@cotal-ai/manager 0.78.1 → 0.81.1

package/dist/manager.js

@@ -23,11 +23,11 @@ import { TranscriptReceiver } from "./transcript-receive.js";
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
 import { recordsBucket, epAuthBucket, ensureAuthorityStores, ensureContractStore, createEndpointStreams, contractStoreContext, publishContractArtifact, contractArtifactCanonicalBytes, standaloneConnectOpts, rawDigest, STANDING_RENEWABLE_TTL_SEC as MANAGED_STATIC_TTL_SEC, newArtifactSigner, RotatingSigner, generationAnchor, sessionsBucket, SESSION_GRANT_MAX_TTL_MS, REMOTE_MANAGER_IDENTITY_NAMES, } from "@cotal-ai/core";
-// P2 item 6: the manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
+// The manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
 // standup for `attach`, over a dedicated standing session-LEDGER connection (the byte rails ride
 // per-session credentials on their own short-lived connections).
 import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
-// P2 item 1 (1a-serve): the manager as an ordinary v0.4 `service` endpoint — the §13.1
+// The manager as an ordinary v0.4 `service` endpoint — the §13.1
 // endpoint-serve credential subsystem (gate provisioning, registration barrier, mint fence) plus
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
 import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, requestGoalCancel, goalAlreadyTerminal, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
@@ -255,10 +255,10 @@ function parseTurnNote(raw) {
         return undefined;
     return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, owner: n.owner, ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}), ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
 }
-/** A turn relay's key in the manager's maps: the caller triple and goal id the goal plane stores
- *  the turn under, because a goal id is the caller's own (SPEC 13.6 item 1) and two callers may
- *  pick the same one. Every part is a subject token, so the dotted join is unambiguous. */
-function turnKey(ref) {
+/** A goal's key in the manager's maps: the caller triple and goal id the goal plane stores the
+ *  goal under, because a goal id is the caller's own (SPEC 13.6 item 1) and two callers may pick
+ *  the same one. Every part is a subject token, so the dotted join is unambiguous. */
+function goalKey(ref) {
     return `${ref.caller.owner}.${ref.caller.actor}.${ref.caller.uid}.${ref.goalId}`;
 }
 /** A turn hold's token, DERIVED (same recipe as the runtime's pause tokens) from the relay key, so
@@ -329,13 +329,13 @@ const STORE_CHALLENGE_TIMEOUT_MS = 5_000;
 export class Manager {
     space;
     servers;
-    /** P2 item 6: the broker ws listener port (loopback) `cotal up` allocated, for the console session
+    /** The broker ws listener port (loopback) `cotal up` allocated, for the console session
      *  client's wsUrl. Undefined ⇒ no console session client (POST /session 503s). */
     wsPort;
     name;
     workspaceRoot;
     eventsRequired;
-    /** P2 item 6: the operator-set global live-session ceiling (see {@link ManagerOptions.maxSessions}). */
+    /** The operator-set global live-session ceiling (see {@link ManagerOptions.maxSessions}). */
     maxSessions;
     /** The ONE secret store for every kind this manager touches (daemon-cred remint + agent kinds).
      *  See {@link ManagerOptions.secretStore}. */
@@ -401,7 +401,7 @@ export class Manager {
      *  never reused across restarts) — the endpoint's presence key AND the `managerInstance` audit
      *  coordinate every static activation records. */
     managerLifecycleUid = mintLifecycleUid();
-    /** The persisted LOGICAL instance id (SPEC 13.6 item 7, P2 item 3): STABLE across restart, so a
+    /** The persisted LOGICAL instance id (SPEC 13.6 item 7): STABLE across restart, so a
      *  restart re-registers the SAME id with an ADVANCED epoch through the §13.1 gate (the successor
      *  fences the predecessor's epoch — the (i) fence bites on a real restart). It is the registration
      *  instanceId, the served-status id, the goal spec's executor.instanceId, the epe route, and the
@@ -412,19 +412,19 @@ export class Manager {
      *  {@link provisionEndpointGateOpen} idempotent (no core barrier change) and gives verified
      *  eviction a stable target (the predecessor's connections under this principal). Set in start(). */
     managerServeIdentity;
-    /** P2 item 1 (1a-serve): the manager's v0.4 service-endpoint serve state — the serve handle +
+    /** The manager's v0.4 service-endpoint serve state — the serve handle +
      *  its dedicated connection, the STABLE serve identity (renewals re-mint the same nkey), the
      *  branded serve grant, and the CURRENT credential (the connection's authenticator reads it on
      *  every (re)connect, so a renewal is adopted without re-registration). Absent on open meshes,
-     *  in user mode (the named 1a follow-up), and before registration completes. */
+     *  in user mode, and before registration completes. */
     serviceServe;
     /** #1577: serve connections whose transport is down while the client reconnects them. Such a
      *  connection is open (`isClosed()` is false under unbounded reconnects) yet the broker holds
      *  none of its rails, so the liveness responder must not grade it `bound`. Keyed by the
      *  connection, so a re-dial that swaps in a fresh one starts from its own state. */
     serveTransportDown = new WeakSet();
-    /** P2 item 2 (spawn-as-action): the SELF-MEDIATED goal-writer connection + ActionContext — a
-     *  standing connection DISJOINT from the serve credential (Q2), scoped to exactly this endpoint's
+    /** The spawn-as-action SELF-MEDIATED goal-writer connection + ActionContext — a
+     *  standing connection DISJOINT from the serve credential, scoped to exactly this endpoint's
      *  goal bind/terminal facts + goal-record writes ({@link goalWriterGrants}). Auth mode mints the
      *  `goal-writer` cred; an open mesh uses a bare connection (no credential system to mint from).
      *  `gate` (auth mode) is the own-issuance-gate READER for the own-gate currency belt — the
@@ -442,31 +442,31 @@ export class Manager {
      *  live) and stashed here for {@link startGoalWriter} to build the standing connection from. */
     goalWriterIdentity;
     goalWriterCreds;
-    /** P2 item 6: the manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
+    /** The manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
      *  standup for `attach`. The face's establisher and the CLI attach handler both call THIS one
      *  plane; the manager never constructs a second. Undefined until {@link startSessionPlane}. */
     sessionPlane;
-    /** P2 item 6: the standing session-LEDGER connection + its mutable creds holder (the authenticator
+    /** The standing session-LEDGER connection + its mutable creds holder (the authenticator
      *  presents the refreshed cred on the next reconnect after a half-TTL renewal — the goal-writer
      *  precedent). Auth mode only; an open mesh runs the plane over a bare connection. */
     sessionLedgerConn;
     /** Renews the session signing key long before its window closes. A key that expires unattended
      *  takes the whole session plane down until the manager is restarted, which kills live sessions. */
     sessionKeyRenewTimer;
-    /** P2 item 6: credentialId → the nkey that credential was minted for, for the live per-session
+    /** Maps credentialId → the nkey that credential was minted for, for the live per-session
      *  SERVING credentials. The §13.1 ledger row records the holder principal, and the row is written
      *  at stage time (after the mint), so the two steps need this one hop. Entries are dropped at
      *  revoke; a session that never staged drops its entry when the manager exits. */
     sessionServingKeys = new Map();
-    /** P2 item 6: the STABLE session-LEDGER identity (auth mode) — minted once at registration
+    /** The STABLE session-LEDGER identity (auth mode) — minted once at registration
      *  alongside the serve + goal-writer identities; a renewal re-mints the SAME nkey with a fresh
      *  bounded exp and re-stages its distinct credId into the §13.1 revocation family. The current
      *  credential is minted INSIDE {@link registerManagerService}'s run block and stashed here. */
     sessionLedgerIdentity;
     sessionLedgerCreds;
-    /** P2 item 2: the acceptance replied for each in-flight goalId this incarnation accepted, so an
-     *  idempotent same-goalId retry serves the IDENTICAL acceptance (same allocated name/triple) without
-     *  a second spawn. Durable cross-incarnation reconstruction rides the goal index; here the
+    /** The acceptance replied for each in-flight goal this incarnation accepted, by {@link goalKey},
+     *  so an idempotent same-goalId retry serves the IDENTICAL acceptance (same allocated name/triple)
+     *  without a second spawn. Durable cross-incarnation reconstruction rides the goal index; here the
      *  live map covers same-incarnation retries, with the committed result fact as the fallback. */
     goalAcceptances = new Map();
     /** The boot reconcile of the durable goal index runs ONCE at start (a
@@ -474,12 +474,12 @@ export class Manager {
      *  Spawn-as-action REFUSES to accept until it completes, so the sweep never races a live goal's
      *  acceptance (settling one mid-flight would steal its real terminal). */
     goalReconcileDone = false;
-    /** P2 item 2 (M4): the live spawn goal ref for each managed agent name, so a despawn MID-GOAL
+    /** The live spawn goal ref for each managed agent name, so a despawn MID-GOAL
      *  drives the cancel path (transition -> cancel terminal). Cleared when the goal terminalizes. */
     agentGoals = new Map();
     /**
      * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin), by
-     * {@link turnKey}: a same-goal retry serves the identical acceptance; cross-incarnation retries
+     * {@link goalKey}: a same-goal retry serves the identical acceptance; cross-incarnation retries
      * rebuild from the goal-index entry (its acceptance floor + note).
      *
      * One entry per turn this incarnation accepted: the acceptance a duplicate submission is served
@@ -501,7 +501,7 @@ export class Manager {
      * window would hear `not-found` again.
      */
     turnAcceptances = new Map();
-    /** Every relayed turn awaiting its seat's yield, by {@link turnKey}. The seat's `turn-pending` pull
+    /** Every relayed turn awaiting its seat's yield, by {@link goalKey}. The seat's `turn-pending` pull
      *  scans it; the deadline sweep drives expiry; a seat reap stamps its entries `seatDiedAt`, which
      *  the deadline terminal carries as `agentDownAt` so the run reads that death as L4002.
      *  Rebuilt at boot from goal-index entries carrying a turn note. */
@@ -681,7 +681,7 @@ export class Manager {
         this.attach = new AttachEndpoint(() => this.list(), 
         // Initial /feed replay for a connecting console: the current peer roster.
         () => [{ event: "roster", data: this.ep?.getRoster() ?? [] }], opts.consolePort ?? 0, 
-        // P2 item 6: the console's mesh §13.6 session establisher — injected ONLY when a broker ws
+        // The console's mesh §13.6 session establisher — injected ONLY when a broker ws
         // listener exists (cotal up allocated a wsPort). Never a second plane; it drives THE plane.
         opts.wsPort !== undefined ? (name) => this.establishConsoleSession(name) : undefined, 
         // Loopback unless the OPERATOR said otherwise. A broker *dial* address is not a manager *bind*
@@ -889,7 +889,7 @@ export class Manager {
             throw new Error(`space "${this.space}" has user-auth state on disk but no mesh registry entry - a user-mode manager needs the authoritative record (\`cotal up\` writes it before the control plane); \`cotal up --user-auth\` this space, or remove the stale ${userAuthStateDir(this.workspaceRoot, this.space)}`);
         if (!this.remoteAuthority && this.userMode && !this.auth)
             throw new Error(`space "${this.space}" has user-auth state but no auth.json under ${authDir(this.workspaceRoot)} - the pre-flip manager still needs the space trust bundle; re-run \`cotal up --user-auth\` here`);
-        // P2 item 3 (SPEC 13.6 item 7): the LOGICAL instance id + serve identity PERSIST across restart
+        // SPEC 13.6 item 7: the LOGICAL instance id + serve identity PERSIST across restart
         // (a space-scoped manager identity file under .cotal). A restart re-registers the SAME id with an
         // ADVANCED epoch (the successor fences the predecessor); a fresh mint over a malformed file is
         // refused loud (no-fallbacks - a restart never silently becomes a fresh instance). A second
@@ -978,7 +978,7 @@ export class Manager {
         this.ep.on("presence-view", () => this.logSeatMeshTransitions());
         await this.ep.start();
         await this.ep.setActivity(`supervisor (${this.runtimeKind})`);
-        // Per-instance liveness lease (P2 item 3 — the old per-space singleton is DEMOTED per D9). Acquire
+        // Per-instance liveness lease (the old per-space singleton is DEMOTED). Acquire
         // THIS logical instance's own key (atomic CAS create). A DIFFERENT instance (a second manager in a
         // second workspace root) has a distinct id ⇒ a distinct key ⇒ it coexists; the create THROWS only
         // when the SAME instance id is already live (a same-root double-start, or a restart racing the
@@ -1035,7 +1035,7 @@ export class Manager {
         const startupReconcile = this.auth && !this.userMode ? this.reconcileStaticLifecycles() : undefined;
         if (startupReconcile)
             void startupReconcile.catch((e) => console.error(`! ${STARTUP_RECONCILING}: ${rejectionText(e)} - no per-alias retry could be planned; a later manager start re-reads unfinished durable terminals`));
-        // P2 item 1 (1d): the manager serves NO ctl tiers - its whole control surface is the v0.4
+        // The manager serves NO ctl tiers - its whole control surface is the v0.4
         // service endpoint registered below. The old three-tier rail (self/manager/admin) is deleted;
         // `ctl.delivery`/`ctl.delivery-admin` (the delivery daemon) and `ctl.auth-admin` (the auth
         // plane) are separate services and keep their rails.
@@ -1101,8 +1101,8 @@ export class Manager {
         // the fence before it can publish a fresh service registration after shutdown.
         if (this.staticReconcileStopping)
             return;
-        // P2 item 1: register the manager as an ordinary v0.4 `service` endpoint (SPEC §13.7/§13.9)
-        // and serve its typed command surface on the ep rails - since 1d the ONLY control door, in
+        // Register the manager as an ordinary v0.4 `service` endpoint (SPEC §13.7/§13.9)
+        // and serve its typed command surface on the ep rails - the ONLY control door, in
         // EVERY mesh mode. Static + user meshes mint the scoped executor + endpoint-serve credential;
         // an open mesh runs the same gate/registration ceremony over bare connections and never mints
         // (there is no credential system - the broker enforces nothing, matching the old open-mesh ctl
@@ -1110,10 +1110,10 @@ export class Manager {
         await this.registerManagerService();
         if (this.staticReconcileStopping)
             return;
-        // P2 item 2: stand up the standing goal-writer connection for spawn-as-action — AFTER
+        // Stand up the standing goal-writer connection for spawn-as-action — AFTER
         // registration (it writes this endpoint's goal facts/records), disjoint from the serve cred.
         await this.startGoalWriter();
-        // P2 item 6: stand up the ONE §13.6 session plane for `attach` — AFTER registration too (it
+        // Stand up the ONE §13.6 session plane for `attach` — AFTER registration too (it
         // rides the serve grant's epoch + the family-staged session-ledger cred), on its own standing
         // connection disjoint from both the serve and goal-writer creds.
         await this.startSessionPlane();
@@ -1483,7 +1483,7 @@ export class Manager {
                     }
                 }
             }
-            // P2 item 1 (checklist 7): the manager is the `endpoint-serve` renewal owner for its OWN
+            // The manager is the `endpoint-serve` renewal owner for its OWN
             // service credential — re-mint the SAME serve identity with a fresh bounded exp THROUGH the
             // §13.1 mint fence over a scoped one-shot executor (every renewal stages a distinct ledger
             // row and wins the gate CAS; never the standing connection). The serve connection's
@@ -1529,7 +1529,7 @@ export class Manager {
                     console.error(`! goal-writer renewal: ${rejectionText(e)} - spawn-as-action stops accepting at this cred's expiry unless the manager restarts`);
                 }
             }
-            // P2 item 6: the manager is also the session-ledger's renewal owner — re-mint the SAME nkey
+            // The manager is also the session-ledger's renewal owner — re-mint the SAME nkey
             // with a fresh bounded exp AND re-stage its new credId into the §13.1 family, through the
             // scoped executor. Without this the standing session-ledger connection dies at its TTL and
             // `attach` stops establishing sessions until a restart. The connection's authenticator presents
@@ -2644,7 +2644,7 @@ export class Manager {
             return { ok: false, error: rejectionText(e) };
         }
     }
-    /** The ONE shared control-admission chokepoint (P2 item 1, checklist 3/8) BOTH dispatch doors
+    /** The ONE shared control-admission chokepoint BOTH dispatch doors
      *  run — the v0.3 `ctl` door ({@link handle}) and the v0.4 `ep` service handlers
      *  ({@link serveGated}): the maintenance/resume fence (`beginLifecycle`: a resume-pending or
      *  non-active manager accepts no ordinary control work) and then the F5(a) membership gate
@@ -2679,7 +2679,7 @@ export class Manager {
             admission.release();
         }
     }
-    /** The ep door's ADMIN flag for a caller (the 1c tier refinement). Static mesh: `true` — the
+    /** The ep door's ADMIN flag for a caller. Static mesh: `true` — the
      *  admin-grade rows (any-mode despawn/attach, the `manager.admin` family, `launch`) are minted
      *  only into operator instruments (§13.2: `any` is operator-policy-mintable; the agent/spawn
      *  rollups never carry them), so REACHING the handler is holding the admin tier, exactly as
@@ -2688,9 +2688,9 @@ export class Manager {
      *  subject-parsed caller tuple to its host-owned authorization callback, with no participant-ledger
      *  fallback. The same fresh authority drives {@link psOwnerFilter}, so a revoked scope demotes the
      *  very next call even on a still-valid bearer. Local ledger read failures authorize nothing;
-     *  remote host-state faults throw and fail the operation closed. NAMED RESIDUAL (critic,
-     *  1c.2b): the static `true` has no serve-time
-     *  re-check — a LEAKED static admin instrument keeps its reach until the credential's bounded
+     *  remote host-state faults throw and fail the operation closed.
+     *  NAMED RESIDUAL: the static `true` has no serve-time re-check — a LEAKED static admin
+     *  instrument keeps its reach until the credential's bounded
      *  TTL (the one-shot 5-minute profile), the same static-revoke≠reconnect-death class ruled
      *  across this campaign; static revocation is the TTL, not a ledger. */
     async epAdminReach(caller) {
@@ -2796,15 +2796,15 @@ export class Manager {
         if (accepted.by !== agent.name)
             throw new EpEnvelopeError("permission-denied", `run-answer amend is allowed to ${agent.name} only for an answer recorded under its own name; this step's accepted answer is ${JSON.stringify(accepted.by)}'s`);
     }
-    /** The v0.4 typed command table (P2 item 1, slice 1b): every ordinary handler runs the SHARED
+    /** The v0.4 typed command table: every ordinary handler runs the SHARED
      *  admission chokepoint ({@link serveGated}) and then delegates to the SAME op core the ctl
-     *  door dispatches (checklist 8: one core, two thin doors). The resume/preservation family
+     *  door dispatches (one core, two thin doors). The resume/preservation family
      *  deliberately BYPASSES serveGated — exactly as it sits before {@link admitControl} on the ctl
      *  door (those ops must run while `resumeRequired` fences ordinary work) — riding its own state
-     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (the 1b rule: static
+     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (static
      *  admin-class commands are capability-gated + untargeted, never a fabricated ledger mode).
      *
-     *  TIER SEMANTICS on the ep door (the 1c grant-migration table): the tier lives in the CALLER'S
+     *  TIER SEMANTICS on the ep door: the tier lives in the CALLER'S
      *  GRANT, refined per-op exactly as the ctl doors refine their subject tier. Owner-mode
      *  `despawn`/`attach` keep the privileged semantics (`admin=false`, own-domain via
      *  {@link authorizeNamed}) — every spawn-capable agent holds those rows. ANY-mode requests are
@@ -2828,13 +2828,13 @@ export class Manager {
         const callerOf = (ctx) => principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
         // A ctl-core failure reply becomes the §13.3 structured error the serve boundary publishes.
         // The data half of a failure reply (e.g. a degraded resume result) rides the error MESSAGE
-        // only — the item-2 action model gives failures a typed channel.
+        // only — the action model gives failures a typed channel.
         const unwrap = (r) => {
             if (!r.ok)
                 throw new EpEnvelopeError("failed-precondition", r.error ?? "the operation failed");
             return r.data;
         };
-        // The admin-family serve gate (1c.2c, security4's hardening): every `manager.admin`-class
+        // The admin-family serve gate: every `manager.admin`-class
         // command re-checks operator reach AT SERVE TIME - static: true (the mint boundary already
         // gates the rows to instruments); user mesh: the caller's CURRENT ledger scope must still
         // carry `admin` ({@link epAdminReach}'s fresh read), so a revoked scope demotes the very next
@@ -2942,8 +2942,8 @@ export class Manager {
                     throw new EpEnvelopeError(persona.error.startsWith("no persona") ? "not-found" : "failed-precondition", persona.error);
                 return { agent: persona.agent };
             }),
-            // P2 item 2: `spawn` is an ACTION - accept a goal + reply the acceptance floor payload, drive
-            // progress + terminal off-handler (no ~30s block). The blocking reply path is gone (pin 8).
+            // `spawn` is an ACTION - accept a goal + reply the acceptance floor payload, drive
+            // progress + terminal off-handler (no ~30s block). The blocking reply path is gone.
             // #373: arming the event plane (events: true, or the omission that arms it by default)
             // follows owner-domain reach on a user mesh. Resolve the caller's admin tier once for
             // the residual cross-owner case; opStart decides before connector resolution or grant
@@ -3013,7 +3013,7 @@ export class Manager {
             // deployer bearer would then bypass owner-equality (operator launch) despite the view holding
             // no admin rows. Uniform owner-equality removes that divergence in the least-privilege
             // direction.
-            // P2 item 2 (ruling 3): manifest `launch` is an ACTION through the SAME chokepoint as spawn -
+            // Manifest `launch` is an ACTION through the SAME chokepoint as spawn -
             // the manifest resolve + owner-equality authz run in opLaunch's accept path, then the goal
             // drives progress + terminal. The acceptance floor is the allocated identity + goal coords.
             launch: (ctx) => this.serveGated(ctx, () => this.serveSpawnGoal(ctx, (h) => this.opLaunch(args(ctx), callerOf(ctx), false, h, ctx.subject.route))),
@@ -3624,7 +3624,7 @@ export class Manager {
             rmSync(a.restart.sessionStatePath, { force: true });
         if (a.seatHome)
             rmSync(a.seatHome, { recursive: true, force: true });
-        // P2 item 6 (pin 4): end any live §13.6 attach session bound to THIS incarnation with the honest
+        // End any live §13.6 attach session bound to THIS incarnation with the honest
         // `target-despawn` reason. Fires once per agent on every free path (despawn / self-stop / reap /
         // exit) via the `agents` guard above; a no-op when no plane or no live session for the target.
         this.sessionPlane?.endForTarget(a.name, a.lifecycleUid, "target-despawn");
@@ -3973,9 +3973,14 @@ export class Manager {
                 console.error(`despawn ${a.name}: the agent's retirement completed; the name is free for reuse`);
             }
         }
-        else {
+        else if (cur) {
             console.error(`despawn ${a.name}: retirement confirmed for a prior lifecycle of "${a.name}"; the current hold is left intact`);
         }
+        else {
+            // No hold stands, as after an orphaned spawn's rollback: that lifecycle was never despawned and
+            // has no successor, so this line names neither.
+            console.error(`retire ${a.name}: lifecycle ${a.lifecycleUid} retired; the name had no hold to clear`);
+        }
     }
     /** The teardown's ASYNC BROKER PHASE: mint the ephemeral target-pinned deprovisioner cred and
      *  delete the agent's broker footprint (dm_/dlv_ durables + read-ACL row). Split from
@@ -4397,7 +4402,7 @@ export class Manager {
         }
         return live;
     }
-    /** THE single name-liveness predicate both the hard-pinned collision refuse (M6, P2 item 2) and
+    /** THE single name-liveness predicate both the hard-pinned collision refuse and
      *  uniqueName's numbering consult, so they can never drift: a name is taken if this manager
      *  reserves/manages/retires it OR a roster-live occupant already holds it. Pass a pre-built
      *  {@link liveRosterNames} set when checking many names in one allocation. */
@@ -4671,9 +4676,9 @@ export class Manager {
     }
     /** The launch fields the host supplies rather than the seat. Spawn and resume both take them from
      *  here, so a resumed seat launches under the same host policy, `eventsRequired` included, as the
-     *  same seat spawned fresh. */
-    hostLaunchFields(agent, shareTools, harness) {
-        const cotalConfig = loadCotalConfig(this.workspaceRoot);
+     *  same seat spawned fresh. The caller passes the cotal config it judged the launch by, so the
+     *  servers and env allowlist come from the contents its checks read. */
+    hostLaunchFields(cotalConfig, agent, shareTools, harness) {
         return {
             space: this.space,
             servers: this.servers,
@@ -5024,6 +5029,17 @@ export class Manager {
             if (this.userMode)
                 return { ok: false, error: "supervise is a restart policy this host cannot enforce: a user-mode seat has no static slot to keep the incarnation owned across a process death" };
         }
+        // One read of the cotal config per spawn: the delegated refusal, the model policy and the launch
+        // fields below all take this value, so the awaits between the policy check and the launch cannot
+        // admit the seat under one file and launch it with another's servers and env allowlist. Read per
+        // spawn, so a policy edit reaches the next spawn without a restart.
+        let cotalConfig;
+        try {
+            cotalConfig = loadCotalConfig(this.workspaceRoot);
+        }
+        catch (e) {
+            return { ok: false, error: rejectionText(e) };
+        }
         // A delegated seat starts outside this host from values alone, so a choice only this host can
         // honour is refused here, before enrollment, and named rather than dropped.
         if (this.requiredRuntime.spawnDelegated) {
@@ -5042,7 +5058,7 @@ export class Manager {
                 return { ok: false, error: `${delegatedBy}, so it cannot reopen a session held on this host (continuity: exact)` };
             if (typeof opts.cwd === "string" && opts.cwd !== "")
                 return { ok: false, error: `${delegatedBy}, so it cannot run in a directory on this host's filesystem (cwd); the seat runs in its runtime resource's own directory` };
-            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, opts.shareTools));
+            const shared = Object.keys(connectorServers(cotalConfig, agent, opts.shareTools));
             if (shared.length)
                 return { ok: false, error: `${delegatedBy}, so it cannot share MCP servers that run on this host (${shared.join(", ")}); pass --share-tools none` };
         }
@@ -5160,22 +5176,16 @@ export class Manager {
         // #581: the operator's per-role model allowlist, judged on the EFFECTIVE role and model resolved
         // above, before any reserve or mint. This is where the launch is performed, so no caller can
         // skip it, and a definition pinned to a stale model (or to none) is refused here instead of
-        // serving on it. Read per spawn, so a policy edit reaches the next spawn without a restart.
-        let policyRefusal;
-        try {
-            policyRefusal = modelPolicyRefusal(loadCotalConfig(this.workspaceRoot), {
-                persona: opts.resolved ? `manifest agent "${ref}"` : `persona "${ref}" (${configPath})`,
-                role, model, variant,
-                // A manifest launch carries its own declared model/variant in these options
-                // (launchAgentToStartOpts), so there they are the definition's field, never a flag.
-                modelFlag: !opts.resolved && opts.model !== undefined,
-                variantFlag: !opts.resolved && opts.variant !== undefined,
-                launchOptions,
-            });
-        }
-        catch (e) {
-            return { ok: false, error: rejectionText(e) };
-        }
+        // serving on it.
+        const policyRefusal = modelPolicyRefusal(cotalConfig, {
+            persona: opts.resolved ? `manifest agent "${ref}"` : `persona "${ref}" (${configPath})`,
+            role, model, variant,
+            // A manifest launch carries its own declared model/variant in these options
+            // (launchAgentToStartOpts), so there they are the definition's field, never a flag.
+            modelFlag: !opts.resolved && opts.model !== undefined,
+            variantFlag: !opts.resolved && opts.variant !== undefined,
+            launchOptions,
+        });
         if (policyRefusal)
             return { ok: false, error: policyRefusal };
         // The alias-reuse gate (#29 piece 3): a name whose previous agent is still retiring REFUSES
@@ -5230,9 +5240,9 @@ export class Manager {
         // unconditional: a half-wired endpoint without the seam must fail loud here, not silently
         // allocate off a pre-snapshot roster.
         await this.ep.waitForPresenceSnapshot();
-        // M6 (P2 item 2 spawn-as-action): a HARD-PINNED name — an imperative `--name`/identity override
+        // Spawn-as-action: a HARD-PINNED name — an imperative `--name`/identity override
         // or a manifest-declared name (opts.resolved) — that collides with a LIVE/provisioning/reserved
-        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `_2`
+        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind, never a silent `_2`
         // suffix (so an address-by-triple caller's pinned name can't be re-pointed). A PERSONA-DERIVED
         // base name (no pin) keeps uniqueName's collision numbering, so multi-peer `spawn reviewer` twice
         // still yields reviewer + reviewer_2. The alias-reuse gate above is orthogonal and already fired.
@@ -5243,7 +5253,7 @@ export class Manager {
             // this manager's agents/reserved/retiring PLUS the roster-live set) - a hard-pinned name
             // colliding with ANY live incarnation (managed, unmanaged foreground/connector, or another
             // manager's agent) refuses cleanly at accept, rather than minting the collision and black-
-            // holing on the broker/auth refusal (item 3: a pinned name live under another manager MUST refuse).
+            // holing on the broker/auth refusal (a pinned name live under another manager MUST refuse).
             if (this.nameInUse(identityName))
                 return { ok: false, error: `the name "${identityName}" is hard-pinned (${opts.resolved ? "manifest-declared" : "--name/identity override"}) but is already held by a live incarnation (managed here, an unmanaged foreground/connector session, or another manager's agent); a pinned same-name collision refuses at accept - pick another name or despawn the existing one` };
             name = identityName;
@@ -5285,11 +5295,11 @@ export class Manager {
             // before anything recorded how to address them, so a crash in that window left a live seat
             // outside every manager and the successor retired the slot over it.
             const custody = this.reserveCustody();
-            // ACCEPT SEAM (P2 item 2 spawn-as-action): the incarnation identity is minted and NOTHING has
+            // ACCEPT SEAM (spawn-as-action): the incarnation identity is minted and NOTHING has
             // been provisioned yet — the action serve path binds the goal + replies the acceptance HERE. A
             // throw (bind conflict / duplicate goalId) aborts the spawn before provisioning: the catch below
             // returns the failure and the finally releases the reserve, so a refused accept leaves zero
-            // footprint (pin 1). The hosted enrollment arm is the exception, below. Blocking callers
+            // footprint. The hosted enrollment arm is the exception, below. Blocking callers
             // (roster boot) pass no hooks and this is a no-op.
             // The ALLOCATED agent's addressing triple (the acceptance floor names what was actually
             // allocated, never the requested-but-unallocated name). Static/open key on DEV_OWNER + the
@@ -5462,7 +5472,7 @@ export class Manager {
                 : undefined;
             const manifestSha256 = manifestPath ? this.fileDigest(manifestPath) : undefined;
             const launchOpts = {
-                ...this.hostLaunchFields(agent, opts.shareTools, harness),
+                ...this.hostLaunchFields(cotalConfig, agent, opts.shareTools, harness),
                 name,
                 role,
                 // User mode: the principal IS the identity (the endpoint derives card.id from owner+actor);
@@ -5521,7 +5531,7 @@ export class Manager {
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
                 handle = await this.spawnCustodied(name, spec, cwd, custody);
             }
-            hooks?.onLaunched?.(); // P2 item 2: the "launched" progress edge (process spawned, pre-presence)
+            hooks?.onLaunched?.(); // The "launched" progress edge (process spawned, pre-presence)
             const managed = {
                 name,
                 role,
@@ -5688,7 +5698,7 @@ export class Manager {
             // OMIT an absent role: the goal terminal commits this data through the strict
             // canonicalJson (undefined never coerces to null, SPEC 13.6), so a role-less spawn would
             // otherwise fail its succeeded terminal. The CLI/connector already render an absent role as
-            // "no role", so dropping the key preserves the reply (P2 item 2, surfaced by readiness:live).
+            // "no role", so dropping the key preserves the reply (surfaced by readiness:live).
             const okData = { name, agent, id: managed.id, mode: handle.kind, lifecycleUid, ...(role !== undefined ? { role } : {}), ...(opts.eventsNotice !== undefined ? { eventsNotice: opts.eventsNotice } : {}) };
             await hooks?.onOutcome?.({ kind: "succeeded", data: okData });
             return { ok: true, data: okData };
@@ -6179,7 +6189,7 @@ export class Manager {
             }
             try {
                 const launchOpts = {
-                    ...this.hostLaunchFields(entry.launch.connector, entry.launch.shareTools, harness),
+                    ...this.hostLaunchFields(loadCotalConfig(this.workspaceRoot), entry.launch.connector, entry.launch.shareTools, harness),
                     name: entry.name,
                     role: entry.role,
                     id: authority.id,
@@ -6635,7 +6645,7 @@ export class Manager {
             return { ok: false, error: `no agent "${name}"` };
         return this.despawnCore(a, caller, admin, args.graceful !== false);
     }
-    /** The ONE named-terminal core both doors share (P2 item 1, checklist 8): the ctl named `stop`
+    /** The ONE named-terminal core both doors share: the ctl named `stop`
      *  and the v0.4 targeted `despawn` are the same terminal — authorize by the shared policy
      *  ({@link authorizeNamed}: own-child / owner-domain on privileged, any on admin), stop, track.
      *  The ep door runs the SAME two pieces separately so a policy denial surfaces as the §13.3
@@ -6653,14 +6663,15 @@ export class Manager {
     despawnAuthorized(a, graceful, trackNonAdmin, caller) {
         this.stopHandle(a, graceful);
         this.trackStoppedHandle(a, trackNonAdmin, { kind: "stopped-requested", requester: caller });
-        void this.cancelAgentGoal(a.name, graceful ? "graceful" : "terminate"); // M4: cancel a live spawn goal
+        void this.cancelAgentGoal(a.name, graceful ? "graceful" : "terminate"); // Cancel a live spawn goal
         return { ok: true, data: { name: a.name, stopped: true, graceful } };
     }
     /** Retire one agent this manager launched under a delegated user intent, through the host
      *  (SPEC 13.16). It sends the user's retirement intent for the UID of the running slot or its
-     *  retirement hold, and only on `retired: true` for that exact target stops the slot and frees the
-     *  name; every other answer leaves the slot running or the name held. It never calls the holder's
-     *  own prepare or requester. */
+     *  retirement hold, and only on `retired: true` for that exact target stops the slot, shreds the
+     *  seat's local secret family and frees the name; every other answer leaves the slot running or
+     *  the name held, and a failed shred keeps the name held. It never calls the holder's own prepare
+     *  or requester. */
     async retireDelegatedAgent(name, intentId) {
         const execute = this.remoteAuthority?.executeDelegatedUserIntent;
         if (!execute)
@@ -6696,6 +6707,17 @@ export class Manager {
             const slot = this.agents.get(name);
             if (slot?.lifecycleUid === target.lifecycleUid)
                 this.despawnAuthorized(slot, true, false, `delegated retirement ${intentId}`);
+            // The host owns the grant and the footprint, but the secret family enrollUserAgent wrote here
+            // is this participant's, and no teardown arm of a delegated seat removes it.
+            const unshredded = [];
+            await this.shredUserSecrets(unshredded, (live ?? held?.target)?.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, name, target.lifecycleUid));
+            if (unshredded.length) {
+                const error = `the host retired "${name}" at ${target.lifecycleUid}, but cleanup failed: ${unshredded.join("; ")}; the name stays held until a retried retirement intent removes it`;
+                const hold = this.retiring.get(name);
+                if (hold?.target.lifecycleUid === target.lifecycleUid)
+                    hold.lastError = error;
+                return { ok: false, error };
+            }
             this.confirmRetirement({ id: principalKey(target.owner, target.actor).key, name, lifecycleUid: target.lifecycleUid });
             return { ok: true, data: { name, lifecycleUid: target.lifecycleUid, retired: true } };
         }
@@ -6808,7 +6830,7 @@ export class Manager {
             await nc.drain().catch(() => nc.close());
         }
     }
-    /** 1d open-mesh counterpart of {@link withEndpointServeExecutor}: an OPEN mesh has no
+    /** The open-mesh counterpart of {@link withEndpointServeExecutor}: an OPEN mesh has no
      *  credential system, so there is no scoped executor to mint - the same §13.1 gate/records
      *  writes ride a bare one-shot connection (the broker enforces nothing on an open mesh; the
      *  ceremony still produces the real gate, epoch, and registration the serve rails run on). */
@@ -6829,7 +6851,7 @@ export class Manager {
             await nc.drain().catch(() => nc.close());
         }
     }
-    /** The served manager-level health summary (1a's one read-only command). */
+    /** The served manager-level health summary. */
     managerStatusData() {
         return {
             instanceId: this.managerInstanceId,
@@ -6936,7 +6958,7 @@ export class Manager {
         })().catch(() => this.serveTransportDown.add(nc));
         let handle;
         try {
-            // The 1b typed surface + the derived `describe`. The descriptor stays PUBLIC in static
+            // The typed surface + the derived `describe`. The descriptor stays PUBLIC in static
             // mode: the broker grant (who holds each command's request-publish row) is the
             // load-bearing authority tier, and a static single-operator mesh leaks nothing by listing
             // command names; the trusted per-caller `view(caller)` scoping joins the user-mode
@@ -7029,8 +7051,8 @@ export class Manager {
         await this.stop();
         process.exit(1);
     }
-    /** P2 item 1: register the manager as an ordinary v0.4 `service` endpoint and serve its typed
-     *  command surface on the ep rails - since 1d the manager's ONLY control door. On an AUTH mesh
+    /** Register the manager as an ordinary v0.4 `service` endpoint and serve its typed
+     *  command surface on the ep rails - the manager's ONLY control door. On an AUTH mesh
      *  the whole credential path is the SAME one an ordinary endpoint traverses (the enforcement
      *  test that keeps "ordinary" honest): provision the §13.1 issuance gate, drive the
      *  registration BARRIER's gate CAS, then release the serve credential only on the mint FENCE's
@@ -7065,7 +7087,7 @@ export class Manager {
             console.error(`remote manager service endpoint activated: ${MANAGER_ENDPOINT}/${this.managerInstanceId} (epoch ${state.grant.epoch})`);
             return;
         }
-        // The §13.7 contract store is REGISTRATION's dependency, ensured here MODE-NEUTRALLY (1c.2c):
+        // The §13.7 contract store is REGISTRATION's dependency, ensured here MODE-NEUTRALLY:
         // it used to ride the static-only lifecycle reconcile, so a USER-mode manager registered
         // against an absent stream and its artifact publish died no-responders (live-repro'd). A
         // provisioner one-shot creates-or-verifies it (config-B immutability incl. the shadowed-legacy
@@ -7075,7 +7097,7 @@ export class Manager {
             const provCreds = auth ? await mintCreds(auth, newIdentity(), "provisioner") : undefined;
             const provNc = await this.dial({ ...standaloneConnectOpts({ creds: provCreds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
             try {
-                // P2 item 2: the manager now WRITES goal facts (EPF) + progress events (EPE), so the §13.12
+                // The manager now WRITES goal facts (EPF) + progress events (EPE), so the §13.12
                 // endpoint streams must exist. Nothing provisioned them before spawn-as-action (no endpoint
                 // wrote to EPF/EPE), so the manager ensures the full set here over the provisioner (whose
                 // STREAM.CREATE now covers them), idempotently - createEndpointStreams is a superset of
@@ -7103,7 +7125,7 @@ export class Manager {
         const authority = {
             authorize: (name, owner) => ({ authorized: name === MANAGER_ENDPOINT && owner === DEV_OWNER, revision: 0 }),
         };
-        // The STABLE serve identity (P2 item 3): the PERSISTED serve nkey, reused across restart so the
+        // The STABLE serve identity: the PERSISTED serve nkey, reused across restart so the
         // gate binds the SAME principal (§13.1 serving-principal binding) - provisionEndpointGateOpen
         // stays idempotent and verified eviction has a stable target. Renewals re-mint the same nkey
         // with a fresh bounded exp; a restart re-provisions the same (idempotent) gate + re-registers.
@@ -7114,7 +7136,7 @@ export class Manager {
         // The STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
         // (not the gate's bound serving principal), so the run block can family-stage it.
         this.goalWriterIdentity = siblings.goalWriter;
-        // P2 item 6: the STABLE session-LEDGER identity — another SIBLING in the SAME §13.1 family, so
+        // The STABLE session-LEDGER identity — another SIBLING in the SAME §13.1 family, so
         // the takeover barrier revokes a deposed manager's ledger cred alongside its goal-writer. The
         // per-session serving creds join the same family, each with its own fresh identity.
         this.sessionLedgerIdentity = siblings.sessionLedger;
@@ -7135,17 +7157,17 @@ export class Manager {
             }
         };
         const publishAndProvision = async ({ authKv, nc: execNc }) => {
-            // §13.7 contract-artifact publication (1c): every schema root + its closure manifest, plus
+            // §13.7 contract-artifact publication: every schema root + its closure manifest, plus
             // the cluster document + ITS manifest, land in the EPC store BEFORE the registration that
             // advertises their digests — so a caller can always fetch-verify-compile a registered
-            // digest (the item-5 generic-invoke read path). Create-only + content-addressed: a retry
+            // digest (the generic-invoke read path). Create-only + content-addressed: a retry
             // or a same-artifact republish is an idempotent lost-CAS. The registration itself still
             // verifies against the in-memory copies (the manager is the author).
             const storeCtx = await contractStoreContext(execNc, this.space);
             for (const value of [...managerContractArtifactValues(), artifacts.document, artifacts.manifest])
                 await publishContractArtifact(storeCtx, contractArtifactCanonicalBytes(value));
-            // §13.1 pre-registration (checklist 1): the issuance gate, born open@gen0 bound to the serve
-            // principal — provisioned ONCE, on the FIRST registration. On a RESTART (P2 item 3) the gate
+            // §13.1 pre-registration: the issuance gate, born open@gen0 bound to the serve
+            // principal — provisioned ONCE, on the FIRST registration. On a RESTART the gate
             // already EXISTS (advanced past gen0 by the prior registration), so re-provisioning the gen0
             // row would conflict "foreign content"; the persisted instanceId makes this a TAKEOVER, and
             // registerServiceInstance below freezes + re-registers the EXISTING gate (advancing the epoch
@@ -7156,7 +7178,7 @@ export class Manager {
         };
         const completeRegistration = async ({ recordsKv, authKv, nc: execNc }) => {
             await publishAndProvision({ recordsKv, authKv, nc: execNc });
-            // P2 item 3 (slice 3a): on an AUTH mesh a RE-registration (restart of the persisted instanceId)
+            // On an AUTH mesh a RE-registration (restart of the persisted instanceId)
             // must VERIFY-EVICT the superseded serve family BEFORE the epoch advances (§13.1 "old authority
             // dies before new authority is visible"). Inject the SCOPED delivery-admin evictor; the OPEN
             // mesh mints no serve family, so no evictor (the empty-family path never consults it and a
@@ -7186,7 +7208,7 @@ export class Manager {
             // authKv (the fence is live), so its credId lands in `epcred.<e>.<iid>` and the takeover
             // barrier revokes it. Open mesh: no mint (no credential system; the goal-writer conn is bare).
             const goalWriterCreds = auth ? await this.mintAndStageGoalWriter(authKv) : undefined;
-            // P2 item 6: mint + family-stage the session-LEDGER credential HERE too (same executor, same
+            // Mint + family-stage the session-LEDGER credential HERE too (same executor, same
             // fence, same §13.1 family), so takeover revokes a deposed manager's ledger connection. The
             // per-session SERVING credentials are minted later, one per redemption, into the SAME family.
             // Open mesh: no mint (no credential system; the ledger connection stays bare).
@@ -7249,7 +7271,7 @@ export class Manager {
         const auth = this.auth;
         const identity = this.goalWriterIdentity;
         // The issuance gate + §13.1 revocation family are keyed by the REGISTRATION instanceId
-        // (the persisted logical id, item 3's split), NOT the per-process lifecycleUid — the barrier
+        // (the persisted logical id), NOT the per-process lifecycleUid — the barrier
         // enumerates `epcred.<e>.<managerInstanceId>`, so the goal-writer must stage into that family.
         const iid = this.managerInstanceId;
         const creds = await mintCreds(auth, identity, "goal-writer", { goalWriter: { endpoint: MANAGER_ENDPOINT } });
@@ -7287,8 +7309,8 @@ export class Manager {
         });
         nc.closed().then((err) => { void this.onGoalWriterConnectionClosed(err ?? undefined); });
         gw.nc = nc;
-        // The (i) fence resolver (SPEC 13.6 P2 item 3): resolve an executing instance's CURRENT gate
-        // epoch. This manager reconciles only ITS OWN goals (security pin 4), so it resolves its own
+        // The (i) fence resolver (SPEC 13.6): resolve an executing instance's CURRENT gate
+        // epoch. This manager reconciles only ITS OWN goals, so it resolves its own
         // registration instanceId to this incarnation's serve-grant epoch; a foreign/retired instance
         // is `null` (no current terminal to surface). A successor incarnation carries an ADVANCED epoch
         // here, so its reads pick the current-epoch subject and the predecessor's terminal is fenced out.
@@ -7341,7 +7363,7 @@ export class Manager {
             return;
         console.error("! manager goal-writer could not be re-dialed; leaving the credential to the next renewal pass");
     }
-    /** P2 item 2 (spawn-as-action): stand up the standing self-mediated goal-writer connection +
+    /** Spawn-as-action: stand up the standing self-mediated goal-writer connection +
      *  ActionContext. Mode-dual, mirroring {@link registerManagerService}: an AUTH mesh uses the
      *  scoped `goal-writer` credential already minted + family-STAGED inside registration's run block
      *  ({@link mintAndStageGoalWriter} — DISJOINT grant from the serve cred, SHARED §13.1 revocation
@@ -7375,7 +7397,7 @@ export class Manager {
             catch { /* best effort */ }
         }
     }
-    /** P2 item 6: mint the standing `session-ledger` credential and STAGE it into this instance's
+    /** Mint the standing `session-ledger` credential and STAGE it into this instance's
      *  §13.1 revocation family (`epcred.<e>.<iid>`), over the passed executor's `authKv` — EXACTLY the
      *  {@link mintAndStageGoalWriter} pattern, under the same open-and-commit fence.
      *
@@ -7388,7 +7410,7 @@ export class Manager {
     async mintAndStageSessionLedger(authKv) {
         const auth = this.auth;
         const identity = this.sessionLedgerIdentity;
-        // Registration instanceId (item 3's persisted logical id), not the per-process lifecycleUid:
+        // Registration instanceId (the persisted logical id), not the per-process lifecycleUid:
         // the barrier enumerates `epcred.<e>.<managerInstanceId>`, so the ledger cred joins that family.
         const iid = this.managerInstanceId;
         const fence = serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid });
@@ -7455,7 +7477,7 @@ export class Manager {
             return;
         console.error("! manager session-ledger could not be re-dialed; leaving the credential to the next renewal pass");
     }
-    /** P2 item 6: stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
+    /** Stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
      *  mirroring {@link startGoalWriter}: an AUTH mesh presents the scoped `session-ledger` cred
      *  already minted + family-staged inside registration's run block ({@link mintAndStageSessionLedger});
      *  an OPEN mesh uses a bare connection (no credential system to mint from). The connection presents
@@ -7506,10 +7528,10 @@ export class Manager {
         const keyId = rotating.current().keyId;
         this.sessionPlane = new ManagerSessionPlane({
             space: this.space,
-            // The session's serving identity is the persisted REGISTRATION instanceId (item 3), not the
+            // The session's serving identity is the persisted REGISTRATION instanceId, not the
             // per-process lifecycleUid: a restarted manager re-registers the SAME logical instanceId with
             // an ADVANCED epoch, so a client re-attaches by the same instance while the epoch fences the
-            // old incarnation's sessions (item 6's restart-refusal composed with item 3's addressing).
+            // old incarnation's sessions.
             serving: { instanceId: this.managerInstanceId, epoch: serveEpoch },
             // Read through the rotator on EVERY use rather than capturing a key: signing takes the newest
             // generation, and resolution accepts any generation still inside its overlap so an artifact
@@ -7538,7 +7560,7 @@ export class Manager {
         console.error(`manager session plane standing (endpoint ${MANAGER_ENDPOINT}, epoch ${serveEpoch}, ${(this.auth || this.remoteAuthority) ? "scoped session-ledger cred, §13.1 family-staged" : "open/bare"})`);
     }
     /**
-     * The per-session SERVING credential seam (P2 item 6, SPEC 13.6): the manager mints, gate-stages,
+     * The per-session SERVING credential seam (SPEC 13.6): the manager mints, gate-stages,
      * connects and revokes ONE credential per live session, replacing a standing credential that held
      * `eps.manager.*.<epoch>.{in,out}` and so reached every live session's bytes at its epoch.
      *
@@ -7713,11 +7735,12 @@ export class Manager {
                     await nc.drain().catch(() => nc.close());
                 }
             }
-            // Single-manager item 2: EVERY inherited entry belongs to a DEAD predecessor (only one manager
-            // at a time), so all are reconciled. The `iid` field is the hook item-3's multi-instance sweep
+            // Single-manager: EVERY inherited entry belongs to a DEAD predecessor (only one manager
+            // at a time), so all are reconciled. The `iid` field is the hook the multi-instance sweep
             // filters on (skip a goal whose accepting `iid` is a still-LIVE sibling — never settle its goal).
             for (const entry of entries) {
-                if (this.goalAcceptances.has(entry.ref.goalId) || this.turnAcceptances.has(turnKey(entry.ref)))
+                const key = goalKey(entry.ref);
+                if (this.goalAcceptances.has(key) || this.turnAcceptances.has(key))
                     continue; // never settle a goal THIS incarnation drives
                 try {
                     // A note marks a TURN entry: its relay is rebuilt (the hold is its bounded ending), never
@@ -7788,9 +7811,9 @@ export class Manager {
         const t = setTimeout(() => { settle().catch((e) => console.error(`! goal reconcile settle ${ref.goalId}: ${rejectionText(e)}`)); }, remaining + 100);
         t.unref?.();
     }
-    /** P2 item 2: publish a goal PROGRESS event on the caller-scoped epe subtree, over the SERVE
+    /** Publish a goal PROGRESS event on the caller-scoped epe subtree, over the SERVE
      *  connection (which holds the `epe.<e>.<iid>.<epoch>.>` egress grant; the goal-writer deliberately
-     *  does not). The terminal rides a final event `phase:"terminal"` (Q1 — the caller follows epe to
+     *  does not). The terminal rides a final event `phase:"terminal"` (the caller follows epe to
      *  the terminal; the durable result fact + inspect/ps are the reconcile authority). A dropped event
      *  is non-fatal (the terminal is authoritative in the journal). */
     emitGoalProgress(ref, epoch, event) {
@@ -7838,13 +7861,13 @@ export class Manager {
         if (observed.processEpoch !== epoch)
             throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (SPEC 13.6)`);
     }
-    /** Serve `spawn`/`launch` as an ACTION (P2 item 2). Authz already ran in {@link serveGated}. The
+    /** Serve `spawn`/`launch` as an ACTION. Authz already ran in {@link serveGated}. The
      *  accept path runs INLINE on the handler ({@link startAgent} with hooks): the goal binds + the
-     *  acceptance replies the moment the identity is minted, BEFORE any provision (pin 1), or on the
+     *  acceptance replies the moment the identity is minted, BEFORE any provision, or on the
      *  hosted enrollment arm once the host has enrolled the agent; progress and the terminal are driven
      *  OFF-handler, so the ~30s readiness wait no longer blocks the reply.
      *  Returns the acceptance floor payload {name, owner, actor, uid, goalId, fingerprint, executor}
-     *  (the ALLOCATED identity). goalId = the request id (env.id, Q3). */
+     *  (the ALLOCATED identity). goalId = the request id (env.id). */
     async serveSpawnGoal(ctx, run) {
         if (this.execution === "none")
             throw new EpEnvelopeError("unimplemented", this.executionRefusal());
@@ -7858,14 +7881,15 @@ export class Manager {
         const goalId = ctx.request.id;
         const { fingerprint } = submissionFingerprint(ctx.request, ctx.subject);
         const ref = goalRefOf(ctx.subject, goalId);
+        const key = goalKey(ref);
         const executor = { lifecycleUid: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 };
         const epoch = executor.epoch;
         const acceptedAt = Date.now();
         // Idempotent same-goalId retry (a client re-send): serve the IDENTICAL acceptance without
-        // re-running the accept path — so a HARD-PINNED retry does not trip the M6 same-name refuse and no
+        // re-running the accept path — so a HARD-PINNED retry does not trip the same-name refuse and no
         // name is re-allocated. Same-incarnation rides the live map; the create-only bindGoal in onAccepted
         // still fences a CONCURRENT same-goalId race (the loser aborts and serves the winner's acceptance).
-        const prior = this.goalAcceptances.get(goalId);
+        const prior = this.goalAcceptances.get(key);
         if (prior !== undefined) {
             if (prior.fingerprint !== fingerprint)
                 throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted under a different submission; one goalId never carries two specs (SPEC 13.6)`);
@@ -7969,15 +7993,15 @@ export class Manager {
                     // No claim needed here: `ownsGoal` is still false, so the commit path refuses this attempt.
                     throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted by instance "${idx.existing.iid}"; that instance's acceptance is served and this attempt provisions nothing (SPEC 13.6)`);
                 }
-                // Bind AFTER the accept-path checks (M6/capacity/persona) + identity mint, BEFORE any provision:
-                // a create-only CAS per goalId (pin 1 — a refused accept above left zero bind, zero reserve).
+                // Bind AFTER the accept-path checks (name/capacity/persona) + identity mint, BEFORE any provision:
+                // a create-only CAS per goalId (a refused accept above left zero bind, zero reserve).
                 const b = await bindGoal(gw.ctx, ref, fingerprint);
                 if (!b.bound) {
                     if (b.existing.fingerprint !== fingerprint)
                         throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" is already bound to a different submission; one goalId never carries two specs (SPEC 13.6)`);
                     // Lost a concurrent same-goalId race: serve the winner's acceptance and abort THIS provision
                     // (no second spawn). The throw unwinds to the finally, which releases this attempt's reserve.
-                    acceptance = this.goalAcceptances.get(goalId) ?? await this.cachedSpawnAcceptance(ref, goalId, fingerprint, executor);
+                    acceptance = this.goalAcceptances.get(key) ?? await this.cachedSpawnAcceptance(ref, goalId, fingerprint, executor);
                     resolveAccept(acceptance);
                     // No claim needed here either. This attempt lost the CAS, so `ownsGoal` is still false and
                     // the single check in `onOutcome` refuses it. Before that check existed this site had to
@@ -8001,8 +8025,8 @@ export class Manager {
                     readinessDeadlineMs: readinessTimeoutMs,
                 });
                 acceptance = { name, owner: agentTriple.owner, actor: agentTriple.actor, uid: agentTriple.uid, goalId, fingerprint, readinessDeadlineMs: readinessTimeoutMs, executor };
-                this.goalAcceptances.set(goalId, acceptance);
-                this.agentGoals.set(name, ref); // M4: a despawn of this name mid-goal drives the cancel path
+                this.goalAcceptances.set(key, acceptance);
+                this.agentGoals.set(name, ref); // A despawn of this name mid-goal drives the cancel path
                 resolveAccept(acceptance);
                 this.emitGoalProgress(ref, epoch, { phase: "handoff" });
             },
@@ -8015,7 +8039,7 @@ export class Manager {
             onTerminalDeferred: () => { terminalEntered = true; },
         });
         bg.then((reply) => {
-            // Refused BEFORE onAccepted (M6 hard-pin collision, capacity, persona-not-found) — no goal bound.
+            // Refused BEFORE onAccepted (hard-pin collision, capacity, persona-not-found) — no goal bound.
             if (acceptance === undefined) {
                 const details = reply.details;
                 rejectAccept(new EpEnvelopeError("failed-precondition", reply.error ?? "spawn refused at accept", details));
@@ -8107,7 +8131,7 @@ export class Manager {
         const goalId = ctx.request.id;
         const { fingerprint } = submissionFingerprint(ctx.request, ctx.subject);
         const ref = goalRefOf(ctx.subject, goalId);
-        const key = turnKey(ref);
+        const key = goalKey(ref);
         const executor = { lifecycleUid: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 };
         const acceptedAt = Date.now();
         const prior = this.turnAcceptances.get(key)?.acceptance;
@@ -8366,7 +8390,7 @@ export class Manager {
         const raw = (ctx.request.args ?? {});
         const goalId = String(raw.goalId);
         const ref = goalRefOf(ctx.subject, goalId);
-        const key = turnKey(ref);
+        const key = goalKey(ref);
         const p = this.pendingTurns.get(key);
         if (p === undefined) {
             const ended = await readGoalResult(gw.ctx, ref);
@@ -8407,7 +8431,7 @@ export class Manager {
         const gw = this.goalWriter;
         if (!gw)
             return;
-        const key = turnKey(p.ref);
+        const key = goalKey(p.ref);
         if (!this.pendingTurns.delete(key))
             return;
         this.markTurnLatchDropped(key);
@@ -8581,7 +8605,7 @@ export class Manager {
             console.error(`turn reconcile ${p.goalId}: its deadline hold was never minted (the accept crashed before it); left unsettled`);
             return;
         }
-        const key = turnKey(p.ref);
+        const key = goalKey(p.ref);
         this.pendingTurns.set(key, p);
         // THE ACCEPTANCE TOO, or the adopted turn's answer is never remembered: `rememberSettledTurn`
         // writes only against an acceptance this incarnation holds, and adoption rebuilt the pending
@@ -8605,12 +8629,12 @@ export class Manager {
         console.error(`turn reconcile ${p.goalId}: pending relay to ${p.seat.name}/${p.seat.uid} adopted (deadline ${p.deadlineAt})`);
         this.ensureTurnSweep();
     }
-    /** M4 (settle race): a despawn MID-GOAL drives the goal's cancel terminal - transition to
+    /** Settle race: a despawn MID-GOAL drives the goal's cancel terminal - transition to
      *  `cancelling`, then commit the `cancel` cause on the goal-writer connection. First-terminal-fact
      *  wins: if the readiness outcome already committed (succeeded/failed/uncertain) the transition or
      *  the create-only commit loses gracefully and the readiness terminal stands. Fire-and-forget from
      *  despawn (the process teardown is authoritative for the agent; this settles the GOAL honestly).
-     *  Cancel rides the despawn's own authorizeNamed reach (pin 5) - there is no cancel-by-goalId. */
+     *  Cancel rides the despawn's own authorizeNamed reach - there is no cancel-by-goalId. */
     async cancelAgentGoal(name, mode) {
         const gw = this.goalWriter;
         const ref = this.agentGoals.get(name);
@@ -9161,12 +9185,12 @@ export class Manager {
                     retiredSlots++;
                     continue;
                 }
-                // 3b-2 RECONCILE OWNERSHIP (multi-manager-per-space): a manager adjudicates ONLY the non-retired
+                // RECONCILE OWNERSHIP (multi-manager-per-space): a manager adjudicates ONLY the non-retired
                 // rows THIS logical instance owns. A SIBLING manager's active/provisioning row is LEFT UNTOUCHED —
                 // sweep-terminalizing it would destroy the sibling's live agent (the historical all-agents-kill
-                // hazard, now cross-instance). A legacy row (pre-3b-2, no owner recorded) predates multi-manager,
+                // hazard, now cross-instance). A legacy row (no owner recorded) predates multi-manager,
                 // so this manager is its legitimate single-manager-past successor and reconciles it. An orphaned
-                // sibling row is reclaimed only by an explicit operator CAS takeover (ruling 1), never here.
+                // sibling row is reclaimed only by an explicit operator CAS takeover, never here.
                 if (ownedBySibling(row, this.managerInstanceId)) {
                     preservedForeign++;
                     continue;
@@ -9608,7 +9632,7 @@ export class Manager {
             throw new EpEnvelopeError("unavailable", `input for seat "${a.name}" failed: runtime accepted ${String(bytes)} of ${intendedBytes} bytes`);
         return { name: a.name, bytes };
     }
-    /** The post-authorization attach effect (P2 item 6): mint the holder-bound §13.6 offer, redeem it
+    /** The post-authorization attach effect: mint the holder-bound §13.6 offer, redeem it
      *  through the ONE session plane (one-use CAS + presenter-equality), and stand up the PTY bridge —
      *  atomically. The reply is the SIGNED grant (no ws:// URL, non-bearer, never logged); the caller
      *  redeems it over the mesh with a per-session rails-only cred it mints itself. Only streamable
@@ -9650,7 +9674,7 @@ export class Manager {
         const carried = a.launch.resumed?.host;
         return { ok: true, data: { grant, ...(carried ? { resumedFrom: { host: carried, source: a.launch.resumed.source } } : {}) } };
     }
-    /** P2 item 6: the console's mesh §13.6 session establisher (backing `POST /session/<name>` on the
+    /** The console's mesh §13.6 session establisher (backing `POST /session/<name>` on the
      *  loopback face). Drives THE ONE plane — same establishAttach as the ep `attach` command — with
      *  the loopback OPERATOR as holder (same-host trust boundary), then hands the browser everything it
      *  needs to open the caller rail over the broker ws listener: the holder-bound grant, a per-session