@cotal-ai/manager 0.90.1 → 0.91.0

package/dist/manager.js

@@ -5,6 +5,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, s
 import { isAbsolute, join, dirname, resolve } from "node:path";
 import Headless from "@xterm/headless";
 import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, MANAGER_LEASE_TTL_MS, awaitLeaseExpiry, leaseRemainingMs, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, identityFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, digestIdToken, } from "@cotal-ai/core";
+import { loadLaunchPersonaFile, PersonaSourceError } from "@cotal-ai/workspace";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimIdentityRecord, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, probeLiveness, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceKey, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, exitProof, isCustodialRuntime, pollProvedExit, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, watchProvedExit, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
@@ -33,6 +34,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, requestGoalCancel, goalAlreadyTerminal, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
 import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, walkStaticSlots, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
+import { CHAT_ALIAS_PREFIX, CHAT_EXPIRY_CONCURRENCY, ChatSessionExpiry, chatOpenLists, chatRetireRefusal, drawChatAlias, isChatAlias, readChatOpenInput, readChatRetireInput, sealChatAdmission, } from "./chat-session.js";
 // Capture the loaded package version before an installation can replace its files.
 const MANAGER_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
@@ -415,6 +417,7 @@ export class Manager {
      *  {@link provisionEndpointGateOpen} idempotent (no core barrier change) and gives verified
      *  eviction a stable target (the predecessor's connections under this principal). Set in start(). */
     managerServeIdentity;
+    onServiceIdentity;
     /** The manager's v0.4 service-endpoint serve state — the serve handle +
      *  its dedicated connection, the STABLE serve identity (renewals re-mint the same nkey), the
      *  branded serve grant, and the CURRENT credential (the connection's authenticator reads it on
@@ -525,6 +528,15 @@ export class Manager {
     /** Static aliases whose startup exact-op terminal is still in flight. Scoped per alias: control
      * serves during the sweep, but no caller can reuse or attach an alias the sweep still owns. */
     reconcilingAliases = new Set();
+    /** In-flight static chat-session terminals, by lifecycle UID, so every caller that retires one
+     *  session joins one terminal instead of racing its CAS sequence. */
+    chatRetirements = new Map();
+    /** The expiry side of every chat session this process admitted and nothing retired sooner. */
+    chatExpiry = new ChatSessionExpiry((session) => this.expireStaticChatSession(session), {
+        retryDelaysMs: STATIC_RECONCILE_RETRY_DELAYS_MS,
+        concurrency: CHAT_EXPIRY_CONCURRENCY,
+        log: (line) => console.error(line),
+    });
     /** Current failed/recovered static reconciliation coordinates. This is an operator snapshot, not
      *  lifecycle authority: every re-drive re-reads broker KV and re-runs planStaticSlotResume. */
     staticReconcileItems = new Map();
@@ -641,11 +653,16 @@ export class Manager {
         return dialerFor(servers)({ ...opts, servers });
     }
     constructor(opts) {
+        if (opts.onServiceIdentity !== undefined && typeof opts.onServiceIdentity !== "function")
+            throw new Error("manager onServiceIdentity must be a trusted embedding callback");
         if (opts.execution !== undefined && opts.execution !== "runtime" && opts.execution !== "none")
             throw new Error(`unknown manager execution capability ${JSON.stringify(opts.execution)}`);
-        if (opts.execution === "none" && (!opts.pooled || !opts.remoteAuthority || opts.runtime !== undefined))
-            throw new Error("execution: none requires pooled signerless remote authority and no runtime option");
-        if (opts.execution === "none" && ["renewExecutor", "renewStandingBundle", "mintSessionServing", "mintRetirementRequester", "prepareAgentRetirement", "validateRetainedAgent", "scanGoalIndex", "authorizeAdmin"].some((key) => typeof opts.remoteAuthority?.[key] !== "function"))
+        if (opts.execution === "none" && ((opts.pooled !== undefined && typeof opts.pooled !== "boolean") ||
+            (opts.remoteAuthority !== undefined && (!opts.remoteAuthority || typeof opts.remoteAuthority !== "object" || Array.isArray(opts.remoteAuthority)))))
+            throw new Error("execution: none requires boolean pooled and a non-null remote authority object when supplied");
+        if (opts.execution === "none" && (opts.runtime !== undefined || (!!opts.pooled !== !!opts.remoteAuthority)))
+            throw new Error("execution: none requires pooled signerless remote authority for remote composition, or genuine local authority, and no runtime option");
+        if (opts.execution === "none" && opts.remoteAuthority && ["renewExecutor", "renewStandingBundle", "mintSessionServing", "mintRetirementRequester", "prepareAgentRetirement", "validateRetainedAgent", "scanGoalIndex", "authorizeAdmin"].some((key) => typeof opts.remoteAuthority?.[key] !== "function"))
             throw new Error("execution: none requires complete closed remote authority callbacks before construction");
         if (opts.pooled && (!opts.remoteAuthority || (opts.execution !== "none" && (opts.runtime === undefined || opts.runtime === "auto" || opts.runtime === "pty"))))
             throw new Error("pooled control requires signerless remote authority and an explicit non-PTY runtime; local custodial execution is forbidden");
@@ -655,6 +672,7 @@ export class Manager {
         this.servers = opts.servers;
         this.name = opts.name ?? "manager";
         this.workspaceRoot = opts.workspaceRoot ?? findCotalRoot();
+        this.onServiceIdentity = opts.onServiceIdentity;
         this.eventsRequired = opts.eventsRequired === true;
         this.maxSessions = opts.maxSessions;
         this.remoteAuthority = opts.remoteAuthority;
@@ -670,6 +688,11 @@ export class Manager {
             this.secretStoreIdentity = injectedSecretStoreIdentity(opts.secretStore);
         this.installedExtensions = opts.installedExtensions ?? false;
         this.executionState = opts.execution === "none" ? { kind: "none" } : { kind: "runtime" };
+        if (!this.remoteAuthority) {
+            const local = loadManagerInstanceIdentity(this.workspaceRoot, this.space);
+            if (local && existsSync(this.executionRecordPath(local.instanceId)))
+                this.claimExecutionRecord(local.instanceId);
+        }
         if (this.executionState.kind === "runtime")
             this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
         if (opts.pooled && this.executionState.kind === "runtime" && isCustodialRuntime(this.requiredRuntime))
@@ -707,7 +730,7 @@ export class Manager {
         return this.executionState.kind;
     }
     executionRefusal() {
-        return "execution: none forbids seat launch and workflow hosting on this control instance; select the participant Manager with an instance-pinned manager-caller view";
+        return "execution: none forbids seat launch, workflow hosting, model inspection and caller-driven writes on this control instance; select the participant Manager with an instance-pinned manager-caller view";
     }
     /** A defensive last barrier, not a substitute Runtime. Entry admission runs before effects. */
     get requiredRuntime() {
@@ -730,6 +753,37 @@ export class Manager {
             throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         return requireRuntimeAdopt(this.requiredRuntime, reference);
     }
+    /** Snapshot this embedding's own registration and stop policy. It is not a fresh serving
+     *  response, registration-leader read or authorization for another process to act. Wire callers
+     *  still use status through its fresh owner/admin visibility gate. No credential or URL leaves. */
+    localServiceObservation() {
+        const state = this.serviceServe;
+        if (!state)
+            return undefined;
+        const identity = this.serviceIdentityObservation();
+        if (state.grant.endpoint !== identity.endpoint || state.grant.instanceId !== identity.instanceId || state.grant.owner !== identity.principal.owner)
+            throw new Error("the manager's local service observation does not match its owned serve incarnation");
+        const stopImpact = this.managerStatusData(undefined).stopImpact;
+        if (!stopImpact)
+            throw new Error("the manager did not expose its own native stop policy");
+        // The local receipt keeps its revision-32 shape: an older controller's closed reader refuses an
+        // extra key. The preserved-exit check reads the binding through `localPreservation` instead.
+        const { preservation: _preservation, ...ordinary } = stopImpact;
+        return { registration: { ...identity, epoch: state.grant.epoch }, stopImpact: ordinary };
+    }
+    /** The attempt and inventory digest this embedding holds while maintenance is not `active`, for
+     *  its own native child only. Absent when active or before an inventory exists. */
+    localPreservation() {
+        return this.managerStatusData(undefined).stopImpact?.preservation;
+    }
+    serviceIdentityObservation() {
+        if (!this.managerInstanceId || !this.managerServeIdentity)
+            throw new Error("manager native service identity has not been selected");
+        const principal = this.remoteAuthority
+            ? { owner: this.remoteAuthority.owner, actor: this.remoteAuthority.actors.serve, uid: this.managerLifecycleUid }
+            : { owner: DEV_OWNER, actor: this.managerServeIdentity.id, uid: this.managerLifecycleUid };
+        return Object.freeze({ endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId, principal: Object.freeze(principal) });
+    }
     /** The console page URL (manager-hosted, loopback). */
     get consoleUrl() {
         return this.attach.consoleUrl();
@@ -831,12 +885,64 @@ export class Manager {
         this.startTask = wrapped;
         return wrapped;
     }
+    executionRecordPath(instanceId) {
+        return join(this.workspaceRoot, ".cotal", `manager-execution.${spaceKey(this.space)}.${instanceId}.json`);
+    }
+    claimExecutionRecord(instanceId) {
+        const record = claimIdentityRecord(this.executionRecordPath(instanceId), "manager execution capability", (raw) => {
+            if (!raw || typeof raw !== "object" || Array.isArray(raw))
+                return undefined;
+            const r = raw;
+            return Object.keys(r).sort().join(",") === "execution,instanceId,space,v" && r.v === 1 && r.space === this.space &&
+                r.instanceId === instanceId && (r.execution === "none" || r.execution === "runtime") ? r : undefined;
+        }, () => ({ v: 1, space: this.space, instanceId, execution: this.execution }));
+        if (record.execution !== this.execution)
+            throw new Error("manager execution capability differs from its retained instance record; execution cannot change across restart");
+    }
     async admitExecutionState() {
+        if (!this.remoteAuthority) {
+            let local = loadManagerInstanceIdentity(this.workspaceRoot, this.space);
+            if (this.execution === "none") {
+                const recorded = loadMeshes().find((m) => m.space === this.space);
+                const auth = hasUserAuthState(this.workspaceRoot, this.space) && recorded?.mode === "user"
+                    ? await getSpaceAuth(this.secrets, this.space) : undefined;
+                if (!auth)
+                    throw new Error("execution: none requires a genuine hosting user-auth root and its user-mode mesh record");
+                if (local && !existsSync(this.executionRecordPath(local.instanceId)))
+                    throw new Error("execution: none refuses an existing unclassified manager instance; keep its runtime and retained state, or register a fresh control instance");
+                if (!local) {
+                    const proposed = { instanceId: mintLifecycleUid(), serveIdentity: newIdentity() };
+                    local = createManagerInstanceIdentity(this.workspaceRoot, this.space, proposed);
+                    if (local.instanceId !== proposed.instanceId)
+                        throw new Error("execution: none refuses a concurrently claimed unclassified manager identity");
+                }
+                const localInstanceId = local.instanceId;
+                this.claimExecutionRecord(localInstanceId);
+                const nc = await this.dial({ ...standaloneConnectOpts({ creds: await mintCreds(auth, newIdentity(), "provisioner"), tls: false }), maxReconnectAttempts: 0 });
+                try {
+                    const kvm = new Kvm(nc);
+                    await ensureAuthorityStores(await jetstreamManager(nc), kvm, this.space);
+                    const entries = await listGoalIndex(await kvm.open(recordsBucket(this.space)), MANAGER_ENDPOINT);
+                    if (entries.some((entry) => entry.iid === localInstanceId && (entry.allocated !== undefined || entry.note !== undefined)))
+                        throw new Error("execution: none refuses retained seat or turn inventory before recovery; keep the execution-owning Manager");
+                }
+                finally {
+                    await nc.drain().catch(() => nc.close());
+                }
+            }
+            else {
+                local ??= createManagerInstanceIdentity(this.workspaceRoot, this.space, { instanceId: mintLifecycleUid(), serveIdentity: newIdentity() });
+                this.claimExecutionRecord(local.instanceId);
+            }
+            return;
+        }
         if (this.remoteAuthority) {
+            if (this.execution === "none" && (await localTrustOfSpace(this.secrets, this.space)).present)
+                throw new Error("remote manager-service authority cannot be combined with local space signing trust - choose one authority path, never a fallback");
             // Execution is fixed for a registered instance. An older instance with no capability
             // record might own retained seats/runs, so it cannot be converted to none by omission.
             const remote = this.remoteAuthority;
-            const path = join(this.workspaceRoot, ".cotal", `manager-execution.${spaceKey(this.space)}.${remote.instanceId}.json`);
+            const path = this.executionRecordPath(remote.instanceId);
             if (this.execution === "none" && !existsSync(path) && remote.serveGrant.epoch !== 0)
                 throw new Error("execution: none refuses an existing unclassified manager instance; keep its runtime and retained state, or register a fresh control instance");
             if (this.execution === "none") {
@@ -844,17 +950,8 @@ export class Manager {
                 if (entries.some((entry) => entry.iid === remote.instanceId && (entry.allocated !== undefined || entry.note !== undefined)))
                     throw new Error("execution: none refuses retained seat or turn inventory before recovery; keep the execution-owning Manager");
             }
-            if (this.execution === "none" || existsSync(path)) {
-                const record = claimIdentityRecord(path, "manager execution capability", (raw) => {
-                    if (!raw || typeof raw !== "object" || Array.isArray(raw))
-                        return undefined;
-                    const r = raw;
-                    return Object.keys(r).sort().join(",") === "execution,instanceId,space,v" && r.v === 1 && r.space === this.space &&
-                        r.instanceId === remote.instanceId && (r.execution === "none" || r.execution === "runtime") ? r : undefined;
-                }, () => ({ v: 1, space: this.space, instanceId: remote.instanceId, execution: this.execution }));
-                if (record.execution !== this.execution)
-                    throw new Error("manager execution capability differs from its retained instance record; execution cannot change across restart");
-            }
+            if (this.execution === "none" || existsSync(path))
+                this.claimExecutionRecord(remote.instanceId);
         }
     }
     async runStart() {
@@ -931,6 +1028,7 @@ export class Manager {
                 }
             }
         }
+        await this.onServiceIdentity?.(this.serviceIdentityObservation());
         let creds;
         let id;
         if (this.remoteAuthority) {
@@ -1164,7 +1262,7 @@ export class Manager {
         }
         // A carried resume (#1499) needs this instance's transfer reader: minted from the space's signing
         // seed, issued by the host to a remote manager, or none on an open mesh.
-        if (!this.remoteAuthority || this.remoteAuthority.mintTransferReader) {
+        if (this.execution !== "none" && (!this.remoteAuthority || this.remoteAuthority.mintTransferReader)) {
             this.transcripts = new TranscriptReceiver({
                 space: this.space,
                 instanceId: this.managerInstanceId,
@@ -1754,6 +1852,8 @@ export class Manager {
     /** Fence and build the inventory without stopping a child. The coordinator must durably persist
      * this exact plan before calling commitPreservation with the same attempt id. */
     preparePreservation(attemptId) {
+        if (this.execution === "none")
+            return Promise.reject(new EpEnvelopeError("unimplemented", this.executionRefusal()));
         if (!attemptId.trim())
             return Promise.reject(new Error("preservation attemptId is required"));
         if (this.preservationAttemptId && this.preservationAttemptId !== attemptId)
@@ -1857,6 +1957,8 @@ export class Manager {
     /** Stop children only after the coordinator has persisted the prepared inventory. Same-attempt
      * retries are idempotent; a different attempt is refused. */
     commitPreservation(attemptId) {
+        if (this.execution === "none")
+            return Promise.reject(new EpEnvelopeError("unimplemented", this.executionRefusal()));
         if (!this.preservationAttemptId || this.preservationAttemptId !== attemptId)
             return Promise.reject(new Error(`preservation attempt ${attemptId} was not prepared by this manager`));
         if (!this.preservationInventory)
@@ -1882,6 +1984,8 @@ export class Manager {
     /** Recover an abandoned prepare before any child stop. Once commit begins, preservation is
      * irreversible and remains fenced until the coordinator records failure/recourse. */
     abortPreservation(attemptId) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         if (this.preservationAttemptId !== attemptId)
             throw new Error(`preservation attempt ${attemptId} is not the active manager attempt`);
         if (this.preparationTask || this.lifecycleInFlight > 0)
@@ -2144,11 +2248,14 @@ export class Manager {
         if (failures.length)
             throw new Error(`manager shutdown could not prove every seat exited: ${failures.join("; ")}`);
     }
+    isProcessBoundSeat(agent) {
+        return agent.handle.kind === "pty" && typeof agent.handle.release !== "function";
+    }
     /** Drop this manager's local custody of every seat that can outlive it. A pty seat whose handle
      *  cannot be released lives in this process and closes with it, so it is left for {@link stop} to
      *  stop instead. */
     releaseManagedAgents() {
-        const managed = [...this.agents.values()].filter((a) => !(a.handle.kind === "pty" && typeof a.handle.release !== "function"));
+        const managed = [...this.agents.values()].filter((a) => !this.isProcessBoundSeat(a));
         const failures = [];
         for (const a of managed) {
             try {
@@ -2248,6 +2355,7 @@ export class Manager {
         this.leaseStopping = true;
         this.transcripts?.stop();
         this.staticReconcileStopping = true;
+        this.chatExpiry.stop();
         const starting = this.startTask;
         for (const item of this.staticReconcileItems.values()) {
             if (item.timer)
@@ -2286,7 +2394,7 @@ export class Manager {
                 else {
                     // An in-process seat cannot be detached from the process that is exiting, so the default
                     // stop stops and deprovisions it as `withAgents` does instead of orphaning its footprint.
-                    const inProcess = [...this.agents.values()].filter((a) => a.handle.kind === "pty" && typeof a.handle.release !== "function");
+                    const inProcess = [...this.agents.values()].filter((a) => this.isProcessBoundSeat(a));
                     releaseFailures = this.releaseManagedAgents();
                     await this.teardownManagedAgents(inProcess);
                 }
@@ -2310,6 +2418,13 @@ export class Manager {
                 failures.push(`${name}: ${rejectionText(e)}`);
             }
         };
+        // The expiry that would end a chat session stops with this process, and nothing can adopt one,
+        // so an active stop retires every session this process admitted, under either agent policy, as
+        // it does an in-process seat. A preserving stop leaves them to the next start's sweep.
+        if (this.maintenanceState === "active" && !this.resumeRequired)
+            await step("retire chat sessions", () => this.retireChatSessionsOnStop());
+        else
+            this.reportChatSessionsLeftAtStop(this.resumeRequired ? "this manager is waiting for a resume" : "this manager is preserving its state");
         // A seat that may still be alive keeps this instance's leases and registration (see
         // teardownManagedAgents): they lapse on their TTL instead of being handed to a successor.
         if (seatFailure === undefined) {
@@ -2555,6 +2670,8 @@ export class Manager {
         return { kind: "held", revision: current.revision };
     }
     async opFinalizeResume(rawArgs) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         {
             let args;
             try {
@@ -2605,6 +2722,8 @@ export class Manager {
         }
     }
     async opCommitResume(rawArgs) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         {
             let attemptId;
             try {
@@ -2638,11 +2757,11 @@ export class Manager {
         }
     }
     async opResumePreserved(rawArgs) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         {
             try {
                 const args = parseResumeControlArgs(rawArgs);
-                if (this.execution === "none" && args.inventory.agents.length !== 0)
-                    return { ok: false, error: this.executionRefusal() };
                 const inventoryDigest = createHash("sha256").update(JSON.stringify(args.inventory)).digest("hex");
                 if (!this.resumeAttemptId)
                     return { ok: false, error: "resumePreserved requires a manager started with --resume-attempt" };
@@ -2675,6 +2794,8 @@ export class Manager {
         }
     }
     async opPreservationCtl(op, rawArgs) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         if (this.resumeRequired)
             return { ok: false, error: this.maintenanceError() };
         const attemptId = String(rawArgs?.attemptId ?? "").trim();
@@ -2726,8 +2847,9 @@ export class Manager {
     async serveGated(ctx, fn) {
         const caller = principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
         const admission = this.admitControl(caller);
+        // Both fences refuse before the handler runs, so nothing ran (SPEC 13.3).
         if (admission.refusal !== undefined)
-            throw new EpEnvelopeError(admission.fence === "membership" ? "permission-denied" : "unavailable", admission.refusal);
+            throw new EpEnvelopeError(admission.fence === "membership" ? "permission-denied" : "unavailable", admission.refusal, undefined, "not-executed");
         try {
             return await fn();
         }
@@ -2735,6 +2857,29 @@ export class Manager {
             admission.release();
         }
     }
+    /** `status` only: {@link serveGated}, except that a fully preserved manager, and an active one
+     *  launched for a resume that has not committed it yet, still answer it. A preserved-exit stop's
+     *  caller-attributed preview needs the preserved manager's stop impact, and a resumed service's
+     *  readiness reads the same status; the maintenance fence refuses every other command in both
+     *  states. The read is counted in `lifecycleInFlight` like any admitted operation and released in
+     *  `finally`, so a drain waits at most for one status snapshot; the membership gate still
+     *  applies. `preserving` and a stopping manager stay fenced. Status writes nothing. */
+    async serveObservation(ctx, fn) {
+        const preserved = this.maintenanceState === "preserved" && !this.resumeRequired;
+        const resumePending = this.maintenanceState === "active" && this.resumeRequired;
+        if (this.leaseStopping || !preserved && !resumePending)
+            return this.serveGated(ctx, fn);
+        const membership = this.lifecycleMembershipRefusal(principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key);
+        if (membership)
+            throw new EpEnvelopeError("permission-denied", membership, undefined, "not-executed");
+        this.lifecycleInFlight++;
+        try {
+            return await fn();
+        }
+        finally {
+            this.releaseLifecycle();
+        }
+    }
     /** The ep door's ADMIN flag for a caller. Static mesh: `true` — the
      *  admin-grade rows (any-mode despawn/attach, the `manager.admin` family, `launch`) are minted
      *  only into operator instruments (§13.2: `any` is operator-policy-mintable; the agent/spawn
@@ -2898,20 +3043,22 @@ export class Manager {
         // serveGated BYPASS (those ops must run while the maintenance fence holds) but not the gate.
         const adminGated = async (ctx, fn) => {
             if (!(await this.epAdminReach(ctx.subject.caller)))
-                throw new EpEnvelopeError("permission-denied", `${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
+                throw new EpEnvelopeError("permission-denied", `${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`, undefined, "not-executed");
             return fn();
         };
         const targetAgent = (ctx) => {
+            if (this.execution === "none")
+                throw new EpEnvelopeError("unimplemented", this.executionRefusal());
             const t = ctx.request.target; // targeted commands only: the serve boundary enforced body-target presence + fresh currency
             const a = this.findManagedByTarget(t);
             if (!a)
-                throw new EpEnvelopeError("expired", `target ${t.owner}.${t.actor} (lifecycle ${t.lifecycleUid}) is not a live managed agent of this manager`);
+                throw new EpEnvelopeError("expired", `target ${t.owner}.${t.actor} (lifecycle ${t.lifecycleUid}) is not a live managed agent of this manager`, undefined, "not-executed");
             return a;
         };
         return managerCommandDefs({
             // A remote Manager files every seat under its own owner, so only a user mesh's shared local
             // Manager narrows the count, and status never waits on a remote admin check.
-            status: (ctx) => this.serveGated(ctx, async () => this.managerStatusData(this.remoteAuthority ? undefined : await this.psOwnerFilter(ctx.subject.caller, false))),
+            status: (ctx) => this.serveObservation(ctx, async () => this.managerStatusData(this.remoteAuthority ? undefined : await this.psOwnerFilter(ctx.subject.caller, false))),
             ps: (ctx) => this.serveGated(ctx, async () => this.list(await this.psOwnerFilter(ctx.subject.caller, false))),
             inspect: (ctx) => this.serveGated(ctx, async () => {
                 const name = String(args(ctx).name ?? "").trim();
@@ -2966,7 +3113,11 @@ export class Manager {
                     ]);
                 let observed;
                 try {
-                    observed = await listStaticSlotObservations(recordsKv, DEV_OWNER, this.managerInstanceId);
+                    const query = args(ctx);
+                    observed = await listStaticSlotObservations(recordsKv, DEV_OWNER, this.managerInstanceId, {
+                        ...(query.names === undefined ? {} : { names: query.names }),
+                        ...(query.includeRetired === true ? { includeRetired: true } : {}),
+                    });
                 }
                 catch (error) {
                     throw new EpEnvelopeError("unavailable", `the durable static slot state could not be scanned: ${rejectionText(error)}`, [
@@ -2995,9 +3146,11 @@ export class Manager {
             }),
             resolveCwd: (ctx) => this.serveGated(ctx, () => this.resolveSpawnCwd(args(ctx).cwd)),
             resolveAgent: (ctx) => this.serveGated(ctx, async () => {
+                if (this.execution === "none")
+                    throw new EpEnvelopeError("unimplemented", this.executionRefusal());
                 const persona = await this.spawnPersona(args(ctx), callerOf(ctx), ctx.subject.caller);
                 if ("error" in persona)
-                    throw new EpEnvelopeError(persona.error.startsWith("no persona") ? "not-found" : "failed-precondition", persona.error);
+                    throw new EpEnvelopeError(persona.code ?? (persona.error.startsWith("no persona") ? "not-found" : "failed-precondition"), persona.error);
                 return { agent: persona.agent };
             }),
             // `spawn` is an ACTION - accept a goal + reply the acceptance floor payload, drive
@@ -3011,14 +3164,14 @@ export class Manager {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
-                    throw new EpEnvelopeError("permission-denied", denied);
+                    throw new EpEnvelopeError("permission-denied", denied, undefined, "not-executed");
                 return unwrap(this.despawnAuthorized(a, args(ctx).graceful !== false, true, callerOf(ctx)));
             }),
             attach: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
-                    throw new EpEnvelopeError("permission-denied", denied);
+                    throw new EpEnvelopeError("permission-denied", denied, undefined, "not-executed");
                 return unwrap(await this.attachAuthorized(a, ctx.subject.caller));
             }),
             // C3 `input`: the SAME authorization as `attach`, deliberately written out rather than
@@ -3028,7 +3181,7 @@ export class Manager {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
-                    throw new EpEnvelopeError("permission-denied", denied);
+                    throw new EpEnvelopeError("permission-denied", denied, undefined, "not-executed");
                 return this.inputAuthorized(a, args(ctx));
             }),
             // The turn relay (§8 durable actions): `turn` shares despawn/input's reach policy — the
@@ -3038,7 +3191,7 @@ export class Manager {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
-                    throw new EpEnvelopeError("permission-denied", denied);
+                    throw new EpEnvelopeError("permission-denied", denied, undefined, "not-executed");
                 return this.serveTurnGoal(ctx, a);
             }),
             // The seat's own half of the relay (`manager.self`, stop-self's tier): a seat pulls the
@@ -3050,6 +3203,10 @@ export class Manager {
             cancel: (ctx) => this.serveGated(ctx, () => this.serveTurnCancel(ctx)),
             stopSelf: (ctx) => this.serveGated(ctx, () => unwrap(this.opStopSelf(callerOf(ctx), args(ctx)))),
             definePersona: (ctx) => this.serveGated(ctx, () => unwrap(this.opDefinePersona(args(ctx), callerOf(ctx), false))),
+            // Reach is the broker's: only operator instruments carry these rows. The serve gate is the
+            // maintenance fence, so neither runs while a shutdown or resume holds control.
+            chatSessionOpen: (ctx) => this.serveGated(ctx, () => this.openStaticChatSession(args(ctx))),
+            chatSessionRetire: (ctx) => this.serveGated(ctx, () => this.retireStaticChatSession(args(ctx))),
             listPersonas: (ctx) => this.serveGated(ctx, () => unwrap(this.opListPersonas(callerOf(ctx), false))),
             showPersona: (ctx) => this.serveGated(ctx, () => {
                 const r = this.opShowPersona(args(ctx), callerOf(ctx), false);
@@ -3094,6 +3251,8 @@ export class Manager {
             commitPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("commitPreservation", args(ctx)))),
             abortPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("abortPreservation", args(ctx)))),
             transcriptReceive: (ctx) => this.serveGated(ctx, () => adminGated(ctx, () => {
+                if (this.execution === "none")
+                    throw new EpEnvelopeError("unimplemented", this.executionRefusal());
                 if (!this.transcripts)
                     throw new EpEnvelopeError("failed-precondition", "transcript-receive: this manager does not receive carried transcripts (its remote authority issues no transfer reader)");
                 return this.transcripts.receive(args(ctx));
@@ -3231,6 +3390,8 @@ export class Manager {
      *  hitting another agent. Non-managed callers (human CLI, the manager itself, observers) find
      *  no match and get a loud error, not a silent no-op. */
     opStopSelf(callerId, args) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         const target = [...this.agents.values()].find((a) => this.managedPrincipal(a) === callerId);
         if (!target)
             return { ok: false, error: `self-stop: caller ${callerId} is not a managed agent` };
@@ -3390,6 +3551,9 @@ export class Manager {
                 parent: spawnerPr ? opts.spawner : undefined,
                 label: opts.label,
                 lifecycleUid: opts.lifecycleUid,
+                // This manager attests its own persisted logical instance id: the same id a static slot
+                // records as its owner. Recovery binds a managed row to a manager only through this.
+                custody: { kind: "local-manager", instanceId: this.managerInstanceId },
             });
             // Durables + ACL row, LIFECYCLE-keyed (SPEC 13.1) — the same onboarding as static agents minus
             // the mint (a user agent's credential is its bearer, minted by the callout per connect from the
@@ -4631,6 +4795,8 @@ export class Manager {
     /** Resolve a placed spawn directory on this manager's host. Delegated execution refuses before
      * filesystem lookup, since its seats cannot use host cwd. Creates nothing and never substitutes the workspace root. */
     resolveSpawnCwd(value) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         if (this.execution === "runtime" && this.requiredRuntime.spawnDelegated)
             throw new EpEnvelopeError("failed-precondition", `runtime "${this.requiredRuntime.kind}" starts seats outside this host, so it cannot resolve a directory on this host's filesystem (cwd); the seat runs in its runtime resource's own directory`);
         const asked = typeof value === "string" ? value : String(value ?? "");
@@ -4786,6 +4952,8 @@ export class Manager {
      *  local model-list API reports `supported:false` rather than blocking the manager. A connector that
      *  fails to import shows an `error:` row (from manifest enumeration) and never blocks the others. */
     async opModels(args) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         const requested = String(args.agent ?? "").trim();
         const refresh = args.refresh === true;
         const one = async (connector) => {
@@ -4796,7 +4964,7 @@ export class Manager {
                 return { agent: connector.name, supported: true, models: [], error: harness.refusal };
             try {
                 const catalog = await connector.listModels({ refresh });
-                return { agent: connector.name, supported: true, ...catalog };
+                return { agent: connector.name, supported: catalog.unavailable === undefined, ...catalog };
             }
             catch (e) {
                 return { agent: connector.name, supported: true, models: [], error: rejectionText(e) };
@@ -4883,6 +5051,7 @@ export class Manager {
                 spec = parseLaunchSpec(args.spec, `inline launch spec (run ${runId})`);
                 if (spec.runId !== runId)
                     return { ok: false, error: `inline launch spec runId "${spec.runId}" does not match requested "${runId}"` };
+                hooks?.onEffect?.();
                 persistLaunchSpec(this.workspaceRoot, spec);
             }
             catch (e) {
@@ -4914,6 +5083,7 @@ export class Manager {
         }
         let configPath;
         try {
+            hooks?.onEffect?.();
             configPath = materializePersona(this.workspaceRoot, runId, la);
         }
         catch (e) {
@@ -4995,10 +5165,10 @@ export class Manager {
         let def;
         if (!opts.resolved) {
             try {
-                def = loadAgentFile(configPath);
+                def = loadLaunchPersonaFile(configPath);
             }
             catch (e) {
-                return { error: rejectionText(e) };
+                return { error: rejectionText(e), ...(e instanceof PersonaSourceError ? { code: "bad-request" } : {}) };
             }
             // Shared operator files remain launchable. Owned content follows the catalog's visibility
             // decision before connector loading or any allocation. A hosted run acts for its admission;
@@ -5032,7 +5202,7 @@ export class Manager {
         }
         const persona = await this.spawnPersona(opts, spawner, authenticatedCaller);
         if ("error" in persona)
-            return { ok: false, error: persona.error };
+            return { ok: false, error: persona.error, ...(persona.code ? { code: persona.code } : {}) };
         const { ref, configPath, def, agent } = persona;
         // Materialize the requested connector up front — the ONE async step in the spawn path (a lazy
         // `cotal ext` manifest import on the published binary). It runs BEFORE the capacity/reserve span
@@ -5044,7 +5214,12 @@ export class Manager {
             connector = await this.resolveConnector(agent);
         }
         catch (e) {
-            return { ok: false, error: rejectionText(e) };
+            const error = rejectionText(e);
+            // An action refusal here precedes capacity, allocation and onAccepted. Preserve that proof
+            // through serveSpawnGoal without changing the direct startAgent ControlReply contract.
+            if (hooks?.onAccepted)
+                throw new EpEnvelopeError("failed-precondition", error, undefined, "not-executed");
+            return { ok: false, error };
         }
         const readinessTimeoutMs = connector.readinessTimeoutMs ?? this.readinessTimeoutMs;
         if (!Number.isSafeInteger(readinessTimeoutMs) || readinessTimeoutMs <= 0)
@@ -5265,6 +5440,7 @@ export class Manager {
             return { ok: false, error: `the name "${identityName}" is still reconciling at manager startup; its prior lifecycle terminal owns this alias until it completes. Retry shortly.` };
         const held = this.retiring.get(identityName);
         if (held !== undefined) {
+            hooks?.onEffect?.();
             void this.deprovision(held.target).catch(() => { });
             const err = lifecycleBlocked("failed-precondition", `the name "${identityName}" is reserved pending retirement: its previous agent's despawn started that lifecycle's teardown (footprint + standing-authority revoke + auth-side retirement), and the name frees only when all of it completes${held.lastError !== undefined ? ` (last attempt: ${held.lastError})` : ""}. NEXT: wait a moment and retry this spawn (retrying re-drives the whole teardown), or pick another name.`, { blockedOp: "retirement", opId: held.opId, remedy: "retry" });
             return { ok: false, error: renderLifecycleBlocked(err.message, err), details: err.details };
@@ -5328,6 +5504,11 @@ export class Manager {
         else {
             name = this.uniqueName(identityName);
         }
+        // The `chat_` prefix belongs to static chat sessions, whose aliases only `chat-session-open`
+        // draws. Checked once the name is fixed by either branch above, so a persona name, a numbered
+        // collision, a manifest name and a `--name` override all meet it, and before the reservation.
+        if (name.startsWith(CHAT_ALIAS_PREFIX))
+            return { ok: false, error: `the name "${name}" starts with "${CHAT_ALIAS_PREFIX}", which is reserved for chat sessions; pick another name` };
         // Set once the agent's footprint (durables + creds, or the user-mode grant + secret files)
         // exists; cleared when a live slot takes ownership. If it survives to `finally`, the spawn threw
         // AFTER provisioning (buildLaunch / runtime.spawn) — the orphan-rollback tears it down. Carries
@@ -5343,6 +5524,7 @@ export class Manager {
         let seatHome;
         // Taken right before the try so its finally is the only release; a refusal belongs above the
         // allocation, where there is no name to give back.
+        hooks?.onEffect?.();
         this.reserved.add(name);
         try {
             // A stable nkey identity assigned at spawn: the public key is the agent's card.id (threaded via
@@ -5824,7 +6006,7 @@ export class Manager {
      * principal without provisioning. A later runtime launch failure is reported per-agent, but malformed
      * or missing inventory material can never produce a partially resumed set. */
     async resumePreserved(inventory) {
-        if (this.execution === "none" && (!Array.isArray(inventory.agents) || inventory.agents.length !== 0))
+        if (this.execution === "none")
             return { ok: false, agents: [], error: this.executionRefusal() };
         const release = this.beginLifecycle(true);
         if (!release)
@@ -6957,6 +7139,7 @@ export class Manager {
     managerStatusData(ownerFilter) {
         return {
             instanceId: this.managerInstanceId,
+            lifecycleUid: this.managerLifecycleUid,
             host: hostname(),
             version: MANAGER_VERSION,
             execution: this.execution,
@@ -6969,6 +7152,34 @@ export class Manager {
             connectors: this.connectorStatuses.map((row) => ({ ...row, binaries: { ...row.binaries } })),
             classSpawn: this.classSpawnEnabled(),
             staticReconciliation: this.staticReconciliationStatus(),
+            stopImpact: {
+                agentScope: ownerFilter === undefined ? "manager" : "owner-filtered",
+                observedAt: new Date().toISOString(),
+                maintenance: this.maintenanceState,
+                resumeRequired: this.resumeRequired,
+                stopping: this.leaseStopping,
+                lifecycleInFlight: this.lifecycleInFlight,
+                reservedLaunches: this.reserved.size,
+                retirementsPending: this.retiring.size,
+                deprovisioningInFlight: this.deprovisioningFlight.size,
+                staticReconciliationInFlight: this.staticReconcileSweepsInFlight,
+                agents: [...this.agents.values()]
+                    .filter((a) => ownerFilter === undefined || a.userOwner === ownerFilter)
+                    .map((a) => ({
+                    name: a.name,
+                    id: a.id,
+                    lifecycleUid: a.lifecycleUid,
+                    mode: a.handle.kind,
+                    defaultAction: this.maintenanceState !== "active" || this.resumeRequired
+                        ? "stop-retaining-state" : this.isProcessBoundSeat(a) ? "stop" : "release-custody",
+                    withAgentsAction: this.maintenanceState !== "active" || this.resumeRequired ? "stop-retaining-state" : "stop",
+                })),
+                // The same digest form `opResumePreserved` binds, so a preserved-exit stop and the later
+                // resume name one inventory.
+                ...(this.maintenanceState !== "active" && this.preservationAttemptId && this.preservationInventory
+                    ? { preservation: { attemptId: this.preservationAttemptId, inventorySha256: createHash("sha256").update(JSON.stringify(this.preservationInventory)).digest("hex") } }
+                    : {}),
+            },
         };
     }
     /** Render the current operator snapshot. Recovered rows live until the next sweep starts, then
@@ -7973,15 +8184,16 @@ export class Manager {
      *  Returns the acceptance floor payload {name, owner, actor, uid, goalId, fingerprint, executor}
      *  (the ALLOCATED identity). goalId = the request id (env.id). */
     async serveSpawnGoal(ctx, run) {
+        // These four refuse before anything is accepted or allocated, so they state it (SPEC 13.3).
         if (this.execution === "none")
-            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal(), undefined, "not-executed");
         const gw = this.goalWriter;
         if (!gw)
-            throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; spawn-as-action cannot accept (SPEC 13.6)");
+            throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; spawn-as-action cannot accept (SPEC 13.6)", undefined, "not-executed");
         // Refuse to accept until the boot reconcile of inherited goals completes, so a fresh
         // acceptance never races the sweep (settling a live goal mid-flight would steal its real terminal).
         if (!this.goalReconcileDone)
-            throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; retry shortly (SPEC 13.6)");
+            throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; retry shortly (SPEC 13.6)", undefined, "not-executed");
         const goalId = ctx.request.id;
         const { fingerprint } = submissionFingerprint(ctx.request, ctx.subject);
         const ref = goalRefOf(ctx.subject, goalId);
@@ -8002,7 +8214,7 @@ export class Manager {
         const accepted = prior ?? ended;
         if (accepted !== undefined) {
             if (accepted.fingerprint !== fingerprint)
-                throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted under a different submission; one goalId never carries two specs (SPEC 13.6)`);
+                throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted under a different submission; one goalId never carries two specs (SPEC 13.6)`, undefined, "not-executed");
             return prior ?? this.cachedSpawnAcceptance(ref, goalId, fingerprint, executor);
         }
         let resolveAccept;
@@ -8029,6 +8241,8 @@ export class Manager {
         // (#357): it had entered no terminal, so the fallback wrote one for it, using its own abort
         // message as the caller-visible outcome.
         let ownsGoal = false;
+        // Set by onEffect. A refusal that arrives with it still false changed nothing.
+        let effectStarted = false;
         // The terminal commits OFF-handler on the goal-writer connection (manager-only authority; a
         // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): (a) reads THIS
         // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
@@ -8148,12 +8362,15 @@ export class Manager {
             // it and commits `cancel`. This only stops the non-ok reply below from manufacturing a
             // `failed` that would race that `cancel` (first-terminal-fact-wins).
             onTerminalDeferred: () => { terminalEntered = true; },
+            onEffect: () => { effectStarted = true; },
         });
         bg.then((reply) => {
             // Refused BEFORE onAccepted (hard-pin collision, capacity, persona-not-found) — no goal bound.
+            // Only a refusal before the first effect states `not-executed`; a later one, such as the
+            // alias gate that re-drives a teardown, leaves the outcome unknown.
             if (acceptance === undefined) {
                 const details = reply.details;
-                rejectAccept(new EpEnvelopeError("failed-precondition", reply.error ?? "spawn refused at accept", details));
+                rejectAccept(new EpEnvelopeError("failed-precondition", reply.error ?? "spawn refused at accept", details, effectStarted ? undefined : "not-executed"));
                 return;
             }
             // H1: `run` CATCHES its own body (a throw in buildLaunch/runtime.spawn) and RESOLVES `{ok:false}`
@@ -8415,6 +8632,8 @@ export class Manager {
      *  `succeeded` carrying the TurnResult. A yield AFTER the deadline drives the deadline terminal
      *  instead and refuses — the expiry outcome stands, never a late success over it. */
     async serveTurnYield(c, raw) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         // Same boot window as the pull, and checked first because it is the earlier boot phase: before
         // the index is rebuilt a predecessor's accepted turn is not in `pendingTurns`, and `not-found`
         // would tell the seat to drop work it is holding.
@@ -8503,6 +8722,8 @@ export class Manager {
      *  whose outcome cannot be read back stays out and converges through the goal index at the
      *  next boot, as a failed deadline commit does. */
     async serveTurnCancel(ctx) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         if (!this.goalReconcileDone)
             throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; the pending-turn index is not rebuilt yet, retry (SPEC 13.6)");
         const gw = this.goalWriter;
@@ -9141,6 +9362,229 @@ export class Manager {
                 throw e;
         }
     }
+    /** `chat-session-open`: admit one static chat session. The manager draws the `chat_` alias and a
+     *  fresh nkey identity, then runs the same native steps a static spawn does: the slot intent and
+     *  the shared activation saga, the provisioner's bind-only DM and DELIVER durables plus the ACL
+     *  row, and the agent-profile mint. The leaf carries the spawn's three lists under the spawn's
+     *  rules (`resolveReadAcl`, a default-deny post list, the foreign event-channel refusal) and
+     *  nothing else: no role (so no TASK queue), no capabilities, no endpoint rows, no issuance. It
+     *  expires at `ttl` with no renewal, because no managed row exists to renew it.
+     *
+     *  The session is registered with the tracker before the first durable write and scheduled for
+     *  its expiry before the reply is sent, or after a rollback that did not complete, so this
+     *  process retires it at the expiry even when the reply is lost or the client never retires.
+     *
+     *  The credential is ledgered before it leaves this process (slot credentialId, then the `cred.`
+     *  row), so the static terminal marks the row revoked and verify-evicts the session's principal;
+     *  the broker keeps accepting the leaf until its expiry. The direct ledger write is deliberate:
+     *  the leaf is not an issuance, so the issuance seam, which writes the same row inside its
+     *  finalization, never runs for it, and without the row the terminal's eviction set would be
+     *  empty. The credential leaves only sealed to `sealTo`, bound to the space, this instance and
+     *  the reply's fields, so a reply printed anywhere carries no usable credential. A failure at
+     *  any step drives the terminal before the refusal is returned, and the refusal says whether it
+     *  completed. */
+    async openStaticChatSession(raw) {
+        if (!this.auth || this.userMode)
+            throw new EpEnvelopeError("unimplemented", "chat-session-open admits static chat sessions only, and this manager is not a static-auth manager", undefined, "not-executed");
+        const input = readChatOpenInput(raw);
+        if ("error" in input)
+            throw new EpEnvelopeError("bad-request", input.error, undefined, "not-executed");
+        const lists = chatOpenLists(input);
+        if ("error" in lists)
+            throw new EpEnvelopeError("bad-request", lists.error, undefined, "not-executed");
+        const alias = drawChatAlias();
+        const identity = newIdentity();
+        // The spawn's rule, against the drawn actor: a concrete event channel of any other principal is
+        // refused, and a wildcard is an ordinary grant.
+        const foreign = foreignEventChannels([...lists.allowSubscribe, ...lists.allowPublish], DEV_OWNER, identity.id);
+        if (foreign.length)
+            throw new EpEnvelopeError("bad-request", `chat-session-open asks for another agent's event channel: ${foreign.join(", ")}. A session may be granted its OWN event plane and no other, because that plane carries the session's tool inputs and outputs. Grant a reader out of band rather than through a chat session: ${this.readerRemedy(DEV_OWNER, foreign[0])}`, undefined, "not-executed");
+        const lifecycleUid = mintLifecycleUid();
+        const exp = Math.floor(Date.now() / 1000) + input.ttl;
+        const pin = { owner: DEV_OWNER, actor: identity.id, lifecycleUid, alias };
+        const session = { alias, actor: identity.id, lifecycleUid, channels: lists.allowSubscribe, expiresAt: exp * 1000 };
+        // Registered before the first durable write, so the startup sweep never mistakes this opening's
+        // provisioning row for a crashed spawn, and the stop knows it.
+        try {
+            this.chatExpiry.register(session);
+        }
+        catch (e) {
+            throw new EpEnvelopeError("unavailable", rejectionText(e), undefined, "not-executed");
+        }
+        try {
+            await this.withLifecycleExecutor(pin, (t) => activateStaticLifecycle(t, { owner: DEV_OWNER, alias, actor: identity.id, lifecycleUid, managerInstance: this.managerLifecycleUid, ownerInstanceId: this.managerInstanceId }));
+            const creds = await this.withProvisioner((prov) => provisionAgent(prov, this.auth, identity, { subscribe: lists.subscribe, allowSubscribe: lists.allowSubscribe, allowPublish: lists.allowPublish, lifecycleUid, expiresAt: exp }));
+            // The same credential id the issuance path derives, so a re-sent identical credential maps to
+            // the same row.
+            const credentialId = rawDigest(creds).replace("sha256:", "sha256-");
+            await this.withLifecycleExecutor(pin, async (t) => {
+                await recordSlotCredential(t, DEV_OWNER, alias, lifecycleUid, credentialId);
+                await appendStaticCredentialRow(t, { lifecycleUid, credentialId, holderPrincipal: principalKey(DEV_OWNER, identity.id).key, exp });
+                const slot = await readStaticSlot(t, DEV_OWNER, alias);
+                if (slot === undefined || slot.row.lifecycleUid !== lifecycleUid || slot.row.phase !== "provisioning")
+                    throw new Error(`the static slot for "${alias}" is ${slot === undefined ? "absent" : `${slot.row.phase} at uid ${slot.row.lifecycleUid}`}, not this opening's provisioning intent`);
+                await casStaticSlot(t, { ...slot.row, phase: "active" }, slot.revision);
+            });
+            const { sealer, sealed } = sealChatAdmission({
+                space: this.space, managerInstanceId: this.managerInstanceId, alias, actor: identity.id, lifecycleUid, expiresAt: exp * 1000, sealTo: input.sealTo, creds,
+            });
+            this.chatExpiry.arm(lifecycleUid);
+            console.error(`chat session ${alias} admitted as ${identity.id} (uid ${lifecycleUid}), expires ${new Date(exp * 1000).toISOString()}`);
+            return { alias, actor: identity.id, lifecycleUid, expiresAt: exp * 1000, sealer, sealed };
+        }
+        catch (e) {
+            // A confirmed rollback leaves a known state, a retired slot. An unconfirmed one does not, so
+            // the session stays registered and its expiry, or the stop, retries the same terminal.
+            let rollback;
+            try {
+                await this.chatTerminal(session);
+            }
+            catch (r) {
+                rollback = rejectionText(r);
+                try {
+                    this.chatExpiry.arm(lifecycleUid);
+                }
+                catch (t) {
+                    rollback += `; ${rejectionText(t)}`;
+                }
+            }
+            throw new EpEnvelopeError(e instanceof EpEnvelopeError ? e.code : "unavailable", `chat-session-open did not complete for ${alias}: ${rejectionText(e)}; ${rollback === undefined ? "its rollback retired the slot" : `its rollback was not confirmed (${rollback}), so the slot stays held until a retire, its expiry here, this manager's stop, or the next start of this manager instance`}`, undefined, rollback === undefined ? "executed" : "unknown");
+        }
+    }
+    /** `chat-session-retire`: end one static chat session through the native static terminal (ledger
+     *  row marked revoked, verified eviction of its principal's live connections, footprint cleanup,
+     *  gate and head retirement). It refuses before any effect unless {@link admitChatRetirement}
+     *  admits the request. A terminal that cannot complete answers `failed` with the reason, never
+     *  success; the slot stays held. The broker keeps accepting the leaf until its expiry either way. */
+    async retireStaticChatSession(raw) {
+        if (!this.auth || this.userMode)
+            throw new EpEnvelopeError("unimplemented", "chat-session-retire retires static chat sessions only, and this manager is not a static-auth manager", undefined, "not-executed");
+        const input = readChatRetireInput(raw);
+        if ("error" in input)
+            throw new EpEnvelopeError("bad-request", input.error, undefined, "not-executed");
+        if (await this.admitChatRetirement(input) === "alreadyRetired")
+            return { outcome: "alreadyRetired" };
+        try {
+            await this.chatTerminal({ ...input, channels: this.chatExpiry.channels(input.lifecycleUid) });
+        }
+        catch (e) {
+            return { outcome: "failed", reason: `retirement pending: ${rejectionText(e)}` };
+        }
+        return { outcome: "retired" };
+    }
+    /** The expiry cleanup's retirement of one session this process admitted. It is lifecycle work, so
+     *  it is admitted like a control call and a stop drains it. A throw is a failure the tracker
+     *  retries; a slot that is no longer this instance's to retire ends the tracking instead. */
+    async expireStaticChatSession(session) {
+        const release = this.beginLifecycle();
+        if (!release)
+            throw new Error(this.maintenanceError());
+        try {
+            console.error(`chat session ${session.alias} (uid ${session.lifecycleUid}) reached its expiry; retiring it`);
+            let admitted;
+            try {
+                admitted = await this.admitChatRetirement(session);
+            }
+            catch (e) {
+                if (e instanceof EpEnvelopeError && (e.code === "not-found" || e.code === "failed-precondition")) {
+                    console.error(`! chat session ${session.alias} expired, but its slot is not this instance's to retire (${e.message}); expiry tracking ends`);
+                    return;
+                }
+                throw e;
+            }
+            if (admitted === "admitted")
+                await this.chatTerminal(session);
+        }
+        finally {
+            release();
+        }
+    }
+    /** The ownership admission shared by `chat-session-retire`, the expiry and the stop. It throws a
+     *  not-executed refusal unless the alias is a chat alias whose slot this logical instance owns
+     *  at the requested UID and actor. An already retired slot ends its expiry tracking. */
+    async admitChatRetirement(s) {
+        if (!isChatAlias(s.alias))
+            throw new EpEnvelopeError("permission-denied", `"${s.alias}" is not a chat session alias`, undefined, "not-executed");
+        if (this.reconcilingAliases.has(s.alias))
+            throw new EpEnvelopeError("unavailable", `the chat session "${s.alias}" is still reconciling at manager startup; that terminal owns it`, undefined, "not-executed");
+        const recordsKv = this.goalWriter?.ctx.kv;
+        if (!recordsKv)
+            throw new EpEnvelopeError("unavailable", `the durable static slot store is not ready while retiring "${s.alias}"`, undefined, "not-executed");
+        let slot;
+        try {
+            slot = await readStaticSlot(staticLifecycleTransport(recordsKv, recordsKv), DEV_OWNER, s.alias);
+        }
+        catch (e) {
+            throw new EpEnvelopeError("unavailable", `the durable slot for "${s.alias}" could not be read: ${rejectionText(e)}`, undefined, "not-executed");
+        }
+        const refused = chatRetireRefusal(slot?.row, s, this.managerInstanceId);
+        if (refused)
+            throw new EpEnvelopeError(refused.code, refused.message, undefined, "not-executed");
+        if (slot.row.phase !== "retired")
+            return "admitted";
+        this.chatExpiry.forget(s.lifecycleUid);
+        return "alreadyRetired";
+    }
+    /** One static terminal per chat session UID, however many callers ask: the explicit retire, the
+     *  expiry cleanup and the open's rollback join it instead of racing its CAS sequence. A completed
+     *  terminal ends the expiry tracking. `channels` names the membership rows to delete by name;
+     *  without it the delivery inventory alone finds them. */
+    chatTerminal(s) {
+        let flight = this.chatRetirements.get(s.lifecycleUid);
+        if (!flight) {
+            flight = this.driveStaticRetirement({ id: s.actor, name: s.alias, lifecycleUid: s.lifecycleUid, secretPaths: {}, ...(s.channels ? { launch: { allowSubscribe: s.channels } } : {}) }, true)
+                .then(() => this.chatExpiry.forget(s.lifecycleUid))
+                .finally(() => this.chatRetirements.delete(s.lifecycleUid));
+            this.chatRetirements.set(s.lifecycleUid, flight);
+        }
+        return flight;
+    }
+    /** Whether `row` is a chat slot this process registered, at its exact alias, actor and UID,
+     *  under this logical instance and this process's incarnation. */
+    holdsLiveChatSlot(row) {
+        return row.ownerInstanceId === this.managerInstanceId && row.managerInstance === this.managerLifecycleUid && this.chatExpiry.holdsExact(row);
+    }
+    /** The stop's retirement of every chat session this process still tracks, through the same
+     *  ownership admission and terminal as `chat-session-retire`, at most
+     *  {@link CHAT_EXPIRY_CONCURRENCY} at a time. It runs after the lifecycle fence closed and every
+     *  admitted operation drained, as the seat teardown does, and mints nothing the terminal does not
+     *  already mint. Every outcome is logged. It throws, naming each one, when any session was not
+     *  retired; that session stays held until the next start of this manager instance. */
+    async retireChatSessionsOnStop() {
+        const queue = this.chatExpiry.remaining();
+        const failed = [];
+        const retireOne = async (session) => {
+            const at = `chat session ${session.alias} (uid ${session.lifecycleUid})`;
+            try {
+                if (await this.admitChatRetirement(session) === "alreadyRetired") {
+                    console.error(`${at} was already retired at stop`);
+                    return;
+                }
+                await this.chatTerminal(session);
+                console.error(`${at} retired at stop`);
+            }
+            catch (e) {
+                if (e instanceof EpEnvelopeError && (e.code === "not-found" || e.code === "failed-precondition")) {
+                    this.chatExpiry.forget(session.lifecycleUid);
+                    console.error(`! ${at} was not retired at stop: its slot is not this instance's to retire (${e.message})`);
+                    return;
+                }
+                failed.push(`${session.alias} (uid ${session.lifecycleUid}): ${rejectionText(e)}`);
+                console.error(`! ${at} was not retired at stop (${rejectionText(e)}); it stays held until the next start of this manager instance`);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(CHAT_EXPIRY_CONCURRENCY, queue.length) }, async () => {
+            for (let next = queue.shift(); next !== undefined; next = queue.shift())
+                await retireOne(next);
+        }));
+        if (failed.length)
+            throw new Error(`${failed.length} chat session(s) were not retired and stay held until the next start of this manager instance: ${failed.join("; ")}`);
+    }
+    /** Name, at a stop that does not retire them, each chat session this process still tracks. */
+    reportChatSessionsLeftAtStop(why) {
+        for (const session of this.chatExpiry.remaining())
+            console.error(`! chat session ${session.alias} (uid ${session.lifecycleUid}) was not retired because ${why}; the next start of this manager instance retires it`);
+    }
     /** F5(b) push renewal of ONE live managed-static credential (Unit B): re-mint the SAME nkey
      *  identity with the SAME scope (recorded on the managed row at spawn) and a fresh bounded
      *  exp, ledger the new credentialId (slot record first, then the row, then the file — a
@@ -9505,6 +9949,15 @@ export class Manager {
                     preservedForeign++;
                     continue;
                 }
+                // A chat session this process is opening or holds is live membership, as an adopted seat
+                // is: its own open, expiry or stop runs its terminal, which this sweep must not race. The
+                // match is the exact registered alias, actor and UID under this logical instance and this
+                // process's incarnation, so a foreign, legacy or unrecorded row, or any UID this process
+                // did not register, falls through to the ordinary plan below.
+                if (this.holdsLiveChatSlot(row)) {
+                    preservedAdopted++;
+                    continue;
+                }
                 // ADOPTION is genuine membership: a slot backed by a live managed agent THIS process owns
                 // at the SAME uid is never an orphan (empty at boot; exactly the adopted set at the
                 // post-adoption sweep — the fix for the F3 resume hole).
@@ -9721,6 +10174,8 @@ export class Manager {
      *  supervisor); regular agents are denied STREAM.PURGE under auth. Cleanup only: leaves live agents and
      *  the TASK queue alone. */
     async opPurge(args, _caller) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         const includeDms = args.includeDms === true;
         try {
             const creds = this.auth ? await mintCreds(this.auth, newIdentity(), "purger") : undefined;
@@ -9748,6 +10203,8 @@ export class Manager {
      *  only if `file.owner == caller`, else admin is required. Fail-closed: an ownerless file
      *  (legacy / operator-written) is admin-only. */
     opDefinePersona(args, caller, admin) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
         const name = String(args.name ?? "").trim();
         if (!name)
             return { ok: false, error: "name required" };
@@ -9898,13 +10355,16 @@ export class Manager {
      *  `enter` defaults to true: a harness command typed but not submitted has not been delivered.
      *  Nothing is echoed back; the caller reads the resulting turns from the event plane. */
     async inputAuthorized(a, args) {
+        // These three refuse before the first write, so nothing was typed (SPEC 13.3). A write the
+        // runtime rejects below states no outcome: the runtime contract does not say a rejected write
+        // delivered nothing, and an earlier slice may already have reached the seat.
         if (this.agents.get(a.name) !== a)
-            throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" was replaced during authorization - retry`);
+            throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" was replaced during authorization - retry`, undefined, "not-executed");
         if (a.handle.status() !== "running")
-            throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" is not running (${a.handle.status()}); nothing to type into`);
+            throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" is not running (${a.handle.status()}); nothing to type into`, undefined, "not-executed");
         const write = a.handle.write?.bind(a.handle);
         if (!write)
-            throw new EpEnvelopeError("unimplemented", `input is not supported by runtime ${a.handle.kind}`);
+            throw new EpEnvelopeError("unimplemented", `input is not supported by runtime ${a.handle.kind}`, undefined, "not-executed");
         // The contract validated `text` (non-empty, <= 64KiB) and `enter` (boolean) before this ran, so
         // the only decision left is the carriage return. `!== false` and not `?? true`: an ABSENT enter
         // and an explicit `true` must behave identically, and only `false` may suppress the return.
@@ -9978,18 +10438,19 @@ export class Manager {
      *  redeems it over the mesh with a per-session rails-only cred it mints itself. Only streamable
      *  backends (pty/host) attach; an external runtime's attach() throws with per-runtime guidance. */
     async attachAuthorized(a, caller) {
+        // Every refusal before establishAttach below has opened no session, so it states that (SPEC 13.3).
         if (!this.sessionPlane)
-            return { ok: false, error: "the manager session plane is not available (the manager is not fully started)" };
+            throw new EpEnvelopeError("failed-precondition", "the manager session plane is not available (the manager is not fully started)", undefined, "not-executed");
         // A name is a reusable slot and the authorization above can await (user mode reads the ledger).
         // The ep target is incarnation-pinned, so `a` cannot BE a successor — but the slot it names can
         // have been stopped and refilled while we waited, and everything below must act on the
         // incarnation this caller was actually authorized for, never on whoever holds the name now.
         if (this.agents.get(a.name) !== a)
-            return { ok: false, error: `agent "${a.name}" was replaced during authorization - retry` };
+            throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" was replaced during authorization - retry`, undefined, "not-executed");
         // Never establish a session over a dead agent — a doomed session (the caller would get an
         // immediate process-exit at best, a confusing empty terminal at worst). Refuse honestly.
         if (a.handle.status() !== "running")
-            return { ok: false, error: `agent "${a.name}" is not running (${a.handle.status()}); nothing to attach` };
+            throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" is not running (${a.handle.status()}); nothing to attach`, undefined, "not-executed");
         // CLAIM the session slot BEFORE attaching the target's PTY, matching the console door: this door
         // used to attach first and check capacity inside establishAttach, so a `resource-exhausted`
         // refusal landed AFTER the attach. The claim is carried INTO establishAttach, so one reservation
@@ -10007,7 +10468,8 @@ export class Manager {
         }
         catch (e) {
             slot.release();
-            return { ok: false, error: rejectionText(e) };
+            // The external runtimes refuse attach() before acquiring anything (see the residual above).
+            throw new EpEnvelopeError("failed-precondition", rejectionText(e), undefined, "not-executed");
         }
         // establishAttach releases the claim it was handed on every exit; nothing to unwind here.
         const { grant } = await this.sessionPlane.establishAttach(caller, { name: a.name, lifecycleUid: a.lifecycleUid }, session, slot);
@@ -10066,6 +10528,7 @@ export class Manager {
      *  owner-domain bound); undefined = unbounded. {@link NO_OWNER_MATCHES} matches nothing. */
     list(ownerFilter) {
         const roster = new Map(this.ep.getRoster().map((p) => [p.card.name, p]));
+        const observedAt = Date.now();
         // The roster is only evidence while THIS observer's presence watch is fresh. A stale view
         // (whole-bucket silence past TTL) or an unpopulated one (snapshot not yet replayed) cannot
         // support "offline" or "absent" for anyone: a live deployment on 2026-09-09 rendered every live seat as
@@ -10085,6 +10548,7 @@ export class Manager {
             // The connector-reported provider from presence (#785): the live roster card's `meta.provider`,
             // when it is a non-empty string. Absent when the connector reported none — never fabricated.
             const seen = roster.get(a.name);
+            const presenceIdentityVerified = this.isOwnPresence(a, seen);
             const providerMeta = seen?.card.meta?.provider;
             const provider = typeof providerMeta === "string" && providerMeta ? providerMeta : undefined;
             // The harness-reported condition beside the mesh status (#618): a turn that died upstream reads
@@ -10129,6 +10593,8 @@ export class Manager {
                 // `current` is the only state in which `mesh` is a verdict; the other two are the
                 // observer's own condition and travel on the row (older CLIs ignore the field).
                 meshView: view.state,
+                presenceIdentityVerified,
+                ...(view.state === "current" && presenceIdentityVerified ? { presenceObservedAt: observedAt } : {}),
                 ...(offlineSince !== undefined ? { offlineSince } : {}),
                 // The incarnation coordinate (SPEC 13.1) — with `id`, exactly what a v0.4 caller needs to
                 // build a targeted (`despawn`/`attach`) request against THIS incarnation.