@akagilnc/pi-workflow-roles 0.1.5307 → 0.1.5312

package/dist/acp-host/production-host.js

@@ -13,11 +13,114 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/host-descriptions.ts
+import { join } from "node:path";
+function resolveHostBinary(description, operatorHome) {
+  return join(operatorHome, ...description.binaryFromHome);
+}
+function lookupHostDescription(host) {
+  return Object.hasOwn(HOST_DESCRIPTIONS, host) ? HOST_DESCRIPTIONS[host] : void 0;
+}
+function lookupHeadlessHostDescription(host) {
+  return Object.hasOwn(HEADLESS_HOST_DESCRIPTIONS, host) ? HEADLESS_HOST_DESCRIPTIONS[host] : void 0;
+}
+function lookupHostFamily(host) {
+  if (lookupHostDescription(host) !== void 0) return "acp";
+  if (lookupHeadlessHostDescription(host) !== void 0) return "headless";
+  return void 0;
+}
+function packagedExternalHostNames() {
+  return [...Object.keys(HOST_DESCRIPTIONS), ...Object.keys(HEADLESS_HOST_DESCRIPTIONS)];
+}
+function assertRegisteredHostName(host) {
+  if (host === DEFAULT_ROLE_TURN_HOST || lookupHostFamily(host) !== void 0) {
+    return host;
+  }
+  throw new Error(`unregistered host: ${host}`);
+}
+var DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
+var init_host_descriptions = __esm({
+  "src/host-descriptions.ts"() {
+    "use strict";
+    DEFAULT_ROLE_TURN_HOST = "pi";
+    HOST_DESCRIPTIONS = Object.freeze({
+      /** Operator home `~/.grok`, native session/load resume, `agent [--model X] stdio`. */
+      "grok-build": Object.freeze({
+        binaryFromHome: Object.freeze([".grok", "bin", "grok"]),
+        argv: Object.freeze({
+          prefix: Object.freeze(["agent"]),
+          suffix: Object.freeze(["stdio"]),
+          modelFlag: "--model"
+        }),
+        modelPassing: "argv",
+        sessionBindingFile: "grok-acp-session.json"
+      }),
+      /**
+       * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
+       * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
+       * (seat table provider + model concatenated). Reasoning is the global
+       * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
+       * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
+       */
+      "hermes": Object.freeze({
+        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
+        argv: Object.freeze({
+          prefix: Object.freeze(["acp"]),
+          suffix: Object.freeze([]),
+          thinkingFlag: "--reasoning"
+        }),
+        modelPassing: "set_model",
+        sessionBindingFile: "hermes-acp-session.json",
+        seatProfileSoul: Object.freeze({
+          flag: "-p",
+          namePrefix: "ak-",
+          profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
+          soulFileName: "SOUL.md"
+        })
+      })
+    });
+    HEADLESS_HOST_DESCRIPTIONS = Object.freeze({
+      "claude": Object.freeze({
+        protocol: "claude-print",
+        binaryFromHome: Object.freeze([".local", "bin", "claude"]),
+        sessionBindingFile: "claude-headless-session.json",
+        fixedArgs: Object.freeze([
+          // Live NDJSON events → sitian host-session records (#811); last line is the result receipt.
+          "--output-format",
+          "stream-json",
+          // Intermediate assistant/tool/system events require verbose with stream-json.
+          "--verbose",
+          "--permission-mode",
+          "bypassPermissions"
+        ]),
+        promptFlag: "-p",
+        modelFlag: "--model",
+        effortFlag: "--effort",
+        // File path keeps large role envelopes off ARG_MAX.
+        systemPromptFlag: "--system-prompt-file",
+        jsonSchemaFlag: "--json-schema",
+        mcpConfigFlag: "--mcp-config",
+        sessionIdFlag: "--session-id",
+        resumeFlag: "--resume"
+      }),
+      /**
+       * Codex headless (#646). Binary under operator home; auth stays in CODEX_HOME.
+       * Argv/parse/schema-close are codex-exec helpers — not Claude flag mapping.
+       */
+      "codex": Object.freeze({
+        protocol: "codex-exec",
+        binaryFromHome: Object.freeze([".local", "bin", "codex"]),
+        sessionBindingFile: "codex-headless-session.json"
+      })
+    });
+  }
+});
+
 // src/engine-detour.ts
 import { spawn } from "node:child_process";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 function normalizeEngineName(engine) {
   if (engine === void 0) return void 0;
   const trimmed = engine.trim();
@@ -118,8 +221,8 @@ async function runEngineDetourOnce(input) {
   if (input.stagedPrompt === void 0) {
     return spawnEngineDetourOnce(input);
   }
-  const stagingDir = await mkdtemp(join(tmpdir(), "ak-engine-detour-"));
-  const stagedPath = join(stagingDir, "prompt.txt");
+  const stagingDir = await mkdtemp(join2(tmpdir(), "ak-engine-detour-"));
+  const stagedPath = join2(stagingDir, "prompt.txt");
   let result;
   let runError;
   try {
@@ -962,7 +1065,7 @@ __export(run_ticket_number_exports, {
   requireSafePositiveTicketNumber: () => requireSafePositiveTicketNumber
 });
 import { readFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 function isEnoent(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
@@ -1002,7 +1105,7 @@ async function readJsonObject(path) {
   }
 }
 async function readBoardPageTicketNumber(runDirectory, page) {
-  const record4 = await readJsonObject(join2(runDirectory, page));
+  const record4 = await readJsonObject(join3(runDirectory, page));
   if (record4 === void 0) return void 0;
   return ticketFromRecord(record4);
 }
@@ -1011,7 +1114,7 @@ async function readBoardTicketNumber(runDirectory) {
 }
 async function readMigrationDerivedTicketNumber(runDirectory) {
   const record4 = await readJsonObject(
-    join2(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE)
+    join3(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE)
   );
   if (record4 === void 0) return void 0;
   if (record4.derivation !== "worktree-path-basename") return void 0;
@@ -1935,7 +2038,7 @@ import {
   statSync
 } from "node:fs";
 import { userInfo } from "node:os";
-import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative, resolve as resolve2, sep } from "node:path";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join4, relative, resolve as resolve2, sep } from "node:path";
 function packageMachineHome() {
   return resolve2(userInfo().homedir);
 }
@@ -1975,7 +2078,7 @@ function resolveActivationLedgerHomeForPath(path) {
   return resolveActivationLedgerHome();
 }
 function activationBookDirectory(ledgerHome, bookKey) {
-  return join3(ledgerHome, "books", bookKey);
+  return join4(ledgerHome, "books", bookKey);
 }
 function pathContainedIn(root, candidate) {
   const rel = relative(root, candidate);
@@ -1988,7 +2091,7 @@ function physicalPathIdentity(path) {
   while (true) {
     try {
       const real = realpathSync(cursor);
-      return missing.length === 0 ? real : join3(real, ...missing);
+      return missing.length === 0 ? real : join4(real, ...missing);
     } catch (error) {
       if (errnoCode(error) !== "ENOENT") {
         return absolute;
@@ -2088,7 +2191,7 @@ function ensureRealDirectoryTree(root, targetDir) {
     if (part === "..") {
       throw new ActivationLedgerError(`activation ledger path contains '..': ${absoluteTarget}`);
     }
-    lexicalCursor = join3(lexicalCursor, part);
+    lexicalCursor = join4(lexicalCursor, part);
     let st;
     try {
       st = lstatSync(lexicalCursor);
@@ -2211,7 +2314,7 @@ var init_sitian_contracts = __esm({
 // src/sitian-appender.ts
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname3, join as join5 } from "node:path";
 function appendSitianRecordBlock(input, block) {
   if (block === "") return;
   try {
@@ -2233,8 +2336,8 @@ function resolveSitianVolumeCategory(kind) {
   return kind;
 }
 function ticketProvenanceUnderBookPaths(ledgerHome, bookKey, ticketId) {
-  const sessionDir = join4(activationBookDirectory(ledgerHome, bookKey), ticketId);
-  return { sessionDir, recordFile: join4(sessionDir, SITIAN_RECORDS_LEAF) };
+  const sessionDir = join5(activationBookDirectory(ledgerHome, bookKey), ticketId);
+  return { sessionDir, recordFile: join5(sessionDir, SITIAN_RECORDS_LEAF) };
 }
 function resolveSitianRecordPathInLedger(input, ledgerHome) {
   const category = resolveSitianVolumeCategory(input.kind);
@@ -2251,13 +2354,13 @@ function resolveSitianRecordPathInLedger(input, ledgerHome) {
     recordFile = paths.recordFile;
   } else if (category === "ticket-provenance" && input.runDirectory !== void 0) {
     sessionDir = input.runDirectory;
-    recordFile = join4(sessionDir, SITIAN_RECORDS_LEAF);
+    recordFile = join5(sessionDir, SITIAN_RECORDS_LEAF);
   } else {
     if (input.sessionParent === void 0 || input.sessionParent.length === 0 || !physicallyContainedIn(ledgerHome, input.sessionParent)) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = join4(dirname3(input.sessionParent), category);
-    recordFile = join4(sessionDir, SITIAN_RECORDS_LEAF);
+    sessionDir = join5(dirname3(input.sessionParent), category);
+    recordFile = join5(sessionDir, SITIAN_RECORDS_LEAF);
   }
   if (!physicallyContainedIn(ledgerHome, sessionDir)) {
     throw new Error("Sitian record ownership requires a directory inside the ledger home");
@@ -2386,7 +2489,7 @@ var init_sitian_facade = __esm({
 
 // src/role-run-placement.ts
 import { readdir } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 function isMissingPathError(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
@@ -2403,13 +2506,13 @@ async function listBookRunDirectories(bookDir) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const runDir = join5(runsDir, entry.name);
+      const runDir = join6(runsDir, entry.name);
       if (seen.has(runDir)) continue;
       seen.add(runDir);
       out.push(runDir);
     }
   };
-  await collect(join5(bookDir, "runs"));
+  await collect(join6(bookDir, "runs"));
   let subjects;
   try {
     subjects = await readdir(bookDir, { withFileTypes: true });
@@ -2419,7 +2522,7 @@ async function listBookRunDirectories(bookDir) {
   }
   for (const subject of subjects) {
     if (!subject.isDirectory() || subject.name === "runs") continue;
-    await collect(join5(bookDir, subject.name, "runs"));
+    await collect(join6(bookDir, subject.name, "runs"));
   }
   return out.sort();
 }
@@ -2428,23 +2531,23 @@ function roleRunPlacement(ledgerHome, input) {
     input.subject.ticketNumber,
     "roleRunPlacement subject.ticketNumber"
   )) : "unbound";
-  const runDirectory = join5(
+  const runDirectory = join6(
     activationBookDirectory(ledgerHome, input.bookKey),
     subjectDirectory,
     "runs",
     `${input.runId}@${input.role}`
   );
-  const sessionDirectory = join5(runDirectory, "session");
+  const sessionDirectory = join6(runDirectory, "session");
   return {
     runDirectory,
     sessionDirectory,
-    sessionFile: join5(sessionDirectory, "session.jsonl"),
+    sessionFile: join6(sessionDirectory, "session.jsonl"),
     artifactsDirectory: roleRunArtifactsDirectory(runDirectory),
-    attachmentsDirectory: join5(runDirectory, "attachments")
+    attachmentsDirectory: join6(runDirectory, "attachments")
   };
 }
 function roleRunArtifactsDirectory(runDirectory) {
-  return join5(runDirectory, "artifacts");
+  return join6(runDirectory, "artifacts");
 }
 function ensureRoleRunDirectory(ledgerHome, directory) {
   return ensureRealDirectoryTree(ledgerHome, directory);
@@ -2476,7 +2579,7 @@ __export(run_terminal_artifacts_exports, {
   runIdFromRunDirectory: () => runIdFromRunDirectory
 });
 import { readdir as readdir2, readFile as readFile3 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname4, join as join6 } from "node:path";
+import { basename as basename3, dirname as dirname4, join as join7 } from "node:path";
 function isMissingPathError2(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
@@ -2551,7 +2654,7 @@ async function listUniqueErrorFallbackPaths(directories) {
     }
     for (const name of names.sort((a, b) => a.localeCompare(b))) {
       if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
-      found.push(join6(dir, name));
+      found.push(join7(dir, name));
     }
   }
   return found;
@@ -2597,11 +2700,11 @@ async function readRunTerminalArtifact(runDirectory) {
     unreadable.push(read);
   };
   for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    consider(await readTerminalArtifactAtPath(join6(artifactsDir, file), file));
+    consider(await readTerminalArtifactAtPath(join7(artifactsDir, file), file));
   }
   for (const relative4 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
     consider(
-      await readTerminalArtifactAtPath(join6(runDirectory, relative4), "error.json")
+      await readTerminalArtifactAtPath(join7(runDirectory, relative4), "error.json")
     );
   }
   for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
@@ -2663,9 +2766,9 @@ var init_cli_errors = __esm({
 
 // src/typed-provider-http.ts
 import { readFile as readFile4, unlink, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function typedProviderHttpPath(runDirectory) {
-  return join7(runDirectory, TYPED_HTTP_FILE);
+  return join8(runDirectory, TYPED_HTTP_FILE);
 }
 async function clearTypedProviderHttpObservation(runDirectory) {
   try {
@@ -2809,7 +2912,7 @@ __export(auditor_dossier_tool_exports, {
   auditorRunDirectory: () => auditorRunDirectory,
   createAuditorDossierTool: () => createAuditorDossierTool
 });
-import { dirname as dirname5, join as join8, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join9, resolve as resolve3 } from "node:path";
 import { Type as Type10 } from "typebox";
 function auditorRunDirectory(context) {
   const sessionFile = context.sessionManager?.getSessionFile?.();
@@ -2832,9 +2935,9 @@ function createAuditorDossierTool(runDirectory) {
       }
       const details = {
         runDirectory,
-        admittedRequest: join8(runDirectory, "admitted-request.json"),
-        parentSessionCandidate: join8(runDirectory, "session", "session.jsonl"),
-        attachments: join8(runDirectory, "attachments"),
+        admittedRequest: join9(runDirectory, "admitted-request.json"),
+        parentSessionCandidate: join9(runDirectory, "session", "session.jsonl"),
+        attachments: join9(runDirectory, "attachments"),
         artifacts: roleRunArtifactsDirectory(runDirectory)
       };
       return {
@@ -3250,7 +3353,7 @@ __export(session_assistant_usage_exports, {
   sessionFileFromPublicSummon: () => sessionFileFromPublicSummon,
   usageFromPublicSummon: () => usageFromPublicSummon
 });
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 async function readAssistantUsageFromSessionFile(sessionFile) {
   const { readFile: readFile25 } = await import("node:fs/promises");
   let text;
@@ -3320,7 +3423,7 @@ async function readAssistantUsageFromSessionFile(sessionFile) {
 }
 function sessionFileFromPublicSummon(summoned) {
   if (typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== "") {
-    return join9(summoned.runDirectory, "session", "session.jsonl");
+    return join10(summoned.runDirectory, "session", "session.jsonl");
   }
   const fromArtifacts = summoned.terminal?.artifacts?.map((a) => a.path).find((p) => typeof p === "string" && p.endsWith("session.jsonl"));
   if (fromArtifacts !== void 0) return fromArtifacts;
@@ -3329,7 +3432,7 @@ function sessionFileFromPublicSummon(summoned) {
   const facts = outcome.decisiveFacts;
   const pointer = facts?.runPointer;
   if (typeof pointer === "string" && pointer.trim() !== "") {
-    return join9(pointer, "session", "session.jsonl");
+    return join10(pointer, "session", "session.jsonl");
   }
   return void 0;
 }
@@ -3346,7 +3449,7 @@ var init_session_assistant_usage = __esm({
 
 // src/package-resources/engine-material.ts
 import { existsSync as existsSync2, readdirSync } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function pickEngineAxis(source) {
   return {
     ...source.engine === void 0 ? {} : { engine: source.engine },
@@ -3367,11 +3470,11 @@ function isEngineNameSyntax(name) {
   return true;
 }
 function resolveEngineMaterialDirectory(packageRoot) {
-  return join10(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
+  return join11(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
 }
 function resolveEngineMaterialPath(packageRoot, name) {
   const legal = assertLegalEngineName(name);
-  return join10(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
+  return join11(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
 }
 function assertLegalEngineName(name) {
   if (!isEngineNameSyntax(name)) {
@@ -3428,7 +3531,7 @@ __export(durable_principal_exports, {
   issuePiDurablePrincipalCoordinates: () => issuePiDurablePrincipalCoordinates,
   piDurablePrincipalAuthority: () => piDurablePrincipalAuthority
 });
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function encode(coordinates) {
   return coordinates;
 }
@@ -3478,7 +3581,7 @@ var init_durable_principal = __esm({
         }
         return {
           sessionDirectory: record4.sessionDirectory,
-          sessionFile: typeof record4.sessionFile === "string" && record4.sessionFile.trim() !== "" ? record4.sessionFile : join11(record4.sessionDirectory, "session.jsonl")
+          sessionFile: typeof record4.sessionFile === "string" && record4.sessionFile.trim() !== "" ? record4.sessionFile : join12(record4.sessionDirectory, "session.jsonl")
         };
       }
     };
@@ -3541,12 +3644,12 @@ __export(role_turn_host_exports, {
 import { execFile, spawn as spawn2 } from "node:child_process";
 import { constants } from "node:fs";
 import { access, appendFile, readFile as readFile6, realpath } from "node:fs/promises";
-import { delimiter, dirname as dirname6, isAbsolute as isAbsolute3, join as join12, resolve as resolve4 } from "node:path";
+import { delimiter, dirname as dirname6, isAbsolute as isAbsolute3, join as join13, resolve as resolve4 } from "node:path";
 import { platform } from "node:process";
 import { promisify } from "node:util";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function resolveInternalRoleEntrypoint(packageRoot) {
-  return join12(packageRoot, INTERNAL_ROLE_ENTRYPOINT_RELATIVE);
+  return join13(packageRoot, INTERNAL_ROLE_ENTRYPOINT_RELATIVE);
 }
 function buildExplicitInternalActivationArgs(selectedRoleEntry, extraArgs = []) {
   return ["--no-extensions", "-e", selectedRoleEntry, ...extraArgs];
@@ -3842,105 +3945,6 @@ var init_role_turn_host = __esm({
   }
 });
 
-// src/host-descriptions.ts
-function lookupHostDescription(host) {
-  return Object.hasOwn(HOST_DESCRIPTIONS, host) ? HOST_DESCRIPTIONS[host] : void 0;
-}
-function lookupHeadlessHostDescription(host) {
-  return Object.hasOwn(HEADLESS_HOST_DESCRIPTIONS, host) ? HEADLESS_HOST_DESCRIPTIONS[host] : void 0;
-}
-function lookupHostFamily(host) {
-  if (lookupHostDescription(host) !== void 0) return "acp";
-  if (lookupHeadlessHostDescription(host) !== void 0) return "headless";
-  return void 0;
-}
-function packagedExternalHostNames() {
-  return [...Object.keys(HOST_DESCRIPTIONS), ...Object.keys(HEADLESS_HOST_DESCRIPTIONS)];
-}
-function assertRegisteredHostName(host) {
-  if (host === DEFAULT_ROLE_TURN_HOST || lookupHostFamily(host) !== void 0) {
-    return host;
-  }
-  throw new Error(`unregistered host: ${host}`);
-}
-var DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
-var init_host_descriptions = __esm({
-  "src/host-descriptions.ts"() {
-    "use strict";
-    DEFAULT_ROLE_TURN_HOST = "pi";
-    HOST_DESCRIPTIONS = Object.freeze({
-      /** Operator home `~/.grok`, native session/load resume, `agent [--model X] stdio`. */
-      "grok-build": Object.freeze({
-        binaryFromHome: Object.freeze([".grok", "bin", "grok"]),
-        argv: Object.freeze({
-          prefix: Object.freeze(["agent"]),
-          suffix: Object.freeze(["stdio"]),
-          modelFlag: "--model"
-        }),
-        modelPassing: "argv",
-        sessionBindingFile: "grok-acp-session.json"
-      }),
-      /**
-       * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
-       * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
-       * (seat table provider + model concatenated). Reasoning is the global
-       * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
-       * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
-       */
-      "hermes": Object.freeze({
-        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
-        argv: Object.freeze({
-          prefix: Object.freeze(["acp"]),
-          suffix: Object.freeze([]),
-          thinkingFlag: "--reasoning"
-        }),
-        modelPassing: "set_model",
-        sessionBindingFile: "hermes-acp-session.json",
-        seatProfileSoul: Object.freeze({
-          flag: "-p",
-          namePrefix: "ak-",
-          profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
-          soulFileName: "SOUL.md"
-        })
-      })
-    });
-    HEADLESS_HOST_DESCRIPTIONS = Object.freeze({
-      "claude": Object.freeze({
-        protocol: "claude-print",
-        binaryFromHome: Object.freeze([".local", "bin", "claude"]),
-        sessionBindingFile: "claude-headless-session.json",
-        fixedArgs: Object.freeze([
-          // Live NDJSON events → sitian host-session records (#811); last line is the result receipt.
-          "--output-format",
-          "stream-json",
-          // Intermediate assistant/tool/system events require verbose with stream-json.
-          "--verbose",
-          "--permission-mode",
-          "bypassPermissions"
-        ]),
-        promptFlag: "-p",
-        modelFlag: "--model",
-        effortFlag: "--effort",
-        // File path keeps large role envelopes off ARG_MAX.
-        systemPromptFlag: "--system-prompt-file",
-        jsonSchemaFlag: "--json-schema",
-        mcpConfigFlag: "--mcp-config",
-        sessionIdFlag: "--session-id",
-        resumeFlag: "--resume"
-      }),
-      /**
-       * Codex headless (#646). Binary under operator home; auth stays in CODEX_HOME.
-       * Argv/parse/schema-close are codex-exec helpers — not Claude flag mapping.
-       */
-      "codex": Object.freeze({
-        protocol: "codex-exec",
-        binaryFromHome: Object.freeze([".local", "bin", "codex"]),
-        sessionBindingFile: "codex-headless-session.json"
-      })
-    });
-  }
-});
-
 // src/sha256.ts
 import { createHash as createHash2 } from "node:crypto";
 function sha256Hex(bytes) {
@@ -4656,13 +4660,13 @@ var init_session_dialogue = __esm({
 
 // src/ticket-provenance.ts
 import { readFile as readFile10, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname8, join as join13, resolve as resolve7 } from "node:path";
+import { basename as basename4, dirname as dirname8, join as join14, resolve as resolve7 } from "node:path";
 function dialogueSessionSourceRoots(home) {
   const machineHome = typeof home === "string" && home.trim() !== "" ? home : packageMachineHome();
   return [
-    join13(machineHome, ".claude", "projects"),
-    join13(machineHome, ".codex", "sessions"),
-    join13(machineHome, ".pi", "agent", "sessions")
+    join14(machineHome, ".claude", "projects"),
+    join14(machineHome, ".codex", "sessions"),
+    join14(machineHome, ".pi", "agent", "sessions")
   ];
 }
 function isLedgerRoleSessionFile(absolute, home) {
@@ -4700,7 +4704,7 @@ function ticketProvenanceRecordInput(ticketNumber, cwd, home, runDirectory) {
   };
 }
 async function rehomeUnboundTicketProvenance(runDirectory, ticketNumber, cwd, home) {
-  const source = join13(runDirectory, "records.jsonl");
+  const source = join14(runDirectory, "records.jsonl");
   let content;
   try {
     content = await readFile10(source, "utf8");
@@ -4910,7 +4914,7 @@ var init_uuidv7 = __esm({
 });
 
 // src/notary-source-run.ts
-import { dirname as dirname9, isAbsolute as isAbsolute5, join as join14, resolve as resolve8, basename as basename5 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute5, join as join15, resolve as resolve8, basename as basename5 } from "node:path";
 import { lstat, realpath as realpath3 } from "node:fs/promises";
 async function readRetainedIdentity(runDirectory) {
   try {
@@ -4967,11 +4971,11 @@ async function resolveNotarySourceRunLocator(options) {
   const ledgerHome = resolveActivationLedgerHome(options.home);
   const bookKey = resolveBookKeyFromGit(options.projectRoot);
   const bookDirectory = activationBookDirectory(ledgerHome, bookKey);
-  const bookRunsRoot = join14(bookDirectory, "runs");
+  const bookRunsRoot = join15(bookDirectory, "runs");
   let candidate;
   const bare = parseRunDirectoryName(raw);
   if (bare !== void 0 && !raw.includes("/") && !raw.includes("\\")) {
-    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join14(bookRunsRoot, `${bare.runId}@${bare.role}`);
+    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join15(bookRunsRoot, `${bare.runId}@${bare.role}`);
   } else {
     candidate = isAbsolute5(raw) ? raw : resolve8(options.projectRoot, raw);
     const identity2 = parseRunDirectoryName(basename5(candidate));
@@ -6186,7 +6190,7 @@ import {
   writeFile as writeFile3
 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute6, join as join15, resolve as resolve9, sep as sep3 } from "node:path";
+import { basename as basename6, dirname as dirname10, isAbsolute as isAbsolute6, join as join16, resolve as resolve9, sep as sep3 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
   const bookKey = resolveBookKeyFromGit(request.cwd);
@@ -6240,14 +6244,14 @@ async function writeRoleInvocationLedger(source, role, effectiveModel) {
     ...effectiveModelLedgerFields(effectiveModel)
   };
   await writeFile3(
-    join15(source.runDirectory, "invocation.json"),
+    join16(source.runDirectory, "invocation.json"),
     `${JSON.stringify(identity, null, 2)}
 `,
     "utf8"
   );
 }
 async function recordEffectiveInvocationModel(runDirectory, model, engine, host, engineModel) {
-  const ledgerPath = join15(runDirectory, "invocation.json");
+  const ledgerPath = join16(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile11(ledgerPath, "utf8"));
   const next = { ...current };
   if (model !== void 0) {
@@ -6280,7 +6284,7 @@ async function recordEffectiveInvocationModel(runDirectory, model, engine, host,
   );
 }
 async function mergeInvocationIdentityPage(runDirectory, fields) {
-  const ledgerPath = join15(runDirectory, "invocation.json");
+  const ledgerPath = join16(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile11(ledgerPath, "utf8"));
   await writeFile3(
     ledgerPath,
@@ -6363,7 +6367,7 @@ async function relocateAdmittedRunToTicket(admitted, authority, heldLease) {
     const childRunIds = parentPage.childDiaristRunIds;
     for (const childRunId of Array.isArray(childRunIds) ? childRunIds : []) {
       if (typeof childRunId !== "string") continue;
-      const childDirectory = join15(dirname10(oldRunDirectory), `${childRunId}@diarist`);
+      const childDirectory = join16(dirname10(oldRunDirectory), `${childRunId}@diarist`);
       if (!existsSync3(childDirectory)) continue;
       const childTarget = roleRunPlacement(ledgerHome, {
         bookKey: admitted.bookKey,
@@ -6420,7 +6424,7 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
     ticketNumber,
     "bindTicketNumberOnRunDirectory"
   );
-  const admittedPath = join15(runDirectory, "admitted-request.json");
+  const admittedPath = join16(runDirectory, "admitted-request.json");
   const admitted = JSON.parse(await readFile11(admittedPath, "utf8"));
   if (admitted.ticketNumber === ticketNumber) return;
   await writeFile3(
@@ -6440,7 +6444,7 @@ async function recordLaunchedPiIdentity(runDirectory, identity) {
 async function observeLaunchedRolePackageIdentity(packageRoot, selectedRoleEntry) {
   const rolePackageRoot = packageRoot;
   const raw = JSON.parse(
-    await readFile11(join15(rolePackageRoot, "package.json"), "utf8")
+    await readFile11(join16(rolePackageRoot, "package.json"), "utf8")
   );
   if (typeof raw.version !== "string" || raw.version.trim() === "") {
     throw new Error(
@@ -6728,13 +6732,13 @@ async function removePreparedAttachmentDirectory(stagingDirectory) {
 }
 async function withPreparedAttachments(attachmentPaths, use) {
   if (attachmentPaths.length === 0) return await use([]);
-  const stagingDirectory = await mkdtemp2(join15(tmpdir2(), "ak-role-attachments-"));
+  const stagingDirectory = await mkdtemp2(join16(tmpdir2(), "ak-role-attachments-"));
   const prepared = [];
   let result;
   try {
     for (let index = 0; index < attachmentPaths.length; index += 1) {
       const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
-      const snapshotPath = join15(stagingDirectory, String(index).padStart(6, "0"));
+      const snapshotPath = join16(stagingDirectory, String(index).padStart(6, "0"));
       await writeFile3(snapshotPath, bytes);
       prepared.push({ absolute, snapshotPath });
     }
@@ -6755,7 +6759,7 @@ async function withPreparedAttachments(attachmentPaths, use) {
   return result;
 }
 async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
-  const frozenPath = join15(
+  const frozenPath = join16(
     destinationDir,
     `${String(index).padStart(2, "0")}-${basename6(provenancePath)}`
   );
@@ -6798,14 +6802,14 @@ async function freezeAttachments(attachmentPaths, attachmentsDirectory) {
 async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKey = `s-${Date.now().toString(36)}`) {
   if (attachmentPaths.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = join15(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = join16(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
 async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
   if (prepared.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = summonsKey === void 0 ? join15(runDirectory, "attachments") : join15(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = summonsKey === void 0 ? join16(runDirectory, "attachments") : join16(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   const attachments = [];
   for (let index = 0; index < prepared.length; index += 1) {
@@ -6882,7 +6886,7 @@ async function admitPublicRole(role, parsed, env, override) {
         attachmentPaths,
         ...project,
         placedFields: async (placed) => {
-          const taskPath = join15(placed.runDirectory, "task.md");
+          const taskPath = join16(placed.runDirectory, "task.md");
           await writeFile3(taskPath, instruction, "utf8");
           return { phase, taskPath };
         }
@@ -6928,7 +6932,7 @@ async function admitPublicRole(role, parsed, env, override) {
         placedFields: async (placed) => {
           let prerequisitesPath;
           if (prerequisitesSource !== void 0) {
-            prerequisitesPath = join15(placed.runDirectory, "prerequisites.json");
+            prerequisitesPath = join16(placed.runDirectory, "prerequisites.json");
             await writeFile3(
               prerequisitesPath,
               `${JSON.stringify(prerequisites, null, 2)}
@@ -6936,7 +6940,7 @@ async function admitPublicRole(role, parsed, env, override) {
               "utf8"
             );
           }
-          const packetPath = join15(placed.runDirectory, "fix-packet.md");
+          const packetPath = join16(placed.runDirectory, "fix-packet.md");
           await writeFile3(packetPath, instruction, "utf8");
           return {
             phase,
@@ -6994,7 +6998,7 @@ async function admitPublicRole(role, parsed, env, override) {
         placedFields: async (placed) => {
           let requestManifestPath;
           if (manifestCanonicalJson !== void 0) {
-            requestManifestPath = join15(placed.runDirectory, "request-manifest.json");
+            requestManifestPath = join16(placed.runDirectory, "request-manifest.json");
             await writeFile3(requestManifestPath, manifestCanonicalJson, "utf8");
           }
           return {
@@ -7184,7 +7188,7 @@ async function admitPublicRole(role, parsed, env, override) {
             resolutionScope: [...derived.resolutionScope],
             authorizedChecks: []
           });
-          const mergerInputPath = join15(placed.runDirectory, "merger-input.json");
+          const mergerInputPath = join16(placed.runDirectory, "merger-input.json");
           await writeFile3(
             mergerInputPath,
             `${JSON.stringify(mergerInput, null, 2)}
@@ -7258,7 +7262,7 @@ function persistedAttachmentRefs(attachments) {
   }));
 }
 async function persistPlacedAdmission(admitted, placed, model) {
-  const admittedRequestPath = join15(placed.runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(placed.runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory: placed.sessionDirectory,
     sessionFile: placed.sessionFile
@@ -7311,7 +7315,7 @@ async function admitStandardMaterialInvocation(role, options) {
     attachments: persistedAttachmentRefs(placed.attachments),
     ...placed.ticketFields
   };
-  const admittedRequestPath = defer ? join15(placed.runDirectory, "admitted-request.json") : await persistPlacedAdmission(admitted, placed, options.model);
+  const admittedRequestPath = defer ? join16(placed.runDirectory, "admitted-request.json") : await persistPlacedAdmission(admitted, placed, options.model);
   return {
     role,
     runId: placed.runId,
@@ -7389,7 +7393,7 @@ async function materializeCountersignInvocation(admitted, options) {
   });
   const placement = placed;
   admitted.runDirectory = placement.runDirectory;
-  admitted.admittedRequestPath = join15(
+  admitted.admittedRequestPath = join16(
     placement.runDirectory,
     "admitted-request.json"
   );
@@ -7416,7 +7420,7 @@ async function materializeCountersignInvocation(admitted, options) {
 async function loadAdmittedJudgeRequest(runDirectory) {
   try {
     const raw = JSON.parse(
-      await readFile11(join15(runDirectory, "admitted-request.json"), "utf8")
+      await readFile11(join16(runDirectory, "admitted-request.json"), "utf8")
     );
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
     const record4 = raw;
@@ -7505,7 +7509,7 @@ function parseDoctorIssueNumber(raw) {
 }
 async function resolveDoctorCaseRunsPath(options) {
   const ledgerHome = resolveActivationLedgerHome(options.home);
-  const defaultRuns = join15(
+  const defaultRuns = join16(
     activationBookDirectory(ledgerHome, options.bookKey),
     String(options.issueNumber),
     "runs"
@@ -7826,15 +7830,15 @@ var init_invocation = __esm({
 
 // src/public-cli/load-production-acp-host.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { pathToFileURL } from "node:url";
 async function loadProductionAcpHostFactory(packageRoot, host) {
   const description = lookupHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered host: ${host}`);
   }
-  const built = join16(packageRoot, "dist/acp-host/production-host.js");
-  const source = join16(packageRoot, "src/acp-host/production-host.ts");
+  const built = join17(packageRoot, "dist/acp-host/production-host.js");
+  const source = join17(packageRoot, "src/acp-host/production-host.ts");
   const target = existsSync4(built) ? built : source;
   const href = pathToFileURL(target).href;
   const mod = await import(href);
@@ -7850,15 +7854,15 @@ var init_load_production_acp_host = __esm({
 
 // src/public-cli/load-production-headless-host.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 async function loadProductionHeadlessHostFactory(packageRoot, host) {
   const description = lookupHeadlessHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered headless host: ${host}`);
   }
-  const built = join17(packageRoot, "dist/headless-host/production-host.js");
-  const source = join17(packageRoot, "src/headless-host/production-host.ts");
+  const built = join18(packageRoot, "dist/headless-host/production-host.js");
+  const source = join18(packageRoot, "src/headless-host/production-host.ts");
   const target = existsSync5(built) ? built : source;
   const href = pathToFileURL2(target).href;
   const mod = await import(href);
@@ -7912,8 +7916,8 @@ __export(role_turn_host_resolution_exports, {
   resolveRoleTurnHost: () => resolveRoleTurnHost,
   selectRoleTurnHost: () => selectRoleTurnHost
 });
-function formatHostSelectionFailure(failure2) {
-  return `${failure2.kind}: ${failure2.host}; seat=${failure2.seat}; model=${failure2.model}; registered: ${failure2.registeredHosts.join(", ")}`;
+function formatHostSelectionFailure(failure) {
+  return `${failure.kind}: ${failure.host}; seat=${failure.seat}; model=${failure.model}; registered: ${failure.registeredHosts.join(", ")}`;
 }
 function composeRoleTurnHostAdapters(env, principalAuthority) {
   const piHost = env.roleTurnHost ?? createPiRoleTurnHost({
@@ -7973,9 +7977,9 @@ var init_role_turn_host_resolution = __esm({
     init_invocation();
     init_load_production_external_host();
     HostSelectionError = class extends Error {
-      constructor(failure2) {
-        super(formatHostSelectionFailure(failure2));
-        this.failure = failure2;
+      constructor(failure) {
+        super(formatHostSelectionFailure(failure));
+        this.failure = failure;
         this.name = "HostSelectionError";
       }
       failure;
@@ -8037,7 +8041,7 @@ __export(config_exports, {
   validatePublicCliConfigAxes: () => validatePublicCliConfigAxes
 });
 import { mkdir, readFile as readFile12, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname11, join as join18 } from "node:path";
+import { dirname as dirname11, join as join19 } from "node:path";
 function isGateOfficerSeat(value) {
   return packagedProvinceConfig(value);
 }
@@ -8045,7 +8049,7 @@ function publicCliConfigPath(home) {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
   }
-  return join18(home, ".ak-roles", "public-cli.json");
+  return join19(home, ".ak-roles", "public-cli.json");
 }
 async function loadPublicCliConfig(home) {
   const path = publicCliConfigPath(home);
@@ -8508,7 +8512,7 @@ function credentialProvidersFromAuthData(data) {
 }
 async function loadCredentialProviders(agentDir) {
   try {
-    const raw = await readFile12(join18(agentDir, "auth.json"), "utf8");
+    const raw = await readFile12(join19(agentDir, "auth.json"), "utf8");
     return credentialProvidersFromAuthData(JSON.parse(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -8546,15 +8550,15 @@ __export(host_providers_exports, {
   renderHostProvidersTable: () => renderHostProvidersTable
 });
 import { readFileSync } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function hostProvidersPath(home) {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
   }
-  return join19(home, ".ak-roles", "host-providers.json");
+  return join20(home, ".ak-roles", "host-providers.json");
 }
 function hermesProviderModelsCachePath(home) {
-  return join19(home, ".hermes", "provider_models_cache.json");
+  return join20(home, ".hermes", "provider_models_cache.json");
 }
 function parseHostProvidersTable(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -8710,7 +8714,7 @@ var init_host_providers = __esm({
 
 // src/analyst-gate-cycles-read.ts
 import { readdir as readdir4 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -8961,7 +8965,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
       throw error;
     }
     for (const name of names) {
-      const path = join20(directory, name);
+      const path = join21(directory, name);
       const fromPointer = name.endsWith(".pointer.json");
       const pointer = fromPointer ? await resolveOfficerSessionFromPointerFile(path) : void 0;
       const sessionPath = pointer?.sessionFile ?? path;
@@ -9012,12 +9016,12 @@ var init_audit_escalation = __esm({
 // src/session-opening-materials.ts
 import { existsSync as existsSync6 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { dirname as dirname12, join as join21 } from "node:path";
+import { dirname as dirname12, join as join22 } from "node:path";
 import { fileURLToPath, pathToFileURL as pathToFileURL3 } from "node:url";
 function resolvePackageRootDir(moduleUrl = import.meta.url) {
   let dir = dirname12(fileURLToPath(moduleUrl));
   for (let i = 0; i < 8; i += 1) {
-    if (existsSync6(join21(dir, "package.json")) && existsSync6(join21(dir, "souls"))) {
+    if (existsSync6(join22(dir, "package.json")) && existsSync6(join22(dir, "souls"))) {
       return dir;
     }
     const parent = dirname12(dir);
@@ -9086,7 +9090,7 @@ __export(auditor_soul_exports, {
   resolveAuditorSubject: () => resolveAuditorSubject
 });
 import { readFile as readFile14 } from "node:fs/promises";
-import { basename as basename7, join as join22 } from "node:path";
+import { basename as basename7, join as join23 } from "node:path";
 function auditorSoulRelativePath(role) {
   return `souls/${role}-auditor.md`;
 }
@@ -9128,7 +9132,7 @@ function subjectFromSourceDirectory(sourceRunDirectory) {
 async function readAuditorResumeBinding(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile14(join22(runDirectory, "admitted-request.json"), "utf8"));
+    raw = JSON.parse(await readFile14(join23(runDirectory, "admitted-request.json"), "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -9241,7 +9245,7 @@ var init_serialize_thrown_value = __esm({
 // src/engine-detour-usage.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname13, join as join23 } from "node:path";
+import { dirname as dirname13, join as join24 } from "node:path";
 function engineDetourStdoutByteLength(stdout) {
   return Buffer.byteLength(stdout, "utf8");
 }
@@ -9378,7 +9382,7 @@ function projectEngineDetourToolUsageForPublicTerminal(usage, options) {
 function readInvocationRecord(runDirectory) {
   try {
     const raw = JSON.parse(
-      readFileSync2(join23(runDirectory, "invocation.json"), "utf8")
+      readFileSync2(join24(runDirectory, "invocation.json"), "utf8")
     );
     return isRecord7(raw) ? raw : void 0;
   } catch (error) {
@@ -9406,7 +9410,7 @@ function runDirectoryFromSessionDirectory(sessionDirectory) {
   return dirname13(sessionDirectory);
 }
 function sessionFileFromSessionDirectory(sessionDirectory) {
-  return join23(sessionDirectory, "session.jsonl");
+  return join24(sessionDirectory, "session.jsonl");
 }
 function mintEngineDetourInvocationScope(input) {
   const engine = input.effectiveEngine?.trim();
@@ -9862,14 +9866,14 @@ __export(settlement_exports, {
 });
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { appendFile as appendFile2, readFile as readFile15, readdir as readdir5, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname14, join as join24 } from "node:path";
+import { dirname as dirname14, join as join25 } from "node:path";
 function sealedLedgerHome(admitted) {
   return homeFromRunDirectory(admitted.runDirectory);
 }
 function ledgerReadScope(admitted, scope) {
   return {
     home: sealedLedgerHome(admitted),
-    sessionParent: join24(admitted.runDirectory, "session", "session.jsonl"),
+    sessionParent: join25(admitted.runDirectory, "session", "session.jsonl"),
     ...scope?.courtAttemptId === void 0 || scope.courtAttemptId.length === 0 ? {} : { attemptId: scope.courtAttemptId }
   };
 }
@@ -10001,8 +10005,8 @@ function formatCliDiagnostic(message) {
   return `ak-role: ${message}
 `;
 }
-function formatFailureStderrDiagnostic(failure2) {
-  const text = failure2.diagnostic.trim().length > 0 ? failure2.diagnostic : "failure";
+function formatFailureStderrDiagnostic(failure) {
+  const text = failure.diagnostic.trim().length > 0 ? failure.diagnostic : "failure";
   return formatCliDiagnostic(text);
 }
 function formatErrorCauseDetail(cause) {
@@ -10027,10 +10031,10 @@ function presentStructuralRejection(error, io) {
   }
   io.stderr(formatCliDiagnostic(message));
 }
-function presentControlledFailure(failure2, io) {
-  io.stdout(`${JSON.stringify(failure2, null, 2)}
+function presentControlledFailure(failure, io) {
+  io.stdout(`${JSON.stringify(failure, null, 2)}
 `);
-  io.stderr(formatFailureStderrDiagnostic(failure2));
+  io.stderr(formatFailureStderrDiagnostic(failure));
 }
 async function inspectJudgeSession(sessionFile) {
   try {
@@ -10133,14 +10137,14 @@ function classifyThrownFailure(error) {
     }
   };
 }
-function withKnownDetails(failure2, knownDetails) {
-  if (knownDetails === void 0) return failure2;
+function withKnownDetails(failure, knownDetails) {
+  if (knownDetails === void 0) return failure;
   const { timedOut: _knownTimedOut, ...rest } = knownDetails;
   return {
-    ...failure2,
+    ...failure,
     details: {
       ...rest,
-      ...failure2.details ?? {}
+      ...failure.details ?? {}
     }
   };
 }
@@ -10233,13 +10237,13 @@ function classifyPostAdmissionFailure(input) {
     input.knownDetails
   );
 }
-function explicitInternalKnownFailureClassificationInput(failure2) {
-  if (failure2 === void 0) return {};
+function explicitInternalKnownFailureClassificationInput(failure) {
+  if (failure === void 0) return {};
   return {
-    ...failure2.cause === void 0 ? {} : { knownCause: failure2.cause },
-    ...failure2.identity === void 0 ? {} : { knownIdentity: failure2.identity },
-    ...failure2.diagnostic === void 0 ? {} : { knownDiagnostic: failure2.diagnostic },
-    ...failure2.details === void 0 ? {} : { knownDetails: failure2.details }
+    ...failure.cause === void 0 ? {} : { knownCause: failure.cause },
+    ...failure.identity === void 0 ? {} : { knownIdentity: failure.identity },
+    ...failure.diagnostic === void 0 ? {} : { knownDiagnostic: failure.diagnostic },
+    ...failure.details === void 0 ? {} : { knownDetails: failure.details }
   };
 }
 function isMissingPathError4(error) {
@@ -10370,7 +10374,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
   }
   const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
   if (parentId === void 0) return void 0;
-  const childDirectories = [join24(dirname14(sessionFile), "auditor-roles")];
+  const childDirectories = [join25(dirname14(sessionFile), "auditor-roles")];
   const valid = [];
   let sawAnyDirectory = false;
   for (const childDirectory of childDirectories) {
@@ -10385,7 +10389,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
     for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
       let entries;
       try {
-        entries = await readBoundSessionEntries(join24(childDirectory, file));
+        entries = await readBoundSessionEntries(join25(childDirectory, file));
       } catch (error) {
         throw sessionReadFailure(error, "failed to read discovered auditor session");
       }
@@ -10430,19 +10434,19 @@ function complianceFailureFromAuditorVolumes(volumes) {
       const entry = entries[i];
       if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord10(entry.data)) continue;
       const parent = isRecord10(entry.data.parent) ? entry.data.parent : void 0;
-      const failure2 = isRecord10(entry.data.failure) ? entry.data.failure : void 0;
+      const failure = isRecord10(entry.data.failure) ? entry.data.failure : void 0;
       if (parent?.sessionId !== parentId || parent.sessionFile !== sessionFile || parent.attemptEntryId !== attemptEntryId) continue;
-      if (failure2 === void 0) continue;
-      const identity = isRecord10(failure2.identity) ? failure2.identity : void 0;
-      const typedCause = failure2.cause === "provider" || failure2.cause === "activation" || failure2.cause === "session" || failure2.cause === "output" || failure2.cause === "timeout" ? failure2.cause : void 0;
+      if (failure === void 0) continue;
+      const identity = isRecord10(failure.identity) ? failure.identity : void 0;
+      const typedCause = failure.cause === "provider" || failure.cause === "activation" || failure.cause === "session" || failure.cause === "output" || failure.cause === "timeout" ? failure.cause : void 0;
       return {
         ...typedCause === void 0 ? {} : { cause: typedCause },
         ...identity === void 0 ? {} : { identity: {
           ...typeof identity.name === "string" ? { name: identity.name } : {},
           ...typeof identity.code === "string" || typeof identity.code === "number" ? { code: identity.code } : {}
         } },
-        ...typeof failure2.diagnostic === "string" ? { diagnostic: failure2.diagnostic } : {},
-        ...isRecord10(failure2.details) ? { details: failure2.details } : {}
+        ...typeof failure.diagnostic === "string" ? { diagnostic: failure.diagnostic } : {},
+        ...isRecord10(failure.details) ? { details: failure.details } : {}
       };
     }
   }
@@ -10514,11 +10518,11 @@ async function resolveAuditedRunnerFailureResolution(input) {
     const auditorCompliance = await readBoundAuditorComplianceFailure(input.sessionFile);
     if (auditorCompliance !== void 0) return resolutionOf(auditorCompliance);
   } catch (error) {
-    const failure2 = sessionReadFailure(error, "failed to recover bound auditor failure");
+    const failure = sessionReadFailure(error, "failed to recover bound auditor failure");
     return resolutionOf({
       cause: "session",
-      identity: thrownIdentity(failure2),
-      diagnostic: failure2.message || failure2.name
+      identity: thrownIdentity(failure),
+      diagnostic: failure.message || failure.name
     });
   }
   try {
@@ -10528,11 +10532,11 @@ async function resolveAuditedRunnerFailureResolution(input) {
     if (terminatingFailure !== void 0) return resolutionOf(terminatingFailure);
   } catch (error) {
     if (!isMissingPathError4(error)) {
-      const failure2 = sessionReadFailure(error, "failed to recover typed terminating-tool failure");
+      const failure = sessionReadFailure(error, "failed to recover typed terminating-tool failure");
       return resolutionOf({
         cause: "session",
-        identity: thrownIdentity(failure2),
-        diagnostic: failure2.message || failure2.name
+        identity: thrownIdentity(failure),
+        diagnostic: failure.message || failure.name
       });
     }
   }
@@ -10540,11 +10544,11 @@ async function resolveAuditedRunnerFailureResolution(input) {
     const auditorStop = await readBoundAuditorProviderStopFallback(input.sessionFile);
     if (auditorStop !== void 0) return resolutionOf(auditorStop);
   } catch (error) {
-    const failure2 = sessionReadFailure(error, "failed to recover bound auditor provider stop");
+    const failure = sessionReadFailure(error, "failed to recover bound auditor provider stop");
     return resolutionOf({
       cause: "session",
-      identity: thrownIdentity(failure2),
-      diagnostic: failure2.message || failure2.name
+      identity: thrownIdentity(failure),
+      diagnostic: failure.message || failure.name
     });
   }
   const parentStop = await readSessionProviderStop(input.sessionFile);
@@ -10553,12 +10557,12 @@ async function resolveAuditedRunnerFailureResolution(input) {
     try {
       httpObservation = await readLatestTypedProviderHttpObservation(input.runDirectory);
     } catch (error) {
-      const failure2 = error instanceof Error ? error : new Error(String(error));
+      const failure = error instanceof Error ? error : new Error(String(error));
       return resolutionOf(
         {
           cause: "session",
-          identity: thrownIdentity(failure2),
-          diagnostic: failure2.message || failure2.name
+          identity: thrownIdentity(failure),
+          diagnostic: failure.message || failure.name
         },
         { settled: true }
       );
@@ -10609,12 +10613,12 @@ async function resolveControlledFailureResumeObservation(input) {
     const typedHttp429 = await readTypedHttp429Observation(input.runDirectory);
     return typedHttp429 === void 0 ? {} : { typedHttp429 };
   } catch (error) {
-    const failure2 = error instanceof Error ? error : new Error(String(error));
+    const failure = error instanceof Error ? error : new Error(String(error));
     return {
       observationReadFailure: {
         cause: "session",
-        identity: thrownIdentity(failure2),
-        diagnostic: failure2.message || failure2.name
+        identity: thrownIdentity(failure),
+        diagnostic: failure.message || failure.name
       }
     };
   }
@@ -10694,11 +10698,11 @@ async function readEngineDetourInfrastructureFailure(sessionFile) {
     ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC
   );
 }
-function knownFailureFromControlled(failure2) {
+function knownFailureFromControlled(failure) {
   return {
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic,
-    ...failure2.identity === void 0 ? {} : { identity: failure2.identity }
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic,
+    ...failure.identity === void 0 ? {} : { identity: failure.identity }
   };
 }
 function seatKnownFailureResolver(role) {
@@ -10861,8 +10865,8 @@ function projectTerminalGateFact(rounds) {
   };
 }
 async function extractGateFactFromSessionDirectory(sessionDirectory, options = {}) {
-  const directories = [join24(sessionDirectory, "auditor-roles")];
-  const parentSessionFile = options.parentSessionFile ?? join24(sessionDirectory, "session.jsonl");
+  const directories = [join25(sessionDirectory, "auditor-roles")];
+  const parentSessionFile = options.parentSessionFile ?? join25(sessionDirectory, "session.jsonl");
   const rounds = await readAnalystGateCyclesFromAuditorRoles(directories, {
     parentSessionFile
   });
@@ -10974,10 +10978,10 @@ async function removeFaceIfPresent(path) {
 async function clearOppositeTerminalArtifactFace(runDirectory) {
   const artifactsDir = roleRunArtifactsDirectory(runDirectory);
   for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    await removeFaceIfPresent(join24(artifactsDir, file));
+    await removeFaceIfPresent(join25(artifactsDir, file));
   }
   for (const relative4 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-    await removeFaceIfPresent(join24(runDirectory, relative4));
+    await removeFaceIfPresent(join25(runDirectory, relative4));
   }
   for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
     await removeFaceIfPresent(path);
@@ -11006,8 +11010,8 @@ async function publishAcceptedTerminalArtifacts(admitted, roleOutcome, coordinat
     roleOutcome
   );
   const artifactsDir = await ensureTerminalArtifactFace(admitted.runDirectory);
-  const reportPath = join24(artifactsDir, "report.json");
-  const evidencePath = join24(artifactsDir, "evidence.json");
+  const reportPath = join25(artifactsDir, "report.json");
+  const evidencePath = join25(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(bodies.report, null, 2)}
@@ -11416,7 +11420,7 @@ async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbac
   const candidates = [
     ...preferredCandidates,
     // One unique name per fallback dir — collisions on fixed names cannot exhaust this.
-    ...uniqueFallbackDirs.map((dir) => join24(dir, `${stem}.${randomUUID4()}.json`))
+    ...uniqueFallbackDirs.map((dir) => join25(dir, `${stem}.${randomUUID4()}.json`))
   ];
   for (let i = 0; i < candidates.length; i += 1) {
     const path = candidates[i];
@@ -11446,7 +11450,7 @@ async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbac
   error.publicationAttempts = issues;
   throw error;
 }
-async function publishFailureArtifacts(admitted, failure2, authority, onErrorPublished) {
+async function publishFailureArtifacts(admitted, failure, authority, onErrorPublished) {
   const { sessionDirectory, sessionFile } = coordinatesFromAdmitted(authority, admitted);
   const { baseDir, attempt: baseAttempt } = await resolveFailureArtifactsBase(
     admitted.runDirectory
@@ -11466,7 +11470,7 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
     await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile }, {
       kind: "failure",
       role: admitted.role,
-      ...failure2
+      ...failure
     });
   } catch (error) {
     priorIssues.push(publicationAttemptFromError(sessionFile, error));
@@ -11477,29 +11481,29 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
     baseDir
   );
   const errorCandidates = underArtifacts ? [
-    join24(baseDir, "error.json"),
-    join24(baseDir, "error.settlement.json"),
-    join24(admitted.runDirectory, "error.settlement.json")
+    join25(baseDir, "error.json"),
+    join25(baseDir, "error.settlement.json"),
+    join25(admitted.runDirectory, "error.settlement.json")
   ] : [
-    join24(baseDir, "error.settlement.json"),
-    join24(baseDir, "error.json")
+    join25(baseDir, "error.settlement.json"),
+    join25(baseDir, "error.json")
   ];
   const evidenceCandidates = underArtifacts ? [
-    join24(baseDir, "evidence.json"),
-    join24(baseDir, "evidence.settlement.json"),
-    join24(admitted.runDirectory, "evidence.settlement.json")
+    join25(baseDir, "evidence.json"),
+    join25(baseDir, "evidence.settlement.json"),
+    join25(admitted.runDirectory, "evidence.settlement.json")
   ] : [
-    join24(baseDir, "evidence.settlement.json"),
-    join24(baseDir, "evidence.json")
+    join25(baseDir, "evidence.settlement.json"),
+    join25(baseDir, "evidence.json")
   ];
   const errorPayloadBase = {
     kind: "error",
     role: admitted.role,
     runId: admitted.runId,
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic,
-    ...failure2.identity === void 0 ? {} : { identity: failure2.identity },
-    ...failure2.details === void 0 ? {} : { details: failure2.details }
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic,
+    ...failure.identity === void 0 ? {} : { identity: failure.identity },
+    ...failure.details === void 0 ? {} : { details: failure.details }
   };
   const errorWrite = await writeFailureJsonRetainingCause(
     errorCandidates,
@@ -11520,7 +11524,7 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
       sha256: a.sha256,
       byteLength: a.byteLength
     })),
-    ...failure2.cause === void 0 ? {} : { failureCause: failure2.cause }
+    ...failure.cause === void 0 ? {} : { failureCause: failure.cause }
   };
   const evidenceWrite = await writeFailureJsonRetainingCause(
     evidenceCandidates,
@@ -11535,10 +11539,10 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
     { kind: "evidence", path: evidenceWrite.path }
   ];
 }
-async function settleFailureTerminalResult(admitted, failure2, authority, options = {}) {
+async function settleFailureTerminalResult(admitted, failure, authority, options = {}) {
   const coordinates = coordinatesFromAdmitted(authority, admitted);
   const { sessionDirectory, sessionFile } = coordinates;
-  if (failure2.cause === "output") {
+  if (failure.cause === "output") {
     const entries = await readBoundSessionEntries(sessionFile).catch(() => void 0);
     if (entries !== void 0) {
       let attemptStart = 0;
@@ -11580,27 +11584,27 @@ async function settleFailureTerminalResult(admitted, failure2, authority, option
     }
   }
   const navigator = await extractNavigatorFactFromAdmittedSession(sessionFile);
-  const artifacts = await publishFailureArtifacts(admitted, failure2, authority, options.onErrorPublished);
+  const artifacts = await publishFailureArtifacts(admitted, failure, authority, options.onErrorPublished);
   const errorPath = artifacts.find((artifact) => artifact.kind === "error")?.path;
   const decisiveFacts = {
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic
   };
-  if (failure2.identity?.name !== void 0) {
-    decisiveFacts.errorName = failure2.identity.name;
+  if (failure.identity?.name !== void 0) {
+    decisiveFacts.errorName = failure.identity.name;
   }
-  if (failure2.identity?.code !== void 0) {
-    decisiveFacts.errorCode = failure2.identity.code;
+  if (failure.identity?.code !== void 0) {
+    decisiveFacts.errorCode = failure.identity.code;
   }
-  if (failure2.details !== void 0) {
-    decisiveFacts.secondaryEvidence = failure2.details;
+  if (failure.details !== void 0) {
+    decisiveFacts.secondaryEvidence = failure.details;
   }
   if (options.resume !== void 0) {
     const roleOutcome2 = {
       kind: "failure",
       role: admitted.role,
-      ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-      diagnostic: failure2.diagnostic,
+      ...failure.cause === void 0 ? {} : { cause: failure.cause },
+      diagnostic: failure.diagnostic,
       decisiveFacts
     };
     const terminal = await withOptionalGateProjection(
@@ -11619,8 +11623,8 @@ async function settleFailureTerminalResult(admitted, failure2, authority, option
   const roleOutcome = {
     kind: "failure",
     role: admitted.role,
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic,
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic,
     decisiveFacts
   };
   return withOptionalGateProjection(
@@ -11634,8 +11638,8 @@ async function settleFailureTerminalResult(admitted, failure2, authority, option
     detourGateContext(admitted, options)
   );
 }
-async function settleJudgeFailureTerminalResult(admitted, failure2, authority, options = {}) {
-  return settleFailureTerminalResult(admitted, failure2, authority, options);
+async function settleJudgeFailureTerminalResult(admitted, failure, authority, options = {}) {
+  return settleFailureTerminalResult(admitted, failure, authority, options);
 }
 function presentFailureTerminal(terminal, io) {
   if (terminal.roleOutcome.kind !== "failure" && terminal.roleOutcome.kind !== "no_receipt") {
@@ -11745,9 +11749,9 @@ var init_settlement = __esm({
 
 // src/archivist-record-pointer.ts
 import { mkdirSync as mkdirSync2, writeFileSync } from "node:fs";
-import { dirname as dirname15, join as join25 } from "node:path";
+import { dirname as dirname15, join as join26 } from "node:path";
 function bookDirectOfficerRunPointer(options) {
-  const nest = join25(dirname15(options.parentSessionFile), "auditor-roles");
+  const nest = join26(dirname15(options.parentSessionFile), "auditor-roles");
   mkdirSync2(nest, { recursive: true });
   const pointer = {
     version: 1,
@@ -11757,7 +11761,7 @@ function bookDirectOfficerRunPointer(options) {
     ...options.runDirectory !== void 0 && options.runDirectory.trim() !== "" ? { runDirectory: options.runDirectory } : {}
   };
   writeFileSync(
-    join25(nest, `${options.officer}.pointer.json`),
+    join26(nest, `${options.officer}.pointer.json`),
     `${JSON.stringify(pointer)}
 `,
     "utf8"
@@ -11986,11 +11990,11 @@ async function requireSubmissionGate(options) {
       continue;
     }
     if (gatekeeper.status === "transport_failure") {
-      const failure2 = Object.assign(new Error(gatekeeper.reason), {
+      const failure = Object.assign(new Error(gatekeeper.reason), {
         name: "GatekeeperTransportFailure",
         ...gatekeeper.submission === void 0 ? {} : { submission: gatekeeper.submission }
       });
-      options.hostActions.failInfrastructure(failure2, options.context, options.toolCallId);
+      options.hostActions.failInfrastructure(failure, options.context, options.toolCallId);
     }
     if (gatekeeper.status === "escalate") {
       return {
@@ -12016,9 +12020,9 @@ var init_submission_gate = __esm({
 
 // src/session-identity.ts
 import { mkdir as mkdir2, readFile as readFile16, rename as rename2, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname16, join as join26 } from "node:path";
+import { dirname as dirname16, join as join27 } from "node:path";
 function createSessionIdentityAuthority(authority, sessionBindingFile) {
-  const bindingPath = (principal) => join26(authority.decode(principal).sessionDirectory, sessionBindingFile);
+  const bindingPath = (principal) => join27(authority.decode(principal).sessionDirectory, sessionBindingFile);
   return {
     resolveSessionFile(principal) {
       return authority.decode(principal).sessionFile;
@@ -12096,7 +12100,7 @@ import {
   statSync as statSync3
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname17, join as join27 } from "node:path";
+import { dirname as dirname17, join as join28 } from "node:path";
 function declareHostSessionFailure(error) {
   const message = error instanceof Error ? error.stack || error.message : String(error);
   process.stderr.write(`[host-session] Dossier record failure: ${message}
@@ -12121,7 +12125,7 @@ function findCodexRollout(sessionsDir, sessionId) {
       return;
     }
     for (const entry of entries) {
-      const fullPath = join27(dir, entry.name);
+      const fullPath = join28(dir, entry.name);
       if (entry.isDirectory()) {
         scan(fullPath, depth + 1);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl") && entry.name.includes(sessionId)) {
@@ -12145,25 +12149,25 @@ function sanitizeClaudeCwd(cwd) {
 function resolveNativeSessionPath(options) {
   const home = options.home || homedir();
   if (options.host === "claude") {
-    const configDir = process.env.CLAUDE_CONFIG_DIR || join27(home, ".claude");
+    const configDir = process.env.CLAUDE_CONFIG_DIR || join28(home, ".claude");
     const sanitizedCwd = sanitizeClaudeCwd(options.cwd);
-    return join27(configDir, "projects", sanitizedCwd, `${options.sessionId}.jsonl`);
+    return join28(configDir, "projects", sanitizedCwd, `${options.sessionId}.jsonl`);
   }
   if (options.host === "codex") {
     return findCodexRollout(codexSessionsDirectory(home), options.sessionId);
   }
   if (options.host === "grok-build") {
-    const grokHome = process.env.GROK_HOME || join27(home, ".grok");
-    return join27(grokHome, "sessions", encodeURIComponent(options.cwd), options.sessionId);
+    const grokHome = process.env.GROK_HOME || join28(home, ".grok");
+    return join28(grokHome, "sessions", encodeURIComponent(options.cwd), options.sessionId);
   }
   return void 0;
 }
 function codexSessionsDirectory(home) {
-  return join27(process.env.CODEX_HOME || join27(home || homedir(), ".codex"), "sessions");
+  return join28(process.env.CODEX_HOME || join28(home || homedir(), ".codex"), "sessions");
 }
 function recordRunStart(runDirectory) {
   try {
-    appendFileSync2(join27(runDirectory, ".run-starts"), "\n");
+    appendFileSync2(join28(runDirectory, ".run-starts"), "\n");
   } catch (error) {
     declareHostSessionFailure(error);
   }
@@ -12187,12 +12191,12 @@ function resolveHostDossierLandingPath(options) {
     } catch {
     }
   }
-  const startsPath = join27(dirname17(options.sessionDirectory), ".run-starts");
+  const startsPath = join28(dirname17(options.sessionDirectory), ".run-starts");
   let starts = 0;
   if (existsSync8(startsPath)) starts = readFileSync3(startsPath, "utf8").length;
   const ordinal = Math.max(maxOrdinal + 1, starts, options.continuation.kind === "resume" ? 2 : 1);
   const baseName = `${options.host}-${sanitizedModel}-${ordinal}`;
-  const landingPath = options.host === "grok-build" ? join27(options.sessionDirectory, baseName) : join27(options.sessionDirectory, `${baseName}.jsonl`);
+  const landingPath = options.host === "grok-build" ? join28(options.sessionDirectory, baseName) : join28(options.sessionDirectory, `${baseName}.jsonl`);
   return { landingPath, ordinal, sanitizedModel };
 }
 function recordNativeSessionPointer(options) {
@@ -12225,18 +12229,18 @@ function copyFileCloneOrFallback(src, dest) {
   copyFileSync(src, dest);
 }
 function copyGrokDossier(srcDir, destDir) {
-  const chatHistorySrc = join27(srcDir, "chat_history.jsonl");
+  const chatHistorySrc = join28(srcDir, "chat_history.jsonl");
   if (!existsSync8(chatHistorySrc)) {
     throw new Error(`Grok native chat_history.jsonl missing at ${chatHistorySrc}`);
   }
   mkdirSync3(destDir, { recursive: true });
-  const chatHistoryDest = join27(destDir, "chat_history.jsonl");
+  const chatHistoryDest = join28(destDir, "chat_history.jsonl");
   copyFileCloneOrFallback(chatHistorySrc, chatHistoryDest);
-  const usageSrc = join27(srcDir, "usage.json");
+  const usageSrc = join28(srcDir, "usage.json");
   if (!existsSync8(usageSrc)) {
     throw new Error(`Grok native usage.json missing at ${usageSrc}`);
   }
-  copyFileCloneOrFallback(usageSrc, join27(destDir, "usage.json"));
+  copyFileCloneOrFallback(usageSrc, join28(destDir, "usage.json"));
 }
 function copyAndRecordHostDossier(options) {
   if (options.host === "pi" || options.host === "hermes") {
@@ -12311,7 +12315,7 @@ function copyAndRecordHostDossier(options) {
     }
     try {
       mkdirSync3(options.sessionDirectory, { recursive: true });
-      closeSync(openSync(join27(options.sessionDirectory, `${options.host}-${sanitizedModel}-${ordinal}.failed`), "a"));
+      closeSync(openSync(join28(options.sessionDirectory, `${options.host}-${sanitizedModel}-${ordinal}.failed`), "a"));
     } catch {
     }
     sitianReportSafe({
@@ -12345,7 +12349,7 @@ var init_host_session_record = __esm({
 import { constants as fsConstants2 } from "node:fs";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { lstat as lstat4, mkdir as mkdir3, open } from "node:fs/promises";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 async function persistReturnedRunState(admitted, options) {
   if (options?.lawful === true) {
     await markRunTerminal(admitted.runDirectory);
@@ -12414,7 +12418,7 @@ function jsonSafeReplacer() {
   };
 }
 async function writeHardenedArtifactFile(artifactsDir, namePrefix, payload) {
-  const filePath = join28(artifactsDir, `${namePrefix}-${randomUUID5()}.json`);
+  const filePath = join29(artifactsDir, `${namePrefix}-${randomUUID5()}.json`);
   const body = `${JSON.stringify(payload, jsonSafeReplacer(), 2)}
 `;
   const noFollowFlag = typeof fsConstants2.O_NOFOLLOW === "number" ? fsConstants2.O_NOFOLLOW : 0;
@@ -12669,7 +12673,7 @@ var init_auto_resume = __esm({
 // src/public-cli/post-admission.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { writeFile as writeFile7 } from "node:fs/promises";
-import { isAbsolute as isAbsolute7, join as join29, resolve as resolve12 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join30, resolve as resolve12 } from "node:path";
 function describeCaughtError(error) {
   if (error instanceof Error) {
     const code = error.code;
@@ -12765,7 +12769,7 @@ async function recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic,
     try {
       const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
       await writeFile7(
-        join29(artifactsDir, `post-admission-diagnostic-${randomUUID6()}.json`),
+        join30(artifactsDir, `post-admission-diagnostic-${randomUUID6()}.json`),
         `${JSON.stringify({ version: 1, ...payload }, null, 2)}
 `,
         { encoding: "utf8", flag: "wx" }
@@ -12794,7 +12798,7 @@ async function presentControlledFailure2(admitted, failureInput, adapters, autho
   const knownFailure = failureInput.knownFailure ?? resumeObservation.observationReadFailure;
   const session = !hasThrown && !failureInput.timedOut && knownFailure === void 0 && failureInput.knownCause === void 0 && admitted.principal !== void 0 ? await inspectJudgeSession(authority.decode(admitted.principal).sessionFile) : void 0;
   const fromKnownFailure = explicitInternalKnownFailureClassificationInput(knownFailure);
-  const failure2 = classifyPostAdmissionFailure({
+  const failure = classifyPostAdmissionFailure({
     timedOut: failureInput.timedOut,
     code: failureInput.code,
     stderr: failureInput.stderr,
@@ -12813,7 +12817,7 @@ async function presentControlledFailure2(admitted, failureInput, adapters, autho
   let publishedErrorPath;
   let terminal;
   try {
-    const settled = await settleFailureTerminalResult(admitted, failure2, authority, {
+    const settled = await settleFailureTerminalResult(admitted, failure, authority, {
       ...resumable ? { resume: { command: renderResumeCommand(admitted.runId) } } : {},
       ...failureInput.invocationScopeId === void 0 || failureInput.invocationScopeId.length === 0 ? {} : { invocationScopeId: failureInput.invocationScopeId },
       onErrorPublished: (path) => {
@@ -12906,7 +12910,7 @@ async function dispatchPostAdmissionTurn(input) {
         const rows = await readRecordedSubmissionRows(
           admitted.projectRoot,
           admitted.runId,
-          { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join29(admitted.runDirectory, "session", "session.jsonl") }
+          { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join30(admitted.runDirectory, "session", "session.jsonl") }
         );
         let ticketNumber;
         for (const row of rows) {
@@ -13033,7 +13037,7 @@ async function dispatchPostAdmissionTurn(input) {
     let stderrLogWriteFailure;
     try {
       await writeFile7(
-        join29(admitted.runDirectory, "stderr.log"),
+        join30(admitted.runDirectory, "stderr.log"),
         result.stderr,
         "utf8"
       );
@@ -13312,7 +13316,7 @@ async function dispatchAfterWriterLease(input) {
 }
 function isAlreadyFrozenSummonsAttachment(runDirectory, attachmentPath) {
   const absolute = isAbsolute7(attachmentPath) ? attachmentPath : resolve12(attachmentPath);
-  return pathContainedIn(join29(runDirectory, "attachments"), absolute);
+  return pathContainedIn(join30(runDirectory, "attachments"), absolute);
 }
 async function prepareSummonsResumeMaterials(runDirectory, summons) {
   if (summons === void 0) return void 0;
@@ -13494,10 +13498,10 @@ async function runPostAdmissionSeatResume(input) {
     await presentResumeFailurePointer(
       input.io,
       error,
-      (failure2) => writeResumeDiagnosticFile(
+      (failure) => writeResumeDiagnosticFile(
         loaded.admitted.runDirectory,
         loaded.admitted.runId,
-        failure2,
+        failure,
         loaded.admitted.role
       )
     );
@@ -13520,7 +13524,7 @@ async function pointExistingRunFailure(home, runId, authority, io, thrown) {
     await presentResumeFailurePointer(
       io,
       thrown,
-      (failure2) => writeResumeDiagnosticFile(runDirectory, runId, failure2)
+      (failure) => writeResumeDiagnosticFile(runDirectory, runId, failure)
     );
     return true;
   }
@@ -13528,7 +13532,7 @@ async function pointExistingRunFailure(home, runId, authority, io, thrown) {
   await presentResumeFailurePointer(
     io,
     thrown,
-    (failure2) => writeResumeDiagnosticFile(runDirectory, runId, failure2, record4.role)
+    (failure) => writeResumeDiagnosticFile(runDirectory, runId, failure, record4.role)
   );
   return true;
 }
@@ -13544,14 +13548,14 @@ function showResumeErrorPointer(io, exitCode, terminal) {
   if (publishedError !== void 0) writeResumeFailurePointer(io, publishedError);
 }
 async function presentResumeFailurePointer(io, thrown, publish) {
-  const failure2 = classifyPostAdmissionFailure({
+  const failure = classifyPostAdmissionFailure({
     timedOut: false,
     code: null,
     stderr: "",
     thrown
   });
   try {
-    writeResumeFailurePointer(io, await publish(failure2));
+    writeResumeFailurePointer(io, await publish(failure));
   } catch (publishError) {
     const cause = {
       publishError: formatErrorCauseDetail(publishError)
@@ -13565,18 +13569,18 @@ async function presentResumeFailurePointer(io, thrown, publish) {
     }, io);
   }
 }
-async function writeResumeDiagnosticFile(runDirectory, runId, failure2, role) {
+async function writeResumeDiagnosticFile(runDirectory, runId, failure, role) {
   const dir = await ensureRealArtifactsDirectory(runDirectory);
-  const path = join29(dir, `resume-diagnostic-${randomUUID6()}.json`);
+  const path = join30(dir, `resume-diagnostic-${randomUUID6()}.json`);
   await writeFile7(
     path,
     `${JSON.stringify({
       runId,
       ...role === void 0 ? {} : { role },
-      diagnostic: failure2.diagnostic,
-      ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-      ...failure2.identity === void 0 ? {} : { identity: failure2.identity },
-      ...failure2.details === void 0 ? {} : { details: failure2.details }
+      diagnostic: failure.diagnostic,
+      ...failure.cause === void 0 ? {} : { cause: failure.cause },
+      ...failure.identity === void 0 ? {} : { identity: failure.identity },
+      ...failure.details === void 0 ? {} : { details: failure.details }
     }, null, 2)}
 `,
     { encoding: "utf8", flag: "wx" }
@@ -13736,16 +13740,16 @@ var init_seat_ticket_binding = __esm({
 // src/public-cli/machine-method-skills.ts
 import { accessSync, constants as constants2, statSync as statSync4 } from "node:fs";
 import { lstat as lstat5, mkdir as mkdir4, symlink } from "node:fs/promises";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function skillRoot(home) {
-  return join30(home, ".agents/skills");
+  return join31(home, ".agents/skills");
 }
 function installedMethodSkillPath(home, name) {
   return installedSkillPath(skillRoot(home), name);
 }
 function installedSkillPath(root, name) {
-  const path = join30(root, name, "SKILL.md");
+  const path = join31(root, name, "SKILL.md");
   try {
     if (!statSync4(path).isFile()) return void 0;
     accessSync(path, constants2.R_OK);
@@ -13758,9 +13762,9 @@ function installedSkillPath(root, name) {
 }
 function linkedSkillRoot(home, host) {
   if (host === "claude" || host === "claude-code") {
-    return join30(process.env.CLAUDE_CONFIG_DIR?.trim() || join30(home, ".claude"), "skills");
+    return join31(process.env.CLAUDE_CONFIG_DIR?.trim() || join31(home, ".claude"), "skills");
   }
-  if (host === "hermes") return join30(home, ".hermes/skills");
+  if (host === "hermes") return join31(home, ".hermes/skills");
   return void 0;
 }
 async function occupied(path) {
@@ -13817,7 +13821,7 @@ async function runMachineSkillSetup(home, stdout) {
   const missingBySource = /* @__PURE__ */ new Map();
   let unsourced = false;
   for (const name of packagedMethodSkillNames()) {
-    const path = join30(canonical, name);
+    const path = join31(canonical, name);
     if (await occupied(path)) {
       warnOccupied(path, stdout);
       continue;
@@ -13839,17 +13843,17 @@ async function runMachineSkillSetup(home, stdout) {
   if (unsourced) return 1;
   for (const host of ["claude-code", "hermes"]) {
     const root = linkedSkillRoot(home, host);
-    const binaryFromHome = host === "claude-code" ? HEADLESS_HOST_DESCRIPTIONS.claude.binaryFromHome : HOST_DESCRIPTIONS.hermes.binaryFromHome;
+    const description = host === "claude-code" ? HEADLESS_HOST_DESCRIPTIONS.claude : HOST_DESCRIPTIONS.hermes;
     try {
-      accessSync(join30(home, ...binaryFromHome), constants2.X_OK);
+      accessSync(resolveHostBinary(description, home), constants2.X_OK);
     } catch (error) {
       if (["ENOENT", "ENOTDIR", "EACCES"].includes(error.code ?? "")) continue;
       throw error;
     }
     for (const name of packagedMethodSkillNames()) {
-      const target = join30(canonical, name);
+      const target = join31(canonical, name);
       if (installedMethodSkillPath(home, name) === void 0) continue;
-      const link = join30(root, name);
+      const link = join31(root, name);
       if (await occupied(link)) {
         warnOccupied(link, stdout);
         continue;
@@ -15058,10 +15062,10 @@ var init_analyst_book_key = __esm({
 // src/atomic-write.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { rename as rename3, rm as rm4, writeFile as writeFile8 } from "node:fs/promises";
-import { dirname as dirname19, join as join31 } from "node:path";
+import { dirname as dirname19, join as join32 } from "node:path";
 async function writeFileAtomically(destination, contents) {
   const parent = dirname19(destination);
-  const temporary = join31(parent, `.atomic-write-${randomUUID7()}.tmp`);
+  const temporary = join32(parent, `.atomic-write-${randomUUID7()}.tmp`);
   try {
     await writeFile8(temporary, contents);
     await rename3(temporary, destination);
@@ -15078,7 +15082,7 @@ var init_atomic_write = __esm({
 
 // src/analyst-index.ts
 import { open as open2, readFile as readFile17, unlink as unlink4 } from "node:fs/promises";
-import { dirname as dirname20, join as join32 } from "node:path";
+import { dirname as dirname20, join as join33 } from "node:path";
 function sleep(ms) {
   return new Promise((resolve22) => {
     setTimeout(resolve22, ms);
@@ -15087,7 +15091,7 @@ function sleep(ms) {
 async function withAnalystLibraryIndexLock(ledgerHome, fn) {
   const indexPath = analystLibraryIndexPath(ledgerHome);
   ensureRealDirectoryTree(ledgerHome, dirname20(indexPath));
-  const lockPath = join32(dirname20(indexPath), LIBRARY_INDEX_LOCK_NAME);
+  const lockPath = join33(dirname20(indexPath), LIBRARY_INDEX_LOCK_NAME);
   assertLedgerFileInsideHome(lockPath, ledgerHome);
   const startedAt = Date.now();
   while (true) {
@@ -15114,7 +15118,7 @@ async function withAnalystLibraryIndexLock(ledgerHome, fn) {
   }
 }
 function analystLibraryIndexPath(ledgerHome) {
-  return join32(ledgerHome, "analyst", "library-index.json");
+  return join33(ledgerHome, "analyst", "library-index.json");
 }
 function rowFromIssueMetricsPage(page) {
   return {
@@ -15410,7 +15414,7 @@ var init_analyst_cohort = __esm({
 
 // src/analyst-ledger.ts
 import { readdir as readdir6, readFile as readFile18 } from "node:fs/promises";
-import { basename as basename8, join as join33 } from "node:path";
+import { basename as basename8, join as join34 } from "node:path";
 function isMissingPathError6(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
@@ -15439,7 +15443,7 @@ function ghostLeaseCheckFromAutopsy(autopsy) {
   }
 }
 async function classifyGhostCandidate(input) {
-  const autopsy = await autopsyWriterLock(join33(input.runDirectory, "writer.lock"));
+  const autopsy = await autopsyWriterLock(join34(input.runDirectory, "writer.lock"));
   const leaseCheck = ghostLeaseCheckFromAutopsy(autopsy);
   if (leaseCheck === void 0) return { kind: "live" };
   return {
@@ -15468,7 +15472,7 @@ async function listLedgerBookNames(booksRoot) {
 async function readInvocationScopeFields(runDirectory) {
   let raw;
   try {
-    raw = await readFile18(join33(runDirectory, "invocation.json"), "utf8");
+    raw = await readFile18(join34(runDirectory, "invocation.json"), "utf8");
   } catch (error) {
     if (isMissingPathError6(error)) return void 0;
     throw error;
@@ -15501,7 +15505,7 @@ function decideIssueScope(input) {
 }
 async function resolveSessionFile(runDirectory) {
   try {
-    const raw = await readFile18(join33(runDirectory, "invocation.json"), "utf8");
+    const raw = await readFile18(join34(runDirectory, "invocation.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (isRecord12(parsed) && typeof parsed.sessionFile === "string" && parsed.sessionFile.trim() !== "") {
       return parsed.sessionFile;
@@ -15509,7 +15513,7 @@ async function resolveSessionFile(runDirectory) {
   } catch (error) {
     if (!isMissingPathError6(error)) throw error;
   }
-  return join33(runDirectory, "session", "session.jsonl");
+  return join34(runDirectory, "session", "session.jsonl");
 }
 function attributeSessionRowsForRun(input) {
   if (pathContainedIn(input.runDirectory, input.sessionFile)) {
@@ -15711,9 +15715,9 @@ async function classifyScopedRun(input) {
   }
   let gateCycles;
   try {
-    const parentSessionFile = join33(input.runDirectory, "session", "session.jsonl");
+    const parentSessionFile = join34(input.runDirectory, "session", "session.jsonl");
     gateCycles = await readAnalystGateCyclesFromAuditorRoles(
-      join33(input.runDirectory, "session", "auditor-roles"),
+      join34(input.runDirectory, "session", "auditor-roles"),
       { parentSessionFile }
     );
   } catch (error) {
@@ -15748,7 +15752,7 @@ async function classifyScopedRun(input) {
 async function scanAnalystIssueRuns(input) {
   const ledgerHome = resolveActivationLedgerHome(input.home);
   const scopeTicketNumber = input.ticketNumber;
-  const booksRoot = join33(ledgerHome, "books");
+  const booksRoot = join34(ledgerHome, "books");
   let wholeBook = false;
   let scopeRootIdentity;
   let bookNames;
@@ -15781,7 +15785,7 @@ async function scanAnalystIssueRuns(input) {
   const ghostLegs = [];
   const scopeConflicts = [];
   for (const book of bookNames) {
-    const bookDir = join33(booksRoot, book);
+    const bookDir = join34(booksRoot, book);
     let runDirectories;
     try {
       runDirectories = await listBookRunDirectories(bookDir);
@@ -16518,7 +16522,7 @@ var init_analyst_metric_family = __esm({
 
 // src/analyst-page.ts
 import { createHash as createHash3 } from "node:crypto";
-import { dirname as dirname21, join as join34 } from "node:path";
+import { dirname as dirname21, join as join35 } from "node:path";
 function analystIssuePageKey(address) {
   const parts = ["book", address.bookKey];
   if (address.issueNumber !== void 0) {
@@ -16529,7 +16533,7 @@ function analystIssuePageKey(address) {
   return createHash3("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
 }
 function analystIssuePagePath(ledgerHome, address) {
-  return join34(ledgerHome, "analyst", "issues", `${analystIssuePageKey(address)}.json`);
+  return join35(ledgerHome, "analyst", "issues", `${analystIssuePageKey(address)}.json`);
 }
 function analystIssuePageAddressFromPage(page) {
   return {
@@ -17168,7 +17172,7 @@ __export(cli_exports, {
   runAkRole: () => runAkRole
 });
 import { realpath as realpath5 } from "node:fs/promises";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 function publicSeatArgv(owner) {
   return {
     parse: (args) => parsePublicSeatArgv(owner, args),
@@ -17307,7 +17311,7 @@ function resolveHome(env) {
   return env.home ?? packageMachineHome();
 }
 function resolveAgentDir(env, home) {
-  return env.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join35(home, ".pi", "agent");
+  return env.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join36(home, ".pi", "agent");
 }
 function parseThinking(value) {
   return value;
@@ -18079,7 +18083,7 @@ __export(public_role_summons_exports, {
 import { execFile as execFile3 } from "node:child_process";
 import { existsSync as existsSync9 } from "node:fs";
 import { realpath as realpath6 } from "node:fs/promises";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 function createCapturingIo() {
   const chunks = [];
@@ -18103,7 +18107,7 @@ function parentDir(path) {
 function walkPackageRoot(start) {
   let dir = start;
   for (let i = 0; i < 12; i += 1) {
-    if (existsSync9(join36(dir, "package.json")) && existsSync9(join36(dir, "souls"))) {
+    if (existsSync9(join37(dir, "package.json")) && existsSync9(join37(dir, "souls"))) {
       return dir;
     }
     const parent = parentDir(dir);
@@ -18153,8 +18157,8 @@ function projectSeatHost2(seat) {
 function hostSelectionFailureFromUnknown(error) {
   if (typeof error !== "object" || error === null) return void 0;
   if (error.name !== "HostSelectionError") return void 0;
-  const failure2 = error.failure;
-  return failure2;
+  const failure = error.failure;
+  return failure;
 }
 async function createSummonEnv(options, afterHost) {
   const [
@@ -18219,7 +18223,7 @@ async function createSummonEnv(options, afterHost) {
 async function summonPublicRole(options) {
   const packageRoot = resolveSummonsPackageRoot(options.packageRoot);
   const home = await resolveSummonHome(options);
-  const agentDir = options.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join36(home, ".pi", "agent");
+  const agentDir = options.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join37(home, ".pi", "agent");
   const {
     loadCredentialProviders: loadCredentialProviders2,
     loadPublicCliConfig: loadPublicCliConfig2,
@@ -18287,10 +18291,10 @@ async function summonPublicRole(options) {
         }
       };
     } catch (error) {
-      const failure2 = hostSelectionFailureFromUnknown(error);
-      if (failure2 !== void 0) {
+      const failure = hostSelectionFailureFromUnknown(error);
+      if (failure !== void 0) {
         const { formatHostSelectionFailure: formatHostSelectionFailure2 } = await Promise.resolve().then(() => (init_role_turn_host_resolution(), role_turn_host_resolution_exports));
-        return { ok: false, exitCode: 1, stderr: formatHostSelectionFailure2(failure2) };
+        return { ok: false, exitCode: 1, stderr: formatHostSelectionFailure2(failure) };
       }
       const { CliUsageError: CliUsageError2 } = await Promise.resolve().then(() => (init_cli_errors(), cli_errors_exports));
       if (error instanceof CliUsageError2) {
@@ -18386,8 +18390,8 @@ async function summonParallelReviewerLenses(options) {
     stderr: describeFailure(error)
   });
   const dualFailure = (error) => {
-    const failure2 = failedResult(error);
-    return { completeness: failure2, correctness: failure2 };
+    const failure = failedResult(error);
+    return { completeness: failure, correctness: failure };
   };
   let sourceProjectRoot;
   let targetCommit;
@@ -18727,7 +18731,7 @@ var init_compliance_transport = __esm({
 });
 
 // src/role-run-relocation.ts
-import { join as join37, sep as sep5 } from "node:path";
+import { join as join38, sep as sep5 } from "node:path";
 function rewriteRunDirectoryPathValue(value, oldRunDirectory, newRunDirectory) {
   if (typeof value !== "string") return value;
   if (value === oldRunDirectory) return newRunDirectory;
@@ -18855,7 +18859,7 @@ __export(run_lifecycle_exports, {
   writeRoleRunState: () => writeRoleRunState
 });
 import { chmod, lstat as lstat6, open as open3, readdir as readdir7, readFile as readFile21, unlink as unlink5, writeFile as writeFile9 } from "node:fs/promises";
-import { basename as basename9, join as join38 } from "node:path";
+import { basename as basename9, join as join39 } from "node:path";
 function buildAutoResumeContinuationPrompt(options) {
   return appendEngineSessionMaterial(
     [RESUME_TRANSPORT_ENVELOPE],
@@ -18881,7 +18885,7 @@ function renderResumeCommand(runId) {
 async function writeRoleRunState(runDirectory, record4) {
   const payload = { ...record4, runDirectory };
   await writeFile9(
-    join38(runDirectory, RUN_STATE_FILE),
+    join39(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -18931,7 +18935,7 @@ function parseCurrentCourtState(raw) {
 async function readRoleRunStateRaw(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile21(join38(runDirectory, RUN_STATE_FILE), "utf8"));
+    raw = JSON.parse(await readFile21(join39(runDirectory, RUN_STATE_FILE), "utf8"));
   } catch (error) {
     if (errorCodeOf(error) === "ENOENT") return void 0;
     throw error;
@@ -19025,7 +19029,7 @@ async function writeRoleRunStateDisk(runDirectory, disk) {
     ...disk.currentCourt === void 0 ? {} : { currentCourt: disk.currentCourt }
   };
   await writeFile9(
-    join38(runDirectory, RUN_STATE_FILE),
+    join39(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -19248,7 +19252,7 @@ async function createWriterLease(lockPath, runDirectory, reportCleanupFailure) {
     },
     relocate(nextRunDirectory) {
       currentRunDirectory = nextRunDirectory;
-      currentLockPath = join38(nextRunDirectory, WRITER_LOCK_FILE);
+      currentLockPath = join39(nextRunDirectory, WRITER_LOCK_FILE);
     },
     async release() {
       if (released) return;
@@ -19287,10 +19291,10 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
   };
   const reportReadFailure = (error) => {
     reportDiagnostic(
-      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join38(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
+      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join39(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
     );
   };
-  const lockPath = join38(runDirectory, WRITER_LOCK_FILE);
+  const lockPath = join39(runDirectory, WRITER_LOCK_FILE);
   let lastAutopsy = { verdict: "absent" };
   let lastReclaimFailure;
   for (let reclaimsLeft = WRITER_LEASE_RECLAIM_ROUNDS; ; reclaimsLeft -= 1) {
@@ -19345,7 +19349,7 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
 async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
   if (runId.trim() === "") return void 0;
   const ledgerHome = resolveActivationLedgerHome(home);
-  const booksRoot = join38(ledgerHome, "books");
+  const booksRoot = join39(ledgerHome, "books");
   let bookKeys;
   try {
     bookKeys = await readdir7(booksRoot);
@@ -19386,7 +19390,7 @@ async function readRunParentPath(runDirectory) {
   let raw;
   try {
     raw = JSON.parse(
-      await readFile21(join38(runDirectory, "admitted-request.json"), "utf8")
+      await readFile21(join39(runDirectory, "admitted-request.json"), "utf8")
     );
   } catch (error) {
     if (errorCodeOf(error) === "ENOENT") return void 0;
@@ -19407,7 +19411,7 @@ async function readRunParentPath(runDirectory) {
 async function runHasFormedSessionPrincipal(runDirectory) {
   const disk = await readRoleRunStateDisk(runDirectory);
   if (disk === void 0) return false;
-  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join38(disk.principalWire.sessionDirectory, "session.jsonl");
+  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join39(disk.principalWire.sessionDirectory, "session.jsonl");
   try {
     const stat2 = await lstat6(sessionFile);
     return stat2.isFile() && !stat2.isSymbolicLink();
@@ -19425,7 +19429,7 @@ async function findLatestRunIdForSeatTicket(input) {
   let runDirectories;
   try {
     runDirectories = await listBookRunDirectories(
-      input.ticketNumber === void 0 ? bookDir : join38(bookDir, String(input.ticketNumber))
+      input.ticketNumber === void 0 ? bookDir : join39(bookDir, String(input.ticketNumber))
     );
   } catch (error) {
     if (errorCodeOf(error) === "ENOENT") return void 0;
@@ -19623,7 +19627,7 @@ async function loadResumableRunRecord(home, runId, authority) {
   let model;
   try {
     const invocationRaw = JSON.parse(
-      await readFile21(join38(run.runDirectory, "invocation.json"), "utf8")
+      await readFile21(join39(run.runDirectory, "invocation.json"), "utf8")
     );
     if (invocationRaw !== null && typeof invocationRaw === "object" && !Array.isArray(invocationRaw)) {
       const rec = invocationRaw;
@@ -19991,7 +19995,7 @@ var init_run_lifecycle = __esm({
 });
 
 // src/submission-ledger.ts
-import { join as join39 } from "node:path";
+import { join as join40 } from "node:path";
 function runIdentity(context) {
   const directory = runDirectoryFromHostContext(context);
   if (directory !== void 0) {
@@ -20013,7 +20017,7 @@ async function submissionRecordFile(cwd, runId, scope) {
   if (sessionParent === void 0) {
     const discoveredRun = await findRunDirectoryById(scope.home, runId);
     if (discoveredRun === void 0) return void 0;
-    sessionParent = join39(discoveredRun, "session", "session.jsonl");
+    sessionParent = join40(discoveredRun, "session", "session.jsonl");
   }
   return resolveSitianRecordPathInLedger({
     level: "event",
@@ -20206,12 +20210,12 @@ async function restoreState(cwd, runId, scope) {
 }
 function sessionParentFromHostContext(context) {
   const runDirectory = runDirectoryFromHostContext(context);
-  if (runDirectory !== void 0) return join39(runDirectory, "session", "session.jsonl");
+  if (runDirectory !== void 0) return join40(runDirectory, "session", "session.jsonl");
   const sessionFile = context.sessionManager.getSessionFile?.();
   if (typeof sessionFile === "string" && sessionFile.length > 0) return sessionFile;
   const sessionDir = context.sessionManager.getSessionDir?.();
   if (typeof sessionDir === "string" && sessionDir.length > 0) {
-    return join39(sessionDir, "session.jsonl");
+    return join40(sessionDir, "session.jsonl");
   }
   return void 0;
 }
@@ -20391,7 +20395,7 @@ var init_submission_ledger = __esm({
 
 // src/archivist-record-topology.ts
 import { createHash as createHash4 } from "node:crypto";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 function resolveNavigatorWorkSubjectPlacement(input) {
   let ledgerHome;
   if (input.parentSessionFile !== void 0 && input.parentSessionFile.length > 0) {
@@ -20404,7 +20408,7 @@ function resolveNavigatorWorkSubjectPlacement(input) {
   const digest = createHash4("sha256").update(input.subject).digest("hex").slice(0, 32);
   return {
     ledgerHome,
-    sessionDir: join41(
+    sessionDir: join42(
       activationBookDirectory(ledgerHome, resolveBookKeyFromGit(input.cwd)),
       NAVIGATOR_RECORD_KIND,
       digest
@@ -20476,10 +20480,10 @@ import {
   statSync as statSync7,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { dirname as dirname23, resolve as resolve17, join as join42 } from "node:path";
+import { dirname as dirname23, resolve as resolve17, join as join43 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function readCurrentSession(sessionDir) {
-  const ledger = join42(sessionDir, CURRENT_SESSION_LEDGER);
+  const ledger = join43(sessionDir, CURRENT_SESSION_LEDGER);
   try {
     const value = JSON.parse(readFileSync4(ledger, "utf8"));
     if (typeof value !== "object" || value === null || typeof value.sessionFile !== "string" || value.sessionFile.length === 0) {
@@ -20494,7 +20498,7 @@ function readCurrentSession(sessionDir) {
   }
 }
 function writeCurrentSession(sessionDir, sessionFile) {
-  const ledger = join42(sessionDir, CURRENT_SESSION_LEDGER);
+  const ledger = join43(sessionDir, CURRENT_SESSION_LEDGER);
   try {
     writeFileSync3(ledger, `${JSON.stringify({ sessionFile })}
 `, { flag: "wx" });
@@ -20510,7 +20514,7 @@ function isCurrentSessionClaimRace(error) {
   return errnoCode(error.cause) === "EEXIST";
 }
 function currentSessionLedgerPath(sessionDir) {
-  return join42(sessionDir, CURRENT_SESSION_LEDGER);
+  return join43(sessionDir, CURRENT_SESSION_LEDGER);
 }
 function readBoundedSessionHeader(filePath) {
   const fd = openSync2(filePath, "r");
@@ -20597,7 +20601,7 @@ function mostRecentNavigatorSessionFile(sessionDir, cwd) {
   const matched = [];
   for (const name of names) {
     if (!name.endsWith(".jsonl")) continue;
-    const filePath = join42(absoluteSessionDir, name);
+    const filePath = join43(absoluteSessionDir, name);
     let st;
     try {
       st = statSync7(filePath);
@@ -20709,7 +20713,7 @@ function createRecordSessionOpen(options, host = piRecordSessionHost) {
     if (!physicallyContainedIn(ledgerHome, parentResolved)) {
       throw new Error("Durable record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = join42(dirname23(parentResolved), options.kind);
+    sessionDir = join43(dirname23(parentResolved), options.kind);
     parentSession = parentFile;
     mayResumeSameNest = options.kind === WORKER_SUBMISSION_GATE_KIND;
   }
@@ -20772,6 +20776,7 @@ var init_archivist_record_entry = __esm({
 });
 
 // src/acp-host/production-host.ts
+init_host_descriptions();
 import { randomUUID as randomUUID10 } from "node:crypto";
 
 // src/role-envelope.ts
@@ -20780,7 +20785,7 @@ init_packaged_role_registry();
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { appendFile as appendFile3, mkdir as mkdir5, writeFile as writeFile10 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname25, join as join45 } from "node:path";
+import { dirname as dirname25, join as join46 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/role-runtime.ts
@@ -20789,7 +20794,7 @@ init_sitian_facade();
 init_submission_ledger();
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { readFileSync as readFileSync6, writeSync as writeSync2 } from "node:fs";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 import { Value as Value4 } from "typebox/value";
 
 // src/activation-trace.ts
@@ -21859,10 +21864,10 @@ init_packaged_role_registry();
 init_atomic_write();
 import { existsSync as existsSync10, realpathSync as realpathSync3 } from "node:fs";
 import { readFile as readFile22 } from "node:fs/promises";
-import { basename as basename10, dirname as dirname22, join as join40, resolve as resolve16 } from "node:path";
+import { basename as basename10, dirname as dirname22, join as join41, resolve as resolve16 } from "node:path";
 var NAVIGATOR_WORK_CONTEXT_BASENAME = "work-context.json";
 function navigatorWorkContextFile(sessionDir) {
-  return join40(sessionDir, NAVIGATOR_WORK_CONTEXT_BASENAME);
+  return join41(sessionDir, NAVIGATOR_WORK_CONTEXT_BASENAME);
 }
 function isNavigatorWorkContextFile(path) {
   const resolved = resolve16(path);
@@ -22279,12 +22284,12 @@ function createNavigatorAttendance(options) {
     return { ...options.context, signal };
   };
   const unavailable = (invocationId, reason) => {
-    const failure2 = reason instanceof NavigatorUnavailableError ? reason : navigatorUnavailableError("unknown", reason);
+    const failure = reason instanceof NavigatorUnavailableError ? reason : navigatorUnavailableError("unknown", reason);
     return {
       disposition: "unavailable",
-      unavailableReason: failure2.message,
-      unavailableSource: failure2.unavailableSource,
-      unavailableCause: failure2.unavailableCause
+      unavailableReason: failure.message,
+      unavailableSource: failure.unavailableSource,
+      unavailableCause: failure.unavailableCause
     };
   };
   let prepareBoundSettlement;
@@ -23710,7 +23715,7 @@ function readDiaristTicketAssertion(submitted) {
 function readRoleRunCoordinates(ctx, label) {
   const runDirectory = runDirectoryFromHostContext(ctx);
   if (runDirectory === void 0) throw new Error(`${label} requires AK_ROLE_RUN_DIR`);
-  const admittedPath = join44(runDirectory, "admitted-request.json");
+  const admittedPath = join45(runDirectory, "admitted-request.json");
   const admitted = JSON.parse(readFileSync6(admittedPath, "utf8"));
   if (typeof admitted.projectRoot !== "string" || admitted.projectRoot.trim() === "") {
     throw new Error(`${label} admitted-request missing projectRoot (${admittedPath})`);
@@ -24633,7 +24638,7 @@ async function prepareRoleEnvelope(options) {
   const hostAbort = new AbortController();
   const runId = request.runDirectory.split("/").filter(Boolean).at(-1) ?? randomUUID9();
   await mkdir5(request.runDirectory, { recursive: true });
-  let sessionFile = options.sessionFile ?? join45(request.runDirectory, "session", "session.jsonl");
+  let sessionFile = options.sessionFile ?? join46(request.runDirectory, "session", "session.jsonl");
   await mkdir5(dirname25(sessionFile), { recursive: true });
   if (request.continuation.kind !== "resume") {
     try {
@@ -25298,10 +25303,6 @@ function createRoleRuntimeDependencies(packageRoot) {
 init_session_identity();
 
 // src/acp-host/description.ts
-import { join as join46 } from "node:path";
-function resolveAcpBinary(description, operatorHome) {
-  return join46(operatorHome, ...description.binaryFromHome);
-}
 function acpStdioArgs(description, model, seat) {
   const { prefix, suffix, modelFlag, thinkingFlag } = description.argv;
   const pair = (flag, value) => flag === void 0 || value === void 0 ? [] : [flag, value];
@@ -25365,6 +25366,27 @@ function raceAgainstHostAbort(work, abortSignal, message = "host aborted") {
     );
   });
 }
+function externalHostFailure(cause, name, code, details, diagnostic) {
+  return asFailure({
+    cause,
+    identity: { name, code },
+    ...diagnostic === void 0 ? {} : { diagnostic },
+    ...details === void 0 ? {} : { details }
+  });
+}
+function withExternalHostCleanupFailure(outcome, cleanupError, name) {
+  const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+  if (outcome.knownFailure === void 0) {
+    return externalHostFailure("session", name, "dispose-failed", { cleanupError: message }, message);
+  }
+  return {
+    ...outcome,
+    knownFailure: {
+      ...outcome.knownFailure,
+      details: { ...outcome.knownFailure.details ?? {}, cleanupError: message }
+    }
+  };
+}
 function asFailure(knownFailure, stderr = "") {
   return { code: null, stderr, timedOut: false, knownFailure };
 }
@@ -25436,6 +25458,10 @@ function renderAgentStartMaterials(body, materials) {
 function renderSystemPromptOverride(authority) {
   return renderAgentStartMaterials(authority.body, authority.materials);
 }
+async function resolveBoundHostSessionId(request, identity) {
+  const explicit = request.continuation.kind === "resume" ? request.continuation.hostSessionId : void 0;
+  return explicit !== void 0 && explicit !== "" ? explicit : identity.load(request.principal);
+}
 
 // src/acp-host/role-turn-host.ts
 function acpAgentTextChunk(params) {
@@ -25473,32 +25499,6 @@ function acpAgentTextChunk(params) {
   if (typeof textFallback === "string" && textFallback.length > 0) return textFallback;
   return void 0;
 }
-function failure(cause, name, code, details, diagnostic) {
-  return {
-    code: null,
-    stderr: "",
-    timedOut: false,
-    knownFailure: {
-      cause,
-      identity: { name, code },
-      ...diagnostic === void 0 ? {} : { diagnostic },
-      ...details === void 0 ? {} : { details }
-    }
-  };
-}
-function withCleanupFailure(outcome, cleanupError) {
-  const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
-  if (outcome.knownFailure === void 0) {
-    return failure("session", "AcpDisposeFailure", "dispose-failed", { cleanupError: message }, message);
-  }
-  return {
-    ...outcome,
-    knownFailure: {
-      ...outcome.knownFailure,
-      details: { ...outcome.knownFailure.details ?? {}, cleanupError: message }
-    }
-  };
-}
 function acpError(code, message, cause) {
   return Object.assign(new Error(message, cause === void 0 ? void 0 : { cause }), { code });
 }
@@ -25612,10 +25612,10 @@ function createAcpRoleTurnHost(config) {
     let sessionOpened = false;
     let accepted = false;
     const sessionParent = config.sessionIdentity.resolveSessionFile(request.principal);
-    let outcome = failure("session", "AcpNoOutcome", "no-outcome");
+    let outcome = externalHostFailure("session", "AcpNoOutcome", "no-outcome");
     try {
       if (prepared.mcpServers.length === 0) {
-        outcome = failure("activation", "UncontrolledAcpSession", "ak-config-missing");
+        outcome = externalHostFailure("activation", "UncontrolledAcpSession", "ak-config-missing");
       } else {
         connection = await config.connect(request);
         const rpc = (method, params) => connection.request(method, params);
@@ -25636,7 +25636,7 @@ function createAcpRoleTurnHost(config) {
         const initializeMeta = initialized._meta;
         const availableModels = Array.isArray(initializeMeta?.modelState?.availableModels) ? initializeMeta.modelState.availableModels : void 0;
         if (request.model !== void 0 && availableModels !== void 0 && !availableModels.some((entry) => typeof entry === "object" && entry !== null && entry.modelId === acpModelId(config.modelPassing, request.model))) {
-          outcome = failure("activation", "AcpHostModelMismatch", "host-model-mismatch", {
+          outcome = externalHostFailure("activation", "AcpHostModelMismatch", "host-model-mismatch", {
             provider: request.model.provider,
             model: request.model.model
           });
@@ -25663,14 +25663,13 @@ function createAcpRoleTurnHost(config) {
           };
           let sessionReady = true;
           if (request.continuation.kind === "resume") {
-            const explicitHostSessionId = request.continuation.hostSessionId;
-            const boundSessionId = explicitHostSessionId !== void 0 && explicitHostSessionId !== "" ? explicitHostSessionId : await config.sessionIdentity.load(request.principal);
+            const boundSessionId = await resolveBoundHostSessionId(request, config.sessionIdentity);
             if (boundSessionId !== void 0 && boundSessionId !== "") {
               sessionId = boundSessionId;
               sessionId = await loadSession(boundSessionId);
               sessionOpened = true;
             } else {
-              outcome = failure(
+              outcome = externalHostFailure(
                 "session",
                 "AcpSessionFailure",
                 "session-id-missing",
@@ -25683,7 +25682,7 @@ function createAcpRoleTurnHost(config) {
             const session = await rpc("session/new", sessionBindParams);
             sessionId = typeof session.sessionId === "string" ? session.sessionId : void 0;
             if (sessionId === void 0 || sessionId === "") {
-              outcome = failure("session", "AcpSessionFailure", "session-id-missing");
+              outcome = externalHostFailure("session", "AcpSessionFailure", "session-id-missing");
               sessionReady = false;
             } else {
               if (config.hostName !== "hermes") recordNativeSessionPointer({
@@ -25733,7 +25732,7 @@ function createAcpRoleTurnHost(config) {
                   agentProseChunks.length = 0;
                   return {
                     status: "terminal",
-                    result: failure("output", "AcpRefusal", "refusal", { sessionId })
+                    result: externalHostFailure("output", "AcpRefusal", "refusal", { sessionId })
                   };
                 }
                 if (prepared.terminatingToolName === NAVIGATOR_OUTPUT_TOOL_NAME) {
@@ -25784,7 +25783,7 @@ function createAcpRoleTurnHost(config) {
       try {
         await prepared.dispose?.();
       } catch (cleanupError) {
-        outcome = withCleanupFailure(outcome, cleanupError);
+        outcome = withExternalHostCleanupFailure(outcome, cleanupError, "AcpDisposeFailure");
       }
     }
     return outcome;
@@ -25882,7 +25881,7 @@ function createProductionAcpRoleTurnHost(options) {
         role: request.activation.role
       });
       return connectAcpStdio({
-        binary: resolveAcpBinary(description, request.home),
+        binary: resolveHostBinary(description, request.home),
         args: acpStdioArgs(
           description,
           request.model,