@akagilnc/pi-workflow-roles 0.1.5307 → 0.1.5314

package/dist/headless-host/production-host.js

@@ -13,6 +13,109 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/host-descriptions.ts
+import { join } from "node:path";
+function resolveHostBinary(description, operatorHome) {
+  return join(operatorHome, ...description.binaryFromHome);
+}
+function lookupHostDescription(host) {
+  return Object.hasOwn(HOST_DESCRIPTIONS, host) ? HOST_DESCRIPTIONS[host] : void 0;
+}
+function lookupHeadlessHostDescription(host) {
+  return Object.hasOwn(HEADLESS_HOST_DESCRIPTIONS, host) ? HEADLESS_HOST_DESCRIPTIONS[host] : void 0;
+}
+function lookupHostFamily(host) {
+  if (lookupHostDescription(host) !== void 0) return "acp";
+  if (lookupHeadlessHostDescription(host) !== void 0) return "headless";
+  return void 0;
+}
+function packagedExternalHostNames() {
+  return [...Object.keys(HOST_DESCRIPTIONS), ...Object.keys(HEADLESS_HOST_DESCRIPTIONS)];
+}
+function assertRegisteredHostName(host) {
+  if (host === DEFAULT_ROLE_TURN_HOST || lookupHostFamily(host) !== void 0) {
+    return host;
+  }
+  throw new Error(`unregistered host: ${host}`);
+}
+var DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
+var init_host_descriptions = __esm({
+  "src/host-descriptions.ts"() {
+    "use strict";
+    DEFAULT_ROLE_TURN_HOST = "pi";
+    HOST_DESCRIPTIONS = Object.freeze({
+      /** Operator home `~/.grok`, native session/load resume, `agent [--model X] stdio`. */
+      "grok-build": Object.freeze({
+        binaryFromHome: Object.freeze([".grok", "bin", "grok"]),
+        argv: Object.freeze({
+          prefix: Object.freeze(["agent"]),
+          suffix: Object.freeze(["stdio"]),
+          modelFlag: "--model"
+        }),
+        modelPassing: "argv",
+        sessionBindingFile: "grok-acp-session.json"
+      }),
+      /**
+       * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
+       * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
+       * (seat table provider + model concatenated). Reasoning is the global
+       * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
+       * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
+       */
+      "hermes": Object.freeze({
+        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
+        argv: Object.freeze({
+          prefix: Object.freeze(["acp"]),
+          suffix: Object.freeze([]),
+          thinkingFlag: "--reasoning"
+        }),
+        modelPassing: "set_model",
+        sessionBindingFile: "hermes-acp-session.json",
+        seatProfileSoul: Object.freeze({
+          flag: "-p",
+          namePrefix: "ak-",
+          profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
+          soulFileName: "SOUL.md"
+        })
+      })
+    });
+    HEADLESS_HOST_DESCRIPTIONS = Object.freeze({
+      "claude": Object.freeze({
+        protocol: "claude-print",
+        binaryFromHome: Object.freeze([".local", "bin", "claude"]),
+        sessionBindingFile: "claude-headless-session.json",
+        fixedArgs: Object.freeze([
+          // Live NDJSON events → sitian host-session records (#811); last line is the result receipt.
+          "--output-format",
+          "stream-json",
+          // Intermediate assistant/tool/system events require verbose with stream-json.
+          "--verbose",
+          "--permission-mode",
+          "bypassPermissions"
+        ]),
+        promptFlag: "-p",
+        modelFlag: "--model",
+        effortFlag: "--effort",
+        // File path keeps large role envelopes off ARG_MAX.
+        systemPromptFlag: "--system-prompt-file",
+        jsonSchemaFlag: "--json-schema",
+        mcpConfigFlag: "--mcp-config",
+        sessionIdFlag: "--session-id",
+        resumeFlag: "--resume"
+      }),
+      /**
+       * Codex headless (#646). Binary under operator home; auth stays in CODEX_HOME.
+       * Argv/parse/schema-close are codex-exec helpers — not Claude flag mapping.
+       */
+      "codex": Object.freeze({
+        protocol: "codex-exec",
+        binaryFromHome: Object.freeze([".local", "bin", "codex"]),
+        sessionBindingFile: "codex-headless-session.json"
+      })
+    });
+  }
+});
+
 // src/sha256.ts
 import { createHash } from "node:crypto";
 function sha256Hex(bytes) {
@@ -789,7 +892,7 @@ __export(run_ticket_number_exports, {
   requireSafePositiveTicketNumber: () => requireSafePositiveTicketNumber
 });
 import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 function isEnoent(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
@@ -829,7 +932,7 @@ async function readJsonObject(path) {
   }
 }
 async function readBoardPageTicketNumber(runDirectory, page) {
-  const record4 = await readJsonObject(join(runDirectory, page));
+  const record4 = await readJsonObject(join2(runDirectory, page));
   if (record4 === void 0) return void 0;
   return ticketFromRecord(record4);
 }
@@ -838,7 +941,7 @@ async function readBoardTicketNumber(runDirectory) {
 }
 async function readMigrationDerivedTicketNumber(runDirectory) {
   const record4 = await readJsonObject(
-    join(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE)
+    join2(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE)
   );
   if (record4 === void 0) return void 0;
   if (record4.derivation !== "worktree-path-basename") return void 0;
@@ -2004,7 +2107,7 @@ import {
   statSync
 } from "node:fs";
 import { userInfo } from "node:os";
-import { basename, dirname as dirname2, isAbsolute, join as join2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { basename, dirname as dirname2, isAbsolute, join as join3, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
 function packageMachineHome() {
   return resolve2(userInfo().homedir);
 }
@@ -2044,7 +2147,7 @@ function resolveActivationLedgerHomeForPath(path) {
   return resolveActivationLedgerHome();
 }
 function activationBookDirectory(ledgerHome, bookKey) {
-  return join2(ledgerHome, "books", bookKey);
+  return join3(ledgerHome, "books", bookKey);
 }
 function pathContainedIn(root, candidate) {
   const rel = relative2(root, candidate);
@@ -2057,7 +2160,7 @@ function physicalPathIdentity(path) {
   while (true) {
     try {
       const real = realpathSync(cursor);
-      return missing.length === 0 ? real : join2(real, ...missing);
+      return missing.length === 0 ? real : join3(real, ...missing);
     } catch (error) {
       if (errnoCode(error) !== "ENOENT") {
         return absolute;
@@ -2157,7 +2260,7 @@ function ensureRealDirectoryTree(root, targetDir) {
     if (part === "..") {
       throw new ActivationLedgerError(`activation ledger path contains '..': ${absoluteTarget}`);
     }
-    lexicalCursor = join2(lexicalCursor, part);
+    lexicalCursor = join3(lexicalCursor, part);
     let st;
     try {
       st = lstatSync(lexicalCursor);
@@ -2572,7 +2675,7 @@ var init_sitian_contracts = __esm({
 // src/sitian-appender.ts
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
-import { dirname as dirname4, join as join3 } from "node:path";
+import { dirname as dirname4, join as join4 } from "node:path";
 function appendSitianRecordBlock(input, block) {
   if (block === "") return;
   try {
@@ -2594,8 +2697,8 @@ function resolveSitianVolumeCategory(kind) {
   return kind;
 }
 function ticketProvenanceUnderBookPaths(ledgerHome, bookKey, ticketId) {
-  const sessionDir = join3(activationBookDirectory(ledgerHome, bookKey), ticketId);
-  return { sessionDir, recordFile: join3(sessionDir, SITIAN_RECORDS_LEAF) };
+  const sessionDir = join4(activationBookDirectory(ledgerHome, bookKey), ticketId);
+  return { sessionDir, recordFile: join4(sessionDir, SITIAN_RECORDS_LEAF) };
 }
 function resolveSitianRecordPathInLedger(input, ledgerHome) {
   const category = resolveSitianVolumeCategory(input.kind);
@@ -2612,13 +2715,13 @@ function resolveSitianRecordPathInLedger(input, ledgerHome) {
     recordFile = paths.recordFile;
   } else if (category === "ticket-provenance" && input.runDirectory !== void 0) {
     sessionDir = input.runDirectory;
-    recordFile = join3(sessionDir, SITIAN_RECORDS_LEAF);
+    recordFile = join4(sessionDir, SITIAN_RECORDS_LEAF);
   } else {
     if (input.sessionParent === void 0 || input.sessionParent.length === 0 || !physicallyContainedIn(ledgerHome, input.sessionParent)) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = join3(dirname4(input.sessionParent), category);
-    recordFile = join3(sessionDir, SITIAN_RECORDS_LEAF);
+    sessionDir = join4(dirname4(input.sessionParent), category);
+    recordFile = join4(sessionDir, SITIAN_RECORDS_LEAF);
   }
   if (!physicallyContainedIn(ledgerHome, sessionDir)) {
     throw new Error("Sitian record ownership requires a directory inside the ledger home");
@@ -2745,108 +2848,9 @@ var init_sitian_facade = __esm({
   }
 });
 
-// src/host-descriptions.ts
-function lookupHostDescription(host) {
-  return Object.hasOwn(HOST_DESCRIPTIONS, host) ? HOST_DESCRIPTIONS[host] : void 0;
-}
-function lookupHeadlessHostDescription(host) {
-  return Object.hasOwn(HEADLESS_HOST_DESCRIPTIONS, host) ? HEADLESS_HOST_DESCRIPTIONS[host] : void 0;
-}
-function lookupHostFamily(host) {
-  if (lookupHostDescription(host) !== void 0) return "acp";
-  if (lookupHeadlessHostDescription(host) !== void 0) return "headless";
-  return void 0;
-}
-function packagedExternalHostNames() {
-  return [...Object.keys(HOST_DESCRIPTIONS), ...Object.keys(HEADLESS_HOST_DESCRIPTIONS)];
-}
-function assertRegisteredHostName(host) {
-  if (host === DEFAULT_ROLE_TURN_HOST || lookupHostFamily(host) !== void 0) {
-    return host;
-  }
-  throw new Error(`unregistered host: ${host}`);
-}
-var DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
-var init_host_descriptions = __esm({
-  "src/host-descriptions.ts"() {
-    "use strict";
-    DEFAULT_ROLE_TURN_HOST = "pi";
-    HOST_DESCRIPTIONS = Object.freeze({
-      /** Operator home `~/.grok`, native session/load resume, `agent [--model X] stdio`. */
-      "grok-build": Object.freeze({
-        binaryFromHome: Object.freeze([".grok", "bin", "grok"]),
-        argv: Object.freeze({
-          prefix: Object.freeze(["agent"]),
-          suffix: Object.freeze(["stdio"]),
-          modelFlag: "--model"
-        }),
-        modelPassing: "argv",
-        sessionBindingFile: "grok-acp-session.json"
-      }),
-      /**
-       * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
-       * Model arrives as an ACP `session/set_model` RPC with modelId `provider:model`
-       * (seat table provider + model concatenated). Reasoning is the global
-       * `--reasoning` flag before `acp`. Soul is the seat profile SOUL.md symlink
-       * (`hermes -p ak-<role> …`); package `souls/<role>.md` is the sole source.
-       */
-      "hermes": Object.freeze({
-        binaryFromHome: Object.freeze([".local", "bin", "hermes"]),
-        argv: Object.freeze({
-          prefix: Object.freeze(["acp"]),
-          suffix: Object.freeze([]),
-          thinkingFlag: "--reasoning"
-        }),
-        modelPassing: "set_model",
-        sessionBindingFile: "hermes-acp-session.json",
-        seatProfileSoul: Object.freeze({
-          flag: "-p",
-          namePrefix: "ak-",
-          profilesRootFromHome: Object.freeze([".hermes", "profiles"]),
-          soulFileName: "SOUL.md"
-        })
-      })
-    });
-    HEADLESS_HOST_DESCRIPTIONS = Object.freeze({
-      "claude": Object.freeze({
-        protocol: "claude-print",
-        binaryFromHome: Object.freeze([".local", "bin", "claude"]),
-        sessionBindingFile: "claude-headless-session.json",
-        fixedArgs: Object.freeze([
-          // Live NDJSON events → sitian host-session records (#811); last line is the result receipt.
-          "--output-format",
-          "stream-json",
-          // Intermediate assistant/tool/system events require verbose with stream-json.
-          "--verbose",
-          "--permission-mode",
-          "bypassPermissions"
-        ]),
-        promptFlag: "-p",
-        modelFlag: "--model",
-        effortFlag: "--effort",
-        // File path keeps large role envelopes off ARG_MAX.
-        systemPromptFlag: "--system-prompt-file",
-        jsonSchemaFlag: "--json-schema",
-        mcpConfigFlag: "--mcp-config",
-        sessionIdFlag: "--session-id",
-        resumeFlag: "--resume"
-      }),
-      /**
-       * Codex headless (#646). Binary under operator home; auth stays in CODEX_HOME.
-       * Argv/parse/schema-close are codex-exec helpers — not Claude flag mapping.
-       */
-      "codex": Object.freeze({
-        protocol: "codex-exec",
-        binaryFromHome: Object.freeze([".local", "bin", "codex"]),
-        sessionBindingFile: "codex-headless-session.json"
-      })
-    });
-  }
-});
-
 // src/package-resources/engine-material.ts
 import { existsSync as existsSync2, readdirSync } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function pickEngineAxis(source) {
   return {
     ...source.engine === void 0 ? {} : { engine: source.engine },
@@ -2867,11 +2871,11 @@ function isEngineNameSyntax(name) {
   return true;
 }
 function resolveEngineMaterialDirectory(packageRoot) {
-  return join4(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
+  return join5(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
 }
 function resolveEngineMaterialPath(packageRoot, name) {
   const legal = assertLegalEngineName(name);
-  return join4(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
+  return join5(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
 }
 function assertLegalEngineName(name) {
   if (!isEngineNameSyntax(name)) {
@@ -3050,7 +3054,7 @@ __export(config_exports, {
   validatePublicCliConfigAxes: () => validatePublicCliConfigAxes
 });
 import { mkdir, readFile as readFile4, writeFile } from "node:fs/promises";
-import { dirname as dirname5, join as join5 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 function isGateOfficerSeat(value) {
   return packagedProvinceConfig(value);
 }
@@ -3058,7 +3062,7 @@ function publicCliConfigPath(home) {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
   }
-  return join5(home, ".ak-roles", "public-cli.json");
+  return join6(home, ".ak-roles", "public-cli.json");
 }
 async function loadPublicCliConfig(home) {
   const path = publicCliConfigPath(home);
@@ -3521,7 +3525,7 @@ function credentialProvidersFromAuthData(data) {
 }
 async function loadCredentialProviders(agentDir) {
   try {
-    const raw = await readFile4(join5(agentDir, "auth.json"), "utf8");
+    const raw = await readFile4(join6(agentDir, "auth.json"), "utf8");
     return credentialProvidersFromAuthData(JSON.parse(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -3599,10 +3603,10 @@ var init_cli_errors = __esm({
 // src/atomic-write.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { rename, rm, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname6, join as join6 } from "node:path";
+import { dirname as dirname6, join as join7 } from "node:path";
 async function writeFileAtomically(destination, contents) {
   const parent = dirname6(destination);
-  const temporary = join6(parent, `.atomic-write-${randomUUID2()}.tmp`);
+  const temporary = join7(parent, `.atomic-write-${randomUUID2()}.tmp`);
   try {
     await writeFile2(temporary, contents);
     await rename(temporary, destination);
@@ -3619,7 +3623,7 @@ var init_atomic_write = __esm({
 
 // src/role-run-placement.ts
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function isMissingPathError2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
@@ -3636,13 +3640,13 @@ async function listBookRunDirectories(bookDir) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const runDir = join8(runsDir, entry.name);
+      const runDir = join9(runsDir, entry.name);
       if (seen.has(runDir)) continue;
       seen.add(runDir);
       out.push(runDir);
     }
   };
-  await collect(join8(bookDir, "runs"));
+  await collect(join9(bookDir, "runs"));
   let subjects;
   try {
     subjects = await readdir2(bookDir, { withFileTypes: true });
@@ -3652,7 +3656,7 @@ async function listBookRunDirectories(bookDir) {
   }
   for (const subject of subjects) {
     if (!subject.isDirectory() || subject.name === "runs") continue;
-    await collect(join8(bookDir, subject.name, "runs"));
+    await collect(join9(bookDir, subject.name, "runs"));
   }
   return out.sort();
 }
@@ -3661,23 +3665,23 @@ function roleRunPlacement(ledgerHome, input) {
     input.subject.ticketNumber,
     "roleRunPlacement subject.ticketNumber"
   )) : "unbound";
-  const runDirectory = join8(
+  const runDirectory = join9(
     activationBookDirectory(ledgerHome, input.bookKey),
     subjectDirectory,
     "runs",
     `${input.runId}@${input.role}`
   );
-  const sessionDirectory = join8(runDirectory, "session");
+  const sessionDirectory = join9(runDirectory, "session");
   return {
     runDirectory,
     sessionDirectory,
-    sessionFile: join8(sessionDirectory, "session.jsonl"),
+    sessionFile: join9(sessionDirectory, "session.jsonl"),
     artifactsDirectory: roleRunArtifactsDirectory(runDirectory),
-    attachmentsDirectory: join8(runDirectory, "attachments")
+    attachmentsDirectory: join9(runDirectory, "attachments")
   };
 }
 function roleRunArtifactsDirectory(runDirectory) {
-  return join8(runDirectory, "artifacts");
+  return join9(runDirectory, "artifacts");
 }
 function ensureRoleRunDirectory(ledgerHome, directory) {
   return ensureRealDirectoryTree(ledgerHome, directory);
@@ -3704,7 +3708,7 @@ __export(durable_principal_exports, {
   issuePiDurablePrincipalCoordinates: () => issuePiDurablePrincipalCoordinates,
   piDurablePrincipalAuthority: () => piDurablePrincipalAuthority
 });
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function encode(coordinates) {
   return coordinates;
 }
@@ -3754,7 +3758,7 @@ var init_durable_principal = __esm({
         }
         return {
           sessionDirectory: record4.sessionDirectory,
-          sessionFile: typeof record4.sessionFile === "string" && record4.sessionFile.trim() !== "" ? record4.sessionFile : join9(record4.sessionDirectory, "session.jsonl")
+          sessionFile: typeof record4.sessionFile === "string" && record4.sessionFile.trim() !== "" ? record4.sessionFile : join10(record4.sessionDirectory, "session.jsonl")
         };
       }
     };
@@ -3763,9 +3767,9 @@ var init_durable_principal = __esm({
 
 // src/typed-provider-http.ts
 import { readFile as readFile6, unlink, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function typedProviderHttpPath(runDirectory) {
-  return join10(runDirectory, TYPED_HTTP_FILE);
+  return join11(runDirectory, TYPED_HTTP_FILE);
 }
 async function clearTypedProviderHttpObservation(runDirectory) {
   try {
@@ -3909,7 +3913,7 @@ __export(auditor_dossier_tool_exports, {
   auditorRunDirectory: () => auditorRunDirectory,
   createAuditorDossierTool: () => createAuditorDossierTool
 });
-import { dirname as dirname8, join as join11, resolve as resolve6 } from "node:path";
+import { dirname as dirname8, join as join12, resolve as resolve6 } from "node:path";
 import { Type as Type11 } from "typebox";
 function auditorRunDirectory(context) {
   const sessionFile = context.sessionManager?.getSessionFile?.();
@@ -3932,9 +3936,9 @@ function createAuditorDossierTool(runDirectory) {
       }
       const details = {
         runDirectory,
-        admittedRequest: join11(runDirectory, "admitted-request.json"),
-        parentSessionCandidate: join11(runDirectory, "session", "session.jsonl"),
-        attachments: join11(runDirectory, "attachments"),
+        admittedRequest: join12(runDirectory, "admitted-request.json"),
+        parentSessionCandidate: join12(runDirectory, "session", "session.jsonl"),
+        attachments: join12(runDirectory, "attachments"),
         artifacts: roleRunArtifactsDirectory(runDirectory)
       };
       return {
@@ -3964,7 +3968,7 @@ __export(run_terminal_artifacts_exports, {
   runIdFromRunDirectory: () => runIdFromRunDirectory
 });
 import { readdir as readdir3, readFile as readFile8 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname9, join as join12 } from "node:path";
+import { basename as basename4, dirname as dirname9, join as join13 } from "node:path";
 function isMissingPathError3(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
@@ -4039,7 +4043,7 @@ async function listUniqueErrorFallbackPaths(directories) {
     }
     for (const name of names.sort((a, b) => a.localeCompare(b))) {
       if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
-      found.push(join12(dir, name));
+      found.push(join13(dir, name));
     }
   }
   return found;
@@ -4085,11 +4089,11 @@ async function readRunTerminalArtifact(runDirectory) {
     unreadable.push(read);
   };
   for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    consider(await readTerminalArtifactAtPath(join12(artifactsDir, file), file));
+    consider(await readTerminalArtifactAtPath(join13(artifactsDir, file), file));
   }
   for (const relative3 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
     consider(
-      await readTerminalArtifactAtPath(join12(runDirectory, relative3), "error.json")
+      await readTerminalArtifactAtPath(join13(runDirectory, relative3), "error.json")
     );
   }
   for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
@@ -4438,7 +4442,7 @@ __export(session_assistant_usage_exports, {
   sessionFileFromPublicSummon: () => sessionFileFromPublicSummon,
   usageFromPublicSummon: () => usageFromPublicSummon
 });
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 async function readAssistantUsageFromSessionFile(sessionFile) {
   const { readFile: readFile25 } = await import("node:fs/promises");
   let text;
@@ -4508,7 +4512,7 @@ async function readAssistantUsageFromSessionFile(sessionFile) {
 }
 function sessionFileFromPublicSummon(summoned) {
   if (typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== "") {
-    return join13(summoned.runDirectory, "session", "session.jsonl");
+    return join14(summoned.runDirectory, "session", "session.jsonl");
   }
   const fromArtifacts = summoned.terminal?.artifacts?.map((a) => a.path).find((p) => typeof p === "string" && p.endsWith("session.jsonl"));
   if (fromArtifacts !== void 0) return fromArtifacts;
@@ -4517,7 +4521,7 @@ function sessionFileFromPublicSummon(summoned) {
   const facts = outcome.decisiveFacts;
   const pointer = facts?.runPointer;
   if (typeof pointer === "string" && pointer.trim() !== "") {
-    return join13(pointer, "session", "session.jsonl");
+    return join14(pointer, "session", "session.jsonl");
   }
   return void 0;
 }
@@ -4536,7 +4540,7 @@ var init_session_assistant_usage = __esm({
 import { spawn } from "node:child_process";
 import { mkdtemp, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function normalizeEngineName(engine) {
   if (engine === void 0) return void 0;
   const trimmed = engine.trim();
@@ -4637,8 +4641,8 @@ async function runEngineDetourOnce(input) {
   if (input.stagedPrompt === void 0) {
     return spawnEngineDetourOnce(input);
   }
-  const stagingDir = await mkdtemp(join14(tmpdir(), "ak-engine-detour-"));
-  const stagedPath = join14(stagingDir, "prompt.txt");
+  const stagingDir = await mkdtemp(join15(tmpdir(), "ak-engine-detour-"));
+  const stagedPath = join15(stagingDir, "prompt.txt");
   let result;
   let runError;
   try {
@@ -4772,12 +4776,12 @@ __export(role_turn_host_exports, {
 import { execFile, spawn as spawn2 } from "node:child_process";
 import { constants } from "node:fs";
 import { access, appendFile, readFile as readFile9, realpath as realpath2 } from "node:fs/promises";
-import { delimiter, dirname as dirname10, isAbsolute as isAbsolute3, join as join15, resolve as resolve7 } from "node:path";
+import { delimiter, dirname as dirname10, isAbsolute as isAbsolute3, join as join16, resolve as resolve7 } from "node:path";
 import { platform } from "node:process";
 import { promisify } from "node:util";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function resolveInternalRoleEntrypoint(packageRoot) {
-  return join15(packageRoot, INTERNAL_ROLE_ENTRYPOINT_RELATIVE2);
+  return join16(packageRoot, INTERNAL_ROLE_ENTRYPOINT_RELATIVE2);
 }
 function buildExplicitInternalActivationArgs(selectedRoleEntry, extraArgs = []) {
   return ["--no-extensions", "-e", selectedRoleEntry, ...extraArgs];
@@ -5536,13 +5540,13 @@ var init_session_dialogue = __esm({
 
 // src/ticket-provenance.ts
 import { readFile as readFile12, unlink as unlink2 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname11, join as join16, resolve as resolve9 } from "node:path";
+import { basename as basename5, dirname as dirname11, join as join17, resolve as resolve9 } from "node:path";
 function dialogueSessionSourceRoots(home) {
   const machineHome = typeof home === "string" && home.trim() !== "" ? home : packageMachineHome();
   return [
-    join16(machineHome, ".claude", "projects"),
-    join16(machineHome, ".codex", "sessions"),
-    join16(machineHome, ".pi", "agent", "sessions")
+    join17(machineHome, ".claude", "projects"),
+    join17(machineHome, ".codex", "sessions"),
+    join17(machineHome, ".pi", "agent", "sessions")
   ];
 }
 function isLedgerRoleSessionFile(absolute, home) {
@@ -5580,7 +5584,7 @@ function ticketProvenanceRecordInput(ticketNumber, cwd, home, runDirectory) {
   };
 }
 async function rehomeUnboundTicketProvenance(runDirectory, ticketNumber, cwd, home) {
-  const source = join16(runDirectory, "records.jsonl");
+  const source = join17(runDirectory, "records.jsonl");
   let content;
   try {
     content = await readFile12(source, "utf8");
@@ -5765,7 +5769,7 @@ var init_ticket_provenance = __esm({
 });
 
 // src/notary-source-run.ts
-import { dirname as dirname12, isAbsolute as isAbsolute5, join as join17, resolve as resolve10, basename as basename6 } from "node:path";
+import { dirname as dirname12, isAbsolute as isAbsolute5, join as join18, resolve as resolve10, basename as basename6 } from "node:path";
 import { lstat, realpath as realpath3 } from "node:fs/promises";
 async function readRetainedIdentity(runDirectory) {
   try {
@@ -5822,11 +5826,11 @@ async function resolveNotarySourceRunLocator(options) {
   const ledgerHome = resolveActivationLedgerHome(options.home);
   const bookKey = resolveBookKeyFromGit(options.projectRoot);
   const bookDirectory = activationBookDirectory(ledgerHome, bookKey);
-  const bookRunsRoot = join17(bookDirectory, "runs");
+  const bookRunsRoot = join18(bookDirectory, "runs");
   let candidate;
   const bare = parseRunDirectoryName(raw);
   if (bare !== void 0 && !raw.includes("/") && !raw.includes("\\")) {
-    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join17(bookRunsRoot, `${bare.runId}@${bare.role}`);
+    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join18(bookRunsRoot, `${bare.runId}@${bare.role}`);
   } else {
     candidate = isAbsolute5(raw) ? raw : resolve10(options.projectRoot, raw);
     const identity2 = parseRunDirectoryName(basename6(candidate));
@@ -6967,7 +6971,7 @@ import {
   writeFile as writeFile5
 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute6, join as join18, resolve as resolve11, sep as sep3 } from "node:path";
+import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute6, join as join19, resolve as resolve11, sep as sep3 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
   const bookKey = resolveBookKeyFromGit(request.cwd);
@@ -7021,14 +7025,14 @@ async function writeRoleInvocationLedger(source, role, effectiveModel) {
     ...effectiveModelLedgerFields(effectiveModel)
   };
   await writeFile5(
-    join18(source.runDirectory, "invocation.json"),
+    join19(source.runDirectory, "invocation.json"),
     `${JSON.stringify(identity, null, 2)}
 `,
     "utf8"
   );
 }
 async function recordEffectiveInvocationModel(runDirectory, model, engine, host, engineModel) {
-  const ledgerPath = join18(runDirectory, "invocation.json");
+  const ledgerPath = join19(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile13(ledgerPath, "utf8"));
   const next = { ...current };
   if (model !== void 0) {
@@ -7061,7 +7065,7 @@ async function recordEffectiveInvocationModel(runDirectory, model, engine, host,
   );
 }
 async function mergeInvocationIdentityPage(runDirectory, fields) {
-  const ledgerPath = join18(runDirectory, "invocation.json");
+  const ledgerPath = join19(runDirectory, "invocation.json");
   const current = JSON.parse(await readFile13(ledgerPath, "utf8"));
   await writeFile5(
     ledgerPath,
@@ -7144,7 +7148,7 @@ async function relocateAdmittedRunToTicket(admitted, authority, heldLease) {
     const childRunIds = parentPage.childDiaristRunIds;
     for (const childRunId of Array.isArray(childRunIds) ? childRunIds : []) {
       if (typeof childRunId !== "string") continue;
-      const childDirectory = join18(dirname13(oldRunDirectory), `${childRunId}@diarist`);
+      const childDirectory = join19(dirname13(oldRunDirectory), `${childRunId}@diarist`);
       if (!existsSync4(childDirectory)) continue;
       const childTarget = roleRunPlacement(ledgerHome, {
         bookKey: admitted.bookKey,
@@ -7201,7 +7205,7 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
     ticketNumber,
     "bindTicketNumberOnRunDirectory"
   );
-  const admittedPath = join18(runDirectory, "admitted-request.json");
+  const admittedPath = join19(runDirectory, "admitted-request.json");
   const admitted = JSON.parse(await readFile13(admittedPath, "utf8"));
   if (admitted.ticketNumber === ticketNumber) return;
   await writeFile5(
@@ -7221,7 +7225,7 @@ async function recordLaunchedPiIdentity(runDirectory, identity) {
 async function observeLaunchedRolePackageIdentity(packageRoot, selectedRoleEntry) {
   const rolePackageRoot = packageRoot;
   const raw = JSON.parse(
-    await readFile13(join18(rolePackageRoot, "package.json"), "utf8")
+    await readFile13(join19(rolePackageRoot, "package.json"), "utf8")
   );
   if (typeof raw.version !== "string" || raw.version.trim() === "") {
     throw new Error(
@@ -7509,13 +7513,13 @@ async function removePreparedAttachmentDirectory(stagingDirectory) {
 }
 async function withPreparedAttachments(attachmentPaths, use) {
   if (attachmentPaths.length === 0) return await use([]);
-  const stagingDirectory = await mkdtemp2(join18(tmpdir2(), "ak-role-attachments-"));
+  const stagingDirectory = await mkdtemp2(join19(tmpdir2(), "ak-role-attachments-"));
   const prepared = [];
   let result;
   try {
     for (let index = 0; index < attachmentPaths.length; index += 1) {
       const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
-      const snapshotPath = join18(stagingDirectory, String(index).padStart(6, "0"));
+      const snapshotPath = join19(stagingDirectory, String(index).padStart(6, "0"));
       await writeFile5(snapshotPath, bytes);
       prepared.push({ absolute, snapshotPath });
     }
@@ -7536,7 +7540,7 @@ async function withPreparedAttachments(attachmentPaths, use) {
   return result;
 }
 async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
-  const frozenPath = join18(
+  const frozenPath = join19(
     destinationDir,
     `${String(index).padStart(2, "0")}-${basename7(provenancePath)}`
   );
@@ -7579,14 +7583,14 @@ async function freezeAttachments(attachmentPaths, attachmentsDirectory) {
 async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKey = `s-${Date.now().toString(36)}`) {
   if (attachmentPaths.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = join18(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = join19(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
 async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
   if (prepared.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = summonsKey === void 0 ? join18(runDirectory, "attachments") : join18(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = summonsKey === void 0 ? join19(runDirectory, "attachments") : join19(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   const attachments = [];
   for (let index = 0; index < prepared.length; index += 1) {
@@ -7663,7 +7667,7 @@ async function admitPublicRole(role, parsed, env, override) {
         attachmentPaths,
         ...project,
         placedFields: async (placed) => {
-          const taskPath = join18(placed.runDirectory, "task.md");
+          const taskPath = join19(placed.runDirectory, "task.md");
           await writeFile5(taskPath, instruction, "utf8");
           return { phase, taskPath };
         }
@@ -7709,7 +7713,7 @@ async function admitPublicRole(role, parsed, env, override) {
         placedFields: async (placed) => {
           let prerequisitesPath;
           if (prerequisitesSource !== void 0) {
-            prerequisitesPath = join18(placed.runDirectory, "prerequisites.json");
+            prerequisitesPath = join19(placed.runDirectory, "prerequisites.json");
             await writeFile5(
               prerequisitesPath,
               `${JSON.stringify(prerequisites, null, 2)}
@@ -7717,7 +7721,7 @@ async function admitPublicRole(role, parsed, env, override) {
               "utf8"
             );
           }
-          const packetPath = join18(placed.runDirectory, "fix-packet.md");
+          const packetPath = join19(placed.runDirectory, "fix-packet.md");
           await writeFile5(packetPath, instruction, "utf8");
           return {
             phase,
@@ -7775,7 +7779,7 @@ async function admitPublicRole(role, parsed, env, override) {
         placedFields: async (placed) => {
           let requestManifestPath;
           if (manifestCanonicalJson !== void 0) {
-            requestManifestPath = join18(placed.runDirectory, "request-manifest.json");
+            requestManifestPath = join19(placed.runDirectory, "request-manifest.json");
             await writeFile5(requestManifestPath, manifestCanonicalJson, "utf8");
           }
           return {
@@ -7965,7 +7969,7 @@ async function admitPublicRole(role, parsed, env, override) {
             resolutionScope: [...derived.resolutionScope],
             authorizedChecks: []
           });
-          const mergerInputPath = join18(placed.runDirectory, "merger-input.json");
+          const mergerInputPath = join19(placed.runDirectory, "merger-input.json");
           await writeFile5(
             mergerInputPath,
             `${JSON.stringify(mergerInput, null, 2)}
@@ -8039,7 +8043,7 @@ function persistedAttachmentRefs(attachments) {
   }));
 }
 async function persistPlacedAdmission(admitted, placed, model) {
-  const admittedRequestPath = join18(placed.runDirectory, "admitted-request.json");
+  const admittedRequestPath = join19(placed.runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory: placed.sessionDirectory,
     sessionFile: placed.sessionFile
@@ -8092,7 +8096,7 @@ async function admitStandardMaterialInvocation(role, options) {
     attachments: persistedAttachmentRefs(placed.attachments),
     ...placed.ticketFields
   };
-  const admittedRequestPath = defer ? join18(placed.runDirectory, "admitted-request.json") : await persistPlacedAdmission(admitted, placed, options.model);
+  const admittedRequestPath = defer ? join19(placed.runDirectory, "admitted-request.json") : await persistPlacedAdmission(admitted, placed, options.model);
   return {
     role,
     runId: placed.runId,
@@ -8170,7 +8174,7 @@ async function materializeCountersignInvocation(admitted, options) {
   });
   const placement = placed;
   admitted.runDirectory = placement.runDirectory;
-  admitted.admittedRequestPath = join18(
+  admitted.admittedRequestPath = join19(
     placement.runDirectory,
     "admitted-request.json"
   );
@@ -8197,7 +8201,7 @@ async function materializeCountersignInvocation(admitted, options) {
 async function loadAdmittedJudgeRequest(runDirectory) {
   try {
     const raw = JSON.parse(
-      await readFile13(join18(runDirectory, "admitted-request.json"), "utf8")
+      await readFile13(join19(runDirectory, "admitted-request.json"), "utf8")
     );
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
     const record4 = raw;
@@ -8286,7 +8290,7 @@ function parseDoctorIssueNumber(raw) {
 }
 async function resolveDoctorCaseRunsPath(options) {
   const ledgerHome = resolveActivationLedgerHome(options.home);
-  const defaultRuns = join18(
+  const defaultRuns = join19(
     activationBookDirectory(ledgerHome, options.bookKey),
     String(options.issueNumber),
     "runs"
@@ -8607,15 +8611,15 @@ var init_invocation = __esm({
 
 // src/public-cli/load-production-acp-host.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 import { pathToFileURL } from "node:url";
 async function loadProductionAcpHostFactory(packageRoot, host) {
   const description = lookupHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered host: ${host}`);
   }
-  const built = join19(packageRoot, "dist/acp-host/production-host.js");
-  const source = join19(packageRoot, "src/acp-host/production-host.ts");
+  const built = join20(packageRoot, "dist/acp-host/production-host.js");
+  const source = join20(packageRoot, "src/acp-host/production-host.ts");
   const target = existsSync5(built) ? built : source;
   const href = pathToFileURL(target).href;
   const mod = await import(href);
@@ -8631,15 +8635,15 @@ var init_load_production_acp_host = __esm({
 
 // src/public-cli/load-production-headless-host.ts
 import { existsSync as existsSync6 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 async function loadProductionHeadlessHostFactory(packageRoot, host) {
   const description = lookupHeadlessHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered headless host: ${host}`);
   }
-  const built = join20(packageRoot, "dist/headless-host/production-host.js");
-  const source = join20(packageRoot, "src/headless-host/production-host.ts");
+  const built = join21(packageRoot, "dist/headless-host/production-host.js");
+  const source = join21(packageRoot, "src/headless-host/production-host.ts");
   const target = existsSync6(built) ? built : source;
   const href = pathToFileURL2(target).href;
   const mod = await import(href);
@@ -8693,8 +8697,8 @@ __export(role_turn_host_resolution_exports, {
   resolveRoleTurnHost: () => resolveRoleTurnHost,
   selectRoleTurnHost: () => selectRoleTurnHost
 });
-function formatHostSelectionFailure(failure2) {
-  return `${failure2.kind}: ${failure2.host}; seat=${failure2.seat}; model=${failure2.model}; registered: ${failure2.registeredHosts.join(", ")}`;
+function formatHostSelectionFailure(failure) {
+  return `${failure.kind}: ${failure.host}; seat=${failure.seat}; model=${failure.model}; registered: ${failure.registeredHosts.join(", ")}`;
 }
 function composeRoleTurnHostAdapters(env, principalAuthority) {
   const piHost = env.roleTurnHost ?? createPiRoleTurnHost({
@@ -8754,9 +8758,9 @@ var init_role_turn_host_resolution = __esm({
     init_invocation();
     init_load_production_external_host();
     HostSelectionError = class extends Error {
-      constructor(failure2) {
-        super(formatHostSelectionFailure(failure2));
-        this.failure = failure2;
+      constructor(failure) {
+        super(formatHostSelectionFailure(failure));
+        this.failure = failure;
         this.name = "HostSelectionError";
       }
       failure;
@@ -8778,15 +8782,15 @@ __export(host_providers_exports, {
   renderHostProvidersTable: () => renderHostProvidersTable
 });
 import { readFileSync } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 function hostProvidersPath(home) {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
   }
-  return join21(home, ".ak-roles", "host-providers.json");
+  return join22(home, ".ak-roles", "host-providers.json");
 }
 function hermesProviderModelsCachePath(home) {
-  return join21(home, ".hermes", "provider_models_cache.json");
+  return join22(home, ".hermes", "provider_models_cache.json");
 }
 function parseHostProvidersTable(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -8942,7 +8946,7 @@ var init_host_providers = __esm({
 
 // src/analyst-gate-cycles-read.ts
 import { readdir as readdir4 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -9193,7 +9197,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
       throw error;
     }
     for (const name of names) {
-      const path = join22(directory, name);
+      const path = join23(directory, name);
       const fromPointer = name.endsWith(".pointer.json");
       const pointer = fromPointer ? await resolveOfficerSessionFromPointerFile(path) : void 0;
       const sessionPath = pointer?.sessionFile ?? path;
@@ -9235,7 +9239,7 @@ var init_analyst_gate_cycles_read = __esm({
 });
 
 // src/submission-ledger.ts
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function runIdentity(context) {
   const directory = runDirectoryFromHostContext(context);
   if (directory !== void 0) {
@@ -9257,7 +9261,7 @@ async function submissionRecordFile(cwd, runId, scope) {
   if (sessionParent === void 0) {
     const discoveredRun = await findRunDirectoryById(scope.home, runId);
     if (discoveredRun === void 0) return void 0;
-    sessionParent = join23(discoveredRun, "session", "session.jsonl");
+    sessionParent = join24(discoveredRun, "session", "session.jsonl");
   }
   return resolveSitianRecordPathInLedger({
     level: "event",
@@ -9450,12 +9454,12 @@ async function restoreState(cwd, runId, scope) {
 }
 function sessionParentFromHostContext(context) {
   const runDirectory = runDirectoryFromHostContext(context);
-  if (runDirectory !== void 0) return join23(runDirectory, "session", "session.jsonl");
+  if (runDirectory !== void 0) return join24(runDirectory, "session", "session.jsonl");
   const sessionFile = context.sessionManager.getSessionFile?.();
   if (typeof sessionFile === "string" && sessionFile.length > 0) return sessionFile;
   const sessionDir = context.sessionManager.getSessionDir?.();
   if (typeof sessionDir === "string" && sessionDir.length > 0) {
-    return join23(sessionDir, "session.jsonl");
+    return join24(sessionDir, "session.jsonl");
   }
   return void 0;
 }
@@ -9643,12 +9647,12 @@ var init_audit_escalation = __esm({
 // src/session-opening-materials.ts
 import { existsSync as existsSync7 } from "node:fs";
 import { readFile as readFile14 } from "node:fs/promises";
-import { dirname as dirname14, join as join24 } from "node:path";
+import { dirname as dirname14, join as join25 } from "node:path";
 import { fileURLToPath, pathToFileURL as pathToFileURL3 } from "node:url";
 function resolvePackageRootDir(moduleUrl = import.meta.url) {
   let dir = dirname14(fileURLToPath(moduleUrl));
   for (let i = 0; i < 8; i += 1) {
-    if (existsSync7(join24(dir, "package.json")) && existsSync7(join24(dir, "souls"))) {
+    if (existsSync7(join25(dir, "package.json")) && existsSync7(join25(dir, "souls"))) {
       return dir;
     }
     const parent = dirname14(dir);
@@ -9717,7 +9721,7 @@ __export(auditor_soul_exports, {
   resolveAuditorSubject: () => resolveAuditorSubject
 });
 import { readFile as readFile15 } from "node:fs/promises";
-import { basename as basename8, join as join25 } from "node:path";
+import { basename as basename8, join as join26 } from "node:path";
 function auditorSoulRelativePath(role) {
   return `souls/${role}-auditor.md`;
 }
@@ -9759,7 +9763,7 @@ function subjectFromSourceDirectory(sourceRunDirectory) {
 async function readAuditorResumeBinding(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile15(join25(runDirectory, "admitted-request.json"), "utf8"));
+    raw = JSON.parse(await readFile15(join26(runDirectory, "admitted-request.json"), "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -9872,7 +9876,7 @@ var init_serialize_thrown_value = __esm({
 // src/engine-detour-usage.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname15, join as join26 } from "node:path";
+import { dirname as dirname15, join as join27 } from "node:path";
 function engineDetourStdoutByteLength(stdout) {
   return Buffer.byteLength(stdout, "utf8");
 }
@@ -10009,7 +10013,7 @@ function projectEngineDetourToolUsageForPublicTerminal(usage, options) {
 function readInvocationRecord(runDirectory) {
   try {
     const raw = JSON.parse(
-      readFileSync2(join26(runDirectory, "invocation.json"), "utf8")
+      readFileSync2(join27(runDirectory, "invocation.json"), "utf8")
     );
     return isRecord7(raw) ? raw : void 0;
   } catch (error) {
@@ -10037,7 +10041,7 @@ function runDirectoryFromSessionDirectory(sessionDirectory) {
   return dirname15(sessionDirectory);
 }
 function sessionFileFromSessionDirectory(sessionDirectory) {
-  return join26(sessionDirectory, "session.jsonl");
+  return join27(sessionDirectory, "session.jsonl");
 }
 function mintEngineDetourInvocationScope(input) {
   const engine = input.effectiveEngine?.trim();
@@ -10282,14 +10286,14 @@ __export(settlement_exports, {
 });
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { appendFile as appendFile2, readFile as readFile16, readdir as readdir5, rm as rm4, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname16, join as join27 } from "node:path";
+import { dirname as dirname16, join as join28 } from "node:path";
 function sealedLedgerHome(admitted) {
   return homeFromRunDirectory(admitted.runDirectory);
 }
 function ledgerReadScope(admitted, scope) {
   return {
     home: sealedLedgerHome(admitted),
-    sessionParent: join27(admitted.runDirectory, "session", "session.jsonl"),
+    sessionParent: join28(admitted.runDirectory, "session", "session.jsonl"),
     ...scope?.courtAttemptId === void 0 || scope.courtAttemptId.length === 0 ? {} : { attemptId: scope.courtAttemptId }
   };
 }
@@ -10421,8 +10425,8 @@ function formatCliDiagnostic(message) {
   return `ak-role: ${message}
 `;
 }
-function formatFailureStderrDiagnostic(failure2) {
-  const text = failure2.diagnostic.trim().length > 0 ? failure2.diagnostic : "failure";
+function formatFailureStderrDiagnostic(failure) {
+  const text = failure.diagnostic.trim().length > 0 ? failure.diagnostic : "failure";
   return formatCliDiagnostic(text);
 }
 function formatErrorCauseDetail(cause) {
@@ -10447,10 +10451,10 @@ function presentStructuralRejection(error, io) {
   }
   io.stderr(formatCliDiagnostic(message));
 }
-function presentControlledFailure(failure2, io) {
-  io.stdout(`${JSON.stringify(failure2, null, 2)}
+function presentControlledFailure(failure, io) {
+  io.stdout(`${JSON.stringify(failure, null, 2)}
 `);
-  io.stderr(formatFailureStderrDiagnostic(failure2));
+  io.stderr(formatFailureStderrDiagnostic(failure));
 }
 async function inspectJudgeSession(sessionFile) {
   try {
@@ -10553,14 +10557,14 @@ function classifyThrownFailure(error) {
     }
   };
 }
-function withKnownDetails(failure2, knownDetails) {
-  if (knownDetails === void 0) return failure2;
+function withKnownDetails(failure, knownDetails) {
+  if (knownDetails === void 0) return failure;
   const { timedOut: _knownTimedOut, ...rest } = knownDetails;
   return {
-    ...failure2,
+    ...failure,
     details: {
       ...rest,
-      ...failure2.details ?? {}
+      ...failure.details ?? {}
     }
   };
 }
@@ -10653,13 +10657,13 @@ function classifyPostAdmissionFailure(input) {
     input.knownDetails
   );
 }
-function explicitInternalKnownFailureClassificationInput(failure2) {
-  if (failure2 === void 0) return {};
+function explicitInternalKnownFailureClassificationInput(failure) {
+  if (failure === void 0) return {};
   return {
-    ...failure2.cause === void 0 ? {} : { knownCause: failure2.cause },
-    ...failure2.identity === void 0 ? {} : { knownIdentity: failure2.identity },
-    ...failure2.diagnostic === void 0 ? {} : { knownDiagnostic: failure2.diagnostic },
-    ...failure2.details === void 0 ? {} : { knownDetails: failure2.details }
+    ...failure.cause === void 0 ? {} : { knownCause: failure.cause },
+    ...failure.identity === void 0 ? {} : { knownIdentity: failure.identity },
+    ...failure.diagnostic === void 0 ? {} : { knownDiagnostic: failure.diagnostic },
+    ...failure.details === void 0 ? {} : { knownDetails: failure.details }
   };
 }
 function isMissingPathError4(error) {
@@ -10790,7 +10794,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
   }
   const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
   if (parentId === void 0) return void 0;
-  const childDirectories = [join27(dirname16(sessionFile), "auditor-roles")];
+  const childDirectories = [join28(dirname16(sessionFile), "auditor-roles")];
   const valid = [];
   let sawAnyDirectory = false;
   for (const childDirectory of childDirectories) {
@@ -10805,7 +10809,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
     for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
       let entries;
       try {
-        entries = await readBoundSessionEntries(join27(childDirectory, file));
+        entries = await readBoundSessionEntries(join28(childDirectory, file));
       } catch (error) {
         throw sessionReadFailure(error, "failed to read discovered auditor session");
       }
@@ -10850,19 +10854,19 @@ function complianceFailureFromAuditorVolumes(volumes) {
       const entry = entries[i];
       if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord10(entry.data)) continue;
       const parent = isRecord10(entry.data.parent) ? entry.data.parent : void 0;
-      const failure2 = isRecord10(entry.data.failure) ? entry.data.failure : void 0;
+      const failure = isRecord10(entry.data.failure) ? entry.data.failure : void 0;
       if (parent?.sessionId !== parentId || parent.sessionFile !== sessionFile || parent.attemptEntryId !== attemptEntryId) continue;
-      if (failure2 === void 0) continue;
-      const identity = isRecord10(failure2.identity) ? failure2.identity : void 0;
-      const typedCause = failure2.cause === "provider" || failure2.cause === "activation" || failure2.cause === "session" || failure2.cause === "output" || failure2.cause === "timeout" ? failure2.cause : void 0;
+      if (failure === void 0) continue;
+      const identity = isRecord10(failure.identity) ? failure.identity : void 0;
+      const typedCause = failure.cause === "provider" || failure.cause === "activation" || failure.cause === "session" || failure.cause === "output" || failure.cause === "timeout" ? failure.cause : void 0;
       return {
         ...typedCause === void 0 ? {} : { cause: typedCause },
         ...identity === void 0 ? {} : { identity: {
           ...typeof identity.name === "string" ? { name: identity.name } : {},
           ...typeof identity.code === "string" || typeof identity.code === "number" ? { code: identity.code } : {}
         } },
-        ...typeof failure2.diagnostic === "string" ? { diagnostic: failure2.diagnostic } : {},
-        ...isRecord10(failure2.details) ? { details: failure2.details } : {}
+        ...typeof failure.diagnostic === "string" ? { diagnostic: failure.diagnostic } : {},
+        ...isRecord10(failure.details) ? { details: failure.details } : {}
       };
     }
   }
@@ -10934,11 +10938,11 @@ async function resolveAuditedRunnerFailureResolution(input) {
     const auditorCompliance = await readBoundAuditorComplianceFailure(input.sessionFile);
     if (auditorCompliance !== void 0) return resolutionOf(auditorCompliance);
   } catch (error) {
-    const failure2 = sessionReadFailure(error, "failed to recover bound auditor failure");
+    const failure = sessionReadFailure(error, "failed to recover bound auditor failure");
     return resolutionOf({
       cause: "session",
-      identity: thrownIdentity(failure2),
-      diagnostic: failure2.message || failure2.name
+      identity: thrownIdentity(failure),
+      diagnostic: failure.message || failure.name
     });
   }
   try {
@@ -10948,11 +10952,11 @@ async function resolveAuditedRunnerFailureResolution(input) {
     if (terminatingFailure !== void 0) return resolutionOf(terminatingFailure);
   } catch (error) {
     if (!isMissingPathError4(error)) {
-      const failure2 = sessionReadFailure(error, "failed to recover typed terminating-tool failure");
+      const failure = sessionReadFailure(error, "failed to recover typed terminating-tool failure");
       return resolutionOf({
         cause: "session",
-        identity: thrownIdentity(failure2),
-        diagnostic: failure2.message || failure2.name
+        identity: thrownIdentity(failure),
+        diagnostic: failure.message || failure.name
       });
     }
   }
@@ -10960,11 +10964,11 @@ async function resolveAuditedRunnerFailureResolution(input) {
     const auditorStop = await readBoundAuditorProviderStopFallback(input.sessionFile);
     if (auditorStop !== void 0) return resolutionOf(auditorStop);
   } catch (error) {
-    const failure2 = sessionReadFailure(error, "failed to recover bound auditor provider stop");
+    const failure = sessionReadFailure(error, "failed to recover bound auditor provider stop");
     return resolutionOf({
       cause: "session",
-      identity: thrownIdentity(failure2),
-      diagnostic: failure2.message || failure2.name
+      identity: thrownIdentity(failure),
+      diagnostic: failure.message || failure.name
     });
   }
   const parentStop = await readSessionProviderStop(input.sessionFile);
@@ -10973,12 +10977,12 @@ async function resolveAuditedRunnerFailureResolution(input) {
     try {
       httpObservation = await readLatestTypedProviderHttpObservation(input.runDirectory);
     } catch (error) {
-      const failure2 = error instanceof Error ? error : new Error(String(error));
+      const failure = error instanceof Error ? error : new Error(String(error));
       return resolutionOf(
         {
           cause: "session",
-          identity: thrownIdentity(failure2),
-          diagnostic: failure2.message || failure2.name
+          identity: thrownIdentity(failure),
+          diagnostic: failure.message || failure.name
         },
         { settled: true }
       );
@@ -11029,12 +11033,12 @@ async function resolveControlledFailureResumeObservation(input) {
     const typedHttp429 = await readTypedHttp429Observation(input.runDirectory);
     return typedHttp429 === void 0 ? {} : { typedHttp429 };
   } catch (error) {
-    const failure2 = error instanceof Error ? error : new Error(String(error));
+    const failure = error instanceof Error ? error : new Error(String(error));
     return {
       observationReadFailure: {
         cause: "session",
-        identity: thrownIdentity(failure2),
-        diagnostic: failure2.message || failure2.name
+        identity: thrownIdentity(failure),
+        diagnostic: failure.message || failure.name
       }
     };
   }
@@ -11114,11 +11118,11 @@ async function readEngineDetourInfrastructureFailure(sessionFile) {
     ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC
   );
 }
-function knownFailureFromControlled(failure2) {
+function knownFailureFromControlled(failure) {
   return {
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic,
-    ...failure2.identity === void 0 ? {} : { identity: failure2.identity }
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic,
+    ...failure.identity === void 0 ? {} : { identity: failure.identity }
   };
 }
 function seatKnownFailureResolver(role) {
@@ -11281,8 +11285,8 @@ function projectTerminalGateFact(rounds) {
   };
 }
 async function extractGateFactFromSessionDirectory(sessionDirectory, options = {}) {
-  const directories = [join27(sessionDirectory, "auditor-roles")];
-  const parentSessionFile = options.parentSessionFile ?? join27(sessionDirectory, "session.jsonl");
+  const directories = [join28(sessionDirectory, "auditor-roles")];
+  const parentSessionFile = options.parentSessionFile ?? join28(sessionDirectory, "session.jsonl");
   const rounds = await readAnalystGateCyclesFromAuditorRoles(directories, {
     parentSessionFile
   });
@@ -11394,10 +11398,10 @@ async function removeFaceIfPresent(path) {
 async function clearOppositeTerminalArtifactFace(runDirectory) {
   const artifactsDir = roleRunArtifactsDirectory(runDirectory);
   for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    await removeFaceIfPresent(join27(artifactsDir, file));
+    await removeFaceIfPresent(join28(artifactsDir, file));
   }
   for (const relative3 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-    await removeFaceIfPresent(join27(runDirectory, relative3));
+    await removeFaceIfPresent(join28(runDirectory, relative3));
   }
   for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
     await removeFaceIfPresent(path);
@@ -11426,8 +11430,8 @@ async function publishAcceptedTerminalArtifacts(admitted, roleOutcome, coordinat
     roleOutcome
   );
   const artifactsDir = await ensureTerminalArtifactFace(admitted.runDirectory);
-  const reportPath = join27(artifactsDir, "report.json");
-  const evidencePath = join27(artifactsDir, "evidence.json");
+  const reportPath = join28(artifactsDir, "report.json");
+  const evidencePath = join28(artifactsDir, "evidence.json");
   await writeFile6(
     reportPath,
     `${JSON.stringify(bodies.report, null, 2)}
@@ -11836,7 +11840,7 @@ async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbac
   const candidates = [
     ...preferredCandidates,
     // One unique name per fallback dir — collisions on fixed names cannot exhaust this.
-    ...uniqueFallbackDirs.map((dir) => join27(dir, `${stem}.${randomUUID5()}.json`))
+    ...uniqueFallbackDirs.map((dir) => join28(dir, `${stem}.${randomUUID5()}.json`))
   ];
   for (let i = 0; i < candidates.length; i += 1) {
     const path = candidates[i];
@@ -11866,7 +11870,7 @@ async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbac
   error.publicationAttempts = issues;
   throw error;
 }
-async function publishFailureArtifacts(admitted, failure2, authority, onErrorPublished) {
+async function publishFailureArtifacts(admitted, failure, authority, onErrorPublished) {
   const { sessionDirectory, sessionFile } = coordinatesFromAdmitted(authority, admitted);
   const { baseDir, attempt: baseAttempt } = await resolveFailureArtifactsBase(
     admitted.runDirectory
@@ -11886,7 +11890,7 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
     await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile }, {
       kind: "failure",
       role: admitted.role,
-      ...failure2
+      ...failure
     });
   } catch (error) {
     priorIssues.push(publicationAttemptFromError(sessionFile, error));
@@ -11897,29 +11901,29 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
     baseDir
   );
   const errorCandidates = underArtifacts ? [
-    join27(baseDir, "error.json"),
-    join27(baseDir, "error.settlement.json"),
-    join27(admitted.runDirectory, "error.settlement.json")
+    join28(baseDir, "error.json"),
+    join28(baseDir, "error.settlement.json"),
+    join28(admitted.runDirectory, "error.settlement.json")
   ] : [
-    join27(baseDir, "error.settlement.json"),
-    join27(baseDir, "error.json")
+    join28(baseDir, "error.settlement.json"),
+    join28(baseDir, "error.json")
   ];
   const evidenceCandidates = underArtifacts ? [
-    join27(baseDir, "evidence.json"),
-    join27(baseDir, "evidence.settlement.json"),
-    join27(admitted.runDirectory, "evidence.settlement.json")
+    join28(baseDir, "evidence.json"),
+    join28(baseDir, "evidence.settlement.json"),
+    join28(admitted.runDirectory, "evidence.settlement.json")
   ] : [
-    join27(baseDir, "evidence.settlement.json"),
-    join27(baseDir, "evidence.json")
+    join28(baseDir, "evidence.settlement.json"),
+    join28(baseDir, "evidence.json")
   ];
   const errorPayloadBase = {
     kind: "error",
     role: admitted.role,
     runId: admitted.runId,
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic,
-    ...failure2.identity === void 0 ? {} : { identity: failure2.identity },
-    ...failure2.details === void 0 ? {} : { details: failure2.details }
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic,
+    ...failure.identity === void 0 ? {} : { identity: failure.identity },
+    ...failure.details === void 0 ? {} : { details: failure.details }
   };
   const errorWrite = await writeFailureJsonRetainingCause(
     errorCandidates,
@@ -11940,7 +11944,7 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
       sha256: a.sha256,
       byteLength: a.byteLength
     })),
-    ...failure2.cause === void 0 ? {} : { failureCause: failure2.cause }
+    ...failure.cause === void 0 ? {} : { failureCause: failure.cause }
   };
   const evidenceWrite = await writeFailureJsonRetainingCause(
     evidenceCandidates,
@@ -11955,10 +11959,10 @@ async function publishFailureArtifacts(admitted, failure2, authority, onErrorPub
     { kind: "evidence", path: evidenceWrite.path }
   ];
 }
-async function settleFailureTerminalResult(admitted, failure2, authority, options = {}) {
+async function settleFailureTerminalResult(admitted, failure, authority, options = {}) {
   const coordinates = coordinatesFromAdmitted(authority, admitted);
   const { sessionDirectory, sessionFile } = coordinates;
-  if (failure2.cause === "output") {
+  if (failure.cause === "output") {
     const entries = await readBoundSessionEntries(sessionFile).catch(() => void 0);
     if (entries !== void 0) {
       let attemptStart = 0;
@@ -12000,27 +12004,27 @@ async function settleFailureTerminalResult(admitted, failure2, authority, option
     }
   }
   const navigator = await extractNavigatorFactFromAdmittedSession(sessionFile);
-  const artifacts = await publishFailureArtifacts(admitted, failure2, authority, options.onErrorPublished);
+  const artifacts = await publishFailureArtifacts(admitted, failure, authority, options.onErrorPublished);
   const errorPath = artifacts.find((artifact) => artifact.kind === "error")?.path;
   const decisiveFacts = {
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic
   };
-  if (failure2.identity?.name !== void 0) {
-    decisiveFacts.errorName = failure2.identity.name;
+  if (failure.identity?.name !== void 0) {
+    decisiveFacts.errorName = failure.identity.name;
   }
-  if (failure2.identity?.code !== void 0) {
-    decisiveFacts.errorCode = failure2.identity.code;
+  if (failure.identity?.code !== void 0) {
+    decisiveFacts.errorCode = failure.identity.code;
   }
-  if (failure2.details !== void 0) {
-    decisiveFacts.secondaryEvidence = failure2.details;
+  if (failure.details !== void 0) {
+    decisiveFacts.secondaryEvidence = failure.details;
   }
   if (options.resume !== void 0) {
     const roleOutcome2 = {
       kind: "failure",
       role: admitted.role,
-      ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-      diagnostic: failure2.diagnostic,
+      ...failure.cause === void 0 ? {} : { cause: failure.cause },
+      diagnostic: failure.diagnostic,
       decisiveFacts
     };
     const terminal = await withOptionalGateProjection(
@@ -12039,8 +12043,8 @@ async function settleFailureTerminalResult(admitted, failure2, authority, option
   const roleOutcome = {
     kind: "failure",
     role: admitted.role,
-    ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-    diagnostic: failure2.diagnostic,
+    ...failure.cause === void 0 ? {} : { cause: failure.cause },
+    diagnostic: failure.diagnostic,
     decisiveFacts
   };
   return withOptionalGateProjection(
@@ -12054,8 +12058,8 @@ async function settleFailureTerminalResult(admitted, failure2, authority, option
     detourGateContext(admitted, options)
   );
 }
-async function settleJudgeFailureTerminalResult(admitted, failure2, authority, options = {}) {
-  return settleFailureTerminalResult(admitted, failure2, authority, options);
+async function settleJudgeFailureTerminalResult(admitted, failure, authority, options = {}) {
+  return settleFailureTerminalResult(admitted, failure, authority, options);
 }
 function presentFailureTerminal(terminal, io) {
   if (terminal.roleOutcome.kind !== "failure" && terminal.roleOutcome.kind !== "no_receipt") {
@@ -12165,9 +12169,9 @@ var init_settlement = __esm({
 
 // src/archivist-record-pointer.ts
 import { mkdirSync as mkdirSync2, writeFileSync } from "node:fs";
-import { dirname as dirname17, join as join28 } from "node:path";
+import { dirname as dirname17, join as join29 } from "node:path";
 function bookDirectOfficerRunPointer(options) {
-  const nest = join28(dirname17(options.parentSessionFile), "auditor-roles");
+  const nest = join29(dirname17(options.parentSessionFile), "auditor-roles");
   mkdirSync2(nest, { recursive: true });
   const pointer = {
     version: 1,
@@ -12177,7 +12181,7 @@ function bookDirectOfficerRunPointer(options) {
     ...options.runDirectory !== void 0 && options.runDirectory.trim() !== "" ? { runDirectory: options.runDirectory } : {}
   };
   writeFileSync(
-    join28(nest, `${options.officer}.pointer.json`),
+    join29(nest, `${options.officer}.pointer.json`),
     `${JSON.stringify(pointer)}
 `,
     "utf8"
@@ -12406,11 +12410,11 @@ async function requireSubmissionGate(options) {
       continue;
     }
     if (gatekeeper.status === "transport_failure") {
-      const failure2 = Object.assign(new Error(gatekeeper.reason), {
+      const failure = Object.assign(new Error(gatekeeper.reason), {
         name: "GatekeeperTransportFailure",
         ...gatekeeper.submission === void 0 ? {} : { submission: gatekeeper.submission }
       });
-      options.hostActions.failInfrastructure(failure2, options.context, options.toolCallId);
+      options.hostActions.failInfrastructure(failure, options.context, options.toolCallId);
     }
     if (gatekeeper.status === "escalate") {
       return {
@@ -12436,9 +12440,9 @@ var init_submission_gate = __esm({
 
 // src/session-identity.ts
 import { mkdir as mkdir2, readFile as readFile17, rename as rename3, writeFile as writeFile7 } from "node:fs/promises";
-import { dirname as dirname18, join as join29 } from "node:path";
+import { dirname as dirname18, join as join30 } from "node:path";
 function createSessionIdentityAuthority(authority, sessionBindingFile) {
-  const bindingPath = (principal) => join29(authority.decode(principal).sessionDirectory, sessionBindingFile);
+  const bindingPath = (principal) => join30(authority.decode(principal).sessionDirectory, sessionBindingFile);
   return {
     resolveSessionFile(principal) {
       return authority.decode(principal).sessionFile;
@@ -12516,7 +12520,7 @@ import {
   statSync as statSync3
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname19, join as join30 } from "node:path";
+import { dirname as dirname19, join as join31 } from "node:path";
 function declareHostSessionFailure(error) {
   const message = error instanceof Error ? error.stack || error.message : String(error);
   process.stderr.write(`[host-session] Dossier record failure: ${message}
@@ -12541,7 +12545,7 @@ function findCodexRollout(sessionsDir, sessionId) {
       return;
     }
     for (const entry of entries) {
-      const fullPath = join30(dir, entry.name);
+      const fullPath = join31(dir, entry.name);
       if (entry.isDirectory()) {
         scan(fullPath, depth + 1);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl") && entry.name.includes(sessionId)) {
@@ -12565,25 +12569,25 @@ function sanitizeClaudeCwd(cwd) {
 function resolveNativeSessionPath(options) {
   const home = options.home || homedir();
   if (options.host === "claude") {
-    const configDir = process.env.CLAUDE_CONFIG_DIR || join30(home, ".claude");
+    const configDir = process.env.CLAUDE_CONFIG_DIR || join31(home, ".claude");
     const sanitizedCwd = sanitizeClaudeCwd(options.cwd);
-    return join30(configDir, "projects", sanitizedCwd, `${options.sessionId}.jsonl`);
+    return join31(configDir, "projects", sanitizedCwd, `${options.sessionId}.jsonl`);
   }
   if (options.host === "codex") {
     return findCodexRollout(codexSessionsDirectory(home), options.sessionId);
   }
   if (options.host === "grok-build") {
-    const grokHome = process.env.GROK_HOME || join30(home, ".grok");
-    return join30(grokHome, "sessions", encodeURIComponent(options.cwd), options.sessionId);
+    const grokHome = process.env.GROK_HOME || join31(home, ".grok");
+    return join31(grokHome, "sessions", encodeURIComponent(options.cwd), options.sessionId);
   }
   return void 0;
 }
 function codexSessionsDirectory(home) {
-  return join30(process.env.CODEX_HOME || join30(home || homedir(), ".codex"), "sessions");
+  return join31(process.env.CODEX_HOME || join31(home || homedir(), ".codex"), "sessions");
 }
 function recordRunStart(runDirectory) {
   try {
-    appendFileSync2(join30(runDirectory, ".run-starts"), "\n");
+    appendFileSync2(join31(runDirectory, ".run-starts"), "\n");
   } catch (error) {
     declareHostSessionFailure(error);
   }
@@ -12607,12 +12611,12 @@ function resolveHostDossierLandingPath(options) {
     } catch {
     }
   }
-  const startsPath = join30(dirname19(options.sessionDirectory), ".run-starts");
+  const startsPath = join31(dirname19(options.sessionDirectory), ".run-starts");
   let starts = 0;
   if (existsSync9(startsPath)) starts = readFileSync3(startsPath, "utf8").length;
   const ordinal = Math.max(maxOrdinal + 1, starts, options.continuation.kind === "resume" ? 2 : 1);
   const baseName = `${options.host}-${sanitizedModel}-${ordinal}`;
-  const landingPath = options.host === "grok-build" ? join30(options.sessionDirectory, baseName) : join30(options.sessionDirectory, `${baseName}.jsonl`);
+  const landingPath = options.host === "grok-build" ? join31(options.sessionDirectory, baseName) : join31(options.sessionDirectory, `${baseName}.jsonl`);
   return { landingPath, ordinal, sanitizedModel };
 }
 function recordNativeSessionPointer(options) {
@@ -12645,18 +12649,18 @@ function copyFileCloneOrFallback(src, dest) {
   copyFileSync(src, dest);
 }
 function copyGrokDossier(srcDir, destDir) {
-  const chatHistorySrc = join30(srcDir, "chat_history.jsonl");
+  const chatHistorySrc = join31(srcDir, "chat_history.jsonl");
   if (!existsSync9(chatHistorySrc)) {
     throw new Error(`Grok native chat_history.jsonl missing at ${chatHistorySrc}`);
   }
   mkdirSync3(destDir, { recursive: true });
-  const chatHistoryDest = join30(destDir, "chat_history.jsonl");
+  const chatHistoryDest = join31(destDir, "chat_history.jsonl");
   copyFileCloneOrFallback(chatHistorySrc, chatHistoryDest);
-  const usageSrc = join30(srcDir, "usage.json");
+  const usageSrc = join31(srcDir, "usage.json");
   if (!existsSync9(usageSrc)) {
     throw new Error(`Grok native usage.json missing at ${usageSrc}`);
   }
-  copyFileCloneOrFallback(usageSrc, join30(destDir, "usage.json"));
+  copyFileCloneOrFallback(usageSrc, join31(destDir, "usage.json"));
 }
 function copyAndRecordHostDossier(options) {
   if (options.host === "pi" || options.host === "hermes") {
@@ -12731,7 +12735,7 @@ function copyAndRecordHostDossier(options) {
     }
     try {
       mkdirSync3(options.sessionDirectory, { recursive: true });
-      closeSync(openSync(join30(options.sessionDirectory, `${options.host}-${sanitizedModel}-${ordinal}.failed`), "a"));
+      closeSync(openSync(join31(options.sessionDirectory, `${options.host}-${sanitizedModel}-${ordinal}.failed`), "a"));
     } catch {
     }
     sitianReportSafe({
@@ -12765,7 +12769,7 @@ var init_host_session_record = __esm({
 import { constants as fsConstants2 } from "node:fs";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { lstat as lstat4, mkdir as mkdir3, open } from "node:fs/promises";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 async function persistReturnedRunState(admitted, options) {
   if (options?.lawful === true) {
     await markRunTerminal(admitted.runDirectory);
@@ -12834,7 +12838,7 @@ function jsonSafeReplacer() {
   };
 }
 async function writeHardenedArtifactFile(artifactsDir, namePrefix, payload) {
-  const filePath = join31(artifactsDir, `${namePrefix}-${randomUUID6()}.json`);
+  const filePath = join32(artifactsDir, `${namePrefix}-${randomUUID6()}.json`);
   const body = `${JSON.stringify(payload, jsonSafeReplacer(), 2)}
 `;
   const noFollowFlag = typeof fsConstants2.O_NOFOLLOW === "number" ? fsConstants2.O_NOFOLLOW : 0;
@@ -13089,7 +13093,7 @@ var init_auto_resume = __esm({
 // src/public-cli/post-admission.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { writeFile as writeFile8 } from "node:fs/promises";
-import { isAbsolute as isAbsolute7, join as join32, resolve as resolve13 } from "node:path";
+import { isAbsolute as isAbsolute7, join as join33, resolve as resolve13 } from "node:path";
 function describeCaughtError(error) {
   if (error instanceof Error) {
     const code = error.code;
@@ -13185,7 +13189,7 @@ async function recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic,
     try {
       const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
       await writeFile8(
-        join32(artifactsDir, `post-admission-diagnostic-${randomUUID7()}.json`),
+        join33(artifactsDir, `post-admission-diagnostic-${randomUUID7()}.json`),
         `${JSON.stringify({ version: 1, ...payload }, null, 2)}
 `,
         { encoding: "utf8", flag: "wx" }
@@ -13214,7 +13218,7 @@ async function presentControlledFailure2(admitted, failureInput, adapters, autho
   const knownFailure = failureInput.knownFailure ?? resumeObservation.observationReadFailure;
   const session = !hasThrown && !failureInput.timedOut && knownFailure === void 0 && failureInput.knownCause === void 0 && admitted.principal !== void 0 ? await inspectJudgeSession(authority.decode(admitted.principal).sessionFile) : void 0;
   const fromKnownFailure = explicitInternalKnownFailureClassificationInput(knownFailure);
-  const failure2 = classifyPostAdmissionFailure({
+  const failure = classifyPostAdmissionFailure({
     timedOut: failureInput.timedOut,
     code: failureInput.code,
     stderr: failureInput.stderr,
@@ -13233,7 +13237,7 @@ async function presentControlledFailure2(admitted, failureInput, adapters, autho
   let publishedErrorPath;
   let terminal;
   try {
-    const settled = await settleFailureTerminalResult(admitted, failure2, authority, {
+    const settled = await settleFailureTerminalResult(admitted, failure, authority, {
       ...resumable ? { resume: { command: renderResumeCommand(admitted.runId) } } : {},
       ...failureInput.invocationScopeId === void 0 || failureInput.invocationScopeId.length === 0 ? {} : { invocationScopeId: failureInput.invocationScopeId },
       onErrorPublished: (path) => {
@@ -13326,7 +13330,7 @@ async function dispatchPostAdmissionTurn(input) {
         const rows = await readRecordedSubmissionRows(
           admitted.projectRoot,
           admitted.runId,
-          { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join32(admitted.runDirectory, "session", "session.jsonl") }
+          { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join33(admitted.runDirectory, "session", "session.jsonl") }
         );
         let ticketNumber;
         for (const row of rows) {
@@ -13453,7 +13457,7 @@ async function dispatchPostAdmissionTurn(input) {
     let stderrLogWriteFailure;
     try {
       await writeFile8(
-        join32(admitted.runDirectory, "stderr.log"),
+        join33(admitted.runDirectory, "stderr.log"),
         result.stderr,
         "utf8"
       );
@@ -13732,7 +13736,7 @@ async function dispatchAfterWriterLease(input) {
 }
 function isAlreadyFrozenSummonsAttachment(runDirectory, attachmentPath) {
   const absolute = isAbsolute7(attachmentPath) ? attachmentPath : resolve13(attachmentPath);
-  return pathContainedIn(join32(runDirectory, "attachments"), absolute);
+  return pathContainedIn(join33(runDirectory, "attachments"), absolute);
 }
 async function prepareSummonsResumeMaterials(runDirectory, summons) {
   if (summons === void 0) return void 0;
@@ -13914,10 +13918,10 @@ async function runPostAdmissionSeatResume(input) {
     await presentResumeFailurePointer(
       input.io,
       error,
-      (failure2) => writeResumeDiagnosticFile(
+      (failure) => writeResumeDiagnosticFile(
         loaded.admitted.runDirectory,
         loaded.admitted.runId,
-        failure2,
+        failure,
         loaded.admitted.role
       )
     );
@@ -13940,7 +13944,7 @@ async function pointExistingRunFailure(home, runId, authority, io, thrown) {
     await presentResumeFailurePointer(
       io,
       thrown,
-      (failure2) => writeResumeDiagnosticFile(runDirectory, runId, failure2)
+      (failure) => writeResumeDiagnosticFile(runDirectory, runId, failure)
     );
     return true;
   }
@@ -13948,7 +13952,7 @@ async function pointExistingRunFailure(home, runId, authority, io, thrown) {
   await presentResumeFailurePointer(
     io,
     thrown,
-    (failure2) => writeResumeDiagnosticFile(runDirectory, runId, failure2, record4.role)
+    (failure) => writeResumeDiagnosticFile(runDirectory, runId, failure, record4.role)
   );
   return true;
 }
@@ -13964,14 +13968,14 @@ function showResumeErrorPointer(io, exitCode, terminal) {
   if (publishedError !== void 0) writeResumeFailurePointer(io, publishedError);
 }
 async function presentResumeFailurePointer(io, thrown, publish) {
-  const failure2 = classifyPostAdmissionFailure({
+  const failure = classifyPostAdmissionFailure({
     timedOut: false,
     code: null,
     stderr: "",
     thrown
   });
   try {
-    writeResumeFailurePointer(io, await publish(failure2));
+    writeResumeFailurePointer(io, await publish(failure));
   } catch (publishError) {
     const cause = {
       publishError: formatErrorCauseDetail(publishError)
@@ -13985,18 +13989,18 @@ async function presentResumeFailurePointer(io, thrown, publish) {
     }, io);
   }
 }
-async function writeResumeDiagnosticFile(runDirectory, runId, failure2, role) {
+async function writeResumeDiagnosticFile(runDirectory, runId, failure, role) {
   const dir = await ensureRealArtifactsDirectory(runDirectory);
-  const path = join32(dir, `resume-diagnostic-${randomUUID7()}.json`);
+  const path = join33(dir, `resume-diagnostic-${randomUUID7()}.json`);
   await writeFile8(
     path,
     `${JSON.stringify({
       runId,
       ...role === void 0 ? {} : { role },
-      diagnostic: failure2.diagnostic,
-      ...failure2.cause === void 0 ? {} : { cause: failure2.cause },
-      ...failure2.identity === void 0 ? {} : { identity: failure2.identity },
-      ...failure2.details === void 0 ? {} : { details: failure2.details }
+      diagnostic: failure.diagnostic,
+      ...failure.cause === void 0 ? {} : { cause: failure.cause },
+      ...failure.identity === void 0 ? {} : { identity: failure.identity },
+      ...failure.details === void 0 ? {} : { details: failure.details }
     }, null, 2)}
 `,
     { encoding: "utf8", flag: "wx" }
@@ -14156,16 +14160,16 @@ var init_seat_ticket_binding = __esm({
 // src/public-cli/machine-method-skills.ts
 import { accessSync, constants as constants2, statSync as statSync4 } from "node:fs";
 import { lstat as lstat5, mkdir as mkdir4, symlink } from "node:fs/promises";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function skillRoot(home) {
-  return join33(home, ".agents/skills");
+  return join34(home, ".agents/skills");
 }
 function installedMethodSkillPath(home, name) {
   return installedSkillPath(skillRoot(home), name);
 }
 function installedSkillPath(root, name) {
-  const path = join33(root, name, "SKILL.md");
+  const path = join34(root, name, "SKILL.md");
   try {
     if (!statSync4(path).isFile()) return void 0;
     accessSync(path, constants2.R_OK);
@@ -14178,9 +14182,9 @@ function installedSkillPath(root, name) {
 }
 function linkedSkillRoot(home, host) {
   if (host === "claude" || host === "claude-code") {
-    return join33(process.env.CLAUDE_CONFIG_DIR?.trim() || join33(home, ".claude"), "skills");
+    return join34(process.env.CLAUDE_CONFIG_DIR?.trim() || join34(home, ".claude"), "skills");
   }
-  if (host === "hermes") return join33(home, ".hermes/skills");
+  if (host === "hermes") return join34(home, ".hermes/skills");
   return void 0;
 }
 async function occupied(path) {
@@ -14237,7 +14241,7 @@ async function runMachineSkillSetup(home, stdout) {
   const missingBySource = /* @__PURE__ */ new Map();
   let unsourced = false;
   for (const name of packagedMethodSkillNames()) {
-    const path = join33(canonical, name);
+    const path = join34(canonical, name);
     if (await occupied(path)) {
       warnOccupied(path, stdout);
       continue;
@@ -14259,17 +14263,17 @@ async function runMachineSkillSetup(home, stdout) {
   if (unsourced) return 1;
   for (const host of ["claude-code", "hermes"]) {
     const root = linkedSkillRoot(home, host);
-    const binaryFromHome = host === "claude-code" ? HEADLESS_HOST_DESCRIPTIONS.claude.binaryFromHome : HOST_DESCRIPTIONS.hermes.binaryFromHome;
+    const description = host === "claude-code" ? HEADLESS_HOST_DESCRIPTIONS.claude : HOST_DESCRIPTIONS.hermes;
     try {
-      accessSync(join33(home, ...binaryFromHome), constants2.X_OK);
+      accessSync(resolveHostBinary(description, home), constants2.X_OK);
     } catch (error) {
       if (["ENOENT", "ENOTDIR", "EACCES"].includes(error.code ?? "")) continue;
       throw error;
     }
     for (const name of packagedMethodSkillNames()) {
-      const target = join33(canonical, name);
+      const target = join34(canonical, name);
       if (installedMethodSkillPath(home, name) === void 0) continue;
-      const link = join33(root, name);
+      const link = join34(root, name);
       if (await occupied(link)) {
         warnOccupied(link, stdout);
         continue;
@@ -15477,7 +15481,7 @@ var init_analyst_book_key = __esm({
 
 // src/analyst-index.ts
 import { open as open2, readFile as readFile18, unlink as unlink4 } from "node:fs/promises";
-import { dirname as dirname21, join as join34 } from "node:path";
+import { dirname as dirname21, join as join35 } from "node:path";
 function sleep(ms) {
   return new Promise((resolve22) => {
     setTimeout(resolve22, ms);
@@ -15486,7 +15490,7 @@ function sleep(ms) {
 async function withAnalystLibraryIndexLock(ledgerHome, fn) {
   const indexPath = analystLibraryIndexPath(ledgerHome);
   ensureRealDirectoryTree(ledgerHome, dirname21(indexPath));
-  const lockPath = join34(dirname21(indexPath), LIBRARY_INDEX_LOCK_NAME);
+  const lockPath = join35(dirname21(indexPath), LIBRARY_INDEX_LOCK_NAME);
   assertLedgerFileInsideHome(lockPath, ledgerHome);
   const startedAt = Date.now();
   while (true) {
@@ -15513,7 +15517,7 @@ async function withAnalystLibraryIndexLock(ledgerHome, fn) {
   }
 }
 function analystLibraryIndexPath(ledgerHome) {
-  return join34(ledgerHome, "analyst", "library-index.json");
+  return join35(ledgerHome, "analyst", "library-index.json");
 }
 function rowFromIssueMetricsPage(page) {
   return {
@@ -15809,7 +15813,7 @@ var init_analyst_cohort = __esm({
 
 // src/analyst-ledger.ts
 import { readdir as readdir6, readFile as readFile19 } from "node:fs/promises";
-import { basename as basename9, join as join35 } from "node:path";
+import { basename as basename9, join as join36 } from "node:path";
 function isMissingPathError6(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
@@ -15838,7 +15842,7 @@ function ghostLeaseCheckFromAutopsy(autopsy) {
   }
 }
 async function classifyGhostCandidate(input) {
-  const autopsy = await autopsyWriterLock(join35(input.runDirectory, "writer.lock"));
+  const autopsy = await autopsyWriterLock(join36(input.runDirectory, "writer.lock"));
   const leaseCheck = ghostLeaseCheckFromAutopsy(autopsy);
   if (leaseCheck === void 0) return { kind: "live" };
   return {
@@ -15867,7 +15871,7 @@ async function listLedgerBookNames(booksRoot) {
 async function readInvocationScopeFields(runDirectory) {
   let raw;
   try {
-    raw = await readFile19(join35(runDirectory, "invocation.json"), "utf8");
+    raw = await readFile19(join36(runDirectory, "invocation.json"), "utf8");
   } catch (error) {
     if (isMissingPathError6(error)) return void 0;
     throw error;
@@ -15900,7 +15904,7 @@ function decideIssueScope(input) {
 }
 async function resolveSessionFile(runDirectory) {
   try {
-    const raw = await readFile19(join35(runDirectory, "invocation.json"), "utf8");
+    const raw = await readFile19(join36(runDirectory, "invocation.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (isRecord12(parsed) && typeof parsed.sessionFile === "string" && parsed.sessionFile.trim() !== "") {
       return parsed.sessionFile;
@@ -15908,7 +15912,7 @@ async function resolveSessionFile(runDirectory) {
   } catch (error) {
     if (!isMissingPathError6(error)) throw error;
   }
-  return join35(runDirectory, "session", "session.jsonl");
+  return join36(runDirectory, "session", "session.jsonl");
 }
 function attributeSessionRowsForRun(input) {
   if (pathContainedIn(input.runDirectory, input.sessionFile)) {
@@ -16110,9 +16114,9 @@ async function classifyScopedRun(input) {
   }
   let gateCycles;
   try {
-    const parentSessionFile = join35(input.runDirectory, "session", "session.jsonl");
+    const parentSessionFile = join36(input.runDirectory, "session", "session.jsonl");
     gateCycles = await readAnalystGateCyclesFromAuditorRoles(
-      join35(input.runDirectory, "session", "auditor-roles"),
+      join36(input.runDirectory, "session", "auditor-roles"),
       { parentSessionFile }
     );
   } catch (error) {
@@ -16147,7 +16151,7 @@ async function classifyScopedRun(input) {
 async function scanAnalystIssueRuns(input) {
   const ledgerHome = resolveActivationLedgerHome(input.home);
   const scopeTicketNumber = input.ticketNumber;
-  const booksRoot = join35(ledgerHome, "books");
+  const booksRoot = join36(ledgerHome, "books");
   let wholeBook = false;
   let scopeRootIdentity;
   let bookNames;
@@ -16180,7 +16184,7 @@ async function scanAnalystIssueRuns(input) {
   const ghostLegs = [];
   const scopeConflicts = [];
   for (const book of bookNames) {
-    const bookDir = join35(booksRoot, book);
+    const bookDir = join36(booksRoot, book);
     let runDirectories;
     try {
       runDirectories = await listBookRunDirectories(bookDir);
@@ -16917,7 +16921,7 @@ var init_analyst_metric_family = __esm({
 
 // src/analyst-page.ts
 import { createHash as createHash3 } from "node:crypto";
-import { dirname as dirname22, join as join36 } from "node:path";
+import { dirname as dirname22, join as join37 } from "node:path";
 function analystIssuePageKey(address) {
   const parts = ["book", address.bookKey];
   if (address.issueNumber !== void 0) {
@@ -16928,7 +16932,7 @@ function analystIssuePageKey(address) {
   return createHash3("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
 }
 function analystIssuePagePath(ledgerHome, address) {
-  return join36(ledgerHome, "analyst", "issues", `${analystIssuePageKey(address)}.json`);
+  return join37(ledgerHome, "analyst", "issues", `${analystIssuePageKey(address)}.json`);
 }
 function analystIssuePageAddressFromPage(page) {
   return {
@@ -17567,7 +17571,7 @@ __export(cli_exports, {
   runAkRole: () => runAkRole
 });
 import { realpath as realpath5 } from "node:fs/promises";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 function publicSeatArgv(owner) {
   return {
     parse: (args) => parsePublicSeatArgv(owner, args),
@@ -17706,7 +17710,7 @@ function resolveHome(env) {
   return env.home ?? packageMachineHome();
 }
 function resolveAgentDir(env, home) {
-  return env.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join37(home, ".pi", "agent");
+  return env.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join38(home, ".pi", "agent");
 }
 function parseThinking(value) {
   return value;
@@ -18478,7 +18482,7 @@ __export(public_role_summons_exports, {
 import { execFile as execFile3 } from "node:child_process";
 import { existsSync as existsSync10 } from "node:fs";
 import { realpath as realpath6 } from "node:fs/promises";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 function createCapturingIo() {
   const chunks = [];
@@ -18502,7 +18506,7 @@ function parentDir(path) {
 function walkPackageRoot(start) {
   let dir = start;
   for (let i = 0; i < 12; i += 1) {
-    if (existsSync10(join38(dir, "package.json")) && existsSync10(join38(dir, "souls"))) {
+    if (existsSync10(join39(dir, "package.json")) && existsSync10(join39(dir, "souls"))) {
       return dir;
     }
     const parent = parentDir(dir);
@@ -18552,8 +18556,8 @@ function projectSeatHost2(seat) {
 function hostSelectionFailureFromUnknown(error) {
   if (typeof error !== "object" || error === null) return void 0;
   if (error.name !== "HostSelectionError") return void 0;
-  const failure2 = error.failure;
-  return failure2;
+  const failure = error.failure;
+  return failure;
 }
 async function createSummonEnv(options, afterHost) {
   const [
@@ -18618,7 +18622,7 @@ async function createSummonEnv(options, afterHost) {
 async function summonPublicRole(options) {
   const packageRoot = resolveSummonsPackageRoot(options.packageRoot);
   const home = await resolveSummonHome(options);
-  const agentDir = options.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join38(home, ".pi", "agent");
+  const agentDir = options.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? join39(home, ".pi", "agent");
   const {
     loadCredentialProviders: loadCredentialProviders2,
     loadPublicCliConfig: loadPublicCliConfig2,
@@ -18686,10 +18690,10 @@ async function summonPublicRole(options) {
         }
       };
     } catch (error) {
-      const failure2 = hostSelectionFailureFromUnknown(error);
-      if (failure2 !== void 0) {
+      const failure = hostSelectionFailureFromUnknown(error);
+      if (failure !== void 0) {
         const { formatHostSelectionFailure: formatHostSelectionFailure2 } = await Promise.resolve().then(() => (init_role_turn_host_resolution(), role_turn_host_resolution_exports));
-        return { ok: false, exitCode: 1, stderr: formatHostSelectionFailure2(failure2) };
+        return { ok: false, exitCode: 1, stderr: formatHostSelectionFailure2(failure) };
       }
       const { CliUsageError: CliUsageError2 } = await Promise.resolve().then(() => (init_cli_errors(), cli_errors_exports));
       if (error instanceof CliUsageError2) {
@@ -18785,8 +18789,8 @@ async function summonParallelReviewerLenses(options) {
     stderr: describeFailure(error)
   });
   const dualFailure = (error) => {
-    const failure2 = failedResult(error);
-    return { completeness: failure2, correctness: failure2 };
+    const failure = failedResult(error);
+    return { completeness: failure, correctness: failure };
   };
   let sourceProjectRoot;
   let targetCommit;
@@ -19126,7 +19130,7 @@ var init_compliance_transport = __esm({
 });
 
 // src/role-run-relocation.ts
-import { join as join39, sep as sep5 } from "node:path";
+import { join as join40, sep as sep5 } from "node:path";
 function rewriteRunDirectoryPathValue(value, oldRunDirectory, newRunDirectory) {
   if (typeof value !== "string") return value;
   if (value === oldRunDirectory) return newRunDirectory;
@@ -19254,7 +19258,7 @@ __export(run_lifecycle_exports, {
   writeRoleRunState: () => writeRoleRunState
 });
 import { chmod, lstat as lstat6, open as open3, readdir as readdir7, readFile as readFile22, unlink as unlink5, writeFile as writeFile9 } from "node:fs/promises";
-import { basename as basename10, join as join40 } from "node:path";
+import { basename as basename10, join as join41 } from "node:path";
 function buildAutoResumeContinuationPrompt(options) {
   return appendEngineSessionMaterial(
     [RESUME_TRANSPORT_ENVELOPE],
@@ -19280,7 +19284,7 @@ function renderResumeCommand(runId) {
 async function writeRoleRunState(runDirectory, record4) {
   const payload = { ...record4, runDirectory };
   await writeFile9(
-    join40(runDirectory, RUN_STATE_FILE),
+    join41(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -19330,7 +19334,7 @@ function parseCurrentCourtState(raw) {
 async function readRoleRunStateRaw(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile22(join40(runDirectory, RUN_STATE_FILE), "utf8"));
+    raw = JSON.parse(await readFile22(join41(runDirectory, RUN_STATE_FILE), "utf8"));
   } catch (error) {
     if (errorCodeOf(error) === "ENOENT") return void 0;
     throw error;
@@ -19424,7 +19428,7 @@ async function writeRoleRunStateDisk(runDirectory, disk) {
     ...disk.currentCourt === void 0 ? {} : { currentCourt: disk.currentCourt }
   };
   await writeFile9(
-    join40(runDirectory, RUN_STATE_FILE),
+    join41(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -19647,7 +19651,7 @@ async function createWriterLease(lockPath, runDirectory, reportCleanupFailure) {
     },
     relocate(nextRunDirectory) {
       currentRunDirectory = nextRunDirectory;
-      currentLockPath = join40(nextRunDirectory, WRITER_LOCK_FILE);
+      currentLockPath = join41(nextRunDirectory, WRITER_LOCK_FILE);
     },
     async release() {
       if (released) return;
@@ -19686,10 +19690,10 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
   };
   const reportReadFailure = (error) => {
     reportDiagnostic(
-      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join40(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
+      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join41(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
     );
   };
-  const lockPath = join40(runDirectory, WRITER_LOCK_FILE);
+  const lockPath = join41(runDirectory, WRITER_LOCK_FILE);
   let lastAutopsy = { verdict: "absent" };
   let lastReclaimFailure;
   for (let reclaimsLeft = WRITER_LEASE_RECLAIM_ROUNDS; ; reclaimsLeft -= 1) {
@@ -19744,7 +19748,7 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
 async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
   if (runId.trim() === "") return void 0;
   const ledgerHome = resolveActivationLedgerHome(home);
-  const booksRoot = join40(ledgerHome, "books");
+  const booksRoot = join41(ledgerHome, "books");
   let bookKeys;
   try {
     bookKeys = await readdir7(booksRoot);
@@ -19785,7 +19789,7 @@ async function readRunParentPath(runDirectory) {
   let raw;
   try {
     raw = JSON.parse(
-      await readFile22(join40(runDirectory, "admitted-request.json"), "utf8")
+      await readFile22(join41(runDirectory, "admitted-request.json"), "utf8")
     );
   } catch (error) {
     if (errorCodeOf(error) === "ENOENT") return void 0;
@@ -19806,7 +19810,7 @@ async function readRunParentPath(runDirectory) {
 async function runHasFormedSessionPrincipal(runDirectory) {
   const disk = await readRoleRunStateDisk(runDirectory);
   if (disk === void 0) return false;
-  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join40(disk.principalWire.sessionDirectory, "session.jsonl");
+  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join41(disk.principalWire.sessionDirectory, "session.jsonl");
   try {
     const stat2 = await lstat6(sessionFile);
     return stat2.isFile() && !stat2.isSymbolicLink();
@@ -19824,7 +19828,7 @@ async function findLatestRunIdForSeatTicket(input) {
   let runDirectories;
   try {
     runDirectories = await listBookRunDirectories(
-      input.ticketNumber === void 0 ? bookDir : join40(bookDir, String(input.ticketNumber))
+      input.ticketNumber === void 0 ? bookDir : join41(bookDir, String(input.ticketNumber))
     );
   } catch (error) {
     if (errorCodeOf(error) === "ENOENT") return void 0;
@@ -20022,7 +20026,7 @@ async function loadResumableRunRecord(home, runId, authority) {
   let model;
   try {
     const invocationRaw = JSON.parse(
-      await readFile22(join40(run.runDirectory, "invocation.json"), "utf8")
+      await readFile22(join41(run.runDirectory, "invocation.json"), "utf8")
     );
     if (invocationRaw !== null && typeof invocationRaw === "object" && !Array.isArray(invocationRaw)) {
       const rec = invocationRaw;
@@ -20391,7 +20395,7 @@ var init_run_lifecycle = __esm({
 
 // src/archivist-record-topology.ts
 import { createHash as createHash4 } from "node:crypto";
-import { join as join41 } from "node:path";
+import { join as join42 } from "node:path";
 function resolveNavigatorWorkSubjectPlacement(input) {
   let ledgerHome;
   if (input.parentSessionFile !== void 0 && input.parentSessionFile.length > 0) {
@@ -20404,7 +20408,7 @@ function resolveNavigatorWorkSubjectPlacement(input) {
   const digest = createHash4("sha256").update(input.subject).digest("hex").slice(0, 32);
   return {
     ledgerHome,
-    sessionDir: join41(
+    sessionDir: join42(
       activationBookDirectory(ledgerHome, resolveBookKeyFromGit(input.cwd)),
       NAVIGATOR_RECORD_KIND,
       digest
@@ -20476,10 +20480,10 @@ import {
   statSync as statSync6,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname as dirname23, resolve as resolve16, join as join42 } from "node:path";
+import { dirname as dirname23, resolve as resolve16, join as join43 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function readCurrentSession(sessionDir) {
-  const ledger = join42(sessionDir, CURRENT_SESSION_LEDGER);
+  const ledger = join43(sessionDir, CURRENT_SESSION_LEDGER);
   try {
     const value = JSON.parse(readFileSync4(ledger, "utf8"));
     if (typeof value !== "object" || value === null || typeof value.sessionFile !== "string" || value.sessionFile.length === 0) {
@@ -20494,7 +20498,7 @@ function readCurrentSession(sessionDir) {
   }
 }
 function writeCurrentSession(sessionDir, sessionFile) {
-  const ledger = join42(sessionDir, CURRENT_SESSION_LEDGER);
+  const ledger = join43(sessionDir, CURRENT_SESSION_LEDGER);
   try {
     writeFileSync2(ledger, `${JSON.stringify({ sessionFile })}
 `, { flag: "wx" });
@@ -20510,7 +20514,7 @@ function isCurrentSessionClaimRace(error) {
   return errnoCode(error.cause) === "EEXIST";
 }
 function currentSessionLedgerPath(sessionDir) {
-  return join42(sessionDir, CURRENT_SESSION_LEDGER);
+  return join43(sessionDir, CURRENT_SESSION_LEDGER);
 }
 function readBoundedSessionHeader(filePath) {
   const fd = openSync2(filePath, "r");
@@ -20597,7 +20601,7 @@ function mostRecentNavigatorSessionFile(sessionDir, cwd) {
   const matched = [];
   for (const name of names) {
     if (!name.endsWith(".jsonl")) continue;
-    const filePath = join42(absoluteSessionDir, name);
+    const filePath = join43(absoluteSessionDir, name);
     let st;
     try {
       st = statSync6(filePath);
@@ -20709,7 +20713,7 @@ function createRecordSessionOpen(options, host = piRecordSessionHost) {
     if (!physicallyContainedIn(ledgerHome, parentResolved)) {
       throw new Error("Durable record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = join42(dirname23(parentResolved), options.kind);
+    sessionDir = join43(dirname23(parentResolved), options.kind);
     parentSession = parentFile;
     mayResumeSameNest = options.kind === WORKER_SUBMISSION_GATE_KIND;
   }
@@ -20772,6 +20776,7 @@ var init_archivist_record_entry = __esm({
 });
 
 // src/headless-host/production-host.ts
+init_host_descriptions();
 import { randomUUID as randomUUID11 } from "node:crypto";
 
 // src/role-runtime-dependencies.ts
@@ -20985,10 +20990,10 @@ init_packaged_role_registry();
 init_atomic_write();
 import { existsSync as existsSync3, realpathSync as realpathSync2 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname7, join as join7, resolve as resolve5 } from "node:path";
+import { basename as basename3, dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
 var NAVIGATOR_WORK_CONTEXT_BASENAME = "work-context.json";
 function navigatorWorkContextFile(sessionDir) {
-  return join7(sessionDir, NAVIGATOR_WORK_CONTEXT_BASENAME);
+  return join8(sessionDir, NAVIGATOR_WORK_CONTEXT_BASENAME);
 }
 function isNavigatorWorkContextFile(path) {
   const resolved = resolve5(path);
@@ -21405,12 +21410,12 @@ function createNavigatorAttendance(options) {
     return { ...options.context, signal };
   };
   const unavailable = (invocationId, reason) => {
-    const failure2 = reason instanceof NavigatorUnavailableError ? reason : navigatorUnavailableError("unknown", reason);
+    const failure = reason instanceof NavigatorUnavailableError ? reason : navigatorUnavailableError("unknown", reason);
     return {
       disposition: "unavailable",
-      unavailableReason: failure2.message,
-      unavailableSource: failure2.unavailableSource,
-      unavailableCause: failure2.unavailableCause
+      unavailableReason: failure.message,
+      unavailableSource: failure.unavailableSource,
+      unavailableCause: failure.unavailableCause
     };
   };
   let prepareBoundSettlement;
@@ -21847,7 +21852,7 @@ init_sitian_facade();
 init_submission_ledger();
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { readFileSync as readFileSync6, writeSync as writeSync2 } from "node:fs";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 import { Value as Value4 } from "typebox/value";
 
 // src/activation-trace.ts
@@ -23803,7 +23808,7 @@ function readDiaristTicketAssertion(submitted) {
 function readRoleRunCoordinates(ctx, label) {
   const runDirectory = runDirectoryFromHostContext(ctx);
   if (runDirectory === void 0) throw new Error(`${label} requires AK_ROLE_RUN_DIR`);
-  const admittedPath = join44(runDirectory, "admitted-request.json");
+  const admittedPath = join45(runDirectory, "admitted-request.json");
   const admitted = JSON.parse(readFileSync6(admittedPath, "utf8"));
   if (typeof admitted.projectRoot !== "string" || admitted.projectRoot.trim() === "") {
     throw new Error(`${label} admitted-request missing projectRoot (${admittedPath})`);
@@ -24732,7 +24737,7 @@ init_packaged_role_registry();
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { appendFile as appendFile3, mkdir as mkdir5, writeFile as writeFile10 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname25, join as join45 } from "node:path";
+import { dirname as dirname25, join as join46 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 init_role_activation_flags();
 init_submission_correctable_error();
@@ -24778,7 +24783,7 @@ async function prepareRoleEnvelope(options) {
   const hostAbort = new AbortController();
   const runId = request.runDirectory.split("/").filter(Boolean).at(-1) ?? randomUUID9();
   await mkdir5(request.runDirectory, { recursive: true });
-  let sessionFile = options.sessionFile ?? join45(request.runDirectory, "session", "session.jsonl");
+  let sessionFile = options.sessionFile ?? join46(request.runDirectory, "session", "session.jsonl");
   await mkdir5(dirname25(sessionFile), { recursive: true });
   if (request.continuation.kind !== "resume") {
     try {
@@ -25297,17 +25302,129 @@ async function prepareRoleEnvelope(options) {
 // src/headless-host/production-host.ts
 init_session_identity();
 
+// src/headless-host/role-turn-host.ts
+import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
+import { randomUUID as randomUUID10 } from "node:crypto";
+import { existsSync as existsSync15 } from "node:fs";
+import { writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname26, isAbsolute as isAbsolute12, join as join47, resolve as resolve21 } from "node:path";
+
+// src/external-host-turn-loop.ts
+var EXTERNAL_ROLE_TURN_ROUND_LIMIT = 8;
+function mergeRoleTurnAbortSignals(prepared, request) {
+  if (request === void 0) return prepared;
+  if (prepared === void 0) return request;
+  return AbortSignal.any([prepared, request]);
+}
+function isHostAbortedError(error) {
+  return typeof error === "object" && error !== null && error.code === "host-aborted";
+}
+function hostAbortedError(message = "host aborted") {
+  return Object.assign(new Error(message), { code: "host-aborted" });
+}
+function externalHostFailure(cause, name, code, details, diagnostic) {
+  return asFailure({
+    cause,
+    identity: { name, code },
+    ...diagnostic === void 0 ? {} : { diagnostic },
+    ...details === void 0 ? {} : { details }
+  });
+}
+function withExternalHostCleanupFailure(outcome, cleanupError, name) {
+  const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+  if (outcome.knownFailure === void 0) {
+    return externalHostFailure("session", name, "dispose-failed", { cleanupError: message }, message);
+  }
+  return {
+    ...outcome,
+    knownFailure: {
+      ...outcome.knownFailure,
+      details: { ...outcome.knownFailure.details ?? {}, cleanupError: message }
+    }
+  };
+}
+function asFailure(knownFailure, stderr = "") {
+  return { code: null, stderr, timedOut: false, knownFailure };
+}
+async function settleHostAborted(prepared, sessionId) {
+  const closure = await prepared.closeRound();
+  if ("failure" in closure) return asFailure(closure.failure);
+  return asFailure({
+    cause: "session",
+    identity: { name: "HostAborted", code: "host-aborted" },
+    ...sessionId === void 0 ? {} : { details: { sessionId } }
+  });
+}
+async function driveExternalRoleTurnRounds(prepared, request, driver) {
+  let prompt = prepared.prompt;
+  const abortSignal = mergeRoleTurnAbortSignals(prepared.abortSignal, request.signal);
+  let stderr = "";
+  for (let attempt = 0; attempt < EXTERNAL_ROLE_TURN_ROUND_LIMIT; attempt += 1) {
+    if (abortSignal?.aborted) return settleHostAborted(prepared, driver.currentSessionId());
+    let round;
+    try {
+      round = await driver.runRound({ prompt, abortSignal, attempt });
+    } catch (error) {
+      if (isHostAbortedError(error)) return settleHostAborted(prepared, driver.currentSessionId());
+      throw error;
+    }
+    if (round.status === "terminal") {
+      const result = round.result;
+      const combined = `${stderr}${result.stderr}`;
+      return combined === result.stderr ? result : { ...result, stderr: combined };
+    }
+    if (round.stderr !== void 0 && round.stderr.length > 0) stderr += round.stderr;
+    const closure = await prepared.closeRound();
+    if (closure.accepted) {
+      await driver.afterAccepted?.();
+      return { code: 0, stderr, timedOut: false };
+    }
+    if ("failure" in closure) return asFailure(closure.failure, stderr);
+    prompt = closure.retry.message;
+    driver.afterRetry?.();
+  }
+  return asFailure({
+    cause: "output",
+    identity: { name: driver.roundLimitName, code: "round-retry-limit" },
+    ...driver.currentSessionId() === void 0 ? {} : { details: { sessionId: driver.currentSessionId() } }
+  });
+}
+function createSerializedRoleTurnHost(execute) {
+  let serial = Promise.resolve();
+  return {
+    executeTurn(request) {
+      const execution = serial.then(() => execute(request));
+      serial = execution.then(() => void 0, () => void 0);
+      return execution;
+    }
+  };
+}
+
+// src/agent-start-materials.ts
+function renderAgentStartMaterials(body, materials) {
+  if (materials.length === 0) return body;
+  return [body, ...materials.map((material) => JSON.stringify(material))].join("\n\n");
+}
+
+// src/prepared-role-turn.ts
+function renderSystemPromptOverride(authority) {
+  return renderAgentStartMaterials(authority.body, authority.materials);
+}
+async function resolveBoundHostSessionId(request, identity) {
+  const explicit = request.continuation.kind === "resume" ? request.continuation.hostSessionId : void 0;
+  return explicit !== void 0 && explicit !== "" ? explicit : identity.load(request.principal);
+}
+
+// src/headless-host/role-turn-host.ts
+init_host_session_record();
+
 // src/headless-host/description.ts
-import { join as join46 } from "node:path";
 function isClaudePrintDescription(description) {
   return description.protocol === "claude-print";
 }
 function isCodexExecDescription(description) {
   return description.protocol === "codex-exec";
 }
-function resolveHeadlessBinary(description, operatorHome) {
-  return join46(operatorHome, ...description.binaryFromHome);
-}
 function headlessTurnArgs(options) {
   const { description } = options;
   const args = [
@@ -25566,109 +25683,7 @@ function headlessMcpConfigDocument(mcpServers) {
 }
 
 // src/headless-host/role-turn-host.ts
-import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
-import { randomUUID as randomUUID10 } from "node:crypto";
-import { existsSync as existsSync15 } from "node:fs";
-import { writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname26, isAbsolute as isAbsolute12, join as join47, resolve as resolve21 } from "node:path";
-
-// src/external-host-turn-loop.ts
-var EXTERNAL_ROLE_TURN_ROUND_LIMIT = 8;
-function mergeRoleTurnAbortSignals(prepared, request) {
-  if (request === void 0) return prepared;
-  if (prepared === void 0) return request;
-  return AbortSignal.any([prepared, request]);
-}
-function isHostAbortedError(error) {
-  return typeof error === "object" && error !== null && error.code === "host-aborted";
-}
-function hostAbortedError(message = "host aborted") {
-  return Object.assign(new Error(message), { code: "host-aborted" });
-}
-function asFailure(knownFailure, stderr = "") {
-  return { code: null, stderr, timedOut: false, knownFailure };
-}
-async function settleHostAborted(prepared, sessionId) {
-  const closure = await prepared.closeRound();
-  if ("failure" in closure) return asFailure(closure.failure);
-  return asFailure({
-    cause: "session",
-    identity: { name: "HostAborted", code: "host-aborted" },
-    ...sessionId === void 0 ? {} : { details: { sessionId } }
-  });
-}
-async function driveExternalRoleTurnRounds(prepared, request, driver) {
-  let prompt = prepared.prompt;
-  const abortSignal = mergeRoleTurnAbortSignals(prepared.abortSignal, request.signal);
-  let stderr = "";
-  for (let attempt = 0; attempt < EXTERNAL_ROLE_TURN_ROUND_LIMIT; attempt += 1) {
-    if (abortSignal?.aborted) return settleHostAborted(prepared, driver.currentSessionId());
-    let round;
-    try {
-      round = await driver.runRound({ prompt, abortSignal, attempt });
-    } catch (error) {
-      if (isHostAbortedError(error)) return settleHostAborted(prepared, driver.currentSessionId());
-      throw error;
-    }
-    if (round.status === "terminal") {
-      const result = round.result;
-      const combined = `${stderr}${result.stderr}`;
-      return combined === result.stderr ? result : { ...result, stderr: combined };
-    }
-    if (round.stderr !== void 0 && round.stderr.length > 0) stderr += round.stderr;
-    const closure = await prepared.closeRound();
-    if (closure.accepted) {
-      await driver.afterAccepted?.();
-      return { code: 0, stderr, timedOut: false };
-    }
-    if ("failure" in closure) return asFailure(closure.failure, stderr);
-    prompt = closure.retry.message;
-    driver.afterRetry?.();
-  }
-  return asFailure({
-    cause: "output",
-    identity: { name: driver.roundLimitName, code: "round-retry-limit" },
-    ...driver.currentSessionId() === void 0 ? {} : { details: { sessionId: driver.currentSessionId() } }
-  });
-}
-function createSerializedRoleTurnHost(execute) {
-  let serial = Promise.resolve();
-  return {
-    executeTurn(request) {
-      const execution = serial.then(() => execute(request));
-      serial = execution.then(() => void 0, () => void 0);
-      return execution;
-    }
-  };
-}
-
-// src/agent-start-materials.ts
-function renderAgentStartMaterials(body, materials) {
-  if (materials.length === 0) return body;
-  return [body, ...materials.map((material) => JSON.stringify(material))].join("\n\n");
-}
-
-// src/prepared-role-turn.ts
-function renderSystemPromptOverride(authority) {
-  return renderAgentStartMaterials(authority.body, authority.materials);
-}
-
-// src/headless-host/role-turn-host.ts
-init_host_session_record();
 init_navigator_output();
-function failure(cause, name, code, details, diagnostic) {
-  return {
-    code: null,
-    stderr: "",
-    timedOut: false,
-    knownFailure: {
-      cause,
-      identity: { name, code },
-      ...diagnostic === void 0 ? {} : { diagnostic },
-      ...details === void 0 ? {} : { details }
-    }
-  };
-}
 function isHeadlessResultCandidate(value) {
   if (!isPlainObject2(value)) return false;
   const record4 = value;
@@ -25678,25 +25693,11 @@ function parseHeadlessCliStdout(stdout) {
   const trimmed = stdout.trim();
   if (trimmed === "") return void 0;
   try {
-    const single = JSON.parse(trimmed);
-    if (isHeadlessResultCandidate(single)) return single;
+    const value = JSON.parse(trimmed);
+    return isHeadlessResultCandidate(value) ? value : void 0;
   } catch {
+    return void 0;
   }
-  let last;
-  for (const line2 of trimmed.split("\n")) {
-    const text = line2.trim();
-    if (text === "") continue;
-    try {
-      const value = JSON.parse(text);
-      if (!isPlainObject2(value)) continue;
-      const record4 = value;
-      if (record4.type === "result" || record4.structured_output !== void 0) {
-        last = record4;
-      }
-    } catch {
-    }
-  }
-  return last;
 }
 function resultCandidateText(line2) {
   const text = line2.trim();
@@ -25903,19 +25904,6 @@ function spawnHeadlessTurn(options) {
     }
   });
 }
-function withCleanupFailure(outcome, cleanupError) {
-  const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
-  if (outcome.knownFailure === void 0) {
-    return failure("session", "HeadlessDisposeFailure", "dispose-failed", { cleanupError: message }, message);
-  }
-  return {
-    ...outcome,
-    knownFailure: {
-      ...outcome.knownFailure,
-      details: { ...outcome.knownFailure.details ?? {}, cleanupError: message }
-    }
-  };
-}
 function terminalFromSpawned(spawned, knownFailure) {
   return {
     status: "terminal",
@@ -25962,12 +25950,11 @@ function createHeadlessRoleTurnHost(config) {
     const prepared = await config.prepare(request);
     const systemPrompt = renderSystemPromptOverride(prepared.systemPrompt);
     const codex = isCodexExecDescription(config.description);
-    let outcome = failure("session", "HeadlessNoOutcome", "no-outcome");
+    let outcome = externalHostFailure("session", "HeadlessNoOutcome", "no-outcome");
     try {
-      const explicitHostSessionId = request.continuation.kind === "resume" ? request.continuation.hostSessionId : void 0;
-      let sessionId = explicitHostSessionId !== void 0 && explicitHostSessionId !== "" ? explicitHostSessionId : await config.sessionIdentity.load(request.principal);
+      let sessionId = await resolveBoundHostSessionId(request, config.sessionIdentity);
       if (request.continuation.kind === "resume" && (sessionId === void 0 || sessionId === "")) {
-        outcome = failure(
+        outcome = externalHostFailure(
           "session",
           "HeadlessSessionFailure",
           "session-id-missing",
@@ -26036,7 +26023,7 @@ function createHeadlessRoleTurnHost(config) {
                 const message = error instanceof Error ? error.message : String(error);
                 return {
                   status: "terminal",
-                  result: failure("session", "HeadlessArgvFailure", "argv-failed", { diagnostic: message }, message)
+                  result: externalHostFailure("session", "HeadlessArgvFailure", "argv-failed", { diagnostic: message }, message)
                 };
               }
               const codexObserver = codex ? createCodexExecTurnObserver() : void 0;
@@ -26107,7 +26094,7 @@ function createHeadlessRoleTurnHost(config) {
                 if (observedHostFailure !== void 0) {
                   return {
                     status: "terminal",
-                    result: failure("output", "HeadlessCliError", "codex-turn-failed", {
+                    result: externalHostFailure("output", "HeadlessCliError", "codex-turn-failed", {
                       diagnostic: observedHostFailure,
                       sessionRecordDiagnostic: message,
                       sessionId
@@ -26116,7 +26103,7 @@ function createHeadlessRoleTurnHost(config) {
                 }
                 return {
                   status: "terminal",
-                  result: failure("activation", "HeadlessSpawnFailure", "spawn-failed", {
+                  result: externalHostFailure("activation", "HeadlessSpawnFailure", "spawn-failed", {
                     diagnostic: message,
                     binary: config.binary
                   }, message)
@@ -26272,7 +26259,7 @@ function createHeadlessRoleTurnHost(config) {
       try {
         await prepared.dispose?.();
       } catch (cleanupError) {
-        outcome = withCleanupFailure(outcome, cleanupError);
+        outcome = withExternalHostCleanupFailure(outcome, cleanupError, "HeadlessDisposeFailure");
       }
     }
     return outcome;
@@ -26291,7 +26278,7 @@ function createProductionHeadlessRoleTurnHost(options) {
     description,
     hostName,
     sessionIdentity,
-    binary: resolveHeadlessBinary(description, operatorHome),
+    binary: resolveHostBinary(description, operatorHome),
     env: {
       ...process.env,
       AK_PACKAGE_ROOT: packageRoot