@akagilnc/pi-workflow-roles 0.1.5845 → 0.1.5855

package/src/navigator-public-session.ts

@@ -1,305 +0,0 @@
-/**
- * Navigator attendance session factory (#675 r3 / #1178).
- * Each prepare turn uses the public navigator activation path (summonPublicRole) —
- * same seat table and shared envelope as `ak-role navigator`.
- * Advice and run facts stay on the nested @navigator run dossier only —
- * no books/<book>/navigator/<hash>/ side-branch nest, work-context file,
- * current-session pointer, or attendance parallel ledger (#1178).
- * Host conversation continuity uses CLI resume (`resumeRunId`) within this
- * attendance lifetime (in-memory pointer). Parallel byStatus prepare is #1160.
- */
-import { basename } from "node:path";
-
-import { sitianReportSafe } from "./host-session-record.ts";
-import {
-  NavigatorUnavailableError,
-  navigatorProviderFailureFromPublicTerminal,
-  navigatorProviderFailureFromError,
-  navigatorUnavailableError,
-  parseNavigatorModelSetting,
-  type NavigatorProviderFailureFact,
-  type NavigatorSessionFactory,
-} from "./navigator-session-contracts.ts";
-import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
-import { runDirectoryFromHostContext, type HostContext } from "./host-contracts.ts";
-import { parseRunLeaf } from "./role-run-placement.ts";
-import type { PublicSummonResult } from "./public-role-summons.ts";
-import { CliUsageError } from "./public-cli/cli-errors.ts";
-import { isNavigatorSeat } from "./packaged-role-registry.ts";
-
-/**
- * Ledger process home for navigator summon: admitted HostContext.runDirectory
- * first, else a parent session file under .ak-roles. Never context.home / env HOME /
- * passwd guesses (#852).
- */
-async function resolveNavigatorLedgerHome(context: HostContext): Promise<string | undefined> {
-  const { tryHomeFromAkRolesPath } = await import(
-    "./activation-ledger-topology.ts"
-  );
-  const runDirectory = runDirectoryFromHostContext(context);
-  if (runDirectory !== undefined) {
-    const fromRun = tryHomeFromAkRolesPath(runDirectory);
-    if (fromRun !== undefined && fromRun.length > 0) return fromRun;
-  }
-  const parentFile = context.sessionManager?.getSessionFile?.();
-  if (typeof parentFile === "string" && parentFile.trim() !== "") {
-    const fromParent = tryHomeFromAkRolesPath(parentFile);
-    if (fromParent !== undefined && fromParent.length > 0) return fromParent;
-  }
-  return undefined;
-}
-
-export function runIdFromNavigatorDirectory(runDirectory: string): string | undefined {
-  const parsed = parseRunLeaf(basename(runDirectory));
-  if (parsed === undefined || parsed.role !== "navigator") return undefined;
-  return parsed.runId;
-}
-
-/**
- * Typed preflight via public CLI load path: can this run reopen as navigator?
- * CliUsageError (code AK_ROLE_USAGE) from loadResumablePublicRole means
- * unknown id or principal unavailable — not resumable. Any other disk role
- * is not this navigator host run. Other throws propagate. Never reads stderr prose.
- */
-export async function navigatorHostRunResumable(
-  home: string,
-  runId: string,
-  runDirectory?: string,
-): Promise<boolean> {
-  const { piDurablePrincipalAuthority } = await import("./pi/durable-principal.ts");
-  const { loadResumablePublicRole } = await import("./public-cli/run-lifecycle.ts");
-  try {
-    const loaded = await loadResumablePublicRole(
-      home, runId, piDurablePrincipalAuthority,
-      runDirectory === undefined ? undefined : { runDirectory },
-    );
-    return isNavigatorSeat(loaded.admitted.role);
-  } catch (error) {
-    if (error instanceof CliUsageError) return false;
-    throw error;
-  }
-}
-
-export type NavigatorPublicSummon = (options: {
-  readonly role: "navigator";
-  readonly argv: readonly string[];
-  readonly cwd: string;
-  readonly home?: string;
-  readonly resumeRunId?: string;
-  readonly resumeRunDirectory?: string;
-  /** Shared-lifecycle cancel forwarded from HostContext.signal (#675 / #959). */
-  readonly signal?: AbortSignal;
-  /** #1160 attendance auto byStatus prepare — host mounts structured schema. */
-  readonly navigatorByStatusPrepare?: boolean;
-}) => Promise<PublicSummonResult>;
-
-type MemoryEntry = {
-  readonly type: string;
-  readonly customType?: string;
-  readonly data?: unknown;
-};
-
-export function createNativeNavigatorSessionFactory(deps?: {
-  /** Test/composition inject — production leaves unset and uses public-role-summons. */
-  readonly summonPublicRole?: NavigatorPublicSummon;
-  /** Test inject — production uses navigatorHostRunResumable (typed CLI load). */
-  readonly hostRunResumable?: (home: string, runId: string, runDirectory?: string) => Promise<boolean>;
-}): NavigatorSessionFactory {
-  return async ({ context, tool }) => {
-    // Model is enforced at prepare (attendance seat resolve) and at prompt (summon).
-    // Factory open only holds in-memory attendance bookkeeping — no side-branch nest.
-    const entries: MemoryEntry[] = [];
-    let providerFailure: NavigatorProviderFailureFact | undefined;
-    let noReceipt: Partial<NoReceiptLifecycleFacts> | undefined;
-    let routePlaybookReadFailure: string | undefined;
-    let disposed = false;
-    /** Existing in-memory host continuity, retaining the directory already selected. */
-    let hostRun: { runId: string; runDirectory: string } | undefined;
-
-    const summon: NavigatorPublicSummon = deps?.summonPublicRole
-      ?? (async (options) => {
-        const { summonPublicRole } = await import("./public-role-summons.ts");
-        return summonPublicRole(options);
-      });
-
-    const parentSessionFile = (): string | undefined =>
-      context.sessionManager?.getSessionFile?.();
-
-    return {
-      prompt: async (text) => {
-        if (disposed) {
-          throw navigatorUnavailableError("session", new Error("Navigator attendance was disposed"));
-        }
-        providerFailure = undefined;
-        noReceipt = undefined;
-        routePlaybookReadFailure = undefined;
-        try {
-          const summonHome = await resolveNavigatorLedgerHome(context);
-          // Admission after every await: dispose during preflight must not start summon
-          // (ADR 0018 / #959 — legal HostContext may omit signal).
-          if (disposed) return;
-          const resumeRunId = hostRun?.runId;
-
-          // Call contract only: forward shared-lifecycle signal; do not own AbortController here
-          // (ADR 0018 / #959 — cancel ownership stays on the attendance/envelope seam).
-          const baseSummon = {
-            role: "navigator" as const,
-            argv: [text] as const,
-            cwd: context.cwd,
-            // Attendance prepare always asks for structured byStatus (#1160).
-            // Direct `ak-role navigator` never sets this flag.
-            navigatorByStatusPrepare: true as const,
-            ...(summonHome === undefined ? {} : { home: summonHome }),
-            ...(context.signal === undefined ? {} : { signal: context.signal }),
-          };
-
-          // Prefer host CLI resume so prior advice stays on the host session.
-          // Fresh mint only when typed load says the principal cannot reopen.
-          const resumable = deps?.hostRunResumable ?? navigatorHostRunResumable;
-          let summoned: PublicSummonResult;
-          if (resumeRunId === undefined || summonHome === undefined) {
-            if (disposed) return;
-            summoned = await summon(baseSummon);
-          } else {
-            const canResume = await resumable(summonHome, resumeRunId, hostRun?.runDirectory);
-            if (disposed) return;
-            if (canResume) {
-              summoned = await summon({
-                ...baseSummon,
-                resumeRunId,
-                ...(hostRun === undefined ? {} : { resumeRunDirectory: hostRun.runDirectory }),
-              });
-            } else {
-              hostRun = undefined;
-              summoned = await summon(baseSummon);
-            }
-          }
-
-          // Dispose won the race (with or without HostContext.signal): no late pointer/prepare.
-          // Cancel ownership stays on attendance/envelope; this only closes side effects (#959).
-          if (disposed) return;
-
-          const playbookFailure = summoned.terminal?.navigator?.advisoryDiagnostic;
-          routePlaybookReadFailure = typeof playbookFailure === "string" && playbookFailure.trim() !== ""
-            ? playbookFailure
-            : undefined;
-          const outcome = summoned.terminal?.roleOutcome;
-          if (outcome === undefined) {
-            const detail = summoned.stderr?.trim() || `exit ${summoned.exitCode}`;
-            // Known source is the public-summon transport path; unconfirmed cause stays unknown.
-            providerFailure = { source: "transport", cause: "unknown" };
-            throw navigatorUnavailableError(
-              providerFailure.source,
-              new Error(`Navigator public summon produced no terminal (${detail})`),
-              providerFailure.cause,
-            );
-          }
-          if (outcome.kind === "failure") {
-            providerFailure = navigatorProviderFailureFromPublicTerminal(outcome);
-            const failedAttempts = outcome.decisiveFacts.failedAttempts;
-            const attemptReasons = Array.isArray(failedAttempts)
-              ? failedAttempts.map((entry: unknown, index: number) => {
-                const fact = entry !== null && typeof entry === "object"
-                  ? entry as { attempt?: unknown; diagnostic?: unknown }
-                  : undefined;
-                return `${typeof fact?.attempt === "number" ? fact.attempt + 1 : index + 1}: ${
-                  typeof fact?.diagnostic === "string" ? fact.diagnostic : outcome.diagnostic
-                }`;
-              })
-              : [];
-            throw navigatorUnavailableError(
-              providerFailure.source,
-              new Error(attemptReasons.length > 0 ? attemptReasons.join("\n") : outcome.diagnostic),
-              providerFailure.cause,
-            );
-          }
-          if (outcome.kind === "no_receipt") {
-            // The nested session spent its own delivery budget; attendance settles
-            // no-receipt on these facts instead of opening another summon (#675).
-            noReceipt = outcome;
-            return;
-          }
-
-          // Pin host run for the next attendance prompt in this lifetime (CLI resume key).
-          const runDirectory = summoned.runDirectory
-            ?? (typeof summoned.admitted?.runDirectory === "string"
-              ? summoned.admitted.runDirectory
-              : undefined);
-          if (typeof runDirectory === "string" && runDirectory.trim() !== "") {
-            const nextRunId = runIdFromNavigatorDirectory(runDirectory);
-            if (nextRunId !== undefined) {
-              // In-memory only for this attendance lifetime (#1178) — no side-branch pointer ledger.
-              hostRun = { runId: nextRunId, runDirectory };
-            }
-          }
-
-          if (outcome.kind !== "accepted") {
-            // Non-accepted kinds (e.g. audit_escalation): no prose advice this turn.
-            // Not a shape-unusable judgment on the navigator reply (#757).
-            return;
-          }
-          // #959 / #1160: pass through prose and byStatus. No route parsing.
-          const {
-            byStatusToPlainObject,
-            mergePreparedAdvice,
-            preparedAdviceFromUnknown,
-          } = await import("./package-contracts/navigator-output.ts");
-          let prepared = undefined as ReturnType<typeof preparedAdviceFromUnknown>;
-          for (const payload of outcome.payloads ?? []) {
-            prepared = mergePreparedAdvice(prepared, preparedAdviceFromUnknown(payload));
-          }
-          if (prepared === undefined) return;
-          if (disposed) return;
-          await tool.execute(
-            "navigator-public-prepare",
-            {
-              ...(prepared.prose === undefined ? {} : { prose: prepared.prose }),
-              ...(prepared.byStatus.size === 0 ? {} : { byStatus: byStatusToPlainObject(prepared.byStatus) }),
-            },
-            undefined,
-            undefined,
-            context as never,
-          );
-        } catch (error) {
-          // Closed session: drain late nest errors without providerFailure side effects.
-          if (disposed) return;
-          if (error instanceof NavigatorUnavailableError) throw error;
-          const fact = navigatorProviderFailureFromError(error);
-          // Catch path is the public-summon seam (source transport); untyped cause stays unknown.
-          providerFailure = fact ?? { source: "transport", cause: "unknown" };
-          throw navigatorUnavailableError(providerFailure.source, error, providerFailure.cause);
-        }
-      },
-      providerFailure: () => providerFailure,
-      noReceipt: () => noReceipt,
-      routePlaybookReadFailure: () => routePlaybookReadFailure,
-      appendEntry: (customType, data) => {
-        entries.push({ type: "custom", customType, data });
-        const parent = parentSessionFile();
-        sitianReportSafe({
-          level: "event",
-          kind: "attendance",
-          cwd: context.cwd,
-          ...(parent === undefined ? {} : { sessionParent: parent }),
-          payload: { customType, data },
-          source: "navigator-public-session",
-        });
-      },
-      entries: () => entries,
-      setModel: async (next) => {
-        // Validate only — resume/fresh mint both read the live seat table
-        // (#675 / #617 DK-3). No test-only thinking observation state (#1160 F1).
-        try {
-          parseNavigatorModelSetting(next);
-        } catch (error) {
-          throw navigatorUnavailableError("model", error);
-        }
-      },
-      dispose: async () => {
-        // Marker only — nested cancel and non-blocking teardown are owned by
-        // navigator-attendance / role-runtime (ADR 0018 / #959).
-        disposed = true;
-      },
-    };
-  };
-}

package/src/navigator-role.ts

@@ -1,15 +0,0 @@
-import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
-
-/**
- * 决定工具规格。生命周期装配归注册信封 owner——src/role-runtime.ts（ADR 0018）。
- * #959: navigator speaks free-form prose; tool is a lifecycle vehicle only.
- */
-export const NAVIGATOR_TOOL_SPEC = roleSubmissionDeclaration("navigator");
-
-export type NavigatorRuntimeDependencies = {
-  loadSoul(): Promise<string>;
-  /** Standing route playbook. Production omits this and reads the package file once. */
-  loadRoutePlaybook?(): Promise<string>;
-  /** Same read's native failure, for the existing routePlaybookReadFailure outlet. */
-  recordRoutePlaybookReadFailure?(message: string | undefined): void;
-};

package/src/navigator-session-contracts.ts

@@ -1,320 +0,0 @@
-/**
- * Navigator session contracts — pure types, model setting, seat resolution, failure classification.
- * No lifecycle. Shared by attendance (consumer) and the unique institutional-child seam.
- */
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-
-import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
-import { Type } from "typebox";
-import { Value } from "typebox/value";
-
-import type { HostContext, HostInstitutionalModelSelection } from "./host-contracts.ts";
-import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
-
-import { isRecord, errorText, isEnoent } from "./unknown-value.ts";
-
-export const NAVIGATOR_PREPARE_TOOL_NAME = "ak_navigator_prepare" as const;
-
-export type NavigatorUnavailableKey =
-  | "context" | "session" | "model" | "thinking" | "auth" | "quota" | "transport" | "unknown";
-
-const NAVIGATOR_UNAVAILABLE_KEYS = new Set<NavigatorUnavailableKey>([
-  "context", "session", "model", "thinking", "auth", "quota", "transport", "unknown",
-]);
-
-function navigatorUnavailableKey(value: unknown): NavigatorUnavailableKey | undefined {
-  return typeof value === "string" && NAVIGATOR_UNAVAILABLE_KEYS.has(value as NavigatorUnavailableKey)
-    ? value as NavigatorUnavailableKey
-    : undefined;
-}
-
-export class NavigatorUnavailableError extends Error {
-  readonly unavailableSource: NavigatorUnavailableKey;
-  readonly unavailableCause: NavigatorUnavailableKey;
-  readonly originalCause: unknown;
-
-  constructor(source: NavigatorUnavailableKey, message: string, cause: NavigatorUnavailableKey = source, originalCause?: unknown) {
-    super(message);
-    this.name = "NavigatorUnavailableError";
-    this.unavailableSource = source;
-    this.unavailableCause = cause;
-    this.originalCause = originalCause;
-  }
-}
-
-export type NavigatorProviderFailureFact = {
-  source: NavigatorUnavailableKey;
-  cause: NavigatorUnavailableKey;
-};
-
-export function navigatorUnavailableError(
-  source: NavigatorUnavailableKey,
-  error: unknown,
-  cause: NavigatorUnavailableKey = source,
-): NavigatorUnavailableError {
-  const message = errorText(error);
-  return error instanceof NavigatorUnavailableError
-    ? error
-    : new NavigatorUnavailableError(source, message, cause, error);
-}
-
-export function navigatorProviderFailureFromStatus(status: number | undefined): NavigatorProviderFailureFact | undefined {
-  if (status === 401 || status === 403) return { source: "auth", cause: "auth" };
-  if (status === 429) return { source: "quota", cause: "quota" };
-  return undefined;
-}
-
-function navigatorProviderFailureFromCode(code: unknown): NavigatorProviderFailureFact | undefined {
-  if (typeof code === "number") return navigatorProviderFailureFromStatus(code);
-  if (typeof code !== "string") return undefined;
-  if (code === "unauthorized" || code === "authentication_failed") return { source: "auth", cause: "auth" };
-  if (code === "insufficient_quota" || code === "quota_exhausted") return { source: "quota", cause: "quota" };
-  if (code === "transport_error") return { source: "transport", cause: "transport" };
-  return undefined;
-}
-
-export function navigatorProviderFailureFromError(error: unknown): NavigatorProviderFailureFact | undefined {
-  let cursor: unknown = error;
-  const seen = new Set<unknown>();
-  while (typeof cursor === "object" && cursor !== null && !seen.has(cursor)) {
-    seen.add(cursor);
-    if (cursor instanceof NavigatorUnavailableError) {
-      return { source: cursor.unavailableSource, cause: cursor.unavailableCause };
-    }
-    if (!isRecord(cursor)) {
-      cursor = cursor instanceof Error ? cursor.cause : undefined;
-      continue;
-    }
-    const fromReason = navigatorUnavailableKey(cursor.reason);
-    if (fromReason !== undefined) return { source: fromReason, cause: fromReason };
-    const statusCode = typeof cursor.statusCode === "number"
-      ? cursor.statusCode
-      : typeof cursor.status === "number"
-        ? cursor.status
-        : typeof cursor.httpStatus === "number"
-          ? cursor.httpStatus
-          : undefined;
-    const fromStatus = navigatorProviderFailureFromStatus(statusCode);
-    if (fromStatus !== undefined) return fromStatus;
-    const fromCode = navigatorProviderFailureFromCode(cursor.code);
-    if (fromCode !== undefined) return fromCode;
-    cursor = cursor.cause;
-  }
-  return undefined;
-}
-
-export function navigatorProviderFailureFromDiagnostics(diagnostics: unknown): NavigatorProviderFailureFact | undefined {
-  if (!Array.isArray(diagnostics)) return undefined;
-  for (const diagnostic of diagnostics) {
-    if (!isRecord(diagnostic)) continue;
-    if (diagnostic.type === "provider_transport_failure") return { source: "transport", cause: "transport" };
-    if (isRecord(diagnostic.error)) {
-      const fromCode = navigatorProviderFailureFromCode(diagnostic.error.code);
-      if (fromCode !== undefined) return fromCode;
-    }
-    if (isRecord(diagnostic.details)) {
-      const status = typeof diagnostic.details.status === "number"
-        ? diagnostic.details.status
-        : typeof diagnostic.details.statusCode === "number"
-          ? diagnostic.details.statusCode
-          : undefined;
-      const fromStatus = navigatorProviderFailureFromStatus(status);
-      if (fromStatus !== undefined) return fromStatus;
-      const fromCode = navigatorProviderFailureFromCode(diagnostic.details.code);
-      if (fromCode !== undefined) return fromCode;
-    }
-  }
-  return undefined;
-}
-
-/**
- * Classify a public-navigator failure terminal from structured facts only.
- * Untyped cause stays unknown — never relabeled session.
- */
-export function navigatorProviderFailureFromPublicTerminal(outcome: {
-  readonly cause?: string;
-  readonly diagnostic: string;
-  readonly decisiveFacts: Readonly<Record<string, unknown>>;
-}): NavigatorProviderFailureFact {
-  const facts = outcome.decisiveFacts;
-  const secondary =
-    typeof facts.secondaryEvidence === "object" && facts.secondaryEvidence !== null
-      ? (facts.secondaryEvidence as Record<string, unknown>)
-      : undefined;
-  const httpStatus =
-    typeof secondary?.httpStatus === "number"
-      ? secondary.httpStatus
-      : typeof facts.httpStatus === "number"
-        ? facts.httpStatus
-        : typeof facts.errorCode === "number"
-          ? facts.errorCode
-          : undefined;
-  const fromStatus = navigatorProviderFailureFromStatus(httpStatus);
-  if (fromStatus !== undefined) return fromStatus;
-  const diagnostics = secondary?.diagnostics ?? facts.diagnostics;
-  const fromDiagnostics = navigatorProviderFailureFromDiagnostics(diagnostics);
-  if (fromDiagnostics !== undefined) return fromDiagnostics;
-  const fromCode = navigatorProviderFailureFromError({
-    code: secondary?.code ?? facts.errorCode,
-  });
-  if (fromCode !== undefined) return fromCode;
-  // cause=provider names the known source region only; without status/diagnostics/code
-  // the specific cause stays unknown (#881 — never invent transport/session labels).
-  if (outcome.cause === "provider") return { source: "transport", cause: "unknown" };
-  const typed = navigatorUnavailableKey(outcome.cause);
-  if (typed !== undefined) return { source: typed, cause: typed };
-  return { source: "unknown", cause: "unknown" };
-}
-
-const navigatorProviderFailureSchema = Type.Object({
-  source: Type.Union([
-    Type.Literal("context"), Type.Literal("session"), Type.Literal("model"), Type.Literal("thinking"),
-    Type.Literal("auth"), Type.Literal("quota"), Type.Literal("transport"), Type.Literal("unknown"),
-  ]),
-  cause: Type.Union([
-    Type.Literal("context"), Type.Literal("session"), Type.Literal("model"), Type.Literal("thinking"),
-    Type.Literal("auth"), Type.Literal("quota"), Type.Literal("transport"), Type.Literal("unknown"),
-  ]),
-}, { additionalProperties: false });
-
-export function navigatorProviderFailure<T extends object>(
-  message: T,
-  source: NavigatorUnavailableKey,
-  cause: NavigatorUnavailableKey = source,
-): T & { navigatorFailure: NavigatorProviderFailureFact } {
-  const fact = { source, cause } satisfies NavigatorProviderFailureFact;
-  if (!Value.Check(navigatorProviderFailureSchema, fact)) throw new TypeError("Navigator provider failure fact is not typed");
-  return Object.assign(message, { navigatorFailure: fact });
-}
-
-export type NavigatorPreparationSession = {
-  prompt(text: string): Promise<void>;
-  appendEntry(customType: string, data: unknown): void;
-  entries(): readonly unknown[];
-  providerFailure?(): NavigatorProviderFailureFact | undefined;
-  /**
-   * Facts of a nested session that already settled without an accepted receipt.
-   * Present means its own delivery budget is spent — another prompt would open an
-   * independent summon rather than press the session that owes the receipt.
-   */
-  noReceipt?(): Partial<NoReceiptLifecycleFacts> | undefined;
-  /** Native message from the nested playbook read, when that read failed. */
-  routePlaybookReadFailure?(): string | undefined;
-  setModel?(model: string, thinkingLevel?: string): Promise<void>;
-  dispose(): void | Promise<void>;
-};
-
-export type NavigatorSessionFactory = (options: {
-  context: HostContext;
-  subject: string;
-  modelSettingPath?: string;
-  tool: ToolDefinition;
-}) => Promise<NavigatorPreparationSession>;
-
-export function navigatorModelSettingPath(): string {
-  return join(process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"), "navigator-model.json");
-}
-
-export async function readNavigatorModelSetting(path = navigatorModelSettingPath()): Promise<string> {
-  try {
-    const raw = JSON.parse(await readFile(path, "utf8")) as unknown;
-    if (!isRecord(raw) || typeof raw.model !== "string" || raw.model.trim() === "") {
-      throw new Error("Navigator model setting is malformed");
-    }
-    return raw.model;
-  } catch (error) {
-    // #178: missing file is absence (no package default).
-    if (isEnoent(error)) {
-      throw new Error("Navigator model setting is missing");
-    }
-    throw error;
-  }
-}
-
-export async function writeNavigatorModelSetting(model: string, path = navigatorModelSettingPath()): Promise<void> {
-  const normalized = model.trim();
-  parseNavigatorModelSetting(normalized);
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, `${JSON.stringify({ model: normalized })}\n`, "utf8");
-}
-
-export function parseNavigatorModelSetting(value: string): {
-  provider: string;
-  model: string;
-  /** Host thinking passthrough — omit when bare provider/model (#675 ⑥). */
-  thinkingLevel?: string;
-} {
-  const slash = value.indexOf("/");
-  if (slash <= 0 || slash === value.length - 1) {
-    throw new Error("Navigator model setting must be provider/model[:thinking]");
-  }
-  const provider = value.slice(0, slash);
-  const modelWithThinking = value.slice(slash + 1);
-  const colon = modelWithThinking.lastIndexOf(":");
-  const suffix = colon < 0 ? undefined : modelWithThinking.slice(colon + 1);
-  const model = colon < 0 ? modelWithThinking : modelWithThinking.slice(0, colon);
-  if (model === "") throw new Error("Navigator model setting must include a model");
-  if (suffix !== undefined && suffix.trim() === "") {
-    throw new Error("Navigator model setting thinking suffix must be non-blank");
-  }
-  return {
-    provider,
-    model,
-    ...(suffix === undefined ? {} : { thinkingLevel: suffix }),
-  };
-}
-
-/**
- * Navigator model selection from the public seat table only (#675 / #617 DK-3).
- * No legacy navigator-model.json fallback — missing seat is a real model failure.
- * Host/engine axes ride the shared public summons path; attendance open consumes
- * model/thinking here and defers host selection to the shared envelope when present.
- */
-export async function resolveNavigatorSeatSelection(
-  context: HostContext,
-): Promise<{ selection: HostInstitutionalModelSelection; configuredLabel: string; thinkingLevel?: string }> {
-  try {
-    const { loadPublicCliConfig } = await import("./public-cli/config.ts");
-    const { seatModelOnly } = await import("./public-cli/registry.ts");
-    const { packageMachineHome } = await import("./activation-ledger-topology.ts");
-    const homeCandidate = (context as unknown as { home?: unknown }).home;
-    const envHome = process.env.HOME;
-    // Prefer explicit context home, then process HOME (hermetic tests), never
-    // jump straight to the real machine home when a temp HOME is armed.
-    const home =
-      typeof homeCandidate === "string"
-        ? homeCandidate
-        : typeof envHome === "string" && envHome.trim() !== ""
-          ? envHome
-          : packageMachineHome();
-    const config = await loadPublicCliConfig(home);
-    const modelOnly = seatModelOnly(config.seats.navigator);
-    // Seat table only — missing navigator seat → typed model-unavailable (#178).
-    if (modelOnly === undefined) {
-      const { missingResolvedSeatModelMessage } = await import("./public-cli/config.ts");
-      throw navigatorUnavailableError(
-        "model",
-        new Error(missingResolvedSeatModelMessage("navigator")),
-      );
-    }
-    // Host params passthrough only — no map/validate/default (#675 ⑥).
-    const thinkingRaw = modelOnly.thinking;
-    const configuredLabel =
-      thinkingRaw === undefined
-        ? `${modelOnly.provider}/${modelOnly.model}`
-        : `${modelOnly.provider}/${modelOnly.model}:${thinkingRaw}`;
-    return {
-      selection: {
-        provider: modelOnly.provider,
-        model: modelOnly.model,
-        ...(thinkingRaw === undefined ? {} : { thinking: thinkingRaw }),
-      },
-      configuredLabel,
-      ...(thinkingRaw === undefined ? {} : { thinkingLevel: thinkingRaw }),
-    };
-  } catch (error) {
-    throw navigatorUnavailableError("model", error);
-  }
-}