@corca-org/ceal-host-linux-arm64 1.0.17 → 1.0.19

package/libexec/ceal-host/relay.mjs

@@ -109,6 +109,9 @@ var client_wire_contract_default = {
       "document"
     ],
     optional_fields: [
+      "operation_id",
+      "visible_output_max_bytes",
+      "local_delivery",
       "verified_artifact"
     ],
     bare_document_fields: [
@@ -195,11 +198,15 @@ var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.f
 var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
 var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
+var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
 
 // packages/ceal-client-protocol/src/vocabulary.ts
 function vocabulary(words) {
   return Object.freeze(words);
 }
+function isVocabularyWord(words, value) {
+  return words.some((word) => word === value);
+}
 
 // packages/ceal-client-protocol/src/gateway-response-types.ts
 var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
@@ -222,6 +229,7 @@ var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verifie
 var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
 var CEAL_PROTOCOL_VERSION = "1.4.0";
 var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
 var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
   "audited_call_pending",
   "continuation_read_pending",
@@ -245,6 +253,7 @@ var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
 // packages/ceal-client-protocol/src/operation-next-actions.ts
 var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
 var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
+var CEAL_ANSWER_WITH_GAP_NEXT_ACTION = "answer_with_gap";
 var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "select_did_you_mean",
   "choose_new_output_path",
@@ -298,10 +307,20 @@ var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "retry_after",
   // The ref names a container of rows (a Notion database or data source), which
   // has no body of its own; the caller searches its rows instead of reading it.
-  "search_container_rows"
+  "search_container_rows",
+  // A settled unknown write names the exact receipt Operation that can inspect
+  // its outcome without issuing another provider mutation.
+  "write_receipt.get",
+  // Command resolution carries the exact required Operation sequence beside
+  // this action, so the caller can execute each declared input in order.
+  "follow_required_action_sequence",
+  // The command needs caller-owned local materialization (for example an
+  // @path file) before the Gateway can receive the argument.
+  "materialize_local_argument"
 ];
 var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
 var NON_REMEDY_NEXT_ACTION_VALUES = [
+  CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
   // Only an administrator can take the named step -- approving a place for an
   // Operation, granting a withheld capability -- so a non-administrator asks
   // one. The refusal names the administrator step; this word is the ask.
@@ -349,7 +368,58 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "select_exact_approval"
 ];
 var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
-var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
+var CEAL_DECLARED_NEXT_ACTIONS = Object.freeze([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
+var DECLARED = new Set(CEAL_DECLARED_NEXT_ACTIONS);
+function defineCealNonModelNextActions(actions) {
+  return actions;
+}
+var NON_MODEL_NEXT_ACTION_VALUES = defineCealNonModelNextActions([
+  CEAL_INSPECT_RECEIPT_NEXT_ACTION,
+  "await_pending_approval",
+  "inspect_gateway",
+  "operator_action",
+  "none",
+  "check_gateway",
+  "inspect_context_store",
+  "inspect_local_cache",
+  "inspect_local_client",
+  "inspect_local_command",
+  "inspect_local_output",
+  "inspect_local_route",
+  "inspect_request",
+  "reconcile",
+  "reconcile_occurrence",
+  "retry_after_owner_recovery",
+  "select_exact_approval"
+]);
+var NON_MODEL_NEXT_ACTIONS = new Set(NON_MODEL_NEXT_ACTION_VALUES);
+function isCealModelActionableNonRemedyNextAction(action) {
+  return !NON_MODEL_NEXT_ACTIONS.has(action);
+}
+var CEAL_MODEL_ACTIONABLE_NEXT_ACTIONS = Object.freeze([
+  ...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS,
+  ...CEAL_NON_REMEDY_NEXT_ACTIONS.filter(isCealModelActionableNonRemedyNextAction)
+]);
+var MODEL_ACTIONABLE = new Set(CEAL_MODEL_ACTIONABLE_NEXT_ACTIONS);
+var NON_MODEL_ACTION_TO_MODEL_ACTION = Object.freeze({
+  [CEAL_INSPECT_RECEIPT_NEXT_ACTION]: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  await_pending_approval: "ask_admin",
+  inspect_gateway: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  operator_action: "ask_admin",
+  none: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  check_gateway: "ask_admin",
+  inspect_context_store: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  inspect_local_cache: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  inspect_local_client: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  inspect_local_command: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  inspect_local_output: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  inspect_local_route: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  inspect_request: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  reconcile: CEAL_ANSWER_WITH_GAP_NEXT_ACTION,
+  reconcile_occurrence: "ask_admin",
+  retry_after_owner_recovery: "ask_admin",
+  select_exact_approval: "ask_admin"
+});
 var RETRY_PROMISE_NEXT_ACTIONS = ["retry", "retry_after"];
 var RETRY_PROMISE = new Set(RETRY_PROMISE_NEXT_ACTIONS);
 var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
@@ -619,21 +689,15 @@ var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
 // packages/ceal-client-protocol/src/domain-vocabulary.ts
 var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
 var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
-var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
-  "github_account",
-  "github_organization",
-  "google_workspace_domain",
-  "notion_workspace",
-  "slack_workspace"
-]);
-var CEAL_PROVIDER_BOUNDARY_EVIDENCE = vocabulary(["provider_readback", "operator_stated"]);
 var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
 var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
 var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
 var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
 var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
-var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
+var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
+var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
 var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
+var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
 var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
 
 // packages/ceal-client-protocol/src/safe-json-budget.ts
@@ -809,7 +873,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.operation_receipt.v1",
   "ceal.operation_result.v1",
   "ceal.operation_result.compact.v1",
-  "ceal.local_result_materialization.v1",
+  "ceal.local_result_file.v1",
   "ceal.local_result_root.v1",
   "ceal.owner_bootstrap_exchange_request.v1",
   "ceal.owner_bootstrap_exchange_result.v1",
@@ -839,6 +903,9 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   gateway_personal_client_access_audit: (root) => join(root, "access-audit.jsonl")
 });
 
+// packages/ceal-client-protocol/src/canonical-http-boundary.ts
+var CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES = CEAL_COMMAND_RESPONSE_MAX_BYTES;
+
 // packages/ceal-client-protocol/src/gateway-installation-activation.ts
 var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS = 32;
 var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS = 8;
@@ -904,41 +971,6 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
   }
 });
 
-// packages/ceal-client-protocol/src/provider-operation-vocabulary.ts
-var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
-var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
-var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
-  "paragraph",
-  "heading_1",
-  "heading_2",
-  "heading_3",
-  "bulleted_list_item",
-  "numbered_list_item",
-  "to_do",
-  "code"
-]);
-var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
-  "text",
-  "number",
-  "boolean",
-  "date",
-  "select",
-  "multi_select",
-  "people",
-  "url",
-  "email",
-  "phone",
-  "unsupported"
-]);
-var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
-  "identity_unavailable",
-  "identity_stale",
-  "identity_ambiguous",
-  "identity_revoked",
-  "identity_unlinked"
-]);
-var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
-
 // packages/ceal-client-protocol/src/opaque-reference.ts
 var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
 var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
@@ -950,7 +982,7 @@ var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_o
 // packages/ceal-client-protocol/src/resource-row.ts
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
 var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
-var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "since", "until", "authored_by_me", "authored_by", "include_replies", "kinds", "container_ref", "container_refs", "container_names", "addressed_to_me", "unread"]);
 var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
 var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
 var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
@@ -971,6 +1003,7 @@ var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
   "resource_modified"
 ]);
 var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
+var CEAL_ACTIVITY_UNSUPPORTED_EVENT_KIND_CODE = "unsupported_event_kind";
 var CEAL_ACTIVITY_GAP_CODES = vocabulary([
   "provider_page_budget",
   "call_deadline",
@@ -978,7 +1011,7 @@ var CEAL_ACTIVITY_GAP_CODES = vocabulary([
   "provider_cursor_unavailable",
   "malformed_provider_page",
   "visibility_incomplete",
-  "unsupported_event_kind",
+  CEAL_ACTIVITY_UNSUPPORTED_EVENT_KIND_CODE,
   "direct_messages_excluded"
 ]);
 var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
@@ -1029,6 +1062,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   ref: { required: true, timestamp: false },
   next: { required: true, timestamp: false },
   kind: { required: true, timestamp: false },
+  matched_kinds: { required: false, timestamp: false },
   title: { required: true, timestamp: false },
   container_label: { required: true, timestamp: false },
   container_ref: { required: false, timestamp: false },
@@ -1042,6 +1076,8 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   modified_at: { required: false, timestamp: true },
   modified_at_local: { required: false, timestamp: true },
   viewed_by_me_at: { required: false, timestamp: true },
+  own_ceal_write: { required: false, timestamp: false },
+  owned_by_me: { required: false, timestamp: false },
   visibility: { required: false, timestamp: false },
   start: { required: false, timestamp: false },
   end: { required: false, timestamp: false },
@@ -1075,6 +1111,15 @@ function cealExcludedTargetCoverageJsonSchema() {
   };
 }
 
+// packages/ceal-client-protocol/src/gateway-write-identity.ts
+var CEAL_GATEWAY_WRITE_IDENTITY_ROLES = Object.freeze(["replay_identity", "lookup_handle", "collision_evidence"]);
+var CEAL_GATEWAY_WRITE_REQUEST_REF_PATTERN = /^gateway-write-request:[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u;
+var CEAL_GATEWAY_WRITE_IDENTITY_FIELDS = Object.freeze({
+  replay_identity: "idempotency_claim_sha256",
+  lookup_handle: "write_request_sha256",
+  collision_evidence: "normalized_mutation_sha256"
+});
+
 // packages/ceal-client-protocol/src/write-safety-finding.ts
 var CEAL_WRITE_SAFETY_FINDING_STATUSES = vocabulary(["warning", "unchecked"]);
 var CEAL_WRITE_SAFETY_AUDIENCES = vocabulary(["workspace", "person", "members", "unknown"]);
@@ -1102,7 +1147,11 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
   "refresh_revoked",
   "authority_replaced",
   "refresh_recovery_unavailable",
-  "refresh_recovery_expired"
+  "refresh_recovery_expired",
+  // The serving gate answers this while the Gateway is still starting and the
+  // refresh was never attempted; the same attempt stays retryable. It is never
+  // stored by the session owner, only answered at the serving edge.
+  "gateway_starting"
 ]);
 
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
@@ -1135,7 +1184,7 @@ var CANCELLATION_STATES = vocabulary(["requested", "cancelled"]);
 var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority", "prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
 var CEAL_REQUEST_JSON_SCHEMA = {
   type: "object",
-  maxProperties: 10,
+  maxProperties: 11,
   additionalProperties: false,
   properties: {
     schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
@@ -1159,7 +1208,8 @@ var CEAL_REQUEST_JSON_SCHEMA = {
     host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." }
+    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
+    device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session; absent for Host turns and older records." }
   },
   required: CEAL_REQUEST_KEYS
 };
@@ -1218,6 +1268,7 @@ var REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES = {
   retryable: { type: "boolean" },
   source: { type: "string", enum: ["provider", "gateway"] },
   retry_after_ms: { type: "integer", minimum: 0, maximum: CEAL_RETRY_AFTER_MAX_MS },
+  write_request_ref: { type: "string", pattern: CEAL_GATEWAY_WRITE_REQUEST_REF_PATTERN.source, maxLength: 128 },
   excluded_targets: cealExcludedTargetCoverageJsonSchema(),
   repaired_input: {},
   unrepaired_pointers: { type: "array", maxItems: 128, items: { type: "string", minLength: 1, maxLength: 256 } },
@@ -1276,6 +1327,7 @@ function isCealHostInputKind(value) {
   return typeof value === "string" && CEAL_HOST_INPUT_KINDS.some((kind) => kind === value);
 }
 var CEAL_HOST_OBSERVATION_REF_PREFIX = "host-observation:";
+var HOST_TOKEN_OBSERVATION_BREAKDOWN_KEYS = vocabulary(["cached_input", "cache_write_input", "reasoning_output"]);
 function validateCealHostObservationDraft(value) {
   const record6 = operationRecord(value, "Ceal Host observation draft is invalid.");
   requirePrefixedRef(record6.observation_ref, CEAL_HOST_OBSERVATION_REF_PREFIX, "Ceal Host observation reference is invalid.");
@@ -1419,6 +1471,104 @@ var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().enc
   expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
 })}
 `).byteLength;
+var CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS = vocabulary([
+  "request_authority_unavailable",
+  "request_missing",
+  "authority_mismatch",
+  "host_source_mismatch",
+  "host_session_mismatch",
+  "host_turn_mismatch",
+  "host_input_mismatch",
+  "host_prompt_mismatch"
+]);
+var CEAL_HOST_AUTHENTICATION_CAUSES = vocabulary([
+  "invalid_arguments",
+  "options_invalid",
+  "session_unavailable",
+  "context_unavailable",
+  "context_replaced",
+  "no_binding",
+  "context_stale",
+  "context_expired",
+  "host_source_refused",
+  "host_credential_refused",
+  "gateway_unavailable",
+  "gateway_rate_limited",
+  "gateway_refused",
+  "gateway_response_invalid",
+  "producer_frame_invalid",
+  "relay_permission_denied",
+  "relay_unavailable",
+  "transient_retryable",
+  "mint_failed",
+  "relay_failed",
+  "host_refusal_invalid"
+]);
+var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
+  invalid_arguments: Object.freeze({ classification: "host_arguments_invalid", next_action: "answer_with_gap" }),
+  options_invalid: Object.freeze({ classification: "host_configuration_invalid", next_action: "answer_with_gap" }),
+  session_unavailable: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
+  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "refresh_host_invocation_context", remedy: "the Host has no invocation context from the current transcript turn; run `ceal-host install` to repair the Host hook registration, then retry this command on a fresh Host turn" }),
+  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
+  no_binding: Object.freeze({ classification: "host_binding_unavailable", next_action: "refresh_host_invocation_context" }),
+  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
+  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "refresh_host_invocation_context" }),
+  host_source_refused: Object.freeze({ classification: "host_source_refused", next_action: "answer_with_gap" }),
+  host_credential_refused: Object.freeze({ classification: "host_registration_credential_refused", next_action: "ask_admin" }),
+  gateway_unavailable: Object.freeze({ classification: "host_mint_gateway_unavailable", next_action: "ask_admin" }),
+  gateway_rate_limited: Object.freeze({ classification: "host_mint_gateway_rate_limited", next_action: "answer_with_gap" }),
+  gateway_refused: Object.freeze({ classification: "host_mint_gateway_refused", next_action: "answer_with_gap" }),
+  gateway_response_invalid: Object.freeze({ classification: "host_mint_gateway_response_invalid", next_action: "answer_with_gap" }),
+  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin", remedy: "ask an administrator to inspect and repair the producer frame, then start a fresh Host turn" }),
+  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox", remedy: "an agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox" }),
+  relay_unavailable: Object.freeze({ classification: "host_relay_unavailable", next_action: "answer_with_gap" }),
+  transient_retryable: Object.freeze({ classification: "host_mint_transient_retryable", next_action: "retry" }),
+  mint_failed: Object.freeze({ classification: "host_mint_failed", next_action: "answer_with_gap" }),
+  relay_failed: Object.freeze({ classification: "host_relay_failed", next_action: "answer_with_gap" }),
+  host_refusal_invalid: Object.freeze({ classification: "host_refusal_invalid", next_action: "answer_with_gap" })
+});
+function projectCealHostAuthenticationCause(diagnostic) {
+  return projectRelayCodeCause(diagnostic) ?? projectGatewayCodeCause(diagnostic) ?? projectGatewayStatusCause(diagnostic) ?? "mint_failed";
+}
+function projectRelayCodeCause(diagnostic) {
+  switch (diagnostic.relayCode) {
+    case "credential":
+      return "host_credential_refused";
+    case "configuration":
+      return "options_invalid";
+    case "payload_rejected":
+      return "producer_frame_invalid";
+    case "invalid_response":
+      return "gateway_response_invalid";
+    case "gateway_refused":
+      return projectGatewayRefusedCause(diagnostic);
+    case "gateway_unavailable":
+      return diagnostic.exhausted === true ? void 0 : "gateway_unavailable";
+    case void 0:
+    case "":
+      return void 0;
+    default:
+      return "mint_failed";
+  }
+}
+function projectGatewayRefusedCause(diagnostic) {
+  if (diagnostic.gatewayStatus === 401 || diagnostic.gatewayStatus === 403) return "host_credential_refused";
+  const stale = projectGatewayCodeCause(diagnostic);
+  if (stale !== void 0) return stale;
+  if (diagnostic.exhausted === true && (diagnostic.gatewayStatus === 408 || diagnostic.gatewayStatus === 429)) return "gateway_rate_limited";
+  return "gateway_refused";
+}
+function projectGatewayCodeCause(diagnostic) {
+  if (diagnostic.gatewayCode === "request_context_refused" && diagnostic.gatewayReason !== void 0 && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, diagnostic.gatewayReason)) return "context_stale";
+  if (diagnostic.gatewayCode === "context_expired") return "context_expired";
+  if (diagnostic.gatewayCode === "host_source_refused") return "host_source_refused";
+  return void 0;
+}
+function projectGatewayStatusCause(diagnostic) {
+  if (diagnostic.gatewayStatus === 401 || diagnostic.gatewayStatus === 403) return "host_credential_refused";
+  if (diagnostic.exhausted === true && (diagnostic.gatewayStatus === 408 || diagnostic.gatewayStatus === 429)) return "gateway_rate_limited";
+  return void 0;
+}
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
   if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");
@@ -1434,11 +1584,36 @@ function exactKeys(value, expected) {
   return keys.length === expected.length && expected.every((key) => Object.hasOwn(value, key));
 }
 
+// packages/ceal-client-protocol/src/host-service-diagnostic.ts
+var CEAL_HOST_SERVICE_DIAGNOSTIC_PRODUCERS = vocabulary(["claude", "codex"]);
+var CEAL_HOST_SERVICE_DIAGNOSTIC_EVENTS = vocabulary([
+  "hook_invoked",
+  "registration_written",
+  "hook_failed",
+  "watcher_turn_observed",
+  "current_prompt_registered",
+  "current_prompt_registration_failed",
+  "activation_recorded",
+  "activation_failed",
+  "watcher_scan_failed",
+  "activation_wait_skipped",
+  "activation_wait_engaged",
+  "activation_wait_completed",
+  "activation_wait_exhausted"
+]);
+var CEAL_HOST_SERVICE_DIAGNOSTIC_FAILURE_KINDS = vocabulary([
+  "malformed_line",
+  "other",
+  "payload_rejected",
+  "read_error",
+  "size_budget",
+  "symlink"
+]);
+
 // packages/ceal-client-protocol/src/client-result-materialization.ts
 var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
-var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
-var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id"]);
-var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "read_argv", "local_result_root", "continue_argv", "model_disclosure", "item_read_argv"]);
+var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "path", "sha256"]);
+var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "items_path", "row_count", "result_complete", "coverage", "local_result_root", "model_disclosure", "continue_argv", "how_to_read"]);
 
 // packages/ceal-client-protocol/src/gateway-cache-origin-validation.ts
 var CEAL_MAX_CACHE_ORIGIN_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -1468,14 +1643,6 @@ var CEAL_GATEWAY_ANNOUNCEMENT_POLICY_NON_CLAIMS = vocabulary([
   "target_specific_scope_not_declared"
 ]);
 
-// packages/ceal-client-protocol/src/gateway-write-identity.ts
-var CEAL_GATEWAY_WRITE_IDENTITY_ROLES = Object.freeze(["replay_identity", "lookup_handle", "collision_evidence"]);
-var CEAL_GATEWAY_WRITE_IDENTITY_FIELDS = Object.freeze({
-  replay_identity: "idempotency_claim_sha256",
-  lookup_handle: "write_request_sha256",
-  collision_evidence: "normalized_mutation_sha256"
-});
-
 // packages/ceal-client-protocol/src/gateway-scoped-identity-projection-validation.ts
 var PROJECTION_REVISION_KEYS = Object.freeze(["graph_revision", "subject_key_revision", "projection_revision"]);
 
@@ -1488,6 +1655,18 @@ var CEAL_SUPPORTED_GATEWAY_PROTOCOL_RANGE = Object.freeze({
 // packages/ceal-client-protocol/src/admin-projection-vocabulary.ts
 var ADMIN_PROJECTION_STATES = vocabulary(["ready", "empty", "partial", "unknown"]);
 var ADMIN_VIEW_KINDS = vocabulary(["request_detail", "resource_access_timeline", "weekly_usage"]);
+var ADMIN_RECORD_PROJECTION_KINDS = vocabulary([
+  "request_list",
+  "usage_series",
+  "connector_health",
+  "person_connections",
+  "client_sessions",
+  "knowledge_base",
+  "change_history",
+  "approval_queue",
+  "access_group_list",
+  "capability_catalogue"
+]);
 var ADMIN_GAP_KINDS = vocabulary(["unknown", "unavailable", "partial"]);
 var ADMIN_UNAVAILABLE_REASONS = vocabulary([
   "not_recorded",
@@ -1511,7 +1690,11 @@ var ADMIN_SOURCE_OWNERS = vocabulary([
   "person",
   "resource",
   "prompt",
-  "usage"
+  "usage",
+  "connector",
+  "session",
+  "knowledge",
+  "policy"
 ]);
 var ADMIN_COMPLETENESS_STATES = vocabulary(["complete", "partial", "unknown"]);
 var ADMIN_OPERATION_OUTCOMES = vocabulary(["completed", "failed", "denied", "cancelled", "unknown"]);
@@ -1649,7 +1832,7 @@ function assertHostRelaySourcePaths(stateRoot, config, platform = process.platfo
 // host/relay/src/host-relay-runtime.ts
 import { O_NOFOLLOW as O_NOFOLLOW3, O_RDONLY as O_RDONLY4 } from "node:constants";
 import { lstat as lstat4, open as open5 } from "node:fs/promises";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 
 // host/abortable-wait.ts
 function waitForAbort(signal, milliseconds) {
@@ -1746,6 +1929,15 @@ var FRAME_KINDS = new Set(HOST_PRODUCER_FRAME_KINDS);
 function isHostProducerFrameKind(value) {
   return typeof value === "string" && FRAME_KINDS.has(value);
 }
+var HOST_PRODUCER_FRAME_ERROR_CODES = [
+  "invalid_frame_encoding",
+  "invalid_frame_length",
+  "frame_truncated",
+  "unsupported_frame_schema",
+  "invalid_frame_shape",
+  "invalid_producer_identity",
+  "frame_too_large"
+];
 var HostProducerFrameError = class extends Error {
   code;
   constructor(code, message = code) {
@@ -1753,6 +1945,9 @@ var HostProducerFrameError = class extends Error {
     this.code = code;
   }
 };
+function assertHostProducerFrame(value) {
+  validateFrame(value);
+}
 function encodeHostProducerFrame(frame) {
   validateFrame(frame);
   const json = Buffer.from(JSON.stringify(frame), "utf8");
@@ -1783,6 +1978,30 @@ function decodeHostProducerFrame(input) {
 function hostProducerFrameHash(frame) {
   return createHash3("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
 }
+function extractHostBindingSelector(frame) {
+  if (frame.frame_kind !== "user_input") return null;
+  if (!PRODUCERS.has(frame.producer_id) || !safeRef(frame.producer_installation_ref)) return null;
+  const payload = frame.payload;
+  if (!safeRef(payload.local_session_ref) || !safeRef(payload.local_turn_ref)) return null;
+  const aliases = payload.local_turn_aliases;
+  if (aliases === void 0) {
+    return Object.freeze({
+      producer_id: frame.producer_id,
+      producer_installation_ref: frame.producer_installation_ref,
+      local_session_ref: payload.local_session_ref,
+      local_turn_ref: payload.local_turn_ref,
+      local_turn_aliases: Object.freeze([])
+    });
+  }
+  if (!Array.isArray(aliases) || aliases.length > 16 || !aliases.every(safeRef) || new Set(aliases).size !== aliases.length) return null;
+  return Object.freeze({
+    producer_id: frame.producer_id,
+    producer_installation_ref: frame.producer_installation_ref,
+    local_session_ref: payload.local_session_ref,
+    local_turn_ref: payload.local_turn_ref,
+    local_turn_aliases: Object.freeze([...aliases])
+  });
+}
 function hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef) {
   if (!opaqueHostSourceRef(hostSourceRef)) throw new TypeError("Gateway host source reference is invalid.");
   const host_session_ref = localSessionRef === void 0 ? void 0 : `ceal-host-session:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, local_session_ref: localSessionRef })}`;
@@ -1806,6 +2025,31 @@ function hostProducerSubmissionRef(hostSourceRef, frame) {
 function opaqueHostSourceRef(value) {
   return typeof value === "string" && SAFE_REF2.test(value) && !value.startsWith("ceal-host-source:");
 }
+function isHostSafeRef(value) {
+  return safeRef(value);
+}
+var BOUNDED_REFUSAL_WORD = /^[a-z][a-z0-9_]{0,63}$/u;
+function isBoundedRefusalWord(value) {
+  return typeof value === "string" && BOUNDED_REFUSAL_WORD.test(value);
+}
+function hasExactKeys2(value, required, optional = []) {
+  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+}
+function isUndefinedOr(value, guard) {
+  return value === void 0 || guard(value);
+}
+var HOST_RELAY_GATEWAY_ERROR_CODES = [
+  "configuration",
+  "credential",
+  "gateway_unavailable",
+  "gateway_refused",
+  "invalid_response",
+  "payload_rejected"
+];
+function isRelayGatewayErrorCode(value) {
+  return isVocabularyWord(HOST_RELAY_GATEWAY_ERROR_CODES, value);
+}
+var RELAY_DELIVERY_DIAGNOSTIC_KEYS = ["relayCode", "gatewayStatus", "gatewayCode", "gatewayReason", "exhausted"];
 function requiredIdentity(value) {
   if (value === void 0) throw new TypeError("Canonical Host identity is incomplete.");
   return value;
@@ -2234,6 +2478,8 @@ var RELAY_QUARANTINE_MAX_RECORDS = 512;
 var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
 var MAX_CAPTURE_BYTES = 262148;
 var PRODUCERS2 = ["codex", "claude", "unknown"];
+var RELAY_QUARANTINE_FRAME_REASONS = ["frame_identity_conflict", "sequence_gap", "gateway_refused"];
+var RELAY_QUARANTINE_REASONS = [...RELAY_QUARANTINE_FRAME_REASONS, ...HOST_PRODUCER_FRAME_ERROR_CODES];
 var RelayQuarantineStore = class {
   root;
   maxRecords;
@@ -2246,8 +2492,8 @@ var RelayQuarantineStore = class {
     if (!Number.isSafeInteger(this.maxRecords) || this.maxRecords < 1 || this.maxRecords > RELAY_QUARANTINE_MAX_RECORDS) throw new TypeError(`Relay quarantine record cap is invalid: ${refusalFact("max_records", this.maxRecords, `between 1 and ${RELAY_QUARANTINE_MAX_RECORDS}`)}.`);
     if (!Number.isSafeInteger(this.maxBytes) || this.maxBytes < 1 || this.maxBytes > RELAY_QUARANTINE_MAX_BYTES) throw new TypeError(`Relay quarantine byte cap is invalid: ${refusalFact("max_bytes", this.maxBytes, `between 1 and ${RELAY_QUARANTINE_MAX_BYTES}`)}.`);
   }
-  async retainFrame(frame, reason, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-    await this.retain(encodeHostProducerFrame(frame), frame.producer_id, reason, capturedAt);
+  async retainFrame(frame, reason, attribution, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+    await this.retain(encodeHostProducerFrame(frame), frame.producer_id, reason, capturedAt, attribution);
   }
   async retainMalformed(rawFrame, reason, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
     await this.retain(rawFrame, inferProducer(rawFrame), reason, capturedAt);
@@ -2259,11 +2505,26 @@ var RelayQuarantineStore = class {
     const records = state.producers[producerId].slice(-Math.min(limit, this.maxRecords)).map((record6) => structuredClone(record6));
     return { producer_id: producerId, records, total_bytes: records.reduce((total, record6) => total + record6.charged_bytes, 0) };
   }
+  /**
+   * The newest quarantined record whose exact-turn attribution matches the
+   * query, or null when evicted, unattributed, or for another turn. The
+   * file-backed state survives drain, restart, and overwrite.
+   */
+  async findNewestAttributedMatch(query) {
+    await this.tail;
+    const state = await this.readState();
+    const bucket = query.producer_id === "codex" || query.producer_id === "claude" ? state.producers[query.producer_id] : [];
+    for (let index = bucket.length - 1; index >= 0; index -= 1) {
+      const record6 = bucket[index];
+      if (record6 !== void 0 && attributedRecordMatchesQuery(record6, query)) return structuredClone(record6);
+    }
+    return null;
+  }
   async snapshot() {
     await this.tail;
     return this.readState();
   }
-  async retain(rawFrame, producerId, reason, capturedAt) {
+  async retain(rawFrame, producerId, reason, capturedAt, attribution) {
     const run = this.tail.then(async () => {
       if (!PRODUCERS2.includes(producerId) || !Number.isFinite(Date.parse(capturedAt))) throw new TypeError("Relay quarantine record identity is invalid.");
       const raw = Buffer.from(rawFrame).subarray(0, MAX_CAPTURE_BYTES);
@@ -2275,7 +2536,8 @@ var RelayQuarantineStore = class {
         captured_at: capturedAt,
         frame_sha256: createHash4("sha256").update(raw).digest("hex"),
         charged_bytes: raw.byteLength,
-        raw_frame_base64: raw.toString("base64")
+        raw_frame_base64: raw.toString("base64"),
+        ...attribution === void 0 ? {} : { attribution: structuredClone(attribution) }
       };
       const records = state.producers[producerId];
       records.push(record6);
@@ -2312,8 +2574,47 @@ function decodeState2(value) {
   return state;
 }
 function validRecord(value) {
-  if (!record3(value) || typeof value.quarantine_ref !== "string" || !quarantineProducer(value.producer_id) || typeof value.reason !== "string" || !Number.isFinite(Date.parse(String(value.captured_at))) || typeof value.frame_sha256 !== "string" || typeof value.charged_bytes !== "number" || !Number.isSafeInteger(value.charged_bytes) || value.charged_bytes < 0 || typeof value.raw_frame_base64 !== "string") return false;
-  return true;
+  if (!record3(value) || !validRecordIdentity(value)) return false;
+  return value.attribution === void 0 || validAttribution(value.attribution);
+}
+function validRecordIdentity(value) {
+  return typeof value.quarantine_ref === "string" && quarantineProducer(value.producer_id) && validReason(value.reason) && Number.isFinite(Date.parse(String(value.captured_at))) && typeof value.frame_sha256 === "string" && typeof value.raw_frame_base64 === "string" && validChargedBytes(value.charged_bytes);
+}
+function validReason(value) {
+  return typeof value === "string" && RELAY_QUARANTINE_REASONS.includes(value);
+}
+function validChargedBytes(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+var ATTRIBUTION_REQUIRED_KEYS = ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "sequence", "frame_sha256"];
+var ATTRIBUTION_OPTIONAL_KEYS = ["diagnostic"];
+function validAttribution(value) {
+  if (!record3(value) || !hasExactKeys2(value, ATTRIBUTION_REQUIRED_KEYS, ATTRIBUTION_OPTIONAL_KEYS)) return false;
+  return validAttributionIdentity(value) && validAttributionAliases(value.local_turn_aliases) && validAttributionEnvelope(value) && (value.diagnostic === void 0 || validAttributionDiagnostic(value.diagnostic));
+}
+function validAttributionIdentity(value) {
+  return (value.producer_id === "codex" || value.producer_id === "claude") && isHostSafeRef(value.producer_installation_ref) && isHostSafeRef(value.local_session_ref) && isHostSafeRef(value.local_turn_ref);
+}
+function validAttributionAliases(value) {
+  return Array.isArray(value) && value.length <= 16 && value.every(isHostSafeRef);
+}
+function validAttributionEnvelope(value) {
+  return typeof value.sequence === "number" && Number.isSafeInteger(value.sequence) && value.sequence > 0 && typeof value.frame_sha256 === "string";
+}
+function validAttributionDiagnostic(value) {
+  if (!record3(value) || !hasExactKeys2(value, [], RELAY_DELIVERY_DIAGNOSTIC_KEYS)) return false;
+  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean);
+}
+function isSafeInteger(value) {
+  return Number.isSafeInteger(value);
+}
+function isBoolean(value) {
+  return typeof value === "boolean";
+}
+function attributedRecordMatchesQuery(recordValue, query) {
+  const attribution = recordValue.attribution;
+  if (attribution === void 0) return false;
+  return attribution.producer_id === query.producer_id && attribution.producer_installation_ref === query.producer_installation_ref && attribution.local_session_ref === query.local_session_ref && (attribution.local_turn_ref === query.local_turn_ref || attribution.local_turn_aliases.includes(query.local_turn_ref));
 }
 function quarantineProducer(value) {
   return value === "codex" || value === "claude" || value === "unknown";
@@ -2401,11 +2702,11 @@ var RelayAdmissionStore = class {
     const hash = hostProducerFrameHash(frame);
     const replay = replayCode(existing, hash, frame.sequence, installation2);
     if (replay !== null) {
-      if (replay === "frame_identity_conflict") await this.quarantine.retainFrame(frame, replay);
+      if (replay === "frame_identity_conflict") await this.quarantine.retainFrame(frame, replay, attributionForFrame(frame, hash, frame.sequence));
       return result(replay, installation2);
     }
     if (frame.sequence !== installation2.admitted_through_sequence + 1) {
-      await this.quarantine.retainFrame(frame, "sequence_gap");
+      await this.quarantine.retainFrame(frame, "sequence_gap", attributionForFrame(frame, hash, frame.sequence));
       return result("sequence_gap", installation2);
     }
     const chargedBytes = 4 + Buffer.byteLength(JSON.stringify(frame), "utf8");
@@ -2433,31 +2734,54 @@ var RelayAdmissionStore = class {
     for (const producerId of PRODUCER_ORDER) {
       const head = state.entries.find((entry2) => entry2.producer_id === producerId);
       if (!head || head.retry_at_ms > options.now_ms) continue;
-      const input = { frame: structuredClone(head.frame), host_source_ref: options.host_source_ref, submission_ref: hostProducerSubmissionRef(options.host_source_ref, head.frame) };
-      const outcome = await deliver(input);
-      const exhausted = retryExhausted(outcome, head);
-      if (outcome.status === "retryable" && !exhausted) {
-        scheduleRetry(head, options.now_ms, outcome.reason);
-        retained.push(input.submission_ref);
-        await this.write(state);
-        continue;
-      }
-      const installation2 = state.installations[installationKey(head.frame)];
-      if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
-      if (outcome.status === "refused" || exhausted) {
-        await this.quarantine.retainFrame(head.frame, "gateway_refused");
-        installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), refused_at_ms: options.now_ms };
-        refused.push(input.submission_ref);
-      } else {
-        await options.after_gateway_accept_before_delivery_fsync?.({ fault_point: "after_gateway_accept_before_delivery_fsync", delivery: structuredClone(input) });
-        delivered.push(input.submission_ref);
-      }
-      state.entries.splice(state.entries.indexOf(head), 1);
-      installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
-      await this.write(state);
+      if (await this.refusePoisonHead(state, head, options, refused)) continue;
+      await this.deliverHead(state, head, deliver, options, delivered, retained, refused);
     }
     return { delivered, retained, refused };
   }
+  async deliverHead(state, head, deliver, options, delivered, retained, refused) {
+    const input = { frame: structuredClone(head.frame), host_source_ref: options.host_source_ref, submission_ref: hostProducerSubmissionRef(options.host_source_ref, head.frame) };
+    const outcome = await deliver(input);
+    const exhausted = retryExhausted(outcome, head);
+    if (outcome.status === "retryable" && !exhausted) {
+      scheduleRetry(head, options.now_ms, outcome.reason);
+      retained.push(input.submission_ref);
+      await this.write(state);
+      return;
+    }
+    const installation2 = state.installations[installationKey(head.frame)];
+    if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
+    if (outcome.status === "refused" || exhausted) {
+      const diagnostic = exhaustedDiagnostic(outcome, exhausted);
+      await this.quarantine.retainFrame(head.frame, "gateway_refused", attributionForFrame(head.frame, head.hash, head.sequence, diagnostic));
+      installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), ...diagnostic === void 0 ? {} : { diagnostic }, refused_at_ms: options.now_ms };
+      refused.push(input.submission_ref);
+    } else {
+      await options.after_gateway_accept_before_delivery_fsync?.({ fault_point: "after_gateway_accept_before_delivery_fsync", delivery: structuredClone(input) });
+      delivered.push(input.submission_ref);
+    }
+    state.entries.splice(state.entries.indexOf(head), 1);
+    installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
+    await this.write(state);
+  }
+  async refusePoisonHead(state, head, options, refused) {
+    const poison = poisonFrameError(head.frame);
+    if (poison === null) return false;
+    const installation2 = state.installations[installationKey(head)];
+    if (!hasIntactAdmissionEnvelope(head, installation2)) throw new TypeError("Host Relay admission state is invalid.");
+    const json = Buffer.from(JSON.stringify(head.frame), "utf8");
+    const raw = Buffer.allocUnsafe(json.byteLength + 4);
+    raw.writeUInt32BE(json.byteLength, 0);
+    json.copy(raw, 4);
+    await this.quarantine.retainMalformed(raw, poison.code);
+    const submissionRef = hostProducerSubmissionRef(options.host_source_ref, { producer_id: head.producer_id, producer_installation_ref: head.producer_installation_ref, sequence: head.sequence });
+    installation2.last_refusal = { sequence: head.sequence, submission_ref: submissionRef, code: poison.code, message: `Host Relay persisted frame is invalid: ${poison.code}.`, refused_at_ms: options.now_ms };
+    refused.push(submissionRef);
+    state.entries.splice(state.entries.indexOf(head), 1);
+    installation2.delivered_through_sequence = Math.max(installation2.delivered_through_sequence, head.sequence);
+    await this.write(state);
+    return true;
+  }
   async read() {
     try {
       return decodeState3(JSON.parse(await readFile2(join4(this.root, "admission.json"), "utf8")));
@@ -2474,17 +2798,22 @@ function installationKey(frame) {
   return `${frame.producer_id}\0${frame.producer_installation_ref}`;
 }
 function pendingFrameMatchesBindingQuery(entry2, query) {
-  if (entry2.frame.frame_kind !== "user_input") return false;
-  const payload = entry2.frame.payload;
-  if (typeof payload.local_session_ref !== "string" || typeof payload.local_turn_ref !== "string") return false;
-  const aliases = Array.isArray(payload.local_turn_aliases) ? payload.local_turn_aliases.filter((value) => typeof value === "string") : [];
-  return relayRequestBindingMatchesQuery(query, {
-    producer_id: entry2.frame.producer_id,
-    producer_installation_ref: entry2.frame.producer_installation_ref,
-    local_session_ref: payload.local_session_ref,
-    local_turn_ref: payload.local_turn_ref,
-    local_turn_aliases: aliases
-  });
+  const selector = extractHostBindingSelector(entry2.frame);
+  if (selector === null) return false;
+  return relayRequestBindingMatchesQuery(query, selector);
+}
+function attributionForFrame(frame, hash, sequence, diagnostic) {
+  const selector = extractHostBindingSelector(frame);
+  if (selector === null) return void 0;
+  if (frame.producer_id !== selector.producer_id || frame.producer_installation_ref !== selector.producer_installation_ref || frame.sequence !== sequence) return void 0;
+  if (hostProducerFrameHash(frame) !== hash) return void 0;
+  return { ...selector, sequence, frame_sha256: hash, ...diagnostic === void 0 ? {} : { diagnostic } };
+}
+function exhaustedDiagnostic(outcome, exhausted) {
+  if (outcome.status !== "retryable" && outcome.status !== "refused") return void 0;
+  if (outcome.diagnostic !== void 0) return exhausted ? { ...outcome.diagnostic, exhausted: true } : outcome.diagnostic;
+  if (exhausted) return { exhausted: true };
+  return void 0;
 }
 function replayCode(existing, hash, sequence, installation2) {
   if (existing !== void 0) return existing.hash === hash ? "already_admitted" : "frame_identity_conflict";
@@ -2523,6 +2852,8 @@ function decodeState3(value) {
   const entries = [];
   for (const item of value.entries) {
     if (!entry(item)) throw new TypeError("Host Relay entry state is invalid.");
+    poisonFrameError(item.frame);
+    if (!hasIntactAdmissionEnvelope(item, installations[installationKey(item)])) throw new TypeError("Host Relay admission state is invalid.");
     entries.push(item);
   }
   return { schema_version: "ceal.host_relay_admission_state.v1", installations, entries };
@@ -2534,7 +2865,17 @@ function installation(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && "epoch" in value && "admitted_through_sequence" in value && "delivered_through_sequence" in value && [value.epoch, value.admitted_through_sequence, value.delivered_through_sequence].every(Number.isSafeInteger) && (!("last_refusal" in value) || refusalRecord(value.last_refusal));
 }
 function refusalRecord(value) {
-  return object(value) && Number.isSafeInteger(value.sequence) && typeof value.submission_ref === "string" && typeof value.code === "string" && typeof value.message === "string" && Number.isSafeInteger(value.refused_at_ms);
+  return object(value) && Number.isSafeInteger(value.sequence) && typeof value.submission_ref === "string" && typeof value.code === "string" && typeof value.message === "string" && Number.isSafeInteger(value.refused_at_ms) && (value.diagnostic === void 0 || validDiagnostic(value.diagnostic));
+}
+function validDiagnostic(value) {
+  if (!object(value) || !hasExactKeys2(value, [], RELAY_DELIVERY_DIAGNOSTIC_KEYS)) return false;
+  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger2) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean2);
+}
+function isSafeInteger2(value) {
+  return Number.isSafeInteger(value);
+}
+function isBoolean2(value) {
+  return typeof value === "boolean";
 }
 function entry(value) {
   return object(value) && producer2(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
@@ -2545,6 +2886,60 @@ function producer2(value) {
 function object(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function poisonFrameError(frame) {
+  try {
+    assertHostProducerFrame(frame);
+    return null;
+  } catch (error) {
+    if (error instanceof HostProducerFrameError) return error;
+    throw error;
+  }
+}
+function hasIntactAdmissionEnvelope(entryValue, installation2) {
+  if (installation2 === void 0) return false;
+  return poisonIdentityValid(entryValue) && poisonEnvelopeMatches(entryValue, installation2) && poisonIntegrityMatches(entryValue) && poisonSequenceInRange(entryValue, installation2);
+}
+function poisonIdentityValid(entryValue) {
+  if (entryValue.producer_id !== "codex" && entryValue.producer_id !== "claude") return false;
+  if (!opaqueHostSourceRef(entryValue.producer_installation_ref)) return false;
+  return Number.isSafeInteger(entryValue.sequence) && entryValue.sequence > 0;
+}
+function poisonEnvelopeMatches(entryValue, installation2) {
+  const frame = entryValue.frame;
+  if (!object(frame)) return false;
+  return poisonEnvelopeSchema(frame) && poisonEnvelopeProducer(frame, entryValue) && poisonEnvelopeInstallation(frame, entryValue) && poisonEnvelopeEpoch(frame, installation2) && poisonEnvelopeSequence(frame, entryValue) && poisonEnvelopeKind(frame) && poisonEnvelopeTimestamp(frame);
+}
+function poisonEnvelopeSchema(frame) {
+  return frame.schema_version === "ceal.host_producer_frame.v1";
+}
+function poisonEnvelopeProducer(frame, entryValue) {
+  return producer2(frame.producer_id) && frame.producer_id === entryValue.producer_id;
+}
+function poisonEnvelopeInstallation(frame, entryValue) {
+  return opaqueHostSourceRef(frame.producer_installation_ref) && frame.producer_installation_ref === entryValue.producer_installation_ref;
+}
+function poisonEnvelopeEpoch(frame, installation2) {
+  return Number.isSafeInteger(frame.producer_epoch) && typeof frame.producer_epoch === "number" && frame.producer_epoch > 0 && frame.producer_epoch <= installation2.epoch;
+}
+function poisonEnvelopeSequence(frame, entryValue) {
+  return Number.isSafeInteger(frame.sequence) && frame.sequence === entryValue.sequence;
+}
+function poisonEnvelopeKind(frame) {
+  return isHostProducerFrameKind(frame.frame_kind);
+}
+function poisonEnvelopeTimestamp(frame) {
+  return typeof frame.occurred_at === "string" && Number.isFinite(Date.parse(frame.occurred_at));
+}
+function poisonIntegrityMatches(entryValue) {
+  const frame = entryValue.frame;
+  if (!object(frame)) return false;
+  const json = JSON.stringify(frame);
+  return entryValue.charged_bytes === 4 + Buffer.byteLength(json, "utf8") && entryValue.hash === hostProducerFrameHash(entryValue.frame);
+}
+function poisonSequenceInRange(entryValue, installation2) {
+  if (entryValue.sequence <= installation2.delivered_through_sequence) return false;
+  return entryValue.sequence <= installation2.admitted_through_sequence;
+}
 
 // host/relay/src/relay-gateway-bridge.ts
 import { readFile as readFile3 } from "node:fs/promises";
@@ -2688,10 +3083,22 @@ function submissionRefusal(error) {
   const status = isRecord(error) && typeof error.status === "number" ? error.status : void 0;
   const code = errorCode7(error) ?? "gateway_unavailable";
   const definitive = code === "payload_rejected" || status !== void 0 && status >= 400 && status < 500 && !RETRYABLE_HTTP_STATUSES.has(status);
-  return { code, message: errorMessage(error), definitive };
+  return { code, message: errorMessage(error), definitive, diagnostic: typedDiagnostic(error, status) };
+}
+function typedDiagnostic(error, status) {
+  if (!isRecord(error)) return status === void 0 ? {} : { gatewayStatus: status };
+  const gatewayCode = isBoundedRefusalWord(error.error_code) ? error.error_code : void 0;
+  const gatewayReason = isBoundedRefusalWord(error.refusal_reason) ? error.refusal_reason : void 0;
+  return {
+    ...typeof error.code === "string" ? { relayCode: error.code } : {},
+    ...status === void 0 ? {} : { gatewayStatus: status },
+    ...gatewayCode === void 0 ? {} : { gatewayCode },
+    ...gatewayReason === void 0 ? {} : { gatewayReason }
+  };
 }
 function deliveryRefusal(refusal) {
-  return refusal.definitive ? { status: "refused", code: refusal.code, message: refusal.message } : { status: "retryable", reason: `${refusal.code}: ${refusal.message}` };
+  const diagnostic = refusal.diagnostic === void 0 ? {} : { diagnostic: refusal.diagnostic };
+  return refusal.definitive ? { status: "refused", code: refusal.code, message: refusal.message, ...diagnostic } : { status: "retryable", reason: `${refusal.code}: ${refusal.message}`, ...diagnostic };
 }
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
@@ -2889,22 +3296,35 @@ var HostRelayGatewayError = class extends Error {
   status;
   /** The Gateway's own refusal word, when it named one; a bounded token, never its message. */
   error_code;
-  constructor(code, message, status, errorCode9) {
+  /** The Gateway mint refusal's bounded continuity reason, when it named one; a fixed token, never its message. */
+  refusal_reason;
+  constructor(code, message, status, errorCode9, refusalReason) {
     super(message);
     this.code = code;
     if (status !== void 0) this.status = status;
     if (errorCode9 !== void 0) this.error_code = errorCode9;
+    if (refusalReason !== void 0) this.refusal_reason = refusalReason;
   }
 };
 var GATEWAY_REFUSAL_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
-async function gatewayRefusalCode(response2) {
+async function gatewayRefusal(response2) {
   try {
     const body = await response2.json();
-    return isCealJsonRecord(body) && typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
+    if (!isCealJsonRecord(body)) return {};
+    const code = typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
+    const reason = code === "request_context_refused" && typeof body.reason === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.reason) && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, body.reason) ? body.reason : void 0;
+    return {
+      ...code === void 0 ? {} : { code },
+      ...reason === void 0 ? {} : { reason }
+    };
   } catch {
-    return void 0;
+    return {};
   }
 }
+function submitRefusalCode(body) {
+  if (!isCealJsonRecord(body) || typeof body.error_code !== "string" || !GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code)) return void 0;
+  return body.error_code;
+}
 function refusalMessage(status, body) {
   const record6 = isCealJsonRecord(body) ? body : {};
   const code = typeof record6.error_code === "string" ? record6.error_code : "unknown";
@@ -2932,7 +3352,7 @@ function createHostRelayGatewayHttpPort(options) {
         invalidEventTime: () => new HostRelayGatewayError("payload_rejected", "Host Relay submission has no event time."),
         unavailable: () => new HostRelayGatewayError("gateway_unavailable", "Gateway Host ingress is unavailable."),
         invalidResponse: () => new HostRelayGatewayError("invalid_response", "Gateway Host ingress response is not JSON."),
-        refused: (status, body) => new HostRelayGatewayError("gateway_refused", refusalMessage(status, body), status),
+        refused: (status, body) => new HostRelayGatewayError("gateway_refused", refusalMessage(status, body), status, submitRefusalCode(body)),
         acknowledgement
       });
     },
@@ -2950,7 +3370,10 @@ function createHostRelayGatewayHttpPort(options) {
       } catch {
         throw new HostRelayGatewayError("gateway_unavailable", "Gateway Host invocation context is unavailable.");
       }
-      if (!response2.ok) throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, await gatewayRefusalCode(response2));
+      if (!response2.ok) {
+        const refusal = await gatewayRefusal(response2);
+        throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, refusal.code, refusal.reason);
+      }
       let value;
       try {
         value = await response2.json();
@@ -3071,8 +3494,9 @@ function acknowledgement(value) {
 }
 
 // host/relay/src/relay-ipc.ts
-import { chmod, lstat as lstat3, unlink as unlink2 } from "node:fs/promises";
+import { chmod, lstat as lstat3, rename as rename2, unlink as unlink2 } from "node:fs/promises";
 import { createConnection, createServer } from "node:net";
+import { dirname as dirname3, join as join6 } from "node:path";
 
 // host/relay/src/current-prompt-custody.ts
 import { createHash as createHash5 } from "node:crypto";
@@ -3150,10 +3574,31 @@ var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
   "gateway_unavailable",
   "gateway_refused",
   "gateway_response_invalid",
+  "gateway_rate_limited",
+  "producer_frame_invalid",
   "deadline",
   "cancelled",
   "mint_failed",
-  "relay_failed"
+  "relay_failed",
+  "request_authority_unavailable",
+  "request_missing",
+  "authority_mismatch",
+  "host_source_mismatch",
+  "host_session_mismatch",
+  "host_turn_mismatch",
+  "host_input_mismatch",
+  "host_prompt_mismatch"
+]);
+var HOST_RELAY_DIRECT_WIRE_MINT_REASONS = vocabulary([
+  "context_stale",
+  "context_expired",
+  "host_source_refused",
+  "host_credential_refused",
+  "gateway_unavailable",
+  "gateway_rate_limited",
+  "gateway_refused",
+  "gateway_response_invalid",
+  "producer_frame_invalid"
 ]);
 var HostRelayInvocationMintRefusal = class extends Error {
   reason;
@@ -3185,15 +3630,42 @@ var HostRelayIpcError = class extends Error {
   }
 };
 async function startHostRelayIpcServer(options) {
-  await assertEndpointVacant(options.endpoint);
-  const active = /* @__PURE__ */ new Map();
-  const sockets = /* @__PURE__ */ new Set();
-  const quarantine = options.quarantine ?? options.admission.quarantine;
-  const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
-  const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
-  await listen(server, options.endpoint);
-  if (process.platform !== "win32") await chmod(options.endpoint, 384);
-  return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
+  return withRelayEndpointLock(options.endpoint, async () => {
+    if (process.platform === "win32") {
+      await assertEndpointVacant(options.endpoint);
+    } else {
+      await assertTrustedEndpointParent(options.endpoint);
+      await removeStaleRelayEndpoint(options.endpoint, options.testHooks);
+    }
+    const active = /* @__PURE__ */ new Map();
+    const sockets = /* @__PURE__ */ new Set();
+    const quarantine = options.quarantine ?? options.admission.quarantine;
+    const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
+    const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
+    if (process.platform === "win32") {
+      try {
+        await listen(server, options.endpoint);
+      } catch (error) {
+        await abandonRelayServer(server, sockets);
+        throw error;
+      }
+      return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
+    }
+    const staging = stagingRelayEndpoint(options.endpoint);
+    await listenStagingRelayEndpoint(server, sockets, staging);
+    let owned;
+    try {
+      await options.testHooks?.beforeCaptureOwnedEndpoint?.(options.endpoint);
+      owned = await readStagingRelayEndpointIdentity(staging);
+      await chmod(staging, 384);
+      const identity = await publishStagingRelayEndpoint(staging, owned, options.endpoint);
+      return { endpoint: options.endpoint, close: () => closeRelayServer(server, sockets, options.endpoint, identity, options.testHooks) };
+    } catch (error) {
+      if (owned !== void 0) await releaseOwnedRelayEndpoint(server, sockets, options.endpoint, owned);
+      else await abandonRelayServer(server, sockets);
+      throw error;
+    }
+  });
 }
 function encodeHostRelayIpcResponse(response2) {
   const body = Buffer.from(JSON.stringify(response2), "utf8");
@@ -3355,17 +3827,68 @@ function writeCurrentPromptResponse(socket, status) {
 async function resolveInvocationContext(request2, admission, bindings, currentPrompts, mint, signal) {
   if (mint === void 0) throw new HostRelayIpcError("relay_unavailable");
   const query = bindingQueryFromRequest(request2);
+  const expectedSequences = pendingAdmissionSequences(await admission.snapshot(), query);
   const binding = await waitForRequestBinding(query, admission, bindings, signal);
-  if (binding.status !== "ready") return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
+  if (binding.status !== "ready") return await unboundInvocationContextRefusal(admission, await admission.snapshot(), query, expectedSequences) ?? { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
   const currentPrompt = currentPrompts.take({ producer_id: request2.producer_id, producer_installation_ref: request2.producer_installation_ref, local_session_ref: request2.local_session_ref, local_turn_ref: request2.local_turn_ref, prompt_ref: binding.binding.prompt_ref });
   let result2;
   try {
-    result2 = await mint({ client_nonce: request2.client_nonce, context_expires_at: binding.binding.context_expires_at ?? binding.binding.bound_at, request_work_context: relayRequestWorkContextFromBinding(binding.binding), ...currentPrompt === void 0 ? {} : { current_prompt: currentPrompt } }, signal);
+    result2 = await mint({ client_nonce: request2.client_nonce, context_expires_at: binding.binding.context_expires_at ?? binding.binding.bound_at, request_work_context: relayRequestWorkContextFromBinding(binding.binding), ...currentPrompt === void 0 ? {} : { current_prompt: currentPrompt }, ...request2.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: request2.visible_output_max_bytes } }, signal);
   } catch (error) {
     return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: error instanceof HostRelayInvocationMintRefusal ? error.reason : "mint_failed" };
   }
   return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "ready", result: result2 };
 }
+async function unboundInvocationContextRefusal(admission, snapshot, query, expectedSequences) {
+  if (expectedSequences.length > 0) {
+    const refusal = snapshot.installations[`${query.producer_id}\0${query.producer_installation_ref}`]?.last_refusal;
+    if (refusal !== void 0 && expectedSequences.includes(refusal.sequence)) {
+      const reason2 = mintReasonForDeliveryRefusal(refusal.code, refusal.diagnostic);
+      if (reason2 !== void 0) return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: reason2 };
+    }
+  }
+  const selector = Object.freeze({
+    producer_id: query.producer_id,
+    producer_installation_ref: query.producer_installation_ref,
+    local_session_ref: query.local_session_ref,
+    local_turn_ref: query.local_turn_ref,
+    local_turn_aliases: Object.freeze([])
+  });
+  const match = await admission.quarantine.findNewestAttributedMatch(selector);
+  if (match === null) return null;
+  const reason = mintReasonForQuarantinedMatch(match);
+  if (reason === void 0) return null;
+  return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason };
+}
+function mintReasonForDeliveryRefusal(code, diagnostic) {
+  if (code !== "gateway_refused") return void 0;
+  if (diagnostic === void 0) return "gateway_refused";
+  return mintReasonForWireCause(projectCealHostAuthenticationCause(diagnostic));
+}
+function mintReasonForQuarantinedMatch(match) {
+  if (match === null) return void 0;
+  if (match.reason !== "gateway_refused") return "producer_frame_invalid";
+  const diagnostic = match.attribution?.diagnostic;
+  if (diagnostic === void 0) return void 0;
+  return mintReasonForWireCause(projectCealHostAuthenticationCause(diagnostic));
+}
+function mintReasonForWireCause(cause) {
+  if (isDirectWireCause(cause)) return cause;
+  if (cause === "relay_failed" || cause === "relay_unavailable" || cause === "options_invalid") return "relay_failed";
+  return "mint_failed";
+}
+function isDirectWireCause(cause) {
+  return isVocabularyWord(HOST_RELAY_DIRECT_WIRE_MINT_REASONS, cause);
+}
+function pendingAdmissionSequences(snapshot, query) {
+  const sequences = [];
+  for (const entry2 of snapshot.entries) {
+    const selector = extractHostBindingSelector(entry2.frame);
+    if (selector === null || !relayRequestBindingMatchesQuery(query, selector)) continue;
+    sequences.push(entry2.sequence);
+  }
+  return sequences;
+}
 async function waitForRequestBinding(query, admission, bindings, signal) {
   let binding = await bindings.query(query);
   if (binding.status === "ready") return binding;
@@ -3483,11 +4006,14 @@ function bindingQueryFromRequest(value) {
   return { producer_id: value.producer_id, producer_installation_ref: value.producer_installation_ref, local_session_ref: value.local_session_ref, local_turn_ref: value.local_turn_ref };
 }
 function validInvocationContextQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "client_nonce"]) && typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce);
+  return validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "client_nonce"], ["visible_output_max_bytes"]) && typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
 }
 function validQueryIdentity(value, schema) {
   return record4(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef3(value.producer_installation_ref) && safeRef3(value.local_session_ref) && safeRef3(value.local_turn_ref);
 }
+function validVisibleOutputBudget(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
+}
 function decodeLengthPrefixedJson(input, maximum) {
   if (input.length < HOST_RELAY_IPC_LENGTH_BYTES) return null;
   const length = input.readUInt32BE(0);
@@ -3510,8 +4036,9 @@ function encodeLengthPrefixed(value) {
 function currentPromptWire(value) {
   return value.subarray(HOST_RELAY_IPC_LENGTH_BYTES, Math.min(value.length, HOST_RELAY_IPC_LENGTH_BYTES + 128)).includes(Buffer.from(`"schema_version":"${HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA}"`, "utf8"));
 }
-function exactKeys4(value, keys) {
-  return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+function exactKeys4(value, required, optional = []) {
+  const keys = Object.keys(value);
+  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
 }
 function safeRef3(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
@@ -3541,6 +4068,160 @@ async function closeServer(server, sockets, endpoint) {
   await new Promise((resolve) => server.close(() => resolve()));
   if (process.platform !== "win32") await unlink2(endpoint).catch(() => void 0);
 }
+var relayEndpointLocks = /* @__PURE__ */ new Map();
+function withRelayEndpointLock(endpoint, run) {
+  const prior = relayEndpointLocks.get(endpoint) ?? Promise.resolve();
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const tail = prior.then(() => gate);
+  relayEndpointLocks.set(endpoint, tail);
+  return prior.then(run).finally(() => {
+    release?.();
+    if (relayEndpointLocks.get(endpoint) === tail) relayEndpointLocks.delete(endpoint);
+  });
+}
+function currentUid(fallback) {
+  return typeof process.geteuid === "function" ? process.geteuid() : fallback;
+}
+async function assertTrustedEndpointParent(endpoint) {
+  const parent = dirname3(endpoint);
+  let stats;
+  try {
+    stats = await lstat3(parent);
+  } catch {
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint parent is unavailable; leaving it untouched.");
+  }
+  if (!stats.isDirectory() || stats.uid !== currentUid(stats.uid) || (stats.mode & 63) !== 0) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint parent is not an owner-private directory; leaving it untouched.");
+}
+var HOST_RELAY_ENDPOINT_PROBE_TIMEOUT_MS = 1e3;
+function probeRelayEndpoint(endpoint) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const socket = createConnection(endpoint);
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(outcome);
+    };
+    const timer = setTimeout(() => finish("ambiguous"), HOST_RELAY_ENDPOINT_PROBE_TIMEOUT_MS);
+    timer.unref?.();
+    socket.once("connect", () => finish("live"));
+    socket.once("error", (error) => {
+      const code = errorCode8(error);
+      if (code === "ECONNREFUSED") finish("stale");
+      else if (code === "ENOENT") finish("missing");
+      else finish("ambiguous");
+    });
+  });
+}
+async function removeStaleRelayEndpoint(endpoint, testHooks) {
+  const observed = await readEndpointStats(endpoint);
+  if (observed === null) return;
+  if (!observed.isSocket()) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already present and is not a socket; leaving it untouched.");
+  if (observed.uid !== currentUid(observed.uid)) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is not owned by the current uid; leaving it untouched.");
+  const captured = { uid: observed.uid, dev: observed.dev, ino: observed.ino };
+  await requireStaleEndpoint(endpoint);
+  await testHooks?.beforeRemoveStaleEndpoint?.(endpoint);
+  const current = await readEndpointStats(endpoint);
+  if (current === null) return;
+  requireSameEndpointIdentity(current, captured, "Host Relay IPC endpoint changed before cleanup; leaving it untouched.");
+  await unlinkRelayEndpoint(endpoint);
+}
+async function requireStaleEndpoint(endpoint) {
+  switch (await probeRelayEndpoint(endpoint)) {
+    case "missing":
+    case "stale":
+      return;
+    case "live":
+      throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already served by a live Relay; leaving it untouched.");
+    case "ambiguous":
+      throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint liveness is ambiguous; leaving it untouched.");
+  }
+}
+async function readEndpointStats(endpoint) {
+  try {
+    return await lstat3(endpoint);
+  } catch (error) {
+    if (errorCode8(error) === "ENOENT") return null;
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint identity is ambiguous; leaving it untouched.");
+  }
+}
+function requireSameEndpointIdentity(current, owned, message) {
+  if (!current.isSocket() || current.uid !== owned.uid || current.dev !== owned.dev || current.ino !== owned.ino) throw new HostRelayIpcError("relay_unavailable", message);
+}
+async function unlinkRelayEndpoint(endpoint) {
+  try {
+    await unlink2(endpoint);
+  } catch (error) {
+    if (errorCode8(error) !== "ENOENT") throw error;
+  }
+}
+var relayStagingSequence = 0;
+function stagingRelayEndpoint(canonical) {
+  const parent = dirname3(canonical);
+  const pid = process.pid.toString(36);
+  const sequence = (relayStagingSequence++ % (36 * 36)).toString(36);
+  return join6(parent, `.r${pid}${sequence}`);
+}
+async function readStagingRelayEndpointIdentity(staging) {
+  let created;
+  try {
+    created = await lstat3(staging);
+  } catch {
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is unavailable after listen; leaving it untouched.");
+  }
+  if (!created.isSocket()) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint was replaced before this server listened; leaving it untouched.");
+  if (created.uid !== currentUid(created.uid)) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is not owned by the current uid after listen; leaving it untouched.");
+  return { uid: created.uid, dev: created.dev, ino: created.ino };
+}
+async function listenStagingRelayEndpoint(server, sockets, staging) {
+  try {
+    await listen(server, staging);
+  } catch (error) {
+    await abandonRelayServer(server, sockets);
+    throw error;
+  }
+}
+async function publishStagingRelayEndpoint(staging, owned, canonical) {
+  const incumbent = await readEndpointStats(canonical);
+  if (incumbent !== null) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint was replaced before this server listened; leaving it untouched.");
+  await rename2(staging, canonical);
+  const published = await readEndpointStats(canonical);
+  if (published === null) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is unavailable after listen; leaving it untouched.");
+  requireSameEndpointIdentity(published, owned, "Host Relay IPC endpoint was replaced before this server listened; leaving it untouched.");
+  return { uid: published.uid, dev: published.dev, ino: published.ino };
+}
+async function releaseOwnedRelayEndpoint(server, sockets, endpoint, owned) {
+  await abandonRelayServer(server, sockets);
+  try {
+    const current = await readEndpointStats(endpoint);
+    if (current === null) return;
+    requireSameEndpointIdentity(current, owned, "Host Relay IPC endpoint changed while releasing a failed startup; leaving it untouched.");
+    await unlinkRelayEndpoint(endpoint);
+  } catch {
+  }
+}
+async function closeRelayServer(server, sockets, endpoint, owned, testHooks) {
+  await withRelayEndpointLock(endpoint, async () => {
+    for (const socket of sockets) socket.destroy();
+    await new Promise((resolve) => server.close(() => resolve()));
+    await testHooks?.beforeRemoveOwnedEndpoint?.(endpoint);
+    const current = await readEndpointStats(endpoint);
+    if (current === null) return;
+    requireSameEndpointIdentity(current, owned, "Host Relay IPC endpoint was replaced after this server listened; leaving it untouched.");
+    await unlinkRelayEndpoint(endpoint);
+  });
+}
+async function abandonRelayServer(server, sockets) {
+  for (const socket of sockets) socket.destroy();
+  await new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
 function errorCode8(error) {
   return record4(error) && typeof error.code === "string" ? error.code : null;
 }
@@ -3562,7 +4243,7 @@ async function readHostRelayConfig(path) {
   if (!isAbsoluteNormalizedNonRootPath(path, process.platform, true)) throw new HostRelayConfigError("invalid_config_path", `invalid_config_path: Host Relay config path is invalid: ${refusalFact("config_path", path, "absolute, normalized, and non-root")}.`);
   let handle;
   try {
-    await assertOwnerPrivateDirectory2(dirname3(path));
+    await assertOwnerPrivateDirectory2(dirname4(path));
     handle = await open5(path, O_RDONLY4 | O_NOFOLLOW3);
     const stats = await handle.stat();
     if (!stats.isFile() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not owner-private.");
@@ -3587,7 +4268,7 @@ async function readHostRelayConfig(path) {
 }
 function validateHostRelaySourcePaths(config) {
   try {
-    assertHostRelaySourcePaths(dirname3(config.registration_state_file), config);
+    assertHostRelaySourcePaths(dirname4(config.registration_state_file), config);
   } catch (error) {
     throw new HostRelayConfigError("invalid_config", error instanceof Error ? error.message : "Host Relay source tuple is invalid.");
   }
@@ -3617,10 +4298,10 @@ function validConfigRuntime(value) {
 var HOST_RELAY_INVOCATION_MINT_LOG_TAG = "[host-relay-invocation-mint]";
 var HOST_RELAY_INVOCATION_MINT_LINE = new RegExp(`^${HOST_RELAY_INVOCATION_MINT_LOG_TAG.replace(/[[\]]/gu, "\\$&")} outcome=([a-z_]+)(?: reason=([a-z][a-z0-9_]{0,63}))? elapsed_ms=[0-9]+$`, "u");
 async function serveHostRelay(config, signal, dependencies = {}) {
-  const admission = new RelayAdmissionStore(join6(config.state_root, "admission"));
-  const bindings = new RelayRequestBindingStore(join6(config.state_root, "bindings"));
+  const admission = new RelayAdmissionStore(join7(config.state_root, "admission"));
+  const bindings = new RelayRequestBindingStore(join7(config.state_root, "bindings"));
   const gateway = (dependencies.createGateway ?? createHostRelayGatewayHttpPort)({ registration_state_file: config.registration_state_file, host_source_ref: config.host_source_ref });
-  const bridge = new RelayGatewayBridge({ state_root: join6(config.state_root, "gateway"), host_source_ref: config.host_source_ref, gateway, timeout_ms: config.gateway_timeout_ms, on_request_bound: async (binding) => {
+  const bridge = new RelayGatewayBridge({ state_root: join7(config.state_root, "gateway"), host_source_ref: config.host_source_ref, gateway, timeout_ms: config.gateway_timeout_ms, on_request_bound: async (binding) => {
     await bindings.bind(binding);
   } });
   let server;
@@ -3661,7 +4342,11 @@ function invocationMintRefusalReason(error, cancellation) {
   if (error.code === "gateway_unavailable") return "gateway_unavailable";
   if (error.code === "invalid_response") return "gateway_response_invalid";
   if (error.code !== "gateway_refused") return "mint_failed";
-  return (error.error_code === void 0 ? void 0 : GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code)) ?? "gateway_refused";
+  return gatewayMintRefusalReason(error);
+}
+function gatewayMintRefusalReason(error) {
+  if (error.error_code === "request_context_refused" && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, error.refusal_reason)) return error.refusal_reason;
+  return GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code ?? "") ?? "gateway_refused";
 }
 var GATEWAY_MINT_REFUSAL_REASONS = /* @__PURE__ */ new Map([
   ["request_context_refused", "context_stale"],