@corca-org/ceal-host-linux-arm64 1.0.20 → 1.0.21

package/libexec/ceal-host/codex-invocation-authentication.mjs

@@ -2059,16 +2059,34 @@ function isPlainRecord(value) {
   return prototype === Object.prototype || prototype === null;
 }
 
+// packages/ceal-client-protocol/src/client-wire-contract.ts
+import { createHash } from "node:crypto";
+
 // packages/ceal-client-protocol/client-wire-contract.json
 var client_wire_contract_default = {
   schema_version: "ceal.client_wire_contract.v1",
+  doctor: {
+    schema_version: "ceal.doctor.v1"
+  },
+  client_commands: {
+    doctor: ["doctor"],
+    version: ["version"],
+    access_group_list: ["access-group", "list"]
+  },
+  client_environment: {
+    environment_prefix: "CEAL",
+    context_override_suffixes: ["GATEWAY_ORIGIN", "GATEWAY_TRANSPORT_ORIGIN", "ACCESS_TOKEN", "CONTEXT_STORE_PATH"]
+  },
   canonical_json: {
     ordering: "utf16_code_unit_ascending"
   },
   artifact_descriptor: {
-    operation_contract_bundle_schema_version: "ceal.operation_contract_bundle.v1",
-    schema_version: "ceal.verified_artifact_descriptor.v1",
-    binding_schema_version: "ceal.verified_artifact_binding.v1",
+    operation_contract_bundle_schema_name: "ceal.operation_contract_bundle",
+    operation_contract_bundle_fields: ["schema_version", "catalog_revision", "operations", "failure_guidance"],
+    schema_name: "ceal.verified_artifact_descriptor",
+    fields: ["schema_version", "kind", "media_type", "byte_count", "sha256", "binding"],
+    binding_schema_name: "ceal.verified_artifact_binding",
+    binding_fields: ["schema_version", "kind", "catalog_revision"],
     kind: "verified_artifact",
     binding_kind: "catalog",
     media_type: "application/json",
@@ -2084,14 +2102,16 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    envelope_max_bytes: 389
+    envelope_max_bytes: 407
   },
   command_request: {
-    schema_version: "ceal.command_request.v1",
+    schema_name: "ceal.command_request",
+    fields: ["schema_version", "argv", "operation", "client_nonce", "context_token"],
     absolute_transport_max_bytes: 65536
   },
   command_resolution: {
-    schema_version: "ceal.gateway_command_resolution.v1",
+    schema_name: "ceal.gateway_command_resolution",
+    fields: ["schema_version", "kind", "ok", "execution_started", "program", "route", "authority", "routes", "operations", "required_action_sequence", "semantic_options", "result_delivery", "operation", "invocation", "entrypoints", "common_concepts", "withheld", "catalog_revision", "operation_id", "input", "transport", "output", "unresolved_inputs", "unresolved_refusal", "attempted_route", "did_you_mean", "error"],
     authority: {
       anonymous: {
         state: "anonymous",
@@ -2131,7 +2151,8 @@ var client_wire_contract_default = {
     }
   },
   command_response: {
-    schema_version: "ceal.command_response.v1",
+    schema_name: "ceal.command_response",
+    fields: ["schema_version", "exit_code", "document", "operation_id", "visible_output_max_bytes", "local_delivery", "verified_artifact"],
     descriptor_field: "verified_artifact",
     required_fields: [
       "schema_version",
@@ -2155,29 +2176,41 @@ var client_wire_contract_default = {
       "required_action_sequence",
       "withheld"
     ],
-    prompt_field: "prompt",
-    prompt_schema_version: "ceal.prompt.v1",
-    focused_prompt_document_fields: [
-      "catalog_revision",
-      "prompt"
-    ],
-    focused_prompt_continuation_document_fields: [
-      "catalog_revision",
-      "remaining_work",
-      "prompt"
-    ],
     discovery_command: "discovery",
-    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
+    discovery_manifest_schema_name: "ceal.discovery_manifest",
+    discovery_manifest_fields: ["schema_version", "skill", "authority_scope", "connector_kinds", "personal_connector_kinds", "guide_markdown", "renderer_version", "digest"],
     discovery_manifest_document_fields: [
       "discovery_manifest"
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019
+    complete_max_bytes: 66046
+  },
+  host_invocation_authentication: {
+    request_schema_name: "ceal.host_invocation_authentication_request",
+    request_fields: [
+      "schema_version",
+      "client_nonce"
+    ],
+    result_schema_name: "ceal.host_invocation_authentication_result",
+    result_fields: [
+      "schema_version",
+      "context_token",
+      "expires_at"
+    ],
+    client_nonce: {
+      character_class_source: "A-Za-z0-9_-",
+      encoded_characters: 43
+    }
+  },
+  gateway_host_invocation_context_request: {
+    schema_name: "ceal.gateway_host_invocation_context_request",
+    fields: ["schema_version", "client_nonce", "context_expires_at", "request_work_context", "current_prompt", "visible_output_max_bytes"]
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
-    request_schema_version: "ceal.resource_stream_request.v1",
+    request_schema_name: "ceal.resource_stream_request",
+    request_fields: ["schema_version", "resource_ref", "client_nonce", "context_token"],
     ref_pattern: "^resource:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
     media_type_pattern: "^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$",
     filename_max_bytes: 512,
@@ -2194,92 +2227,6 @@ var client_wire_contract_default = {
   }
 };
 
-// packages/ceal-client-protocol/src/client-wire-contract.ts
-var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
-var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
-var commandResolutionAuthority = commandResolution.authority;
-var commandResolutionSemanticOptions = commandResolution.semantic_options;
-var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
-var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
-var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
-var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
-var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
-var CEAL_OPERATION_CONTRACT_BUNDLE_SCHEMA_VERSION = artifact.operation_contract_bundle_schema_version;
-var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_SCHEMA_VERSION = artifact.schema_version;
-var CEAL_VERIFIED_ARTIFACT_BINDING_SCHEMA_VERSION = artifact.binding_schema_version;
-var CEAL_VERIFIED_ARTIFACT_KIND = artifact.kind;
-var CEAL_VERIFIED_ARTIFACT_BINDING_KIND = artifact.binding_kind;
-var CEAL_VERIFIED_ARTIFACT_MEDIA_TYPE = artifact.media_type;
-var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
-var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
-var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
-var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
-var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
-var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
-var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
-var CEAL_COMMAND_RESPONSE_PROMPT_FIELD = response.prompt_field;
-var CEAL_COMMAND_RESPONSE_PROMPT_SCHEMA_VERSION = response.prompt_schema_version;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
-var CEAL_COMMAND_RESPONSE_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.bare_document_fields, response.prompt_field]);
-var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_document_fields]);
-var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_continuation_document_fields]);
-var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
-var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
-var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
-
-// packages/ceal-client-protocol/src/vocabulary.ts
-function vocabulary(words) {
-  return Object.freeze(words);
-}
-function isVocabularyWord(words, value) {
-  return words.some((word) => word === value);
-}
-
-// packages/ceal-client-protocol/src/gateway-response-types.ts
-var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
-var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
-var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
-var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
-var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
-var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
-var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
-var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
-var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
-var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
-var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
-var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
-var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
-var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
-var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
-var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
-var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
-var CEAL_PROTOCOL_VERSION = "1.4.0";
-var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
-var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
-var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
-  "audited_call_pending",
-  "continuation_read_pending",
-  "continuation_write_pending",
-  "provider_pacing_pending",
-  "corpus_replay_pending",
-  "corpus_append_pending",
-  "corpus_fence_pending",
-  "corpus_content_pending",
-  "corpus_transaction_pending"
-]);
-var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
-var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
-var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
-var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
-  "connector_ref",
-  "connector_revision",
-  "policy_decision_revision"
-]);
-
 // packages/ceal-client-protocol/src/operation-next-actions.ts
 var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
 var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
@@ -2346,7 +2293,10 @@ var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "follow_required_action_sequence",
   // The command needs caller-owned local materialization (for example an
   // @path file) before the Gateway can receive the argument.
-  "materialize_local_argument"
+  "materialize_local_argument",
+  // A peer's derived schema identifier changed with its field set; install or
+  // upgrade the CLI and Host Relay to the Gateway's release before retrying.
+  "upgrade_ceal_client"
 ];
 var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
 var NON_REMEDY_NEXT_ACTION_VALUES = [
@@ -2459,47 +2409,56 @@ var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
   personal_authorization_required: "connect_personal_account"
 });
 
-// packages/ceal-client-protocol/src/operation-withheld-cause.ts
-var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+// packages/ceal-client-protocol/src/vocabulary.ts
+function vocabulary(words) {
+  return Object.freeze(words);
+}
+function isVocabularyWord(words, value) {
+  return words.some((word) => word === value);
+}
 
-// packages/ceal-client-protocol/src/operation-contract-types.ts
-var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
-var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
-var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
-var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
-var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
-var SAFETY_CLASSES = vocabulary(["routine", "sensitive", "high_impact"]);
-var IDEMPOTENCY_CLASSES = vocabulary(["idempotent", "conditionally_idempotent", "non_idempotent"]);
-var REVERSIBILITY_CLASSES = vocabulary(["none", "reversible", "compensatable", "irreversible"]);
-var COMPENSATION_OWNERS = vocabulary(["none", "connector", "operator"]);
-var CANCELLATION_BOUNDARIES = vocabulary(["before_admission", "before_handoff", "after_handoff_reconcile"]);
-var HANDOFF_CLASSES = vocabulary(["not_applicable", "submission", "effect"]);
-var AUTHORITATIVE_READBACK_CLASSES = vocabulary(["required", "unavailable"]);
-var PROVIDER_READBACK_CLASSES = vocabulary(["required", "not_available", "not_applicable"]);
-var RECONCILIATION_CLASSES = vocabulary(["none", "automatic", "operator"]);
-var NO_READBACK_APPROVAL_CLASSES = vocabulary(["not_applicable", "explicit", "operator"]);
-var REPLAY_PREREQUISITES = vocabulary(["never", "fresh_admission", "reconciled_non_application", "operator_approval"]);
-var UNKNOWN_OUTCOMES = vocabulary(["reconcile", "operator_action", "excluded"]);
-var RECOVERY_OWNERS = vocabulary(["gateway", "connector", "operator"]);
-var CEAL_OPERATION_ADMISSION_STATES = vocabulary(["proposed", "refused", "admitted"]);
-var CEAL_OPERATION_EXECUTION_STATES = vocabulary(["not_started", "started", "completed"]);
-var CEAL_OPERATION_PROVIDER_HANDOFF_STATES = vocabulary(["not_offered", "offered", "accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_EFFECT_STATES = vocabulary(["none", "applied", "failed", "unknown", "compensated"]);
-var CEAL_OPERATION_OBSERVATION_STATES = vocabulary(["not_started", "not_required", "pending", "observed", "unavailable"]);
-var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate", "operator_action"]);
-var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
-var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
-var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
-var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
-  "approval_not_required_by_policy",
-  "interactive_pending",
-  "interactive_granted",
-  "interactive_denied",
-  "interactive_expired",
-  "interactive_unavailable"
+// packages/ceal-client-protocol/src/gateway-response-types.ts
+var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
+var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
+var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
+var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
+var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
+var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
+var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
+var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
+var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
+var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
+var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
+var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
+var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
+var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
+var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
+var CEAL_PROTOCOL_VERSION = "1.4.0";
+var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_GATEWAY_CALL_RESULT_SCHEMA_VERSION = "ceal.gateway_call_result.v1";
+var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
+var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
+  "audited_call_pending",
+  "continuation_read_pending",
+  "continuation_write_pending",
+  "provider_pacing_pending",
+  "corpus_replay_pending",
+  "corpus_append_pending",
+  "corpus_fence_pending",
+  "corpus_content_pending",
+  "corpus_transaction_pending"
+]);
+var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
+var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
+var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
+var CEAL_GATEWAY_AUDIT_CALL_DETAIL_SCHEMA_VERSION = "ceal.gateway_audit_call_detail.v1";
+var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
+  "connector_ref",
+  "connector_revision",
+  "policy_decision_revision"
 ]);
 
 // packages/ceal-client-protocol/src/gateway-validation-primitives.ts
@@ -2541,10 +2500,10 @@ function assertSafeJsonArray(value, options, depth, count) {
   if (value.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   for (const item of value) assertSafeJsonValue(item, options, depth + 1, count);
 }
-function assertSafeJsonRecord(record3, options, depth, count) {
-  const entries = Object.entries(record3);
+function assertSafeJsonRecord(record2, options, depth, count) {
+  const entries = Object.entries(record2);
   if (entries.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
-  const sourceUrlColumn = options.allowHttpsUrl ? compactSourceUrlColumn(record3.fields) : null;
+  const sourceUrlColumn = options.allowHttpsUrl ? compactSourceUrlColumn(record2.fields) : null;
   for (const [key, child] of entries) {
     if (key === "credential_material_included" && child !== false) invalidByContext(options);
     if (!isSafeNegativeMaterialAssertion(key, child)) assertSafeJsonKey(key, options);
@@ -2639,6 +2598,11 @@ function isCealJsonRecord(value) {
 }
 var CEAL_VALIDATION_STATUSES = vocabulary(["not_applicable", "valid", "invalid"]);
 var CEAL_PARSE_STATUSES = vocabulary(["not_applicable", "parsed", "parse_failed"]);
+function hasExactKeys(value, expected) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
 function invalidByContext(options) {
   if (options.forbidAuthorityKeys) invalidRequest();
   invalidResponse();
@@ -2713,51 +2677,6 @@ function cut(text) {
   return text.length <= REFUSAL_VALUE_MAX_CHARS ? text : `${text.slice(0, REFUSAL_VALUE_MAX_CHARS)}...(+${text.length - REFUSAL_VALUE_MAX_CHARS} chars)`;
 }
 
-// packages/ceal-client-protocol/src/operation-access-class.ts
-var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
-
-// packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
-var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
-var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
-var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
-var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
-var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
-var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
-var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
-var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
-var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
-var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
-var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
-
-// packages/ceal-client-protocol/src/safe-json-budget.ts
-var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
-function safeJsonNodeBudgetForBytes(maxBytes) {
-  if (!Number.isSafeInteger(maxBytes) || maxBytes < SAFE_JSON_MIN_BYTES_PER_NODE) {
-    throw new RangeError(`safe-JSON byte cap is invalid: ${refusalFact("maxBytes", maxBytes, `at least ${SAFE_JSON_MIN_BYTES_PER_NODE} bytes`)}`);
-  }
-  return Math.floor(maxBytes / SAFE_JSON_MIN_BYTES_PER_NODE);
-}
-
-// packages/ceal-client-protocol/src/protocol-bounds.ts
-var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES = 64 * 1024;
-var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_NODES = safeJsonNodeBudgetForBytes(CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES);
-var OPERATION_SCHEMA_LITERAL_MAX_BYTES = CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES / 4;
-var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
-  max_depth: 8,
-  max_properties: 96,
-  max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
-  max_alternatives: 8,
-  max_enum_values: 64,
-  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
-  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
-  max_description_characters: 1024,
-  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
-  max_pattern_characters: 256,
-  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
-  max_literal_nodes: 512
-});
-
 // packages/ceal-client-protocol/src/operation-validation-primitives.ts
 var ISO_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?([Zz]|([+-])(\d{2}):(\d{2}))$/u;
 var CEAL_CALENDAR_DATE_PATTERN_SOURCE = "^\\d{4}-\\d{2}-\\d{2}$";
@@ -2825,38 +2744,366 @@ function requireIsoTimestamp(value, message) {
   if (!isCealIsoTimestamp(value)) throw new TypeError(message);
 }
 
-// packages/ceal-client-protocol/src/operation-json-schema.ts
-var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
-
-// packages/ceal-client-protocol/src/operation-contract-validation.ts
-var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
-var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
-var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
-var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
-
-// packages/ceal-client-protocol/src/operation-catalog.ts
-var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
-var CLIENT_AUDIENCES = Object.freeze(["ceal", "cealctl", "agent"]);
-var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
+// packages/ceal-client-protocol/src/failure-guidance-table.ts
+var CEAL_FAILURE_REDACTION_CLASSES = vocabulary(["model_safe", "withheld"]);
+var CEAL_GATEWAY_STARTING_FAILURE_CODE = "gateway_starting";
+var CEAL_OWNER_BOOTSTRAP_ABSENT_FAILURE_CODE = "bootstrap_absent";
+var CEAL_OWNER_BOOTSTRAP_UNAVAILABLE_FAILURE_CODE = "bootstrap_unavailable";
+var LOCAL_COMMAND_INVALID = "The local command or argument is invalid.";
+var LOCAL_TRANSPORT_INCOMPLETE = "The local Ceal transport could not complete; report this as a gap.";
+var GATEWAY_TRANSPORT_UNAVAILABLE = "The Gateway transport is unavailable; ask an administrator to restore Gateway availability.";
+var HOST_AUTHENTICATION_UNAVAILABLE = "The Host could not authenticate this invocation; report this as a gap.";
+var SESSION_CONTEXT_UNAVAILABLE = "The local Gateway session context is unavailable.";
+function guidance(message, next_action, http_status, retryable = false, redaction_class = "model_safe") {
+  return Object.freeze({ message, next_action, http_status, retryable, redaction_class });
+}
+var CEAL_FAILURE_GUIDANCE_TABLE = Object.freeze({
+  invalid_command: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 400),
+  invalid_argument: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 400),
+  command_not_found: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 404),
+  unknown_operation: guidance("The requested Operation is absent from the current verified catalog; report this as a gap unless a catalog suggestion names a replacement.", "answer_with_gap", 404),
+  local_route_unavailable: guidance("The requested local route is unavailable or its descriptor is invalid; report this as a gap.", "answer_with_gap", 404),
+  local_route_ambiguous: guidance("The requested local route is ambiguous; no local executable was selected. Report this as a gap.", "answer_with_gap", 400),
+  local_execution_unavailable: guidance("The selected local route executable is unavailable; report this as a gap.", "answer_with_gap", 500),
+  local_pickup_failed: guidance("The Host Request pickup failed; the Gateway command was not sent. Report this as a gap.", "answer_with_gap", 502),
+  invocation_authentication_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 401),
+  local_execution_cancellation_unknown: guidance("The selected local route cancellation outcome is unknown; a retry can repeat an effect the cancelled route already completed. Report this as a gap and do not retry.", "answer_with_gap", 409),
+  gateway_origin_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  access_token_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_pair_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_not_selected: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_store_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_store_conflict: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_expired: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_replayed: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_revoked: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_recovery_unavailable: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_custody_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  session_store_unwritable: guidance("The Ceal client could not write its local session store; the operating system refused the write (EACCES, EPERM, or EROFS). rerun_outside_agent_sandbox reruns it with escalated execution.", "rerun_outside_agent_sandbox", 500),
+  local_output_exists: guidance("The selected local output path already exists; nothing was written to it.", "choose_new_output_path", 400),
+  local_output_outside_result_root: guidance("The selected local output path lies outside this run's result root; only a path inside the result root named here is writable.", "choose_new_output_path", 400),
+  local_output_unwritable: guidance("The Ceal client could not write the result file at its local path; the operating system refused the write. When that step followed the Gateway call, the call may already have completed a write effect that a rerun repeats. rerun_outside_agent_sandbox reruns it with escalated execution.", "rerun_outside_agent_sandbox", 500),
+  local_output_unavailable: guidance("The Gateway result could not be materialized at the selected local path; report this as a gap.", "answer_with_gap", 500),
+  local_materialization_required: guidance("The Gateway result could not be materialized at the selected local path; report this as a gap.", "answer_with_gap", 500),
+  contract_artifact_cache_invalid: guidance("The verified contract artifact could not be stored in the private local cache; report this as a gap.", "answer_with_gap", 500),
+  response_encoding_failed: guidance("The local response could not be encoded; report this as a gap.", "answer_with_gap", 500),
+  request_timeout: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 504),
+  request_failed: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 502),
+  gateway_unavailable: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 503, true),
+  contract_mismatch: guidance("Install or upgrade the Ceal CLI and Host Relay to the same release as the Gateway, then retry.", "upgrade_ceal_client", 409),
+  // `gateway_starting` is the one retryable envelope the serving gate answers on every route while starting
+  // (`cli/internal/client/gateway_startup_wait.go` re-drives it); the sentence is the client default that renders
+  // when the wait ends still unserved, moved from the `localFailureText` default branch.
+  [CEAL_GATEWAY_STARTING_FAILURE_CODE]: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503, true),
+  gateway_internal_error: guidance("The Gateway failed without exposing internal state; report this as a gap.", "answer_with_gap", 500),
+  // The serving gate emits this code with no message; the sentence is the owner-normalized form of the
+  // `gateway_internal_error` guidance (decided with the operator 2026-10-13).
+  internal_error: guidance("The Gateway failed without exposing internal state.", "answer_with_gap", 500),
+  // Owned by the Gateway canonical adapter (`gateway/core/src/gateway-canonical-operation-http-adapter.ts`):
+  // the client variant of this sentence in `localFailureText` was retired when the client started reading this table.
+  request_body_too_large: guidance("The Gateway request body exceeds its bounded limit.", "reduce_request_size", 413),
+  // Restored verbatim from the retired `localFailureText` `unknown_outcome`
+  // case: the outcome is unknown, so a read may be retried while a write
+  // must receipt-check first. Collapsing both to "do not repeat the call"
+  // forbids the safe read retry the sentence exists to allow.
+  unknown_outcome: guidance("The transport outcome is unknown: a read may be retried; for a write, check write_receipt.get before repeating.", "answer_with_gap", 500),
+  // Restored verbatim from the retired `localFailureText`
+  // `refresh_unknown_outcome` case: a refresh that ends unknown leaves the
+  // session context unavailable, so the caller repairs or adopts the
+  // session instead of reporting a transport gap.
+  refresh_unknown_outcome: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  request_cancelled: guidance("The caller cancelled the request before it completed.", "retry", 400, true),
+  expired: guidance("The activation transaction or its administrator approval request expired before completion; repeat the original activation arguments to start a new transaction.", "repeat_original_arguments", 410, true),
+  denied: guidance("An administrator denied this device's activation request; ask an administrator whether to reconsider it.", "ask_admin", 403),
+  device_approval_pending_limit: guidance("Device approval requests are already waiting for an administrator decision; ask an administrator to decide a pending request before adding another device.", "ask_admin", 429),
+  session_already_adopted: guidance("The requested enrollment was not started because this machine already has a live session with the Gateway. Report this as a gap if that local session needs replacement.", "answer_with_gap", 409),
+  pending_adoption_limit: guidance("This device's pending activation file is full; another activation is refused while an administrator decision is pending. Report this as a gap.", "answer_with_gap", 429),
+  recovery_required: guidance("The Gateway could not safely complete the activation transaction automatically; ask an administrator to recover this transaction.", "ask_admin", 500),
+  unsupported_feature: guidance("This Ceal client does not support the Gateway's required activation protocol; ask an administrator to update the client.", "ask_admin", 501),
+  // Activation commit codes rendered through the `localFailureText` default before phase 2b; `retryable` is moved from the
+  // emitting sites in `cli/internal/client/gateway_installation_activation.go` and `activation.go:483`.
+  activation_state_commit_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500, true),
+  activation_response_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502, true),
+  activation_rejected: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502),
+  activation_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_binding: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_crypto: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_state_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  // Long-tail local codes rendered through the `localFailureText` default before phase 2b; sentences moved from that branch.
+  invalid_response: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  invalid_configuration: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_state_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_code_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_code_file_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_code_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 404),
+  bootstrap_file_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  bootstrap_not_active: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 409),
+  bootstrap_unauthorized: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  // The Gateway owner-bootstrap store file was never created, so the Gateway
+  // holds no owner bootstrap to exchange (`gateway/src/host/owner-bootstrap-http-composition.ts`
+  // `absent`, stored at `gateway/src/shared/installation/owner-bootstrap-store.ts:162`);
+  // the sentence is the owner-normalized form of that store error. Non-retryable:
+  // repeating the exchange cannot create the store; only an administrator
+  // placing a bootstrap (fresh gateway setup) changes the outcome.
+  [CEAL_OWNER_BOOTSTRAP_ABSENT_FAILURE_CODE]: guidance("The Gateway holds no owner bootstrap to exchange; report this as a gap.", "answer_with_gap", 503),
+  // The Gateway owner-bootstrap store file exists but cannot be read, so the
+  // exchange cannot proceed (`gateway/src/host/owner-bootstrap-http-composition.ts`
+  // `unavailable`, stored at `gateway/src/shared/installation/owner-bootstrap-store.ts:163`);
+  // the sentence is the owner-normalized form of that store error. Retryable:
+  // unlike `absent`, a later exchange may succeed once the store is readable.
+  [CEAL_OWNER_BOOTSTRAP_UNAVAILABLE_FAILURE_CODE]: guidance("The Gateway owner bootstrap store is unavailable; retry the exchange.", "retry", 503, true),
+  context_selection_ambiguous: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  session_authority_unverified: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  session_authority_mismatch: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 409),
+  local_credential_lost: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  local_capability_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  host_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503),
+  host_activation_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  doctor_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503),
+  admin_sign_in_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502),
+  // `invalid_request` renders through the client default today (local encode/path faults); Gateway-answered
+  // envelopes carry the Gateway message verbatim and never read this sentence.
+  invalid_request: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  // Gateway canonical-route codes, sentences moved from their minting adapters; statuses moved from the
+  // `valid*Failure` decoder maps in `cli/internal/client/gateway_api.go` and `transport.go`.
+  invalid_json: guidance("The Gateway request body must be valid JSON.", "answer_with_gap", 400),
+  // Per-route variants name their route; the table holds the one stable guidance and the route's `allow`
+  // header stays the measured fact (decided with the operator 2026-10-13).
+  method_not_allowed: guidance("The HTTP method is not allowed for this Gateway route.", "answer_with_gap", 405),
+  request_target_too_large: guidance("The Gateway request target exceeds its bounded limit.", "reduce_request_size", 414),
+  route_not_found: guidance("The Gateway route is not present.", "answer_with_gap", 404),
+  artifact_unavailable: guidance("The Gateway artifact is unavailable.", "answer_with_gap", 503),
+  discovery_unavailable: guidance("The Gateway discovery manifest is unavailable.", "answer_with_gap", 503),
+  serialization_failed: guidance("The Gateway response could not be serialized.", "answer_with_gap", 500),
+  request_header_too_large: guidance("A consumed Gateway request header exceeds its bounded limit.", "answer_with_gap", 431),
+  request_work_context_missing: guidance("The Gateway command requires a Request work context.", "answer_with_gap", 400),
+  request_work_context_invalid: guidance("The Gateway Request work context encoding is invalid.", "answer_with_gap", 400),
+  request_work_context_refused: guidance("The Host-only discovery manifest takes no Request work context.", "answer_with_gap", 400),
+  // Moved from `gateway/src/operations/http-composition.ts` (`unauthorized`) and `command-runtime.ts:827`
+  // (`artifact_stale`); both travel with Gateway messages verbatim online, so these sentences are the
+  // owner fallback guidance. `unauthorized` re-authenticates through the session, hence its action.
+  unauthorized: guidance("Unauthorized.", "repair_or_adopt_session", 401),
+  artifact_stale: guidance("The requested contract artifact is not the current catalog artifact.", "answer_with_gap", 409),
+  // Host mint classifications. The CLI emits `invocation_authentication_unavailable` with the classification
+  // in its detail fact; rows without their own sentence share that code's moved sentence, while `next_action`
+  // is moved from `canonicalHostAuthenticationNextActions` (generated from `CEAL_HOST_AUTHENTICATION_POLICY`)
+  // and `retryable` from `hostAuthenticationFailureForCause` (`failure.nextAction == "retry"`). The three rows
+  // with their own sentences carry the retired policy remedies as Gateway-owned guidance. Statuses are the
+  // Gateway-owned mapping decided with the operator 2026-10-13. This covers every wire cause the maps at
+  // `host/invocation-authentication-command.ts:217-242` emit, through their policy classifications.
+  host_arguments_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 400),
+  host_configuration_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500),
+  host_session_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 401),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // missing exact-turn fact names the fresh Host turn, not a reinstall.
+  host_context_unavailable: guidance("The Host has not activated an invocation context for this session yet. Wait for the Host turn hook to register the session, then retry this command.", "retry", 401, true),
+  host_invocation_context_stale: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 401, true),
+  host_invocation_context_expired: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 401, true),
+  host_source_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 403),
+  host_registration_credential_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "ask_admin", 403),
+  host_mint_gateway_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "ask_admin", 503),
+  host_mint_gateway_rate_limited: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 429),
+  host_mint_gateway_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  host_mint_gateway_response_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // producer-frame fault names the administrator repair step.
+  host_producer_frame_invalid: guidance("Ask an administrator to inspect and repair the producer frame, then start a fresh Host turn.", "ask_admin", 400),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // sandboxed Relay socket names the run-alone retry.
+  host_relay_permission_denied: guidance("An agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox.", "rerun_outside_agent_sandbox", 403),
+  host_relay_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 503),
+  host_mint_transient_retryable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 503, true),
+  host_mint_failed: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500),
+  host_relay_failed: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  host_refusal_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500)
+});
+function cealFailureGuidanceForCode(code) {
+  const entry = CEAL_FAILURE_GUIDANCE_TABLE[code];
+  if (entry === void 0) throw new TypeError(`Failure guidance code is not guided: ${code}.`);
+  return entry;
+}
+var FAILURE_GUIDANCE_ENTRY_KEYS = Object.freeze(["message", "next_action", "http_status", "retryable", "redaction_class"]);
 
-// packages/ceal-client-protocol/src/schema-literals.ts
-var CEAL_SCHEMA_LITERALS = [
-  "ceal.activation_transport.v1",
-  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
-  CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
-  "ceal.client_refresh_request.v1",
-  "ceal.client_refresh_result.v1",
-  "ceal.client_revoke_request.v1",
-  "ceal.client_revoke_result.v1",
-  CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
-  "ceal.device_enrollment_challenge.v1",
-  "ceal.device_enrollment_challenge_request.v1",
-  "ceal.device_enrollment_hpke_aad.v1",
-  "ceal.device_enrollment_hpke_info.v1",
-  "ceal.device_enrollment_poll.v1",
-  "ceal.device_enrollment_poll_result.v1",
-  "ceal.device_enrollment_proof.v1",
-  "ceal.device_enrollment_start.v1",
+// packages/ceal-client-protocol/src/client-wire-contract.ts
+var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
+var CEAL_CLIENT_DOCTOR_SCHEMA_VERSION = CEAL_CLIENT_WIRE_CONTRACT.doctor.schema_version;
+var clientCommands = CEAL_CLIENT_WIRE_CONTRACT.client_commands;
+var CEAL_CLIENT_DOCTOR_COMMAND = Object.freeze([...clientCommands.doctor]);
+var CEAL_CLIENT_VERSION_COMMAND = Object.freeze([...clientCommands.version]);
+var CEAL_CLIENT_ACCESS_GROUP_LIST_COMMAND = Object.freeze([...clientCommands.access_group_list]);
+function deriveCealClientWireSchemaVersion(schema) {
+  if (!/^ceal\.[a-z][a-z0-9_]*$/u.test(schema.schema_name) || !schema.fields.includes("schema_version") || new Set(schema.fields).size !== schema.fields.length || schema.fields.some((field) => typeof field !== "string" || !/^[a-z][a-z0-9_]*$/u.test(field))) {
+    throw new TypeError("Client wire schema name or field set is invalid.");
+  }
+  const fields = schema.fields.filter((field) => field !== "schema_version").sort();
+  const hash8 = createHash("sha256").update(cealCanonicalJson(fields), "utf8").digest("hex").slice(0, 8);
+  return `${schema.schema_name}.v1.${hash8}`;
+}
+var CealClientWireContractMismatchError = class extends Error {
+  code = "contract_mismatch";
+  next_action = cealFailureGuidanceForCode("contract_mismatch").next_action;
+  constructor(expected, actual) {
+    super(`The peer wire contract ${actual} does not match this client contract ${expected}.`);
+    this.name = "CealClientWireContractMismatchError";
+  }
+};
+function requireCealClientWireSchemaVersion(value, expected) {
+  if (typeof value === "string" && value !== expected) throw new CealClientWireContractMismatchError(expected, value);
+}
+var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
+var commandResolutionAuthority = commandResolution.authority;
+var commandResolutionSemanticOptions = commandResolution.semantic_options;
+var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(commandResolution);
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
+var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
+var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
+var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
+var CEAL_OPERATION_CONTRACT_BUNDLE_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: artifact.operation_contract_bundle_schema_name, fields: artifact.operation_contract_bundle_fields });
+var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(artifact);
+var CEAL_VERIFIED_ARTIFACT_BINDING_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: artifact.binding_schema_name, fields: artifact.binding_fields });
+var CEAL_VERIFIED_ARTIFACT_KIND = artifact.kind;
+var CEAL_VERIFIED_ARTIFACT_BINDING_KIND = artifact.binding_kind;
+var CEAL_VERIFIED_ARTIFACT_MEDIA_TYPE = artifact.media_type;
+var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
+var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
+var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
+var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
+var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
+var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(request);
+var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: response.discovery_manifest_schema_name, fields: response.discovery_manifest_fields });
+var CEAL_COMMAND_RESPONSE_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(response);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
+var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
+var CEAL_RESOURCE_STREAM_REQUEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_schema_name, fields: CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_fields });
+var CEAL_RESOURCE_STREAM_REQUEST_FIELDS = Object.freeze([...CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_fields]);
+
+// packages/ceal-client-protocol/src/operation-withheld-cause.ts
+var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+
+// packages/ceal-client-protocol/src/operation-contract-types.ts
+var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+var CEAL_OPERATION_DESCRIPTOR_SCHEMA_VERSION = "ceal.operation_descriptor.v1";
+var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
+var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
+var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
+var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
+var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
+var SAFETY_CLASSES = vocabulary(["routine", "sensitive", "high_impact"]);
+var IDEMPOTENCY_CLASSES = vocabulary(["idempotent", "conditionally_idempotent", "non_idempotent"]);
+var REVERSIBILITY_CLASSES = vocabulary(["none", "reversible", "compensatable", "irreversible"]);
+var COMPENSATION_OWNERS = vocabulary(["none", "connector", "operator"]);
+var CANCELLATION_BOUNDARIES = vocabulary(["before_admission", "before_handoff", "after_handoff_reconcile"]);
+var HANDOFF_CLASSES = vocabulary(["not_applicable", "submission", "effect"]);
+var AUTHORITATIVE_READBACK_CLASSES = vocabulary(["required", "unavailable"]);
+var PROVIDER_READBACK_CLASSES = vocabulary(["required", "not_available", "not_applicable"]);
+var RECONCILIATION_CLASSES = vocabulary(["none", "automatic", "operator"]);
+var NO_READBACK_APPROVAL_CLASSES = vocabulary(["not_applicable", "explicit", "operator"]);
+var REPLAY_PREREQUISITES = vocabulary(["never", "fresh_admission", "reconciled_non_application", "operator_approval"]);
+var UNKNOWN_OUTCOMES = vocabulary(["reconcile", "operator_action", "excluded"]);
+var RECOVERY_OWNERS = vocabulary(["gateway", "connector", "operator"]);
+var CEAL_OPERATION_ADMISSION_STATES = vocabulary(["proposed", "refused", "admitted"]);
+var CEAL_OPERATION_EXECUTION_STATES = vocabulary(["not_started", "started", "completed"]);
+var CEAL_OPERATION_PROVIDER_HANDOFF_STATES = vocabulary(["not_offered", "offered", "accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_EFFECT_STATES = vocabulary(["none", "applied", "failed", "unknown", "compensated"]);
+var CEAL_OPERATION_OBSERVATION_STATES = vocabulary(["not_started", "not_required", "pending", "observed", "unavailable"]);
+var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate", "operator_action"]);
+var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
+var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
+var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
+var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
+  "approval_not_required_by_policy",
+  "interactive_pending",
+  "interactive_granted",
+  "interactive_denied",
+  "interactive_expired",
+  "interactive_unavailable"
+]);
+
+// packages/ceal-client-protocol/src/operation-access-class.ts
+var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
+
+// packages/ceal-client-protocol/src/domain-vocabulary.ts
+var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
+var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
+var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
+var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
+var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
+var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
+var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
+var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
+var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
+var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
+var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
+var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
+
+// packages/ceal-client-protocol/src/safe-json-budget.ts
+var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
+function safeJsonNodeBudgetForBytes(maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < SAFE_JSON_MIN_BYTES_PER_NODE) {
+    throw new RangeError(`safe-JSON byte cap is invalid: ${refusalFact("maxBytes", maxBytes, `at least ${SAFE_JSON_MIN_BYTES_PER_NODE} bytes`)}`);
+  }
+  return Math.floor(maxBytes / SAFE_JSON_MIN_BYTES_PER_NODE);
+}
+
+// packages/ceal-client-protocol/src/protocol-bounds.ts
+var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES = 64 * 1024;
+var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_NODES = safeJsonNodeBudgetForBytes(CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES);
+var OPERATION_SCHEMA_LITERAL_MAX_BYTES = CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES / 4;
+var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
+  max_depth: 8,
+  max_properties: 96,
+  max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
+  max_alternatives: 8,
+  max_enum_values: 64,
+  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
+  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
+  max_description_characters: 1024,
+  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
+  max_pattern_characters: 256,
+  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
+  max_literal_nodes: 512
+});
+
+// packages/ceal-client-protocol/src/operation-json-schema.ts
+var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
+
+// packages/ceal-client-protocol/src/operation-contract-validation.ts
+var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
+var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
+var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
+var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
+
+// packages/ceal-client-protocol/src/operation-catalog.ts
+var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
+var CLIENT_AUDIENCES = Object.freeze(["ceal", "cealctl", "agent"]);
+var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
+
+// packages/ceal-client-protocol/src/schema-literals.ts
+var CEAL_SCHEMA_LITERALS = [
+  "ceal.activation_transport.v1",
+  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
+  CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
+  "ceal.client_refresh_request.v1",
+  "ceal.client_refresh_result.v1",
+  "ceal.client_revoke_request.v1",
+  "ceal.client_revoke_result.v1",
+  CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
+  "ceal.device_enrollment_challenge.v1",
+  "ceal.device_enrollment_challenge_request.v1",
+  "ceal.device_enrollment_hpke_aad.v1",
+  "ceal.device_enrollment_hpke_info.v1",
+  "ceal.device_enrollment_poll.v1",
+  "ceal.device_enrollment_poll_result.v1",
+  "ceal.device_enrollment_proof.v1",
+  "ceal.device_enrollment_start.v1",
   "ceal.device_enrollment_start_result.v1",
   "ceal.effect_approval.v1",
   "ceal.effect_approval_confirmation.v1",
@@ -2866,12 +3113,12 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.enrollment_result.v1",
   "ceal.first_activation_causal_join.v1",
   "ceal.gateway_announcement_policy.v1",
-  "ceal.gateway_audit_call_detail.v1",
+  CEAL_GATEWAY_AUDIT_CALL_DETAIL_SCHEMA_VERSION,
   "ceal.gateway_audit_event.v1",
   "ceal.gateway_audit_readback.v1",
   "ceal.gateway_authorization_snapshot.v1",
   "ceal.gateway_cache_origin.v1",
-  "ceal.gateway_call_result.v1",
+  CEAL_GATEWAY_CALL_RESULT_SCHEMA_VERSION,
   CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
   "ceal.gateway_connector_route_failure.v1",
   "ceal.gateway_discovery.v1",
@@ -2896,7 +3143,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.host_observation.v1",
   "ceal.host_registration_request.v1",
   "ceal.host_registration_result.v1",
-  "ceal.operation_descriptor.v1",
+  CEAL_OPERATION_DESCRIPTOR_SCHEMA_VERSION,
   "ceal.operation_error.v1",
   "ceal.operation_failure.v1",
   "ceal.operation_failure.compact.v1",
@@ -3004,10 +3251,20 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
 var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
 var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
 
+// packages/ceal-client-protocol/src/client-environment-generated.ts
+var CEAL_CLIENT_CONTEXT_OVERRIDE_ENVIRONMENTS = Object.freeze(["CEAL_GATEWAY_ORIGIN", "CEAL_GATEWAY_TRANSPORT_ORIGIN", "CEAL_ACCESS_TOKEN", "CEAL_CONTEXT_STORE_PATH"]);
+
+// packages/ceal-client-protocol/src/client-process-contract.ts
+var CEAL_CLIENT_VERSION_SCHEMA_SUFFIX = ".version.v1";
+var CEAL_CLIENT_VERSION_SCHEMA_VERSION = `ceal${CEAL_CLIENT_VERSION_SCHEMA_SUFFIX}`;
+
 // packages/ceal-client-protocol/src/bare-document.ts
 var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
 var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
 
+// packages/ceal-client-protocol/src/actor-kind.ts
+var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
+
 // packages/ceal-client-protocol/src/resource-row.ts
 var CEAL_RESOURCE_ROW_TITLE_MATCH_DISPOSITIONS = vocabulary(["exact", "not_exact", "unknown"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
@@ -3022,6 +3279,8 @@ var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
   "resource_created",
   "review_submitted",
   "comment_created",
+  "reaction_created",
+  "ceal_write_completed",
   "event_start",
   "all_day_start",
   "file_created",
@@ -3056,6 +3315,10 @@ var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
   "github.review.submitted",
   "github.issue_comment.created",
   "github.review_comment.created",
+  "github.reaction.created",
+  "github.reaction.deleted",
+  "github.pull_request.review_requested",
+  "github.pull_request.review_request_removed",
   "calendar.organized",
   "calendar.accepted_invite",
   "calendar.recorded",
@@ -3077,6 +3340,10 @@ var CEAL_ACTIVITY_EVENT_TIMESTAMP_BASIS_MAP = Object.freeze({
   "github.pull_request.opened": "resource_created",
   "github.issue.edited": "resource_modified",
   "github.pull_request.edited": "resource_modified",
+  "github.reaction.created": "reaction_created",
+  "github.reaction.deleted": "ceal_write_completed",
+  "github.pull_request.review_requested": "ceal_write_completed",
+  "github.pull_request.review_request_removed": "ceal_write_completed",
   "calendar.organized": "resource_created",
   "drive.file.created": "file_created",
   "drive.file.modified": "file_modified_by_me",
@@ -3100,6 +3367,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
+  actor_kind: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
   attachments: { required: false, timestamp: false },
   created_at: { required: false, timestamp: true },
@@ -3107,9 +3375,18 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   modified_at: { required: false, timestamp: true },
   modified_at_local: { required: false, timestamp: true },
   viewed_by_me_at: { required: false, timestamp: true },
+  modified_by_me_at: { required: false, timestamp: true },
   own_ceal_write: { required: false, timestamp: false },
   owned_by_me: { required: false, timestamp: false },
+  mime_type: { required: false, timestamp: false },
+  size_bytes: { required: false, timestamp: false },
+  version: { required: false, timestamp: false },
+  trashed: { required: false, timestamp: false },
   visibility: { required: false, timestamp: false },
+  archived: { required: false, timestamp: false },
+  tag: { required: false, timestamp: false },
+  labels: { required: false, timestamp: false },
+  labels_incomplete: { required: false, timestamp: false },
   start: { required: false, timestamp: false },
   end: { required: false, timestamp: false },
   status: { required: false, timestamp: false },
@@ -3182,18 +3459,29 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
   // The serving gate answers this while the Gateway is still starting and the
   // refresh was never attempted; the same attempt stays retryable. It is never
   // stored by the session owner, only answered at the serving edge.
-  "gateway_starting"
+  CEAL_GATEWAY_STARTING_FAILURE_CODE
+]);
+var CEAL_CLIENT_REVOKE_FAILURE_CODES = vocabulary([
+  "refresh_invalid",
+  "refresh_expired",
+  "refresh_replayed",
+  "refresh_revoked"
 ]);
+var CEAL_PERSONAL_CLIENT_ACCESS_TOKEN_PREFIX = "ceal_personal_";
+var CEAL_PERSONAL_CLIENT_REFRESH_TOKEN_PREFIX = "ceal_refresh_";
+var PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN = "[A-Za-z0-9_-]{43}";
+var CEAL_PERSONAL_CLIENT_ACCESS_TOKEN = new RegExp(`^${CEAL_PERSONAL_CLIENT_ACCESS_TOKEN_PREFIX}${PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN}$`, "u");
+var CEAL_PERSONAL_CLIENT_REFRESH_TOKEN = new RegExp(`^${CEAL_PERSONAL_CLIENT_REFRESH_TOKEN_PREFIX}${PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN}$`, "u");
 
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 var DIGEST = /^[a-f0-9]{64}$/u;
 var CEAL_SHA256_DIGEST_PATTERN = DIGEST.source;
 function isCealDigest(value) {
   return typeof value === "string" && DIGEST.test(value);
 }
 function cealRequestSha256(value) {
-  return createHash("sha256").update(cealCanonicalJson(value), "utf8").digest("hex");
+  return createHash2("sha256").update(cealCanonicalJson(value), "utf8").digest("hex");
 }
 function operationRecord(value, message) {
   requireOperationRecord(value, message);
@@ -3209,40 +3497,71 @@ function requirePrefixedRef(value, prefix, message) {
 // packages/ceal-client-protocol/src/request-authority.ts
 var CEAL_REQUEST_SCHEMA_VERSION = "ceal.request.v1";
 var CEAL_REQUEST_ARTIFACT_OWNERS = vocabulary(["gateway", "host", "connector"]);
-var CEAL_REQUEST_HOST_BINDING_KEYS = vocabulary(["prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
+var CEAL_HOST_INVOCATION_IDENTITY_KEYS = vocabulary(["host_session_ref", "host_turn_ref", "host_source_ref"]);
 var CEAL_REQUEST_ARTIFACT_RETENTION_CLASSES = vocabulary(["request", "source", "result"]);
 var CANCELLATION_STATES = vocabulary(["requested", "cancelled"]);
-var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority", "prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
+var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority"]);
+var CEAL_REQUEST_COMMON_PROPERTIES = Object.freeze({
+  schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
+  ceal_request_ref: { type: "string", minLength: 1, maxLength: 128, pattern: "^ceal-request:[A-Za-z0-9][A-Za-z0-9._:-]{0,114}$" },
+  created_at: { type: "string", minLength: 1, maxLength: 64 },
+  authority: {
+    type: "object",
+    maxProperties: 5,
+    additionalProperties: false,
+    properties: {
+      instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+    },
+    required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+  }
+});
+var CEAL_REQUEST_HOST_PROPERTIES = Object.freeze({
+  prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+});
+var CEAL_REQUEST_CALLER_PROPERTIES = Object.freeze({
+  caller_call_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Gateway-minted call-group identity for a non-Host caller." },
+  caller_call_input_sha256: { type: "string", minLength: 64, maxLength: 64, pattern: "^[a-f0-9]{64}$", description: "Commitment to the exact input for active non-Host identity-reuse checks; a migrated legacy call group commits to its legacy group key because the original input may no longer exist." }
+});
+var CEAL_REQUEST_OPTIONAL_PROPERTIES = Object.freeze({
+  requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
+  device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session, including Host turns when the authenticated Host registration carries the device; absent for older records." }
+});
+var CEAL_REQUEST_HOST_REQUIRED_KEYS = Object.freeze([...CEAL_REQUEST_KEYS, ...CEAL_HOST_INVOCATION_IDENTITY_KEYS, "prompt_ref"]);
+var CEAL_REQUEST_CALLER_REQUIRED_KEYS = Object.freeze([...CEAL_REQUEST_KEYS, "caller_call_group_ref", "caller_call_input_sha256"]);
 var CEAL_REQUEST_JSON_SCHEMA = {
   type: "object",
-  maxProperties: 11,
+  description: "A Request has exactly one creation identity: the complete Host tuple and prompt reference, or a caller call-group identity. Caller Requests retain no prompt reference or prompt body.",
+  maxProperties: 13,
   additionalProperties: false,
   properties: {
-    schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
-    ceal_request_ref: { type: "string", minLength: 1, maxLength: 128, pattern: "^ceal-request:[A-Za-z0-9][A-Za-z0-9._:-]{0,114}$" },
-    created_at: { type: "string", minLength: 1, maxLength: 64 },
-    authority: {
+    ...CEAL_REQUEST_COMMON_PROPERTIES,
+    ...CEAL_REQUEST_HOST_PROPERTIES,
+    ...CEAL_REQUEST_CALLER_PROPERTIES,
+    ...CEAL_REQUEST_OPTIONAL_PROPERTIES
+  },
+  required: CEAL_REQUEST_KEYS,
+  anyOf: [
+    {
       type: "object",
-      maxProperties: 5,
-      additionalProperties: false,
-      properties: {
-        instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
-      },
-      required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+      required: CEAL_REQUEST_HOST_REQUIRED_KEYS,
+      properties: { ...CEAL_REQUEST_COMMON_PROPERTIES, ...CEAL_REQUEST_HOST_PROPERTIES, ...CEAL_REQUEST_OPTIONAL_PROPERTIES },
+      additionalProperties: false
     },
-    prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
-    device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session; absent for Host turns and older records." }
-  },
-  required: CEAL_REQUEST_KEYS
+    {
+      type: "object",
+      required: CEAL_REQUEST_CALLER_REQUIRED_KEYS,
+      properties: { ...CEAL_REQUEST_COMMON_PROPERTIES, ...CEAL_REQUEST_CALLER_PROPERTIES, ...CEAL_REQUEST_OPTIONAL_PROPERTIES },
+      additionalProperties: false
+    }
+  ]
 };
 
 // packages/ceal-client-protocol/src/request-operands.ts
@@ -3353,10 +3672,6 @@ var CEAL_REQUEST_RUN_BATCH_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-observation.ts
-var CEAL_HOST_INPUT_KINDS = vocabulary(["human", "host_automatic"]);
-function isCealHostInputKind(value) {
-  return typeof value === "string" && CEAL_HOST_INPUT_KINDS.some((kind) => kind === value);
-}
 var CEAL_HOST_OBSERVATION_REF_PREFIX = "host-observation:";
 var HOST_OBSERVATION_PRODUCER = /^[a-z][a-z0-9]{0,31}$/u;
 var HOST_OBSERVATION_DIGEST = /^[a-f0-9]{8,64}$/u;
@@ -3402,14 +3717,14 @@ function safeCount(value) {
   return Number.isSafeInteger(value) && Number(value) >= 0;
 }
 function validateCealHostObservationDraft(value) {
-  const record3 = operationRecord(value, "Ceal Host observation draft is invalid.");
-  requirePrefixedRef(record3.observation_ref, CEAL_HOST_OBSERVATION_REF_PREFIX, "Ceal Host observation reference is invalid.");
-  requireClosedValue(record3.observation_kind, CEAL_HOST_OBSERVATION_KINDS, "Ceal Host observation kind is invalid.");
-  requireIsoTimestamp(record3.observed_at, "Ceal Host observation time is invalid.");
-  assertHostObservationValue(record3.value, record3.observation_kind);
+  const record2 = operationRecord(value, "Ceal Host observation draft is invalid.");
+  requirePrefixedRef(record2.observation_ref, CEAL_HOST_OBSERVATION_REF_PREFIX, "Ceal Host observation reference is invalid.");
+  requireClosedValue(record2.observation_kind, CEAL_HOST_OBSERVATION_KINDS, "Ceal Host observation kind is invalid.");
+  requireIsoTimestamp(record2.observed_at, "Ceal Host observation time is invalid.");
+  assertHostObservationValue(record2.value, record2.observation_kind);
 }
 var CEAL_REQUEST_MAX_OBSERVATION_VALUE_BYTES = 64 * 1024;
-var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "model", "token", "cost", "timing"]);
+var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "model", "token", "timing"]);
 function isCealHostPromptObservationValue(value) {
   return isOperationRecord(value) && Object.keys(value).length === 1 && isCealDigest(value.body_sha256);
 }
@@ -3532,17 +3847,128 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-invocation-authentication.ts
-var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA = "ceal.host_invocation_authentication_request.v1";
-var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
-var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
-var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
-var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
-var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
-  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
-  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
-  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
-})}
+var hostInvocationAuthenticationContract = CEAL_CLIENT_WIRE_CONTRACT.host_invocation_authentication;
+var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA = deriveCealClientWireSchemaVersion({ schema_name: hostInvocationAuthenticationContract.request_schema_name, fields: hostInvocationAuthenticationContract.request_fields });
+var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_FIELDS = Object.freeze([...hostInvocationAuthenticationContract.request_fields]);
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = deriveCealClientWireSchemaVersion({ schema_name: hostInvocationAuthenticationContract.result_schema_name, fields: hostInvocationAuthenticationContract.result_fields });
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_FIELDS = Object.freeze([...hostInvocationAuthenticationContract.result_fields]);
+var CEAL_HOST_AUTHENTICATION_BUDGET_ENVIRONMENT = "CEAL_HOST_AUTHENTICATION_BUDGET_MS";
+var CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN_SOURCE = "^(?:0|[1-9][0-9]{0,8})$";
+var CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN = new RegExp(CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN_SOURCE, "u");
+var CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA = "ceal.gateway_host_invocation_context_request.v2";
+var CEAL_HOST_INVOCATION_CONTEXT_REQUEST_MAX_BYTES = 16 * 1024;
+var CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES = 2 * 1024;
+var CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES = 32;
+var HOST_CONTEXT_EXPIRY_MAX_CHARS = 64;
+var CEAL_HOST_INVOCATION_CONTEXT_VISIBLE_OUTPUT_MAX_BYTES = CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
+var CEAL_HOST_CONTEXT_TOKEN_PREFIX = "ceal_context_";
+function boundCealHostInvocationHumanMessageWindow(newestFirst, sourceTruncated = false) {
+  const messages = [];
+  let truncated = sourceTruncated || newestFirst.length > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES;
+  for (const candidate of newestFirst.slice(0, CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES)) {
+    const next = [...messages, candidate];
+    if (new TextEncoder().encode(JSON.stringify(next)).byteLength > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES) {
+      truncated = true;
+      break;
+    }
+    messages.push(Object.freeze({ host_turn_ref: candidate.host_turn_ref, host_input_ref: candidate.host_input_ref, text: candidate.text }));
+  }
+  return Object.freeze({ messages: Object.freeze(messages), truncated });
+}
+function decodeCealHostInvocationContextRequest(value) {
+  if (!isCealJsonRecord(value)) throw invalidInvocationContextRequest();
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA);
+  if (!hasInvocationContextRequestKeys(value)) throw invalidInvocationContextRequest();
+  const clientNonce = requireClientNonce(value.client_nonce);
+  const expiresAt = requireContextExpiration(value.context_expires_at);
+  const hostBinding = requireHostBinding(value.host_binding);
+  const messageWindow = requireHumanMessageWindow(value.human_message_window);
+  const lastRequestRef = optionalSafeReference(value.last_seen_request_ref);
+  const visibleOutputMaxBytes = optionalVisibleOutputBudget(value.visible_output_max_bytes);
+  return Object.freeze({
+    schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+    client_nonce: clientNonce,
+    context_expires_at: expiresAt,
+    host_binding: Object.freeze({ ...hostBinding }),
+    human_message_window: messageWindow,
+    ...lastRequestRef === void 0 ? {} : { last_seen_request_ref: lastRequestRef },
+    ...visibleOutputMaxBytes === void 0 ? {} : { visible_output_max_bytes: visibleOutputMaxBytes }
+  });
+}
+function hasInvocationContextRequestKeys(value) {
+  const required = ["schema_version", "client_nonce", "context_expires_at", "host_binding", "human_message_window"];
+  const optional = ["last_seen_request_ref", "visible_output_max_bytes"];
+  const optionalKeys = Object.keys(value).filter((key) => optional.includes(key));
+  return hasExactKeys(value, [...required, ...optionalKeys]) && required.every((key) => Object.hasOwn(value, key)) && value.schema_version === CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA;
+}
+function requireClientNonce(value) {
+  if (typeof value !== "string" || !CEAL_HOST_CLIENT_NONCE_PATTERN.test(value)) throw invalidInvocationContextRequest();
+  return value;
+}
+function requireContextExpiration(value) {
+  if (typeof value !== "string" || value.length > HOST_CONTEXT_EXPIRY_MAX_CHARS || !Number.isFinite(Date.parse(value))) throw invalidInvocationContextRequest();
+  return value;
+}
+function requireHostBinding(value) {
+  if (!isCealJsonRecord(value) || !exactOptionalKeys(value, ["host_source_ref", "host_session_ref", "host_turn_ref"], []) || !safeReference(value.host_source_ref) || !safeReference(value.host_session_ref) || !safeReference(value.host_turn_ref)) throw invalidInvocationContextRequest();
+  return { host_source_ref: value.host_source_ref, host_session_ref: value.host_session_ref, host_turn_ref: value.host_turn_ref };
+}
+function requireHumanMessageWindow(value) {
+  if (!isCealJsonRecord(value) || !exactOptionalKeys(value, ["messages", "truncated"], []) || !Array.isArray(value.messages) || value.messages.length > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES || typeof value.truncated !== "boolean") throw invalidInvocationContextRequest();
+  const messages = value.messages.map(decodeHumanMessage);
+  const bytes = new TextEncoder().encode(JSON.stringify(messages)).byteLength;
+  if (bytes > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES) throw invalidInvocationContextRequest();
+  return Object.freeze({ messages: Object.freeze(messages), truncated: value.truncated });
+}
+function decodeHumanMessage(candidate) {
+  if (!isCealJsonRecord(candidate) || !exactOptionalKeys(candidate, ["host_turn_ref", "host_input_ref", "text"], []) || !safeReference(candidate.host_turn_ref) || !safeReference(candidate.host_input_ref) || typeof candidate.text !== "string") throw invalidInvocationContextRequest();
+  return Object.freeze({ host_turn_ref: candidate.host_turn_ref, host_input_ref: candidate.host_input_ref, text: candidate.text });
+}
+function optionalSafeReference(value) {
+  if (value === void 0) return void 0;
+  if (!safeReference(value)) throw invalidInvocationContextRequest();
+  return value;
+}
+function safeReference(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
+}
+function exactOptionalKeys(value, required, optional = []) {
+  const keys = Object.keys(value);
+  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function optionalVisibleOutputBudget(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > CEAL_HOST_INVOCATION_CONTEXT_VISIBLE_OUTPUT_MAX_BYTES) throw invalidInvocationContextRequest();
+  return value;
+}
+function invalidInvocationContextRequest() {
+  return new TypeError("The Host invocation context request is invalid.");
+}
+function deriveCealHostInvocationNonceContract(contract = CEAL_CLIENT_WIRE_CONTRACT) {
+  const clientNonce = contract.host_invocation_authentication.client_nonce;
+  return {
+    encoded_characters: clientNonce.encoded_characters,
+    client_nonce_pattern_source: `^[${clientNonce.character_class_source}]{${clientNonce.encoded_characters}}$`,
+    context_token_pattern_source: `^${CEAL_HOST_CONTEXT_TOKEN_PREFIX}[${clientNonce.character_class_source}]{${clientNonce.encoded_characters}}$`
+  };
+}
+var hostNonceContract = deriveCealHostInvocationNonceContract();
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = hostNonceContract.encoded_characters;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(hostNonceContract.client_nonce_pattern_source, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(hostNonceContract.context_token_pattern_source, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = deriveCealHostInvocationAuthenticationResultMaxBytes();
+function deriveCealHostInvocationAuthenticationResultMaxBytes(contract = CEAL_CLIENT_WIRE_CONTRACT) {
+  const hostAuthentication = contract.host_invocation_authentication;
+  const values = {
+    schema_version: deriveCealClientWireSchemaVersion({ schema_name: hostAuthentication.result_schema_name, fields: hostAuthentication.result_fields }),
+    context_token: `${CEAL_HOST_CONTEXT_TOKEN_PREFIX}${"A".repeat(hostAuthentication.client_nonce.encoded_characters)}`,
+    expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+  };
+  const fields = hostAuthentication.result_fields;
+  if (fields.some((field) => !Object.hasOwn(values, field))) throw new TypeError("Host invocation result fields have no bounded sample value.");
+  return new TextEncoder().encode(`${JSON.stringify(Object.fromEntries(fields.map((field) => [field, values[field]])))}
 `).byteLength;
+}
 var CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS = vocabulary([
   "request_authority_unavailable",
   "request_missing",
@@ -3566,6 +3992,7 @@ var CEAL_HOST_AUTHENTICATION_CAUSES = vocabulary([
   "host_credential_refused",
   "gateway_unavailable",
   "gateway_rate_limited",
+  "contract_mismatch",
   "gateway_refused",
   "gateway_response_invalid",
   "producer_frame_invalid",
@@ -3580,19 +4007,23 @@ var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
   invalid_arguments: Object.freeze({ classification: "host_arguments_invalid", next_action: "answer_with_gap" }),
   options_invalid: Object.freeze({ classification: "host_configuration_invalid", next_action: "answer_with_gap" }),
   session_unavailable: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
-  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "refresh_host_invocation_context", remedy: "the Host has no invocation context from the current transcript turn; send a new message to start a fresh Host turn, then retry this command on that turn (run `ceal-host install` only if the Host hook registration is missing or drifted)" }),
-  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
-  no_binding: Object.freeze({ classification: "host_binding_unavailable", next_action: "refresh_host_invocation_context" }),
-  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
-  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "refresh_host_invocation_context" }),
+  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "retry" }),
+  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "retry" }),
+  // `no_binding` now means the producer has no real current Host session. The
+  // Host Relay never uses it for an uncreated Gateway Request; there is no
+  // useful retry until the consumer is running inside a Host session.
+  no_binding: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
+  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "retry" }),
+  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "retry" }),
   host_source_refused: Object.freeze({ classification: "host_source_refused", next_action: "answer_with_gap" }),
   host_credential_refused: Object.freeze({ classification: "host_registration_credential_refused", next_action: "ask_admin" }),
   gateway_unavailable: Object.freeze({ classification: "host_mint_gateway_unavailable", next_action: "ask_admin" }),
   gateway_rate_limited: Object.freeze({ classification: "host_mint_gateway_rate_limited", next_action: "answer_with_gap" }),
+  contract_mismatch: Object.freeze({ classification: "contract_mismatch", next_action: "upgrade_ceal_client" }),
   gateway_refused: Object.freeze({ classification: "host_mint_gateway_refused", next_action: "answer_with_gap" }),
   gateway_response_invalid: Object.freeze({ classification: "host_mint_gateway_response_invalid", next_action: "answer_with_gap" }),
-  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin", remedy: "ask an administrator to inspect and repair the producer frame, then start a fresh Host turn" }),
-  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox", remedy: "an agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox" }),
+  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin" }),
+  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox" }),
   relay_unavailable: Object.freeze({ classification: "host_relay_unavailable", next_action: "answer_with_gap" }),
   transient_retryable: Object.freeze({ classification: "host_mint_transient_retryable", next_action: "retry" }),
   mint_failed: Object.freeze({ classification: "host_mint_failed", next_action: "answer_with_gap" }),
@@ -3602,21 +4033,33 @@ var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
 function isCealHostAuthenticationCause(value) {
   return isVocabularyWord(CEAL_HOST_AUTHENTICATION_CAUSES, value);
 }
+function cealHostAuthenticationCauseForExchangeFailure(failure2) {
+  if (failure2 === "permission_denied") return "relay_permission_denied";
+  if (failure2 === "timed_out") return "transient_retryable";
+  return "relay_unavailable";
+}
 function decodeCealHostInvocationAuthenticationRequest(value) {
-  if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "client_nonce"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA || typeof value.client_nonce !== "string" || !CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce)) {
+  if (!isCealJsonRecord(value)) throw new TypeError("The Host invocation authentication request is invalid.");
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA);
+  if (!exactKeys(value, CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_FIELDS) || typeof value.client_nonce !== "string" || !CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce)) {
     throw new TypeError("The Host invocation authentication request is invalid.");
   }
   return Object.freeze({ schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA, client_nonce: value.client_nonce });
 }
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
-  if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
+  return decodeHostInvocationAuthenticationResult(value, CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_FIELDS, now);
+}
+function decodeHostInvocationAuthenticationResult(value, fields, now) {
+  if (!isCealJsonRecord(value)) throw new TypeError("The Host invocation authentication result is invalid.");
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA);
+  if (!exactKeys(value, fields) || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");
   }
   return Object.freeze({ schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA, context_token: value.context_token, expires_at: value.expires_at });
 }
 function validFutureTimestamp(value, now) {
-  const timestamp4 = Date.parse(value);
-  return Number.isFinite(timestamp4) && new Date(timestamp4).toISOString() === value && timestamp4 > now.getTime();
+  const timestamp3 = Date.parse(value);
+  return Number.isFinite(timestamp3) && new Date(timestamp3).toISOString() === value && timestamp3 > now.getTime();
 }
 function exactKeys(value, expected) {
   const keys = Object.keys(value);
@@ -3630,10 +4073,6 @@ var CEAL_HOST_SERVICE_DIAGNOSTIC_EVENTS = vocabulary([
   "hook_invoked",
   "registration_written",
   "hook_failed",
-  "watcher_turn_observed",
-  "current_prompt_registered",
-  "current_prompt_registration_failed",
-  "current_prompt_capacity_exhausted",
   "activation_recorded",
   "activation_failed",
   "watcher_scan_failed",
@@ -3656,6 +4095,9 @@ var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "un
 var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "path", "sha256"]);
 var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "items_path", "row_count", "result_complete", "coverage", "local_result_root", "model_disclosure", "continue_argv", "how_to_read"]);
 
+// packages/ceal-client-protocol/src/discovery-manifest.ts
+var DISCOVERY_MANIFEST_KEYS = CEAL_CLIENT_WIRE_CONTRACT.command_response.discovery_manifest_fields;
+
 // packages/ceal-client-protocol/src/gateway-cache-origin-validation.ts
 var CEAL_MAX_CACHE_ORIGIN_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 
@@ -3714,6 +4156,7 @@ var ADMIN_UNAVAILABLE_REASONS = vocabulary([
   "legacy",
   "invalid_observation",
   "redacted",
+  "organization_setting_disabled",
   "owner_unavailable",
   "unit_unknown",
   "retention_gap",
@@ -3743,15 +4186,13 @@ var ADMIN_APPROVAL_DISPOSITIONS = CEAL_OPERATION_APPROVAL_DISPOSITIONS;
 var ADMIN_APPROVAL_POSTURES = vocabulary([...ADMIN_APPROVAL_DISPOSITIONS, "not_applicable"]);
 var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "approval", "effect", "readback"]);
 
-// packages/ceal-client-protocol/src/actor-kind.ts
-var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
-
 // packages/ceal-client-protocol/src/device-enrollment.ts
 var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
 var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
 
 // packages/ceal-client-protocol/src/personal-client-session.ts
 var REFRESH_FAILURE_CODES = new Set(CEAL_REFRESH_FAILURE_CODES);
+var REVOKE_FAILURE_CODES = new Set(CEAL_CLIENT_REVOKE_FAILURE_CODES);
 
 // packages/ceal-client-protocol/src/index.ts
 var MAX_REQUEST_BYTES = 32 * 1024;
@@ -3843,16 +4284,59 @@ function hostClientProbeRefusal(probe, subject) {
 }
 
 // host/client-doctor.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { execFile } from "node:child_process";
 import { access, open, readFile, realpath, stat } from "node:fs/promises";
 import { delimiter, isAbsolute, join as join2 } from "node:path";
 import { promisify } from "node:util";
+
+// host/command-vector.ts
+import { win32 } from "node:path";
+var MAX_COMMAND_BYTES = 4096;
+function formatHostCommand(vector, platform) {
+  return formatWith(vector, platform === "windows" ? quoteWindowsArgument : quotePosixArgument);
+}
+function hostScriptLauncherInvocation(launcherPath, args, platform = process.platform, environment = process.env) {
+  if (/\.(?:cjs|js|mjs)$/iu.test(launcherPath)) return { executable: process.execPath, args: [launcherPath, ...args] };
+  if (platform === "win32" && /\.(?:bat|cmd)$/iu.test(launcherPath)) {
+    return {
+      executable: environment.ComSpec ?? "cmd.exe",
+      args: ["/d", "/s", "/c", `call ${formatHostCommand({ executable: launcherPath, args }, "windows")}`],
+      windowsVerbatimArguments: true
+    };
+  }
+  if (platform === "win32" && /\.ps1$/iu.test(launcherPath)) {
+    return {
+      executable: win32.join(environment.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
+      args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-File", launcherPath, ...args]
+    };
+  }
+  return { executable: launcherPath, args };
+}
+function formatWith(vector, quote) {
+  const command = [vector.executable, ...vector.args].map(quote).join(" ");
+  const commandBytes = Buffer.byteLength(command, "utf8");
+  if (commandBytes > MAX_COMMAND_BYTES) throw new TypeError(`Host command vector is too large (${refusalFact("bytes", commandBytes, `at most ${MAX_COMMAND_BYTES} UTF-8 bytes`)}).`);
+  return command;
+}
+function quotePosixArgument(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function quoteWindowsArgument(value) {
+  if (value.includes("%") || value.includes("!")) throw new TypeError("Host command vector contains unsafe Windows expansion syntax.");
+  return quoteWindowsExecArgument(value);
+}
+function quoteWindowsExecArgument(value) {
+  const escaped = value.replace(/(\\*)"/gu, '$1$1\\"').replace(/(\\+)$/gu, "$1$1");
+  return `"${escaped}"`;
+}
+
+// host/client-doctor.ts
 var execFileAsync = promisify(execFile);
 var GIT_OID = /^[a-f0-9]{40}$/u;
 var SHA2562 = /^[a-f0-9]{64}$/u;
 var SAFE_REF2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
-var CEAL_ENVIRONMENT_OVERRIDES = ["CEAL_GATEWAY_ORIGIN", "CEAL_GATEWAY_TRANSPORT_ORIGIN", "CEAL_ACCESS_TOKEN", "CEAL_CONTEXT_STORE_PATH"];
+var CEAL_ENVIRONMENT_OVERRIDES = CEAL_CLIENT_CONTEXT_OVERRIDE_ENVIRONMENTS;
 async function doctorClient(options = {}, component) {
   const environment = canonicalClientEnvironment(options.environment ?? process.env);
   const run = options.run ?? executeCealCommand;
@@ -3889,7 +4373,7 @@ async function inspectExecutable(options, environment, component) {
   return { ok: true, value: executable };
 }
 async function inspectVersion(options, executable, environment, run, component) {
-  const probe = hostClientProbe(await safeRun(run, executable.path, ["version"], environment), (result) => versionIdentity(commandDocument(result)));
+  const probe = hostClientProbe(await safeRun(run, executable.path, CEAL_CLIENT_VERSION_COMMAND, environment), (result) => versionIdentity(commandDocument(result)));
   if (probe.kind !== "value") return probeFailure(probe, "version", component, options);
   if (options.expected_source_commit !== void 0 && probe.value.source_commit !== options.expected_source_commit) return inspectedFailure("ceal_identity_mismatch", `The Ceal executable visible to the ${component} Host did not return the expected source identity (${refusalFact("source_commit", probe.value.source_commit, `expected ${options.expected_source_commit}`)}).`, `Install the exact candidate, restart ${component}, and verify \`ceal version\` from that Host.`);
   return { ok: true, value: probe.value };
@@ -3906,8 +4390,8 @@ function probeCode(code) {
   return "ceal_output_unreadable";
 }
 async function inspectCanonicalContext(options, executable, environment, run, component) {
-  const probe = hostClientProbe(await safeRun(run, executable.path, ["access-group", "list"], environment), (result) => selectedContext(commandDocument(result)));
-  if (probe.kind === "unreachable") return probeFailure(probe, "access-group list", component, options);
+  const probe = hostClientProbe(await safeRun(run, executable.path, CEAL_CLIENT_ACCESS_GROUP_LIST_COMMAND, environment), (result) => selectedContext(commandDocument(result)));
+  if (probe.kind === "unreachable") return probeFailure(probe, CEAL_CLIENT_ACCESS_GROUP_LIST_COMMAND.join(" "), component, options);
   if (probe.kind !== "value" || options.expected_instance_ref !== void 0 && probe.value.instance_ref !== options.expected_instance_ref) return inspectedFailure("canonical_context_unavailable", `The ${component} Host cannot select the intended authenticated context from Ceal's canonical user configuration (${refusalFacts([{ name: "probe_kind", value: probe.kind, expected: "value" }, { name: "instance_ref", value: probe.kind === "value" ? probe.value.instance_ref : "unavailable", expected: options.expected_instance_ref ?? "a selected context" }])}).`, `Run \`ceal session adopt --email <email>\` without CEAL context overrides, then restart ${component}.`);
   return { ok: true, value: probe.value };
 }
@@ -3928,7 +4412,7 @@ async function resolveCealExecutable(command, environment) {
       const metadata = await stat(path);
       if (!metadata.isFile()) continue;
       if (await isLauncher(path)) return resolveLauncherBinary(path, environment);
-      return { path, sha256: createHash2("sha256").update(await readFile(path)).digest("hex") };
+      return { path, sha256: createHash3("sha256").update(await readFile(path)).digest("hex") };
     } catch {
     }
   }
@@ -3947,18 +4431,19 @@ async function isLauncher(path) {
   }
 }
 async function resolveLauncherBinary(launcherPath, environment) {
-  const result = await execFileAsync(launcherPath, ["doctor"], { env: environment, timeout: 15e3, encoding: "utf8", windowsHide: false });
+  const invocation = hostScriptLauncherInvocation(launcherPath, CEAL_CLIENT_DOCTOR_COMMAND, process.platform, environment);
+  const result = await execFileAsync(invocation.executable, [...invocation.args], { env: environment, timeout: 15e3, encoding: "utf8", windowsHide: false, ...invocation.windowsVerbatimArguments === void 0 ? {} : { windowsVerbatimArguments: invocation.windowsVerbatimArguments } });
   let parsed;
   try {
     parsed = JSON.parse(result.stdout);
   } catch {
     throw new Error("launcher doctor returned unreadable output");
   }
-  if (!isRecord(parsed) || parsed.schema_version !== "ceal.doctor.v1" || parsed.ok !== true || typeof parsed.binary_path !== "string" || parsed.binary_path.length === 0) throw new Error("launcher doctor did not report a binary path");
+  if (!isRecord(parsed) || parsed.schema_version !== CEAL_CLIENT_DOCTOR_SCHEMA_VERSION || parsed.ok !== true || typeof parsed.binary_path !== "string" || parsed.binary_path.length === 0) throw new Error("launcher doctor did not report a binary path");
   const binaryPath = await realpath(parsed.binary_path);
   const metadata = await stat(binaryPath);
   if (!metadata.isFile()) throw new Error("launcher doctor reported a non-file binary path");
-  return { path: binaryPath, sha256: createHash2("sha256").update(await readFile(binaryPath)).digest("hex") };
+  return { path: binaryPath, sha256: createHash3("sha256").update(await readFile(binaryPath)).digest("hex") };
 }
 async function executeCealCommand(executable, args, environment) {
   try {
@@ -3993,7 +4478,7 @@ function selectedContextRecord(item) {
   return { name: item.name, instance_ref: item.instance_ref };
 }
 function versionIdentity(value) {
-  if (value?.schema_version !== "ceal.version.v1" || value.ok !== true || typeof value.version !== "string" || typeof value.source_commit !== "string" || typeof value.source_tree !== "string") return null;
+  if (value?.schema_version !== CEAL_CLIENT_VERSION_SCHEMA_VERSION || value.ok !== true || typeof value.version !== "string" || typeof value.source_commit !== "string" || typeof value.source_tree !== "string") return null;
   if (value.version.length === 0 || !GIT_OID.test(value.source_commit) || !GIT_OID.test(value.source_tree)) return null;
   return { version: value.version, source_commit: value.source_commit, source_tree: value.source_tree };
 }
@@ -4017,16 +4502,9 @@ async function doctorCodexClient(options = {}) {
 import { performance } from "node:perf_hooks";
 
 // host/relay/src/producer-frame.ts
-var HOST_PRODUCER_FRAME_SCHEMA = "ceal.host_producer_frame.v1";
-var HOST_PRODUCER_MAX_JSON_BYTES = 262144;
 var HOST_PRODUCER_FRAME_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
-var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-var PRODUCERS = /* @__PURE__ */ new Set(["codex", "claude"]);
-var HOST_PRODUCER_FRAME_KINDS = ["session_started", "turn_started", "user_input", "turn_terminal", "producer_status"];
+var HOST_PRODUCER_FRAME_KINDS = ["session_started", "turn_started", "turn_terminal", "producer_status"];
 var FRAME_KINDS = new Set(HOST_PRODUCER_FRAME_KINDS);
-function isHostProducerFrameKind(value) {
-  return typeof value === "string" && FRAME_KINDS.has(value);
-}
 var HOST_PRODUCER_FRAME_ERROR_CODES = [
   "invalid_frame_encoding",
   "invalid_frame_length",
@@ -4036,473 +4514,205 @@ var HOST_PRODUCER_FRAME_ERROR_CODES = [
   "invalid_producer_identity",
   "frame_too_large"
 ];
-var HostProducerFrameError = class extends Error {
-  code;
-  constructor(code, message = code) {
+
+// host/relay/src/host-producer-core.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// host/secure-file.ts
+import { execFile as execFile2 } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, open as open2 } from "node:fs/promises";
+import { dirname, win32 as win322 } from "node:path";
+import { fileURLToPath } from "node:url";
+var SecureFileCustodyError = class extends Error {
+  name = "SecureFileCustodyError";
+  reason;
+  constructor(reason, message) {
     super(message);
-    this.code = code;
+    this.reason = reason;
+  }
+  get code() {
+    if (this.reason === "reparse_point") return "ELOOP";
+    if (this.reason === "not_found") return "ENOENT";
+    if (this.reason === "too_large") return "secure_file_too_large";
+    if (this.reason === "already_exists") return "EEXIST";
+    return this.reason === "not_private" ? "secure_file_not_private" : "secure_file_unavailable";
   }
 };
-function encodeHostProducerFrame(frame) {
-  validateFrame(frame);
-  const json = Buffer.from(JSON.stringify(frame), "utf8");
-  if (json.byteLength > HOST_PRODUCER_MAX_JSON_BYTES) throw new HostProducerFrameError("frame_too_large", `frame_too_large: ${refusalFact("frame_bytes", json.byteLength, `at most ${HOST_PRODUCER_MAX_JSON_BYTES}`)}`);
-  const result = Buffer.allocUnsafe(json.byteLength + HOST_PRODUCER_FRAME_LENGTH_BYTES);
-  result.writeUInt32BE(json.byteLength, 0);
-  json.copy(result, HOST_PRODUCER_FRAME_LENGTH_BYTES);
-  return result;
-}
-function decodeHostProducerFrame(input) {
-  if (input.byteLength < HOST_PRODUCER_FRAME_LENGTH_BYTES) throw new HostProducerFrameError("frame_truncated", `frame_truncated: ${refusalFact("frame_bytes", input.byteLength, `at least ${HOST_PRODUCER_FRAME_LENGTH_BYTES}`)}`);
-  const length = input.readUInt32BE(0);
-  if (length > HOST_PRODUCER_MAX_JSON_BYTES) throw new HostProducerFrameError("frame_too_large", `frame_too_large: ${refusalFact("declared_bytes", length, `at most ${HOST_PRODUCER_MAX_JSON_BYTES}`)}`);
-  if (length === 0) throw new HostProducerFrameError("invalid_frame_length");
-  if (input.byteLength !== length + HOST_PRODUCER_FRAME_LENGTH_BYTES) throw new HostProducerFrameError(input.byteLength < length + HOST_PRODUCER_FRAME_LENGTH_BYTES ? "frame_truncated" : "invalid_frame_length");
-  const bytes = input.subarray(HOST_PRODUCER_FRAME_LENGTH_BYTES);
-  const text = new TextDecoder("utf-8", { fatal: true });
-  let value;
+var WINDOWS_SECUREFS_REFUSAL_SCHEMA = "ceal.host_securefs_refusal.v1";
+var WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES = 4096;
+var WINDOWS_SECUREFS_TIMEOUT_MS = 1e4;
+var WINDOWS_SECUREFS_DIAGNOSTIC_BYTES = 4096;
+function secureOpenFlags(flags, platform) {
+  if (platform === "win32") return flags;
+  const nofollow = constants.O_NOFOLLOW;
+  if (typeof nofollow === "number" && nofollow !== 0) return flags | nofollow;
+  throw new Error("Secure file reads require O_NOFOLLOW on this platform.");
+}
+async function openNoFollow(path, flags = constants.O_RDONLY, mode, platform = process.platform, _custody = {}) {
+  if (platform !== "win32") return await open2(path, secureOpenFlags(flags, platform), mode);
+  return await openWindowsIdentityScreened(path, flags, mode);
+}
+async function openWindowsIdentityScreened(path, flags, mode) {
+  const handle = await open2(path, flags, mode);
   try {
-    value = JSON.parse(text.decode(bytes));
+    const first = await handle.stat();
+    if (!first.isFile()) throw new SecureFileCustodyError("not_private", "The Windows Host file is not a regular file.");
+    await assertWindowsLinkFree(path, first);
+    await assertWindowsIdentityStable(handle, first, path);
+    return handle;
   } catch (error) {
-    if (error instanceof TypeError) throw new HostProducerFrameError("invalid_frame_encoding");
-    throw new HostProducerFrameError("frame_truncated");
+    await handle.close();
+    throw error;
   }
-  validateFrame(value);
-  return value;
 }
-function isHostSafeRef(value) {
-  return safeRef(value);
-}
-function validateFrame(value) {
-  if (!record(value)) throw new HostProducerFrameError("invalid_frame_shape");
-  if (value.schema_version !== HOST_PRODUCER_FRAME_SCHEMA) throw new HostProducerFrameError("unsupported_frame_schema", `unsupported_frame_schema: ${refusalFact("schema_version", value.schema_version, HOST_PRODUCER_FRAME_SCHEMA)}`);
-  if (!exactKeys2(value, ["schema_version", "producer_id", "producer_installation_ref", "producer_epoch", "sequence", "frame_kind", "occurred_at", "payload"])) throw new HostProducerFrameError("invalid_frame_shape");
-  if (!PRODUCERS.has(String(value.producer_id)) || !safeRef(value.producer_installation_ref)) throw new HostProducerFrameError("invalid_producer_identity");
-  if (!positive(value.producer_epoch) || !positive(value.sequence) || !hostProducerFrameKind(value.frame_kind) || !timestamp(value.occurred_at) || !record(value.payload)) throw new HostProducerFrameError("invalid_frame_shape");
-  validatePayload(value.frame_kind, value.payload);
-}
-function validatePayload(kind, value) {
-  const valid = kind === "session_started" ? validSession(value) : kind === "turn_started" ? validTurn(value) : kind === "user_input" ? validInput(value) : kind === "turn_terminal" ? validTerminal(value) : validStatus(value);
-  if (!valid) throw new HostProducerFrameError("invalid_frame_shape");
-}
-function validSession(value) {
-  return exactOptional(value, ["local_session_ref", "working_directory_ref"], ["model", "host_version", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.working_directory_ref) && optionalText(value.model, 256) && optionalText(value.host_version, 256) && validObservations(value.observations);
+async function assertWindowsLinkFree(path, first) {
+  const entry = await lstat(path);
+  if (entry.isSymbolicLink() || entry.dev !== first.dev || entry.ino !== first.ino) {
+    throw new SecureFileCustodyError("reparse_point", "The Windows Host file path resolves through a reparse point.");
+  }
+}
+async function assertWindowsIdentityStable(handle, first, path) {
+  const second = await handle.stat();
+  if (second.dev !== first.dev || second.ino !== first.ino || second.size !== first.size || second.mtimeMs !== first.mtimeMs) {
+    throw new SecureFileCustodyError("unavailable", "The Windows Host file changed while its identity was checked.");
+  }
+  const entry = await lstat(path);
+  if (entry.isSymbolicLink()) throw new SecureFileCustodyError("reparse_point", "The Windows Host file path resolves through a reparse point.");
+  if (entry.dev !== second.dev || entry.ino !== second.ino) throw new SecureFileCustodyError("unavailable", "The Windows Host file path no longer names the opened file.");
+}
+async function readPrivateFileWithSecurefs(path, maxBytes, custody = {}) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) throw new TypeError("The securefs read bound must be a positive safe integer.");
+  const result = await runWindowsSecurefs(["internal", "securefs", "read-private-file", path, String(maxBytes)], maxBytes, custody);
+  if (result.exit_code === 0 && result.stderr.length === 0 && result.stdout.length <= maxBytes) return result.stdout;
+  if (result.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned bytes with a refusal.");
+  if (result.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command exceeded its output contract.");
+  throw securefsRefusal(result.stderr);
+}
+async function createRandomPrivateFileWithSecurefs(path, byteLength2, custody = {}) {
+  if (!Number.isSafeInteger(byteLength2) || byteLength2 < 1 || byteLength2 > WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES) throw new TypeError(`The securefs random-file size must be between 1 and ${WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES} bytes.`);
+  const result = await runWindowsSecurefs(["internal", "securefs", "create-random-private-file", path, String(byteLength2)], 0, custody);
+  if (result.exit_code === 0 && result.stdout.length === 0 && result.stderr.length === 0) return;
+  if (result.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned unexpected creation bytes.");
+  if (result.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an invalid creation result.");
+  throw securefsRefusal(result.stderr);
+}
+async function runWindowsSecurefs(args, maxBytes, custody) {
+  if (custody.run_securefs_command !== void 0) return await custody.run_securefs_command(args);
+  const executable = custody.securefs_executable ?? resolveInstalledHostExecutable();
+  const processArgs = [...custody.securefs_args_prefix ?? [], ...args];
+  return await new Promise((resolve, reject2) => {
+    execFile2(executable, processArgs, { encoding: "buffer", timeout: WINDOWS_SECUREFS_TIMEOUT_MS, maxBuffer: maxBytes + WINDOWS_SECUREFS_DIAGNOSTIC_BYTES }, (error, stdout, stderr) => {
+      const exitCode = error === null ? 0 : typeof error.code === "number" ? error.code : null;
+      if (exitCode === null) {
+        reject2(new SecureFileCustodyError("unavailable", "The installed Windows Host securefs command could not run."));
+        return;
+      }
+      resolve({ exit_code: exitCode, stdout: Buffer.from(stdout), stderr: Buffer.from(stderr) });
+    });
+  });
 }
-function validTurn(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref"], ["model", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && optionalText(value.model, 256) && validObservations(value.observations);
+function securefsRefusal(stderr) {
+  let value;
+  try {
+    value = JSON.parse(stderr.toString("utf8"));
+  } catch {
+    return new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an unreadable refusal.");
+  }
+  if (!isRecord2(value) || value.schema_version !== WINDOWS_SECUREFS_REFUSAL_SCHEMA || typeof value.code !== "string") return new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an unreadable refusal.");
+  if (value.code === "reparse_point") return new SecureFileCustodyError("reparse_point", "The Windows Host securefs file is a reparse point.");
+  if (value.code === "not_found") return new SecureFileCustodyError("not_found", "The Windows Host securefs file was not found.");
+  if (value.code === "too_large") return new SecureFileCustodyError("too_large", "The Windows Host securefs file exceeds its read bound.");
+  if (value.code === "already_exists") return new SecureFileCustodyError("already_exists", "The Windows Host securefs target already exists.");
+  if (value.code === "not_private") return new SecureFileCustodyError("not_private", "The Windows Host securefs file is not private to the current user.");
+  return new SecureFileCustodyError("unavailable", "The Windows Host securefs command refused the file read.");
 }
-function validInput(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "input_kind", "origin_input", "observations"], ["local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && isCealHostInputKind(value.input_kind) && typeof value.origin_input === "boolean" && validInputOptionals(value);
+function resolveInstalledHostExecutable() {
+  const privateRuntimeRoot = dirname(fileURLToPath(import.meta.url));
+  return win322.join(privateRuntimeRoot, "..", "..", "bin", "ceal-host.exe");
 }
-function validInputObservations(value) {
-  return validObservations(value) && Array.isArray(value) && value.filter((item) => record(item) && item.observation_kind === "prompt").length === 1;
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function validInputOptionals(value) {
-  return optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
+function isOwnedBy(uid, expectedUid) {
+  return Number.isSafeInteger(uid) && Number.isSafeInteger(expectedUid) && uid === expectedUid;
 }
-function validTerminal(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref", "terminal_state"], ["abort_reason", "duration_ms", "time_to_first_token_ms", "usage", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && validTerminalDisposition(value.terminal_state, value.abort_reason) && optionalNonNegative(value.duration_ms) && optionalNonNegative(value.time_to_first_token_ms) && (value.usage === void 0 || jsonValue(value.usage)) && validObservations(value.observations);
+function isSelfOwned(uid, platform = process.platform, _handle) {
+  if (platform === "win32" || typeof process.geteuid !== "function") return false;
+  return isOwnedBy(uid, process.geteuid());
 }
-function validTerminalDisposition(state, reason) {
-  return (state === "completed" || state === "aborted") && (reason === void 0 || state === "aborted" && safeRef(reason));
-}
-function validStatus(value) {
-  return exactOptional(value, ["status", "reason_code"], ["detail"]) && ["ready", "degraded", "stopping"].includes(String(value.status)) && safeRef(value.reason_code) && optionalText(value.detail, 4096);
-}
-function optionalText(value, maxLength) {
-  return value === void 0 || typeof value === "string" && value.length > 0 && value.length <= maxLength;
-}
-function optionalNonNegative(value) {
-  return value === void 0 || typeof value === "number" && Number.isFinite(value) && value >= 0;
-}
-function optionalRefs(value) {
-  return value === void 0 || Array.isArray(value) && value.length <= 16 && value.every(safeRef);
-}
-function validObservations(value) {
-  if (value === void 0) return true;
-  if (!Array.isArray(value) || value.length > 32) return false;
-  return value.every((item) => {
-    try {
-      validateCealHostObservationDraft(item);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-}
-function jsonValue(value, depth = 0) {
-  if (depth > 16) return false;
-  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-  if (typeof value === "number") return Number.isFinite(value);
-  if (Array.isArray(value)) return value.length <= 256 && value.every((item) => jsonValue(item, depth + 1));
-  return record(value) && Object.keys(value).length <= 256 && Object.entries(value).every(([key, item]) => key.length > 0 && key.length <= 128 && jsonValue(item, depth + 1));
-}
-function record(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function safeRef(value) {
-  return typeof value === "string" && SAFE_REF3.test(value);
-}
-function positive(value) {
-  return Number.isSafeInteger(value) && Number(value) > 0;
-}
-function timestamp(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
-function hostProducerFrameKind(value) {
-  return isHostProducerFrameKind(value);
-}
-function exactKeys2(value, keys) {
-  return JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...keys].sort());
-}
-function exactOptional(value, required, optional) {
-  const keys = Object.keys(value);
-  return required.every((key) => keys.includes(key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+function isPrivateFileMode(mode, platform = process.platform, _handle) {
+  if (platform === "win32") return false;
+  return (mode & 63) === 0;
 }
 
 // host/relay/src/host-producer-core.ts
-import { createHash as createHash3 } from "node:crypto";
-import { O_NOFOLLOW, O_RDONLY as O_RDONLY2 } from "node:constants";
-import { mkdir as mkdir2, open as open3, readFile as readFile2, rename as rename2, writeFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
-
-// host/relay/src/relay-ipc.ts
-import { createConnection, createServer } from "node:net";
-
-// host/relay/src/durable-atomic-replacement.ts
-import { O_RDONLY } from "node:constants";
-import { lstat, mkdir, open as open2, rename, unlink } from "node:fs/promises";
-var DEFAULT_PORT = {
-  platform: process.platform,
-  mkdir: (path, options) => mkdir(path, options),
-  lstat: (path) => lstat(path),
-  open_file: (path) => open2(path, "wx", 384),
-  rename,
-  unlink,
-  open_directory: (path) => open2(path, O_RDONLY),
-  unique_ref: () => `${process.pid}.${crypto.randomUUID()}`
-};
-
-// host/relay/src/relay-request-binding-store.ts
-var MAX_STATE_BYTES = 8 * 1024 * 1024;
-
-// host/relay/src/current-prompt-custody.ts
-var HOST_CURRENT_PROMPT_MAX_BYTES = 256 * 1024;
-
-// host/service-log.ts
-function writeHostServiceDiagnostic(producer_id, event, failure_kind, cause, sink) {
-  const line = `${JSON.stringify({ schema_version: CEAL_HOST_SERVICE_DIAGNOSTIC_SCHEMA, producer_id, event, ...event === "watcher_scan_failed" && failure_kind !== void 0 ? { failure_kind } : {}, ...event === "watcher_scan_failed" && cause !== void 0 ? { cause } : {} })}
-`;
-  try {
-    (sink ?? defaultHostServiceDiagnosticSink)(line);
-  } catch {
-  }
-}
-function defaultHostServiceDiagnosticSink(line) {
-  process.stderr.write(line);
-}
-var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
-var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
-
-// host/relay/src/relay-ipc.ts
-var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
-  "schema_version",
-  "producer_id",
-  "producer_installation_ref",
-  "local_session_ref",
-  "local_turn_ref",
-  "local_turn_aliases",
-  "prompt_ref",
-  "request_ref",
-  "bound_at",
-  "host_source_ref",
-  "host_session_ref",
-  "host_turn_ref",
-  "host_input_ref"
-]);
-var HOST_RELAY_IPC_RESPONSE_SCHEMA = "ceal.host_relay_admission.v1";
-var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v1";
-var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v1";
-var HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA = "ceal.host_relay_current_prompt_register.v1";
-var HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA = "ceal.host_relay_current_prompt_release.v1";
-var HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA = "ceal.host_relay_current_prompt_result.v1";
-var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
-var HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES = 4096;
-var HOST_RELAY_QUERY_RESPONSE_MAX_BYTES = 8192;
-var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
-  "context_stale",
-  "context_expired",
-  "host_source_refused",
-  "host_credential_refused",
-  "gateway_unavailable",
-  "gateway_refused",
-  "gateway_response_invalid",
-  "gateway_rate_limited",
-  "producer_frame_invalid",
-  "deadline",
-  "cancelled",
-  "mint_failed",
-  "relay_failed",
-  "request_authority_unavailable",
-  "request_missing",
-  "authority_mismatch",
-  "host_source_mismatch",
-  "host_session_mismatch",
-  "host_turn_mismatch",
-  "host_input_mismatch",
-  "host_prompt_mismatch"
-]);
-var HOST_RELAY_DIRECT_WIRE_MINT_REASONS = vocabulary([
-  "context_stale",
-  "context_expired",
-  "host_source_refused",
-  "host_credential_refused",
-  "gateway_unavailable",
-  "gateway_rate_limited",
-  "gateway_refused",
-  "gateway_response_invalid",
-  "producer_frame_invalid"
-]);
-var HOST_RELAY_INVOCATION_MINT_OUTCOMES = vocabulary(["completed", "caller_cancelled", "deadline", "failed", "no_binding"]);
-var HOST_RELAY_EXCHANGE_FAILURES = vocabulary([
-  "permission_denied",
-  "socket_missing",
-  "connection_refused",
-  "closed_early",
-  "response_invalid",
-  "timed_out",
-  "cancelled",
-  "unavailable"
-]);
-var HostRelayIpcError = class extends Error {
-  code;
-  /** Set only when the client-side socket exchange itself failed. */
-  failure;
-  constructor(code, message = code, failure2) {
-    super(message);
-    this.code = code;
-    this.failure = failure2;
-  }
-};
-var HostRelayCurrentPromptCapacityRefusal = class extends Error {
-  constructor() {
-    super("current_prompt_capacity_exhausted");
-    this.name = "HostRelayCurrentPromptCapacityRefusal";
-  }
-};
-function hostRelayExchangeFailure(error) {
-  return error instanceof HostRelayIpcError ? error.failure : void 0;
-}
-function socketErrorFailure(error) {
-  switch (errorCode2(error)) {
-    case "EACCES":
-    case "EPERM":
-      return "permission_denied";
-    case "ENOENT":
-      return "socket_missing";
-    case "ECONNREFUSED":
-      return "connection_refused";
-    default:
-      return "unavailable";
-  }
-}
-var HostRelayInvocationContextPort = class {
-  endpoint;
-  constructor(endpoint) {
-    this.endpoint = endpoint;
-  }
-  mintInvocationContext(input, signal) {
-    return queryHostRelayInvocationContext(this.endpoint, input, signal);
-  }
-};
-var HostRelayIpcAdmissionPort = class {
-  endpoint;
-  timeout_ms;
-  constructor(endpoint, timeoutMs = 5e3) {
-    this.endpoint = endpoint;
-    this.timeout_ms = timeoutMs;
-  }
-  async admit(frame) {
-    const response2 = await submitHostProducerFrame(this.endpoint, frame, this.timeout_ms);
-    if (!relayAdmissionCode(response2.code)) throw new HostRelayIpcError(response2.code);
-    return { code: response2.code, admitted_through_sequence: response2.admitted_through_sequence, delivered_through_sequence: response2.delivered_through_sequence };
-  }
-};
-var HostRelayCurrentPromptPort = class {
-  endpoint;
-  timeout_ms;
-  constructor(endpoint, timeoutMs = 5e3) {
-    this.endpoint = endpoint;
-    this.timeout_ms = timeoutMs;
-  }
-  async register(input) {
-    const request2 = { schema_version: HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA, ...input };
-    const response2 = await exchange(this.endpoint, encodeLengthPrefixed(request2), this.timeout_ms, decodeCurrentPromptResponseBuffer);
-    if (response2.status === "capacity_exhausted") throw new HostRelayCurrentPromptCapacityRefusal();
-    if (response2.status !== "registered") throw new HostRelayIpcError("relay_unavailable", response2.status);
-  }
-  async release(identity) {
-    const request2 = { schema_version: HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA, ...identity };
-    const response2 = await exchange(this.endpoint, encodeLengthPrefixed(request2), this.timeout_ms, decodeCurrentPromptResponseBuffer);
-    if (response2.status !== "released") throw new HostRelayIpcError("relay_unavailable", response2.status, "response_invalid");
-  }
-};
-function submitHostProducerFrame(endpoint, frame, timeoutMs = 5e3) {
-  return exchange(endpoint, encodeHostProducerFrame(frame), timeoutMs, decodeResponseBuffer);
-}
-function queryHostRelayInvocationContext(endpoint, query, signal) {
-  return exchange(endpoint, encodeInvocationContextQuery(query), void 0, decodeInvocationContextResponseBuffer, signal);
-}
-function exchange(endpoint, encoded, timeoutMs, decode, signal) {
-  return new Promise((resolve, reject2) => {
-    const socket = createConnection(endpoint);
-    let buffer = Buffer.alloc(0);
-    let settled = false;
-    const aborted = () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC was cancelled.", "cancelled"));
-    const finish = (error, response2) => {
-      if (settled) return;
-      settled = true;
-      signal?.removeEventListener("abort", aborted);
-      socket.destroy();
-      if (error !== null) reject2(error);
-      else if (response2 !== void 0) resolve(response2);
-    };
-    if (timeoutMs !== void 0) socket.setTimeout(timeoutMs, () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC timed out.", "timed_out")));
-    if (signal?.aborted === true) {
-      aborted();
-      return;
-    }
-    signal?.addEventListener("abort", aborted, { once: true });
-    socket.once("error", (error) => {
-      const failure2 = socketErrorFailure(error);
-      finish(new HostRelayIpcError("relay_unavailable", `Host Relay IPC is unavailable: ${failure2}.`, failure2));
-    });
-    socket.once("connect", () => socket.write(encoded));
-    socket.on("data", (chunk) => {
-      try {
-        buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
-        const decoded = decode(buffer);
-        if (decoded !== null) finish(null, decoded);
-      } catch (error) {
-        finish(new HostRelayIpcError("relay_unavailable", error instanceof Error ? error.message : "Host Relay IPC response is invalid.", "response_invalid"));
-      }
-    });
-    socket.once("end", () => {
-      if (!settled) finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC closed without a response.", "closed_early"));
-    });
-  });
+var HOST_TRANSCRIPT_CURSOR_REASONS = vocabulary(["transcript_replaced", "transcript_truncated", "transcript_rewritten", "transcript_malformed"]);
+function isHostTranscriptCursorReason(value) {
+  return typeof value === "string" && HOST_TRANSCRIPT_CURSOR_REASONS.some((reason) => reason === value);
 }
-function decodeHostRelayIpcResponse(input) {
-  if (input.length < HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response is truncated: ${refusalFact("response_bytes", input.byteLength, `at least ${HOST_RELAY_IPC_LENGTH_BYTES}`)}.`);
-  const length = input.readUInt32BE(0);
-  if (length === 0 || length > HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES || input.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response length is invalid: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `between 1 and ${HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES}` }, { name: "received_bytes", value: input.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
-  let value;
+var TRANSCRIPT_MISSING_REASON = "transcript_missing";
+var TRANSCRIPT_SCAN_READ_ERROR_ERRNOS = ["EBADF", "EACCES", "EIO", "EMFILE", "ENFILE", "ENOENT", "ENOTDIR", "EPERM"];
+var HOST_INVOCATION_TRANSCRIPT_TAIL_MAX_BYTES = 1024 * 1024;
+async function readBoundedHostTranscriptTail(path, maximumBytes = HOST_INVOCATION_TRANSCRIPT_TAIL_MAX_BYTES) {
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1 || maximumBytes > HOST_INVOCATION_TRANSCRIPT_TAIL_MAX_BYTES) throw new TypeError("Host transcript window byte bound is invalid.");
+  const handle = await openNoFollow(path);
   try {
-    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.subarray(HOST_RELAY_IPC_LENGTH_BYTES)));
-  } catch {
-    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC response is invalid.");
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid)) throw new TypeError("Host transcript source is not an owner-owned regular file.");
+    const truncated = stats.size > maximumBytes;
+    const start = Math.max(0, stats.size - maximumBytes);
+    const bytes = await readTranscriptBytes(handle, start, stats.size - start);
+    return { bytes: truncated ? dropPartialLeadingTranscriptRecord(bytes) : bytes, truncated };
+  } finally {
+    await handle.close();
   }
-  if (!validResponse(value)) throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC response shape is invalid.");
-  return value;
-}
-function relayAdmissionCode(value) {
-  return value === "admitted" || value === "already_admitted" || value === "producer_epoch_stale" || value === "sequence_gap" || value === "frame_identity_conflict" || value === "producer_queue_full" || value === "relay_queue_full" || value === "producer_already_connected" || value === "invalid_producer_identity";
-}
-function validResponse(value) {
-  return record2(value) && value.schema_version === HOST_RELAY_IPC_RESPONSE_SCHEMA && hostRelayIpcCode(value.code) && nonnegative(value.admitted_through_sequence) && nonnegative(value.delivered_through_sequence) && Object.keys(value).length === 4;
-}
-function hostRelayIpcCode(value) {
-  return typeof value === "string" && ["admitted", "already_admitted", "producer_epoch_stale", "sequence_gap", "frame_identity_conflict", "producer_queue_full", "relay_queue_full", "invalid_frame_encoding", "invalid_frame_length", "frame_truncated", "unsupported_frame_schema", "invalid_frame_shape", "invalid_producer_identity", "frame_too_large", "producer_already_connected", "relay_unavailable"].includes(value);
-}
-function nonnegative(value) {
-  return Number.isSafeInteger(value) && Number(value) >= 0;
-}
-function record2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function decodeResponseBuffer(buffer) {
-  if (buffer.length < HOST_RELAY_IPC_LENGTH_BYTES) return null;
-  const length = buffer.readUInt32BE(0);
-  if (length === 0 || length > HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC response length is invalid: ${refusalFact("declared_bytes", length, `between 1 and ${HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES}`)}.`);
-  if (buffer.length < length + HOST_RELAY_IPC_LENGTH_BYTES) return null;
-  if (buffer.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC returned trailing bytes: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `the received message length minus ${HOST_RELAY_IPC_LENGTH_BYTES}` }, { name: "received_bytes", value: buffer.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
-  return decodeHostRelayIpcResponse(buffer);
-}
-function decodeInvocationContextResponseBuffer(buffer) {
-  const value = decodeLengthPrefixedJson(buffer, HOST_RELAY_QUERY_RESPONSE_MAX_BYTES);
-  if (value === null) return null;
-  if (!validInvocationContextResponse(value)) throw new HostRelayIpcError("relay_unavailable", "Host Relay invocation context response is invalid.");
-  return value;
-}
-function decodeCurrentPromptResponseBuffer(buffer) {
-  const value = decodeLengthPrefixedJson(buffer, HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES);
-  if (value === null) return null;
-  if (!record2(value) || !exactKeys3(value, ["schema_version", "status"]) || value.schema_version !== HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA || value.status !== "registered" && value.status !== "capacity_exhausted" && value.status !== "current_prompt_unavailable" && value.status !== "released") throw new HostRelayIpcError("relay_unavailable", "Host Relay current-prompt response is invalid.", "response_invalid");
-  return { schema_version: HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA, status: value.status };
-}
-function encodeInvocationContextQuery(query) {
-  const value = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA, ...query };
-  if (!validInvocationContextQueryRequest(value)) throw new HostRelayIpcError("invalid_frame_shape");
-  return encodeLengthPrefixed(value);
 }
-function validInvocationContextQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) && exactKeys3(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "client_nonce"], ["visible_output_max_bytes"]) && typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
-}
-function validQueryIdentity(value, schema) {
-  return record2(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef2(value.producer_installation_ref) && safeRef2(value.local_session_ref) && safeRef2(value.local_turn_ref);
-}
-function validVisibleOutputBudget(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
-}
-function validInvocationContextResponse(value) {
-  if (!record2(value) || value.schema_version !== HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA) return false;
-  if (value.status === "no_binding") return Object.keys(value).length === 2;
-  if (value.status === "refused") return Object.keys(value).length === 3 && isVocabularyWord(HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS, value.reason);
-  if (value.status !== "ready" || Object.keys(value).length !== 3) return false;
-  try {
-    decodeCealHostInvocationAuthenticationResult(value.result);
-    return true;
-  } catch {
-    return false;
+async function readTranscriptBytes(handle, start, length) {
+  const output = Buffer.alloc(Math.max(0, length));
+  let offset = 0;
+  while (offset < output.length) {
+    const { bytesRead } = await handle.read(output, offset, output.length - offset, start + offset);
+    if (bytesRead === 0) break;
+    offset += bytesRead;
   }
+  return output.subarray(0, offset);
 }
-function decodeLengthPrefixedJson(input, maximum) {
-  if (input.length < HOST_RELAY_IPC_LENGTH_BYTES) return null;
-  const length = input.readUInt32BE(0);
-  if (length === 0 || length > maximum) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC message length is invalid: ${refusalFact("declared_bytes", length, `between 1 and ${maximum}`)}.`);
-  if (input.length < length + HOST_RELAY_IPC_LENGTH_BYTES) return null;
-  if (input.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC message has trailing bytes: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `the received message length minus ${HOST_RELAY_IPC_LENGTH_BYTES}` }, { name: "received_bytes", value: input.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
+function dropPartialLeadingTranscriptRecord(bytes) {
+  if (bytes.length === 0) return bytes;
+  const newline = bytes.indexOf(10);
+  return newline < 0 ? Buffer.alloc(0) : bytes.subarray(newline + 1);
+}
+async function readRegisteredHostInvocationHumanMessageWindow(listRegistrations, identity, decodeLine) {
   try {
-    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.subarray(HOST_RELAY_IPC_LENGTH_BYTES)));
+    const registration = (await listRegistrations()).find((candidate) => candidate.host_source_ref === identity.host_source_ref && candidate.host_session_ref === identity.host_session_ref && Date.parse(candidate.expires_at) > Date.now());
+    if (registration === void 0) throw new TypeError("context_unavailable");
+    return await readHostInvocationHumanMessageWindow(registration.transcript_path, (line) => decodeLine(line, registration));
   } catch {
-    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC message is invalid.");
+    throw new TypeError("context_unavailable");
+  }
+}
+async function readHostInvocationHumanMessageWindow(path, decodeLine) {
+  const tail = await readBoundedHostTranscriptTail(path);
+  const lines = new TextDecoder("utf-8", { fatal: true }).decode(tail.bytes).split("\n");
+  const incompleteTail = lines.at(-1) !== "";
+  if (incompleteTail) lines.pop();
+  let truncated = tail.truncated || incompleteTail;
+  const newestFirst = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of lines.reverse()) {
+    if (line.length === 0) continue;
+    const message = decodeLine(line);
+    if (message === "malformed") {
+      truncated = true;
+      continue;
+    }
+    if (message === null || seen.has(message.host_input_ref)) continue;
+    seen.add(message.host_input_ref);
+    newestFirst.push(message);
   }
+  return boundCealHostInvocationHumanMessageWindow(newestFirst, truncated);
 }
-function encodeLengthPrefixed(value) {
-  const body = Buffer.from(JSON.stringify(value), "utf8");
-  const output = Buffer.allocUnsafe(body.length + HOST_RELAY_IPC_LENGTH_BYTES);
-  output.writeUInt32BE(body.length, 0);
-  body.copy(output, HOST_RELAY_IPC_LENGTH_BYTES);
-  return output;
-}
-function exactKeys3(value, required, optional = []) {
-  const keys = Object.keys(value);
-  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
-}
-function safeRef2(value) {
-  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
-}
-function errorCode2(error) {
-  return record2(error) && typeof error.code === "string" ? error.code : null;
-}
-
-// host/relay/src/host-producer-core.ts
-var HOST_TRANSCRIPT_CURSOR_REASONS = vocabulary(["transcript_replaced", "transcript_truncated", "transcript_rewritten", "transcript_malformed"]);
-function isHostTranscriptCursorReason(value) {
-  return typeof value === "string" && HOST_TRANSCRIPT_CURSOR_REASONS.some((reason) => reason === value);
-}
-var TRANSCRIPT_MISSING_REASON = "transcript_missing";
-var TRANSCRIPT_SCAN_READ_ERROR_ERRNOS = ["EBADF", "EACCES", "EIO", "EMFILE", "ENFILE", "ENOENT", "ENOTDIR", "EPERM"];
 function transcriptScanFailureKind(error, adapterFailureKind) {
   if (transcriptErrorCode(error) === "ELOOP") return "symlink";
   const adapter = adapterFailureKind(error);
@@ -4512,16 +4722,6 @@ function transcriptScanFailureKind(error, adapterFailureKind) {
   if (code !== null && TRANSCRIPT_SCAN_READ_ERROR_ERRNOS.includes(code)) return "read_error";
   return "other";
 }
-async function registerHostCurrentPromptDiagnosed(register, diagnostic) {
-  try {
-    await register();
-    diagnostic("current_prompt_registered");
-    return true;
-  } catch (error) {
-    if (!(error instanceof HostRelayCurrentPromptCapacityRefusal)) diagnostic("current_prompt_registration_failed");
-    throw error;
-  }
-}
 function transcriptErrorCode(error) {
   return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" ? error.code : null;
 }
@@ -4569,10 +4769,10 @@ async function transcriptCursorBoundsReason(handle, cursor, size) {
   return null;
 }
 function transcriptSha256(value) {
-  return createHash3("sha256").update(value).digest("hex");
+  return createHash4("sha256").update(value).digest("hex");
 }
 function transcriptObjectSha256(value) {
-  return createHash3("sha256").update(JSON.stringify(value), "utf8").digest("hex");
+  return createHash4("sha256").update(JSON.stringify(value), "utf8").digest("hex");
 }
 function isTranscriptRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -4633,24 +4833,18 @@ var HostTranscriptWatcher = class {
     return scanTranscriptRegistrations(await this.listRegistrations(), (registration) => this.scanRegistration(registration));
   }
   async scanRegistration(registration) {
-    try {
-      return await this.openTranscript(registration, (handle) => this.scanOpened(handle, registration), {
-        missing: () => this.retireMissing(registration),
-        failed: (handle, error) => this.scanFailed(handle, registration, error)
-      });
-    } catch (error) {
-      if (error instanceof HostRelayCurrentPromptCapacityRefusal) return { records: 0, enqueued: 0, quarantined: false };
-      throw error;
-    }
+    return this.openTranscript(registration, (handle) => this.scanOpened(handle, registration), {
+      missing: () => this.retireMissing(registration),
+      failed: (handle, error) => this.scanFailed(handle, registration, error)
+    });
   }
   async openTranscript(registration, scan, handlers) {
     let handle;
     try {
-      handle = await open3(this.transcriptPathOf(registration), O_RDONLY2 | O_NOFOLLOW);
+      handle = await openNoFollow(this.transcriptPathOf(registration));
       return await scan(handle);
     } catch (error) {
       if (handle === void 0 && isMissingTranscriptError(error)) return handlers.missing();
-      if (hostRelayExchangeFailure(error) !== void 0 || error instanceof HostRelayCurrentPromptCapacityRefusal) throw error;
       return handlers.failed(handle, error);
     } finally {
       await handle?.close();
@@ -4696,29 +4890,12 @@ var HostTranscriptWatcher = class {
     return transcriptCursorBoundsReason(handle, cursor, size);
   }
 };
-var HOST_PRODUCER_STATE_IDENTITY = {
-  codex: { file_name: "codex-producer-state.json", schema: "ceal.codex_producer_state.v1" },
-  claude: { file_name: "claude-producer-state.json", schema: "ceal.claude_producer_state.v1" }
-};
 var HostProducerDrainCore = class {
   host;
-  relay;
-  statePath;
-  stateSchema;
-  installationRef;
-  epoch;
   now;
   tail = Promise.resolve();
   constructor(host, runtime) {
-    if (!isHostSafeRef(runtime.producer_installation_ref)) throw host.fail("configuration", `${host.producer_label} producer installation identity is invalid.`);
-    const epoch = runtime.producer_epoch ?? 1;
-    if (!Number.isSafeInteger(epoch) || epoch <= 0) throw host.fail("configuration", `${host.producer_label} producer epoch is invalid.`);
     this.host = host;
-    this.relay = runtime.relay;
-    this.statePath = join3(host.outbox_directory, HOST_PRODUCER_STATE_IDENTITY[host.producer_id].file_name);
-    this.stateSchema = HOST_PRODUCER_STATE_IDENTITY[host.producer_id].schema;
-    this.installationRef = runtime.producer_installation_ref;
-    this.epoch = epoch;
     this.now = runtime.now ?? (() => /* @__PURE__ */ new Date());
   }
   drainOutbox() {
@@ -4728,145 +4905,563 @@ var HostProducerDrainCore = class {
   }
   async drainLocked() {
     const read = await this.host.listEnvelopes();
-    let admitted = 0;
+    let removed = 0;
     let expired = 0;
-    let retained = 0;
     for (const envelope of read.entries) {
-      const reserved = await this.hasReservation(this.host.submissionRefOf(envelope));
-      if (!reserved && Date.parse(this.host.expiresAtOf(envelope)) <= this.now().getTime()) {
-        await this.host.removeEnvelope(envelope);
-        expired += 1;
-        continue;
+      if (Date.parse(this.host.expiresAtOf(envelope)) <= this.now().getTime()) expired += 1;
+      else removed += 1;
+      await this.host.removeEnvelope(envelope);
+    }
+    return { removed, expired, malformed: read.malformed };
+  }
+};
+
+// host/relay/src/durable-atomic-replacement.ts
+import { lstat as lstat2, mkdir, open as open3, rename, unlink } from "node:fs/promises";
+var DEFAULT_PORT = {
+  platform: process.platform,
+  mkdir: (path, options) => mkdir(path, options),
+  lstat: (path) => lstat2(path),
+  open_file: (path) => open3(path, "wx", 384),
+  rename,
+  unlink,
+  open_directory: (path) => open3(path),
+  unique_ref: () => `${process.pid}.${crypto.randomUUID()}`
+};
+
+// host/relay/src/relay-quarantine-store.ts
+var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
+var RELAY_QUARANTINE_FRAME_REASONS = ["frame_identity_conflict", "sequence_gap", "gateway_refused"];
+var RELAY_QUARANTINE_REASONS = [...RELAY_QUARANTINE_FRAME_REASONS, ...HOST_PRODUCER_FRAME_ERROR_CODES];
+
+// host/relay/src/relay-admission-store.ts
+var DEFAULT_LIMITS = { global_count: 8192, global_bytes: 64 * 1024 * 1024, producer_count: 4096, producer_bytes: 32 * 1024 * 1024 };
+var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
+var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
+
+// host/relay/src/relay-ipc.ts
+import { createConnection, createServer } from "node:net";
+
+// host/relay/src/relay-pipe-handshake.ts
+import { createHmac, randomBytes } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { link, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
+var RELAY_PIPE_HANDSHAKE_TIMEOUT_MS = 5e3;
+var RELAY_PIPE_KEY_BYTES = 32;
+var RELAY_PIPE_KEY_FILENAME = "relay-pipe.key";
+var RELAY_PIPE_NONCE_BYTES = 32;
+var RELAY_PIPE_NONCE_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
+var RELAY_PIPE_HELLO_SCHEMA = "ceal.host_relay_pipe_hello.v1";
+var RELAY_PIPE_CHALLENGE_SCHEMA = "ceal.host_relay_pipe_challenge.v1";
+var RELAY_PIPE_RESPONSE_SCHEMA = "ceal.host_relay_pipe_response.v1";
+var RELAY_PIPE_FRAME_BYTES = Uint32Array.BYTES_PER_ELEMENT;
+var RELAY_PIPE_FRAME_MAX_BYTES = 1024;
+var RelayPipeHandshakeError = class extends Error {
+  name = "RelayPipeHandshakeError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+function relayPipeStateRootForOutboxDir(outboxDir) {
+  return join3(dirname2(dirname2(dirname2(outboxDir))), "relay");
+}
+function relayPipeKeyPath(relayStateRoot) {
+  return join3(relayStateRoot, RELAY_PIPE_KEY_FILENAME);
+}
+async function loadRelayPipeKey(relayStateRoot, platform = process.platform, custody = {}) {
+  const path = relayPipeKeyPath(relayStateRoot);
+  if (platform === "win32") return await loadWindowsRelayPipeKey(path, custody);
+  const existing = await readRelayPipeKey(path, platform, custody);
+  if (existing !== null) return existing;
+  return await createPosixRelayPipeKey(path, platform, custody);
+}
+async function loadWindowsRelayPipeKey(path, custody) {
+  const existing = await readRelayPipeKey(path, "win32", custody);
+  if (existing !== null) return existing;
+  try {
+    await createRandomPrivateFileWithSecurefs(path, RELAY_PIPE_KEY_BYTES, custody);
+  } catch (error) {
+    if (errorCode2(error) === "EEXIST") return await readWinnerPipeKey(path, "win32", custody);
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}; delete it and restart the Host Relay.`);
+  }
+  return await readWinnerPipeKey(path, "win32", custody);
+}
+async function createPosixRelayPipeKey(path, platform, custody) {
+  const key = randomBytes(RELAY_PIPE_KEY_BYTES);
+  const staging = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  let handle;
+  try {
+    handle = await openNoFollow(staging, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL, 384);
+  } catch (error) {
+    if (errorCode2(error) !== "EEXIST") throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+    return await readWinnerPipeKey(path, platform, custody);
+  }
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid) || !isPrivateFileMode(stats.mode)) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a private regular file owned by the current user.`);
+    await handle.writeFile(key);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  try {
+    await link(staging, path);
+  } catch (error) {
+    if (errorCode2(error) !== "EEXIST") throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+    return await readWinnerPipeKey(path, platform, custody);
+  } finally {
+    await unlink2(staging).catch(() => void 0);
+  }
+  return Buffer.from(key);
+}
+async function readWinnerPipeKey(path, platform, custody) {
+  const winner = await readRelayPipeKey(path, platform, custody);
+  if (winner === null) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+  return winner;
+}
+async function readRelayPipeKey(path, platform, custody) {
+  if (platform === "win32") return await readWindowsRelayPipeKey(path, custody);
+  return await readPosixRelayPipeKey(path);
+}
+async function readWindowsRelayPipeKey(path, custody) {
+  let key;
+  try {
+    key = await readPrivateFileWithSecurefs(path, RELAY_PIPE_KEY_BYTES, custody);
+  } catch (error) {
+    if (errorCode2(error) === "ENOENT" || errorCode2(error) === "ELOOP") return null;
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}; delete it and restart the Host Relay.`);
+  }
+  if (key.byteLength !== RELAY_PIPE_KEY_BYTES) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} has ${key.byteLength} bytes; want ${RELAY_PIPE_KEY_BYTES}. Delete the file and restart the Host Relay.`);
+  return Buffer.from(key);
+}
+async function readPosixRelayPipeKey(path) {
+  let handle;
+  try {
+    handle = await openNoFollow(path);
+  } catch (error) {
+    if (errorCode2(error) === "ENOENT" || errorCode2(error) === "ELOOP") return null;
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+  }
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile()) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a regular file; delete it and restart the Host Relay.`);
+    if (!isSelfOwned(stats.uid) || !isPrivateFileMode(stats.mode)) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a private file owned by the current user; delete it and restart the Host Relay.`);
+    if (stats.size !== RELAY_PIPE_KEY_BYTES) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} has ${stats.size} bytes; want ${RELAY_PIPE_KEY_BYTES}. Delete the file and restart the Host Relay.`);
+    return await handle.readFile();
+  } finally {
+    await handle.close();
+  }
+}
+function createPipeClientNonce() {
+  return randomBytes(RELAY_PIPE_NONCE_BYTES).toString("base64url");
+}
+function pipeProof(key, role, firstNonce, secondNonce) {
+  return createHmac("sha256", key).update(`${role}\0${firstNonce}\0${secondNonce}`, "utf8").digest("hex");
+}
+function createPipeServerProof(key, clientNonce, serverNonce) {
+  return pipeProof(key, "server", clientNonce, serverNonce);
+}
+function createPipeClientProof(key, serverNonce, clientNonce) {
+  return pipeProof(key, "client", serverNonce, clientNonce);
+}
+function encodePipeFrame(value) {
+  const body = Buffer.from(JSON.stringify(value), "utf8");
+  const output = Buffer.allocUnsafe(body.length + RELAY_PIPE_FRAME_BYTES);
+  output.writeUInt32BE(body.length, 0);
+  body.copy(output, RELAY_PIPE_FRAME_BYTES);
+  return output;
+}
+function decodePipeFrame(buffer) {
+  if (buffer.length < RELAY_PIPE_FRAME_BYTES) return null;
+  const length = buffer.readUInt32BE(0);
+  if (length === 0 || length > RELAY_PIPE_FRAME_MAX_BYTES) throw new RelayPipeHandshakeError("pipe_handshake_invalid", `Host Relay pipe handshake frame declares ${length} bytes; want between 1 and ${RELAY_PIPE_FRAME_MAX_BYTES}.`);
+  if (buffer.length < length + RELAY_PIPE_FRAME_BYTES) return null;
+  let value;
+  try {
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(RELAY_PIPE_FRAME_BYTES, length + RELAY_PIPE_FRAME_BYTES)));
+  } catch {
+    throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is not JSON.");
+  }
+  return { value, rest: buffer.subarray(length + RELAY_PIPE_FRAME_BYTES) };
+}
+function validNonce(value) {
+  return typeof value === "string" && RELAY_PIPE_NONCE_PATTERN.test(value);
+}
+function writePipeFrame(socket, frame) {
+  if (socket.write(frame)) return Promise.resolve();
+  return new Promise((resolve, reject2) => {
+    socket.once("drain", resolve);
+    socket.once("error", reject2);
+    socket.once("close", () => reject2(new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake connection closed.")));
+  });
+}
+function readPipeFrames() {
+  let buffer = Buffer.alloc(0);
+  let pending = null;
+  const feed = (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    if (pending === null) return;
+    let frame;
+    try {
+      frame = decodePipeFrame(buffer);
+    } catch (error) {
+      const waiting2 = pending;
+      pending = null;
+      waiting2.reject(error instanceof Error ? error : new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is invalid."));
+      return;
+    }
+    if (frame === null) return;
+    buffer = frame.rest;
+    const waiting = pending;
+    pending = null;
+    waiting.resolve({ value: frame.value, rest: Buffer.alloc(0) });
+  };
+  const waiter = {
+    wait: () => new Promise((resolve, reject2) => {
+      let frame;
+      try {
+        frame = decodePipeFrame(buffer);
+      } catch (error) {
+        reject2(error instanceof Error ? error : new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is invalid."));
+        return;
       }
-      const frames = await this.reserve(envelope);
-      let complete = true;
-      for (const frame of frames) {
-        const outcome = await this.relay.admit(frame);
-        if (outcome.code !== "admitted" && outcome.code !== "already_admitted") {
-          complete = false;
-          break;
-        }
+      if (frame !== null) {
+        buffer = frame.rest;
+        resolve({ value: frame.value, rest: Buffer.alloc(0) });
+        return;
       }
-      if (!complete) {
-        retained += 1;
-        break;
+      pending = { resolve, reject: reject2 };
+    }),
+    cancel: (error) => {
+      if (pending !== null) {
+        const waiting = pending;
+        pending = null;
+        waiting.reject(error);
       }
-      await this.host.removeEnvelope(envelope);
-      await this.release(this.host.submissionRefOf(envelope));
-      admitted += 1;
     }
-    return { admitted, retained: retained + Math.max(0, read.entries.length - admitted - expired - retained), expired, malformed: read.malformed };
-  }
-  async hasReservation(submissionRef) {
-    return (await this.readState()).pending[submissionRef] !== void 0;
-  }
-  async reserve(envelope) {
-    const state = await this.readState();
-    const submissionRef = this.host.submissionRefOf(envelope);
-    const existing = state.pending[submissionRef];
-    if (existing !== void 0) return existing;
-    const drafts = await this.host.mapEnvelope(envelope);
-    const frames = drafts.map((draft, offset) => ({
-      schema_version: "ceal.host_producer_frame.v1",
-      producer_id: this.host.producer_id,
-      producer_installation_ref: this.installationRef,
-      producer_epoch: this.epoch,
-      sequence: state.next_sequence + offset,
-      frame_kind: draft.frame_kind,
-      occurred_at: this.host.createdAtOf(envelope),
-      payload: draft.payload
-    }));
-    await this.writeState({ ...state, next_sequence: state.next_sequence + frames.length, pending: { ...state.pending, [submissionRef]: frames } });
-    return frames;
+  };
+  return { waiter, feed, remainder: () => buffer };
+}
+function attachHandshakeReader(socket, waiter, feed) {
+  const onData = (chunk) => feed(Buffer.from(chunk));
+  const onError = (error) => waiter.cancel(error);
+  const onClose = () => waiter.cancel(new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake connection closed."));
+  socket.on("data", onData);
+  socket.once("error", onError);
+  socket.once("close", onClose);
+  return () => {
+    socket.removeListener("data", onData);
+    socket.removeListener("error", onError);
+    socket.removeListener("close", onClose);
+  };
+}
+function handshakeTimeout(timeoutMs) {
+  let timer;
+  const done = new Promise((_resolve, reject2) => {
+    timer = setTimeout(() => reject2(new RelayPipeHandshakeError("pipe_handshake_timeout", `Host Relay pipe handshake stalled past ${timeoutMs} ms; dropping the connection.`)), timeoutMs);
+    timer.unref?.();
+  });
+  return { done, clear: () => clearTimeout(timer) };
+}
+async function conductPipeClientHandshake(socket, key, timeoutMs = RELAY_PIPE_HANDSHAKE_TIMEOUT_MS) {
+  const bound = handshakeTimeout(timeoutMs);
+  const { waiter, feed } = readPipeFrames();
+  const detach = attachHandshakeReader(socket, waiter, feed);
+  try {
+    const clientNonce = createPipeClientNonce();
+    await Promise.race([writePipeFrame(socket, encodePipeFrame({ schema_version: RELAY_PIPE_HELLO_SCHEMA, client_nonce: clientNonce })), bound.done]);
+    const challenge = await Promise.race([waiter.wait(), bound.done]);
+    if (!isRecord3(challenge.value) || challenge.value.schema_version !== RELAY_PIPE_CHALLENGE_SCHEMA || !validNonce(challenge.value.server_nonce) || typeof challenge.value.server_proof !== "string") {
+      throw new RelayPipeHandshakeError("pipe_server_unproven", "Host Relay pipe server proof is invalid; aborting before sending any request.");
+    }
+    const serverNonce = challenge.value.server_nonce;
+    const expected = createPipeServerProof(key, clientNonce, serverNonce);
+    if (!timingSafeEqualHex(expected, challenge.value.server_proof)) {
+      throw new RelayPipeHandshakeError("pipe_server_unproven", "Host Relay pipe server proof failed; aborting before sending any request.");
+    }
+    const clientProof = createPipeClientProof(key, serverNonce, clientNonce);
+    await Promise.race([writePipeFrame(socket, encodePipeFrame({ schema_version: RELAY_PIPE_RESPONSE_SCHEMA, client_proof: clientProof })), bound.done]);
+  } finally {
+    bound.clear();
+    detach();
   }
-  async release(submissionRef) {
-    const state = await this.readState();
-    if (state.pending[submissionRef] === void 0) return;
-    const pending = { ...state.pending };
-    delete pending[submissionRef];
-    await this.writeState({ ...state, pending });
+}
+function timingSafeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) diff |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  return diff === 0;
+}
+function isRecord3(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function errorCode2(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
+}
+
+// host/relay/src/relay-ipc.ts
+var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v2";
+var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v2";
+var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
+var HOST_RELAY_QUERY_RESPONSE_MAX_BYTES = 8192;
+var HOST_RELAY_EXCHANGE_FAILURES = vocabulary([
+  "permission_denied",
+  "socket_missing",
+  "connection_refused",
+  "closed_early",
+  "response_invalid",
+  "timed_out",
+  "cancelled",
+  "unavailable"
+]);
+var HostRelayIpcError = class extends Error {
+  code;
+  /** Set only when the client-side socket exchange itself failed. */
+  failure;
+  constructor(code, message = code, failure2) {
+    super(message);
+    this.code = code;
+    this.failure = failure2;
+  }
+};
+function hostRelayExchangeFailure(error) {
+  return error instanceof HostRelayIpcError ? error.failure : void 0;
+}
+function socketErrorFailure(error) {
+  switch (errorCode3(error)) {
+    case "EACCES":
+    case "EPERM":
+      return "permission_denied";
+    case "ENOENT":
+      return "socket_missing";
+    case "ECONNREFUSED":
+      return "connection_refused";
+    default:
+      return "unavailable";
+  }
+}
+var HostRelayInvocationContextPort = class {
+  endpoint;
+  pipe_key;
+  timeout_ms;
+  constructor(endpoint, pipeKey, timeoutMs = 5e3) {
+    this.endpoint = endpoint;
+    this.pipe_key = pipeKey;
+    this.timeout_ms = timeoutMs;
   }
-  async readState() {
-    try {
-      const value = JSON.parse(await readFile2(this.statePath, "utf8"));
-      return this.decodeState(value);
-    } catch (error) {
-      if (errorCode3(error) !== "ENOENT") throw error;
-      return { schema_version: this.stateSchema, producer_installation_ref: this.installationRef, producer_epoch: this.epoch, next_sequence: 1, pending: {} };
-    }
+  mintInvocationContext(input, signal) {
+    return queryHostRelayInvocationContext(this.endpoint, input, this.timeout_ms, signal, this.pipe_key);
   }
-  async writeState(state) {
-    await mkdir2(this.host.outbox_directory, { recursive: true, mode: 448 });
-    const temporary = `${this.statePath}.${process.pid}.new`;
-    await writeFile(temporary, JSON.stringify(state), { mode: 384 });
-    await rename2(temporary, this.statePath);
-  }
-  decodeState(value) {
-    const label = this.host.producer_label;
-    const fail = (code, message) => this.host.fail(code, message);
-    if (!isDrainStateHeader(value, this.stateSchema, this.installationRef)) {
-      throw fail("storage", `${label} producer state header is malformed or belongs to another installation (${refusalFacts([
-        { name: "schema_version", value: isTranscriptRecord(value) ? value.schema_version : void 0, expected: this.stateSchema },
-        { name: "producer_installation_ref", value: isTranscriptRecord(value) ? value.producer_installation_ref : void 0, expected: this.installationRef }
-      ])}).`);
+};
+function queryHostRelayInvocationContext(endpoint, query, timeoutMs, signal, pipeKey) {
+  return exchange(endpoint, encodeInvocationContextQuery(query), timeoutMs, decodeInvocationContextResponseBuffer, signal, pipeKey);
+}
+function exchange(endpoint, encoded, timeoutMs, decode, signal, pipeKey) {
+  return new Promise((resolve, reject2) => {
+    const socket = createConnection(endpoint);
+    let buffer = Buffer.alloc(0);
+    let settled = false;
+    const aborted = () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC was cancelled.", "cancelled"));
+    const finish = (error, response2) => {
+      if (settled) return;
+      settled = true;
+      signal?.removeEventListener("abort", aborted);
+      socket.destroy();
+      if (error !== null) reject2(error);
+      else if (response2 !== void 0) resolve(response2);
+    };
+    if (timeoutMs !== void 0) socket.setTimeout(timeoutMs, () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC timed out.", "timed_out")));
+    if (signal?.aborted === true) {
+      aborted();
+      return;
     }
-    if (Number(value.producer_epoch) > this.epoch) throw fail("storage", `${label} producer state epoch is ahead of this installation (${refusalFact("producer_epoch", value.producer_epoch, `at most ${this.epoch}`)}).`);
-    const pending = {};
-    const storedEpoch = Number(value.producer_epoch);
-    for (const [submissionRef, frames] of Object.entries(value.pending)) {
-      if (!isHostSafeRef(submissionRef) || !Array.isArray(frames) || frames.length === 0) throw fail("storage", `${label} producer pending reservation is malformed.`);
-      pending[submissionRef] = frames.map((frame) => this.decodeStoredFrame(frame, storedEpoch));
+    signal?.addEventListener("abort", aborted, { once: true });
+    socket.once("error", (error) => {
+      const failure2 = socketErrorFailure(error);
+      finish(new HostRelayIpcError("relay_unavailable", `Host Relay IPC is unavailable: ${failure2}.`, failure2));
+    });
+    socket.once("connect", () => {
+      void beginExchange();
+    });
+    async function beginExchange() {
+      try {
+        if (process.platform === "win32") {
+          if (pipeKey === void 0) throw new HostRelayIpcError("relay_unavailable", "Host Relay pipe key is unavailable; refusing to send any request.");
+          await conductPipeClientHandshake(socket, pipeKey, RELAY_PIPE_HANDSHAKE_TIMEOUT_MS);
+        }
+      } catch (error) {
+        finish(error instanceof HostRelayIpcError ? error : new HostRelayIpcError("relay_unavailable", error instanceof Error ? error.message : "Host Relay pipe handshake failed.", "closed_early"));
+        return;
+      }
+      if (settled) return;
+      socket.once("error", (error) => {
+        const failure2 = socketErrorFailure(error);
+        finish(new HostRelayIpcError("relay_unavailable", `Host Relay IPC is unavailable: ${failure2}.`, failure2));
+      });
+      socket.on("data", (chunk) => {
+        try {
+          buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+          const decoded = decode(buffer);
+          if (decoded !== null) finish(null, decoded);
+        } catch (error) {
+          finish(new HostRelayIpcError("relay_unavailable", error instanceof Error ? error.message : "Host Relay IPC response is invalid.", "response_invalid"));
+        }
+      });
+      socket.once("end", () => {
+        if (!settled) finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC closed without a response.", "closed_early"));
+      });
+      socket.write(encoded);
     }
-    return { schema_version: this.stateSchema, producer_installation_ref: this.installationRef, producer_epoch: this.epoch, next_sequence: Number(value.next_sequence), pending };
-  }
-  decodeStoredFrame(value, storedEpoch) {
-    const label = this.host.producer_label;
-    const json = Buffer.from(JSON.stringify(value), "utf8");
-    const encoded = Buffer.allocUnsafe(json.length + 4);
-    encoded.writeUInt32BE(json.length, 0);
-    json.copy(encoded, 4);
-    const frame = decodeHostProducerFrame(encoded);
-    if (frame.producer_id !== this.host.producer_id || frame.producer_installation_ref !== this.installationRef || frame.producer_epoch > storedEpoch) throw this.host.fail("storage", `${label} producer pending frame identity is malformed (${refusalFacts([
-      { name: "producer_id", value: frame.producer_id, expected: this.host.producer_id },
-      { name: "producer_installation_ref", value: frame.producer_installation_ref, expected: this.installationRef },
-      { name: "producer_epoch", value: frame.producer_epoch, expected: `at most ${storedEpoch}` }
-    ])}).`);
-    return frame;
+  });
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function decodeInvocationContextResponseBuffer(buffer) {
+  const value = decodeLengthPrefixedJson(buffer, HOST_RELAY_QUERY_RESPONSE_MAX_BYTES);
+  if (value === null) return null;
+  if (!validInvocationContextResponse(value)) throw new HostRelayIpcError("relay_unavailable", "Host Relay invocation context response is invalid.");
+  return value;
+}
+function encodeInvocationContextQuery(query) {
+  const value = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA, ...query };
+  if (!validInvocationContextQueryRequest(value)) throw new HostRelayIpcError("invalid_frame_shape");
+  return encodeLengthPrefixed(value);
+}
+function validInvocationContextQueryRequest(value) {
+  if (!validQueryEnvelope(value)) return false;
+  try {
+    decodeCealHostInvocationContextRequest({
+      schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+      client_nonce: value.client_nonce,
+      context_expires_at: value.context_expires_at,
+      host_binding: value.host_binding,
+      human_message_window: value.human_message_window,
+      ...value.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: value.visible_output_max_bytes }
+    });
+    return true;
+  } catch {
+    return false;
   }
-};
-function isDrainStateHeader(value, schema, installationRef) {
-  return isTranscriptRecord(value) && value.schema_version === schema && value.producer_installation_ref === installationRef && Number.isSafeInteger(value.producer_epoch) && Number(value.producer_epoch) > 0 && Number.isSafeInteger(value.next_sequence) && Number(value.next_sequence) > 0 && isTranscriptRecord(value.pending);
+}
+function validQueryEnvelope(value) {
+  if (!validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) || !exactKeys2(value, ["schema_version", "producer_id", "producer_installation_ref", "client_nonce", "context_expires_at", "host_binding", "human_message_window"], ["visible_output_max_bytes"])) return false;
+  return typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && typeof value.context_expires_at === "string" && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
+}
+function validQueryIdentity(value, schema) {
+  return record(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef(value.producer_installation_ref);
+}
+function validVisibleOutputBudget(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
+}
+function validInvocationContextResponse(value) {
+  if (!record(value) || value.schema_version !== HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA) return false;
+  return value.status === "refused" ? validInvocationContextRefusal(value) : validReadyInvocationContext(value);
+}
+function validInvocationContextRefusal(value) {
+  return exactKeys2(value, ["schema_version", "status", "reason"]) && isCealHostAuthenticationCause(value.reason) && value.reason !== "no_binding";
+}
+function validReadyInvocationContext(value) {
+  if (value.status !== "ready" || !exactKeys2(value, ["schema_version", "status", "request_ref", "result"]) || !safeRef(value.request_ref) || !value.request_ref.startsWith("ceal-request:") || !record(value.result)) return false;
+  const result = value.result;
+  return exactKeys2(result, ["schema_version", "context_token", "expires_at"]) && result.schema_version === CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA && typeof result.context_token === "string" && CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(result.context_token) && typeof result.expires_at === "string" && Number.isFinite(Date.parse(result.expires_at));
+}
+function decodeLengthPrefixedJson(input, maximum) {
+  if (input.length < HOST_RELAY_IPC_LENGTH_BYTES) return null;
+  const length = input.readUInt32BE(0);
+  if (length === 0 || length > maximum) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC message length is invalid: ${refusalFact("declared_bytes", length, `between 1 and ${maximum}`)}.`);
+  if (input.length < length + HOST_RELAY_IPC_LENGTH_BYTES) return null;
+  if (input.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC message has trailing bytes: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `the received message length minus ${HOST_RELAY_IPC_LENGTH_BYTES}` }, { name: "received_bytes", value: input.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input.subarray(HOST_RELAY_IPC_LENGTH_BYTES)));
+  } catch {
+    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC message is invalid.");
+  }
+}
+function encodeLengthPrefixed(value) {
+  const body = Buffer.from(JSON.stringify(value), "utf8");
+  const output = Buffer.allocUnsafe(body.length + HOST_RELAY_IPC_LENGTH_BYTES);
+  output.writeUInt32BE(body.length, 0);
+  body.copy(output, HOST_RELAY_IPC_LENGTH_BYTES);
+  return output;
+}
+function exactKeys2(value, required, optional = []) {
+  const keys = Object.keys(value);
+  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function safeRef(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
 function errorCode3(error) {
-  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
+  return record(error) && typeof error.code === "string" ? error.code : null;
 }
 
-// host/relay/src/relay-quarantine-store.ts
-var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
-var RELAY_QUARANTINE_FRAME_REASONS = ["frame_identity_conflict", "sequence_gap", "gateway_refused"];
-var RELAY_QUARANTINE_REASONS = [...RELAY_QUARANTINE_FRAME_REASONS, ...HOST_PRODUCER_FRAME_ERROR_CODES];
+// host/service-log.ts
+import { copyFile, mkdir as mkdir2, stat as stat2, truncate, appendFile } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute as isAbsolute2, posix, win32 as win323 } from "node:path";
+var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
+function writeHostServiceDiagnostic(producer_id, event, failure_kind, cause, sink) {
+  const line = `${JSON.stringify({ schema_version: CEAL_HOST_SERVICE_DIAGNOSTIC_SCHEMA, producer_id, event, ...event === "watcher_scan_failed" && failure_kind !== void 0 ? { failure_kind } : {}, ...event === "watcher_scan_failed" && cause !== void 0 ? { cause } : {} })}
+`;
+  try {
+    (sink ?? defaultHostServiceDiagnosticSink)(line);
+  } catch {
+  }
+}
+function defaultHostServiceDiagnosticSink(line) {
+  writeHostServiceLogLine(line);
+  process.stderr.write(line);
+}
+var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
+function writeHostServiceLogLine(line, environment = process.env) {
+  if (process.platform !== "win32") return;
+  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
+  if (path === void 0 || !win323.isAbsolute(path) || win323.normalize(path) !== path) return;
+  void appendHostServiceLogLine(path, line).catch(() => void 0);
+}
+async function appendHostServiceLogLine(path, line) {
+  if (!isAbsolute2(path)) return;
+  await ensureHostServiceLogDirectory(path);
+  await appendFile(path, line);
+}
+var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
+var hostServiceLogDirectories = /* @__PURE__ */ new Map();
+function ensureHostServiceLogDirectory(path) {
+  const directory = dirname3(path);
+  const existing = hostServiceLogDirectories.get(directory);
+  if (existing !== void 0) return existing;
+  const pending = mkdir2(directory, { recursive: true, mode: 448 }).then(() => void 0).catch((error) => {
+    hostServiceLogDirectories.delete(directory);
+    throw error;
+  });
+  hostServiceLogDirectories.set(directory, pending);
+  return pending;
+}
 
-// host/relay/src/relay-admission-store.ts
-var DEFAULT_LIMITS = { global_count: 8192, global_bytes: 64 * 1024 * 1024, producer_count: 4096, producer_bytes: 32 * 1024 * 1024 };
-var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
-var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
+// host/local-capability-descriptor.ts
+var HOST_LOCAL_CAPABILITY_AUTHENTICATION_SUFFIX = Object.freeze(["authenticate", "--client-nonce"]);
 
 // host/invocation-authentication-command.ts
-var HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX = ["authenticate", "--client-nonce"];
-var HOST_AUTHENTICATION_BUDGET_ENVIRONMENT = "CEAL_HOST_AUTHENTICATION_BUDGET_MS";
 var HOST_CONTEXT_ACTIVATION_WAIT_MAX_MS = 2e4;
 var CODEX_CONTEXT_ACTIVATION_WAIT_MAX_MS = HOST_CONTEXT_ACTIVATION_WAIT_MAX_MS;
 var HOST_AUTHENTICATION_COMPLETION_RESERVE_MS = 5e3;
 var INVOCATION_CONTEXT_POLL_INTERVAL_MS = 250;
 var REFUSAL_REASON_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
 function installedHostInvocationAuthenticationCommandOptions(config, contextBudgetMs, maxContextWaitMs) {
-  const port = new HostRelayInvocationContextPort(config.relay_endpoint);
+  let pipeKey;
+  const loadPipeKey = () => {
+    if (pipeKey === void 0) pipeKey = process.platform === "win32" ? loadRelayPipeKey(relayPipeStateRootForOutboxDir(config.outbox_dir)) : Promise.resolve(void 0);
+    return pipeKey;
+  };
   return {
     host_source_ref: config.host_source_ref,
     outbox_dir: config.outbox_dir,
     producer_installation_ref: config.producer_installation_ref,
     context_activation_wait_ms: boundedContextActivationWait(contextBudgetMs, config.ipc_timeout_ms, maxContextWaitMs),
-    mint_invocation_context: (input) => port.mintInvocationContext({ ...input, producer_id: input.producer_id })
+    mint_invocation_context: async (input) => new HostRelayInvocationContextPort(config.relay_endpoint, await loadPipeKey(), config.ipc_timeout_ms).mintInvocationContext(input)
   };
 }
 async function runHostInvocationAuthenticationCommand(descriptor2, args, options) {
@@ -4887,26 +5482,31 @@ function authenticationRefusalReason(error) {
   return isCealHostAuthenticationCause(message) ? message : "host_refusal_invalid";
 }
 async function authenticateHostInvocation(descriptor2, input, options) {
-  if (input.length !== HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX.length + 1 || input[0] !== HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX[0] || input[1] !== HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX[1]) throw new TypeError("invalid_arguments");
+  if (input.length !== HOST_LOCAL_CAPABILITY_AUTHENTICATION_SUFFIX.length + 1 || input[0] !== HOST_LOCAL_CAPABILITY_AUTHENTICATION_SUFFIX[0] || input[1] !== HOST_LOCAL_CAPABILITY_AUTHENTICATION_SUFFIX[1]) throw new TypeError("invalid_arguments");
   const request2 = decodeCealHostInvocationAuthenticationRequest({ schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA, client_nonce: input[2] });
   const config = validateOptions(options);
   const now = config.now ?? (() => /* @__PURE__ */ new Date());
   const { store, current } = await currentInvocation(descriptor2, config, now);
   if (config.mint_invocation_context === void 0) throw new TypeError("relay_failed");
-  const query = {
-    producer_id: descriptor2.producer_id,
-    producer_installation_ref: config.producer_installation_ref,
-    local_session_ref: current.identity.host_session_ref,
-    local_turn_ref: current.identity.host_turn_ref,
-    client_nonce: request2.client_nonce,
-    ...await visibleOutputBudget(descriptor2)
-  };
+  const query = await invocationMintQuery(descriptor2, store, current, request2.client_nonce, config);
   const response2 = await mintedResult(config.mint_invocation_context, query);
   const completedAt = now();
   const rechecked = await store.readInvocationContext(current.identity.host_source_ref, current.identity.host_session_ref, completedAt);
   if (rechecked === null || !sameTurn(current, rechecked)) throw new TypeError("context_replaced");
   return decodeCealHostInvocationAuthenticationResult(response2.result, completedAt);
 }
+async function invocationMintQuery(descriptor2, store, current, clientNonce, options) {
+  const readWindow = options.read_human_message_window?.(current.identity) ?? descriptor2.read_human_message_window?.({ store, identity: current.identity }) ?? Promise.resolve({ messages: [], truncated: false });
+  return {
+    producer_id: descriptor2.producer_id,
+    producer_installation_ref: options.producer_installation_ref,
+    client_nonce: clientNonce,
+    context_expires_at: current.expires_at,
+    host_binding: { ...current.identity },
+    human_message_window: await readWindow,
+    ...await visibleOutputBudget(descriptor2)
+  };
+}
 async function visibleOutputBudget(descriptor2) {
   const bytes = await descriptor2.resolve_visible_output_max_bytes?.();
   return bytes === void 0 ? {} : { visible_output_max_bytes: bytes };
@@ -4916,30 +5516,15 @@ async function mintedResult(mint, query) {
   try {
     response2 = await mint(query);
   } catch (error) {
-    throw new TypeError(exchangeFailureCause(hostRelayExchangeFailure(error) ?? "unavailable"));
+    throw new TypeError(cealHostAuthenticationCauseForExchangeFailure(hostRelayExchangeFailure(error) ?? "unavailable"));
   }
-  if (response2.status === "refused") throw new TypeError(mintRefusalCause(response2.reason));
-  if (response2.status !== "ready") throw new TypeError("no_binding");
+  if (response2.status !== "ready") throw new TypeError(isCealHostAuthenticationCause(response2.reason) && response2.reason !== "no_binding" ? response2.reason : "host_refusal_invalid");
   return response2;
 }
-function mintRefusalCause(reason) {
-  if (isDirectMintRefusalCause(reason)) return reason;
-  if (reason === "deadline" || reason === "cancelled") return "transient_retryable";
-  if (reason === "mint_failed" || reason === "relay_failed") return reason;
-  return isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, reason) ? "context_stale" : "host_refusal_invalid";
-}
-function isDirectMintRefusalCause(reason) {
-  return isVocabularyWord(HOST_RELAY_DIRECT_WIRE_MINT_REASONS, reason);
-}
-function exchangeFailureCause(failure2) {
-  if (failure2 === "permission_denied") return "relay_permission_denied";
-  if (failure2 === "timed_out") return "transient_retryable";
-  return "relay_unavailable";
-}
 async function currentInvocation(descriptor2, config, now) {
   const store = descriptor2.create_store(config.outbox_dir);
   const identity = resolveIdentity(descriptor2, config);
-  if (identity.status !== "ready") throw new TypeError(identity.status);
+  if (identity.status === "session_unavailable") throw new TypeError("no_binding");
   const waitBudgetMs = config.context_activation_wait_ms ?? 0;
   const monotonicNow = config.monotonic_now ?? (() => performance.now());
   const deadline = monotonicNow() + waitBudgetMs;
@@ -5003,9 +5588,9 @@ async function resolveOptions(descriptor2, args, options) {
   };
 }
 function authenticationBudgetMsFromEnvironment() {
-  const value = process.env[HOST_AUTHENTICATION_BUDGET_ENVIRONMENT];
+  const value = process.env[CEAL_HOST_AUTHENTICATION_BUDGET_ENVIRONMENT];
   if (value === void 0) return 0;
-  if (!/^(?:0|[1-9][0-9]{0,8})$/u.test(value)) throw new TypeError("invalid_arguments");
+  if (!CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN.test(value)) throw new TypeError("invalid_arguments");
   return Number(value);
 }
 function boundedContextActivationWait(contextBudgetMs, relayTimeoutMs, maxContextWaitMs) {
@@ -5042,16 +5627,16 @@ function writeResult(value, sink) {
 }
 
 // host/producer-service.ts
-import { posix as posix3, win32 as win323 } from "node:path";
+import { posix as posix4, win32 as win326 } from "node:path";
 
 // host/runtime-source-paths.ts
-import { createHash as createHash4 } from "node:crypto";
-import { posix as posix2, win32 as win322 } from "node:path";
+import { createHash as createHash5 } from "node:crypto";
+import { posix as posix3, win32 as win325 } from "node:path";
 
 // host/absolute-path.ts
-import { posix, win32 } from "node:path";
+import { posix as posix2, win32 as win324 } from "node:path";
 function isAbsoluteNormalizedNonRootPath(value, flavor = process.platform, allowRoot = false) {
-  const pathApi = flavor === "win32" || flavor === "windows" ? win32 : posix;
+  const pathApi = flavor === "win32" || flavor === "windows" ? win324 : posix2;
   return typeof value === "string" && value.length <= 4096 && !value.includes("\0") && pathApi.isAbsolute(value) && pathApi.normalize(value) === value && (allowRoot || pathApi.parse(value).root !== value);
 }
 
@@ -5063,28 +5648,23 @@ function hostSourceUuid(sourceRef) {
 function hostRuntimeSourcePaths(stateRoot, sourceRef, platform = process.platform) {
   const sourceId = hostSourceUuid(sourceRef);
   if (!isAbsoluteNormalizedNonRootPath(stateRoot, platform) || sourceId === null) throw new TypeError("Host runtime source identity is invalid.");
-  const path = platform === "win32" ? win322 : posix2;
+  const path = platform === "win32" ? win325 : posix3;
   const sourcesRoot = path.join(stateRoot, "sources");
   const sourceRoot = path.join(sourcesRoot, sourceId);
   const runtimeRoot = path.join(stateRoot, "run");
-  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash4("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
-  assertHostRuntimeIpcLength(endpoint, platform);
+  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash5("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
   return { sourceId, sourcesRoot, sourceRoot, relayRoot: path.join(sourceRoot, "relay"), codexOutbox: path.join(sourceRoot, "producers", "codex", "outbox"), claudeOutbox: path.join(sourceRoot, "producers", "claude", "outbox"), endpoint, runtimeRoot };
 }
-function assertHostRuntimeIpcLength(endpoint, platform) {
-  if (platform === "win32") return;
-  const maximum = platform === "linux" ? 107 : 103;
-  if (Buffer.byteLength(endpoint, "utf8") > maximum) throw Object.assign(new TypeError(`ipc_endpoint_too_long: Host IPC path exceeds ${maximum} bytes; use a shorter Host state root.`), { code: "ipc_endpoint_too_long" });
-}
 function assertHostProducerSourcePaths(stateRoot, config, producer, platform = process.platform) {
   const paths = hostRuntimeSourcePaths(stateRoot, config.host_source_ref, platform);
-  if (config.outbox_dir !== (producer === "codex" ? paths.codexOutbox : paths.claudeOutbox) || config.relay_endpoint !== paths.endpoint) throw new TypeError("Host producer outbox and IPC must belong to its configured source.");
+  if (config.outbox_dir !== (producer === "codex" ? paths.codexOutbox : paths.claudeOutbox) || platform !== "win32" && config.relay_endpoint !== paths.endpoint) throw new TypeError("Host producer outbox and IPC must belong to its configured source.");
+  return paths.endpoint;
 }
 
 // host/producer-service.ts
-import { constants } from "node:fs";
-import { lstat as lstat2, open as open4 } from "node:fs/promises";
-var SAFE_REF4 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+import { constants as constants3 } from "node:fs";
+import { lstat as lstat3 } from "node:fs/promises";
+var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var HOST_PRODUCER_CONFIG_FLAG = "--ceal-host-config";
 var HostProducerServiceError = class extends Error {
   code;
@@ -5095,18 +5675,19 @@ var HostProducerServiceError = class extends Error {
   }
 };
 var HOST_PRODUCER_CONFIG_KEYS = ["schema_version", "host_source_ref", "producer_installation_ref", "producer_epoch", "outbox_dir", "relay_endpoint"];
+var HOST_PRODUCER_CONFIG_ENDPOINT_KEY = "relay_endpoint";
 var HOST_PRODUCER_TIMING_DEFAULTS = Object.freeze({ reconcile_interval_ms: 250, retry_backoff_ms: 1e3, ipc_timeout_ms: 5e3 });
 function hostProducerExtraPath(extras, key) {
   const value = extras[key];
-  if (value === void 0) throw hostProducerError("invalid_config");
+  if (value === void 0) throw hostProducerError("invalid_config", refusalFact(key, "missing", "an absolute path"));
   return value;
 }
 function parseHostProducerConfigFlag(args, platform = process.platform) {
   return parseProducerHostConfigFlag(args, HOST_PRODUCER_CONFIG_FLAG, platform, hostProducerError);
 }
-async function readHostProducerConfig(descriptor2, configPath, platform = process.platform) {
-  const config = decodeHostProducerConfigText(descriptor2, await readProducerConfigText(configPath, platform, hostProducerError), platform);
-  const path = platform === "win32" ? win323 : posix3;
+async function readHostProducerConfig(descriptor2, configPath, platform = process.platform, custody = {}) {
+  const config = decodeHostProducerConfigText(descriptor2, await readProducerConfigText(configPath, platform, hostProducerError, custody), platform);
+  const path = platform === "win32" ? win326 : posix4;
   const root = path.resolve(config.outbox_dir, "../../../../..");
   try {
     assertHostProducerSourcePaths(root, config, descriptor2.producer_id, platform);
@@ -5132,15 +5713,31 @@ function parseProducerHostConfigFlag(args, flag, platform, error) {
   assertProducerAbsolutePath(value, platform, "config", error);
   return value;
 }
-async function readProducerConfigText(configPath, platform, error) {
-  assertProducerAbsolutePath(configPath, platform, "config", error);
+async function readProducerConfigText(configPath, platform, error, custody) {
+  assertProducerAbsolutePath(configPath, process.platform, "config", error);
+  if (platform === "win32") {
+    let bytes;
+    try {
+      bytes = await readPrivateFileWithSecurefs(configPath, CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES, custody);
+    } catch (cause) {
+      if (cause instanceof SecureFileCustodyError && cause.reason === "not_private") throw error("config_not_private");
+      if (cause instanceof SecureFileCustodyError && cause.reason === "too_large") throw error("invalid_config", refusalFact("config_bytes", "over_limit", `at most ${CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES}`));
+      if (cause instanceof SecureFileCustodyError && cause.reason === "reparse_point") throw error("invalid_config");
+      throw error("config_unavailable");
+    }
+    if (bytes.byteLength === 0) throw error("invalid_config", refusalFact("config_bytes", 0, `between 1 and ${CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES}`));
+    try {
+      return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      throw error("invalid_config");
+    }
+  }
   const pathStat = await configPathStat(configPath, error);
   validateConfigFile(pathStat, platform, error);
-  const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
-  const handle = await openConfigFile(configPath, constants.O_RDONLY | noFollow, error);
+  const handle = await openConfigFile(configPath, platform, error, custody);
   try {
     const opened = await handle.stat();
-    validateConfigFile(opened, platform, error);
+    validateConfigFile(opened, platform, error, handle);
     validateOpenedFile(opened, pathStat, platform, error);
     return await readBoundedConfig(handle, opened.size, error);
   } finally {
@@ -5148,8 +5745,9 @@ async function readProducerConfigText(configPath, platform, error) {
   }
 }
 function decodeProducerConfigCore(text, options) {
+  const ownership = producerConfigKeyOwnership(options.keys, options.platform);
   const value = parseCanonicalJson(text, options.error);
-  if (!isRecord2(value) || !hasConfigKeys(value, options.keys) || value.schema_version !== options.schema) throw options.error("invalid_config");
+  if (!isRecord4(value) || !hasConfigKeys(value, ownership.required, ownership.tolerated) || value.schema_version !== options.schema) throw options.error("invalid_config", refusalFacts(producerShapeFacts(value, { schema: options.schema, keys: ownership.required, tolerated: ownership.tolerated })));
   const hostSourceRef = typeof value.host_source_ref === "string" ? value.host_source_ref : "";
   const installationRef = typeof value.producer_installation_ref === "string" ? value.producer_installation_ref : "";
   const producerEpoch = validateIdentity(hostSourceRef, installationRef, value.producer_epoch, options.error);
@@ -5167,14 +5765,21 @@ function decodeProducerConfigCore(text, options) {
     producer_installation_ref: installationRef,
     producer_epoch: producerEpoch,
     outbox_dir: value.outbox_dir,
-    relay_endpoint: value.relay_endpoint,
+    relay_endpoint: producerConfigEndpoint(value),
     reconcile_interval_ms: intervals[0],
     retry_backoff_ms: intervals[1],
     ipc_timeout_ms: intervals[2]
   };
 }
+function producerConfigKeyOwnership(keys, platform) {
+  if (platform !== "win32") return { required: keys, tolerated: [] };
+  return { required: keys.filter((key) => key !== HOST_PRODUCER_CONFIG_ENDPOINT_KEY), tolerated: [HOST_PRODUCER_CONFIG_ENDPOINT_KEY] };
+}
+function producerConfigEndpoint(value) {
+  return typeof value.relay_endpoint === "string" ? value.relay_endpoint : "";
+}
 function assertProducerRelayEndpoint(value, platform, error) {
-  if (platform === "win32" && typeof value === "string" && /^\\\\\.\\pipe\\[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(value)) return;
+  if (platform === "win32") return;
   assertProducerAbsolutePath(value, platform, "runtime", error);
 }
 function assertProducerAbsolutePath(value, platform, kind, error) {
@@ -5182,26 +5787,27 @@ function assertProducerAbsolutePath(value, platform, kind, error) {
 }
 async function configPathStat(configPath, error) {
   try {
-    return await lstat2(configPath);
+    return await lstat3(configPath);
   } catch {
     throw error("config_unavailable");
   }
 }
-function validateConfigFile(value, platform, error) {
+function validateConfigFile(value, platform, error, handle) {
   if (!value.isFile() || value.isSymbolicLink()) throw error("invalid_config", refusalFacts([{ name: "config_is_file", value: value.isFile(), expected: "true" }, { name: "config_is_symlink", value: value.isSymbolicLink(), expected: "false" }]));
   if (value.size <= 0 || value.size > CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES) throw error("invalid_config", refusalFact("config_bytes", value.size, `between 1 and ${CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES}`));
-  if (platform !== "win32" && (value.uid !== process.getuid?.() || (value.mode & 63) !== 0)) throw error("config_not_private", refusalFacts([{ name: "platform", value: platform, expected: "win32 or owner-private" }, { name: "config_uid", value: value.uid, expected: "the current user" }, { name: "config_mode", value: value.mode, expected: "owner-private" }]));
+  if (!isSelfOwned(value.uid, platform, handle) || !isPrivateFileMode(value.mode, platform, handle)) throw error("config_not_private", refusalFacts([{ name: "platform", value: platform, expected: "a platform with verifiable owner and private-mode facts" }, { name: "config_uid", value: value.uid, expected: "the current user" }, { name: "config_mode", value: value.mode, expected: "private to its owner" }]));
 }
-async function openConfigFile(configPath, flags, error) {
+async function openConfigFile(configPath, platform, error, custody) {
   try {
-    return await open4(configPath, flags);
-  } catch {
+    return await openNoFollow(configPath, constants3.O_RDONLY, void 0, platform, custody);
+  } catch (error_) {
+    if (error_ instanceof SecureFileCustodyError) throw error(error_.reason === "not_private" ? "config_not_private" : "invalid_config");
     throw error("config_unavailable");
   }
 }
 function validateOpenedFile(opened, pathStat, platform, error) {
   if (!opened.isFile()) throw error("config_unavailable", refusalFacts([{ name: "opened_is_file", value: opened.isFile(), expected: "true" }, { name: "opened_mode", value: opened.mode.toString(8), expected: "a regular file mode" }]));
-  if (platform !== "win32" && (opened.dev !== pathStat.dev || opened.ino !== pathStat.ino)) throw error("config_unavailable", refusalFacts([{ name: "platform", value: platform, expected: "win32, or the same file the path named" }, { name: "opened_device", value: opened.dev, expected: String(pathStat.dev) }, { name: "opened_inode", value: opened.ino, expected: String(pathStat.ino) }]));
+  if (opened.dev !== pathStat.dev || opened.ino !== pathStat.ino) throw error("config_unavailable", refusalFacts([{ name: "platform", value: platform, expected: "the same file the path named" }, { name: "opened_device", value: opened.dev, expected: String(pathStat.dev) }, { name: "opened_inode", value: opened.ino, expected: String(pathStat.ino) }]));
 }
 async function readBoundedConfig(handle, expectedBytes, error) {
   const buffer = Buffer.allocUnsafe(expectedBytes + 1);
@@ -5233,34 +5839,58 @@ function firstDifferenceIndex(left, right) {
   for (let index = 0; index < shared; index += 1) if (left[index] !== right[index]) return index;
   return shared;
 }
+function producerShapeFacts(value, options) {
+  if (!isRecord4(value)) return [{ name: "config", value: "wrong_type", expected: "a record" }];
+  const tolerated = options.tolerated ?? [];
+  const allowed = [...options.keys, ...tolerated, ...Object.keys(HOST_PRODUCER_TIMING_DEFAULTS)];
+  const facts = [
+    ...Object.keys(value).filter((key) => !allowed.includes(key)).map((key) => ({ name: key, value: "unknown", expected: `one of ${[...options.keys, ...tolerated].join(", ")}` })),
+    ...options.keys.filter((key) => !Object.hasOwn(value, key)).map((key) => ({ name: key, value: "missing", expected: "present" }))
+  ];
+  if (Object.hasOwn(value, "schema_version") && value.schema_version !== options.schema) facts.push({ name: "schema_version", value: "wrong_type", expected: options.schema });
+  return facts;
+}
 function validateIdentity(sourceRef, installationRef, epoch, error) {
-  if (!SAFE_REF4.test(sourceRef) || !SAFE_REF4.test(installationRef) || !positive2(epoch, 2147483647)) throw error("invalid_config");
+  if (!SAFE_REF3.test(sourceRef) || !SAFE_REF3.test(installationRef) || !positive(epoch, 2147483647)) throw error("invalid_config", refusalFacts(producerIdentityFacts(sourceRef, installationRef, epoch)));
   return epoch;
 }
+function producerIdentityFacts(sourceRef, installationRef, epoch) {
+  const facts = [];
+  if (!SAFE_REF3.test(sourceRef)) facts.push({ name: "host_source_ref", value: "wrong_type", expected: "a safe reference" });
+  if (!SAFE_REF3.test(installationRef)) facts.push({ name: "producer_installation_ref", value: "wrong_type", expected: "a safe reference" });
+  if (!positive(epoch, 2147483647)) facts.push({ name: "producer_epoch", value: "wrong_type", expected: "a positive integer" });
+  return facts;
+}
 function validateIntervals(reconcile, retry, timeout, error) {
-  if (!boundedMilliseconds(reconcile) || !boundedMilliseconds(retry) || !boundedMilliseconds(timeout)) throw error("invalid_config");
+  if (!boundedMilliseconds(reconcile) || !boundedMilliseconds(retry) || !boundedMilliseconds(timeout)) throw error("invalid_config", refusalFacts(producerIntervalFacts(reconcile, retry, timeout)));
   return [reconcile, retry, timeout];
 }
-function hasConfigKeys(value, required) {
-  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || Object.hasOwn(HOST_PRODUCER_TIMING_DEFAULTS, key));
+function producerIntervalFacts(reconcile, retry, timeout) {
+  const facts = [];
+  if (!boundedMilliseconds(reconcile)) facts.push({ name: "reconcile_interval_ms", value: "wrong_type", expected: "25..60000 milliseconds" });
+  if (!boundedMilliseconds(retry)) facts.push({ name: "retry_backoff_ms", value: "wrong_type", expected: "25..60000 milliseconds" });
+  if (!boundedMilliseconds(timeout)) facts.push({ name: "ipc_timeout_ms", value: "wrong_type", expected: "25..60000 milliseconds" });
+  return facts;
 }
-function isRecord2(value) {
+function hasConfigKeys(value, required, tolerated = []) {
+  return required.every((key) => Object.hasOwn(value, key)) && Object.keys(value).every((key) => required.includes(key) || tolerated.includes(key) || Object.hasOwn(HOST_PRODUCER_TIMING_DEFAULTS, key));
+}
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function positive2(value, maximum) {
+function positive(value, maximum) {
   return Number.isSafeInteger(value) && Number(value) > 0 && Number(value) <= maximum;
 }
 function boundedMilliseconds(value) {
-  return positive2(value, 6e4) && Number(value) >= 25;
+  return positive(value, 6e4) && Number(value) >= 25;
 }
 
 // host/codex/src/codex-decoder.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 
 // host/codex/src/codex-types.ts
 var CODEX_THREAD_ID_ENVIRONMENT = "CODEX_THREAD_ID";
 var CODEX_OUTBOX_SCHEMA_VERSION = "ceal.codex_observation_outbox.v1";
-var CODEX_TURN_BINDING_SCHEMA_VERSION = "ceal.codex_turn_binding.v1";
 var CODEX_SESSION_SCHEMA_VERSION = "ceal.codex_session.v1";
 var CODEX_INVOCATION_CONTEXT_SCHEMA_VERSION = "ceal.codex_invocation_context.v1";
 var CODEX_TRANSCRIPT_REGISTRATION_SCHEMA_VERSION = "ceal.codex_transcript_registration.v1";
@@ -5276,20 +5906,20 @@ var CodexHostAdapterError = class extends Error {
 };
 
 // host/codex/src/codex-decoder.ts
-var SAFE_REF5 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+var SAFE_REF4 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var MAX_PAYLOAD_BYTES = 512 * 1024;
-function observationRef(event, identity, value) {
-  return cealHostObservationRef("codex", shortDigest({ event, identity, value }));
+function observationRef(hostSourceRef, event, identity, value) {
+  return cealHostObservationRef("codex", shortDigest({ host_source_ref: hostSourceRef, event, identity, value }));
 }
 function hostSessionReference(sourceRef, sessionId) {
   return `codex-session:${shortDigest({ source_ref: sourceRef, session_id: sessionId })}`;
 }
 function hostTurnReference(sourceRef, sessionRef, nativeTurnId) {
-  if (![sourceRef, sessionRef, nativeTurnId].every((value) => SAFE_REF5.test(value))) throw new CodexHostAdapterError("invalid_input", "Codex turn identity is invalid.");
+  if (![sourceRef, sessionRef, nativeTurnId].every((value) => SAFE_REF4.test(value))) throw new CodexHostAdapterError("invalid_input", "Codex turn identity is invalid.");
   return `codex-turn:${shortDigest({ source_ref: sourceRef, session_ref: sessionRef, native_turn_id: nativeTurnId })}`;
 }
 function hostInputReference(sourceRef, sessionRef, nativeTurnId, messageId, ordinal, prompt) {
-  if (![sourceRef, sessionRef, nativeTurnId, messageId].every((value) => SAFE_REF5.test(value)) || !Number.isSafeInteger(ordinal) || ordinal < 0) {
+  if (![sourceRef, sessionRef, nativeTurnId, messageId].every((value) => SAFE_REF4.test(value)) || !Number.isSafeInteger(ordinal) || ordinal < 0) {
     throw new CodexHostAdapterError("invalid_input", "Codex input identity is invalid.");
   }
   return `codex-input:${shortDigest({ source_ref: sourceRef, session_ref: sessionRef, native_turn_id: nativeTurnId, message_id: messageId, ordinal, prompt_sha256: sha256(prompt) })}`;
@@ -5301,25 +5931,24 @@ function turnObservationValue(sessionId, turnRef, status) {
   return { status, host_session_id_sha256: sha256(sessionId), host_turn_ref: turnRef };
 }
 function sha256(value) {
-  return createHash5("sha256").update(value, "utf8").digest("hex");
+  return createHash6("sha256").update(value, "utf8").digest("hex");
 }
 function shortDigest(value) {
   return cealRequestSha256(value);
 }
 
 // host/codex/src/codex-outbox.ts
-import { O_NOFOLLOW as O_NOFOLLOW2, O_RDONLY as O_RDONLY3 } from "node:constants";
-import { lstat as lstat3, mkdir as mkdir3, open as open5, readdir, rename as rename3, unlink as unlink2 } from "node:fs/promises";
-import { dirname, isAbsolute as isAbsolute2, join as join4 } from "node:path";
+import { mkdir as mkdir3, open as open4, readdir, rename as rename2, stat as stat3, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join4 } from "node:path";
 
 // host/invocation-context.ts
-var HOST_INVOCATION_IDENTITY_KEYS = ["host_session_ref", "host_turn_ref", "host_source_ref"];
+var HOST_INVOCATION_TURN_SELECTION_SCHEMA = "ceal.host_invocation_turn_selection.v1";
 var HOST_INVOCATION_CONTEXT_REQUIRED_KEYS = ["schema_version", "identity", "prompt_ref", "expires_at"];
 function invocationContextKey(identity) {
   return cealRequestSha256({ host_source_ref: identity.host_source_ref, host_session_ref: identity.host_session_ref });
 }
 function hasHostInvocationIdentityKeys(value) {
-  return exactKeys4(value, HOST_INVOCATION_IDENTITY_KEYS);
+  return exactKeys3(value, CEAL_HOST_INVOCATION_IDENTITY_KEYS);
 }
 function hasHostInvocationContextKeys(value, optional = []) {
   return requiredKeys(value, HOST_INVOCATION_CONTEXT_REQUIRED_KEYS, optional);
@@ -5345,12 +5974,9 @@ function invocationContextFromTurn(identity, promptRef, expiresAt, descriptor2)
   return Object.freeze(context);
 }
 function isHostInvocationTurnSelection(value) {
-  return isRecord3(value) && Object.keys(value).length === 5 && value.schema_version === "ceal.host_invocation_turn_selection.v1" && ["host_source_ref", "host_session_ref", "prompt_ref", "turn_generation_ref"].every((key) => safeRef3(value[key]));
+  return isRecord5(value) && Object.keys(value).length === 5 && value.schema_version === HOST_INVOCATION_TURN_SELECTION_SCHEMA && ["host_source_ref", "host_session_ref", "prompt_ref", "turn_generation_ref"].every((key) => safeRef2(value[key]));
 }
-function invocationTurnSelectionMatches(context, selection) {
-  return selection === null || context !== null && selection.host_source_ref === context.identity.host_source_ref && selection.host_session_ref === context.identity.host_session_ref && selection.prompt_ref === context.prompt_ref && selection.turn_generation_ref === context.turn_generation_ref;
-}
-function exactKeys4(value, keys) {
+function exactKeys3(value, keys) {
   const actual = Object.keys(value);
   return actual.length === keys.length && keys.every((key) => Object.hasOwn(value, key)) && actual.every((key) => keys.includes(key));
 }
@@ -5359,10 +5985,10 @@ function requiredKeys(value, required, optional) {
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   return actual.length >= required.length && actual.length <= allowed.size && required.every((key) => Object.hasOwn(value, key)) && actual.every((key) => allowed.has(key));
 }
-function isRecord3(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function safeRef3(value) {
+function safeRef2(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
 
@@ -5378,59 +6004,40 @@ function validateCodexHostInvocationContext(value) {
   validateContextReferences(value);
   validateContextTimes(value);
 }
-function invocationContextFromBinding(binding, turnGenerationRef) {
-  const context = {
-    schema_version: CODEX_INVOCATION_CONTEXT_SCHEMA_VERSION,
-    identity: binding.identity,
-    prompt_ref: binding.prompt_ref,
-    request_ref: binding.request_ref,
-    bound_at: binding.bound_at,
-    expires_at: binding.expires_at,
-    ...turnGenerationRef === void 0 ? {} : { turn_generation_ref: turnGenerationRef }
-  };
-  validateCodexHostInvocationContext(context);
-  return Object.freeze(context);
-}
 function validateIdentity2(value) {
-  if (!isRecord4(value) || !hasHostInvocationIdentityKeys(value) || ![value.host_session_ref, value.host_turn_ref, value.host_source_ref].every(safeRef4)) {
+  if (!isRecord6(value) || !hasHostInvocationIdentityKeys(value) || ![value.host_session_ref, value.host_turn_ref, value.host_source_ref].every(safeRef3)) {
     throw new CodexHostAdapterError("storage", "Codex Host invocation identity is malformed.");
   }
 }
 function isContextShape(value) {
-  return isRecord4(value) && hasHostInvocationContextKeys(value, ["request_ref", "bound_at", "turn_generation_ref"]) && value.schema_version === CODEX_INVOCATION_CONTEXT_SCHEMA_VERSION;
+  return isRecord6(value) && hasHostInvocationContextKeys(value, ["turn_generation_ref"]) && value.schema_version === CODEX_INVOCATION_CONTEXT_SCHEMA_VERSION;
 }
 function validateContextReferences(value) {
-  if (!safeRef4(value.prompt_ref) || !optionalSafeRef(value.request_ref) || !optionalSafeRef(value.turn_generation_ref)) throw new CodexHostAdapterError("storage", "Codex Host invocation context is malformed.");
+  if (!safeRef3(value.prompt_ref) || !optionalSafeRef(value.turn_generation_ref)) throw new CodexHostAdapterError("storage", "Codex Host invocation context is malformed.");
 }
 function validateContextTimes(value) {
   const expiresAt = value.expires_at;
-  const boundAt = value.bound_at;
-  if (!timestamp2(expiresAt) || !optionalTimestamp(boundAt)) throw new CodexHostAdapterError("storage", "Codex Host invocation context is malformed.");
-  if (typeof boundAt === "string" && Date.parse(boundAt) > Date.parse(expiresAt)) throw new CodexHostAdapterError("storage", `Codex Host invocation context has invalid binding time (${refusalFact("bound_at", boundAt, `at or before ${expiresAt}`)}).`);
+  if (!timestamp(expiresAt)) throw new CodexHostAdapterError("storage", "Codex Host invocation context is malformed.");
 }
 function optionalSafeRef(value) {
-  return value === void 0 || safeRef4(value);
-}
-function optionalTimestamp(value) {
-  return value === void 0 || timestamp2(value);
+  return value === void 0 || safeRef3(value);
 }
-function safeRef4(value) {
+function safeRef3(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
-function timestamp2(value) {
+function timestamp(value) {
   return typeof value === "string" && value.length <= 64 && Number.isFinite(Date.parse(value));
 }
-function isRecord4(value) {
+function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
 // host/codex/src/codex-outbox.ts
-var SAFE_REF6 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+var SAFE_REF5 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS = 4096;
 var CodexOutboxStore = class {
   directory;
   entriesDirectory;
-  bindingsDirectory;
   sessionsDirectory;
   activeContextsDirectory;
   turnSelectionsDirectory;
@@ -5440,7 +6047,6 @@ var CodexOutboxStore = class {
     if (typeof directory !== "string" || directory.length === 0) throw new CodexHostAdapterError("configuration", "Codex outbox directory is required.");
     this.directory = directory;
     this.entriesDirectory = join4(directory, "entries");
-    this.bindingsDirectory = join4(directory, "bindings");
     this.sessionsDirectory = join4(directory, "sessions");
     this.activeContextsDirectory = join4(directory, "active-contexts");
     this.turnSelectionsDirectory = join4(directory, "turn-selections");
@@ -5448,8 +6054,8 @@ var CodexOutboxStore = class {
     this.cursorsDirectory = join4(directory, "transcript-cursors");
   }
   async prepare() {
-    for (const path of [this.directory, this.entriesDirectory, this.bindingsDirectory, this.sessionsDirectory, this.activeContextsDirectory, this.turnSelectionsDirectory, this.registrationsDirectory, this.cursorsDirectory]) {
-      await ensurePrivateOwnerDirectory(path);
+    for (const path of [this.directory, this.entriesDirectory, this.sessionsDirectory, this.activeContextsDirectory, this.turnSelectionsDirectory, this.registrationsDirectory, this.cursorsDirectory]) {
+      await ensureOwnerDirectory(path);
     }
   }
   async put(entry) {
@@ -5464,7 +6070,7 @@ var CodexOutboxStore = class {
     for (const name of await readdir(this.entriesDirectory)) {
       if (!name.endsWith(".json")) continue;
       try {
-        const value = JSON.parse(await readPrivateFile(join4(this.entriesDirectory, name)));
+        const value = JSON.parse(await readOwnerStateFile(join4(this.entriesDirectory, name)));
         validateEnvelope(value);
         entries.push(value);
       } catch {
@@ -5477,16 +6083,11 @@ var CodexOutboxStore = class {
   async remove(entry) {
     validateEnvelope(entry);
     try {
-      await unlink2(this.entryPath(entry.submission_ref));
+      await unlink3(this.entryPath(entry.submission_ref));
     } catch (error) {
       if (!isNotFound(error)) throw storageError("Unable to remove the Codex outbox entry.");
     }
   }
-  async writeBinding(binding) {
-    validateBinding(binding);
-    await this.prepare();
-    await writeAtomicJson(this.bindingPath(binding.identity), binding);
-  }
   /**
    * Select the exact Host turn that model-reachable commands may use. A new
    * prompt replaces this projection, so it cannot inherit the prior turn's
@@ -5500,7 +6101,7 @@ var CodexOutboxStore = class {
       await writeAtomicJson(path, context);
     } catch (error) {
       try {
-        await unlink2(path);
+        await unlink3(path);
       } catch (unlinkError) {
         if (!isNotFound(unlinkError)) throw storageError("Unable to clear a failed Codex Host context replacement.");
       }
@@ -5513,7 +6114,7 @@ var CodexOutboxStore = class {
     await writeAtomicJson(this.turnSelectionPath(selection.host_source_ref, selection.host_session_ref), selection);
   }
   async readInvocationTurnSelection(hostSourceRef, hostSessionRef) {
-    if (!SAFE_REF6.test(hostSourceRef) || !SAFE_REF6.test(hostSessionRef)) throw new CodexHostAdapterError("invalid_input", "Codex Host turn selection identity is invalid.");
+    if (!SAFE_REF5.test(hostSourceRef) || !SAFE_REF5.test(hostSessionRef)) throw new CodexHostAdapterError("invalid_input", "Codex Host turn selection identity is invalid.");
     await this.prepare();
     return readOptionalJson(this.turnSelectionPath(hostSourceRef, hostSessionRef), validateTurnSelection);
   }
@@ -5526,23 +6127,11 @@ var CodexOutboxStore = class {
     await writeAtomicJson(path, { ...active, turn_generation_ref: turnGenerationRef });
     return true;
   }
-  /**
-   * Publish a Request reference only while the acknowledged binding is still
-   * the active turn. A delayed relay response therefore cannot overwrite a
-   * newer prompt's context.
-   */
-  async bindInvocationContext(binding, now = /* @__PURE__ */ new Date()) {
-    validateBinding(binding);
-    const active = await this.readInvocationContext(binding.identity.host_source_ref, binding.identity.host_session_ref, now);
-    if (active === null || !sameIdentity(active.identity, binding.identity)) return false;
-    await writeAtomicJson(this.activeContextPath(binding.identity), invocationContextFromBinding(binding, active.turn_generation_ref));
-    return true;
-  }
   /** Return only the live session projection; never fall back to another turn. */
   async readInvocationContext(hostSourceRef, hostSessionRef, now = /* @__PURE__ */ new Date()) {
     if (!(now instanceof Date) || !Number.isFinite(now.getTime())) throw new CodexHostAdapterError("invalid_input", "Codex Host context clock is invalid.");
     const context = await this.readRawInvocationContext(hostSourceRef, hostSessionRef);
-    return isLiveSessionProjection(context, now) && invocationTurnSelectionMatches(context, await this.readInvocationTurnSelection(hostSourceRef, hostSessionRef)) ? context : null;
+    return isLiveSessionProjection(context, now) ? context : null;
   }
   /**
    * The latest Codex session projection even when past expiry, so the
@@ -5550,10 +6139,10 @@ var CodexOutboxStore = class {
    * a missing one. Every other caller keeps the fail-closed read above.
    */
   async readRawInvocationContext(hostSourceRef, hostSessionRef) {
-    if (!SAFE_REF6.test(hostSourceRef) || !SAFE_REF6.test(hostSessionRef)) throw new CodexHostAdapterError("invalid_input", "Codex Host session identity is invalid.");
+    if (!SAFE_REF5.test(hostSourceRef) || !SAFE_REF5.test(hostSessionRef)) throw new CodexHostAdapterError("invalid_input", "Codex Host session identity is invalid.");
     await this.prepare();
     const context = await readLatestSessionProjection(this.activeContextPath({ host_source_ref: hostSourceRef, host_session_ref: hostSessionRef }), hostSourceRef, hostSessionRef, (file) => readOptionalJson(file, validateCodexHostInvocationContext));
-    return invocationTurnSelectionMatches(context, await this.readInvocationTurnSelection(hostSourceRef, hostSessionRef)) ? context : null;
+    return context;
   }
   /** Clear the projection only if the caller still owns its exact active turn. */
   async clearInvocationContext(identity, now = /* @__PURE__ */ new Date()) {
@@ -5561,17 +6150,12 @@ var CodexOutboxStore = class {
     const active = await this.readInvocationContext(identity.host_source_ref, identity.host_session_ref, now);
     if (active === null || !sameIdentity(active.identity, identity)) return false;
     try {
-      await unlink2(this.activeContextPath(identity));
+      await unlink3(this.activeContextPath(identity));
     } catch (error) {
       if (!isNotFound(error)) throw storageError("Unable to clear the Codex Host invocation context.");
     }
     return true;
   }
-  async readBinding(identity) {
-    validateIdentity3(identity);
-    await this.prepare();
-    return readOptionalJson(this.bindingPath(identity), validateBinding);
-  }
   async saveSession(snapshot) {
     validateSession(snapshot);
     await this.prepare();
@@ -5579,7 +6163,7 @@ var CodexOutboxStore = class {
   }
   async readSession(sourceRef, sessionRef) {
     const identity = { host_source_ref: sourceRef, host_session_ref: sessionRef };
-    if (!SAFE_REF6.test(sourceRef) || !SAFE_REF6.test(sessionRef)) throw new CodexHostAdapterError("invalid_input", "Codex session identity is invalid.");
+    if (!SAFE_REF5.test(sourceRef) || !SAFE_REF5.test(sessionRef)) throw new CodexHostAdapterError("invalid_input", "Codex session identity is invalid.");
     await this.prepare();
     return readOptionalJson(this.sessionPath(identity.host_source_ref, identity.host_session_ref), validateSession);
   }
@@ -5612,7 +6196,7 @@ var CodexOutboxStore = class {
     for (const name of await readdir(this.registrationsDirectory)) {
       if (!name.endsWith(".json")) continue;
       try {
-        const value = JSON.parse(await readPrivateFile(join4(this.registrationsDirectory, name)));
+        const value = JSON.parse(await readOwnerStateFile(join4(this.registrationsDirectory, name)));
         validateRegistration(value);
         registrations.push(value);
       } catch {
@@ -5631,34 +6215,23 @@ var CodexOutboxStore = class {
     await writeAtomicJson(this.cursorPath(cursor.host_source_ref, cursor.host_session_ref), cursor);
   }
   async findByAlias(sourceRef, sessionRef, alias) {
-    if (!SAFE_REF6.test(sourceRef) || !SAFE_REF6.test(sessionRef) || !SAFE_REF6.test(alias)) return null;
+    if (!SAFE_REF5.test(sourceRef) || !SAFE_REF5.test(sessionRef) || !SAFE_REF5.test(alias)) return null;
     const read = await this.list();
     const envelope = findEnvelopeByAlias(read.entries, sourceRef, sessionRef, alias);
     if (envelope !== null) return envelopeMatch(envelope);
     await this.prepare();
-    const binding = await findBindingByAlias(this.bindingsDirectory, sourceRef, sessionRef, alias);
-    if (binding !== null) return bindingMatch(binding);
     return null;
   }
   async hasPriorTurn(sourceRef, sessionRef) {
-    if (!SAFE_REF6.test(sourceRef) || !SAFE_REF6.test(sessionRef)) return false;
+    if (!SAFE_REF5.test(sourceRef) || !SAFE_REF5.test(sessionRef)) return false;
     const read = await this.list();
     if (read.entries.some((entry) => entry.identity.host_source_ref === sourceRef && entry.identity.host_session_ref === sessionRef)) return true;
-    await this.prepare();
-    for (const name of await readdir(this.bindingsDirectory)) {
-      if (!name.endsWith(".json")) continue;
-      const binding = await readBindingCandidate(this.bindingsDirectory, name);
-      if (binding?.identity.host_source_ref === sourceRef && binding.identity.host_session_ref === sessionRef) return true;
-    }
     return false;
   }
   entryPath(submissionRef) {
-    if (!SAFE_REF6.test(submissionRef)) throw storageError("Codex submission identity is malformed.");
+    if (!SAFE_REF5.test(submissionRef)) throw storageError("Codex submission identity is malformed.");
     return join4(this.entriesDirectory, `${cealRequestSha256(submissionRef)}.json`);
   }
-  bindingPath(identity) {
-    return join4(this.bindingsDirectory, `${identityKey(identity)}.json`);
-  }
   sessionPath(sourceRef, sessionRef) {
     return join4(this.sessionsDirectory, `${identityKey({ host_source_ref: sourceRef, host_session_ref: sessionRef, host_turn_ref: "session" })}.json`);
   }
@@ -5677,20 +6250,17 @@ var CodexOutboxStore = class {
 };
 async function removeOwnerState(path, what) {
   try {
-    await unlink2(path);
+    await unlink3(path);
   } catch (error) {
     if (!isNotFound(error)) throw storageError(`Unable to retire the Codex transcript ${what}.`);
   }
 }
 function sessionStateKey(sourceRef, sessionRef) {
-  if (!SAFE_REF6.test(sourceRef) || !SAFE_REF6.test(sessionRef)) throw storageError("Codex transcript session identity is malformed.");
+  if (!SAFE_REF5.test(sourceRef) || !SAFE_REF5.test(sessionRef)) throw storageError("Codex transcript session identity is malformed.");
   return cealRequestSha256({ host_source_ref: sourceRef, host_session_ref: sessionRef });
 }
 function envelopeMatch(envelope) {
-  return { identity: envelope.identity, prompt_ref: envelope.prompt_ref, ...envelope.request_ref === void 0 ? {} : { request_ref: envelope.request_ref }, envelope };
-}
-function bindingMatch(binding) {
-  return { identity: binding.identity, prompt_ref: binding.prompt_ref, request_ref: binding.request_ref, binding };
+  return { identity: envelope.identity, prompt_ref: envelope.prompt_ref, envelope };
 }
 function findEnvelopeByAlias(entries, sourceRef, sessionRef, alias) {
   for (const envelope of entries) {
@@ -5699,24 +6269,6 @@ function findEnvelopeByAlias(entries, sourceRef, sessionRef, alias) {
   }
   return null;
 }
-async function findBindingByAlias(directory, sourceRef, sessionRef, alias) {
-  for (const name of await readdir(directory)) {
-    if (!name.endsWith(".json")) continue;
-    const binding = await readBindingCandidate(directory, name);
-    if (binding === null || binding.identity.host_source_ref !== sourceRef || binding.identity.host_session_ref !== sessionRef) continue;
-    if (binding.codex_turn_ids.includes(alias)) return binding;
-  }
-  return null;
-}
-async function readBindingCandidate(directory, name) {
-  try {
-    const value = JSON.parse(await readPrivateFile(join4(directory, name)));
-    validateBinding(value);
-    return value;
-  } catch {
-    return null;
-  }
-}
 function identityKey(identity) {
   validateIdentity3(identity);
   return cealRequestSha256(identity);
@@ -5729,18 +6281,18 @@ async function writeAtomicJson(path, value) {
   if (text === void 0) throw storageError("Codex owner state cannot be serialized.");
   const temp = `${path}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
   try {
-    const handle = await open5(temp, "wx", 384);
+    const handle = await open4(temp, "wx");
     try {
       await handle.writeFile(text, "utf8");
       await handle.sync();
     } finally {
       await handle.close();
     }
-    await rename3(temp, path);
-    await syncDirectory(dirname(path));
+    await rename2(temp, path);
+    await syncDirectory(dirname4(path));
   } catch (error) {
     try {
-      await unlink2(temp);
+      await unlink3(temp);
     } catch {
     }
     if (error instanceof CodexHostAdapterError) throw error;
@@ -5749,7 +6301,7 @@ async function writeAtomicJson(path, value) {
 }
 async function syncDirectory(path) {
   try {
-    const handle = await open5(path, "r");
+    const handle = await open4(path, "r");
     try {
       await handle.sync();
     } finally {
@@ -5760,7 +6312,7 @@ async function syncDirectory(path) {
 }
 async function readOptionalJson(path, validate) {
   try {
-    const value = JSON.parse(await readPrivateFile(path));
+    const value = JSON.parse(await readOwnerStateFile(path));
     validate(value);
     return value;
   } catch (error) {
@@ -5769,36 +6321,30 @@ async function readOptionalJson(path, validate) {
     throw storageError("Codex owner state is malformed.");
   }
 }
-async function ensurePrivateOwnerDirectory(path) {
+async function ensureOwnerDirectory(path) {
   try {
-    await lstat3(path);
+    await stat3(path);
   } catch (error) {
     if (!isNotFound(error)) throw storageError("Codex owner state directory is unavailable.");
-    await mkdir3(path, { recursive: true, mode: 448 });
+    await mkdir3(path, { recursive: true });
   }
-  const stats = await lstat3(path);
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  if (!stats.isDirectory() || stats.isSymbolicLink()) throw storageError(`Codex owner state path is not a directory (${refusalFact("mode", `0o${stats.mode.toString(8)}`, "a directory mode (0o40xxx)")}).`);
-  if ((stats.mode & 63) !== 0) throw storageError(`Codex owner state directory is readable beyond its owner (${refusalFact("permission_bits", `0o${(stats.mode & 511).toString(8)}`, "no group or other bits")}).`);
-  if (stats.uid !== uid) throw storageError(`Codex owner state directory is owned by another user (${refusalFact("uid", stats.uid, `expected ${uid}`)}).`);
+  const stats = await stat3(path);
+  if (!stats.isDirectory()) throw storageError("Codex owner state path is not a directory.");
 }
-async function readPrivateFile(path) {
+async function readOwnerStateFile(path) {
   let handle;
   try {
-    handle = await open5(path, O_RDONLY3 | O_NOFOLLOW2);
+    handle = await open4(path);
     const stats = await handle.stat();
-    const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-    if (!stats.isFile()) throw storageError(`Codex owner state path is not a regular file (${refusalFact("mode", `0o${stats.mode.toString(8)}`, "a regular-file mode (0o100xxx)")}).`);
-    if ((stats.mode & 63) !== 0) throw storageError(`Codex owner state file is readable beyond its owner (${refusalFact("permission_bits", `0o${(stats.mode & 511).toString(8)}`, "no group or other bits")}).`);
-    if (stats.uid !== uid) throw storageError(`Codex owner state file is owned by another user (${refusalFact("uid", stats.uid, `expected ${uid}`)}).`);
+    if (!stats.isFile()) throw storageError("Codex owner state path is not a regular file.");
     return await handle.readFile("utf8");
   } finally {
     await handle?.close();
   }
 }
 function validateEnvelope(value) {
-  if (!isRecord5(value)) throw storageError("Codex outbox entry is malformed.");
-  if (!sameKeys(value, ["schema_version", "identity", "host_input_ref", "input_kind", "prompt_ref", "observations", "origin_input", "submission_ref", "created_at", "expires_at"], ["request_ref", "codex_turn_id"])) throw storageError(`Codex outbox entry key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the outbox entry key set")}).`);
+  if (!isRecord7(value)) throw storageError("Codex outbox entry is malformed.");
+  if (!sameKeys(value, ["schema_version", "identity", "host_input_ref", "prompt_ref", "observations", "origin_input", "submission_ref", "created_at", "expires_at"], ["codex_turn_id"])) throw storageError(`Codex outbox entry key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the outbox entry key set")}).`);
   if (value.schema_version !== CODEX_OUTBOX_SCHEMA_VERSION) throw storageError(`Codex outbox entry is malformed (${refusalFact("schema_version", value.schema_version, `expected ${CODEX_OUTBOX_SCHEMA_VERSION}`)}).`);
   validateIdentity3(value.identity);
   validateEnvelopeReferences(value);
@@ -5806,32 +6352,30 @@ function validateEnvelope(value) {
   validateEnvelopeTimestamps(value);
 }
 function validateEnvelopeReferences(value) {
-  if (!SAFE_REF6.test(String(value.host_input_ref))) throw storageError("Codex outbox input reference is malformed.");
-  if (!isCealHostInputKind(value.input_kind)) throw storageError("Codex outbox input provenance is malformed.");
-  if (!SAFE_REF6.test(String(value.prompt_ref))) throw storageError("Codex outbox references are malformed.");
-  if (!SAFE_REF6.test(String(value.submission_ref))) throw storageError("Codex outbox references are malformed.");
-  if (value.request_ref !== void 0 && !SAFE_REF6.test(String(value.request_ref))) throw storageError("Codex outbox Request reference is malformed.");
-  if (value.codex_turn_id !== void 0 && !SAFE_REF6.test(String(value.codex_turn_id))) throw storageError("Codex outbox turn identity is malformed.");
+  if (!SAFE_REF5.test(String(value.host_input_ref))) throw storageError("Codex outbox input reference is malformed.");
+  if (!SAFE_REF5.test(String(value.prompt_ref))) throw storageError("Codex outbox references are malformed.");
+  if (!SAFE_REF5.test(String(value.submission_ref))) throw storageError("Codex outbox references are malformed.");
+  if (value.codex_turn_id !== void 0 && !SAFE_REF5.test(String(value.codex_turn_id))) throw storageError("Codex outbox turn identity is malformed.");
   if (typeof value.origin_input !== "boolean") throw storageError("Codex outbox origin disposition is malformed.");
 }
 function validateRegistration(value) {
-  if (!isRecord5(value)) throw storageError("Codex transcript registration is malformed.");
+  if (!isRecord7(value)) throw storageError("Codex transcript registration is malformed.");
   if (!sameKeys(value, ["schema_version", "host_source_ref", "host_session_ref", "codex_session_id", "transcript_path", "registered_at", "expires_at"], ["cwd"])) throw storageError(`Codex transcript registration key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the registration key set")}).`);
   if (value.schema_version !== CODEX_TRANSCRIPT_REGISTRATION_SCHEMA_VERSION) throw storageError(`Codex transcript registration is malformed (${refusalFact("schema_version", value.schema_version, `expected ${CODEX_TRANSCRIPT_REGISTRATION_SCHEMA_VERSION}`)}).`);
   validateRegistrationFields(value);
 }
 function validateRegistrationFields(value) {
-  if (![value.host_source_ref, value.host_session_ref, value.codex_session_id].every((candidate) => typeof candidate === "string" && SAFE_REF6.test(candidate))) throw storageError(`Codex transcript registration references are malformed (${refusalFacts([{ name: "host_source_ref", value: value.host_source_ref }, { name: "host_session_ref", value: value.host_session_ref }, { name: "codex_session_id", value: value.codex_session_id }])}).`);
+  if (![value.host_source_ref, value.host_session_ref, value.codex_session_id].every((candidate) => typeof candidate === "string" && SAFE_REF5.test(candidate))) throw storageError(`Codex transcript registration references are malformed (${refusalFacts([{ name: "host_source_ref", value: value.host_source_ref }, { name: "host_session_ref", value: value.host_session_ref }, { name: "codex_session_id", value: value.codex_session_id }])}).`);
   if (!validRegistrationCwd(value.cwd)) throw storageError(`Codex transcript registration working directory is malformed (${refusalFact("cwd_characters", typeof value.cwd === "string" ? value.cwd.length : 0, `an absolute path of at most ${CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS} characters`)}).`);
   if (typeof value.transcript_path !== "string") throw storageError(`Codex transcript registration path is malformed (${refusalFact("kind", typeof value.transcript_path, "string")}).`);
   if (value.transcript_path.length === 0 || value.transcript_path.length > CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS) throw storageError(`Codex transcript registration path is malformed (${refusalFact("characters", value.transcript_path.length, `from 1 through ${CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS}`)}).`);
   if (!isTimestamp(value.registered_at) || !isTimestamp(value.expires_at)) throw storageError(`Codex transcript registration timestamps are malformed (${refusalFacts([{ name: "registered_at", value: value.registered_at }, { name: "expires_at", value: value.expires_at }])}).`);
 }
 function validRegistrationCwd(value) {
-  return value === void 0 || typeof value === "string" && isAbsolute2(value) && value.length <= CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS && !value.includes("\0");
+  return value === void 0 || typeof value === "string" && isAbsolute3(value) && value.length <= CODEX_TRANSCRIPT_PATH_MAX_CHARACTERS && !value.includes("\0");
 }
 function validateCursor(value) {
-  if (!isRecord5(value)) throw storageError("Codex transcript cursor is malformed.");
+  if (!isRecord7(value)) throw storageError("Codex transcript cursor is malformed.");
   if (!sameKeys(value, ["schema_version", "host_source_ref", "host_session_ref", "transcript_path", "device", "inode", "offset", "last_ordinal", "anchor_start", "anchor_sha256", "header_validated", "status", "updated_at"], ["active_task", "reason"])) throw storageError(`Codex transcript cursor key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the cursor key set")}).`);
   if (value.schema_version !== CODEX_TRANSCRIPT_CURSOR_SCHEMA_VERSION) throw storageError(`Codex transcript cursor is malformed (${refusalFact("schema_version", value.schema_version, `expected ${CODEX_TRANSCRIPT_CURSOR_SCHEMA_VERSION}`)}).`);
   if (!validCursorSource(value) || !validCursorPosition(value) || !validCursorStatus(value)) throw storageError("Codex transcript cursor fields are malformed.");
@@ -5839,7 +6383,7 @@ function validateCursor(value) {
   if (value.reason !== void 0 && !isHostTranscriptCursorReason(value.reason)) throw storageError("Codex transcript cursor reason is malformed.");
 }
 function validCursorSource(value) {
-  return [value.host_source_ref, value.host_session_ref].every((candidate) => typeof candidate === "string" && SAFE_REF6.test(candidate)) && typeof value.transcript_path === "string" && value.transcript_path.length > 0 && typeof value.device === "string" && typeof value.inode === "string";
+  return [value.host_source_ref, value.host_session_ref].every((candidate) => typeof candidate === "string" && SAFE_REF5.test(candidate)) && typeof value.transcript_path === "string" && value.transcript_path.length > 0 && typeof value.device === "string" && typeof value.inode === "string";
 }
 function validCursorPosition(value) {
   return nonNegativeInteger(value.offset) && nonNegativeInteger(value.last_ordinal) && nonNegativeInteger(value.anchor_start) && typeof value.anchor_sha256 === "string" && /^[a-f0-9]{64}$/u.test(value.anchor_sha256) && typeof value.header_validated === "boolean";
@@ -5848,23 +6392,23 @@ function validCursorStatus(value) {
   return (value.status === "active" || value.status === "quarantined") && isTimestamp(value.updated_at);
 }
 function validActiveTask(value) {
-  if (!isRecord5(value) || !sameKeys(value, ["codex_turn_id", "host_turn_ref", "started_at"], ["origin_host_input_ref", "prompt_ref", "model", "token_usage", "last_total_usage", "token_usage_gap_reason"])) return false;
+  if (!isRecord7(value) || !sameKeys(value, ["codex_turn_id", "host_turn_ref", "started_at"], ["origin_host_input_ref", "prompt_ref", "model", "token_usage", "last_total_usage", "token_usage_gap_reason"])) return false;
   return validActiveTaskIdentity(value) && validActiveTaskReferences(value) && validActiveTaskUsage(value);
 }
 function validActiveTaskIdentity(value) {
-  return [value.codex_turn_id, value.host_turn_ref].every((candidate) => typeof candidate === "string" && SAFE_REF6.test(candidate)) && isTimestamp(value.started_at);
+  return [value.codex_turn_id, value.host_turn_ref].every((candidate) => typeof candidate === "string" && SAFE_REF5.test(candidate)) && isTimestamp(value.started_at);
 }
 function validActiveTaskReferences(value) {
   return optionalSafeRef2(value.origin_host_input_ref) && optionalSafeRef2(value.prompt_ref) && (value.model === void 0 || typeof value.model === "string" && value.model.length > 0 && value.model.length <= 256);
 }
 function optionalSafeRef2(value) {
-  return value === void 0 || typeof value === "string" && SAFE_REF6.test(value);
+  return value === void 0 || typeof value === "string" && SAFE_REF5.test(value);
 }
 function validActiveTaskUsage(value) {
   return (value.token_usage === void 0 || validTokenUsage(value.token_usage)) && (value.last_total_usage === void 0 || validTokenUsage(value.last_total_usage)) && (value.token_usage_gap_reason === void 0 || value.token_usage_gap_reason === "token_count_shape_not_attributable");
 }
 function validTokenUsage(value) {
-  if (!isRecord5(value) || !sameKeys(value, ["input_tokens", "cached_input_tokens", "cache_write_input_tokens", "output_tokens", "reasoning_output_tokens", "total_tokens"])) return false;
+  if (!isRecord7(value) || !sameKeys(value, ["input_tokens", "cached_input_tokens", "cache_write_input_tokens", "output_tokens", "reasoning_output_tokens", "total_tokens"])) return false;
   if (![value.input_tokens, value.cached_input_tokens, value.cache_write_input_tokens, value.output_tokens, value.reasoning_output_tokens, value.total_tokens].every(nonNegativeInteger)) return false;
   return value.total_tokens === Number(value.input_tokens) + Number(value.output_tokens) && Number(value.cached_input_tokens) + Number(value.cache_write_input_tokens) <= Number(value.input_tokens) && Number(value.reasoning_output_tokens) <= Number(value.output_tokens);
 }
@@ -5874,7 +6418,7 @@ function nonNegativeInteger(value) {
 function validateEnvelopeObservations(value) {
   if (!Array.isArray(value.observations)) throw storageError("Codex outbox observations are malformed.");
   try {
-    for (const observation2 of value.observations) validateCealHostObservationDraft(observation2);
+    for (const observation of value.observations) validateCealHostObservationDraft(observation);
   } catch {
     throw storageError("Codex outbox observations are malformed.");
   }
@@ -5883,34 +6427,23 @@ function validateEnvelopeTimestamps(value) {
   if (!isTimestamp(value.created_at)) throw storageError("Codex outbox timestamps are malformed.");
   if (!isTimestamp(value.expires_at)) throw storageError("Codex outbox timestamps are malformed.");
 }
-function validateBinding(value) {
-  if (!isRecord5(value)) throw storageError("Codex turn binding is malformed.");
-  if (!sameKeys(value, ["schema_version", "identity", "prompt_ref", "request_ref", "codex_turn_ids", "bound_at", "expires_at"])) throw storageError(`Codex turn binding key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the turn binding key set")}).`);
-  if (value.schema_version !== CODEX_TURN_BINDING_SCHEMA_VERSION) throw storageError(`Codex turn binding is malformed (${refusalFact("schema_version", value.schema_version, `expected ${CODEX_TURN_BINDING_SCHEMA_VERSION}`)}).`);
-  validateIdentity3(value.identity);
-  if (!SAFE_REF6.test(String(value.prompt_ref)) || !SAFE_REF6.test(String(value.request_ref))) throw storageError("Codex turn binding references are malformed.");
-  if (!isStringList(value.codex_turn_ids) || !isTimestamp(value.bound_at) || !isTimestamp(value.expires_at)) throw storageError("Codex turn binding fields are malformed.");
-}
 function validateSession(value) {
-  if (!isRecord5(value)) throw storageError("Codex session snapshot is malformed.");
+  if (!isRecord7(value)) throw storageError("Codex session snapshot is malformed.");
   if (!sameKeys(value, ["schema_version", "host_session_ref", "host_source_ref", "observed_at", "value", "expires_at"])) throw storageError(`Codex session snapshot key set is malformed (${refusalFact("keys", Object.keys(value), "exactly the session snapshot key set")}).`);
   if (value.schema_version !== CODEX_SESSION_SCHEMA_VERSION) throw storageError(`Codex session snapshot is malformed (${refusalFact("schema_version", value.schema_version, `expected ${CODEX_SESSION_SCHEMA_VERSION}`)}).`);
-  if (!SAFE_REF6.test(String(value.host_session_ref)) || !SAFE_REF6.test(String(value.host_source_ref)) || !isTimestamp(value.observed_at) || !isTimestamp(value.expires_at) || !isJsonValue(value.value)) throw storageError("Codex session snapshot fields are malformed.");
+  if (!SAFE_REF5.test(String(value.host_session_ref)) || !SAFE_REF5.test(String(value.host_source_ref)) || !isTimestamp(value.observed_at) || !isTimestamp(value.expires_at) || !isJsonValue(value.value)) throw storageError("Codex session snapshot fields are malformed.");
 }
 function validateTurnSelection(value) {
   if (!isHostInvocationTurnSelection(value)) throw storageError("Codex Host turn selection is malformed.");
 }
 function validateIdentity3(value) {
-  if (!isRecord5(value) || !hasHostInvocationIdentityKeys(value) || ![value.host_session_ref, value.host_turn_ref, value.host_source_ref].every((candidate) => typeof candidate === "string" && SAFE_REF6.test(candidate))) throw storageError("Codex Host identity is malformed.");
+  if (!isRecord7(value) || !hasHostInvocationIdentityKeys(value) || ![value.host_session_ref, value.host_turn_ref, value.host_source_ref].every((candidate) => typeof candidate === "string" && SAFE_REF5.test(candidate))) throw storageError("Codex Host identity is malformed.");
 }
 function isJsonValue(value) {
   if (value === null || typeof value === "string" || typeof value === "boolean") return true;
   if (typeof value === "number") return Number.isFinite(value);
   if (Array.isArray(value)) return value.every(isJsonValue);
-  return isRecord5(value) && Object.entries(value).every(([key, child]) => key.length > 0 && key.length <= 128 && isJsonValue(child));
-}
-function isStringList(value) {
-  return Array.isArray(value) && value.every((candidate) => typeof candidate === "string" && SAFE_REF6.test(candidate));
+  return isRecord7(value) && Object.entries(value).every(([key, child]) => key.length > 0 && key.length <= 128 && isJsonValue(child));
 }
 function isTimestamp(value) {
   return typeof value === "string" && value.length <= 64 && !Number.isNaN(Date.parse(value));
@@ -5920,142 +6453,43 @@ function sameKeys(value, required, optional = []) {
   const keys = Object.keys(value);
   return keys.length >= required.length && keys.length <= allowed.size && required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => allowed.has(key));
 }
-function isRecord5(value) {
+function isRecord7(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isNotFound(error) {
-  return isRecord5(error) && error.code === "ENOENT";
+  return isRecord7(error) && error.code === "ENOENT";
 }
 function storageError(message) {
   return new CodexHostAdapterError("storage", message);
 }
 
 // host/codex/src/codex-producer.ts
-import { createHash as createHash6 } from "node:crypto";
-var SAFE_REF7 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var CodexProducer = class {
-  producer_id = "codex";
-  producer_label = "Codex";
-  outbox_directory;
   store;
   core;
   constructor(options) {
     this.store = new CodexOutboxStore(options.outbox_dir);
-    this.outbox_directory = this.store.directory;
     this.core = new HostProducerDrainCore(this, options);
   }
   drainOutbox() {
     return this.core.drainOutbox();
   }
-  fail(code, message) {
-    return new CodexHostAdapterError(code, message);
-  }
   listEnvelopes() {
     return this.store.list();
   }
   removeEnvelope(envelope) {
     return this.store.remove(envelope);
   }
-  submissionRefOf(envelope) {
-    return envelope.submission_ref;
-  }
   expiresAtOf(envelope) {
     return envelope.expires_at;
   }
-  createdAtOf(envelope) {
-    return envelope.created_at;
-  }
-  async mapEnvelope(envelope) {
-    const prompt = observation(envelope, "prompt");
-    if (prompt !== void 0) return this.mapInput(envelope, prompt);
-    return [mapTerminal(envelope)];
-  }
-  async mapInput(envelope, prompt) {
-    const drafts = [];
-    const session = observation(envelope, "session");
-    if (session !== void 0) {
-      const registrations = await this.store.listTranscriptRegistrations();
-      const registration = registrations.find((item) => item.host_source_ref === envelope.identity.host_source_ref && item.host_session_ref === envelope.identity.host_session_ref);
-      const directoryIdentity = registration?.cwd ?? envelope.identity.host_session_ref;
-      drafts.push({ frame_kind: "session_started", payload: compact({
-        local_session_ref: envelope.identity.host_session_ref,
-        working_directory_ref: `workspace:${createHash6("sha256").update(directoryIdentity, "utf8").digest("hex")}`,
-        model: recordText(session.value, "model"),
-        host_version: nestedText(session.value, "host_version"),
-        observations: [session]
-      }) });
-    }
-    const turn = observation(envelope, "turn");
-    if (turn !== void 0) drafts.push({ frame_kind: "turn_started", payload: compact({
-      local_session_ref: envelope.identity.host_session_ref,
-      local_turn_ref: localTurnRef(envelope),
-      observations: [turn]
-    }) });
-    if (!isCealHostPromptObservationValue(prompt.value)) throw new CodexHostAdapterError("storage", "Codex prompt observation is malformed.");
-    drafts.push({ frame_kind: "user_input", payload: compact({
-      local_session_ref: envelope.identity.host_session_ref,
-      local_turn_ref: localTurnRef(envelope),
-      local_input_ref: envelope.host_input_ref,
-      input_kind: envelope.input_kind,
-      origin_input: envelope.origin_input,
-      observations: [prompt],
-      local_turn_aliases: envelope.codex_turn_id === void 0 ? void 0 : [envelope.codex_turn_id],
-      context_expires_at: envelope.expires_at
-    }) });
-    return drafts;
-  }
 };
-function mapTerminal(envelope) {
-  const timing = observation(envelope, "timing");
-  const timingValue = asRecord(timing?.value);
-  const aborted = timingValue?.terminal === "aborted";
-  const usage = envelope.observations.filter((item) => ["token", "cost", "model"].includes(item.observation_kind));
-  return { frame_kind: "turn_terminal", payload: compact({
-    local_session_ref: envelope.identity.host_session_ref,
-    local_turn_ref: localTurnRef(envelope),
-    terminal_state: aborted ? "aborted" : "completed",
-    abort_reason: aborted && typeof timingValue?.reason === "string" ? safeReasonRef(timingValue.reason) : void 0,
-    duration_ms: nonNegativeNumber(timingValue?.duration_ms),
-    time_to_first_token_ms: nonNegativeNumber(timingValue?.time_to_first_token_ms),
-    usage: usage.length === 0 ? void 0 : Object.fromEntries(usage.map((item) => [item.observation_kind, item.value])),
-    observations: envelope.observations
-  }) };
-}
-function observation(envelope, kind) {
-  return envelope.observations.find((item) => item.observation_kind === kind);
-}
-function localTurnRef(envelope) {
-  return envelope.identity.host_turn_ref;
-}
-function compact(value) {
-  return Object.fromEntries(Object.entries(value).filter((entry) => entry[1] !== void 0));
-}
-function asRecord(value) {
-  return isRecord6(value) ? value : void 0;
-}
-function recordText(value, key) {
-  const record3 = asRecord(value);
-  return typeof record3?.[key] === "string" ? record3[key] : void 0;
-}
-function nestedText(value, key) {
-  const nested = asRecord(asRecord(value)?.[key]);
-  return typeof nested?.value === "string" ? nested.value : void 0;
-}
-function nonNegativeNumber(value) {
-  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
-}
-function safeReasonRef(value) {
-  return SAFE_REF7.test(value) ? value : `reason:${createHash6("sha256").update(value, "utf8").digest("hex")}`;
-}
-function isRecord6(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 
 // host/codex/src/codex-transcript-baseline.ts
 import { createHash as createHash7 } from "node:crypto";
 
 // host/codex/src/codex-transcript-decoder.ts
-var SAFE_REF8 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
+var SAFE_REF6 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
 var MAX_PROMPT_BYTES = 64 * 1024;
 function decodeCodexTranscriptLine(line) {
   let value;
@@ -6064,40 +6498,40 @@ function decodeCodexTranscriptLine(line) {
   } catch {
     reject("Codex transcript record is not valid JSON.");
   }
-  if (!isRecord7(value)) reject("Codex transcript record envelope is malformed.");
+  if (!isRecord8(value)) reject("Codex transcript record envelope is malformed.");
   const ordinal = safeOrdinal(value.ordinal);
-  const timestamp4 = safeTimestamp(value.timestamp);
-  if (!isRecord7(value.payload) || typeof value.type !== "string") reject("Codex transcript record payload is malformed.");
-  if (value.type === "session_meta") return decodeSessionMeta(value.payload, ordinal, timestamp4);
-  if (value.type === "turn_context") return decodeTurnContext(value.payload, ordinal, timestamp4);
-  if (value.type === "event_msg") return decodeEventMessage(value.payload, ordinal, timestamp4);
-  if (value.type === "response_item") return decodeResponseItem(value.payload, ordinal, timestamp4);
-  return { kind: "ignored", ordinal, timestamp: timestamp4 };
-}
-function decodeTurnContext(payload, ordinal, timestamp4) {
+  const timestamp3 = safeTimestamp(value.timestamp);
+  if (!isRecord8(value.payload) || typeof value.type !== "string") reject("Codex transcript record payload is malformed.");
+  if (value.type === "session_meta") return decodeSessionMeta(value.payload, ordinal, timestamp3);
+  if (value.type === "turn_context") return decodeTurnContext(value.payload, ordinal, timestamp3);
+  if (value.type === "event_msg") return decodeEventMessage(value.payload, ordinal, timestamp3);
+  if (value.type === "response_item") return decodeResponseItem(value.payload, ordinal, timestamp3);
+  return { kind: "ignored", ordinal, timestamp: timestamp3 };
+}
+function decodeTurnContext(payload, ordinal, timestamp3) {
   return {
     kind: "turn_context",
     ordinal,
-    timestamp: timestamp4,
-    turn_id: safeRef5(payload.turn_id, "Codex turn context identity is invalid."),
+    timestamp: timestamp3,
+    turn_id: safeRef4(payload.turn_id, "Codex turn context identity is invalid."),
     model: boundedNonEmptyText(payload.model, 256, "Codex turn context model is invalid.")
   };
 }
-function decodeSessionMeta(payload, ordinal, timestamp4) {
-  const sessionId = safeRef5(payload.id, "Codex transcript session identity is invalid.");
+function decodeSessionMeta(payload, ordinal, timestamp3) {
+  const sessionId = safeRef4(payload.id, "Codex transcript session identity is invalid.");
   const cliVersion = boundedNonEmptyText(payload.cli_version, 64, "Codex transcript version is invalid.");
-  return { kind: "session_meta", ordinal, timestamp: timestamp4, session_id: sessionId, cli_version: cliVersion };
+  return { kind: "session_meta", ordinal, timestamp: timestamp3, session_id: sessionId, cli_version: cliVersion };
 }
-function decodeEventMessage(payload, ordinal, timestamp4) {
+function decodeEventMessage(payload, ordinal, timestamp3) {
   if (payload.type === "task_started") {
-    return { kind: "task_started", ordinal, timestamp: timestamp4, turn_id: safeRef5(payload.turn_id, "Codex task identity is invalid."), started_at: safeNumber(payload.started_at) };
+    return { kind: "task_started", ordinal, timestamp: timestamp3, turn_id: safeRef4(payload.turn_id, "Codex task identity is invalid."), started_at: safeNumber(payload.started_at) };
   }
   if (payload.type === "task_complete") {
     return {
       kind: "task_complete",
       ordinal,
-      timestamp: timestamp4,
-      turn_id: safeRef5(payload.turn_id, "Codex task identity is invalid."),
+      timestamp: timestamp3,
+      turn_id: safeRef4(payload.turn_id, "Codex task identity is invalid."),
       started_at: safeNumber(payload.started_at),
       completed_at: safeNumber(payload.completed_at),
       duration_ms: safeNumber(payload.duration_ms),
@@ -6108,20 +6542,20 @@ function decodeEventMessage(payload, ordinal, timestamp4) {
     return {
       kind: "turn_aborted",
       ordinal,
-      timestamp: timestamp4,
-      turn_id: safeRef5(payload.turn_id, "Codex task identity is invalid."),
+      timestamp: timestamp3,
+      turn_id: safeRef4(payload.turn_id, "Codex task identity is invalid."),
       started_at: safeNumber(payload.started_at),
       completed_at: safeNumber(payload.completed_at),
       duration_ms: safeNumber(payload.duration_ms),
       reason: boundedText(payload.reason, 256, "Codex task abort reason is invalid.")
     };
   }
-  if (payload.type === "token_count") return decodeTokenCount(payload, ordinal, timestamp4);
-  return { kind: "ignored", ordinal, timestamp: timestamp4 };
+  if (payload.type === "token_count") return decodeTokenCount(payload, ordinal, timestamp3);
+  return { kind: "ignored", ordinal, timestamp: timestamp3 };
 }
-function decodeTokenCount(payload, ordinal, timestamp4) {
-  if (payload.info === null) return { kind: "token_count", ordinal, timestamp: timestamp4 };
-  if (!isRecord7(payload.info)) return { kind: "token_count", ordinal, timestamp: timestamp4, usage_gap_reason: "token_count_shape_not_attributable" };
+function decodeTokenCount(payload, ordinal, timestamp3) {
+  if (payload.info === null) return { kind: "token_count", ordinal, timestamp: timestamp3 };
+  if (!isRecord8(payload.info)) return { kind: "token_count", ordinal, timestamp: timestamp3, usage_gap_reason: "token_count_shape_not_attributable" };
   const lastUsage = optionalTokenUsage(payload.info.last_token_usage);
   const totalUsage = optionalTokenUsage(payload.info.total_token_usage);
   const gap = lastUsage.status === "invalid" || totalUsage.status === "invalid";
@@ -6129,7 +6563,7 @@ function decodeTokenCount(payload, ordinal, timestamp4) {
   return {
     kind: "token_count",
     ordinal,
-    timestamp: timestamp4,
+    timestamp: timestamp3,
     ...lastUsage.status === "valid" ? { last_usage: lastUsage.value } : {},
     ...totalUsage.status === "valid" ? { total_usage: totalUsage.value } : {},
     ...usageGapReason === void 0 ? {} : { usage_gap_reason: usageGapReason }
@@ -6145,7 +6579,7 @@ function optionalTokenUsage(value) {
   }
 }
 function decodeTokenUsage(value) {
-  if (!isRecord7(value)) reject("Codex token usage is malformed.");
+  if (!isRecord8(value)) reject("Codex token usage is malformed.");
   const usage = {
     input_tokens: safeTokenCount(value.input_tokens),
     cached_input_tokens: safeTokenCount(value.cached_input_tokens),
@@ -6157,35 +6591,33 @@ function decodeTokenUsage(value) {
   if (usage.total_tokens !== usage.input_tokens + usage.output_tokens || usage.cached_input_tokens + usage.cache_write_input_tokens > usage.input_tokens || usage.reasoning_output_tokens > usage.output_tokens) reject("Codex token usage buckets are inconsistent.");
   return usage;
 }
-function decodeResponseItem(payload, ordinal, timestamp4) {
-  if (payload.type !== "message" || payload.role !== "user") return { kind: "ignored", ordinal, timestamp: timestamp4 };
+function decodeResponseItem(payload, ordinal, timestamp3) {
+  if (payload.type !== "message" || payload.role !== "user") return { kind: "ignored", ordinal, timestamp: timestamp3 };
   const metadata = userMessageMetadata(payload.internal_chat_message_metadata_passthrough);
-  const inputKind = inputKindFromContentItems(metadata.content_item_kinds);
-  if (inputKind === void 0) return { kind: "ignored", ordinal, timestamp: timestamp4 };
+  const contentItemKind = userTextContentKind(metadata.content_item_kinds);
+  if (contentItemKind === void 0) return { kind: "ignored", ordinal, timestamp: timestamp3 };
   const prompt = userTextContent(payload.content);
   return {
     kind: "user_text",
     ordinal,
-    timestamp: timestamp4,
+    timestamp: timestamp3,
     prompt,
-    input_kind: inputKind,
-    message_id: safeRef5(payload.id, "Codex user message identity is invalid."),
-    turn_id: safeRef5(metadata.turn_id, "Codex user message task identity is invalid.")
+    content_item_kind: contentItemKind,
+    message_id: safeRef4(payload.id, "Codex user message identity is invalid."),
+    turn_id: safeRef4(metadata.turn_id, "Codex user message task identity is invalid.")
   };
 }
-function inputKindFromContentItems(kinds) {
-  if (kinds.length !== 1) return void 0;
-  if (kinds[0] === "user.text") return "human";
-  return kinds[0] === "goal.internal_context" ? "host_automatic" : void 0;
+function userTextContentKind(kinds) {
+  return kinds.length === 1 && (kinds[0] === "user.text" || kinds[0] === "goal.internal_context") ? kinds[0] : void 0;
 }
 function userMessageMetadata(value) {
-  if (!isRecord7(value) || !Array.isArray(value.content_item_kinds)) reject("Codex user message provenance is malformed.");
+  if (!isRecord8(value) || !Array.isArray(value.content_item_kinds)) reject("Codex user message provenance is malformed.");
   return { ...value, content_item_kinds: value.content_item_kinds };
 }
 function userTextContent(value) {
   if (!Array.isArray(value)) reject(`Codex user text content is malformed (${refusalFact("kind", typeof value, "array")}).`);
   if (value.length !== 1) reject(`Codex user text content is malformed (${refusalFact("items", value.length, "exactly one")}).`);
-  if (!isRecord7(value[0]) || value[0].type !== "input_text") reject(`Codex user text content is malformed (${refusalFact("item_type", isRecord7(value[0]) ? value[0].type : typeof value[0], "input_text")}).`);
+  if (!isRecord8(value[0]) || value[0].type !== "input_text") reject(`Codex user text content is malformed (${refusalFact("item_type", isRecord8(value[0]) ? value[0].type : typeof value[0], "input_text")}).`);
   return boundedText(value[0].text, MAX_PROMPT_BYTES, "Codex user text is invalid.");
 }
 function safeOrdinal(value) {
@@ -6206,8 +6638,8 @@ function safeTimestamp(value) {
   if (!Number.isFinite(Date.parse(value))) reject(`Codex transcript timestamp is invalid (${refusalFact("parsed_ms", Date.parse(value), "a finite epoch milliseconds value")}).`);
   return value;
 }
-function safeRef5(value, message) {
-  if (typeof value !== "string" || !SAFE_REF8.test(value)) reject(message);
+function safeRef4(value, message) {
+  if (typeof value !== "string" || !SAFE_REF6.test(value)) reject(message);
   return value;
 }
 function boundedText(value, maximum, message) {
@@ -6221,7 +6653,7 @@ function boundedNonEmptyText(value, maximum, message) {
   if (result.length === 0) reject(message);
   return result;
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function reject(message) {
@@ -6245,46 +6677,48 @@ function codexTranscriptInitialCursor(registration, device, inode, now) {
     anchor_sha256: digest(Buffer.alloc(0)),
     header_validated: false,
     status: "active",
-    updated_at: timestamp3(now)
+    updated_at: timestamp2(now)
   };
 }
-async function ownedCodexTranscriptFile(handle) {
+async function ownedCodexTranscriptFile(handle, platform = process.platform) {
   const stats = await handle.stat();
-  assertCodexTranscriptOwner(stats);
+  if (!stats.isFile()) throw new CodexHostAdapterError("storage", "Codex transcript source is not a regular file.");
+  if (platform !== "win32" && !isSelfOwned(stats.uid, platform, handle)) throw new CodexHostAdapterError("storage", "Codex transcript source is owned by another user.");
   return { size: stats.size, device: String(stats.dev), inode: String(stats.ino) };
 }
-function assertCodexTranscriptOwner(stats) {
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  if (!stats.isFile()) throw new CodexHostAdapterError("storage", `Codex transcript source is not a regular file (${refusalFact("mode", `0o${stats.mode.toString(8)}`, "a regular-file mode (0o100xxx)")}).`);
-  if (stats.uid !== uid) throw new CodexHostAdapterError("storage", `Codex transcript source is owned by another user (${refusalFact("uid", stats.uid, `expected ${uid}`)}).`);
-}
-function assertCodexTranscriptHeader(registration, record3) {
-  if (record3.kind !== "session_meta" || record3.session_id !== registration.codex_session_id) throw new CodexHostAdapterError("payload_rejected", `Codex transcript header does not match its SessionStart registration (${refusalFacts([
-    { name: "kind", value: record3.kind, expected: "session_meta" },
-    { name: "session_id", value: record3.kind === "session_meta" ? record3.session_id : "unavailable", expected: registration.codex_session_id }
+function assertCodexTranscriptHeader(registration, record2) {
+  if (record2.kind !== "session_meta" || record2.session_id !== registration.codex_session_id) throw new CodexHostAdapterError("payload_rejected", `Codex transcript header does not match its SessionStart registration (${refusalFacts([
+    { name: "kind", value: record2.kind, expected: "session_meta" },
+    { name: "session_id", value: record2.kind === "session_meta" ? record2.session_id : "unavailable", expected: registration.codex_session_id }
   ])}).`);
 }
 function digest(value) {
   return createHash7("sha256").update(value).digest("hex");
 }
-function timestamp3(now) {
+function timestamp2(now) {
   const value = now();
   if (!Number.isFinite(value.getTime())) throw new CodexHostAdapterError("storage", "Codex watcher clock is invalid.");
   return value.toISOString();
 }
 
+// host/codex/src/codex-runtime-paths.ts
+import { join as join5 } from "node:path";
+var CODEX_HOME_ENVIRONMENT = "CODEX_HOME";
+var CODEX_HOME_DEFAULT_DIRECTORY = ".codex";
+function resolveCodexHome(environment, home) {
+  return environment[CODEX_HOME_ENVIRONMENT] || join5(home, CODEX_HOME_DEFAULT_DIRECTORY);
+}
+
 // host/codex/src/codex-adapter.ts
-var SAFE_REF9 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+var SAFE_REF7 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 function codexSubmissionReference(hostInputRef, event, ordinal) {
-  if (!SAFE_REF9.test(hostInputRef) || !Number.isSafeInteger(ordinal) || ordinal < 0) throw new CodexHostAdapterError("invalid_input", "Codex submission identity is invalid.");
+  if (!SAFE_REF7.test(hostInputRef) || !Number.isSafeInteger(ordinal) || ordinal < 0) throw new CodexHostAdapterError("invalid_input", "Codex submission identity is invalid.");
   return `codex-submission:${cealRequestSha256({ host_input_ref: hostInputRef, event, ordinal })}`;
 }
 
 // host/codex/src/codex-transcript-watcher.ts
 var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
   store;
-  registerCurrentPrompt;
-  releaseCurrentPrompt;
   diagnostic;
   constructor(options) {
     super(options, {
@@ -6293,8 +6727,6 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
       clock_failure: () => new CodexHostAdapterError("storage", "Codex watcher clock is invalid.")
     });
     this.store = new CodexOutboxStore(options.outbox_dir);
-    this.registerCurrentPrompt = options.register_current_prompt;
-    this.releaseCurrentPrompt = options.release_current_prompt;
     this.diagnostic = options.diagnostic ?? (() => void 0);
   }
   transcriptPathOf(registration) {
@@ -6317,14 +6749,12 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
     return { records: 0, enqueued: 0, quarantined: true };
   }
   async retireMissing(registration) {
-    await this.releaseStoredPromptBestEffort(registration.host_session_ref, await this.store.readTranscriptCursor(registration).catch(() => null));
     return this.retireMissingTranscript(registration.transcript_path, "Codex", () => this.store.retireTranscriptRegistration(registration));
   }
   async preflight(registration, handle, size, device, inode) {
     const existing = await this.store.readTranscriptCursor(registration);
     let cursor = existing ?? codexTranscriptInitialCursor(registration, device, inode, this.now);
     if (cursor.status === "quarantined") {
-      if (cursor.reason !== "transcript_malformed") await this.releaseStoredPromptBestEffort(registration.host_session_ref, cursor);
       return { cursor: null, result: { records: 0, enqueued: 0, quarantined: true } };
     }
     const reason = this.cursorIdentityReason(cursor, registration.transcript_path, device, inode) ?? await this.cursorBoundsReason(handle, cursor, size);
@@ -6338,22 +6768,22 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
     let records = 0;
     let enqueued = 0;
     for (const line of complete.toString("utf8").split("\n").filter((value) => value.length > 0)) {
-      const record3 = decodeCodexTranscriptLine(line);
-      assertRecordSequence(registration, cursor, records, lastOrdinal, record3);
-      await this.observeSessionMetadata(registration, record3);
-      const outcome = await this.processRecord(registration, activeTask, record3);
+      const record2 = decodeCodexTranscriptLine(line);
+      assertRecordSequence(registration, cursor, records, lastOrdinal, record2);
+      await this.observeSessionMetadata(registration, record2);
+      const outcome = await this.processRecord(registration, activeTask, record2);
       activeTask = outcome.activeTask;
       enqueued += outcome.enqueued;
-      lastOrdinal = record3.ordinal;
+      lastOrdinal = record2.ordinal;
       records += 1;
     }
     await this.commitCursor(registration, handle, cursor, complete.length, device, inode, lastOrdinal, activeTask);
     return { records, enqueued, quarantined: false };
   }
-  async observeSessionMetadata(registration, record3) {
-    if (record3.kind !== "session_meta") return;
+  async observeSessionMetadata(registration, record2) {
+    if (record2.kind !== "session_meta") return;
     const session = await this.store.readSession(registration.host_source_ref, registration.host_session_ref);
-    if (session !== null && this.isRecord(session.value)) await this.store.saveSession({ ...session, value: { ...session.value, host_version: record3.cli_version } });
+    if (session !== null && this.isRecord(session.value)) await this.store.saveSession({ ...session, value: { ...session.value, host_version: record2.cli_version } });
   }
   async commitCursor(registration, handle, cursor, consumedBytes, device, inode, lastOrdinal, activeTask) {
     const offset = cursor.offset + consumedBytes;
@@ -6376,56 +6806,54 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
     };
     await this.store.writeTranscriptCursor(quarantined);
   }
-  async processRecord(registration, activeTask, record3) {
-    if (record3.kind === "task_started") return this.processTaskStarted(registration, activeTask, record3);
-    if (record3.kind === "turn_context") return { ...activeTask === void 0 ? {} : { activeTask: record3.turn_id === activeTask.codex_turn_id ? { ...activeTask, model: record3.model } : activeTask }, enqueued: 0 };
-    if (record3.kind === "token_count") return { ...activeTask === void 0 ? {} : { activeTask: accumulateTokenCount(activeTask, record3) }, enqueued: 0 };
-    if (record3.kind === "user_text") return this.processUserInput(registration, activeTask, record3);
-    if (record3.kind === "task_complete" || record3.kind === "turn_aborted") return this.processTerminal(registration, activeTask, record3);
+  async processRecord(registration, activeTask, record2) {
+    if (record2.kind === "task_started") return this.processTaskStarted(registration, record2);
+    if (record2.kind === "turn_context") return { ...activeTask === void 0 ? {} : { activeTask: record2.turn_id === activeTask.codex_turn_id ? { ...activeTask, model: record2.model } : activeTask }, enqueued: 0 };
+    if (record2.kind === "token_count") return { ...activeTask === void 0 ? {} : { activeTask: accumulateTokenCount(activeTask, record2) }, enqueued: 0 };
+    if (record2.kind === "user_text") return this.processUserInput(registration, activeTask, record2);
+    if (record2.kind === "task_complete" || record2.kind === "turn_aborted") return this.processTerminal(registration, activeTask, record2);
     return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
   }
-  async processTaskStarted(registration, activeTask, record3) {
-    if (activeTask !== void 0 && activeTask.codex_turn_id !== record3.turn_id && activeTask.prompt_ref !== void 0) await this.releasePrompt(registration.host_session_ref, activeTask, activeTask.prompt_ref);
-    return { activeTask: { codex_turn_id: record3.turn_id, host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id), started_at: record3.timestamp }, enqueued: 0 };
+  async processTaskStarted(registration, record2) {
+    return { activeTask: { codex_turn_id: record2.turn_id, host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record2.turn_id), started_at: record2.timestamp }, enqueued: 0 };
   }
-  async processUserInput(registration, activeTask, record3) {
-    if (activeTask === void 0 || activeTask.codex_turn_id !== record3.turn_id) {
-      const adopted = await this.adoptHookCorrelatedTurn(registration, activeTask, record3);
+  async processUserInput(registration, activeTask, record2) {
+    if (activeTask === void 0 || activeTask.codex_turn_id !== record2.turn_id) {
+      const adopted = await this.adoptHookCorrelatedTurn(registration, record2);
       if (adopted === void 0) return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
       activeTask = adopted;
     }
-    const hostInputRef = hostInputReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id, record3.message_id, record3.ordinal, record3.prompt);
+    const hostInputRef = hostInputReference(registration.host_source_ref, registration.host_session_ref, record2.turn_id, record2.message_id, record2.ordinal, record2.prompt);
     const origin = activeTask.origin_host_input_ref === void 0;
-    const promptValue = promptObservationValue(record3.prompt);
+    const promptValue = promptObservationValue(record2.prompt);
     const currentPromptRef = hostProducerPromptRef(promptValue.body_sha256);
     const promptRef = activeTask.prompt_ref ?? currentPromptRef;
     const steeredPromptRef = await this.steeredPromptRef(registration, activeTask, origin, currentPromptRef);
     const identity = { host_source_ref: registration.host_source_ref, host_session_ref: registration.host_session_ref, host_turn_ref: activeTask.host_turn_ref };
     const observations = [{
-      observation_ref: observationRef("transcript_user_text", hostInputRef, record3.prompt),
+      observation_ref: observationRef(registration.host_source_ref, "transcript_user_text", hostInputRef, record2.prompt),
       observation_kind: "prompt",
-      observed_at: record3.timestamp,
+      observed_at: record2.timestamp,
       value: promptValue
     }];
     if (origin) {
-      observations.push({ observation_ref: observationRef("transcript_task_started", activeTask.host_turn_ref, record3.turn_id), observation_kind: "turn", observed_at: record3.timestamp, value: turnObservationValue(registration.codex_session_id, activeTask.host_turn_ref, "started") });
+      observations.push({ observation_ref: observationRef(registration.host_source_ref, "transcript_task_started", activeTask.host_turn_ref, record2.turn_id), observation_kind: "turn", observed_at: record2.timestamp, value: turnObservationValue(registration.codex_session_id, activeTask.host_turn_ref, "started") });
       const session = await this.store.readSession(registration.host_source_ref, registration.host_session_ref);
-      if (session !== null) observations.push({ observation_ref: observationRef("transcript_session", registration.host_session_ref, session.value), observation_kind: "session", observed_at: record3.timestamp, value: session.value });
+      if (session !== null) observations.push({ observation_ref: observationRef(registration.host_source_ref, "transcript_session", registration.host_session_ref, session.value), observation_kind: "session", observed_at: record2.timestamp, value: session.value });
     }
     const envelope = {
       schema_version: "ceal.codex_observation_outbox.v1",
       identity,
       host_input_ref: hostInputRef,
-      input_kind: record3.input_kind,
       prompt_ref: promptRef,
       observations,
-      codex_turn_id: record3.turn_id,
+      codex_turn_id: record2.turn_id,
       origin_input: origin,
-      submission_ref: codexSubmissionReference(hostInputRef, "input", record3.ordinal),
-      created_at: record3.timestamp,
+      submission_ref: codexSubmissionReference(hostInputRef, "input", record2.ordinal),
+      created_at: record2.timestamp,
       expires_at: this.expire(this.outboxRetentionMs)
     };
-    const persisted = await this.persistUserInputTurn(registration, activeTask, record3, hostInputRef, origin, currentPromptRef, promptRef, identity, envelope);
+    const persisted = await this.persistUserInputTurn(activeTask, hostInputRef, origin, currentPromptRef, promptRef, identity, envelope);
     if (steeredPromptRef !== null) await this.activateTranscriptTurnContext(identity, steeredPromptRef, envelope.expires_at);
     return persisted;
   }
@@ -6452,40 +6880,21 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
    * stay ignored. A stale active task for another turn releases first, the
    * same as a task_started supersession.
    */
-  async adoptHookCorrelatedTurn(registration, activeTask, record3) {
-    const currentPromptRef = hostProducerPromptRef(promptObservationValue(record3.prompt).body_sha256);
+  async adoptHookCorrelatedTurn(registration, record2) {
+    const currentPromptRef = hostProducerPromptRef(promptObservationValue(record2.prompt).body_sha256);
     const selection = await this.store.readInvocationTurnSelection(registration.host_source_ref, registration.host_session_ref);
     if (selection?.prompt_ref !== currentPromptRef) return void 0;
-    if (activeTask !== void 0 && activeTask.codex_turn_id !== record3.turn_id && activeTask.prompt_ref !== void 0) {
-      await this.releasePrompt(registration.host_session_ref, activeTask, activeTask.prompt_ref);
-    }
     return {
-      codex_turn_id: record3.turn_id,
-      host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record3.turn_id),
-      started_at: record3.timestamp
+      codex_turn_id: record2.turn_id,
+      host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record2.turn_id),
+      started_at: record2.timestamp
     };
   }
-  async persistUserInputTurn(registration, activeTask, record3, hostInputRef, origin, currentPromptRef, promptRef, identity, envelope) {
-    const custodyRegistered = await this.registerPrompt(origin, registration, activeTask, currentPromptRef, record3.prompt, envelope.expires_at);
-    if (custodyRegistered) this.diagnostic("watcher_turn_observed");
-    try {
-      await this.store.put(envelope);
-      if (origin) await this.activateTranscriptTurnContext(identity, promptRef, envelope.expires_at);
-    } catch (error) {
-      if (custodyRegistered) await this.releasePrompt(registration.host_session_ref, activeTask, currentPromptRef).catch(() => void 0);
-      throw error;
-    }
+  async persistUserInputTurn(activeTask, hostInputRef, origin, currentPromptRef, promptRef, identity, envelope) {
+    await this.store.put(envelope);
+    if (origin) await this.activateTranscriptTurnContext(identity, promptRef, envelope.expires_at);
     return { activeTask: { ...activeTask, origin_host_input_ref: activeTask.origin_host_input_ref ?? hostInputRef, prompt_ref: activeTask.prompt_ref ?? currentPromptRef }, enqueued: 1 };
   }
-  async registerPrompt(origin, registration, activeTask, promptRef, prompt, expiresAt) {
-    if (!origin || this.producerInstallationRef === void 0 || this.registerCurrentPrompt === void 0) return false;
-    const register = this.registerCurrentPrompt;
-    const installationRef = this.producerInstallationRef;
-    return registerHostCurrentPromptDiagnosed(
-      () => register({ producer_id: "codex", producer_installation_ref: installationRef, local_session_ref: registration.host_session_ref, local_turn_ref: activeTask.host_turn_ref, prompt_ref: promptRef, current_prompt: prompt, context_expires_at: expiresAt }),
-      (event) => this.diagnostic(event)
-    );
-  }
   async activateTranscriptTurnContext(identity, promptRef, expiresAt) {
     try {
       const selection = await this.store.readInvocationTurnSelection(identity.host_source_ref, identity.host_session_ref);
@@ -6497,41 +6906,27 @@ var CodexTranscriptWatcher = class extends HostTranscriptWatcher {
       throw error;
     }
   }
-  async releasePrompt(sessionRef, activeTask, promptRef) {
-    if (this.producerInstallationRef === void 0 || this.releaseCurrentPrompt === void 0) return;
-    await this.releaseCurrentPrompt({ producer_id: "codex", producer_installation_ref: this.producerInstallationRef, local_session_ref: sessionRef, local_turn_ref: activeTask.host_turn_ref, prompt_ref: promptRef });
-  }
-  async releaseStoredPromptBestEffort(sessionRef, cursor) {
-    await this.releaseActiveTaskBestEffort(sessionRef, cursor?.active_task);
-  }
-  async releaseActiveTaskBestEffort(sessionRef, activeTask) {
-    if (activeTask?.prompt_ref === void 0) return;
-    await this.releasePrompt(sessionRef, activeTask, activeTask.prompt_ref).catch(() => void 0);
-  }
-  async processTerminal(registration, activeTask, record3) {
-    if (activeTask === void 0 || activeTask.codex_turn_id !== record3.turn_id || activeTask.origin_host_input_ref === void 0 || activeTask.prompt_ref === void 0) return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
+  async processTerminal(registration, activeTask, record2) {
+    if (activeTask === void 0 || activeTask.codex_turn_id !== record2.turn_id || activeTask.origin_host_input_ref === void 0 || activeTask.prompt_ref === void 0) return { ...activeTask === void 0 ? {} : { activeTask }, enqueued: 0 };
     const identity = { host_source_ref: registration.host_source_ref, host_session_ref: registration.host_session_ref, host_turn_ref: activeTask.host_turn_ref };
-    const timing = record3.kind === "task_complete" ? { status: "available", unit: "milliseconds", started_at: record3.started_at, completed_at: record3.completed_at, duration_ms: record3.duration_ms, time_to_first_token_ms: record3.time_to_first_token_ms } : { status: "available", unit: "milliseconds", started_at: record3.started_at, completed_at: record3.completed_at, duration_ms: record3.duration_ms, terminal: "aborted", reason: record3.reason };
-    const observations = terminalObservations(registration, activeTask, record3, timing);
+    const timing = record2.kind === "task_complete" ? { status: "available", unit: "milliseconds", started_at: record2.started_at, completed_at: record2.completed_at, duration_ms: record2.duration_ms, time_to_first_token_ms: record2.time_to_first_token_ms } : { status: "available", unit: "milliseconds", started_at: record2.started_at, completed_at: record2.completed_at, duration_ms: record2.duration_ms, terminal: "aborted", reason: record2.reason };
+    const observations = terminalObservations(registration, activeTask, record2, timing);
     await this.store.put({
       schema_version: "ceal.codex_observation_outbox.v1",
       identity,
       host_input_ref: activeTask.origin_host_input_ref,
-      input_kind: "host_automatic",
       prompt_ref: activeTask.prompt_ref,
       observations,
-      codex_turn_id: record3.turn_id,
+      codex_turn_id: record2.turn_id,
       origin_input: false,
-      submission_ref: codexSubmissionReference(activeTask.origin_host_input_ref, "terminal", record3.ordinal),
-      created_at: record3.timestamp,
+      submission_ref: codexSubmissionReference(activeTask.origin_host_input_ref, "terminal", record2.ordinal),
+      created_at: record2.timestamp,
       expires_at: this.expire(this.outboxRetentionMs)
     });
-    await this.releasePrompt(registration.host_session_ref, activeTask, activeTask.prompt_ref);
     await this.store.clearInvocationContext(identity, this.now());
     return { enqueued: 1 };
   }
   async quarantine(registration, cursor, device, inode, reason) {
-    await this.releaseStoredPromptBestEffort(registration.host_session_ref, cursor);
     const quarantined = { ...cursor, transcript_path: registration.transcript_path, device, inode, status: "quarantined", reason, updated_at: this.stamp() };
     await this.store.writeTranscriptCursor(quarantined);
   }
@@ -6544,10 +6939,10 @@ function codexTranscriptScanFailureKind(error) {
     return void 0;
   });
 }
-function accumulateTokenCount(activeTask, record3) {
-  if (record3.usage_gap_reason !== void 0) return { ...activeTask, token_usage_gap_reason: record3.usage_gap_reason };
-  const last = record3.last_usage;
-  const total = record3.total_usage;
+function accumulateTokenCount(activeTask, record2) {
+  if (record2.usage_gap_reason !== void 0) return { ...activeTask, token_usage_gap_reason: record2.usage_gap_reason };
+  const last = record2.last_usage;
+  const total = record2.total_usage;
   if (last === void 0 || ignoreTokenCount(activeTask.last_total_usage, total, last)) return activeTask;
   const tokenUsage = addUsage(activeTask.token_usage, last);
   return {
@@ -6561,21 +6956,16 @@ function ignoreTokenCount(previous, total, last) {
   if (total === void 0 || previous === void 0) return false;
   return sameUsage(total, previous) || regressedUsage(total, previous) && looksLikeStaleRegression(total, previous, last);
 }
-function terminalObservations(registration, activeTask, record3, timing) {
+function terminalObservations(registration, activeTask, record2, timing) {
   const tokenValue = activeTask.token_usage_gap_reason !== void 0 ? notRecorded(activeTask.token_usage_gap_reason) : activeTask.token_usage === void 0 ? notRecorded("token_count_not_observed_for_active_turn") : tokenObservationValue(activeTask.token_usage);
-  const costValue = terminalCostValue();
   const observations = [
-    { observation_ref: observationRef("transcript_terminal", activeTask.host_turn_ref, record3), observation_kind: "turn", observed_at: record3.timestamp, value: turnObservationValue(registration.codex_session_id, activeTask.host_turn_ref, "stopped") },
-    { observation_ref: observationRef("transcript_timing", activeTask.host_turn_ref, timing), observation_kind: "timing", observed_at: record3.timestamp, value: timing },
-    { observation_ref: observationRef("transcript_token", activeTask.host_turn_ref, tokenValue), observation_kind: "token", observed_at: record3.timestamp, value: tokenValue },
-    { observation_ref: observationRef("transcript_cost", activeTask.host_turn_ref, costValue), observation_kind: "cost", observed_at: record3.timestamp, value: costValue }
+    { observation_ref: observationRef(registration.host_source_ref, "transcript_terminal", activeTask.host_turn_ref, record2), observation_kind: "turn", observed_at: record2.timestamp, value: turnObservationValue(registration.codex_session_id, activeTask.host_turn_ref, "stopped") },
+    { observation_ref: observationRef(registration.host_source_ref, "transcript_timing", activeTask.host_turn_ref, timing), observation_kind: "timing", observed_at: record2.timestamp, value: timing },
+    { observation_ref: observationRef(registration.host_source_ref, "transcript_token", activeTask.host_turn_ref, tokenValue), observation_kind: "token", observed_at: record2.timestamp, value: tokenValue }
   ];
-  if (activeTask.model !== void 0) observations.push({ observation_ref: observationRef("transcript_model", activeTask.host_turn_ref, activeTask.model), observation_kind: "model", observed_at: record3.timestamp, value: { status: "available", value: activeTask.model, source: "turn_context.model" } });
+  if (activeTask.model !== void 0) observations.push({ observation_ref: observationRef(registration.host_source_ref, "transcript_model", activeTask.host_turn_ref, activeTask.model), observation_kind: "model", observed_at: record2.timestamp, value: { status: "available", value: activeTask.model, source: "turn_context.model" } });
   return observations;
 }
-function terminalCostValue() {
-  return notRecorded("provider_cost_not_observed");
-}
 function notRecorded(reason) {
   return hostObservationNotRecorded(reason);
 }
@@ -6622,25 +7012,21 @@ function looksLikeStaleRegression(current, previous, last) {
   if (previous.total_tokens <= 0 || current.total_tokens <= 0 || last.total_tokens <= 0) return false;
   return current.total_tokens * 100 >= previous.total_tokens * 98 || current.total_tokens + last.total_tokens * 2 >= previous.total_tokens;
 }
-function assertRecordSequence(registration, cursor, records, lastOrdinal, record3) {
-  if ((cursor.header_validated || records > 0) && record3.ordinal <= lastOrdinal) throw new CodexHostAdapterError("payload_rejected", `Codex transcript ordinal is not monotonic (${refusalFact("ordinal", record3.ordinal, `greater than ${lastOrdinal}`)}).`);
-  if (!cursor.header_validated && records === 0) assertCodexTranscriptHeader(registration, record3);
+function assertRecordSequence(registration, cursor, records, lastOrdinal, record2) {
+  if ((cursor.header_validated || records > 0) && record2.ordinal <= lastOrdinal) throw new CodexHostAdapterError("payload_rejected", `Codex transcript ordinal is not monotonic (${refusalFact("ordinal", record2.ordinal, `greater than ${lastOrdinal}`)}).`);
+  if (!cursor.header_validated && records === 0) assertCodexTranscriptHeader(registration, record2);
 }
 
 // host/codex/src/codex-producer-runtime.ts
 async function drainCodexProducerOnce(options) {
-  const promptPort = new HostRelayCurrentPromptPort(options.relay_endpoint, options.timeout_ms);
   const scan = await new CodexTranscriptWatcher({
     outbox_dir: options.outbox_dir,
-    producer_installation_ref: options.producer_installation_ref,
-    register_current_prompt: (input) => promptPort.register(input),
-    release_current_prompt: (identity) => promptPort.release(identity),
     diagnostic: (event, failure_kind) => writeHostServiceDiagnostic("codex", event, failure_kind)
   }).scanOnce().catch((error) => {
     writeHostServiceDiagnostic("codex", "watcher_scan_failed", codexTranscriptScanFailureKind(error));
     throw error;
   });
-  const producer = new CodexProducer({ outbox_dir: options.outbox_dir, producer_installation_ref: options.producer_installation_ref, relay: new HostRelayIpcAdmissionPort(options.relay_endpoint, options.timeout_ms), ...options.producer_epoch === void 0 ? {} : { producer_epoch: options.producer_epoch }, ...options.now === void 0 ? {} : { now: options.now } });
+  const producer = new CodexProducer({ outbox_dir: options.outbox_dir, ...options.now === void 0 ? {} : { now: options.now } });
   return { scanned: scan.enqueued, ...await producer.drainOutbox() };
 }
 
@@ -6653,33 +7039,29 @@ var CODEX_PRODUCER_DESCRIPTOR = {
   extra_paths: [CODEX_SESSIONS_ROOT],
   config: (shared, extras) => ({ ...shared, codex_sessions_root: hostProducerExtraPath(extras, CODEX_SESSIONS_ROOT) }),
   runtime_options: (config) => Object.freeze({
-    outbox_dir: config.outbox_dir,
-    producer_installation_ref: config.producer_installation_ref,
-    producer_epoch: config.producer_epoch,
-    relay_endpoint: config.relay_endpoint,
-    timeout_ms: config.ipc_timeout_ms
+    outbox_dir: config.outbox_dir
   }),
   drain: drainCodexProducerOnce
 };
 
 // host/codex/src/codex-visible-output-budget.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var import_toml = __toESM(require_toml(), 1);
 var CODEX_DEFAULT_TOOL_OUTPUT_TOKEN_LIMIT = 5e3;
 var CODEX_UTF8_BYTES_PER_OUTPUT_TOKEN = 4;
 async function resolveCodexVisibleOutputMaxBytes(environment = process.env) {
-  const codexHome = environment.CODEX_HOME || join5(homedir(), ".codex");
+  const codexHome = resolveCodexHome(environment, homedir());
   let source;
   try {
-    source = await readFile3(join5(codexHome, "config.toml"), "utf8");
+    source = await readFile2(join6(codexHome, "config.toml"), "utf8");
   } catch (error) {
     return isNotFound2(error) ? codexBytes(CODEX_DEFAULT_TOOL_OUTPUT_TOKEN_LIMIT) : void 0;
   }
   try {
     const parsed = import_toml.default.parse(source);
-    if (!isRecord8(parsed)) return void 0;
+    if (!isRecord9(parsed)) return void 0;
     const configured = parsed.tool_output_token_limit;
     if (configured === void 0) return codexBytes(CODEX_DEFAULT_TOOL_OUTPUT_TOKEN_LIMIT);
     return typeof configured === "number" && Number.isSafeInteger(configured) && configured > 0 ? codexBytes(configured) : void 0;
@@ -6690,7 +7072,7 @@ async function resolveCodexVisibleOutputMaxBytes(environment = process.env) {
 function codexBytes(tokens) {
   return Math.min(tokens * CODEX_UTF8_BYTES_PER_OUTPUT_TOKEN, CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES);
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isNotFound2(error) {
@@ -6707,11 +7089,28 @@ var CODEX_INVOCATION_AUTHENTICATION_DESCRIPTOR = {
   config_flag: HOST_PRODUCER_CONFIG_FLAG,
   parse_config_flag: parseHostProducerConfigFlag,
   read_producer_config: (configPath) => readHostProducerConfig(CODEX_PRODUCER_DESCRIPTOR, configPath),
-  resolve_visible_output_max_bytes: () => resolveCodexVisibleOutputMaxBytes()
+  resolve_visible_output_max_bytes: () => resolveCodexVisibleOutputMaxBytes(),
+  read_human_message_window: readCodexInvocationHumanMessageWindow
 };
 function runCodexInvocationAuthenticationCommand(args, options) {
   return runHostInvocationAuthenticationCommand(CODEX_INVOCATION_AUTHENTICATION_DESCRIPTOR, args, options);
 }
+async function readCodexInvocationHumanMessageWindow(input) {
+  return readRegisteredHostInvocationHumanMessageWindow(() => input.store.listTranscriptRegistrations(), input.identity, (line, registration) => {
+    let record2;
+    try {
+      record2 = decodeCodexTranscriptLine(line);
+    } catch {
+      return "malformed";
+    }
+    if (record2.kind !== "user_text" || record2.content_item_kind !== "user.text") return null;
+    return {
+      host_turn_ref: hostTurnReference(registration.host_source_ref, registration.host_session_ref, record2.turn_id),
+      host_input_ref: hostInputReference(registration.host_source_ref, registration.host_session_ref, record2.turn_id, record2.message_id, record2.ordinal, record2.prompt),
+      text: record2.prompt
+    };
+  });
+}
 
 // host/codex/bin/ceal-codex-invocation-authentication.ts
 var CODEX_INVOCATION_AUTHENTICATION_CLIENT_COMMAND = {