@corca-org/ceal-host-win32-x64 1.0.20 → 1.0.21

package/libexec/ceal-host/relay.mjs

@@ -29,16 +29,34 @@ function isPlainRecord(value) {
   return prototype === Object.prototype || prototype === null;
 }
 
+// packages/ceal-client-protocol/src/client-wire-contract.ts
+import { createHash } from "node:crypto";
+
 // packages/ceal-client-protocol/client-wire-contract.json
 var client_wire_contract_default = {
   schema_version: "ceal.client_wire_contract.v1",
+  doctor: {
+    schema_version: "ceal.doctor.v1"
+  },
+  client_commands: {
+    doctor: ["doctor"],
+    version: ["version"],
+    access_group_list: ["access-group", "list"]
+  },
+  client_environment: {
+    environment_prefix: "CEAL",
+    context_override_suffixes: ["GATEWAY_ORIGIN", "GATEWAY_TRANSPORT_ORIGIN", "ACCESS_TOKEN", "CONTEXT_STORE_PATH"]
+  },
   canonical_json: {
     ordering: "utf16_code_unit_ascending"
   },
   artifact_descriptor: {
-    operation_contract_bundle_schema_version: "ceal.operation_contract_bundle.v1",
-    schema_version: "ceal.verified_artifact_descriptor.v1",
-    binding_schema_version: "ceal.verified_artifact_binding.v1",
+    operation_contract_bundle_schema_name: "ceal.operation_contract_bundle",
+    operation_contract_bundle_fields: ["schema_version", "catalog_revision", "operations", "failure_guidance"],
+    schema_name: "ceal.verified_artifact_descriptor",
+    fields: ["schema_version", "kind", "media_type", "byte_count", "sha256", "binding"],
+    binding_schema_name: "ceal.verified_artifact_binding",
+    binding_fields: ["schema_version", "kind", "catalog_revision"],
     kind: "verified_artifact",
     binding_kind: "catalog",
     media_type: "application/json",
@@ -54,14 +72,16 @@ var client_wire_contract_default = {
       length: 72,
       pattern: "^catalog:[a-f0-9]{64}$"
     },
-    envelope_max_bytes: 389
+    envelope_max_bytes: 407
   },
   command_request: {
-    schema_version: "ceal.command_request.v1",
+    schema_name: "ceal.command_request",
+    fields: ["schema_version", "argv", "operation", "client_nonce", "context_token"],
     absolute_transport_max_bytes: 65536
   },
   command_resolution: {
-    schema_version: "ceal.gateway_command_resolution.v1",
+    schema_name: "ceal.gateway_command_resolution",
+    fields: ["schema_version", "kind", "ok", "execution_started", "program", "route", "authority", "routes", "operations", "required_action_sequence", "semantic_options", "result_delivery", "operation", "invocation", "entrypoints", "common_concepts", "withheld", "catalog_revision", "operation_id", "input", "transport", "output", "unresolved_inputs", "unresolved_refusal", "attempted_route", "did_you_mean", "error"],
     authority: {
       anonymous: {
         state: "anonymous",
@@ -101,7 +121,8 @@ var client_wire_contract_default = {
     }
   },
   command_response: {
-    schema_version: "ceal.command_response.v1",
+    schema_name: "ceal.command_response",
+    fields: ["schema_version", "exit_code", "document", "operation_id", "visible_output_max_bytes", "local_delivery", "verified_artifact"],
     descriptor_field: "verified_artifact",
     required_fields: [
       "schema_version",
@@ -125,29 +146,41 @@ var client_wire_contract_default = {
       "required_action_sequence",
       "withheld"
     ],
-    prompt_field: "prompt",
-    prompt_schema_version: "ceal.prompt.v1",
-    focused_prompt_document_fields: [
-      "catalog_revision",
-      "prompt"
-    ],
-    focused_prompt_continuation_document_fields: [
-      "catalog_revision",
-      "remaining_work",
-      "prompt"
-    ],
     discovery_command: "discovery",
-    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
+    discovery_manifest_schema_name: "ceal.discovery_manifest",
+    discovery_manifest_fields: ["schema_version", "skill", "authority_scope", "connector_kinds", "personal_connector_kinds", "guide_markdown", "renderer_version", "digest"],
     discovery_manifest_document_fields: [
       "discovery_manifest"
     ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
-    complete_max_bytes: 66019
+    complete_max_bytes: 66046
+  },
+  host_invocation_authentication: {
+    request_schema_name: "ceal.host_invocation_authentication_request",
+    request_fields: [
+      "schema_version",
+      "client_nonce"
+    ],
+    result_schema_name: "ceal.host_invocation_authentication_result",
+    result_fields: [
+      "schema_version",
+      "context_token",
+      "expires_at"
+    ],
+    client_nonce: {
+      character_class_source: "A-Za-z0-9_-",
+      encoded_characters: 43
+    }
+  },
+  gateway_host_invocation_context_request: {
+    schema_name: "ceal.gateway_host_invocation_context_request",
+    fields: ["schema_version", "client_nonce", "context_expires_at", "request_work_context", "current_prompt", "visible_output_max_bytes"]
   },
   resource_stream: {
     path: "/api/ceal/v2/resources",
-    request_schema_version: "ceal.resource_stream_request.v1",
+    request_schema_name: "ceal.resource_stream_request",
+    request_fields: ["schema_version", "resource_ref", "client_nonce", "context_token"],
     ref_pattern: "^resource:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
     media_type_pattern: "^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$",
     filename_max_bytes: 512,
@@ -164,92 +197,6 @@ var client_wire_contract_default = {
   }
 };
 
-// packages/ceal-client-protocol/src/client-wire-contract.ts
-var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
-var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
-var commandResolutionAuthority = commandResolution.authority;
-var commandResolutionSemanticOptions = commandResolution.semantic_options;
-var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
-var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
-var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
-var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
-var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
-var CEAL_OPERATION_CONTRACT_BUNDLE_SCHEMA_VERSION = artifact.operation_contract_bundle_schema_version;
-var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_SCHEMA_VERSION = artifact.schema_version;
-var CEAL_VERIFIED_ARTIFACT_BINDING_SCHEMA_VERSION = artifact.binding_schema_version;
-var CEAL_VERIFIED_ARTIFACT_KIND = artifact.kind;
-var CEAL_VERIFIED_ARTIFACT_BINDING_KIND = artifact.binding_kind;
-var CEAL_VERIFIED_ARTIFACT_MEDIA_TYPE = artifact.media_type;
-var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
-var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
-var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
-var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
-var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
-var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
-var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
-var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
-var CEAL_COMMAND_RESPONSE_PROMPT_FIELD = response.prompt_field;
-var CEAL_COMMAND_RESPONSE_PROMPT_SCHEMA_VERSION = response.prompt_schema_version;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
-var CEAL_COMMAND_RESPONSE_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.bare_document_fields, response.prompt_field]);
-var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_document_fields]);
-var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_continuation_document_fields]);
-var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
-var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
-var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
-var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
-
-// packages/ceal-client-protocol/src/vocabulary.ts
-function vocabulary(words) {
-  return Object.freeze(words);
-}
-function isVocabularyWord(words, value) {
-  return words.some((word) => word === value);
-}
-
-// packages/ceal-client-protocol/src/gateway-response-types.ts
-var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
-var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
-var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
-var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
-var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
-var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
-var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
-var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
-var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
-var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
-var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
-var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
-var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
-var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
-var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
-var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
-var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
-var CEAL_PROTOCOL_VERSION = "1.4.0";
-var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
-var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
-var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
-  "audited_call_pending",
-  "continuation_read_pending",
-  "continuation_write_pending",
-  "provider_pacing_pending",
-  "corpus_replay_pending",
-  "corpus_append_pending",
-  "corpus_fence_pending",
-  "corpus_content_pending",
-  "corpus_transaction_pending"
-]);
-var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
-var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
-var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
-var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
-  "connector_ref",
-  "connector_revision",
-  "policy_decision_revision"
-]);
-
 // packages/ceal-client-protocol/src/operation-next-actions.ts
 var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
 var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
@@ -316,7 +263,10 @@ var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "follow_required_action_sequence",
   // The command needs caller-owned local materialization (for example an
   // @path file) before the Gateway can receive the argument.
-  "materialize_local_argument"
+  "materialize_local_argument",
+  // A peer's derived schema identifier changed with its field set; install or
+  // upgrade the CLI and Host Relay to the Gateway's release before retrying.
+  "upgrade_ceal_client"
 ];
 var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
 var NON_REMEDY_NEXT_ACTION_VALUES = [
@@ -429,47 +379,56 @@ var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
   personal_authorization_required: "connect_personal_account"
 });
 
-// packages/ceal-client-protocol/src/operation-withheld-cause.ts
-var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+// packages/ceal-client-protocol/src/vocabulary.ts
+function vocabulary(words) {
+  return Object.freeze(words);
+}
+function isVocabularyWord(words, value) {
+  return words.some((word) => word === value);
+}
 
-// packages/ceal-client-protocol/src/operation-contract-types.ts
-var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
-var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
-var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
-var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
-var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
-var SAFETY_CLASSES = vocabulary(["routine", "sensitive", "high_impact"]);
-var IDEMPOTENCY_CLASSES = vocabulary(["idempotent", "conditionally_idempotent", "non_idempotent"]);
-var REVERSIBILITY_CLASSES = vocabulary(["none", "reversible", "compensatable", "irreversible"]);
-var COMPENSATION_OWNERS = vocabulary(["none", "connector", "operator"]);
-var CANCELLATION_BOUNDARIES = vocabulary(["before_admission", "before_handoff", "after_handoff_reconcile"]);
-var HANDOFF_CLASSES = vocabulary(["not_applicable", "submission", "effect"]);
-var AUTHORITATIVE_READBACK_CLASSES = vocabulary(["required", "unavailable"]);
-var PROVIDER_READBACK_CLASSES = vocabulary(["required", "not_available", "not_applicable"]);
-var RECONCILIATION_CLASSES = vocabulary(["none", "automatic", "operator"]);
-var NO_READBACK_APPROVAL_CLASSES = vocabulary(["not_applicable", "explicit", "operator"]);
-var REPLAY_PREREQUISITES = vocabulary(["never", "fresh_admission", "reconciled_non_application", "operator_approval"]);
-var UNKNOWN_OUTCOMES = vocabulary(["reconcile", "operator_action", "excluded"]);
-var RECOVERY_OWNERS = vocabulary(["gateway", "connector", "operator"]);
-var CEAL_OPERATION_ADMISSION_STATES = vocabulary(["proposed", "refused", "admitted"]);
-var CEAL_OPERATION_EXECUTION_STATES = vocabulary(["not_started", "started", "completed"]);
-var CEAL_OPERATION_PROVIDER_HANDOFF_STATES = vocabulary(["not_offered", "offered", "accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_EFFECT_STATES = vocabulary(["none", "applied", "failed", "unknown", "compensated"]);
-var CEAL_OPERATION_OBSERVATION_STATES = vocabulary(["not_started", "not_required", "pending", "observed", "unavailable"]);
-var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate", "operator_action"]);
-var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
-var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
-var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
-var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
-  "approval_not_required_by_policy",
-  "interactive_pending",
-  "interactive_granted",
-  "interactive_denied",
-  "interactive_expired",
-  "interactive_unavailable"
+// packages/ceal-client-protocol/src/gateway-response-types.ts
+var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
+var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
+var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
+var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
+var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
+var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
+var CEAL_GATEWAY_DERIVED_STORE_FAILURE_CLASSES = vocabulary(["storage_unavailable", "decode_mismatch", "write_conflict", "quota", "store_error"]);
+var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
+var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
+var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "provider_authenticated_event"]);
+var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
+var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
+var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
+var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
+var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
+var CEAL_PROTOCOL_VERSION = "1.4.0";
+var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_GATEWAY_CALL_RESULT_SCHEMA_VERSION = "ceal.gateway_call_result.v1";
+var CEAL_GATEWAY_CONTINUATION_CURSOR_PHASES = vocabulary(["scan", "delivery", "terminal"]);
+var CEAL_GATEWAY_ACTIVE_CALL_PHASES = vocabulary([
+  "audited_call_pending",
+  "continuation_read_pending",
+  "continuation_write_pending",
+  "provider_pacing_pending",
+  "corpus_replay_pending",
+  "corpus_append_pending",
+  "corpus_fence_pending",
+  "corpus_content_pending",
+  "corpus_transaction_pending"
+]);
+var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
+var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
+var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
+var CEAL_GATEWAY_AUDIT_CALL_DETAIL_SCHEMA_VERSION = "ceal.gateway_audit_call_detail.v1";
+var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
+  "connector_ref",
+  "connector_revision",
+  "policy_decision_revision"
 ]);
 
 // packages/ceal-client-protocol/src/gateway-validation-primitives.ts
@@ -609,6 +568,11 @@ function isCealJsonRecord(value) {
 }
 var CEAL_VALIDATION_STATUSES = vocabulary(["not_applicable", "valid", "invalid"]);
 var CEAL_PARSE_STATUSES = vocabulary(["not_applicable", "parsed", "parse_failed"]);
+function hasExactKeys(value, expected) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
 function invalidByContext(options) {
   if (options.forbidAuthorityKeys) invalidRequest();
   invalidResponse();
@@ -683,51 +647,6 @@ function cut(text) {
   return text.length <= REFUSAL_VALUE_MAX_CHARS ? text : `${text.slice(0, REFUSAL_VALUE_MAX_CHARS)}...(+${text.length - REFUSAL_VALUE_MAX_CHARS} chars)`;
 }
 
-// packages/ceal-client-protocol/src/operation-access-class.ts
-var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
-
-// packages/ceal-client-protocol/src/domain-vocabulary.ts
-var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
-var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
-var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
-var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
-var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
-var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
-var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
-var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
-var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
-var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
-var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
-var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
-
-// packages/ceal-client-protocol/src/safe-json-budget.ts
-var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
-function safeJsonNodeBudgetForBytes(maxBytes) {
-  if (!Number.isSafeInteger(maxBytes) || maxBytes < SAFE_JSON_MIN_BYTES_PER_NODE) {
-    throw new RangeError(`safe-JSON byte cap is invalid: ${refusalFact("maxBytes", maxBytes, `at least ${SAFE_JSON_MIN_BYTES_PER_NODE} bytes`)}`);
-  }
-  return Math.floor(maxBytes / SAFE_JSON_MIN_BYTES_PER_NODE);
-}
-
-// packages/ceal-client-protocol/src/protocol-bounds.ts
-var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES = 64 * 1024;
-var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_NODES = safeJsonNodeBudgetForBytes(CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES);
-var OPERATION_SCHEMA_LITERAL_MAX_BYTES = CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES / 4;
-var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
-  max_depth: 8,
-  max_properties: 96,
-  max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
-  max_alternatives: 8,
-  max_enum_values: 64,
-  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
-  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
-  max_description_characters: 1024,
-  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
-  max_pattern_characters: 256,
-  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
-  max_literal_nodes: 512
-});
-
 // packages/ceal-client-protocol/src/operation-validation-primitives.ts
 var ISO_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?([Zz]|([+-])(\d{2}):(\d{2}))$/u;
 var CEAL_CALENDAR_DATE_PATTERN_SOURCE = "^\\d{4}-\\d{2}-\\d{2}$";
@@ -795,38 +714,366 @@ function requireIsoTimestamp(value, message) {
   if (!isCealIsoTimestamp(value)) throw new TypeError(message);
 }
 
-// packages/ceal-client-protocol/src/operation-json-schema.ts
-var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
-
-// packages/ceal-client-protocol/src/operation-contract-validation.ts
-var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
-var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
-var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
-var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
-
-// packages/ceal-client-protocol/src/operation-catalog.ts
-var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
-var CLIENT_AUDIENCES = Object.freeze(["ceal", "cealctl", "agent"]);
-var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
+// packages/ceal-client-protocol/src/failure-guidance-table.ts
+var CEAL_FAILURE_REDACTION_CLASSES = vocabulary(["model_safe", "withheld"]);
+var CEAL_GATEWAY_STARTING_FAILURE_CODE = "gateway_starting";
+var CEAL_OWNER_BOOTSTRAP_ABSENT_FAILURE_CODE = "bootstrap_absent";
+var CEAL_OWNER_BOOTSTRAP_UNAVAILABLE_FAILURE_CODE = "bootstrap_unavailable";
+var LOCAL_COMMAND_INVALID = "The local command or argument is invalid.";
+var LOCAL_TRANSPORT_INCOMPLETE = "The local Ceal transport could not complete; report this as a gap.";
+var GATEWAY_TRANSPORT_UNAVAILABLE = "The Gateway transport is unavailable; ask an administrator to restore Gateway availability.";
+var HOST_AUTHENTICATION_UNAVAILABLE = "The Host could not authenticate this invocation; report this as a gap.";
+var SESSION_CONTEXT_UNAVAILABLE = "The local Gateway session context is unavailable.";
+function guidance(message, next_action, http_status, retryable = false, redaction_class = "model_safe") {
+  return Object.freeze({ message, next_action, http_status, retryable, redaction_class });
+}
+var CEAL_FAILURE_GUIDANCE_TABLE = Object.freeze({
+  invalid_command: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 400),
+  invalid_argument: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 400),
+  command_not_found: guidance(LOCAL_COMMAND_INVALID, "correct_argument", 404),
+  unknown_operation: guidance("The requested Operation is absent from the current verified catalog; report this as a gap unless a catalog suggestion names a replacement.", "answer_with_gap", 404),
+  local_route_unavailable: guidance("The requested local route is unavailable or its descriptor is invalid; report this as a gap.", "answer_with_gap", 404),
+  local_route_ambiguous: guidance("The requested local route is ambiguous; no local executable was selected. Report this as a gap.", "answer_with_gap", 400),
+  local_execution_unavailable: guidance("The selected local route executable is unavailable; report this as a gap.", "answer_with_gap", 500),
+  local_pickup_failed: guidance("The Host Request pickup failed; the Gateway command was not sent. Report this as a gap.", "answer_with_gap", 502),
+  invocation_authentication_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 401),
+  local_execution_cancellation_unknown: guidance("The selected local route cancellation outcome is unknown; a retry can repeat an effect the cancelled route already completed. Report this as a gap and do not retry.", "answer_with_gap", 409),
+  gateway_origin_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  access_token_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_pair_required: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_not_selected: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_store_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  context_store_conflict: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_expired: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_replayed: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_revoked: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_recovery_unavailable: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  refresh_custody_invalid: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  session_store_unwritable: guidance("The Ceal client could not write its local session store; the operating system refused the write (EACCES, EPERM, or EROFS). rerun_outside_agent_sandbox reruns it with escalated execution.", "rerun_outside_agent_sandbox", 500),
+  local_output_exists: guidance("The selected local output path already exists; nothing was written to it.", "choose_new_output_path", 400),
+  local_output_outside_result_root: guidance("The selected local output path lies outside this run's result root; only a path inside the result root named here is writable.", "choose_new_output_path", 400),
+  local_output_unwritable: guidance("The Ceal client could not write the result file at its local path; the operating system refused the write. When that step followed the Gateway call, the call may already have completed a write effect that a rerun repeats. rerun_outside_agent_sandbox reruns it with escalated execution.", "rerun_outside_agent_sandbox", 500),
+  local_output_unavailable: guidance("The Gateway result could not be materialized at the selected local path; report this as a gap.", "answer_with_gap", 500),
+  local_materialization_required: guidance("The Gateway result could not be materialized at the selected local path; report this as a gap.", "answer_with_gap", 500),
+  contract_artifact_cache_invalid: guidance("The verified contract artifact could not be stored in the private local cache; report this as a gap.", "answer_with_gap", 500),
+  response_encoding_failed: guidance("The local response could not be encoded; report this as a gap.", "answer_with_gap", 500),
+  request_timeout: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 504),
+  request_failed: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 502),
+  gateway_unavailable: guidance(GATEWAY_TRANSPORT_UNAVAILABLE, "ask_admin", 503, true),
+  contract_mismatch: guidance("Install or upgrade the Ceal CLI and Host Relay to the same release as the Gateway, then retry.", "upgrade_ceal_client", 409),
+  // `gateway_starting` is the one retryable envelope the serving gate answers on every route while starting
+  // (`cli/internal/client/gateway_startup_wait.go` re-drives it); the sentence is the client default that renders
+  // when the wait ends still unserved, moved from the `localFailureText` default branch.
+  [CEAL_GATEWAY_STARTING_FAILURE_CODE]: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503, true),
+  gateway_internal_error: guidance("The Gateway failed without exposing internal state; report this as a gap.", "answer_with_gap", 500),
+  // The serving gate emits this code with no message; the sentence is the owner-normalized form of the
+  // `gateway_internal_error` guidance (decided with the operator 2026-10-13).
+  internal_error: guidance("The Gateway failed without exposing internal state.", "answer_with_gap", 500),
+  // Owned by the Gateway canonical adapter (`gateway/core/src/gateway-canonical-operation-http-adapter.ts`):
+  // the client variant of this sentence in `localFailureText` was retired when the client started reading this table.
+  request_body_too_large: guidance("The Gateway request body exceeds its bounded limit.", "reduce_request_size", 413),
+  // Restored verbatim from the retired `localFailureText` `unknown_outcome`
+  // case: the outcome is unknown, so a read may be retried while a write
+  // must receipt-check first. Collapsing both to "do not repeat the call"
+  // forbids the safe read retry the sentence exists to allow.
+  unknown_outcome: guidance("The transport outcome is unknown: a read may be retried; for a write, check write_receipt.get before repeating.", "answer_with_gap", 500),
+  // Restored verbatim from the retired `localFailureText`
+  // `refresh_unknown_outcome` case: a refresh that ends unknown leaves the
+  // session context unavailable, so the caller repairs or adopts the
+  // session instead of reporting a transport gap.
+  refresh_unknown_outcome: guidance(SESSION_CONTEXT_UNAVAILABLE, "repair_or_adopt_session", 401),
+  request_cancelled: guidance("The caller cancelled the request before it completed.", "retry", 400, true),
+  expired: guidance("The activation transaction or its administrator approval request expired before completion; repeat the original activation arguments to start a new transaction.", "repeat_original_arguments", 410, true),
+  denied: guidance("An administrator denied this device's activation request; ask an administrator whether to reconsider it.", "ask_admin", 403),
+  device_approval_pending_limit: guidance("Device approval requests are already waiting for an administrator decision; ask an administrator to decide a pending request before adding another device.", "ask_admin", 429),
+  session_already_adopted: guidance("The requested enrollment was not started because this machine already has a live session with the Gateway. Report this as a gap if that local session needs replacement.", "answer_with_gap", 409),
+  pending_adoption_limit: guidance("This device's pending activation file is full; another activation is refused while an administrator decision is pending. Report this as a gap.", "answer_with_gap", 429),
+  recovery_required: guidance("The Gateway could not safely complete the activation transaction automatically; ask an administrator to recover this transaction.", "ask_admin", 500),
+  unsupported_feature: guidance("This Ceal client does not support the Gateway's required activation protocol; ask an administrator to update the client.", "ask_admin", 501),
+  // Activation commit codes rendered through the `localFailureText` default before phase 2b; `retryable` is moved from the
+  // emitting sites in `cli/internal/client/gateway_installation_activation.go` and `activation.go:483`.
+  activation_state_commit_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500, true),
+  activation_response_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502, true),
+  activation_rejected: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502),
+  activation_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_binding: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_crypto: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_state_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  // Long-tail local codes rendered through the `localFailureText` default before phase 2b; sentences moved from that branch.
+  invalid_response: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  invalid_configuration: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_state_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  activation_code_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_code_file_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  activation_code_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 404),
+  bootstrap_file_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  bootstrap_not_active: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 409),
+  bootstrap_unauthorized: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  // The Gateway owner-bootstrap store file was never created, so the Gateway
+  // holds no owner bootstrap to exchange (`gateway/src/host/owner-bootstrap-http-composition.ts`
+  // `absent`, stored at `gateway/src/shared/installation/owner-bootstrap-store.ts:162`);
+  // the sentence is the owner-normalized form of that store error. Non-retryable:
+  // repeating the exchange cannot create the store; only an administrator
+  // placing a bootstrap (fresh gateway setup) changes the outcome.
+  [CEAL_OWNER_BOOTSTRAP_ABSENT_FAILURE_CODE]: guidance("The Gateway holds no owner bootstrap to exchange; report this as a gap.", "answer_with_gap", 503),
+  // The Gateway owner-bootstrap store file exists but cannot be read, so the
+  // exchange cannot proceed (`gateway/src/host/owner-bootstrap-http-composition.ts`
+  // `unavailable`, stored at `gateway/src/shared/installation/owner-bootstrap-store.ts:163`);
+  // the sentence is the owner-normalized form of that store error. Retryable:
+  // unlike `absent`, a later exchange may succeed once the store is readable.
+  [CEAL_OWNER_BOOTSTRAP_UNAVAILABLE_FAILURE_CODE]: guidance("The Gateway owner bootstrap store is unavailable; retry the exchange.", "retry", 503, true),
+  context_selection_ambiguous: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  session_authority_unverified: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  session_authority_mismatch: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 409),
+  local_credential_lost: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 401),
+  local_capability_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  host_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503),
+  host_activation_failed: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 500),
+  doctor_unavailable: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 503),
+  admin_sign_in_invalid: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 502),
+  // `invalid_request` renders through the client default today (local encode/path faults); Gateway-answered
+  // envelopes carry the Gateway message verbatim and never read this sentence.
+  invalid_request: guidance(LOCAL_TRANSPORT_INCOMPLETE, "answer_with_gap", 400),
+  // Gateway canonical-route codes, sentences moved from their minting adapters; statuses moved from the
+  // `valid*Failure` decoder maps in `cli/internal/client/gateway_api.go` and `transport.go`.
+  invalid_json: guidance("The Gateway request body must be valid JSON.", "answer_with_gap", 400),
+  // Per-route variants name their route; the table holds the one stable guidance and the route's `allow`
+  // header stays the measured fact (decided with the operator 2026-10-13).
+  method_not_allowed: guidance("The HTTP method is not allowed for this Gateway route.", "answer_with_gap", 405),
+  request_target_too_large: guidance("The Gateway request target exceeds its bounded limit.", "reduce_request_size", 414),
+  route_not_found: guidance("The Gateway route is not present.", "answer_with_gap", 404),
+  artifact_unavailable: guidance("The Gateway artifact is unavailable.", "answer_with_gap", 503),
+  discovery_unavailable: guidance("The Gateway discovery manifest is unavailable.", "answer_with_gap", 503),
+  serialization_failed: guidance("The Gateway response could not be serialized.", "answer_with_gap", 500),
+  request_header_too_large: guidance("A consumed Gateway request header exceeds its bounded limit.", "answer_with_gap", 431),
+  request_work_context_missing: guidance("The Gateway command requires a Request work context.", "answer_with_gap", 400),
+  request_work_context_invalid: guidance("The Gateway Request work context encoding is invalid.", "answer_with_gap", 400),
+  request_work_context_refused: guidance("The Host-only discovery manifest takes no Request work context.", "answer_with_gap", 400),
+  // Moved from `gateway/src/operations/http-composition.ts` (`unauthorized`) and `command-runtime.ts:827`
+  // (`artifact_stale`); both travel with Gateway messages verbatim online, so these sentences are the
+  // owner fallback guidance. `unauthorized` re-authenticates through the session, hence its action.
+  unauthorized: guidance("Unauthorized.", "repair_or_adopt_session", 401),
+  artifact_stale: guidance("The requested contract artifact is not the current catalog artifact.", "answer_with_gap", 409),
+  // Host mint classifications. The CLI emits `invocation_authentication_unavailable` with the classification
+  // in its detail fact; rows without their own sentence share that code's moved sentence, while `next_action`
+  // is moved from `canonicalHostAuthenticationNextActions` (generated from `CEAL_HOST_AUTHENTICATION_POLICY`)
+  // and `retryable` from `hostAuthenticationFailureForCause` (`failure.nextAction == "retry"`). The three rows
+  // with their own sentences carry the retired policy remedies as Gateway-owned guidance. Statuses are the
+  // Gateway-owned mapping decided with the operator 2026-10-13. This covers every wire cause the maps at
+  // `host/invocation-authentication-command.ts:217-242` emit, through their policy classifications.
+  host_arguments_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 400),
+  host_configuration_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500),
+  host_session_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 401),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // missing exact-turn fact names the fresh Host turn, not a reinstall.
+  host_context_unavailable: guidance("The Host has not activated an invocation context for this session yet. Wait for the Host turn hook to register the session, then retry this command.", "retry", 401, true),
+  host_invocation_context_stale: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 401, true),
+  host_invocation_context_expired: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 401, true),
+  host_source_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 403),
+  host_registration_credential_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "ask_admin", 403),
+  host_mint_gateway_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "ask_admin", 503),
+  host_mint_gateway_rate_limited: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 429),
+  host_mint_gateway_refused: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  host_mint_gateway_response_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // producer-frame fault names the administrator repair step.
+  host_producer_frame_invalid: guidance("Ask an administrator to inspect and repair the producer frame, then start a fresh Host turn.", "ask_admin", 400),
+  // Moved from the retired `CEAL_HOST_AUTHENTICATION_POLICY` remedy: the
+  // sandboxed Relay socket names the run-alone retry.
+  host_relay_permission_denied: guidance("An agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox.", "rerun_outside_agent_sandbox", 403),
+  host_relay_unavailable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 503),
+  host_mint_transient_retryable: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "retry", 503, true),
+  host_mint_failed: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500),
+  host_relay_failed: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 502),
+  host_refusal_invalid: guidance(HOST_AUTHENTICATION_UNAVAILABLE, "answer_with_gap", 500)
+});
+function cealFailureGuidanceForCode(code) {
+  const entry2 = CEAL_FAILURE_GUIDANCE_TABLE[code];
+  if (entry2 === void 0) throw new TypeError(`Failure guidance code is not guided: ${code}.`);
+  return entry2;
+}
+var FAILURE_GUIDANCE_ENTRY_KEYS = Object.freeze(["message", "next_action", "http_status", "retryable", "redaction_class"]);
 
-// packages/ceal-client-protocol/src/schema-literals.ts
-var CEAL_SCHEMA_LITERALS = [
-  "ceal.activation_transport.v1",
-  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
-  CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
-  "ceal.client_refresh_request.v1",
-  "ceal.client_refresh_result.v1",
-  "ceal.client_revoke_request.v1",
-  "ceal.client_revoke_result.v1",
-  CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
-  "ceal.device_enrollment_challenge.v1",
-  "ceal.device_enrollment_challenge_request.v1",
-  "ceal.device_enrollment_hpke_aad.v1",
-  "ceal.device_enrollment_hpke_info.v1",
-  "ceal.device_enrollment_poll.v1",
-  "ceal.device_enrollment_poll_result.v1",
-  "ceal.device_enrollment_proof.v1",
-  "ceal.device_enrollment_start.v1",
+// packages/ceal-client-protocol/src/client-wire-contract.ts
+var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
+var CEAL_CLIENT_DOCTOR_SCHEMA_VERSION = CEAL_CLIENT_WIRE_CONTRACT.doctor.schema_version;
+var clientCommands = CEAL_CLIENT_WIRE_CONTRACT.client_commands;
+var CEAL_CLIENT_DOCTOR_COMMAND = Object.freeze([...clientCommands.doctor]);
+var CEAL_CLIENT_VERSION_COMMAND = Object.freeze([...clientCommands.version]);
+var CEAL_CLIENT_ACCESS_GROUP_LIST_COMMAND = Object.freeze([...clientCommands.access_group_list]);
+function deriveCealClientWireSchemaVersion(schema) {
+  if (!/^ceal\.[a-z][a-z0-9_]*$/u.test(schema.schema_name) || !schema.fields.includes("schema_version") || new Set(schema.fields).size !== schema.fields.length || schema.fields.some((field) => typeof field !== "string" || !/^[a-z][a-z0-9_]*$/u.test(field))) {
+    throw new TypeError("Client wire schema name or field set is invalid.");
+  }
+  const fields = schema.fields.filter((field) => field !== "schema_version").sort();
+  const hash8 = createHash("sha256").update(cealCanonicalJson(fields), "utf8").digest("hex").slice(0, 8);
+  return `${schema.schema_name}.v1.${hash8}`;
+}
+var CealClientWireContractMismatchError = class extends Error {
+  code = "contract_mismatch";
+  next_action = cealFailureGuidanceForCode("contract_mismatch").next_action;
+  constructor(expected, actual) {
+    super(`The peer wire contract ${actual} does not match this client contract ${expected}.`);
+    this.name = "CealClientWireContractMismatchError";
+  }
+};
+function requireCealClientWireSchemaVersion(value, expected) {
+  if (typeof value === "string" && value !== expected) throw new CealClientWireContractMismatchError(expected, value);
+}
+var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
+var commandResolutionAuthority = commandResolution.authority;
+var commandResolutionSemanticOptions = commandResolution.semantic_options;
+var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(commandResolution);
+var CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES = CEAL_CLIENT_WIRE_CONTRACT.encoded_json_document.max_bytes;
+var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
+var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
+var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
+var CEAL_OPERATION_CONTRACT_BUNDLE_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: artifact.operation_contract_bundle_schema_name, fields: artifact.operation_contract_bundle_fields });
+var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(artifact);
+var CEAL_VERIFIED_ARTIFACT_BINDING_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: artifact.binding_schema_name, fields: artifact.binding_fields });
+var CEAL_VERIFIED_ARTIFACT_KIND = artifact.kind;
+var CEAL_VERIFIED_ARTIFACT_BINDING_KIND = artifact.binding_kind;
+var CEAL_VERIFIED_ARTIFACT_MEDIA_TYPE = artifact.media_type;
+var CEAL_VERIFIED_ARTIFACT_DIGEST_LENGTH = artifact.digest.length;
+var CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN = artifact.digest.pattern;
+var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_LENGTH = artifact.catalog_revision.length;
+var CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN = artifact.catalog_revision.pattern;
+var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
+var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
+var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(request);
+var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: response.discovery_manifest_schema_name, fields: response.discovery_manifest_fields });
+var CEAL_COMMAND_RESPONSE_SCHEMA_VERSION = deriveCealClientWireSchemaVersion(response);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
+var CEAL_COMMAND_RESPONSE_MAX_BYTES = CEAL_ENCODED_JSON_DOCUMENT_MAX_BYTES;
+var CEAL_RESOURCE_STREAM_REQUEST_SCHEMA_VERSION = deriveCealClientWireSchemaVersion({ schema_name: CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_schema_name, fields: CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_fields });
+var CEAL_RESOURCE_STREAM_REQUEST_FIELDS = Object.freeze([...CEAL_CLIENT_WIRE_CONTRACT.resource_stream.request_fields]);
+
+// packages/ceal-client-protocol/src/operation-withheld-cause.ts
+var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+
+// packages/ceal-client-protocol/src/operation-contract-types.ts
+var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+var CEAL_OPERATION_DESCRIPTOR_SCHEMA_VERSION = "ceal.operation_descriptor.v1";
+var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
+var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
+var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
+var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
+var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
+var SAFETY_CLASSES = vocabulary(["routine", "sensitive", "high_impact"]);
+var IDEMPOTENCY_CLASSES = vocabulary(["idempotent", "conditionally_idempotent", "non_idempotent"]);
+var REVERSIBILITY_CLASSES = vocabulary(["none", "reversible", "compensatable", "irreversible"]);
+var COMPENSATION_OWNERS = vocabulary(["none", "connector", "operator"]);
+var CANCELLATION_BOUNDARIES = vocabulary(["before_admission", "before_handoff", "after_handoff_reconcile"]);
+var HANDOFF_CLASSES = vocabulary(["not_applicable", "submission", "effect"]);
+var AUTHORITATIVE_READBACK_CLASSES = vocabulary(["required", "unavailable"]);
+var PROVIDER_READBACK_CLASSES = vocabulary(["required", "not_available", "not_applicable"]);
+var RECONCILIATION_CLASSES = vocabulary(["none", "automatic", "operator"]);
+var NO_READBACK_APPROVAL_CLASSES = vocabulary(["not_applicable", "explicit", "operator"]);
+var REPLAY_PREREQUISITES = vocabulary(["never", "fresh_admission", "reconciled_non_application", "operator_approval"]);
+var UNKNOWN_OUTCOMES = vocabulary(["reconcile", "operator_action", "excluded"]);
+var RECOVERY_OWNERS = vocabulary(["gateway", "connector", "operator"]);
+var CEAL_OPERATION_ADMISSION_STATES = vocabulary(["proposed", "refused", "admitted"]);
+var CEAL_OPERATION_EXECUTION_STATES = vocabulary(["not_started", "started", "completed"]);
+var CEAL_OPERATION_PROVIDER_HANDOFF_STATES = vocabulary(["not_offered", "offered", "accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_EFFECT_STATES = vocabulary(["none", "applied", "failed", "unknown", "compensated"]);
+var CEAL_OPERATION_OBSERVATION_STATES = vocabulary(["not_started", "not_required", "pending", "observed", "unavailable"]);
+var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate", "operator_action"]);
+var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
+var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
+var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
+var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
+var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
+  "approval_not_required_by_policy",
+  "interactive_pending",
+  "interactive_granted",
+  "interactive_denied",
+  "interactive_expired",
+  "interactive_unavailable"
+]);
+
+// packages/ceal-client-protocol/src/operation-access-class.ts
+var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
+
+// packages/ceal-client-protocol/src/domain-vocabulary.ts
+var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
+var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
+var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
+var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
+var CEAL_TARGET_REF_PATTERN = "^[^\\p{Cc}]+$";
+var TARGET_REF = new RegExp(CEAL_TARGET_REF_PATTERN, "u");
+var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
+var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "runtime"]);
+var CEAL_PERSISTED_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
+var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
+var CEAL_CALENDAR_PERIODS = vocabulary(["day", "week", "month"]);
+var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
+
+// packages/ceal-client-protocol/src/safe-json-budget.ts
+var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
+function safeJsonNodeBudgetForBytes(maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < SAFE_JSON_MIN_BYTES_PER_NODE) {
+    throw new RangeError(`safe-JSON byte cap is invalid: ${refusalFact("maxBytes", maxBytes, `at least ${SAFE_JSON_MIN_BYTES_PER_NODE} bytes`)}`);
+  }
+  return Math.floor(maxBytes / SAFE_JSON_MIN_BYTES_PER_NODE);
+}
+
+// packages/ceal-client-protocol/src/protocol-bounds.ts
+var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES = 64 * 1024;
+var CEAL_PROTOCOL_RESPONSE_VALUE_MAX_NODES = safeJsonNodeBudgetForBytes(CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES);
+var OPERATION_SCHEMA_LITERAL_MAX_BYTES = CEAL_PROTOCOL_RESPONSE_VALUE_MAX_BYTES / 4;
+var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
+  max_depth: 8,
+  max_properties: 96,
+  max_string_length: OPERATION_SCHEMA_LITERAL_MAX_BYTES / 4,
+  max_alternatives: 8,
+  max_enum_values: 64,
+  max_literal_bytes: OPERATION_SCHEMA_LITERAL_MAX_BYTES,
+  /** @basis our_policy -- bounds explanatory schema prose carried in one catalog. */
+  max_description_characters: 1024,
+  /** @basis our_policy -- bounds regular-expression compilation input from one schema. */
+  max_pattern_characters: 256,
+  /** @basis our_policy -- bounds traversal work inside one already byte-bounded schema literal. */
+  max_literal_nodes: 512
+});
+
+// packages/ceal-client-protocol/src/operation-json-schema.ts
+var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
+
+// packages/ceal-client-protocol/src/operation-contract-validation.ts
+var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
+var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
+var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
+var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
+
+// packages/ceal-client-protocol/src/operation-catalog.ts
+var CEAL_OPERATION_CATALOG_SCHEMA_VERSION = "ceal.catalog.v3";
+var CLIENT_AUDIENCES = Object.freeze(["ceal", "cealctl", "agent"]);
+var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
+
+// packages/ceal-client-protocol/src/schema-literals.ts
+var CEAL_SCHEMA_LITERALS = [
+  "ceal.activation_transport.v1",
+  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
+  CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
+  "ceal.client_refresh_request.v1",
+  "ceal.client_refresh_result.v1",
+  "ceal.client_revoke_request.v1",
+  "ceal.client_revoke_result.v1",
+  CEAL_COMMAND_REQUEST_SCHEMA_VERSION,
+  "ceal.device_enrollment_challenge.v1",
+  "ceal.device_enrollment_challenge_request.v1",
+  "ceal.device_enrollment_hpke_aad.v1",
+  "ceal.device_enrollment_hpke_info.v1",
+  "ceal.device_enrollment_poll.v1",
+  "ceal.device_enrollment_poll_result.v1",
+  "ceal.device_enrollment_proof.v1",
+  "ceal.device_enrollment_start.v1",
   "ceal.device_enrollment_start_result.v1",
   "ceal.effect_approval.v1",
   "ceal.effect_approval_confirmation.v1",
@@ -836,12 +1083,12 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.enrollment_result.v1",
   "ceal.first_activation_causal_join.v1",
   "ceal.gateway_announcement_policy.v1",
-  "ceal.gateway_audit_call_detail.v1",
+  CEAL_GATEWAY_AUDIT_CALL_DETAIL_SCHEMA_VERSION,
   "ceal.gateway_audit_event.v1",
   "ceal.gateway_audit_readback.v1",
   "ceal.gateway_authorization_snapshot.v1",
   "ceal.gateway_cache_origin.v1",
-  "ceal.gateway_call_result.v1",
+  CEAL_GATEWAY_CALL_RESULT_SCHEMA_VERSION,
   CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
   "ceal.gateway_connector_route_failure.v1",
   "ceal.gateway_discovery.v1",
@@ -866,7 +1113,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.host_observation.v1",
   "ceal.host_registration_request.v1",
   "ceal.host_registration_result.v1",
-  "ceal.operation_descriptor.v1",
+  CEAL_OPERATION_DESCRIPTOR_SCHEMA_VERSION,
   "ceal.operation_error.v1",
   "ceal.operation_failure.v1",
   "ceal.operation_failure.compact.v1",
@@ -975,10 +1222,20 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
 var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "block", "object"]);
 var CEAL_OPAQUE_REF_KINDS = vocabulary([...CEAL_OPAQUE_HANDLE_KINDS, "result", "operation-receipt", "reply-receipt", "field", "notion-data-source"]);
 
+// packages/ceal-client-protocol/src/client-environment-generated.ts
+var CEAL_CLIENT_CONTEXT_OVERRIDE_ENVIRONMENTS = Object.freeze(["CEAL_GATEWAY_ORIGIN", "CEAL_GATEWAY_TRANSPORT_ORIGIN", "CEAL_ACCESS_TOKEN", "CEAL_CONTEXT_STORE_PATH"]);
+
+// packages/ceal-client-protocol/src/client-process-contract.ts
+var CEAL_CLIENT_VERSION_SCHEMA_SUFFIX = ".version.v1";
+var CEAL_CLIENT_VERSION_SCHEMA_VERSION = `ceal${CEAL_CLIENT_VERSION_SCHEMA_SUFFIX}`;
+
 // packages/ceal-client-protocol/src/bare-document.ts
 var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
 var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
 
+// packages/ceal-client-protocol/src/actor-kind.ts
+var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
+
 // packages/ceal-client-protocol/src/resource-row.ts
 var CEAL_RESOURCE_ROW_TITLE_MATCH_DISPOSITIONS = vocabulary(["exact", "not_exact", "unknown"]);
 var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
@@ -993,6 +1250,8 @@ var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
   "resource_created",
   "review_submitted",
   "comment_created",
+  "reaction_created",
+  "ceal_write_completed",
   "event_start",
   "all_day_start",
   "file_created",
@@ -1027,6 +1286,10 @@ var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
   "github.review.submitted",
   "github.issue_comment.created",
   "github.review_comment.created",
+  "github.reaction.created",
+  "github.reaction.deleted",
+  "github.pull_request.review_requested",
+  "github.pull_request.review_request_removed",
   "calendar.organized",
   "calendar.accepted_invite",
   "calendar.recorded",
@@ -1048,6 +1311,10 @@ var CEAL_ACTIVITY_EVENT_TIMESTAMP_BASIS_MAP = Object.freeze({
   "github.pull_request.opened": "resource_created",
   "github.issue.edited": "resource_modified",
   "github.pull_request.edited": "resource_modified",
+  "github.reaction.created": "reaction_created",
+  "github.reaction.deleted": "ceal_write_completed",
+  "github.pull_request.review_requested": "ceal_write_completed",
+  "github.pull_request.review_request_removed": "ceal_write_completed",
   "calendar.organized": "resource_created",
   "drive.file.created": "file_created",
   "drive.file.modified": "file_modified_by_me",
@@ -1071,6 +1338,7 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   source_url: { required: false, timestamp: false },
   source: { required: true, timestamp: false },
   owner: { required: false, timestamp: false },
+  actor_kind: { required: false, timestamp: false },
   counterparts: { required: false, timestamp: false },
   attachments: { required: false, timestamp: false },
   created_at: { required: false, timestamp: true },
@@ -1078,9 +1346,18 @@ var RESOURCE_ROW_KEY_RULES = Object.freeze({
   modified_at: { required: false, timestamp: true },
   modified_at_local: { required: false, timestamp: true },
   viewed_by_me_at: { required: false, timestamp: true },
+  modified_by_me_at: { required: false, timestamp: true },
   own_ceal_write: { required: false, timestamp: false },
   owned_by_me: { required: false, timestamp: false },
+  mime_type: { required: false, timestamp: false },
+  size_bytes: { required: false, timestamp: false },
+  version: { required: false, timestamp: false },
+  trashed: { required: false, timestamp: false },
   visibility: { required: false, timestamp: false },
+  archived: { required: false, timestamp: false },
+  tag: { required: false, timestamp: false },
+  labels: { required: false, timestamp: false },
+  labels_incomplete: { required: false, timestamp: false },
   start: { required: false, timestamp: false },
   end: { required: false, timestamp: false },
   status: { required: false, timestamp: false },
@@ -1153,18 +1430,29 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
   // The serving gate answers this while the Gateway is still starting and the
   // refresh was never attempted; the same attempt stays retryable. It is never
   // stored by the session owner, only answered at the serving edge.
-  "gateway_starting"
+  CEAL_GATEWAY_STARTING_FAILURE_CODE
+]);
+var CEAL_CLIENT_REVOKE_FAILURE_CODES = vocabulary([
+  "refresh_invalid",
+  "refresh_expired",
+  "refresh_replayed",
+  "refresh_revoked"
 ]);
+var CEAL_PERSONAL_CLIENT_ACCESS_TOKEN_PREFIX = "ceal_personal_";
+var CEAL_PERSONAL_CLIENT_REFRESH_TOKEN_PREFIX = "ceal_refresh_";
+var PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN = "[A-Za-z0-9_-]{43}";
+var CEAL_PERSONAL_CLIENT_ACCESS_TOKEN = new RegExp(`^${CEAL_PERSONAL_CLIENT_ACCESS_TOKEN_PREFIX}${PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN}$`, "u");
+var CEAL_PERSONAL_CLIENT_REFRESH_TOKEN = new RegExp(`^${CEAL_PERSONAL_CLIENT_REFRESH_TOKEN_PREFIX}${PERSONAL_CLIENT_TOKEN_SUFFIX_PATTERN}$`, "u");
 
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 var DIGEST = /^[a-f0-9]{64}$/u;
 var CEAL_SHA256_DIGEST_PATTERN = DIGEST.source;
 function isCealDigest(value) {
   return typeof value === "string" && DIGEST.test(value);
 }
 function cealRequestSha256(value) {
-  return createHash("sha256").update(cealCanonicalJson(value), "utf8").digest("hex");
+  return createHash2("sha256").update(cealCanonicalJson(value), "utf8").digest("hex");
 }
 function operationRecord(value, message) {
   requireOperationRecord(value, message);
@@ -1180,40 +1468,71 @@ function requirePrefixedRef(value, prefix, message) {
 // packages/ceal-client-protocol/src/request-authority.ts
 var CEAL_REQUEST_SCHEMA_VERSION = "ceal.request.v1";
 var CEAL_REQUEST_ARTIFACT_OWNERS = vocabulary(["gateway", "host", "connector"]);
-var CEAL_REQUEST_HOST_BINDING_KEYS = vocabulary(["prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
+var CEAL_HOST_INVOCATION_IDENTITY_KEYS = vocabulary(["host_session_ref", "host_turn_ref", "host_source_ref"]);
 var CEAL_REQUEST_ARTIFACT_RETENTION_CLASSES = vocabulary(["request", "source", "result"]);
 var CANCELLATION_STATES = vocabulary(["requested", "cancelled"]);
-var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority", "prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
+var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority"]);
+var CEAL_REQUEST_COMMON_PROPERTIES = Object.freeze({
+  schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
+  ceal_request_ref: { type: "string", minLength: 1, maxLength: 128, pattern: "^ceal-request:[A-Za-z0-9][A-Za-z0-9._:-]{0,114}$" },
+  created_at: { type: "string", minLength: 1, maxLength: 64 },
+  authority: {
+    type: "object",
+    maxProperties: 5,
+    additionalProperties: false,
+    properties: {
+      instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+      authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+    },
+    required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+  }
+});
+var CEAL_REQUEST_HOST_PROPERTIES = Object.freeze({
+  prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+  host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+});
+var CEAL_REQUEST_CALLER_PROPERTIES = Object.freeze({
+  caller_call_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Gateway-minted call-group identity for a non-Host caller." },
+  caller_call_input_sha256: { type: "string", minLength: 64, maxLength: 64, pattern: "^[a-f0-9]{64}$", description: "Commitment to the exact input for active non-Host identity-reuse checks; a migrated legacy call group commits to its legacy group key because the original input may no longer exist." }
+});
+var CEAL_REQUEST_OPTIONAL_PROPERTIES = Object.freeze({
+  requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
+  device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session, including Host turns when the authenticated Host registration carries the device; absent for older records." }
+});
+var CEAL_REQUEST_HOST_REQUIRED_KEYS = Object.freeze([...CEAL_REQUEST_KEYS, ...CEAL_HOST_INVOCATION_IDENTITY_KEYS, "prompt_ref"]);
+var CEAL_REQUEST_CALLER_REQUIRED_KEYS = Object.freeze([...CEAL_REQUEST_KEYS, "caller_call_group_ref", "caller_call_input_sha256"]);
 var CEAL_REQUEST_JSON_SCHEMA = {
   type: "object",
-  maxProperties: 11,
+  description: "A Request has exactly one creation identity: the complete Host tuple and prompt reference, or a caller call-group identity. Caller Requests retain no prompt reference or prompt body.",
+  maxProperties: 13,
   additionalProperties: false,
   properties: {
-    schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
-    ceal_request_ref: { type: "string", minLength: 1, maxLength: 128, pattern: "^ceal-request:[A-Za-z0-9][A-Za-z0-9._:-]{0,114}$" },
-    created_at: { type: "string", minLength: 1, maxLength: 64 },
-    authority: {
+    ...CEAL_REQUEST_COMMON_PROPERTIES,
+    ...CEAL_REQUEST_HOST_PROPERTIES,
+    ...CEAL_REQUEST_CALLER_PROPERTIES,
+    ...CEAL_REQUEST_OPTIONAL_PROPERTIES
+  },
+  required: CEAL_REQUEST_KEYS,
+  anyOf: [
+    {
       type: "object",
-      maxProperties: 5,
-      additionalProperties: false,
-      properties: {
-        instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
-      },
-      required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+      required: CEAL_REQUEST_HOST_REQUIRED_KEYS,
+      properties: { ...CEAL_REQUEST_COMMON_PROPERTIES, ...CEAL_REQUEST_HOST_PROPERTIES, ...CEAL_REQUEST_OPTIONAL_PROPERTIES },
+      additionalProperties: false
     },
-    prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." },
-    device_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source, description: "Device that submitted this Request through its client session; absent for Host turns and older records." }
-  },
-  required: CEAL_REQUEST_KEYS
+    {
+      type: "object",
+      required: CEAL_REQUEST_CALLER_REQUIRED_KEYS,
+      properties: { ...CEAL_REQUEST_COMMON_PROPERTIES, ...CEAL_REQUEST_CALLER_PROPERTIES, ...CEAL_REQUEST_OPTIONAL_PROPERTIES },
+      additionalProperties: false
+    }
+  ]
 };
 
 // packages/ceal-client-protocol/src/request-operands.ts
@@ -1324,10 +1643,6 @@ var CEAL_REQUEST_RUN_BATCH_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-observation.ts
-var CEAL_HOST_INPUT_KINDS = vocabulary(["human", "host_automatic"]);
-function isCealHostInputKind(value) {
-  return typeof value === "string" && CEAL_HOST_INPUT_KINDS.some((kind) => kind === value);
-}
 var CEAL_HOST_OBSERVATION_REF_PREFIX = "host-observation:";
 var HOST_TOKEN_OBSERVATION_BREAKDOWN_KEYS = vocabulary(["cached_input", "cache_write_input", "reasoning_output"]);
 function validateCealHostObservationDraft(value) {
@@ -1338,7 +1653,7 @@ function validateCealHostObservationDraft(value) {
   assertHostObservationValue(record6.value, record6.observation_kind);
 }
 var CEAL_REQUEST_MAX_OBSERVATION_VALUE_BYTES = 64 * 1024;
-var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "model", "token", "cost", "timing"]);
+var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "model", "token", "timing"]);
 function isCealHostPromptObservationValue(value) {
   return isOperationRecord(value) && Object.keys(value).length === 1 && isCealDigest(value.body_sha256);
 }
@@ -1365,10 +1680,6 @@ function inspectHostKeys(value) {
 // packages/ceal-client-protocol/src/host-prompt-ref.ts
 var CEAL_HOST_PROMPT_DIGEST_PATTERN = "^[a-f0-9]{64}$";
 var PROMPT_DIGEST = new RegExp(CEAL_HOST_PROMPT_DIGEST_PATTERN, "u");
-function hostProducerPromptRef(promptSha256) {
-  if (!PROMPT_DIGEST.test(promptSha256)) throw new TypeError("Canonical Host prompt digest is invalid.");
-  return `ceal-host-prompt:${promptSha256}`;
-}
 
 // packages/ceal-client-protocol/src/request-effect-approval.ts
 var CEAL_EFFECT_APPROVAL_DECISION_CHECK_PHRASES = Object.freeze([
@@ -1461,18 +1772,115 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/host-invocation-authentication.ts
-var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = "ceal.host_invocation_authentication_result.v1";
+var hostInvocationAuthenticationContract = CEAL_CLIENT_WIRE_CONTRACT.host_invocation_authentication;
+var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA = deriveCealClientWireSchemaVersion({ schema_name: hostInvocationAuthenticationContract.request_schema_name, fields: hostInvocationAuthenticationContract.request_fields });
+var CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_FIELDS = Object.freeze([...hostInvocationAuthenticationContract.request_fields]);
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA = deriveCealClientWireSchemaVersion({ schema_name: hostInvocationAuthenticationContract.result_schema_name, fields: hostInvocationAuthenticationContract.result_fields });
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_FIELDS = Object.freeze([...hostInvocationAuthenticationContract.result_fields]);
+var CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN_SOURCE = "^(?:0|[1-9][0-9]{0,8})$";
+var CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN = new RegExp(CEAL_HOST_AUTHENTICATION_BUDGET_PATTERN_SOURCE, "u");
 var CEAL_HOST_INVOCATION_CONTEXT_PATH = "/api/ceal/v2/host-invocation-context";
-var CEAL_HOST_INGRESS_PATH = "/api/ceal/v2/host-ingress";
-var CEAL_HOST_NONCE_ENCODED_CHARACTERS = 43;
-var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(`^[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
-var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(`^ceal_context_[A-Za-z0-9_-]{${CEAL_HOST_NONCE_ENCODED_CHARACTERS}}$`, "u");
-var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = new TextEncoder().encode(`${JSON.stringify({
-  schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA,
-  context_token: `ceal_context_${"A".repeat(CEAL_HOST_NONCE_ENCODED_CHARACTERS)}`,
-  expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
-})}
+var CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA = "ceal.gateway_host_invocation_context_request.v2";
+var CEAL_HOST_INVOCATION_CONTEXT_REQUEST_MAX_BYTES = 16 * 1024;
+var CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES = 2 * 1024;
+var CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES = 32;
+var HOST_CONTEXT_EXPIRY_MAX_CHARS = 64;
+var CEAL_HOST_INVOCATION_CONTEXT_VISIBLE_OUTPUT_MAX_BYTES = CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
+var CEAL_HOST_CONTEXT_TOKEN_PREFIX = "ceal_context_";
+function decodeCealHostInvocationContextRequest(value) {
+  if (!isCealJsonRecord(value)) throw invalidInvocationContextRequest();
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA);
+  if (!hasInvocationContextRequestKeys(value)) throw invalidInvocationContextRequest();
+  const clientNonce = requireClientNonce(value.client_nonce);
+  const expiresAt = requireContextExpiration(value.context_expires_at);
+  const hostBinding = requireHostBinding(value.host_binding);
+  const messageWindow = requireHumanMessageWindow(value.human_message_window);
+  const lastRequestRef = optionalSafeReference(value.last_seen_request_ref);
+  const visibleOutputMaxBytes = optionalVisibleOutputBudget(value.visible_output_max_bytes);
+  return Object.freeze({
+    schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+    client_nonce: clientNonce,
+    context_expires_at: expiresAt,
+    host_binding: Object.freeze({ ...hostBinding }),
+    human_message_window: messageWindow,
+    ...lastRequestRef === void 0 ? {} : { last_seen_request_ref: lastRequestRef },
+    ...visibleOutputMaxBytes === void 0 ? {} : { visible_output_max_bytes: visibleOutputMaxBytes }
+  });
+}
+function hasInvocationContextRequestKeys(value) {
+  const required = ["schema_version", "client_nonce", "context_expires_at", "host_binding", "human_message_window"];
+  const optional = ["last_seen_request_ref", "visible_output_max_bytes"];
+  const optionalKeys = Object.keys(value).filter((key) => optional.includes(key));
+  return hasExactKeys(value, [...required, ...optionalKeys]) && required.every((key) => Object.hasOwn(value, key)) && value.schema_version === CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA;
+}
+function requireClientNonce(value) {
+  if (typeof value !== "string" || !CEAL_HOST_CLIENT_NONCE_PATTERN.test(value)) throw invalidInvocationContextRequest();
+  return value;
+}
+function requireContextExpiration(value) {
+  if (typeof value !== "string" || value.length > HOST_CONTEXT_EXPIRY_MAX_CHARS || !Number.isFinite(Date.parse(value))) throw invalidInvocationContextRequest();
+  return value;
+}
+function requireHostBinding(value) {
+  if (!isCealJsonRecord(value) || !exactOptionalKeys(value, ["host_source_ref", "host_session_ref", "host_turn_ref"], []) || !safeReference(value.host_source_ref) || !safeReference(value.host_session_ref) || !safeReference(value.host_turn_ref)) throw invalidInvocationContextRequest();
+  return { host_source_ref: value.host_source_ref, host_session_ref: value.host_session_ref, host_turn_ref: value.host_turn_ref };
+}
+function requireHumanMessageWindow(value) {
+  if (!isCealJsonRecord(value) || !exactOptionalKeys(value, ["messages", "truncated"], []) || !Array.isArray(value.messages) || value.messages.length > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_MESSAGES || typeof value.truncated !== "boolean") throw invalidInvocationContextRequest();
+  const messages = value.messages.map(decodeHumanMessage);
+  const bytes2 = new TextEncoder().encode(JSON.stringify(messages)).byteLength;
+  if (bytes2 > CEAL_HOST_INVOCATION_HUMAN_MESSAGE_WINDOW_MAX_BYTES) throw invalidInvocationContextRequest();
+  return Object.freeze({ messages: Object.freeze(messages), truncated: value.truncated });
+}
+function decodeHumanMessage(candidate) {
+  if (!isCealJsonRecord(candidate) || !exactOptionalKeys(candidate, ["host_turn_ref", "host_input_ref", "text"], []) || !safeReference(candidate.host_turn_ref) || !safeReference(candidate.host_input_ref) || typeof candidate.text !== "string") throw invalidInvocationContextRequest();
+  return Object.freeze({ host_turn_ref: candidate.host_turn_ref, host_input_ref: candidate.host_input_ref, text: candidate.text });
+}
+function optionalSafeReference(value) {
+  if (value === void 0) return void 0;
+  if (!safeReference(value)) throw invalidInvocationContextRequest();
+  return value;
+}
+function safeReference(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
+}
+function exactOptionalKeys(value, required, optional = []) {
+  const keys = Object.keys(value);
+  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
+}
+function optionalVisibleOutputBudget(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > CEAL_HOST_INVOCATION_CONTEXT_VISIBLE_OUTPUT_MAX_BYTES) throw invalidInvocationContextRequest();
+  return value;
+}
+function invalidInvocationContextRequest() {
+  return new TypeError("The Host invocation context request is invalid.");
+}
+function deriveCealHostInvocationNonceContract(contract = CEAL_CLIENT_WIRE_CONTRACT) {
+  const clientNonce = contract.host_invocation_authentication.client_nonce;
+  return {
+    encoded_characters: clientNonce.encoded_characters,
+    client_nonce_pattern_source: `^[${clientNonce.character_class_source}]{${clientNonce.encoded_characters}}$`,
+    context_token_pattern_source: `^${CEAL_HOST_CONTEXT_TOKEN_PREFIX}[${clientNonce.character_class_source}]{${clientNonce.encoded_characters}}$`
+  };
+}
+var hostNonceContract = deriveCealHostInvocationNonceContract();
+var CEAL_HOST_NONCE_ENCODED_CHARACTERS = hostNonceContract.encoded_characters;
+var CEAL_HOST_CLIENT_NONCE_PATTERN = new RegExp(hostNonceContract.client_nonce_pattern_source, "u");
+var CEAL_HOST_CONTEXT_TOKEN_PATTERN = new RegExp(hostNonceContract.context_token_pattern_source, "u");
+var CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_MAX_BYTES = deriveCealHostInvocationAuthenticationResultMaxBytes();
+function deriveCealHostInvocationAuthenticationResultMaxBytes(contract = CEAL_CLIENT_WIRE_CONTRACT) {
+  const hostAuthentication = contract.host_invocation_authentication;
+  const values = {
+    schema_version: deriveCealClientWireSchemaVersion({ schema_name: hostAuthentication.result_schema_name, fields: hostAuthentication.result_fields }),
+    context_token: `${CEAL_HOST_CONTEXT_TOKEN_PREFIX}${"A".repeat(hostAuthentication.client_nonce.encoded_characters)}`,
+    expires_at: (/* @__PURE__ */ new Date("+010000-01-01T00:00:00.000Z")).toISOString()
+  };
+  const fields = hostAuthentication.result_fields;
+  if (fields.some((field) => !Object.hasOwn(values, field))) throw new TypeError("Host invocation result fields have no bounded sample value.");
+  return new TextEncoder().encode(`${JSON.stringify(Object.fromEntries(fields.map((field) => [field, values[field]])))}
 `).byteLength;
+}
 var CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS = vocabulary([
   "request_authority_unavailable",
   "request_missing",
@@ -1496,6 +1904,7 @@ var CEAL_HOST_AUTHENTICATION_CAUSES = vocabulary([
   "host_credential_refused",
   "gateway_unavailable",
   "gateway_rate_limited",
+  "contract_mismatch",
   "gateway_refused",
   "gateway_response_invalid",
   "producer_frame_invalid",
@@ -1510,76 +1919,43 @@ var CEAL_HOST_AUTHENTICATION_POLICY = Object.freeze({
   invalid_arguments: Object.freeze({ classification: "host_arguments_invalid", next_action: "answer_with_gap" }),
   options_invalid: Object.freeze({ classification: "host_configuration_invalid", next_action: "answer_with_gap" }),
   session_unavailable: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
-  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "refresh_host_invocation_context", remedy: "the Host has no invocation context from the current transcript turn; send a new message to start a fresh Host turn, then retry this command on that turn (run `ceal-host install` only if the Host hook registration is missing or drifted)" }),
-  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
-  no_binding: Object.freeze({ classification: "host_binding_unavailable", next_action: "refresh_host_invocation_context" }),
-  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "refresh_host_invocation_context" }),
-  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "refresh_host_invocation_context" }),
+  context_unavailable: Object.freeze({ classification: "host_context_unavailable", next_action: "retry" }),
+  context_replaced: Object.freeze({ classification: "host_invocation_context_stale", next_action: "retry" }),
+  // `no_binding` now means the producer has no real current Host session. The
+  // Host Relay never uses it for an uncreated Gateway Request; there is no
+  // useful retry until the consumer is running inside a Host session.
+  no_binding: Object.freeze({ classification: "host_session_unavailable", next_action: "answer_with_gap" }),
+  context_stale: Object.freeze({ classification: "host_invocation_context_stale", next_action: "retry" }),
+  context_expired: Object.freeze({ classification: "host_invocation_context_expired", next_action: "retry" }),
   host_source_refused: Object.freeze({ classification: "host_source_refused", next_action: "answer_with_gap" }),
   host_credential_refused: Object.freeze({ classification: "host_registration_credential_refused", next_action: "ask_admin" }),
   gateway_unavailable: Object.freeze({ classification: "host_mint_gateway_unavailable", next_action: "ask_admin" }),
   gateway_rate_limited: Object.freeze({ classification: "host_mint_gateway_rate_limited", next_action: "answer_with_gap" }),
+  contract_mismatch: Object.freeze({ classification: "contract_mismatch", next_action: "upgrade_ceal_client" }),
   gateway_refused: Object.freeze({ classification: "host_mint_gateway_refused", next_action: "answer_with_gap" }),
   gateway_response_invalid: Object.freeze({ classification: "host_mint_gateway_response_invalid", next_action: "answer_with_gap" }),
-  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin", remedy: "ask an administrator to inspect and repair the producer frame, then start a fresh Host turn" }),
-  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox", remedy: "an agent sandbox denied the Host Relay socket; run `ceal` as the only command, with no pipe, redirect, or `&&`, so the Host allow rule runs it outside the sandbox" }),
+  producer_frame_invalid: Object.freeze({ classification: "host_producer_frame_invalid", next_action: "ask_admin" }),
+  relay_permission_denied: Object.freeze({ classification: "host_relay_permission_denied", next_action: "rerun_outside_agent_sandbox" }),
   relay_unavailable: Object.freeze({ classification: "host_relay_unavailable", next_action: "answer_with_gap" }),
   transient_retryable: Object.freeze({ classification: "host_mint_transient_retryable", next_action: "retry" }),
   mint_failed: Object.freeze({ classification: "host_mint_failed", next_action: "answer_with_gap" }),
   relay_failed: Object.freeze({ classification: "host_relay_failed", next_action: "answer_with_gap" }),
   host_refusal_invalid: Object.freeze({ classification: "host_refusal_invalid", next_action: "answer_with_gap" })
 });
-function projectCealHostAuthenticationCause(diagnostic) {
-  return projectRelayCodeCause(diagnostic) ?? projectGatewayCodeCause(diagnostic) ?? projectGatewayStatusCause(diagnostic) ?? "mint_failed";
-}
-function projectRelayCodeCause(diagnostic) {
-  switch (diagnostic.relayCode) {
-    case "credential":
-      return "host_credential_refused";
-    case "configuration":
-      return "options_invalid";
-    case "payload_rejected":
-      return "producer_frame_invalid";
-    case "invalid_response":
-      return "gateway_response_invalid";
-    case "gateway_refused":
-      return projectGatewayRefusedCause(diagnostic);
-    case "gateway_unavailable":
-      return diagnostic.exhausted === true ? void 0 : "gateway_unavailable";
-    case void 0:
-    case "":
-      return void 0;
-    default:
-      return "mint_failed";
-  }
-}
-function projectGatewayRefusedCause(diagnostic) {
-  if (diagnostic.gatewayStatus === 401 || diagnostic.gatewayStatus === 403) return "host_credential_refused";
-  const stale = projectGatewayCodeCause(diagnostic);
-  if (stale !== void 0) return stale;
-  if (diagnostic.exhausted === true && (diagnostic.gatewayStatus === 408 || diagnostic.gatewayStatus === 429)) return "gateway_rate_limited";
-  return "gateway_refused";
-}
-function projectGatewayCodeCause(diagnostic) {
-  if (diagnostic.gatewayCode === "request_context_refused" && diagnostic.gatewayReason !== void 0 && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, diagnostic.gatewayReason)) return "context_stale";
-  if (diagnostic.gatewayCode === "context_expired") return "context_expired";
-  if (diagnostic.gatewayCode === "host_source_refused") return "host_source_refused";
-  return void 0;
-}
-function projectGatewayStatusCause(diagnostic) {
-  if (diagnostic.gatewayStatus === 401 || diagnostic.gatewayStatus === 403) return "host_credential_refused";
-  if (diagnostic.exhausted === true && (diagnostic.gatewayStatus === 408 || diagnostic.gatewayStatus === 429)) return "gateway_rate_limited";
-  return void 0;
-}
 function decodeCealHostInvocationAuthenticationResult(value, now = /* @__PURE__ */ new Date()) {
-  if (!isCealJsonRecord(value) || !exactKeys(value, ["schema_version", "context_token", "expires_at"]) || value.schema_version !== CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
+  return decodeHostInvocationAuthenticationResult(value, CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_FIELDS, now);
+}
+function decodeHostInvocationAuthenticationResult(value, fields, now) {
+  if (!isCealJsonRecord(value)) throw new TypeError("The Host invocation authentication result is invalid.");
+  requireCealClientWireSchemaVersion(value.schema_version, CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA);
+  if (!exactKeys(value, fields) || typeof value.context_token !== "string" || !CEAL_HOST_CONTEXT_TOKEN_PATTERN.test(value.context_token) || typeof value.expires_at !== "string" || !validFutureTimestamp(value.expires_at, now)) {
     throw new TypeError("The Host invocation authentication result is invalid.");
   }
   return Object.freeze({ schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA, context_token: value.context_token, expires_at: value.expires_at });
 }
 function validFutureTimestamp(value, now) {
-  const timestamp3 = Date.parse(value);
-  return Number.isFinite(timestamp3) && new Date(timestamp3).toISOString() === value && timestamp3 > now.getTime();
+  const timestamp2 = Date.parse(value);
+  return Number.isFinite(timestamp2) && new Date(timestamp2).toISOString() === value && timestamp2 > now.getTime();
 }
 function exactKeys(value, expected) {
   const keys = Object.keys(value);
@@ -1587,16 +1963,11 @@ function exactKeys(value, expected) {
 }
 
 // packages/ceal-client-protocol/src/host-service-diagnostic.ts
-var CEAL_HOST_SERVICE_DIAGNOSTIC_SCHEMA = "ceal.host_service_diagnostic.v1";
 var CEAL_HOST_SERVICE_DIAGNOSTIC_PRODUCERS = vocabulary(["claude", "codex"]);
 var CEAL_HOST_SERVICE_DIAGNOSTIC_EVENTS = vocabulary([
   "hook_invoked",
   "registration_written",
   "hook_failed",
-  "watcher_turn_observed",
-  "current_prompt_registered",
-  "current_prompt_registration_failed",
-  "current_prompt_capacity_exhausted",
   "activation_recorded",
   "activation_failed",
   "watcher_scan_failed",
@@ -1619,6 +1990,9 @@ var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "un
 var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "path", "sha256"]);
 var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "items_path", "row_count", "result_complete", "coverage", "local_result_root", "model_disclosure", "continue_argv", "how_to_read"]);
 
+// packages/ceal-client-protocol/src/discovery-manifest.ts
+var DISCOVERY_MANIFEST_KEYS = CEAL_CLIENT_WIRE_CONTRACT.command_response.discovery_manifest_fields;
+
 // packages/ceal-client-protocol/src/gateway-cache-origin-validation.ts
 var CEAL_MAX_CACHE_ORIGIN_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 
@@ -1677,6 +2051,7 @@ var ADMIN_UNAVAILABLE_REASONS = vocabulary([
   "legacy",
   "invalid_observation",
   "redacted",
+  "organization_setting_disabled",
   "owner_unavailable",
   "unit_unknown",
   "retention_gap",
@@ -1706,15 +2081,13 @@ var ADMIN_APPROVAL_DISPOSITIONS = CEAL_OPERATION_APPROVAL_DISPOSITIONS;
 var ADMIN_APPROVAL_POSTURES = vocabulary([...ADMIN_APPROVAL_DISPOSITIONS, "not_applicable"]);
 var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "approval", "effect", "readback"]);
 
-// packages/ceal-client-protocol/src/actor-kind.ts
-var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
-
 // packages/ceal-client-protocol/src/device-enrollment.ts
 var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
 var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
 
 // packages/ceal-client-protocol/src/personal-client-session.ts
 var REFRESH_FAILURE_CODES = new Set(CEAL_REFRESH_FAILURE_CODES);
+var REVOKE_FAILURE_CODES = new Set(CEAL_CLIENT_REVOKE_FAILURE_CODES);
 
 // packages/ceal-client-protocol/src/index.ts
 var MAX_REQUEST_BYTES = 32 * 1024;
@@ -1750,19 +2123,175 @@ function errorCode(error) {
 }
 
 // host/service-log.ts
-import { copyFile, open, stat, truncate } from "node:fs/promises";
-import { isAbsolute } from "node:path";
-var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
-function writeHostServiceDiagnostic(producer_id, event, failure_kind, cause, sink) {
-  const line = `${JSON.stringify({ schema_version: CEAL_HOST_SERVICE_DIAGNOSTIC_SCHEMA, producer_id, event, ...event === "watcher_scan_failed" && failure_kind !== void 0 ? { failure_kind } : {}, ...event === "watcher_scan_failed" && cause !== void 0 ? { cause } : {} })}
-`;
+import { copyFile, mkdir, stat, truncate, appendFile } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute, posix, win32 as win322 } from "node:path";
+
+// host/secure-file.ts
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { dirname, win32 } from "node:path";
+import { fileURLToPath } from "node:url";
+var SecureFileCustodyError = class extends Error {
+  name = "SecureFileCustodyError";
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+  get code() {
+    if (this.reason === "reparse_point") return "ELOOP";
+    if (this.reason === "not_found") return "ENOENT";
+    if (this.reason === "too_large") return "secure_file_too_large";
+    if (this.reason === "already_exists") return "EEXIST";
+    return this.reason === "not_private" ? "secure_file_not_private" : "secure_file_unavailable";
+  }
+};
+var WINDOWS_SECUREFS_REFUSAL_SCHEMA = "ceal.host_securefs_refusal.v1";
+var WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES = 4096;
+var WINDOWS_SECUREFS_TIMEOUT_MS = 1e4;
+var WINDOWS_SECUREFS_DIAGNOSTIC_BYTES = 4096;
+function secureOpenFlags(flags, platform) {
+  if (platform === "win32") return flags;
+  const nofollow = constants.O_NOFOLLOW;
+  if (typeof nofollow === "number" && nofollow !== 0) return flags | nofollow;
+  throw new Error("Secure file reads require O_NOFOLLOW on this platform.");
+}
+async function openNoFollow(path, flags = constants.O_RDONLY, mode, platform = process.platform, _custody = {}) {
+  if (platform !== "win32") return await open(path, secureOpenFlags(flags, platform), mode);
+  return await openWindowsIdentityScreened(path, flags, mode);
+}
+async function openWindowsIdentityScreened(path, flags, mode) {
+  const handle = await open(path, flags, mode);
+  try {
+    const first = await handle.stat();
+    if (!first.isFile()) throw new SecureFileCustodyError("not_private", "The Windows Host file is not a regular file.");
+    await assertWindowsLinkFree(path, first);
+    await assertWindowsIdentityStable(handle, first, path);
+    return handle;
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+async function assertWindowsLinkFree(path, first) {
+  const entry2 = await lstat(path);
+  if (entry2.isSymbolicLink() || entry2.dev !== first.dev || entry2.ino !== first.ino) {
+    throw new SecureFileCustodyError("reparse_point", "The Windows Host file path resolves through a reparse point.");
+  }
+}
+async function assertWindowsIdentityStable(handle, first, path) {
+  const second = await handle.stat();
+  if (second.dev !== first.dev || second.ino !== first.ino || second.size !== first.size || second.mtimeMs !== first.mtimeMs) {
+    throw new SecureFileCustodyError("unavailable", "The Windows Host file changed while its identity was checked.");
+  }
+  const entry2 = await lstat(path);
+  if (entry2.isSymbolicLink()) throw new SecureFileCustodyError("reparse_point", "The Windows Host file path resolves through a reparse point.");
+  if (entry2.dev !== second.dev || entry2.ino !== second.ino) throw new SecureFileCustodyError("unavailable", "The Windows Host file path no longer names the opened file.");
+}
+async function readPrivateFileWithSecurefs(path, maxBytes, custody = {}) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) throw new TypeError("The securefs read bound must be a positive safe integer.");
+  const result2 = await runWindowsSecurefs(["internal", "securefs", "read-private-file", path, String(maxBytes)], maxBytes, custody);
+  if (result2.exit_code === 0 && result2.stderr.length === 0 && result2.stdout.length <= maxBytes) return result2.stdout;
+  if (result2.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned bytes with a refusal.");
+  if (result2.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command exceeded its output contract.");
+  throw securefsRefusal(result2.stderr);
+}
+async function createRandomPrivateFileWithSecurefs(path, byteLength2, custody = {}) {
+  if (!Number.isSafeInteger(byteLength2) || byteLength2 < 1 || byteLength2 > WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES) throw new TypeError(`The securefs random-file size must be between 1 and ${WINDOWS_SECUREFS_MAX_RANDOM_FILE_BYTES} bytes.`);
+  const result2 = await runWindowsSecurefs(["internal", "securefs", "create-random-private-file", path, String(byteLength2)], 0, custody);
+  if (result2.exit_code === 0 && result2.stdout.length === 0 && result2.stderr.length === 0) return;
+  if (result2.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned unexpected creation bytes.");
+  if (result2.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an invalid creation result.");
+  throw securefsRefusal(result2.stderr);
+}
+async function isPrivateWindowsDirectory(path, custody = {}) {
+  await lstat(path);
+  try {
+    const result2 = await runWindowsSecurefs(["internal", "securefs", "verify-private-dir", path], 0, custody);
+    if (result2.exit_code === 0 && result2.stdout.length === 0 && result2.stderr.length === 0) return true;
+    if (result2.stdout.length !== 0) throw new SecureFileCustodyError("unavailable", "The Windows Host directory proof returned unexpected bytes.");
+    if (result2.exit_code === 0) throw new SecureFileCustodyError("unavailable", "The Windows Host directory proof returned an invalid result.");
+    const refusal = securefsRefusal(result2.stderr);
+    if (refusal.reason === "not_private" || refusal.reason === "reparse_point") return false;
+    throw refusal;
+  } catch (error) {
+    if (error instanceof SecureFileCustodyError) throw error;
+    throw new SecureFileCustodyError("unavailable", "The Windows Host directory custody proof is unavailable.");
+  }
+}
+async function runWindowsSecurefs(args, maxBytes, custody) {
+  if (custody.run_securefs_command !== void 0) return await custody.run_securefs_command(args);
+  const executable = custody.securefs_executable ?? resolveInstalledHostExecutable();
+  const processArgs = [...custody.securefs_args_prefix ?? [], ...args];
+  return await new Promise((resolve, reject) => {
+    execFile(executable, processArgs, { encoding: "buffer", timeout: WINDOWS_SECUREFS_TIMEOUT_MS, maxBuffer: maxBytes + WINDOWS_SECUREFS_DIAGNOSTIC_BYTES }, (error, stdout, stderr) => {
+      const exitCode = error === null ? 0 : typeof error.code === "number" ? error.code : null;
+      if (exitCode === null) {
+        reject(new SecureFileCustodyError("unavailable", "The installed Windows Host securefs command could not run."));
+        return;
+      }
+      resolve({ exit_code: exitCode, stdout: Buffer.from(stdout), stderr: Buffer.from(stderr) });
+    });
+  });
+}
+function securefsRefusal(stderr) {
+  let value;
   try {
-    (sink ?? defaultHostServiceDiagnosticSink)(line);
+    value = JSON.parse(stderr.toString("utf8"));
   } catch {
+    return new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an unreadable refusal.");
   }
+  if (!isRecord(value) || value.schema_version !== WINDOWS_SECUREFS_REFUSAL_SCHEMA || typeof value.code !== "string") return new SecureFileCustodyError("unavailable", "The Windows Host securefs command returned an unreadable refusal.");
+  if (value.code === "reparse_point") return new SecureFileCustodyError("reparse_point", "The Windows Host securefs file is a reparse point.");
+  if (value.code === "not_found") return new SecureFileCustodyError("not_found", "The Windows Host securefs file was not found.");
+  if (value.code === "too_large") return new SecureFileCustodyError("too_large", "The Windows Host securefs file exceeds its read bound.");
+  if (value.code === "already_exists") return new SecureFileCustodyError("already_exists", "The Windows Host securefs target already exists.");
+  if (value.code === "not_private") return new SecureFileCustodyError("not_private", "The Windows Host securefs file is not private to the current user.");
+  return new SecureFileCustodyError("unavailable", "The Windows Host securefs command refused the file read.");
+}
+function resolveInstalledHostExecutable() {
+  const privateRuntimeRoot = dirname(fileURLToPath(import.meta.url));
+  return win32.join(privateRuntimeRoot, "..", "..", "bin", "ceal-host.exe");
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isOwnedBy(uid, expectedUid) {
+  return Number.isSafeInteger(uid) && Number.isSafeInteger(expectedUid) && uid === expectedUid;
+}
+function isSelfOwned(uid, platform = process.platform, _handle) {
+  if (platform === "win32" || typeof process.geteuid !== "function") return false;
+  return isOwnedBy(uid, process.geteuid());
+}
+function isPrivateFileMode(mode, platform = process.platform, _handle) {
+  if (platform === "win32") return false;
+  return (mode & 63) === 0;
 }
-function defaultHostServiceDiagnosticSink(line) {
-  process.stderr.write(line);
+async function isPrivateDirectory(path, platform = process.platform, custody = {}) {
+  if (platform === "win32") return await isPrivateWindowsDirectory(path, custody);
+  const entry2 = await lstat(path);
+  return entry2.isDirectory() && !entry2.isSymbolicLink() && isSelfOwned(entry2.uid, platform) && isPrivateFileMode(entry2.mode, platform);
+}
+
+// host/service-log.ts
+var HOST_SERVICE_LOG_ENVIRONMENT = "CEAL_HOST_SERVICE_LOG";
+var HOST_SERVICE_LOG_ARGUMENT = "--ceal-host-service-log";
+var HostServiceLogArgumentError = class extends Error {
+  constructor() {
+    super("The Host service log argument must occur once with an absolute normalized path.");
+    this.name = "HostServiceLogArgumentError";
+  }
+};
+function consumeHostServiceLogArgument(args, platform = process.platform) {
+  const indexes = args.flatMap((value, index2) => value === HOST_SERVICE_LOG_ARGUMENT ? [index2] : []);
+  if (indexes.length === 0) return { args: [...args] };
+  const index = indexes[0];
+  if (index === void 0) throw new HostServiceLogArgumentError();
+  const path = args[index + 1];
+  const pathApi = platform === "win32" ? win322 : posix;
+  if (indexes.length !== 1 || path === void 0 || !pathApi.isAbsolute(path) || pathApi.normalize(path) !== path) throw new HostServiceLogArgumentError();
+  return { args: [...args.slice(0, index), ...args.slice(index + 2)], path };
 }
 var HOST_SERVICE_LOG_MAX_BYTES = 1024 * 1024;
 var HOST_SERVICE_LOG_CHECK_INTERVAL_MS = 6e4;
@@ -1786,8 +2315,9 @@ function boundHostServiceLog(environment = process.env) {
   const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
   if (path === void 0 || !isAbsolute(path)) return () => void 0;
   let reported = false;
+  const ready = ensureHostServiceLogDirectory(path);
   const check = () => {
-    rotateHostServiceLog(path).catch((error) => {
+    ready.then(() => rotateHostServiceLog(path)).catch((error) => {
       if (reported) return;
       reported = true;
       process.stderr.write(`[host-service-log] rotation_failed code=${errorCode2(error)}
@@ -1799,8 +2329,31 @@ function boundHostServiceLog(environment = process.env) {
   timer.unref();
   return () => clearInterval(timer);
 }
-var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
-function isNotFound(error) {
+function writeHostServiceLogLine(line, environment = process.env) {
+  if (process.platform !== "win32") return;
+  const path = environment[HOST_SERVICE_LOG_ENVIRONMENT];
+  if (path === void 0 || !win322.isAbsolute(path) || win322.normalize(path) !== path) return;
+  void appendHostServiceLogLine(path, line).catch(() => void 0);
+}
+async function appendHostServiceLogLine(path, line) {
+  if (!isAbsolute(path)) return;
+  await ensureHostServiceLogDirectory(path);
+  await appendFile(path, line);
+}
+var HOST_SERVICE_LOG_TAIL_BYTES = 64 * 1024;
+var hostServiceLogDirectories = /* @__PURE__ */ new Map();
+function ensureHostServiceLogDirectory(path) {
+  const directory = dirname2(path);
+  const existing = hostServiceLogDirectories.get(directory);
+  if (existing !== void 0) return existing;
+  const pending = mkdir(directory, { recursive: true, mode: 448 }).then(() => void 0).catch((error) => {
+    hostServiceLogDirectories.delete(directory);
+    throw error;
+  });
+  hostServiceLogDirectories.set(directory, pending);
+  return pending;
+}
+function isNotFound(error) {
   return errorCode2(error) === "ENOENT";
 }
 function errorCode2(error) {
@@ -1808,13 +2361,13 @@ function errorCode2(error) {
 }
 
 // host/runtime-source-paths.ts
-import { createHash as createHash2 } from "node:crypto";
-import { posix as posix2, win32 as win322 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { posix as posix3, win32 as win324 } from "node:path";
 
 // host/absolute-path.ts
-import { posix, win32 } from "node:path";
+import { posix as posix2, win32 as win323 } from "node:path";
 function isAbsoluteNormalizedNonRootPath(value, flavor = process.platform, allowRoot = false) {
-  const pathApi = flavor === "win32" || flavor === "windows" ? win32 : posix;
+  const pathApi = flavor === "win32" || flavor === "windows" ? win323 : posix2;
   return typeof value === "string" && value.length <= 4096 && !value.includes("\0") && pathApi.isAbsolute(value) && pathApi.normalize(value) === value && (allowRoot || pathApi.parse(value).root !== value);
 }
 
@@ -1826,28 +2379,22 @@ function hostSourceUuid(sourceRef) {
 function hostRuntimeSourcePaths(stateRoot, sourceRef, platform = process.platform) {
   const sourceId = hostSourceUuid(sourceRef);
   if (!isAbsoluteNormalizedNonRootPath(stateRoot, platform) || sourceId === null) throw new TypeError("Host runtime source identity is invalid.");
-  const path = platform === "win32" ? win322 : posix2;
+  const path = platform === "win32" ? win324 : posix3;
   const sourcesRoot = path.join(stateRoot, "sources");
   const sourceRoot = path.join(sourcesRoot, sourceId);
   const runtimeRoot = path.join(stateRoot, "run");
-  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash2("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
-  assertHostRuntimeIpcLength(endpoint, platform);
+  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash3("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
   return { sourceId, sourcesRoot, sourceRoot, relayRoot: path.join(sourceRoot, "relay"), codexOutbox: path.join(sourceRoot, "producers", "codex", "outbox"), claudeOutbox: path.join(sourceRoot, "producers", "claude", "outbox"), endpoint, runtimeRoot };
 }
-function assertHostRuntimeIpcLength(endpoint, platform) {
-  if (platform === "win32") return;
-  const maximum = platform === "linux" ? 107 : 103;
-  if (Buffer.byteLength(endpoint, "utf8") > maximum) throw Object.assign(new TypeError(`ipc_endpoint_too_long: Host IPC path exceeds ${maximum} bytes; use a shorter Host state root.`), { code: "ipc_endpoint_too_long" });
-}
 function assertHostRelaySourcePaths(stateRoot, config, platform = process.platform) {
   const paths = hostRuntimeSourcePaths(stateRoot, config.host_source_ref, platform);
-  if (config.state_root !== paths.relayRoot || config.ipc_endpoint !== paths.endpoint) throw new TypeError("Host Relay state and IPC must belong to its configured source.");
+  if (config.state_root !== paths.relayRoot || platform !== "win32" && config.ipc_endpoint !== paths.endpoint) throw new TypeError("Host Relay state and IPC must belong to its configured source.");
+  return paths.endpoint;
 }
 
 // host/relay/src/host-relay-runtime.ts
-import { O_NOFOLLOW as O_NOFOLLOW3, O_RDONLY as O_RDONLY4 } from "node:constants";
-import { lstat as lstat4, open as open5 } from "node:fs/promises";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { constants as constants4 } from "node:fs";
+import { dirname as dirname7, join as join6 } from "node:path";
 
 // host/abortable-wait.ts
 function waitForAbort(signal, milliseconds) {
@@ -1933,13 +2480,13 @@ function skipWhitespace(text, start) {
 }
 
 // host/relay/src/producer-frame.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var HOST_PRODUCER_FRAME_SCHEMA = "ceal.host_producer_frame.v1";
 var HOST_PRODUCER_MAX_JSON_BYTES = 262144;
 var HOST_PRODUCER_FRAME_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
 var SAFE_REF2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var PRODUCERS = /* @__PURE__ */ new Set(["codex", "claude"]);
-var HOST_PRODUCER_FRAME_KINDS = ["session_started", "turn_started", "user_input", "turn_terminal", "producer_status"];
+var HOST_PRODUCER_FRAME_KINDS = ["session_started", "turn_started", "turn_terminal", "producer_status"];
 var FRAME_KINDS = new Set(HOST_PRODUCER_FRAME_KINDS);
 function isHostProducerFrameKind(value) {
   return typeof value === "string" && FRAME_KINDS.has(value);
@@ -1991,58 +2538,15 @@ function decodeHostProducerFrame(input) {
   return value;
 }
 function hostProducerFrameHash(frame) {
-  return createHash3("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
-}
-function extractHostBindingSelector(frame) {
-  if (frame.frame_kind !== "user_input") return null;
-  if (!PRODUCERS.has(frame.producer_id) || !safeRef(frame.producer_installation_ref)) return null;
-  const payload = frame.payload;
-  if (!safeRef(payload.local_session_ref) || !safeRef(payload.local_turn_ref)) return null;
-  const aliases = payload.local_turn_aliases;
-  if (aliases === void 0) {
-    return Object.freeze({
-      producer_id: frame.producer_id,
-      producer_installation_ref: frame.producer_installation_ref,
-      local_session_ref: payload.local_session_ref,
-      local_turn_ref: payload.local_turn_ref,
-      local_turn_aliases: Object.freeze([])
-    });
-  }
-  if (!Array.isArray(aliases) || aliases.length > 16 || !aliases.every(safeRef) || new Set(aliases).size !== aliases.length) return null;
-  return Object.freeze({
-    producer_id: frame.producer_id,
-    producer_installation_ref: frame.producer_installation_ref,
-    local_session_ref: payload.local_session_ref,
-    local_turn_ref: payload.local_turn_ref,
-    local_turn_aliases: Object.freeze([...aliases])
-  });
-}
-function hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef) {
-  if (!opaqueHostSourceRef(hostSourceRef)) throw new TypeError("Gateway host source reference is invalid.");
-  const host_session_ref = localSessionRef === void 0 ? void 0 : `ceal-host-session:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, local_session_ref: localSessionRef })}`;
-  const host_turn_ref = host_session_ref === void 0 || localTurnRef === void 0 ? void 0 : `ceal-host-turn:${cealRequestSha256({ host_session_ref, local_turn_ref: localTurnRef })}`;
-  const host_input_ref = host_turn_ref === void 0 || localInputRef === void 0 ? void 0 : `ceal-host-input:${cealRequestSha256({ host_turn_ref, local_input_ref: localInputRef })}`;
-  const submission_ref = `ceal-host-frame:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, sequence: frame.sequence })}`;
-  return { host_session_ref: host_session_ref ?? "", ...host_turn_ref === void 0 ? {} : { host_turn_ref }, ...host_input_ref === void 0 ? {} : { host_input_ref }, submission_ref };
-}
-function hostProducerSessionRef(hostSourceRef, frame, localSessionRef) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef).host_session_ref);
-}
-function hostProducerTurnRef(hostSourceRef, frame, localSessionRef, localTurnRef) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef).host_turn_ref);
-}
-function hostProducerInputRef(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame, localSessionRef, localTurnRef, localInputRef).host_input_ref);
+  return createHash4("sha256").update(JSON.stringify(frame), "utf8").digest("hex");
 }
 function hostProducerSubmissionRef(hostSourceRef, frame) {
-  return requiredIdentity(hostProducerIdentityRefs(hostSourceRef, frame).submission_ref);
+  if (!opaqueHostSourceRef(hostSourceRef)) throw new TypeError("Gateway host source reference is invalid.");
+  return `ceal-host-frame:${cealRequestSha256({ host_source_ref: hostSourceRef, producer_id: frame.producer_id, producer_installation_ref: frame.producer_installation_ref, sequence: frame.sequence })}`;
 }
 function opaqueHostSourceRef(value) {
   return typeof value === "string" && SAFE_REF2.test(value) && !value.startsWith("ceal-host-source:");
 }
-function isHostSafeRef(value) {
-  return safeRef(value);
-}
 var BOUNDED_REFUSAL_WORD = /^[a-z][a-z0-9_]{0,63}$/u;
 function isBoundedRefusalWord(value) {
   return typeof value === "string" && BOUNDED_REFUSAL_WORD.test(value);
@@ -2059,16 +2563,13 @@ var HOST_RELAY_GATEWAY_ERROR_CODES = [
   "gateway_unavailable",
   "gateway_refused",
   "invalid_response",
+  "contract_mismatch",
   "payload_rejected"
 ];
 function isRelayGatewayErrorCode(value) {
   return isVocabularyWord(HOST_RELAY_GATEWAY_ERROR_CODES, value);
 }
 var RELAY_DELIVERY_DIAGNOSTIC_KEYS = ["relayCode", "gatewayStatus", "gatewayCode", "gatewayReason", "exhausted"];
-function requiredIdentity(value) {
-  if (value === void 0) throw new TypeError("Canonical Host identity is incomplete.");
-  return value;
-}
 function validateFrame(value) {
   if (!record(value)) throw new HostProducerFrameError("invalid_frame_shape");
   if (value.schema_version !== HOST_PRODUCER_FRAME_SCHEMA) throw new HostProducerFrameError("unsupported_frame_schema", `unsupported_frame_schema: ${refusalFact("schema_version", value.schema_version, HOST_PRODUCER_FRAME_SCHEMA)}`);
@@ -2078,7 +2579,7 @@ function validateFrame(value) {
   validatePayload(value.frame_kind, value.payload);
 }
 function validatePayload(kind, value) {
-  const valid = kind === "session_started" ? validSession(value) : kind === "turn_started" ? validTurn(value) : kind === "user_input" ? validInput(value) : kind === "turn_terminal" ? validTerminal(value) : validStatus(value);
+  const valid = kind === "session_started" ? validSession(value) : kind === "turn_started" ? validTurn(value) : kind === "turn_terminal" ? validTerminal(value) : validStatus(value);
   if (!valid) throw new HostProducerFrameError("invalid_frame_shape");
 }
 function validSession(value) {
@@ -2087,15 +2588,6 @@ function validSession(value) {
 function validTurn(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref"], ["model", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && optionalText(value.model, 256) && validObservations(value.observations);
 }
-function validInput(value) {
-  return exactOptional(value, ["local_session_ref", "local_turn_ref", "local_input_ref", "input_kind", "origin_input", "observations"], ["local_turn_aliases", "context_expires_at"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && safeRef(value.local_input_ref) && validInputObservations(value.observations) && isCealHostInputKind(value.input_kind) && typeof value.origin_input === "boolean" && validInputOptionals(value);
-}
-function validInputObservations(value) {
-  return validObservations(value) && Array.isArray(value) && value.filter((item) => record(item) && item.observation_kind === "prompt").length === 1;
-}
-function validInputOptionals(value) {
-  return optionalRefs(value.local_turn_aliases) && (value.context_expires_at === void 0 || timestamp(value.context_expires_at));
-}
 function validTerminal(value) {
   return exactOptional(value, ["local_session_ref", "local_turn_ref", "terminal_state"], ["abort_reason", "duration_ms", "time_to_first_token_ms", "usage", "observations"]) && safeRef(value.local_session_ref) && safeRef(value.local_turn_ref) && validTerminalDisposition(value.terminal_state, value.abort_reason) && optionalNonNegative(value.duration_ms) && optionalNonNegative(value.time_to_first_token_ms) && (value.usage === void 0 || jsonValue(value.usage)) && validObservations(value.observations);
 }
@@ -2111,9 +2603,6 @@ function optionalText(value, maxLength) {
 function optionalNonNegative(value) {
   return value === void 0 || typeof value === "number" && Number.isFinite(value) && value >= 0;
 }
-function optionalRefs(value) {
-  return value === void 0 || Array.isArray(value) && value.length <= 16 && value.every(safeRef);
-}
 function validObservations(value) {
   if (value === void 0) return true;
   if (!Array.isArray(value) || value.length > 32) return false;
@@ -2158,27 +2647,78 @@ function exactOptional(value, required, optional) {
 
 // host/relay/src/relay-admission-store.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
+
+// host/relay/src/durable-atomic-replacement.ts
+import { lstat as lstat2, mkdir as mkdir2, open as open2, rename, unlink } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+
+// host/windows-rename-retry.ts
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+var RETRY_WINDOW_MS = 1e4;
+var RETRY_START_DELAY_MS = 100;
+var RETRY_MAX_DELAY_MS = 2e3;
+var RETRYABLE_CODES = /* @__PURE__ */ new Set(["EBUSY", "EPERM", "EACCES"]);
+var WindowsRenameRetryError = class extends Error {
+  code = "rename_unavailable";
+  constructor(target, attempts, options = {}) {
+    super(`Windows did not permit renaming into place within the bounded retry window: ${target} (after ${attempts} attempts). Wait for the process holding the path to release it, then rerun the same install or update command.`, options);
+    this.name = "WindowsRenameRetryError";
+  }
+};
+function resolveRetrySchedule(tuning) {
+  return {
+    windowMs: tuning.windowMs ?? RETRY_WINDOW_MS,
+    startDelayMs: tuning.startDelayMs ?? RETRY_START_DELAY_MS,
+    maxDelayMs: tuning.maxDelayMs ?? RETRY_MAX_DELAY_MS,
+    sleep: tuning.sleep ?? ((ms) => setTimeout2(ms)),
+    now: tuning.now ?? (() => Date.now())
+  };
+}
+async function renameWithWindowsRetry(operation, tuning) {
+  const schedule = resolveRetrySchedule(tuning);
+  const deadline = schedule.now() + schedule.windowMs;
+  let delayMs = schedule.startDelayMs;
+  let attempts = 0;
+  for (; ; ) {
+    attempts += 1;
+    try {
+      await operation();
+      return;
+    } catch (error) {
+      if (tuning.platform !== "win32" || !isRetryableRenameError(error)) throw error;
+      await sleepWithinWindow(schedule, deadline, delayMs, () => new WindowsRenameRetryError(tuning.target, attempts, { cause: error }));
+      delayMs = Math.min(delayMs * 2, schedule.maxDelayMs);
+    }
+  }
+}
+async function sleepWithinWindow(schedule, deadline, delayMs, exhausted) {
+  if (schedule.now() >= deadline) throw exhausted();
+  await schedule.sleep(Math.min(delayMs, deadline - schedule.now()));
+  if (schedule.now() >= deadline) throw exhausted();
+}
+function isRetryableRenameError(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && RETRYABLE_CODES.has(error.code);
+}
 
 // host/relay/src/durable-atomic-replacement.ts
-import { O_RDONLY } from "node:constants";
-import { lstat, mkdir, open as open2, rename, unlink } from "node:fs/promises";
-import { dirname } from "node:path";
 var DEFAULT_PORT = {
   platform: process.platform,
-  mkdir: (path, options) => mkdir(path, options),
-  lstat: (path) => lstat(path),
+  mkdir: (path, options) => mkdir2(path, options),
+  lstat: (path) => lstat2(path),
   open_file: (path) => open2(path, "wx", 384),
   rename,
   unlink,
-  open_directory: (path) => open2(path, O_RDONLY),
+  open_directory: (path) => open2(path),
   unique_ref: () => `${process.pid}.${crypto.randomUUID()}`
 };
 async function durableAtomicReplace(target, data, port = DEFAULT_PORT) {
-  const parent = dirname(target);
+  const parent = dirname3(target);
   await port.mkdir(parent, { recursive: true, mode: 448 });
   const parentStats = await port.lstat(parent);
-  if (!parentStats.isDirectory() || parentStats.isSymbolicLink() || !ownerPrivate(parentStats, port.platform)) throw new TypeError(`Host Relay durable-state directory is unsafe: ${refusalFacts([{ name: "parent_stats", value: parentStats, expected: "an owner-private directory" }, { name: "platform", value: port.platform }])}.`);
+  const expectedUid = typeof process.geteuid === "function" ? process.geteuid() : parentStats.uid;
+  const ownerPrivate = port.platform === "win32" || isOwnedBy(parentStats.uid, expectedUid) && isPrivateFileMode(parentStats.mode, port.platform);
+  if (!parentStats.isDirectory() || parentStats.isSymbolicLink() || !ownerPrivate) throw new TypeError(`Host Relay durable-state directory is unsafe: ${refusalFacts([{ name: "parent_stats", value: parentStats, expected: "an owner-private directory" }, { name: "platform", value: port.platform }])}.`);
   const temporary = `${target}.${port.unique_ref()}.new`;
   let staged;
   const failures = [];
@@ -2189,7 +2729,7 @@ async function durableAtomicReplace(target, data, port = DEFAULT_PORT) {
     const closing = staged;
     staged = void 0;
     await closing.close();
-    await port.rename(temporary, target);
+    await renameWithWindowsRetry(() => port.rename(temporary, target), { ...port.rename_retry, platform: port.platform, target });
     await syncParentDirectory(parent, port);
   } catch (error) {
     failures.push(error);
@@ -2215,11 +2755,6 @@ async function syncParentDirectory(path, port) {
   }
   if (failure !== void 0) throw failure;
 }
-function ownerPrivate(stats, platform) {
-  if (platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
-}
 async function closeStaged(staged, failures) {
   if (staged !== void 0) try {
     await staged.close();
@@ -2245,249 +2780,10 @@ function errorCode3(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
 
-// host/relay/src/relay-request-binding-store.ts
-import { O_NOFOLLOW, O_RDONLY as O_RDONLY2 } from "node:constants";
-import { open as open3 } from "node:fs/promises";
-import { join as join2 } from "node:path";
-var HOST_RELAY_REQUEST_BINDING_SCHEMA = "ceal.host_relay_request_binding.v1";
-var STATE_SCHEMA = "ceal.host_relay_request_binding_state.v1";
-var SAFE_REF3 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-var MAX_BINDINGS = 8192;
-var MAX_STATE_BYTES = 8 * 1024 * 1024;
-var HostRelayBindingError = class extends TypeError {
-  name = "HostRelayBindingError";
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-};
-var RelayRequestBindingStore = class {
-  tail = Promise.resolve();
-  bindingWaiters = /* @__PURE__ */ new Set();
-  root;
-  constructor(root) {
-    if (typeof root !== "string" || root.length === 0) throw new TypeError("Host Relay binding root is invalid.");
-    this.root = root;
-  }
-  bind(input, now = /* @__PURE__ */ new Date()) {
-    const run = this.tail.then(() => this.bindLocked(input, now));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  query(input) {
-    const run = this.tail.then(() => this.queryLocked(input));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  waitForBinding(input, signal) {
-    validateQuery(input);
-    if (signal.aborted) return Promise.reject(new Error("Host Relay binding wait cancelled."));
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const finish = (result2, error) => {
-        if (settled) return;
-        settled = true;
-        this.bindingWaiters.delete(waiter);
-        signal.removeEventListener("abort", waiter.abort);
-        if (error !== void 0) reject(error);
-        else if (result2?.status === "ready") resolve(result2);
-      };
-      const abort = () => finish(void 0, new Error("Host Relay binding wait cancelled."));
-      const waiter = { query: input, resolve: (result2) => finish(result2), abort };
-      this.bindingWaiters.add(waiter);
-      signal.addEventListener("abort", abort, { once: true });
-      void this.query(input).then((result2) => {
-        if (result2.status === "ready") finish(result2);
-      }, (error) => finish(void 0, error));
-    });
-  }
-  async bindLocked(input, now) {
-    const candidate = bindingFromGateway(input, now);
-    const state = await this.read();
-    const existing = state.bindings.find((item) => sameCanonicalIdentity(item, candidate));
-    if (existing !== void 0) {
-      if (!sameBinding(existing, candidate)) throw new HostRelayBindingError("canonical_turn_rebound", `Host Relay canonical turn is already bound to another Request: ${refusalFacts([{ name: "candidate_request_ref", value: candidate.request_ref, expected: existing.request_ref }, { name: "candidate_prompt_ref", value: candidate.prompt_ref, expected: existing.prompt_ref }, { name: "candidate_context_expires_at", value: candidate.context_expires_at, expected: String(existing.context_expires_at) }, { name: "candidate_local_turn_aliases", value: candidate.local_turn_aliases, expected: JSON.stringify(existing.local_turn_aliases) }])}.`);
-      return existing;
-    }
-    if (state.bindings.length >= MAX_BINDINGS) throw new HostRelayBindingError("binding_capacity_exhausted", `Host Relay request binding capacity is exhausted: ${refusalFact("binding_count", state.bindings.length, `below ${MAX_BINDINGS}`)}.`);
-    const next = { schema_version: STATE_SCHEMA, bindings: [...state.bindings, candidate] };
-    await this.write(next);
-    this.resolveBindingWaiters(candidate);
-    return structuredClone(candidate);
-  }
-  resolveBindingWaiters(binding) {
-    for (const waiter of this.bindingWaiters) {
-      if (relayRequestBindingMatchesQuery(waiter.query, binding)) waiter.resolve({ status: "ready", binding: structuredClone(binding) });
-    }
-  }
-  async queryLocked(input) {
-    validateQuery(input);
-    const state = await this.read();
-    const matches = state.bindings.filter((binding2) => relayRequestBindingMatchesQuery(input, binding2));
-    if (matches.length === 0) return { status: "no_binding" };
-    const binding = matches[0];
-    if (binding === void 0) throw new TypeError("Host Relay binding query result is invalid.");
-    return { status: "ready", binding: structuredClone(binding) };
-  }
-  async read() {
-    let handle;
-    try {
-      handle = await open3(join2(this.root, "request-bindings.json"), O_RDONLY2 | O_NOFOLLOW);
-      const stats = await handle.stat();
-      if (!stats.isFile() || !ownerPrivate2(stats)) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFacts([{ name: "state_is_file", value: stats.isFile(), expected: "true" }, { name: "state_uid", value: stats.uid, expected: String(process.geteuid?.() ?? stats.uid) }, { name: "state_mode", value: (stats.mode & 511).toString(8), expected: "no group or other permission bits" }])}.`);
-      if (stats.size > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is unsafe: ${refusalFact("state_bytes", stats.size, `at most ${MAX_STATE_BYTES}`)}.`);
-      return decodeState(JSON.parse(await handle.readFile("utf8")));
-    } catch (error) {
-      if (errorCode4(error) === "ENOENT") return { schema_version: STATE_SCHEMA, bindings: [] };
-      throw error;
-    } finally {
-      await handle?.close();
-    }
-  }
-  async write(state) {
-    const encoded = JSON.stringify(state);
-    if (Buffer.byteLength(encoded, "utf8") > MAX_STATE_BYTES) throw new TypeError(`Host Relay binding state is too large: ${refusalFact("state_bytes", Buffer.byteLength(encoded, "utf8"), `at most ${MAX_STATE_BYTES}`)}.`);
-    await durableAtomicReplace(join2(this.root, "request-bindings.json"), encoded);
-  }
-};
-function relayRequestWorkContextFromBinding(binding) {
-  return createRelayRequestWorkContext({ request_ref: binding.request_ref, host_binding: {
-    host_source_ref: binding.host_source_ref,
-    host_session_ref: binding.host_session_ref,
-    host_turn_ref: binding.host_turn_ref,
-    host_input_ref: binding.host_input_ref,
-    prompt_ref: binding.prompt_ref
-  } });
-}
-function createRelayRequestWorkContext(input) {
-  if (!record2(input) || !exactKeys3(input, ["request_ref", "host_binding"]) || !safeRef2(input.request_ref) || !record2(input.host_binding)) {
-    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
-  }
-  const hostBinding = input.host_binding;
-  if (!exactKeys3(hostBinding, ["host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref", "prompt_ref"]) || ![hostBinding.host_source_ref, hostBinding.host_session_ref, hostBinding.host_turn_ref, hostBinding.host_input_ref, hostBinding.prompt_ref].every(safeRef2)) {
-    throw new HostRelayBindingError("context_identity_missing", "Host Relay work context does not contain the complete acknowledged Host tuple.");
-  }
-  const hostSourceRef = requiredRef(hostBinding.host_source_ref);
-  const hostSessionRef = requiredRef(hostBinding.host_session_ref);
-  const hostTurnRef = requiredRef(hostBinding.host_turn_ref);
-  const hostInputRef = requiredRef(hostBinding.host_input_ref);
-  const promptRef = requiredRef(hostBinding.prompt_ref);
-  return Object.freeze({ request_ref: input.request_ref, host_binding: Object.freeze({
-    host_source_ref: hostSourceRef,
-    host_session_ref: hostSessionRef,
-    host_turn_ref: hostTurnRef,
-    host_input_ref: hostInputRef,
-    prompt_ref: promptRef
-  }) });
-}
-function bindingFromGateway(input, now) {
-  const payload = input.frame.payload;
-  const candidate = {
-    schema_version: HOST_RELAY_REQUEST_BINDING_SCHEMA,
-    producer_id: input.frame.producer_id,
-    producer_installation_ref: input.frame.producer_installation_ref,
-    local_session_ref: requiredRef(payload.local_session_ref),
-    local_turn_ref: requiredRef(payload.local_turn_ref),
-    local_turn_aliases: optionalRefs2(payload.local_turn_aliases),
-    prompt_ref: requiredRef(input.prompt_ref),
-    request_ref: requiredRef(input.request_ref),
-    bound_at: timestamp2(now.toISOString()),
-    ...payload.context_expires_at === void 0 ? {} : { context_expires_at: timestamp2(payload.context_expires_at) },
-    host_source_ref: requiredRef(input.host_binding.host_source_ref),
-    host_session_ref: requiredRef(input.host_binding.host_session_ref),
-    host_turn_ref: requiredRef(input.host_binding.host_turn_ref),
-    host_input_ref: requiredRef(input.host_binding.host_input_ref)
-  };
-  if (input.host_binding.prompt_ref !== input.prompt_ref) throw new HostRelayBindingError("context_identity_mismatch", "Host Relay binding prompt reference does not match the acknowledged submission.");
-  validateBinding(candidate);
-  return candidate;
-}
-function decodeState(value) {
-  if (!record2(value) || !exactKeys3(value, ["schema_version", "bindings"])) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("state_keys", record2(value) ? Object.keys(value) : [], "exactly schema_version and bindings")}.`);
-  if (value.schema_version !== STATE_SCHEMA) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("schema_version", value.schema_version, STATE_SCHEMA)}.`);
-  if (!Array.isArray(value.bindings)) throw new TypeError(`Host Relay binding state is invalid: ${refusalFact("bindings", value.bindings, "an array")}.`);
-  const bindings = value.bindings.map((item) => {
-    validateBinding(item);
-    return item;
-  });
-  const keys = bindings.map(bindingKey);
-  if (new Set(keys).size !== keys.length) throw new TypeError("Host Relay binding state contains duplicate canonical turns.");
-  return { schema_version: STATE_SCHEMA, bindings };
-}
-function validateBinding(value) {
-  if (!record2(value) || !exactOptionalKeys(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "prompt_ref", "request_ref", "bound_at", "host_source_ref", "host_session_ref", "host_turn_ref", "host_input_ref"], ["context_expires_at"]) || !validBindingIdentity(value) || !validBindingRequest(value)) throw new TypeError("Host Relay request binding is invalid.");
-}
-function validBindingIdentity(value) {
-  return value.schema_version === HOST_RELAY_REQUEST_BINDING_SCHEMA && producer(value.producer_id) && [value.producer_installation_ref, value.local_session_ref, value.local_turn_ref].every(safeRef2) && refList(value.local_turn_aliases);
-}
-function validBindingRequest(value) {
-  const tuple = [value.host_source_ref, value.host_session_ref, value.host_turn_ref, value.host_input_ref];
-  return safeRef2(value.prompt_ref) && safeRef2(value.request_ref) && validTimestamp(value.bound_at) && (value.context_expires_at === void 0 || validTimestamp(value.context_expires_at)) && tuple.every(safeRef2);
-}
-function validateQuery(value) {
-  if (!record2(value) || !exactKeys3(value, ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]) || !producer(value.producer_id) || !safeRef2(value.producer_installation_ref) || !safeRef2(value.local_session_ref) || !safeRef2(value.local_turn_ref)) throw new TypeError("Host Relay binding query is invalid.");
-}
-function relayRequestBindingMatchesQuery(query, binding) {
-  return query.producer_id === binding.producer_id && query.local_session_ref === binding.local_session_ref && (query.local_turn_ref === binding.local_turn_ref || binding.local_turn_aliases.includes(query.local_turn_ref)) && query.producer_installation_ref === binding.producer_installation_ref;
-}
-function sameCanonicalIdentity(left, right) {
-  return bindingKey(left) === bindingKey(right);
-}
-function sameBinding(left, right) {
-  return left.request_ref === right.request_ref && left.prompt_ref === right.prompt_ref && left.context_expires_at === right.context_expires_at && left.host_source_ref === right.host_source_ref && left.host_session_ref === right.host_session_ref && left.host_turn_ref === right.host_turn_ref && left.host_input_ref === right.host_input_ref && JSON.stringify(left.local_turn_aliases) === JSON.stringify(right.local_turn_aliases);
-}
-function bindingKey(value) {
-  return `${value.producer_id}\0${value.producer_installation_ref}\0${value.local_session_ref}\0${value.local_turn_ref}`;
-}
-function requiredRef(value) {
-  if (!safeRef2(value)) throw new TypeError("Host Relay binding reference is invalid.");
-  return value;
-}
-function optionalRefs2(value) {
-  if (value === void 0) return [];
-  if (!refList(value)) throw new TypeError("Host Relay binding aliases are invalid.");
-  return [...value];
-}
-function timestamp2(value) {
-  if (!validTimestamp(value)) throw new TypeError("Host Relay binding timestamp is invalid.");
-  return value;
-}
-function producer(value) {
-  return value === "codex" || value === "claude";
-}
-function safeRef2(value) {
-  return typeof value === "string" && SAFE_REF3.test(value);
-}
-function refList(value) {
-  return Array.isArray(value) && value.length <= 16 && value.every(safeRef2) && new Set(value).size === value.length;
-}
-function validTimestamp(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
-function record2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function exactKeys3(value, keys) {
-  return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
-}
-function exactOptionalKeys(value, required, optional) {
-  const keys = Object.keys(value);
-  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
-}
-function errorCode4(error) {
-  return record2(error) && typeof error.code === "string" ? error.code : null;
-}
-function ownerPrivate2(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
-}
-
 // host/relay/src/relay-quarantine-store.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { join as join2 } from "node:path";
 var RELAY_QUARANTINE_SCHEMA = "ceal.host_relay_quarantine_state.v1";
 var RELAY_QUARANTINE_MAX_RECORDS = 512;
 var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
@@ -2507,8 +2803,8 @@ var RelayQuarantineStore = class {
     if (!Number.isSafeInteger(this.maxRecords) || this.maxRecords < 1 || this.maxRecords > RELAY_QUARANTINE_MAX_RECORDS) throw new TypeError(`Relay quarantine record cap is invalid: ${refusalFact("max_records", this.maxRecords, `between 1 and ${RELAY_QUARANTINE_MAX_RECORDS}`)}.`);
     if (!Number.isSafeInteger(this.maxBytes) || this.maxBytes < 1 || this.maxBytes > RELAY_QUARANTINE_MAX_BYTES) throw new TypeError(`Relay quarantine byte cap is invalid: ${refusalFact("max_bytes", this.maxBytes, `between 1 and ${RELAY_QUARANTINE_MAX_BYTES}`)}.`);
   }
-  async retainFrame(frame, reason, attribution, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-    await this.retain(encodeHostProducerFrame(frame), frame.producer_id, reason, capturedAt, attribution);
+  async retainFrame(frame, reason, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+    await this.retain(encodeHostProducerFrame(frame), frame.producer_id, reason, capturedAt);
   }
   async retainMalformed(rawFrame, reason, capturedAt = (/* @__PURE__ */ new Date()).toISOString()) {
     await this.retain(rawFrame, inferProducer(rawFrame), reason, capturedAt);
@@ -2520,53 +2816,37 @@ var RelayQuarantineStore = class {
     const records = state.producers[producerId].slice(-Math.min(limit, this.maxRecords)).map((record6) => structuredClone(record6));
     return { producer_id: producerId, records, total_bytes: records.reduce((total, record6) => total + record6.charged_bytes, 0) };
   }
-  /**
-   * The newest quarantined record whose exact-turn attribution matches the
-   * query, or null when evicted, unattributed, or for another turn. The
-   * file-backed state survives drain, restart, and overwrite.
-   */
-  async findNewestAttributedMatch(query) {
-    await this.tail;
-    const state = await this.readState();
-    const bucket = query.producer_id === "codex" || query.producer_id === "claude" ? state.producers[query.producer_id] : [];
-    for (let index = bucket.length - 1; index >= 0; index -= 1) {
-      const record6 = bucket[index];
-      if (record6 !== void 0 && attributedRecordMatchesQuery(record6, query)) return structuredClone(record6);
-    }
-    return null;
-  }
   async snapshot() {
     await this.tail;
     return this.readState();
   }
-  async retain(rawFrame, producerId, reason, capturedAt, attribution) {
+  async retain(rawFrame, producerId, reason, capturedAt) {
     const run = this.tail.then(async () => {
       if (!PRODUCERS2.includes(producerId) || !Number.isFinite(Date.parse(capturedAt))) throw new TypeError("Relay quarantine record identity is invalid.");
       const raw = Buffer.from(rawFrame).subarray(0, MAX_CAPTURE_BYTES);
       const state = await this.readState();
       const record6 = {
-        quarantine_ref: `quarantine:${createHash4("sha256").update(`${producerId}\0${reason}\0${capturedAt}\0`).update(raw).digest("hex")}`,
+        quarantine_ref: `quarantine:${createHash5("sha256").update(`${producerId}\0${reason}\0${capturedAt}\0`).update(raw).digest("hex")}`,
         producer_id: producerId,
         reason,
         captured_at: capturedAt,
-        frame_sha256: createHash4("sha256").update(raw).digest("hex"),
+        frame_sha256: createHash5("sha256").update(raw).digest("hex"),
         charged_bytes: raw.byteLength,
-        raw_frame_base64: raw.toString("base64"),
-        ...attribution === void 0 ? {} : { attribution: structuredClone(attribution) }
+        raw_frame_base64: raw.toString("base64")
       };
       const records = state.producers[producerId];
       records.push(record6);
       while (records.length > this.maxRecords || totalBytes(records) > this.maxBytes) records.shift();
-      await durableAtomicReplace(join3(this.root, "quarantine.json"), JSON.stringify(state));
+      await durableAtomicReplace(join2(this.root, "quarantine.json"), JSON.stringify(state));
     });
     this.tail = run.then(() => void 0, () => void 0);
     await run;
   }
   async readState() {
     try {
-      return decodeState2(JSON.parse(await readFile(join3(this.root, "quarantine.json"), "utf8")));
+      return decodeState(JSON.parse(await readFile(join2(this.root, "quarantine.json"), "utf8")));
     } catch (error) {
-      if (errorCode5(error) === "ENOENT") return emptyState();
+      if (errorCode4(error) === "ENOENT") return emptyState();
       throw error;
     }
   }
@@ -2577,9 +2857,9 @@ function emptyState() {
 function totalBytes(records) {
   return records.reduce((total, record6) => total + record6.charged_bytes, 0);
 }
-function decodeState2(value) {
-  if (!record3(value) || value.schema_version !== RELAY_QUARANTINE_SCHEMA) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("schema_version", record3(value) ? value.schema_version : void 0, RELAY_QUARANTINE_SCHEMA)}.`);
-  if (!record3(value.producers)) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("producer_ids", record3(value.producers) ? Object.keys(value.producers) : [], `the ${PRODUCERS2.length} quarantine producer buckets`)}.`);
+function decodeState(value) {
+  if (!record2(value) || value.schema_version !== RELAY_QUARANTINE_SCHEMA) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("schema_version", record2(value) ? value.schema_version : void 0, RELAY_QUARANTINE_SCHEMA)}.`);
+  if (!record2(value.producers)) throw new TypeError(`Host Relay quarantine state is invalid: ${refusalFact("producer_ids", record2(value.producers) ? Object.keys(value.producers) : [], `the ${PRODUCERS2.length} quarantine producer buckets`)}.`);
   const state = emptyState();
   for (const producerId of PRODUCERS2) {
     const records = value.producers[producerId];
@@ -2589,8 +2869,7 @@ function decodeState2(value) {
   return state;
 }
 function validRecord(value) {
-  if (!record3(value) || !validRecordIdentity(value)) return false;
-  return value.attribution === void 0 || validAttribution(value.attribution);
+  return record2(value) && validRecordIdentity(value);
 }
 function validRecordIdentity(value) {
   return typeof value.quarantine_ref === "string" && quarantineProducer(value.producer_id) && validReason(value.reason) && Number.isFinite(Date.parse(String(value.captured_at))) && typeof value.frame_sha256 === "string" && typeof value.raw_frame_base64 === "string" && validChargedBytes(value.charged_bytes);
@@ -2601,52 +2880,22 @@ function validReason(value) {
 function validChargedBytes(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
 }
-var ATTRIBUTION_REQUIRED_KEYS = ["producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "local_turn_aliases", "sequence", "frame_sha256"];
-var ATTRIBUTION_OPTIONAL_KEYS = ["diagnostic"];
-function validAttribution(value) {
-  if (!record3(value) || !hasExactKeys2(value, ATTRIBUTION_REQUIRED_KEYS, ATTRIBUTION_OPTIONAL_KEYS)) return false;
-  return validAttributionIdentity(value) && validAttributionAliases(value.local_turn_aliases) && validAttributionEnvelope(value) && (value.diagnostic === void 0 || validAttributionDiagnostic(value.diagnostic));
-}
-function validAttributionIdentity(value) {
-  return (value.producer_id === "codex" || value.producer_id === "claude") && isHostSafeRef(value.producer_installation_ref) && isHostSafeRef(value.local_session_ref) && isHostSafeRef(value.local_turn_ref);
-}
-function validAttributionAliases(value) {
-  return Array.isArray(value) && value.length <= 16 && value.every(isHostSafeRef);
-}
-function validAttributionEnvelope(value) {
-  return typeof value.sequence === "number" && Number.isSafeInteger(value.sequence) && value.sequence > 0 && typeof value.frame_sha256 === "string";
-}
-function validAttributionDiagnostic(value) {
-  if (!record3(value) || !hasExactKeys2(value, [], RELAY_DELIVERY_DIAGNOSTIC_KEYS)) return false;
-  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean);
-}
-function isSafeInteger(value) {
-  return Number.isSafeInteger(value);
-}
-function isBoolean(value) {
-  return typeof value === "boolean";
-}
-function attributedRecordMatchesQuery(recordValue, query) {
-  const attribution = recordValue.attribution;
-  if (attribution === void 0) return false;
-  return attribution.producer_id === query.producer_id && attribution.producer_installation_ref === query.producer_installation_ref && attribution.local_session_ref === query.local_session_ref && (attribution.local_turn_ref === query.local_turn_ref || attribution.local_turn_aliases.includes(query.local_turn_ref));
-}
 function quarantineProducer(value) {
   return value === "codex" || value === "claude" || value === "unknown";
 }
 function inferProducer(rawFrame) {
   try {
     const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(rawFrame).subarray(4)));
-    return record3(value) && (value.producer_id === "codex" || value.producer_id === "claude") ? value.producer_id : "unknown";
+    return record2(value) && (value.producer_id === "codex" || value.producer_id === "claude") ? value.producer_id : "unknown";
   } catch {
     return "unknown";
   }
 }
-function record3(value) {
+function record2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function errorCode5(error) {
-  return record3(error) && typeof error.code === "string" ? error.code : null;
+function errorCode4(error) {
+  return record2(error) && typeof error.code === "string" ? error.code : null;
 }
 
 // host/relay/src/relay-admission-store.ts
@@ -2656,12 +2905,11 @@ var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
 var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
 var RelayAdmissionStore = class {
   tail = Promise.resolve();
-  drainWaiters = /* @__PURE__ */ new Set();
   root;
   quarantine;
   limits;
   faultHooks;
-  constructor(root, limits = DEFAULT_LIMITS, faultHooks = {}, quarantine = new RelayQuarantineStore(join4(root, "quarantine"))) {
+  constructor(root, limits = DEFAULT_LIMITS, faultHooks = {}, quarantine = new RelayQuarantineStore(join3(root, "quarantine"))) {
     this.root = root;
     this.quarantine = quarantine;
     this.limits = limits;
@@ -2676,36 +2924,10 @@ var RelayAdmissionStore = class {
     await this.tail;
     return this.read();
   }
-  async hasPendingRequestBinding(query) {
-    const state = await this.read();
-    return state.entries.some((entry2) => pendingFrameMatchesBindingQuery(entry2, query));
-  }
   async drainRound(deliver, options) {
     const run = this.tail.then(() => this.drainLocked(deliver, options));
     this.tail = run.then(() => void 0, () => void 0);
-    const result2 = await run;
-    if (result2.delivered.length > 0 || result2.refused.length > 0 || result2.retained.length > 0) this.resolveDrainWaiters();
-    return result2;
-  }
-  waitForDrainChange(signal) {
-    if (signal.aborted) return Promise.reject(new Error("Host Relay admission wait cancelled."));
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const finish = (error) => {
-        if (settled) return;
-        settled = true;
-        this.drainWaiters.delete(waiter);
-        signal.removeEventListener("abort", waiter.abort);
-        if (error !== void 0) reject(error);
-        else resolve();
-      };
-      const waiter = { resolve: () => finish(), abort: () => finish(new Error("Host Relay admission wait cancelled.")) };
-      this.drainWaiters.add(waiter);
-      signal.addEventListener("abort", waiter.abort, { once: true });
-    });
-  }
-  resolveDrainWaiters() {
-    for (const waiter of this.drainWaiters) waiter.resolve();
+    return run;
   }
   async admitLocked(frame) {
     const state = await this.read();
@@ -2717,11 +2939,11 @@ var RelayAdmissionStore = class {
     const hash = hostProducerFrameHash(frame);
     const replay = replayCode(existing, hash, frame.sequence, installation2);
     if (replay !== null) {
-      if (replay === "frame_identity_conflict") await this.quarantine.retainFrame(frame, replay, attributionForFrame(frame, hash, frame.sequence));
+      if (replay === "frame_identity_conflict") await this.quarantine.retainFrame(frame, replay);
       return result(replay, installation2);
     }
     if (frame.sequence !== installation2.admitted_through_sequence + 1) {
-      await this.quarantine.retainFrame(frame, "sequence_gap", attributionForFrame(frame, hash, frame.sequence));
+      await this.quarantine.retainFrame(frame, "sequence_gap");
       return result("sequence_gap", installation2);
     }
     const chargedBytes = 4 + Buffer.byteLength(JSON.stringify(frame), "utf8");
@@ -2768,7 +2990,7 @@ var RelayAdmissionStore = class {
     if (!installation2) throw new TypeError("Host Relay delivery installation is unavailable.");
     if (outcome.status === "refused" || exhausted) {
       const diagnostic = exhaustedDiagnostic(outcome, exhausted);
-      await this.quarantine.retainFrame(head.frame, "gateway_refused", attributionForFrame(head.frame, head.hash, head.sequence, diagnostic));
+      await this.quarantine.retainFrame(head.frame, "gateway_refused");
       installation2.last_refusal = { sequence: head.sequence, submission_ref: input.submission_ref, ...refusalCause(outcome, head), ...diagnostic === void 0 ? {} : { diagnostic }, refused_at_ms: options.now_ms };
       refused.push(input.submission_ref);
     } else {
@@ -2799,31 +3021,19 @@ var RelayAdmissionStore = class {
   }
   async read() {
     try {
-      return decodeState3(JSON.parse(await readFile2(join4(this.root, "admission.json"), "utf8")));
+      return decodeState2(JSON.parse(await readFile2(join3(this.root, "admission.json"), "utf8")));
     } catch (error) {
-      if (errorCode6(error) === "ENOENT") return { schema_version: "ceal.host_relay_admission_state.v1", installations: {}, entries: [] };
+      if (errorCode5(error) === "ENOENT") return { schema_version: "ceal.host_relay_admission_state.v1", installations: {}, entries: [] };
       throw error;
     }
   }
   async write(state) {
-    await durableAtomicReplace(join4(this.root, "admission.json"), JSON.stringify(state));
+    await durableAtomicReplace(join3(this.root, "admission.json"), JSON.stringify(state));
   }
 };
 function installationKey(frame) {
   return `${frame.producer_id}\0${frame.producer_installation_ref}`;
 }
-function pendingFrameMatchesBindingQuery(entry2, query) {
-  const selector = extractHostBindingSelector(entry2.frame);
-  if (selector === null) return false;
-  return relayRequestBindingMatchesQuery(query, selector);
-}
-function attributionForFrame(frame, hash, sequence, diagnostic) {
-  const selector = extractHostBindingSelector(frame);
-  if (selector === null) return void 0;
-  if (frame.producer_id !== selector.producer_id || frame.producer_installation_ref !== selector.producer_installation_ref || frame.sequence !== sequence) return void 0;
-  if (hostProducerFrameHash(frame) !== hash) return void 0;
-  return { ...selector, sequence, frame_sha256: hash, ...diagnostic === void 0 ? {} : { diagnostic } };
-}
 function exhaustedDiagnostic(outcome, exhausted) {
   if (outcome.status !== "retryable" && outcome.status !== "refused") return void 0;
   if (outcome.diagnostic !== void 0) return exhausted ? { ...outcome.diagnostic, exhausted: true } : outcome.diagnostic;
@@ -2841,6 +3051,7 @@ function retryExhausted(outcome, entry2) {
   return outcome.status === "retryable" && entry2.retry_attempts >= MAX_RETRYABLE_ATTEMPTS;
 }
 function refusalCause(outcome, entry2) {
+  if (outcome.status === "refused" && outcome.code === "no_binding") return { code: "gateway_refused", message: "Gateway refused the Host producer frame." };
   if (outcome.status === "refused") return { code: outcome.code, message: outcome.message };
   const reason = outcome.status === "retryable" ? outcome.reason ?? "no reason reported" : "no reason reported";
   return { code: "retry_exhausted", message: `Gateway delivery stayed retryable through ${entry2.retry_attempts} attempts: ${reason}` };
@@ -2854,10 +3065,10 @@ function scheduleRetry(entry2, nowMs, reason) {
 function result(code, state) {
   return { code, admitted_through_sequence: state.admitted_through_sequence, delivered_through_sequence: state.delivered_through_sequence };
 }
-function errorCode6(error) {
+function errorCode5(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
-function decodeState3(value) {
+function decodeState2(value) {
   if (!stateRecord(value)) throw new TypeError("Host Relay admission state is invalid.");
   const installations = {};
   for (const [key, item] of Object.entries(value.installations)) {
@@ -2884,18 +3095,18 @@ function refusalRecord(value) {
 }
 function validDiagnostic(value) {
   if (!object(value) || !hasExactKeys2(value, [], RELAY_DELIVERY_DIAGNOSTIC_KEYS)) return false;
-  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger2) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean2);
+  return isUndefinedOr(value.relayCode, isRelayGatewayErrorCode) && isUndefinedOr(value.gatewayStatus, isSafeInteger) && isUndefinedOr(value.gatewayCode, isBoundedRefusalWord) && isUndefinedOr(value.gatewayReason, isBoundedRefusalWord) && isUndefinedOr(value.exhausted, isBoolean);
 }
-function isSafeInteger2(value) {
+function isSafeInteger(value) {
   return Number.isSafeInteger(value);
 }
-function isBoolean2(value) {
+function isBoolean(value) {
   return typeof value === "boolean";
 }
 function entry(value) {
-  return object(value) && producer2(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
+  return object(value) && producer(value.producer_id) && typeof value.producer_installation_ref === "string" && Number.isSafeInteger(value.sequence) && typeof value.hash === "string" && Number.isSafeInteger(value.charged_bytes) && object(value.frame) && Number.isSafeInteger(value.retry_attempts) && Number.isSafeInteger(value.retry_at_ms);
 }
-function producer2(value) {
+function producer(value) {
   return value === "codex" || value === "claude";
 }
 function object(value) {
@@ -2925,10 +3136,10 @@ function poisonEnvelopeMatches(entryValue, installation2) {
   return poisonEnvelopeSchema(frame) && poisonEnvelopeProducer(frame, entryValue) && poisonEnvelopeInstallation(frame, entryValue) && poisonEnvelopeEpoch(frame, installation2) && poisonEnvelopeSequence(frame, entryValue) && poisonEnvelopeKind(frame) && poisonEnvelopeTimestamp(frame);
 }
 function poisonEnvelopeSchema(frame) {
-  return frame.schema_version === "ceal.host_producer_frame.v1";
+  return frame.schema_version === HOST_PRODUCER_FRAME_SCHEMA;
 }
 function poisonEnvelopeProducer(frame, entryValue) {
-  return producer2(frame.producer_id) && frame.producer_id === entryValue.producer_id;
+  return producer(frame.producer_id) && frame.producer_id === entryValue.producer_id;
 }
 function poisonEnvelopeInstallation(frame, entryValue) {
   return opaqueHostSourceRef(frame.producer_installation_ref) && frame.producer_installation_ref === entryValue.producer_installation_ref;
@@ -2956,713 +3167,275 @@ function poisonSequenceInRange(entryValue, installation2) {
   return entryValue.sequence <= installation2.admitted_through_sequence;
 }
 
-// host/relay/src/relay-gateway-bridge.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import { join as join5 } from "node:path";
-var STATE_SCHEMA2 = "ceal.host_relay_gateway_state.v1";
-var SAFE_REF4 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-var HOST_GATEWAY_ACKNOWLEDGEMENT_DISPOSITIONS = ["created", "adopted", "replayed", "approval_approved", "approval_denied", "approval_replayed"];
-function isHostGatewayAcknowledgementDisposition(value) {
-  return typeof value === "string" && HOST_GATEWAY_ACKNOWLEDGEMENT_DISPOSITIONS.some((disposition) => disposition === value);
-}
-var RelayGatewayBridge = class {
-  statePath;
-  hostSourceRef;
-  gateway;
-  timeoutMs;
-  onRequestBound;
-  tail = Promise.resolve();
-  constructor(options) {
-    if (typeof options.state_root !== "string" || options.state_root.length === 0 || !opaqueHostSourceRef(options.host_source_ref) || typeof options.gateway?.submitHostTurn !== "function") throw new TypeError("Host Relay Gateway bridge configuration is invalid.");
-    if (!validOptionalTimeout(options.timeout_ms)) throw new TypeError("Host Relay Gateway timeout is invalid.");
-    this.statePath = join5(options.state_root, "gateway-state.json");
-    this.hostSourceRef = options.host_source_ref;
-    this.gateway = options.gateway;
-    this.timeoutMs = options.timeout_ms ?? 5e3;
-    this.onRequestBound = options.on_request_bound ?? (() => void 0);
-  }
-  deliver(input) {
-    const run = this.tail.then(() => this.deliverLocked(input));
-    this.tail = run.then(() => void 0, () => void 0);
-    return run;
-  }
-  async deliverLocked(input) {
-    if (input.host_source_ref !== this.hostSourceRef) throw new TypeError(`Host Relay source binding does not match the Gateway source: ${refusalFacts([{ name: "input_host_source_ref", value: input.host_source_ref }, { name: "configured_host_source_ref", value: this.hostSourceRef }])}.`);
-    if (input.frame.frame_kind === "producer_status") return { status: "created" };
-    const state = await this.readState();
-    if (input.frame.frame_kind === "session_started") return this.stageSession(state, input);
-    if (input.frame.frame_kind === "turn_started") return this.stageTurn(state, input);
-    return input.frame.frame_kind === "user_input" ? this.deliverInput(state, input) : this.deliverTerminal(state, input);
-  }
-  async stageSession(state, input) {
-    const localSessionRef = payloadRef(input.frame, "local_session_ref");
-    const hostSessionRef = hostProducerSessionRef(this.hostSourceRef, input.frame, localSessionRef);
-    const next = { ...state, sessions: { ...state.sessions, [hostSessionRef]: { observations: payloadObservations(input.frame), submission_ref: input.submission_ref } } };
-    await this.writeState(next);
-    return { status: "created" };
-  }
-  async stageTurn(state, input) {
-    const refs = frameRefs(input.frame, this.hostSourceRef);
-    const existing = state.turns[refs.host_turn_ref];
-    const nextTurn = {
-      host_session_ref: refs.host_session_ref,
-      observations: payloadObservations(input.frame),
-      submission_ref: input.submission_ref,
-      ...existing?.request_ref === void 0 ? {} : { request_ref: existing.request_ref },
-      ...existing?.prompt_ref === void 0 ? {} : { prompt_ref: existing.prompt_ref },
-      ...existing?.origin_host_input_ref === void 0 ? {} : { origin_host_input_ref: existing.origin_host_input_ref },
-      ...existing?.input_refused === void 0 ? {} : { input_refused: existing.input_refused }
-    };
-    await this.writeState({ ...state, turns: { ...state.turns, [refs.host_turn_ref]: nextTurn } });
-    return { status: "created" };
-  }
-  async deliverInput(state, input) {
-    const prepared = prepareInput(state, input, this.hostSourceRef);
-    const priorRefusal = refusedUnboundInput(prepared.turn);
-    if (priorRefusal !== void 0) return priorRefusal;
-    const outcome = await this.submit(prepared.submission);
-    if ("refusal" in outcome) {
-      if (outcome.refusal.definitive && prepared.turn !== void 0) await this.writeState({ ...state, turns: { ...state.turns, [prepared.refs.host_turn_ref]: { ...prepared.turn, input_refused: { code: outcome.refusal.code, message: outcome.refusal.message } } } });
-      return deliveryRefusal(outcome.refusal);
-    }
-    const acknowledgement2 = outcome.acknowledgement;
-    const nextTurn = bindInput(prepared, acknowledgement2.request_ref, input.submission_ref);
-    await this.writeState({ ...state, turns: { ...state.turns, [prepared.refs.host_turn_ref]: nextTurn } });
-    if (!bindsOriginInput(prepared)) return { status: "created" };
-    const bindingRequestRef = nextTurn.request_ref ?? acknowledgement2.request_ref;
-    const bindingPromptRef = nextTurn.prompt_ref ?? prepared.promptRef;
-    const bindingInputRef = nextTurn.origin_host_input_ref ?? prepared.hostInputRef;
-    const binding = { frame: structuredClone(input.frame), request_ref: bindingRequestRef, prompt_ref: bindingPromptRef, host_binding: {
-      host_source_ref: prepared.submission.identity.host_source_ref,
-      host_session_ref: prepared.submission.identity.host_session_ref,
-      host_turn_ref: prepared.submission.identity.host_turn_ref,
-      host_input_ref: bindingInputRef,
-      prompt_ref: bindingPromptRef
-    } };
-    const context = createRelayRequestWorkContext({ request_ref: bindingRequestRef, host_binding: binding.host_binding });
-    try {
-      await this.onRequestBound(binding, context);
-    } catch (error) {
-      if (error instanceof HostRelayBindingError) return { status: "refused", code: error.code, message: error.message };
-      return { status: "retryable", reason: `binding_store: ${errorMessage(error)}` };
-    }
-    return { status: "created" };
+// host/relay/src/relay-pipe-handshake.ts
+import { createHmac, randomBytes } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { link, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname4, join as join4 } from "node:path";
+var RELAY_PIPE_HANDSHAKE_TIMEOUT_MS = 5e3;
+var RELAY_PIPE_KEY_BYTES = 32;
+var RELAY_PIPE_KEY_FILENAME = "relay-pipe.key";
+var RELAY_PIPE_NONCE_BYTES = 32;
+var RELAY_PIPE_NONCE_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
+var RELAY_PIPE_HELLO_SCHEMA = "ceal.host_relay_pipe_hello.v1";
+var RELAY_PIPE_CHALLENGE_SCHEMA = "ceal.host_relay_pipe_challenge.v1";
+var RELAY_PIPE_RESPONSE_SCHEMA = "ceal.host_relay_pipe_response.v1";
+var RELAY_PIPE_FRAME_BYTES = Uint32Array.BYTES_PER_ELEMENT;
+var RELAY_PIPE_FRAME_MAX_BYTES = 1024;
+var RelayPipeHandshakeError = class extends Error {
+  name = "RelayPipeHandshakeError";
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
   }
-  async deliverTerminal(state, input) {
-    const refs = frameRefs(input.frame, this.hostSourceRef);
-    const turn = state.turns[refs.host_turn_ref];
-    if (turn === void 0) return { status: "refused", code: "origin_turn_unknown", message: "The terminal frame names a turn whose start was never admitted." };
-    if (turn.request_ref === void 0 || turn.prompt_ref === void 0 || turn.origin_host_input_ref === void 0) {
-      if (turn.input_refused !== void 0) return { status: "refused", code: "origin_input_refused", message: `The terminal frame names a turn whose input was refused (${turn.input_refused.code}: ${turn.input_refused.message}).` };
-      return { status: "retryable", reason: "origin_turn_unbound" };
-    }
-    const outcome = await this.submit({
-      identity: { host_source_ref: this.hostSourceRef, host_session_ref: refs.host_session_ref, host_turn_ref: refs.host_turn_ref },
-      host_input_ref: turn.origin_host_input_ref,
-      input_kind: "host_automatic",
-      prompt_ref: turn.prompt_ref,
-      observations: payloadObservations(input.frame),
-      request_ref: turn.request_ref,
-      submission_ref: input.submission_ref
-    });
-    return "refusal" in outcome ? deliveryRefusal(outcome.refusal) : { status: "created" };
+};
+function relayPipeKeyPath(relayStateRoot) {
+  return join4(relayStateRoot, RELAY_PIPE_KEY_FILENAME);
+}
+async function loadRelayPipeKey(relayStateRoot, platform = process.platform, custody = {}) {
+  const path = relayPipeKeyPath(relayStateRoot);
+  if (platform === "win32") return await loadWindowsRelayPipeKey(path, custody);
+  const existing = await readRelayPipeKey(path, platform, custody);
+  if (existing !== null) return existing;
+  return await createPosixRelayPipeKey(path, platform, custody);
+}
+async function loadWindowsRelayPipeKey(path, custody) {
+  const existing = await readRelayPipeKey(path, "win32", custody);
+  if (existing !== null) return existing;
+  try {
+    await createRandomPrivateFileWithSecurefs(path, RELAY_PIPE_KEY_BYTES, custody);
+  } catch (error) {
+    if (errorCode6(error) === "EEXIST") return await readWinnerPipeKey(path, "win32", custody);
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}; delete it and restart the Host Relay.`);
   }
-  async submit(input) {
-    const controller2 = new AbortController();
-    const timeout = setTimeout(() => controller2.abort(), this.timeoutMs);
-    try {
-      const acknowledgement2 = await this.gateway.submitHostTurn(input, controller2.signal);
-      return SAFE_REF4.test(acknowledgement2.request_ref) && isHostGatewayAcknowledgementDisposition(acknowledgement2.disposition) ? { acknowledgement: acknowledgement2 } : { refusal: { code: "invalid_response", message: "Gateway acknowledgement identity is invalid.", definitive: false } };
-    } catch (error) {
-      return { refusal: submissionRefusal(error) };
-    } finally {
-      clearTimeout(timeout);
-    }
+  return await readWinnerPipeKey(path, "win32", custody);
+}
+async function createPosixRelayPipeKey(path, platform, custody) {
+  const key = randomBytes(RELAY_PIPE_KEY_BYTES);
+  const staging = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+  let handle;
+  try {
+    handle = await openNoFollow(staging, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL, 384);
+  } catch (error) {
+    if (errorCode6(error) !== "EEXIST") throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+    return await readWinnerPipeKey(path, platform, custody);
   }
-  async readState() {
-    try {
-      const state = decodeState4(JSON.parse(await readFile3(this.statePath, "utf8")));
-      if (state.host_source_ref !== this.hostSourceRef) throw new TypeError(`Host Relay Gateway source binding changed: ${refusalFacts([{ name: "stored_host_source_ref", value: state.host_source_ref }, { name: "configured_host_source_ref", value: this.hostSourceRef }])}.`);
-      return state;
-    } catch (error) {
-      if (errorCode7(error) === "ENOENT") return { schema_version: STATE_SCHEMA2, host_source_ref: this.hostSourceRef, sessions: {}, turns: {} };
-      throw error;
-    }
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid) || !isPrivateFileMode(stats.mode)) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a private regular file owned by the current user.`);
+    await handle.writeFile(key);
+    await handle.sync();
+  } finally {
+    await handle.close();
   }
-  async writeState(state) {
-    await durableAtomicReplace(this.statePath, JSON.stringify(state));
+  try {
+    await link(staging, path);
+  } catch (error) {
+    if (errorCode6(error) !== "EEXIST") throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+    return await readWinnerPipeKey(path, platform, custody);
+  } finally {
+    await unlink2(staging).catch(() => void 0);
   }
-};
-var RETRYABLE_HTTP_STATUSES = /* @__PURE__ */ new Set([401, 403, 408, 429]);
-function submissionRefusal(error) {
-  const status = isRecord(error) && typeof error.status === "number" ? error.status : void 0;
-  const code = errorCode7(error) ?? "gateway_unavailable";
-  const definitive = code === "payload_rejected" || status !== void 0 && status >= 400 && status < 500 && !RETRYABLE_HTTP_STATUSES.has(status);
-  return { code, message: errorMessage(error), definitive, diagnostic: typedDiagnostic(error, status) };
-}
-function typedDiagnostic(error, status) {
-  if (!isRecord(error)) return status === void 0 ? {} : { gatewayStatus: status };
-  const gatewayCode = isBoundedRefusalWord(error.error_code) ? error.error_code : void 0;
-  const gatewayReason = isBoundedRefusalWord(error.refusal_reason) ? error.refusal_reason : void 0;
-  return {
-    ...typeof error.code === "string" ? { relayCode: error.code } : {},
-    ...status === void 0 ? {} : { gatewayStatus: status },
-    ...gatewayCode === void 0 ? {} : { gatewayCode },
-    ...gatewayReason === void 0 ? {} : { gatewayReason }
-  };
+  return Buffer.from(key);
 }
-function deliveryRefusal(refusal) {
-  const diagnostic = refusal.diagnostic === void 0 ? {} : { diagnostic: refusal.diagnostic };
-  return refusal.definitive ? { status: "refused", code: refusal.code, message: refusal.message, ...diagnostic } : { status: "retryable", reason: `${refusal.code}: ${refusal.message}`, ...diagnostic };
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function frameRefs(frame, hostSourceRef) {
-  const localSessionRef = payloadRef(frame, "local_session_ref");
-  const localTurnRef = payloadRef(frame, "local_turn_ref");
-  const hostSessionRef = hostProducerSessionRef(hostSourceRef, frame, localSessionRef);
-  return { local_session_ref: localSessionRef, local_turn_ref: localTurnRef, host_session_ref: hostSessionRef, host_turn_ref: hostProducerTurnRef(hostSourceRef, frame, localSessionRef, localTurnRef) };
-}
-function prepareInput(state, input, hostSourceRef) {
-  const refs = frameRefs(input.frame, hostSourceRef);
-  const turn = state.turns[refs.host_turn_ref];
-  const promptRef = turn?.prompt_ref ?? hostProducerPromptRef(payloadPromptDigest(input.frame));
-  const hostInputRef = hostProducerInputRef(hostSourceRef, input.frame, refs.local_session_ref, refs.local_turn_ref, payloadRef(input.frame, "local_input_ref"));
-  const observations = uniqueObservations([...state.sessions[refs.host_session_ref]?.observations ?? [], ...turn?.observations ?? [], ...payloadObservations(input.frame)]);
-  const submission = compactSubmission({
-    identity: { host_source_ref: hostSourceRef, host_session_ref: refs.host_session_ref, host_turn_ref: refs.host_turn_ref },
-    host_input_ref: hostInputRef,
-    input_kind: payloadInputKind(input.frame),
-    prompt_ref: promptRef,
-    observations,
-    request_ref: turn?.request_ref,
-    submission_ref: input.submission_ref
-  });
-  return { refs, turn, promptRef, hostInputRef, submission };
-}
-function bindInput(prepared, requestRef, submissionRef) {
-  return {
-    host_session_ref: prepared.refs.host_session_ref,
-    observations: prepared.turn?.observations ?? [],
-    submission_ref: prepared.turn?.submission_ref ?? submissionRef,
-    request_ref: prepared.turn?.request_ref ?? requestRef,
-    prompt_ref: prepared.turn?.prompt_ref ?? prepared.promptRef,
-    origin_host_input_ref: prepared.turn?.origin_host_input_ref ?? prepared.hostInputRef
-  };
+async function readWinnerPipeKey(path, platform, custody) {
+  const winner = await readRelayPipeKey(path, platform, custody);
+  if (winner === null) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+  return winner;
 }
-function refusedUnboundInput(turn) {
-  if (turn?.request_ref !== void 0 || turn?.input_refused === void 0) return void 0;
-  return { status: "refused", code: "origin_input_refused", message: `The input frame names a turn whose origin input was refused (${turn.input_refused.code}: ${turn.input_refused.message}).` };
+async function readRelayPipeKey(path, platform, custody) {
+  if (platform === "win32") return await readWindowsRelayPipeKey(path, custody);
+  return await readPosixRelayPipeKey(path);
 }
-function bindsOriginInput(prepared) {
-  return prepared.turn?.request_ref === void 0 || prepared.turn.origin_host_input_ref === prepared.hostInputRef;
+async function readWindowsRelayPipeKey(path, custody) {
+  let key;
+  try {
+    key = await readPrivateFileWithSecurefs(path, RELAY_PIPE_KEY_BYTES, custody);
+  } catch (error) {
+    if (errorCode6(error) === "ENOENT" || errorCode6(error) === "ELOOP") return null;
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}; delete it and restart the Host Relay.`);
+  }
+  if (key.byteLength !== RELAY_PIPE_KEY_BYTES) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} has ${key.byteLength} bytes; want ${RELAY_PIPE_KEY_BYTES}. Delete the file and restart the Host Relay.`);
+  return Buffer.from(key);
 }
-function payloadRef(frame, key) {
-  const value = frame.payload[key];
-  if (typeof value !== "string" || !SAFE_REF4.test(value)) throw new TypeError("Host Relay frame reference is invalid.");
-  return value;
+async function readPosixRelayPipeKey(path) {
+  let handle;
+  try {
+    handle = await openNoFollow(path);
+  } catch (error) {
+    if (errorCode6(error) === "ENOENT" || errorCode6(error) === "ELOOP") return null;
+    throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key is unavailable at ${path}.`);
+  }
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile()) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a regular file; delete it and restart the Host Relay.`);
+    if (!isSelfOwned(stats.uid) || !isPrivateFileMode(stats.mode)) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} is not a private file owned by the current user; delete it and restart the Host Relay.`);
+    if (stats.size !== RELAY_PIPE_KEY_BYTES) throw new RelayPipeHandshakeError("pipe_key_unavailable", `Host Relay pipe key at ${path} has ${stats.size} bytes; want ${RELAY_PIPE_KEY_BYTES}. Delete the file and restart the Host Relay.`);
+    return await handle.readFile();
+  } finally {
+    await handle.close();
+  }
 }
-function payloadPromptDigest(frame) {
-  const prompt = payloadObservations(frame).find((observation) => observation.observation_kind === "prompt");
-  if (prompt === void 0 || !isCealHostPromptObservationValue(prompt.value)) throw new TypeError("Host Relay prompt observation is invalid.");
-  return prompt.value.body_sha256;
+function createPipeClientNonce() {
+  return randomBytes(RELAY_PIPE_NONCE_BYTES).toString("base64url");
 }
-function payloadObservations(frame) {
-  return Array.isArray(frame.payload.observations) ? frame.payload.observations.filter(isObservation) : [];
+function pipeProof(key, role, firstNonce, secondNonce) {
+  return createHmac("sha256", key).update(`${role}\0${firstNonce}\0${secondNonce}`, "utf8").digest("hex");
 }
-function payloadInputKind(frame) {
-  const value = frame.payload.input_kind;
-  if (!isCealHostInputKind(value)) throw new TypeError("Host Relay input kind is invalid.");
-  return value;
+function createPipeServerProof(key, clientNonce, serverNonce) {
+  return pipeProof(key, "server", clientNonce, serverNonce);
 }
-function uniqueObservations(values) {
-  const seen = /* @__PURE__ */ new Set();
-  return values.filter((value) => !seen.has(value.observation_ref) && Boolean(seen.add(value.observation_ref)));
+function createPipeClientProof(key, serverNonce, clientNonce) {
+  return pipeProof(key, "client", serverNonce, clientNonce);
 }
-function compactSubmission(value) {
-  return { identity: value.identity, host_input_ref: value.host_input_ref, input_kind: value.input_kind, prompt_ref: value.prompt_ref, observations: value.observations, submission_ref: value.submission_ref, ...value.request_ref === void 0 ? {} : { request_ref: value.request_ref } };
+function encodePipeFrame(value) {
+  const body = Buffer.from(JSON.stringify(value), "utf8");
+  const output = Buffer.allocUnsafe(body.length + RELAY_PIPE_FRAME_BYTES);
+  output.writeUInt32BE(body.length, 0);
+  body.copy(output, RELAY_PIPE_FRAME_BYTES);
+  return output;
 }
-function isObservation(value) {
+function decodePipeFrame(buffer) {
+  if (buffer.length < RELAY_PIPE_FRAME_BYTES) return null;
+  const length = buffer.readUInt32BE(0);
+  if (length === 0 || length > RELAY_PIPE_FRAME_MAX_BYTES) throw new RelayPipeHandshakeError("pipe_handshake_invalid", `Host Relay pipe handshake frame declares ${length} bytes; want between 1 and ${RELAY_PIPE_FRAME_MAX_BYTES}.`);
+  if (buffer.length < length + RELAY_PIPE_FRAME_BYTES) return null;
+  let value;
   try {
-    validateCealHostObservationDraft(value);
-    return true;
+    value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(RELAY_PIPE_FRAME_BYTES, length + RELAY_PIPE_FRAME_BYTES)));
   } catch {
-    return false;
+    throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is not JSON.");
   }
+  return { value, rest: buffer.subarray(length + RELAY_PIPE_FRAME_BYTES) };
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function validOptionalTimeout(value) {
-  return value === void 0 || Number.isSafeInteger(value) && Number(value) >= 1 && Number(value) <= 6e4;
-}
-function errorCode7(error) {
-  return isRecord(error) && typeof error.code === "string" ? error.code : null;
-}
-function decodeState4(value) {
-  if (!isRecord(value) || value.schema_version !== STATE_SCHEMA2) throw new TypeError(`Host Relay Gateway state is invalid: ${refusalFact("schema_version", isRecord(value) ? value.schema_version : void 0, STATE_SCHEMA2)}.`);
-  if (!opaqueHostSourceRef(value.host_source_ref)) throw new TypeError(`Host Relay Gateway state is invalid: ${refusalFact("host_source_ref", value.host_source_ref, "an opaque Host source reference")}.`);
-  if (!isRecord(value.sessions) || !isRecord(value.turns)) throw new TypeError(`Host Relay Gateway state is invalid: ${refusalFacts([{ name: "sessions_is_object", value: isRecord(value.sessions), expected: "true" }, { name: "turns_is_object", value: isRecord(value.turns), expected: "true" }])}.`);
-  return { schema_version: STATE_SCHEMA2, host_source_ref: value.host_source_ref, sessions: decodeSessions(value.sessions), turns: decodeTurns(value.turns) };
-}
-function decodeSessions(value) {
-  const result2 = {};
-  for (const [key, item] of Object.entries(value)) {
-    if (!SAFE_REF4.test(key) || !isRecord(item) || !Array.isArray(item.observations) || !item.observations.every(isObservation) || typeof item.submission_ref !== "string") throw new TypeError("Host Relay staged Session is invalid.");
-    result2[key] = { observations: item.observations, submission_ref: item.submission_ref };
-  }
-  return result2;
+function validNonce(value) {
+  return typeof value === "string" && RELAY_PIPE_NONCE_PATTERN.test(value);
 }
-function decodeTurns(value) {
-  const result2 = {};
-  for (const [key, item] of Object.entries(value)) {
-    if (!SAFE_REF4.test(key)) throw new TypeError("Host Relay staged turn is invalid.");
-    result2[key] = decodeTurn(item);
-  }
-  return result2;
+function writePipeFrame(socket, frame) {
+  if (socket.write(frame)) return Promise.resolve();
+  return new Promise((resolve, reject) => {
+    socket.once("drain", resolve);
+    socket.once("error", reject);
+    socket.once("close", () => reject(new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake connection closed.")));
+  });
 }
-function decodeTurn(item) {
-  if (!isRecord(item) || typeof item.host_session_ref !== "string" || !Array.isArray(item.observations) || !item.observations.every(isObservation) || typeof item.submission_ref !== "string") throw new TypeError("Host Relay staged turn is invalid.");
-  return {
-    host_session_ref: item.host_session_ref,
-    observations: item.observations,
-    submission_ref: item.submission_ref,
-    ...decodeTurnBinding(item),
-    ...isInputRefusal(item.input_refused) ? { input_refused: { code: item.input_refused.code, message: item.input_refused.message } } : {}
+function readPipeFrames() {
+  let buffer = Buffer.alloc(0);
+  let pending = null;
+  const feed = (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    if (pending === null) return;
+    let frame;
+    try {
+      frame = decodePipeFrame(buffer);
+    } catch (error) {
+      const waiting2 = pending;
+      pending = null;
+      waiting2.reject(error instanceof Error ? error : new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is invalid."));
+      return;
+    }
+    if (frame === null) return;
+    buffer = frame.rest;
+    const waiting = pending;
+    pending = null;
+    waiting.resolve({ value: frame.value, rest: Buffer.alloc(0) });
   };
-}
-function decodeTurnBinding(item) {
-  return { ...typeof item.request_ref === "string" ? { request_ref: item.request_ref } : {}, ...typeof item.prompt_ref === "string" ? { prompt_ref: item.prompt_ref } : {}, ...typeof item.origin_host_input_ref === "string" ? { origin_host_input_ref: item.origin_host_input_ref } : {} };
-}
-function isInputRefusal(value) {
-  return isRecord(value) && typeof value.code === "string" && typeof value.message === "string";
-}
-
-// host/relay/src/relay-gateway-http.ts
-import { O_NOFOLLOW as O_NOFOLLOW2, O_RDONLY as O_RDONLY3 } from "node:constants";
-import { lstat as lstat2, open as open4 } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
-
-// host/gateway-http.ts
-var SAFE_HOST_REF = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-function hostIngressBody(input, invalidEventTime) {
-  if (!isCealHostInputKind(input.input_kind)) throw new TypeError("Host ingress input kind is invalid.");
-  const prompt = input.observations.find((observation) => observation.observation_kind === "prompt");
-  const observedAt = prompt?.observed_at ?? input.observations[0]?.observed_at;
-  if (observedAt === void 0 || !Number.isFinite(Date.parse(observedAt))) throw invalidEventTime();
-  return {
-    submission_ref: input.submission_ref,
-    host_source_ref: input.identity.host_source_ref,
-    host_session_ref: input.identity.host_session_ref,
-    host_turn_ref: input.identity.host_turn_ref,
-    host_input_ref: input.host_input_ref,
-    input_kind: input.input_kind,
-    prompt_ref: input.prompt_ref,
-    observed_at: observedAt,
-    observations: input.observations,
-    ...input.request_ref === void 0 ? {} : { request_ref: input.request_ref }
-  };
-}
-async function responseJson(response2, invalidResponse2) {
-  try {
-    return await response2.json();
-  } catch {
-    throw invalidResponse2();
-  }
-}
-async function submitHostIngress(options) {
-  if (options.input.identity.host_source_ref !== options.expected_host_source_ref) throw options.sourceMismatch();
-  const body = JSON.stringify(hostIngressBody(options.input, options.invalidEventTime));
-  let response2;
-  try {
-    response2 = await options.fetcher(options.endpoint, {
-      method: "POST",
-      ...options.redirect === void 0 ? {} : { redirect: options.redirect },
-      headers: { authorization: `Bearer ${options.credential}`, "content-type": "application/json" },
-      body,
-      signal: options.signal
-    });
-  } catch {
-    throw options.unavailable();
-  }
-  const responseBody = await responseJson(response2, options.invalidResponse);
-  if (!response2.ok) throw options.refused(response2.status, responseBody);
-  return options.acknowledgement(responseBody);
-}
-
-// host/relay/src/relay-gateway-http.ts
-var HOST_REGISTRATION_STATE_SCHEMA = "ceal.host_registration_state.v1";
-var HOST_REGISTRATION_STATE_KEYS = Object.freeze([
-  "credential_generation",
-  "gateway_request_origin",
-  "host_access_token",
-  "host_installation_ref",
-  "host_source_ref",
-  "registration_attempt_ref",
-  "schema_version",
-  "status"
-]);
-var HOST_REGISTRATION_STATE_MAX_BYTES = 65536;
-var HostRelayGatewayError = class extends Error {
-  name = "HostRelayGatewayError";
-  code;
-  /** HTTP status of a Gateway refusal, when one answered. */
-  status;
-  /** The Gateway's own refusal word, when it named one; a bounded token, never its message. */
-  error_code;
-  /** The Gateway mint refusal's bounded continuity reason, when it named one; a fixed token, never its message. */
-  refusal_reason;
-  constructor(code, message, status, errorCode9, refusalReason) {
-    super(message);
-    this.code = code;
-    if (status !== void 0) this.status = status;
-    if (errorCode9 !== void 0) this.error_code = errorCode9;
-    if (refusalReason !== void 0) this.refusal_reason = refusalReason;
-  }
-};
-var GATEWAY_REFUSAL_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/u;
-async function gatewayRefusal(response2) {
-  try {
-    const body = await response2.json();
-    if (!isCealJsonRecord(body)) return {};
-    const code = typeof body.error_code === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code) ? body.error_code : void 0;
-    const reason = code === "request_context_refused" && typeof body.reason === "string" && GATEWAY_REFUSAL_CODE_PATTERN.test(body.reason) && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, body.reason) ? body.reason : void 0;
-    return {
-      ...code === void 0 ? {} : { code },
-      ...reason === void 0 ? {} : { reason }
-    };
-  } catch {
-    return {};
-  }
-}
-function submitRefusalCode(body) {
-  if (!isCealJsonRecord(body) || typeof body.error_code !== "string" || !GATEWAY_REFUSAL_CODE_PATTERN.test(body.error_code)) return void 0;
-  return body.error_code;
-}
-function refusalMessage(status, body) {
-  const record6 = isCealJsonRecord(body) ? body : {};
-  const code = typeof record6.error_code === "string" ? record6.error_code : "unknown";
-  const message = typeof record6.message === "string" ? `: ${record6.message}` : "";
-  return `Gateway Host ingress refused the submission (${status} ${code}${message}).`;
-}
-function createHostRelayGatewayHttpPort(options) {
-  if (!SAFE_HOST_REF.test(options.host_source_ref) || options.host_source_ref.startsWith("ceal-host-source:") || typeof options.registration_state_file !== "string" || options.registration_state_file.length === 0) {
-    throw new HostRelayGatewayError("configuration", "Host Relay Gateway binding is invalid.");
-  }
-  return Object.freeze({
-    async submitHostTurn(input, signal) {
-      if (input.identity.host_source_ref !== options.host_source_ref) throw new HostRelayGatewayError("payload_rejected", `Host Relay source binding changed: ${refusalFacts([{ name: "input_host_source_ref", value: input.identity.host_source_ref }, { name: "configured_host_source_ref", value: options.host_source_ref }])}.`);
-      const registration = await readHostRegistrationAuthority(options.registration_state_file, options.host_source_ref);
-      const endpoint = hostRelayGatewayEndpoint(registration.gateway_request_origin);
-      return await submitHostIngress({
-        input,
-        expected_host_source_ref: options.host_source_ref,
-        endpoint,
-        credential: registration.host_access_token,
-        fetcher: options.fetch ?? fetch,
-        signal,
-        redirect: "error",
-        sourceMismatch: () => new HostRelayGatewayError("payload_rejected", "Host Relay source binding changed."),
-        invalidEventTime: () => new HostRelayGatewayError("payload_rejected", "Host Relay submission has no event time."),
-        unavailable: () => new HostRelayGatewayError("gateway_unavailable", "Gateway Host ingress is unavailable."),
-        invalidResponse: () => new HostRelayGatewayError("invalid_response", "Gateway Host ingress response is not JSON."),
-        refused: (status, body) => new HostRelayGatewayError("gateway_refused", refusalMessage(status, body), status, submitRefusalCode(body)),
-        acknowledgement
-      });
-    },
-    async mintInvocationContext(input, signal) {
-      const registration = await readHostRegistrationAuthority(options.registration_state_file, options.host_source_ref);
-      let response2;
+  const waiter = {
+    wait: () => new Promise((resolve, reject) => {
+      let frame;
       try {
-        response2 = await (options.fetch ?? fetch)(hostRelayGatewayRoute(registration.gateway_request_origin, CEAL_HOST_INVOCATION_CONTEXT_PATH), {
-          method: "POST",
-          redirect: "error",
-          signal,
-          headers: { authorization: `Bearer ${registration.host_access_token}`, "content-type": "application/json" },
-          body: JSON.stringify({ schema_version: "ceal.gateway_host_invocation_context_request.v1", ...input })
-        });
-      } catch {
-        throw new HostRelayGatewayError("gateway_unavailable", "Gateway Host invocation context is unavailable.");
+        frame = decodePipeFrame(buffer);
+      } catch (error) {
+        reject(error instanceof Error ? error : new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake frame is invalid."));
+        return;
       }
-      if (!response2.ok) {
-        const refusal = await gatewayRefusal(response2);
-        throw new HostRelayGatewayError(response2.status === 401 ? "credential" : "gateway_refused", `Gateway Host invocation context was refused (${response2.status}).`, response2.status, refusal.code, refusal.reason);
+      if (frame !== null) {
+        buffer = frame.rest;
+        resolve({ value: frame.value, rest: Buffer.alloc(0) });
+        return;
       }
-      let value;
-      try {
-        value = await response2.json();
-      } catch {
-        throw new HostRelayGatewayError("invalid_response", "Gateway Host invocation context response is not JSON.");
-      }
-      try {
-        return decodeCealHostInvocationAuthenticationResult(value);
-      } catch {
-        throw new HostRelayGatewayError("invalid_response", "Gateway Host invocation context response is invalid.");
+      pending = { resolve, reject };
+    }),
+    cancel: (error) => {
+      if (pending !== null) {
+        const waiting = pending;
+        pending = null;
+        waiting.reject(error);
       }
     }
-  });
-}
-function hostRelayGatewayEndpoint(value) {
-  return hostRelayGatewayRoute(value, CEAL_HOST_INGRESS_PATH);
-}
-function hostRelayGatewayRoute(value, path) {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    throw new HostRelayGatewayError("configuration", "Host Relay Gateway origin is invalid.");
-  }
-  const hostname = parsed.hostname.toLowerCase().replace(/\.+$/u, "");
-  if (/\s|\0/u.test(value) || hostname === "" || !validPort(parsed) || !isExplicitLoopbackHttp(parsed, hostname) && !isSecureHttps(parsed)) {
-    throw new HostRelayGatewayError("configuration", `Host Relay Gateway origin is invalid: ${refusalFacts([{ name: "protocol", value: parsed.protocol, expected: "https:, or http: with an explicit loopback port" }, { name: "hostname", value: hostname }, { name: "port", value: parsed.port }])}.`);
-  }
-  if (hasOriginDecoration(value, parsed)) {
-    throw new HostRelayGatewayError("configuration", `Host Relay Gateway origin is invalid: ${refusalFacts([{ name: "origin", value: parsed.origin }, { name: "has_userinfo", value: parsed.username !== "" || parsed.password !== "", expected: "false" }, { name: "pathname", value: parsed.pathname, expected: "/" }, { name: "search", value: parsed.search, expected: "an empty query" }, { name: "hash", value: parsed.hash, expected: "an empty fragment" }])}.`);
-  }
-  return `${parsed.origin}${path}`;
-}
-function isExplicitLoopbackHttp(parsed, hostname) {
-  return parsed.protocol === "http:" && parsed.port !== "" && (hostname === "127.0.0.1" || hostname === "[::1]");
-}
-function isSecureHttps(parsed) {
-  return parsed.protocol === "https:";
-}
-function validPort(parsed) {
-  if (parsed.port === "") return true;
-  const port = Number(parsed.port);
-  return Number.isInteger(port) && port >= 1 && port <= 65535;
+  };
+  return { waiter, feed, remainder: () => buffer };
+}
+function attachHandshakeReader(socket, waiter, feed) {
+  const onData = (chunk) => feed(Buffer.from(chunk));
+  const onError = (error) => waiter.cancel(error);
+  const onClose = () => waiter.cancel(new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe handshake connection closed."));
+  socket.on("data", onData);
+  socket.once("error", onError);
+  socket.once("close", onClose);
+  return () => {
+    socket.removeListener("data", onData);
+    socket.removeListener("error", onError);
+    socket.removeListener("close", onClose);
+  };
 }
-function hasOriginDecoration(value, parsed) {
-  const schemeEnd = value.indexOf("://");
-  const authority = schemeEnd < 0 ? "" : value.slice(schemeEnd + 3);
-  const suffixOffset = authority.search(/[\\/?#]/u);
-  const rawSuffix = suffixOffset < 0 ? "" : authority.slice(suffixOffset);
-  return parsed.username !== "" || parsed.password !== "" || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || rawSuffix !== "" && rawSuffix !== "/";
+function handshakeTimeout(timeoutMs) {
+  let timer;
+  const done = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new RelayPipeHandshakeError("pipe_handshake_timeout", `Host Relay pipe handshake stalled past ${timeoutMs} ms; dropping the connection.`)), timeoutMs);
+    timer.unref?.();
+  });
+  return { done, clear: () => clearTimeout(timer) };
 }
-async function readHostRegistrationAuthority(path, expectedHostSourceRef) {
-  let handle;
+async function conductPipeServerHandshake(socket, key, timeoutMs = RELAY_PIPE_HANDSHAKE_TIMEOUT_MS) {
+  const bound = handshakeTimeout(timeoutMs);
+  const { waiter, feed, remainder } = readPipeFrames();
+  const detach = attachHandshakeReader(socket, waiter, feed);
   try {
-    await assertOwnerPrivateDirectory(dirname2(path));
-    handle = await open4(path, O_RDONLY3 | O_NOFOLLOW2);
-    const stats = await handle.stat();
-    if (!stats.isFile() || !ownerPrivate3(stats)) throw new HostRelayGatewayError("credential", "Host Relay credential file is not owner-private.");
-    const raw = await handle.readFile("utf8");
-    if (Buffer.byteLength(raw, "utf8") > HOST_REGISTRATION_STATE_MAX_BYTES) throw new HostRelayGatewayError("credential", `Host registration state is invalid: ${refusalFact("registration_state_bytes", Buffer.byteLength(raw, "utf8"), `at most ${HOST_REGISTRATION_STATE_MAX_BYTES}`)}.`);
-    let value;
-    try {
-      value = JSON.parse(raw);
-    } catch {
-      throw new HostRelayGatewayError("credential", "Host registration state is invalid.");
+    const hello = await Promise.race([waiter.wait(), bound.done]);
+    if (!isRecord2(hello.value) || hello.value.schema_version !== RELAY_PIPE_HELLO_SCHEMA || !validNonce(hello.value.client_nonce)) {
+      throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe client hello is invalid; dropping the connection without an answer.");
     }
-    return decodeHostRegistrationAuthority(value, expectedHostSourceRef);
-  } catch (error) {
-    if (error instanceof HostRelayGatewayError) throw error;
-    throw new HostRelayGatewayError("credential", "Host Relay credential file is unavailable.");
+    const clientNonce = hello.value.client_nonce;
+    const serverNonce = createPipeClientNonce();
+    const serverProof = createPipeServerProof(key, clientNonce, serverNonce);
+    await Promise.race([writePipeFrame(socket, encodePipeFrame({ schema_version: RELAY_PIPE_CHALLENGE_SCHEMA, server_nonce: serverNonce, server_proof: serverProof })), bound.done]);
+    const response2 = await Promise.race([waiter.wait(), bound.done]);
+    if (!isRecord2(response2.value) || response2.value.schema_version !== RELAY_PIPE_RESPONSE_SCHEMA || typeof response2.value.client_proof !== "string") {
+      throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe client proof is invalid; dropping the connection without an answer.");
+    }
+    const expected = createPipeClientProof(key, serverNonce, clientNonce);
+    if (!timingSafeEqualHex(expected, response2.value.client_proof)) {
+      throw new RelayPipeHandshakeError("pipe_handshake_invalid", "Host Relay pipe client proof failed; dropping the connection without an answer.");
+    }
+    return remainder();
   } finally {
-    await handle?.close();
+    bound.clear();
+    detach();
   }
 }
-function decodeHostRegistrationAuthority(value, expectedHostSourceRef) {
-  const keys = HOST_REGISTRATION_STATE_KEYS;
-  const fieldCount = isCealJsonRecord(value) ? Object.keys(value).length : 0;
-  const missing = isCealJsonRecord(value) ? keys.filter((key) => !Object.hasOwn(value, key)).length : keys.length;
-  if (!isCealJsonRecord(value) || fieldCount !== keys.length || missing !== 0) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "registration_field_count", value: fieldCount, expected: `exactly ${keys.length}` }, { name: "missing_registration_field_count", value: missing, expected: "0" }])}.`);
-  if (!validRegistrationIdentity(value, expectedHostSourceRef)) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "schema_version", value: value.schema_version, expected: "ceal.host_registration_state.v1" }, { name: "status", value: value.status, expected: "active" }, { name: "host_source_ref", value: value.host_source_ref, expected: expectedHostSourceRef }, { name: "registration_attempt_ref", value: value.registration_attempt_ref, expected: "host-registration-attempt:<uuid>" }, { name: "host_installation_ref", value: value.host_installation_ref, expected: "host-installation:<uuid>" }])}.`);
-  if (!validRegistrationCredential(value)) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "credential_generation", value: value.credential_generation, expected: "a positive safe integer" }, { name: "host_access_token_matches_registered_shape", value: validHostAccessToken(value.host_access_token), expected: "true" }])}.`);
-  if (!validGatewayOrigin(value.gateway_request_origin)) throw new HostRelayGatewayError("credential", `Host registration state is invalid or does not match this Relay: ${refusalFact("gateway_request_origin", value.gateway_request_origin, "an HTTPS origin or explicit-port loopback HTTP origin")}.`);
-  return { gateway_request_origin: value.gateway_request_origin, host_access_token: value.host_access_token };
-}
-function validRegistrationIdentity(value, expectedHostSourceRef) {
-  return value.schema_version === HOST_REGISTRATION_STATE_SCHEMA && value.status === "active" && value.host_source_ref === expectedHostSourceRef && typeof value.registration_attempt_ref === "string" && CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN.test(value.registration_attempt_ref) && typeof value.host_installation_ref === "string" && CEAL_HOST_INSTALLATION_REF_PATTERN.test(value.host_installation_ref) && typeof value.host_source_ref === "string" && hostSourceUuid(value.host_source_ref) !== null;
-}
-function validRegistrationCredential(value) {
-  return Number.isSafeInteger(value.credential_generation) && Number(value.credential_generation) > 0 && validHostAccessToken(value.host_access_token);
+function timingSafeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let diff = 0;
+  for (let index = 0; index < left.length; index += 1) diff |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  return diff === 0;
 }
-function validHostAccessToken(value) {
-  return typeof value === "string" && CEAL_HOST_ACCESS_TOKEN_PATTERN.test(value);
-}
-function validGatewayOrigin(value) {
-  try {
-    if (typeof value !== "string") return false;
-    hostRelayGatewayEndpoint(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function assertOwnerPrivateDirectory(path) {
-  const stats = await lstat2(path);
-  if (!stats.isDirectory() || stats.isSymbolicLink() || !ownerPrivate3(stats)) throw new HostRelayGatewayError("credential", "Host Relay credential directory is not owner-private.");
-}
-function ownerPrivate3(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function acknowledgement(value) {
-  const fields = isCealJsonRecord(value) ? value : {};
-  if (!isCealJsonRecord(value) || value.ok !== true || value.status !== "accepted" || typeof value.request_ref !== "string" || !SAFE_HOST_REF.test(value.request_ref) || !isHostGatewayAcknowledgementDisposition(value.disposition)) {
-    throw new HostRelayGatewayError("invalid_response", `Gateway Host ingress acknowledgement is invalid: ${refusalFacts([{ name: "ok", value: fields.ok, expected: "true" }, { name: "status", value: fields.status, expected: "accepted" }, { name: "request_ref", value: fields.request_ref, expected: "a safe Host reference" }, { name: "disposition", value: fields.disposition, expected: "a Gateway acknowledgement disposition" }])}.`);
-  }
-  return { request_ref: value.request_ref, disposition: value.disposition };
+function errorCode6(error) {
+  return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
 
 // host/relay/src/relay-ipc.ts
-import { chmod, lstat as lstat3, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { chmod, lstat as lstat3, rename as rename2, unlink as unlink3 } from "node:fs/promises";
 import { createConnection, createServer } from "node:net";
-import { dirname as dirname3, join as join6 } from "node:path";
-
-// host/relay/src/current-prompt-custody.ts
-import { createHash as createHash5 } from "node:crypto";
-var HOST_CURRENT_PROMPT_MAX_BYTES = 256 * 1024;
-var MAX_CURRENT_PROMPTS = 1024;
-var MAX_CONSUMED_PROMPTS = 1024;
-var HostCurrentPromptCapacityError = class extends Error {
-  report_diagnostic;
-  constructor(reportDiagnostic) {
-    super("current_prompt_unavailable");
-    this.name = "HostCurrentPromptCapacityError";
-    this.report_diagnostic = reportDiagnostic;
-  }
-};
-var HostCurrentPromptCustody = class {
-  #records = /* @__PURE__ */ new Map();
-  #consumed = /* @__PURE__ */ new Map();
-  #now;
-  #capacityDiagnosticReported = false;
-  constructor(now = Date.now) {
-    this.#now = now;
-  }
-  register(identity, prompt, expiresAt) {
-    const bytes2 = Buffer.byteLength(prompt, "utf8");
-    const expiry = Date.parse(expiresAt);
-    if (bytes2 === 0 || bytes2 > HOST_CURRENT_PROMPT_MAX_BYTES || !Number.isFinite(expiry) || expiry <= this.#now()) throw new TypeError("current_prompt_unavailable");
-    if (hostProducerPromptRef(createHash5("sha256").update(prompt, "utf8").digest("hex")) !== identity.prompt_ref) throw new TypeError("current_prompt_unavailable");
-    this.#purge();
-    const key = promptKey(identity);
-    if (this.#consumed.has(key)) return;
-    if (!this.#records.has(key) && this.#records.size >= MAX_CURRENT_PROMPTS) {
-      const reportDiagnostic = !this.#capacityDiagnosticReported;
-      this.#capacityDiagnosticReported = true;
-      throw new HostCurrentPromptCapacityError(reportDiagnostic);
-    }
-    this.#records.set(key, { prompt, expires_at_ms: expiry });
-  }
-  /** Transfer this turn's prompt once while its bounded recent replay guard retains the identity. */
-  take(identity) {
-    this.#purge();
-    const key = promptKey(identity);
-    const prompt = this.#records.get(key)?.prompt;
-    if (prompt !== void 0) {
-      const expiresAt = this.#records.get(key)?.expires_at_ms;
-      this.#records.delete(key);
-      if (expiresAt !== void 0) this.#rememberConsumed(key, expiresAt);
-      this.#resetCapacityDiagnosticIfAvailable();
-    }
-    return prompt;
-  }
-  /** Release a prompt after its turn ends while retaining the same bounded replay guard. */
-  release(identity) {
-    this.#purge();
-    const key = promptKey(identity);
-    const record6 = this.#records.get(key);
-    if (record6 === void 0) return false;
-    this.#records.delete(key);
-    this.#rememberConsumed(key, record6.expires_at_ms);
-    this.#resetCapacityDiagnosticIfAvailable();
-    return true;
-  }
-  #rememberConsumed(key, expiresAt) {
-    this.#consumed.set(key, expiresAt);
-    while (this.#consumed.size > MAX_CONSUMED_PROMPTS) {
-      const oldest = this.#consumed.keys().next().value;
-      if (oldest === void 0) return;
-      this.#consumed.delete(oldest);
-    }
-  }
-  #purge() {
-    const now = this.#now();
-    for (const [key, value] of this.#records) if (value.expires_at_ms <= now) this.#records.delete(key);
-    for (const [key, expiresAt] of this.#consumed) if (expiresAt <= now) this.#consumed.delete(key);
-    this.#resetCapacityDiagnosticIfAvailable();
-  }
-  #resetCapacityDiagnosticIfAvailable() {
-    if (this.#records.size < MAX_CURRENT_PROMPTS) this.#capacityDiagnosticReported = false;
-  }
-};
-function promptKey(value) {
-  return [value.producer_id, value.producer_installation_ref, value.local_session_ref, value.local_turn_ref, value.prompt_ref].join("\0");
-}
-
-// host/relay/src/relay-ipc.ts
-var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
-  "schema_version",
-  "producer_id",
-  "producer_installation_ref",
-  "local_session_ref",
-  "local_turn_ref",
-  "local_turn_aliases",
-  "prompt_ref",
-  "request_ref",
-  "bound_at",
-  "host_source_ref",
-  "host_session_ref",
-  "host_turn_ref",
-  "host_input_ref"
-]);
+import { dirname as dirname5, join as join5 } from "node:path";
 var HOST_RELAY_IPC_RESPONSE_SCHEMA = "ceal.host_relay_admission.v1";
-var HOST_RELAY_BINDING_QUERY_SCHEMA = "ceal.host_relay_binding_query.v1";
-var HOST_RELAY_BINDING_RESULT_SCHEMA = "ceal.host_relay_binding_result.v1";
-var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v1";
-var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v1";
-var HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA = "ceal.host_relay_current_prompt_register.v1";
-var HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA = "ceal.host_relay_current_prompt_release.v1";
-var HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA = "ceal.host_relay_current_prompt_result.v1";
+var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v2";
+var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v2";
 var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
-var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
-  "context_stale",
-  "context_expired",
-  "host_source_refused",
-  "host_credential_refused",
-  "gateway_unavailable",
-  "gateway_refused",
-  "gateway_response_invalid",
-  "gateway_rate_limited",
-  "producer_frame_invalid",
-  "deadline",
-  "cancelled",
-  "mint_failed",
-  "relay_failed",
-  "request_authority_unavailable",
-  "request_missing",
-  "authority_mismatch",
-  "host_source_mismatch",
-  "host_session_mismatch",
-  "host_turn_mismatch",
-  "host_input_mismatch",
-  "host_prompt_mismatch"
-]);
-var HOST_RELAY_DIRECT_WIRE_MINT_REASONS = vocabulary([
-  "context_stale",
-  "context_expired",
-  "host_source_refused",
-  "host_credential_refused",
-  "gateway_unavailable",
-  "gateway_rate_limited",
-  "gateway_refused",
-  "gateway_response_invalid",
-  "producer_frame_invalid"
-]);
-var HostRelayInvocationMintRefusal = class extends Error {
-  reason;
-  constructor(reason) {
-    super(reason);
-    this.name = "HostRelayInvocationMintRefusal";
-    this.reason = reason;
-  }
-};
-var HOST_RELAY_INVOCATION_MINT_OUTCOMES = vocabulary(["completed", "caller_cancelled", "deadline", "failed", "no_binding"]);
 var HOST_RELAY_EXCHANGE_FAILURES = vocabulary([
   "permission_denied",
   "socket_missing",
@@ -3685,26 +3458,14 @@ var HostRelayIpcError = class extends Error {
 };
 async function startHostRelayIpcServer(options) {
   return withRelayEndpointLock(options.endpoint, async () => {
-    if (process.platform === "win32") {
-      await assertEndpointVacant(options.endpoint);
-    } else {
-      await assertTrustedEndpointParent(options.endpoint);
-      await removeStaleRelayEndpoint(options.endpoint, options.testHooks);
-    }
+    const lastSeenRequestBySession = /* @__PURE__ */ new Map();
+    if (process.platform === "win32") return startWindowsPipeServer(options, lastSeenRequestBySession);
+    await assertTrustedEndpointParent(options.endpoint);
+    await removeStaleRelayEndpoint(options.endpoint, options.testHooks);
     const active = /* @__PURE__ */ new Map();
     const sockets = /* @__PURE__ */ new Set();
     const quarantine = options.quarantine ?? options.admission.quarantine;
-    const currentPrompts = options.currentPrompts ?? new HostCurrentPromptCustody();
-    const server = createServer((socket) => serveSocket(socket, options, currentPrompts, quarantine, active, sockets));
-    if (process.platform === "win32") {
-      try {
-        await listen(server, options.endpoint);
-      } catch (error) {
-        await abandonRelayServer(server, sockets);
-        throw error;
-      }
-      return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
-    }
+    const server = createServer((socket) => serveSocket(socket, options, quarantine, active, sockets, Buffer.alloc(0), lastSeenRequestBySession));
     const staging = stagingRelayEndpoint(options.endpoint);
     await listenStagingRelayEndpoint(server, sockets, staging);
     let owned;
@@ -3728,39 +3489,105 @@ function encodeHostRelayIpcResponse(response2) {
   body.copy(result2, HOST_RELAY_IPC_LENGTH_BYTES);
   return result2;
 }
-function serveSocket(socket, options, currentPrompts, quarantine, active, sockets) {
-  const state = { buffer: Buffer.alloc(0), closed: false, tail: Promise.resolve(), abort: new AbortController() };
-  sockets.add(socket);
-  socket.on("data", (chunk) => {
-    state.buffer = Buffer.concat([state.buffer, Buffer.from(chunk)]);
-    state.tail = state.tail.then(() => drainFrames(socket, state, options, currentPrompts, quarantine, active)).catch(() => {
-      writeResponse(socket, errorResponse("relay_unavailable"));
-      socket.end();
+async function startWindowsPipeServer(options, lastSeenRequestBySession) {
+  if (options.pipeKey === void 0) throw new HostRelayIpcError("relay_unavailable", "Host Relay pipe key is unavailable; refusing to serve Windows pipe clients it cannot admit.");
+  const active = /* @__PURE__ */ new Map();
+  const sockets = /* @__PURE__ */ new Set();
+  const quarantine = options.quarantine ?? options.admission.quarantine;
+  const pipeKey = options.pipeKey;
+  const server = createServer((socket) => {
+    void admitWindowsPipeSocket(socket, options, quarantine, active, sockets, pipeKey, lastSeenRequestBySession);
+  });
+  try {
+    await listen(server, options.endpoint);
+  } catch (error) {
+    await abandonRelayServer(server, sockets);
+    throw await resolveWindowsPipeListenOutcome(options.endpoint, error);
+  }
+  return { endpoint: options.endpoint, close: () => closeServer(server, sockets, options.endpoint) };
+}
+async function admitWindowsPipeSocket(socket, options, quarantine, active, sockets, pipeKey, lastSeenRequestBySession) {
+  let leftover;
+  try {
+    leftover = await conductPipeServerHandshake(socket, pipeKey, RELAY_PIPE_HANDSHAKE_TIMEOUT_MS);
+  } catch {
+    socket.destroy();
+    return;
+  }
+  if (socket.destroyed) return;
+  serveSocket(socket, options, quarantine, active, sockets, leftover, lastSeenRequestBySession);
+}
+var HostRelayAlreadyRunningError = class extends Error {
+  constructor(endpoint) {
+    super(`another Host Relay already serves ${endpoint}; this instance exits without opening a second pipe.`);
+    this.name = "HostRelayAlreadyRunningError";
+  }
+};
+async function resolveWindowsPipeListenOutcome(endpoint, error, probe = windowsPipeHolderIsLive) {
+  if (pipeNameHeldError(error) && await probe(endpoint)) return new HostRelayAlreadyRunningError(endpoint);
+  return mapWindowsPipeListenError(endpoint, error);
+}
+function pipeNameHeldError(error) {
+  const code = errorCode7(error);
+  return code === "EADDRINUSE" || code === "EACCES";
+}
+function windowsPipeHolderIsLive(endpoint) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      probe.destroy();
+      resolve(false);
+    }, RELAY_PIPE_HANDSHAKE_TIMEOUT_MS);
+    const probe = createConnection(endpoint);
+    probe.once("connect", () => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve(true);
+    });
+    probe.once("error", () => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve(false);
     });
   });
+}
+function mapWindowsPipeListenError(endpoint, error) {
+  const code = errorCode7(error);
+  if (pipeNameHeldError(error)) {
+    return new HostRelayIpcError("relay_unavailable", `relay pipe name held by another process: the Host Relay pipe name ${endpoint} is already served (error ${code}); stop the process holding it, then restart the Host Relay.`);
+  }
+  return error instanceof Error ? error : new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is unavailable.");
+}
+function serveSocket(socket, options, quarantine, active, sockets, initial = Buffer.alloc(0), lastSeenRequestBySession = /* @__PURE__ */ new Map()) {
+  const state = { buffer: initial, closed: false, tail: Promise.resolve(), abort: new AbortController(), last_seen_request_by_session: lastSeenRequestBySession };
+  sockets.add(socket);
+  socket.on("data", (chunk) => receiveRelaySocketBytes(socket, state, options, quarantine, active, Buffer.from(chunk)));
   socket.once("error", () => closeConnection(socket, state, active, sockets));
   socket.once("close", () => closeConnection(socket, state, active, sockets));
   socket.once("end", () => {
-    if (state.buffer.length > 0 && isCurrentPromptWire(state.buffer)) {
-      writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-      socket.end();
-    } else if (state.buffer.length > 0) void quarantine.retainMalformed(state.buffer, "frame_truncated").finally(() => {
+    if (state.buffer.length > 0) void quarantine.retainMalformed(state.buffer, "frame_truncated").finally(() => {
       writeResponse(socket, errorResponse("frame_truncated"));
       socket.end();
     });
     else socket.end();
   });
+  if (initial.length > 0) receiveRelaySocketBytes(socket, state, options, quarantine, active, Buffer.alloc(0));
+}
+function receiveRelaySocketBytes(socket, state, options, quarantine, active, chunk) {
+  state.buffer = Buffer.concat([state.buffer, chunk]);
+  state.tail = state.tail.then(() => drainFrames(socket, state, options, quarantine, active)).catch(() => {
+    writeResponse(socket, errorResponse("relay_unavailable"));
+    socket.end();
+  });
 }
-async function drainFrames(socket, state, options, currentPrompts, quarantine, active) {
-  while (!state.closed && state.buffer.length >= HOST_RELAY_IPC_LENGTH_BYTES && await processBufferedRequest(socket, state, options, currentPrompts, quarantine, active)) {
+async function drainFrames(socket, state, options, quarantine, active) {
+  while (!state.closed && state.buffer.length >= HOST_RELAY_IPC_LENGTH_BYTES && await processBufferedRequest(socket, state, options, quarantine, active)) {
   }
 }
-async function processBufferedRequest(socket, state, options, currentPrompts, quarantine, active) {
+async function processBufferedRequest(socket, state, options, quarantine, active) {
   const length = state.buffer.readUInt32BE(0);
-  const promptWire = isCurrentPromptWire(state.buffer);
-  const maximum = promptWire ? HOST_CURRENT_PROMPT_MAX_BYTES + 4096 : HOST_PRODUCER_MAX_JSON_BYTES;
+  const maximum = HOST_PRODUCER_MAX_JSON_BYTES;
   if (length === 0 || length > maximum) {
-    await refuseInvalidBufferedRequest(socket, state.buffer, length, promptWire, quarantine);
+    await refuseInvalidBufferedRequest(socket, state.buffer, length, quarantine);
     state.buffer = Buffer.alloc(0);
     socket.end();
     return false;
@@ -3772,52 +3599,20 @@ async function processBufferedRequest(socket, state, options, currentPrompts, qu
   try {
     request2 = decodeIpcRequest(encoded);
   } catch (error) {
-    await refuseMalformedRequest(socket, encoded, promptWire, error, quarantine);
-    return true;
-  }
-  if (request2.schema_version === HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA || request2.schema_version === HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA) {
-    answerCurrentPromptRequest(socket, request2, currentPrompts, options.diagnostic_sink);
+    await refuseMalformedRequest(socket, encoded, error, quarantine);
     return true;
   }
-  const answered = await processHostQuery(socket, request2, options, currentPrompts, state.abort.signal);
-  if (answered === "closed") {
-    socket.end();
-    return false;
-  }
+  const answered = await processHostQuery(socket, state, options, request2);
   if (answered === "answered") return true;
   await processProducerRequest(socket, state, request2, encoded, options.admission, quarantine, active);
   return true;
 }
-function answerCurrentPromptRequest(socket, request2, currentPrompts, sink) {
-  if (request2.schema_version === HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA) {
-    currentPrompts.release(request2);
-    writeCurrentPromptResponse(socket, "released");
-    return;
-  }
-  try {
-    currentPrompts.register(request2, request2.current_prompt, request2.context_expires_at);
-    writeCurrentPromptResponse(socket, "registered");
-  } catch (error) {
-    if (error instanceof HostCurrentPromptCapacityError) {
-      if (error.report_diagnostic) writeHostServiceDiagnostic(request2.producer_id, "current_prompt_capacity_exhausted", void 0, void 0, sink);
-      writeCurrentPromptResponse(socket, "capacity_exhausted");
-    } else writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-  }
-}
-async function refuseInvalidBufferedRequest(socket, rawBuffer, length, promptWire, quarantine) {
-  if (promptWire) {
-    writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-    return;
-  }
+async function refuseInvalidBufferedRequest(socket, rawBuffer, length, quarantine) {
   const code = length === 0 ? "invalid_frame_length" : "frame_too_large";
   await quarantine.retainMalformed(rawBuffer.subarray(0, Math.min(rawBuffer.length, length + HOST_RELAY_IPC_LENGTH_BYTES)), code);
   writeResponse(socket, errorResponse(code));
 }
-async function refuseMalformedRequest(socket, encoded, promptWire, error, quarantine) {
-  if (promptWire) {
-    writeCurrentPromptResponse(socket, "current_prompt_unavailable");
-    return;
-  }
+async function refuseMalformedRequest(socket, encoded, error, quarantine) {
   const code = error instanceof HostProducerFrameError ? error.code : "invalid_frame_shape";
   await quarantine.retainMalformed(encoded, code);
   writeResponse(socket, errorResponse(code));
@@ -3833,29 +3628,19 @@ async function processProducerRequest(socket, state, request2, encoded, admissio
   }
   writeResponse(socket, admissionResponse(await admission.admit(request2)));
 }
-async function processHostQuery(socket, request2, options, currentPrompts, signal) {
-  if (request2.schema_version === HOST_RELAY_BINDING_QUERY_SCHEMA) {
-    let result2;
-    try {
-      result2 = await options.bindings.query(bindingQueryFromRequest(request2));
-    } catch {
-      return "closed";
-    }
-    writeBindingResponse(socket, result2);
-    return "answered";
-  }
-  if (request2.schema_version === HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) {
-    let response2;
-    const resolve = (invocationSignal) => resolveInvocationContext(request2, options.admission, options.bindings, currentPrompts, options.mintInvocationContext, invocationSignal);
-    try {
-      response2 = options.invocationMintTimeoutMs === void 0 && options.scheduleInvocationMintDeadline === void 0 && options.observeInvocationMint === void 0 ? await resolve(signal) : await observeInvocationMint(resolve, signal, options.invocationMintTimeoutMs, options.scheduleInvocationMintDeadline, options.observeInvocationMint);
-    } catch {
-      response2 = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "relay_failed" };
-    }
-    writeInvocationContextResponse(socket, response2);
-    return "answered";
+async function processHostQuery(socket, state, options, request2) {
+  if (request2.schema_version !== HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) return "not_a_query";
+  const sessionKey = `${request2.host_binding.host_source_ref}\0${request2.host_binding.host_session_ref}`;
+  const lastSeen = state.last_seen_request_by_session.get(sessionKey);
+  let response2;
+  try {
+    response2 = options.mintInvocationContext === void 0 ? { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "gateway_unavailable" } : await options.mintInvocationContext({ ...request2, ...lastSeen === void 0 ? {} : { last_seen_request_ref: lastSeen } }, state.abort.signal);
+  } catch {
+    response2 = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: "gateway_unavailable" };
   }
-  return "not_a_query";
+  if (response2.status === "ready") state.last_seen_request_by_session.set(sessionKey, response2.request_ref);
+  writeInvocationContextResponse(socket, response2);
+  return "answered";
 }
 function claimProducer(socket, state, frame, active) {
   const key = producerKey(frame);
@@ -3879,154 +3664,9 @@ function closeConnection(socket, state, active, sockets) {
 function writeResponse(socket, response2) {
   if (!socket.destroyed) socket.write(encodeHostRelayIpcResponse(response2));
 }
-function writeBindingResponse(socket, result2) {
-  const response2 = { schema_version: HOST_RELAY_BINDING_RESULT_SCHEMA, ...result2 };
-  if (!socket.destroyed) socket.write(encodeLengthPrefixed(response2));
-}
 function writeInvocationContextResponse(socket, response2) {
   if (!socket.destroyed) socket.write(encodeLengthPrefixed(response2));
 }
-function writeCurrentPromptResponse(socket, status) {
-  if (!socket.destroyed) socket.write(encodeLengthPrefixed({ schema_version: HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA, status }));
-}
-async function resolveInvocationContext(request2, admission, bindings, currentPrompts, mint, signal) {
-  if (mint === void 0) throw new HostRelayIpcError("relay_unavailable");
-  const query = bindingQueryFromRequest(request2);
-  const expectedSequences = pendingAdmissionSequences(await admission.snapshot(), query);
-  const binding = await waitForRequestBinding(query, admission, bindings, signal);
-  if (binding.status !== "ready") return await unboundInvocationContextRefusal(admission, await admission.snapshot(), query, expectedSequences) ?? { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "no_binding" };
-  const currentPrompt = currentPrompts.take({ producer_id: request2.producer_id, producer_installation_ref: request2.producer_installation_ref, local_session_ref: request2.local_session_ref, local_turn_ref: request2.local_turn_ref, prompt_ref: binding.binding.prompt_ref });
-  let result2;
-  try {
-    result2 = await mint({ client_nonce: request2.client_nonce, context_expires_at: binding.binding.context_expires_at ?? binding.binding.bound_at, request_work_context: relayRequestWorkContextFromBinding(binding.binding), ...currentPrompt === void 0 ? {} : { current_prompt: currentPrompt }, ...request2.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: request2.visible_output_max_bytes } }, signal);
-  } catch (error) {
-    return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: error instanceof HostRelayInvocationMintRefusal ? error.reason : "mint_failed" };
-  }
-  return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "ready", result: result2 };
-}
-async function unboundInvocationContextRefusal(admission, snapshot, query, expectedSequences) {
-  if (expectedSequences.length > 0) {
-    const refusal = snapshot.installations[`${query.producer_id}\0${query.producer_installation_ref}`]?.last_refusal;
-    if (refusal !== void 0 && expectedSequences.includes(refusal.sequence)) {
-      const reason2 = mintReasonForDeliveryRefusal(refusal.code, refusal.diagnostic);
-      if (reason2 !== void 0) return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: reason2 };
-    }
-  }
-  const selector = Object.freeze({
-    producer_id: query.producer_id,
-    producer_installation_ref: query.producer_installation_ref,
-    local_session_ref: query.local_session_ref,
-    local_turn_ref: query.local_turn_ref,
-    local_turn_aliases: Object.freeze([])
-  });
-  const match = await admission.quarantine.findNewestAttributedMatch(selector);
-  if (match === null) return null;
-  const reason = mintReasonForQuarantinedMatch(match);
-  if (reason === void 0) return null;
-  return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason };
-}
-function mintReasonForDeliveryRefusal(code, diagnostic) {
-  if (code !== "gateway_refused") return void 0;
-  if (diagnostic === void 0) return "gateway_refused";
-  return mintReasonForWireCause(projectCealHostAuthenticationCause(diagnostic));
-}
-function mintReasonForQuarantinedMatch(match) {
-  if (match === null) return void 0;
-  if (match.reason !== "gateway_refused") return "producer_frame_invalid";
-  const diagnostic = match.attribution?.diagnostic;
-  if (diagnostic === void 0) return void 0;
-  return mintReasonForWireCause(projectCealHostAuthenticationCause(diagnostic));
-}
-function mintReasonForWireCause(cause) {
-  if (isDirectWireCause(cause)) return cause;
-  if (cause === "relay_failed" || cause === "relay_unavailable" || cause === "options_invalid") return "relay_failed";
-  return "mint_failed";
-}
-function isDirectWireCause(cause) {
-  return isVocabularyWord(HOST_RELAY_DIRECT_WIRE_MINT_REASONS, cause);
-}
-function pendingAdmissionSequences(snapshot, query) {
-  const sequences = [];
-  for (const entry2 of snapshot.entries) {
-    const selector = extractHostBindingSelector(entry2.frame);
-    if (selector === null || !relayRequestBindingMatchesQuery(query, selector)) continue;
-    sequences.push(entry2.sequence);
-  }
-  return sequences;
-}
-async function waitForRequestBinding(query, admission, bindings, signal) {
-  let binding = await bindings.query(query);
-  if (binding.status === "ready") return binding;
-  while (await admission.hasPendingRequestBinding(query)) {
-    const cycle = new AbortController();
-    const cancelCycle = () => cycle.abort(signal.reason);
-    if (signal.aborted) cancelCycle();
-    else signal.addEventListener("abort", cancelCycle, { once: true });
-    try {
-      const changed = Promise.race([
-        bindings.waitForBinding(query, cycle.signal).then((result3) => ({ kind: "bound", result: result3 })),
-        admission.waitForDrainChange(cycle.signal).then(() => ({ kind: "drained" }))
-      ]).then((result3) => result3, (error) => ({ kind: "cancelled", error }));
-      binding = await bindings.query(query);
-      if (binding.status === "ready") return binding;
-      if (!await admission.hasPendingRequestBinding(query)) return await bindings.query(query);
-      const result2 = await changed;
-      if (result2.kind === "cancelled") throw result2.error;
-    } finally {
-      signal.removeEventListener("abort", cancelCycle);
-      cycle.abort("wait_cycle_complete");
-    }
-    binding = await bindings.query(query);
-    if (binding.status === "ready") return binding;
-  }
-  return await bindings.query(query);
-}
-async function observeInvocationMint(resolve, callerSignal, timeoutMs, scheduleDeadline, observe) {
-  const started = process.hrtime.bigint();
-  const controller2 = new AbortController();
-  let cancellation = null;
-  let outcome = "failed";
-  let reason;
-  const cancel = (cause) => {
-    if (cancellation === null) {
-      cancellation = cause;
-      controller2.abort(cause);
-    }
-  };
-  const callerCancelled = () => cancel("caller_cancelled");
-  const cancelled = new Promise((_resolve, reject) => controller2.signal.addEventListener("abort", () => reject(new Error("invocation mint cancelled")), { once: true }));
-  const clearDeadline = timeoutMs === void 0 ? () => void 0 : (scheduleDeadline ?? scheduleInvocationMintDeadline)(() => cancel("deadline"), timeoutMs);
-  if (callerSignal.aborted) callerCancelled();
-  else callerSignal.addEventListener("abort", callerCancelled, { once: true });
-  try {
-    const response2 = await Promise.race([resolve(controller2.signal), cancelled]);
-    ({ outcome, reason } = invocationMintObservationForResponse(response2));
-    return response2;
-  } catch {
-    ({ outcome, reason } = invocationMintObservationForCancellation(cancellation));
-    return { schema_version: HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA, status: "refused", reason: reason ?? "relay_failed" };
-  } finally {
-    clearDeadline();
-    callerSignal.removeEventListener("abort", callerCancelled);
-    observe?.({ outcome, elapsed_ms: Number((process.hrtime.bigint() - started) / 1000000n), ...reason === void 0 ? {} : { reason } });
-  }
-}
-function invocationMintObservationForResponse(response2) {
-  if (response2.status === "no_binding") return { outcome: "no_binding" };
-  if (response2.status === "ready") return { outcome: "completed" };
-  if (response2.reason === "deadline") return { outcome: "deadline", reason: "deadline" };
-  if (response2.reason === "cancelled") return { outcome: "caller_cancelled", reason: "cancelled" };
-  return { outcome: "failed", reason: response2.reason };
-}
-function invocationMintObservationForCancellation(cancellation) {
-  if (cancellation === "deadline") return { outcome: "deadline", reason: "deadline" };
-  if (cancellation === "caller_cancelled") return { outcome: "caller_cancelled", reason: "cancelled" };
-  return { outcome: "failed", reason: "relay_failed" };
-}
-function scheduleInvocationMintDeadline(expire, milliseconds) {
-  const timeout = setTimeout(expire, milliseconds);
-  return () => clearTimeout(timeout);
-}
 function admissionResponse(result2) {
   return { schema_version: HOST_RELAY_IPC_RESPONSE_SCHEMA, ...result2 };
 }
@@ -4036,52 +3676,45 @@ function errorResponse(code) {
 function producerKey(frame) {
   return `${frame.producer_id}\0${frame.producer_installation_ref}`;
 }
-function record4(value) {
+function record3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function decodeIpcRequest(input) {
-  const value = decodeLengthPrefixedJson(input, Math.max(HOST_PRODUCER_MAX_JSON_BYTES, HOST_CURRENT_PROMPT_MAX_BYTES + 4096));
+  const value = decodeLengthPrefixedJson(input, HOST_PRODUCER_MAX_JSON_BYTES);
   const local = decodeLocalRequest(value);
   if (local !== void 0) return local;
   return decodeHostProducerFrame(input);
 }
 function decodeLocalRequest(value) {
-  if (!record4(value)) return void 0;
-  if (value.schema_version === HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA) {
-    if (!validCurrentPromptRegisterRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
-    return value;
-  }
-  if (value.schema_version === HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA) {
-    if (!validCurrentPromptReleaseRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
-    return value;
-  }
-  if (value.schema_version === HOST_RELAY_BINDING_QUERY_SCHEMA) {
-    if (!validBindingQueryRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
-    return value;
-  }
+  if (!record3(value)) return void 0;
   if (value.schema_version === HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) {
     if (!validInvocationContextQueryRequest(value)) throw new HostProducerFrameError("invalid_frame_shape");
     return value;
   }
   return void 0;
 }
-function validCurrentPromptRegisterRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "prompt_ref", "current_prompt", "context_expires_at"]) && safeRef3(value.prompt_ref) && typeof value.current_prompt === "string" && Buffer.byteLength(value.current_prompt, "utf8") > 0 && Buffer.byteLength(value.current_prompt, "utf8") <= HOST_CURRENT_PROMPT_MAX_BYTES && validTimestamp2(value.context_expires_at);
-}
-function validCurrentPromptReleaseRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "prompt_ref"]) && safeRef3(value.prompt_ref);
-}
-function validBindingQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_BINDING_QUERY_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]);
-}
-function bindingQueryFromRequest(value) {
-  return { producer_id: value.producer_id, producer_installation_ref: value.producer_installation_ref, local_session_ref: value.local_session_ref, local_turn_ref: value.local_turn_ref };
-}
 function validInvocationContextQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) && exactKeys4(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "client_nonce"], ["visible_output_max_bytes"]) && typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
+  if (!validQueryEnvelope(value)) return false;
+  try {
+    decodeCealHostInvocationContextRequest({
+      schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+      client_nonce: value.client_nonce,
+      context_expires_at: value.context_expires_at,
+      host_binding: value.host_binding,
+      human_message_window: value.human_message_window,
+      ...value.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: value.visible_output_max_bytes }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function validQueryEnvelope(value) {
+  if (!validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) || !exactKeys3(value, ["schema_version", "producer_id", "producer_installation_ref", "client_nonce", "context_expires_at", "host_binding", "human_message_window"], ["visible_output_max_bytes"])) return false;
+  return typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce) && typeof value.context_expires_at === "string" && (value.visible_output_max_bytes === void 0 || validVisibleOutputBudget(value.visible_output_max_bytes));
 }
 function validQueryIdentity(value, schema) {
-  return record4(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef3(value.producer_installation_ref) && safeRef3(value.local_session_ref) && safeRef3(value.local_turn_ref);
+  return record3(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef2(value.producer_installation_ref);
 }
 function validVisibleOutputBudget(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= CEAL_CANONICAL_HTTP_MAX_RESPONSE_BYTES;
@@ -4105,33 +3738,13 @@ function encodeLengthPrefixed(value) {
   body.copy(output, HOST_RELAY_IPC_LENGTH_BYTES);
   return output;
 }
-function isCurrentPromptWire(value) {
-  return currentPromptRegisterWire(value) || currentPromptReleaseWire(value);
-}
-function currentPromptRegisterWire(value) {
-  return value.subarray(HOST_RELAY_IPC_LENGTH_BYTES, Math.min(value.length, HOST_RELAY_IPC_LENGTH_BYTES + 128)).includes(Buffer.from(`"schema_version":"${HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA}"`, "utf8"));
-}
-function currentPromptReleaseWire(value) {
-  return value.subarray(HOST_RELAY_IPC_LENGTH_BYTES, Math.min(value.length, HOST_RELAY_IPC_LENGTH_BYTES + 128)).includes(Buffer.from(`"schema_version":"${HOST_RELAY_CURRENT_PROMPT_RELEASE_SCHEMA}"`, "utf8"));
-}
-function exactKeys4(value, required, optional = []) {
+function exactKeys3(value, required, optional = []) {
   const keys = Object.keys(value);
   return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || optional.includes(key));
 }
-function safeRef3(value) {
+function safeRef2(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
-function validTimestamp2(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
-async function assertEndpointVacant(endpoint) {
-  try {
-    await lstat3(endpoint);
-    throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint is already present.");
-  } catch (error) {
-    if (errorCode8(error) !== "ENOENT") throw error;
-  }
-}
 function listen(server, endpoint) {
   return new Promise((resolve, reject) => {
     server.once("error", reject);
@@ -4144,7 +3757,7 @@ function listen(server, endpoint) {
 async function closeServer(server, sockets, endpoint) {
   for (const socket of sockets) socket.destroy();
   await new Promise((resolve) => server.close(() => resolve()));
-  if (process.platform !== "win32") await unlink2(endpoint).catch(() => void 0);
+  if (process.platform !== "win32") await unlink3(endpoint).catch(() => void 0);
 }
 var relayEndpointLocks = /* @__PURE__ */ new Map();
 function withRelayEndpointLock(endpoint, run) {
@@ -4164,7 +3777,7 @@ function currentUid(fallback) {
   return typeof process.geteuid === "function" ? process.geteuid() : fallback;
 }
 async function assertTrustedEndpointParent(endpoint) {
-  const parent = dirname3(endpoint);
+  const parent = dirname5(endpoint);
   let stats;
   try {
     stats = await lstat3(parent);
@@ -4189,7 +3802,7 @@ function probeRelayEndpoint(endpoint) {
     timer.unref?.();
     socket.once("connect", () => finish("live"));
     socket.once("error", (error) => {
-      const code = errorCode8(error);
+      const code = errorCode7(error);
       if (code === "ECONNREFUSED") finish("stale");
       else if (code === "ENOENT") finish("missing");
       else finish("ambiguous");
@@ -4224,7 +3837,7 @@ async function readEndpointStats(endpoint) {
   try {
     return await lstat3(endpoint);
   } catch (error) {
-    if (errorCode8(error) === "ENOENT") return null;
+    if (errorCode7(error) === "ENOENT") return null;
     throw new HostRelayIpcError("relay_unavailable", "Host Relay IPC endpoint identity is ambiguous; leaving it untouched.");
   }
 }
@@ -4233,17 +3846,17 @@ function requireSameEndpointIdentity(current, owned, message) {
 }
 async function unlinkRelayEndpoint(endpoint) {
   try {
-    await unlink2(endpoint);
+    await unlink3(endpoint);
   } catch (error) {
-    if (errorCode8(error) !== "ENOENT") throw error;
+    if (errorCode7(error) !== "ENOENT") throw error;
   }
 }
 var relayStagingSequence = 0;
 function stagingRelayEndpoint(canonical) {
-  const parent = dirname3(canonical);
+  const parent = dirname5(canonical);
   const pid = process.pid.toString(36);
   const sequence = (relayStagingSequence++ % (36 * 36)).toString(36);
-  return join6(parent, `.r${pid}${sequence}`);
+  return join5(parent, `.r${pid}${sequence}`);
 }
 async function readStagingRelayEndpointIdentity(staging) {
   let created;
@@ -4300,8 +3913,121 @@ async function abandonRelayServer(server, sockets) {
     server.close(() => resolve());
   });
 }
-function errorCode8(error) {
-  return record4(error) && typeof error.code === "string" ? error.code : null;
+function errorCode7(error) {
+  return record3(error) && typeof error.code === "string" ? error.code : null;
+}
+
+// host/relay/src/host-registration-state.ts
+import { constants as constants3 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
+var HOST_REGISTRATION_STATE_SCHEMA = "ceal.host_registration_state.v1";
+var HOST_REGISTRATION_STATE_KEYS = Object.freeze([
+  "credential_generation",
+  "gateway_request_origin",
+  "host_access_token",
+  "host_installation_ref",
+  "host_source_ref",
+  "registration_attempt_ref",
+  "schema_version",
+  "status"
+]);
+var HOST_REGISTRATION_STATE_MAX_BYTES = 65536;
+var HostRegistrationStateError = class extends Error {
+  name = "HostRegistrationStateError";
+  code = "credential";
+};
+async function readHostRegistrationAuthority(path, expectedHostSourceRef, platform = process.platform, custody = {}) {
+  let raw;
+  try {
+    await assertPrivateRegistrationDirectory(dirname6(path), platform, custody);
+    raw = platform === "win32" ? await readWindowsRegistration(path, custody) : await readPosixRegistration(path, platform, custody);
+  } catch (error) {
+    throw registrationReadError(error);
+  }
+  if (Buffer.byteLength(raw, "utf8") > HOST_REGISTRATION_STATE_MAX_BYTES) throw new HostRegistrationStateError(`Host registration state is invalid: ${refusalFact("registration_state_bytes", Buffer.byteLength(raw, "utf8"), `at most ${HOST_REGISTRATION_STATE_MAX_BYTES}`)}.`);
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new HostRegistrationStateError("Host registration state is invalid.");
+  }
+  return decodeHostRegistrationAuthority(value, expectedHostSourceRef);
+}
+async function readWindowsRegistration(path, custody) {
+  const bytes2 = await readPrivateFileWithSecurefs(path, HOST_REGISTRATION_STATE_MAX_BYTES, custody);
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+  } catch {
+    throw new HostRegistrationStateError("Host registration state is invalid.");
+  }
+}
+async function readPosixRegistration(path, platform, custody) {
+  const handle = await openNoFollow(path, constants3.O_RDONLY, void 0, platform, custody);
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid, platform, handle) || !isPrivateFileMode(stats.mode, platform, handle)) throw new HostRegistrationStateError("Host registration file is not private to its owner.");
+    return await handle.readFile("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+function registrationReadError(error) {
+  if (error instanceof HostRegistrationStateError) return error;
+  if (error instanceof SecureFileCustodyError && error.reason === "not_private") return new HostRegistrationStateError("Host registration file is not private to its owner.");
+  return new HostRegistrationStateError("Host registration file is unavailable.");
+}
+function decodeHostRegistrationAuthority(value, expectedHostSourceRef) {
+  const keys = HOST_REGISTRATION_STATE_KEYS;
+  const fieldCount = record4(value) ? Object.keys(value).length : 0;
+  const missing = record4(value) ? keys.filter((key) => !Object.hasOwn(value, key)).length : keys.length;
+  if (!record4(value) || fieldCount !== keys.length || missing !== 0) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "registration_field_count", value: fieldCount, expected: `exactly ${keys.length}` }, { name: "missing_registration_field_count", value: missing, expected: "0" }])}.`);
+  if (!validRegistrationIdentity(value, expectedHostSourceRef)) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "schema_version", value: value.schema_version, expected: HOST_REGISTRATION_STATE_SCHEMA }, { name: "status", value: value.status, expected: "active" }, { name: "host_source_ref", value: value.host_source_ref, expected: expectedHostSourceRef }, { name: "registration_attempt_ref", value: value.registration_attempt_ref, expected: "host-registration-attempt:<uuid>" }, { name: "host_installation_ref", value: value.host_installation_ref, expected: "host-installation:<uuid>" }])}.`);
+  if (!validRegistrationCredential(value)) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFacts([{ name: "credential_generation", value: value.credential_generation, expected: "a positive safe integer" }, { name: "host_access_token_matches_registered_shape", value: validHostAccessToken(value.host_access_token), expected: "true" }])}.`);
+  if (!validGatewayOrigin(value.gateway_request_origin)) throw new HostRegistrationStateError(`Host registration state is invalid or does not match this Relay: ${refusalFact("gateway_request_origin", value.gateway_request_origin, "an HTTPS origin or explicit-port loopback HTTP origin")}.`);
+  return { gateway_request_origin: value.gateway_request_origin, host_access_token: value.host_access_token };
+}
+function validRegistrationIdentity(value, expectedHostSourceRef) {
+  return value.schema_version === HOST_REGISTRATION_STATE_SCHEMA && value.status === "active" && value.host_source_ref === expectedHostSourceRef && typeof value.registration_attempt_ref === "string" && CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN.test(value.registration_attempt_ref) && typeof value.host_installation_ref === "string" && CEAL_HOST_INSTALLATION_REF_PATTERN.test(value.host_installation_ref) && typeof value.host_source_ref === "string" && hostSourceUuid(value.host_source_ref) !== null;
+}
+function validRegistrationCredential(value) {
+  return Number.isSafeInteger(value.credential_generation) && Number(value.credential_generation) > 0 && validHostAccessToken(value.host_access_token);
+}
+function validHostAccessToken(value) {
+  return typeof value === "string" && CEAL_HOST_ACCESS_TOKEN_PATTERN.test(value);
+}
+function validGatewayOrigin(value) {
+  try {
+    if (typeof value !== "string" || /\s|\0/u.test(value)) return false;
+    const parsed = new URL(value);
+    const hostname = parsed.hostname.toLowerCase().replace(/\.+$/u, "");
+    return hostname !== "" && validGatewayPort(parsed.port) && (loopbackHttpOrigin(parsed, hostname) || parsed.protocol === "https:") && cleanOriginPath(parsed) && bareOriginSuffix(value);
+  } catch {
+    return false;
+  }
+}
+function loopbackHttpOrigin(parsed, hostname) {
+  return parsed.protocol === "http:" && parsed.port !== "" && (hostname === "127.0.0.1" || hostname === "[::1]");
+}
+function validGatewayPort(port) {
+  if (port === "") return true;
+  const numeric = Number(port);
+  return Number.isInteger(numeric) && numeric >= 1 && numeric <= 65535;
+}
+function cleanOriginPath(parsed) {
+  return parsed.username === "" && parsed.password === "" && parsed.pathname === "/" && parsed.search === "" && parsed.hash === "";
+}
+function bareOriginSuffix(value) {
+  const schemeEnd = value.indexOf("://");
+  const authority = schemeEnd < 0 ? "" : value.slice(schemeEnd + 3);
+  const suffixOffset = authority.search(/[\\/?#]/u);
+  const rawSuffix = suffixOffset < 0 ? "" : authority.slice(suffixOffset);
+  return rawSuffix === "" || rawSuffix === "/";
+}
+async function assertPrivateRegistrationDirectory(path, platform, custody) {
+  if (!await isPrivateDirectory(path, platform, custody)) throw new HostRegistrationStateError("Host registration directory is not private to its owner.");
+}
+function record4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
 // host/relay/src/host-relay-runtime.ts
@@ -4317,16 +4043,24 @@ var HostRelayConfigError = class extends Error {
     this.code = code;
   }
 };
-async function readHostRelayConfig(path) {
+async function readHostRelayConfig(path, platform = process.platform, custody = {}) {
   if (!isAbsoluteNormalizedNonRootPath(path, process.platform, true)) throw new HostRelayConfigError("invalid_config_path", `invalid_config_path: Host Relay config path is invalid: ${refusalFact("config_path", path, "absolute, normalized, and non-root")}.`);
   let handle;
   try {
-    await assertOwnerPrivateDirectory2(dirname4(path));
-    handle = await open5(path, O_RDONLY4 | O_NOFOLLOW3);
-    const stats = await handle.stat();
-    if (!stats.isFile() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not owner-private.");
-    if (stats.size < HOST_RELAY_CONFIG_MIN_BYTES || stats.size > HOST_RELAY_CONFIG_MAX_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", stats.size, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
-    const text = await handle.readFile("utf8");
+    await assertPrivateRelayConfigDirectory(dirname7(path), platform, custody);
+    let text;
+    if (platform === "win32") {
+      const bytes2 = await readPrivateFileWithSecurefs(path, HOST_RELAY_CONFIG_MAX_BYTES, custody);
+      if (bytes2.byteLength < HOST_RELAY_CONFIG_MIN_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", bytes2.byteLength, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
+      try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+      } catch {
+        throw new HostRelayConfigError("invalid_json", "Host Relay config is not valid UTF-8 JSON.");
+      }
+    } else {
+      handle = await openPrivateRelayConfigFile(path, platform, custody);
+      text = await handle.readFile("utf8");
+    }
     assertNoDuplicateJsonKeys(text);
     let value;
     try {
@@ -4334,114 +4068,236 @@ async function readHostRelayConfig(path) {
     } catch {
       throw new HostRelayConfigError("invalid_json", "Host Relay config is not JSON.");
     }
-    const config = decodeHostRelayConfig(value);
+    const decoded = decodeHostRelayConfig(value);
+    const config = resolveRelayIpcEndpoint(decoded);
     validateHostRelaySourcePaths(config);
     return config;
   } catch (error) {
-    if (error instanceof HostRelayConfigError) throw error;
-    throw new HostRelayConfigError("config_unavailable", "Host Relay config is unavailable.");
+    throw relayConfigReadError(error);
   } finally {
     await handle?.close();
   }
 }
+async function openPrivateRelayConfigFile(path, platform, custody) {
+  const handle = await openNoFollow(path, constants4.O_RDONLY, void 0, platform, custody);
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || !isSelfOwned(stats.uid, platform, handle) || !isPrivateFileMode(stats.mode, platform, handle)) throw new HostRelayConfigError("config_not_private", "Host Relay config file is not private to its owner.");
+    if (stats.size < HOST_RELAY_CONFIG_MIN_BYTES || stats.size > HOST_RELAY_CONFIG_MAX_BYTES) throw new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config size is invalid: ${refusalFact("config_bytes", stats.size, `between ${HOST_RELAY_CONFIG_MIN_BYTES} and ${HOST_RELAY_CONFIG_MAX_BYTES}`)}.`);
+    return handle;
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+function relayConfigReadError(error) {
+  if (error instanceof HostRelayConfigError) return error;
+  if (error instanceof SecureFileCustodyError && error.reason === "not_private") return new HostRelayConfigError("config_not_private", "Host Relay config file is not private to its owner.");
+  if (error instanceof SecureFileCustodyError && error.reason === "too_large") return new HostRelayConfigError("invalid_config", `invalid_config: Host Relay config exceeds ${HOST_RELAY_CONFIG_MAX_BYTES} bytes.`);
+  return new HostRelayConfigError("config_unavailable", "Host Relay config is unavailable.");
+}
+async function assertPrivateRelayConfigDirectory(path, platform, custody) {
+  try {
+    if (!await isPrivateDirectory(path, platform, custody)) throw new HostRelayConfigError("config_not_private", "Host Relay config directory is not private to its owner.");
+  } catch (error) {
+    if (error instanceof HostRelayConfigError) throw error;
+    throw new HostRelayConfigError("config_unavailable", "Host Relay config directory is unavailable.");
+  }
+}
+function resolveRelayIpcEndpoint(decoded) {
+  if (process.platform !== "win32") return decoded;
+  const endpoint = assertHostRelaySourcePaths(dirname7(decoded.registration_state_file), decoded);
+  return endpoint === decoded.ipc_endpoint ? decoded : { ...decoded, ipc_endpoint: endpoint };
+}
 function validateHostRelaySourcePaths(config) {
   try {
-    assertHostRelaySourcePaths(dirname4(config.registration_state_file), config);
+    assertHostRelaySourcePaths(dirname7(config.registration_state_file), config);
   } catch (error) {
     throw new HostRelayConfigError("invalid_config", error instanceof Error ? error.message : "Host Relay source tuple is invalid.");
   }
 }
-function decodeHostRelayConfig(value) {
-  const required = ["schema_version", "registration_state_file", "host_source_ref", "state_root", "ipc_endpoint"];
-  const optional = ["drain_interval_ms", "gateway_timeout_ms"];
-  if (!record5(value) || !exactOptionalKeys2(value, required, optional) || !validConfigIdentity(value) || !validConfigRuntime(value)) {
-    throw new HostRelayConfigError("invalid_config", "Host Relay config shape is invalid.");
+function decodeHostRelayConfig(value, platform = process.platform) {
+  const ignoreEndpoint = platform === "win32";
+  const required = ignoreEndpoint ? ["schema_version", "registration_state_file", "host_source_ref", "state_root"] : ["schema_version", "registration_state_file", "host_source_ref", "state_root", "ipc_endpoint"];
+  const optional = ignoreEndpoint ? ["ipc_endpoint", "drain_interval_ms"] : ["drain_interval_ms"];
+  if (!record5(value) || !exactOptionalKeys2(value, required, optional) || !validConfigIdentity(value, platform) || !validConfigRuntime(value, platform)) {
+    throw new HostRelayConfigError("invalid_config", `Host Relay config shape is invalid: ${refusalFacts(relayShapeFacts(value, required, optional, platform))}.`);
   }
   return {
     schema_version: HOST_RELAY_CONFIG_SCHEMA,
     registration_state_file: value.registration_state_file,
     host_source_ref: value.host_source_ref,
     state_root: value.state_root,
-    ipc_endpoint: value.ipc_endpoint,
-    drain_interval_ms: value.drain_interval_ms ?? 250,
-    gateway_timeout_ms: value.gateway_timeout_ms ?? 5e3
+    ipc_endpoint: typeof value.ipc_endpoint === "string" ? value.ipc_endpoint : "",
+    drain_interval_ms: value.drain_interval_ms ?? 250
   };
 }
-function validConfigIdentity(value) {
-  return value.schema_version === HOST_RELAY_CONFIG_SCHEMA && isAbsoluteNormalizedNonRootPath(value.registration_state_file, process.platform, true) && opaqueHostSourceRef(value.host_source_ref);
+function validConfigIdentity(value, platform) {
+  return value.schema_version === HOST_RELAY_CONFIG_SCHEMA && isAbsoluteNormalizedNonRootPath(value.registration_state_file, platform, true) && opaqueHostSourceRef(value.host_source_ref);
 }
-function validConfigRuntime(value) {
-  return isAbsoluteNormalizedNonRootPath(value.state_root, process.platform, true) && isAbsoluteNormalizedNonRootPath(value.ipc_endpoint, process.platform, true) && boundedInteger(value.drain_interval_ms, 50, 3e4, true) && boundedInteger(value.gateway_timeout_ms, 100, 6e4, true);
+function relayShapeFacts(value, required, optional, platform) {
+  if (!record5(value)) return [{ name: "config", value: "wrong_type", expected: "a record" }];
+  const facts = [
+    ...Object.keys(value).filter((key) => !required.includes(key) && !optional.includes(key)).map((key) => ({ name: key, value: "unknown", expected: `one of ${[...required, ...optional].join(", ")}` })),
+    ...required.filter((key) => !Object.hasOwn(value, key)).map((key) => ({ name: key, value: "missing", expected: "present" }))
+  ];
+  if (Object.hasOwn(value, "schema_version") && value.schema_version !== HOST_RELAY_CONFIG_SCHEMA) facts.push({ name: "schema_version", value: "wrong_type", expected: HOST_RELAY_CONFIG_SCHEMA });
+  for (const fact of relayValueFacts(value, platform)) facts.push(fact);
+  return facts;
+}
+function relayValueFacts(value, platform) {
+  const facts = [];
+  for (const key of platform === "win32" ? ["registration_state_file", "state_root"] : ["registration_state_file", "state_root", "ipc_endpoint"]) {
+    if (Object.hasOwn(value, key) && !isAbsoluteNormalizedNonRootPath(value[key], platform, true)) facts.push({ name: key, value: "wrong_type", expected: "an absolute normalized non-root path" });
+  }
+  if (Object.hasOwn(value, "host_source_ref") && !opaqueHostSourceRef(value.host_source_ref)) facts.push({ name: "host_source_ref", value: "wrong_type", expected: "a host source reference" });
+  if (Object.hasOwn(value, "drain_interval_ms") && !boundedInteger(value.drain_interval_ms, 50, 3e4, true)) facts.push({ name: "drain_interval_ms", value: "wrong_type", expected: "between 50 and 30000" });
+  return facts;
+}
+function validConfigRuntime(value, platform) {
+  return isAbsoluteNormalizedNonRootPath(value.state_root, platform, true) && (platform === "win32" || isAbsoluteNormalizedNonRootPath(value.ipc_endpoint, platform, true)) && boundedInteger(value.drain_interval_ms, 50, 3e4, true);
 }
 var HOST_RELAY_INVOCATION_MINT_LOG_TAG = "[host-relay-invocation-mint]";
-var HOST_RELAY_INVOCATION_MINT_LINE = new RegExp(`^${HOST_RELAY_INVOCATION_MINT_LOG_TAG.replace(/[[\]]/gu, "\\$&")} outcome=([a-z_]+)(?: reason=([a-z][a-z0-9_]{0,63}))? elapsed_ms=[0-9]+$`, "u");
+function formatHostRelayInvocationMintLine(result2) {
+  return `${HOST_RELAY_INVOCATION_MINT_LOG_TAG} outcome=${result2.status === "ready" ? "completed" : "failed"}${result2.status === "refused" ? ` reason=${result2.reason}` : ""}`;
+}
+function reportInvocationMintLine(line) {
+  try {
+    process.stderr.write(line);
+  } catch {
+  }
+  writeHostServiceLogLine(line);
+}
 async function serveHostRelay(config, signal, dependencies = {}) {
-  const admission = new RelayAdmissionStore(join7(config.state_root, "admission"));
-  const bindings = new RelayRequestBindingStore(join7(config.state_root, "bindings"));
-  const gateway = (dependencies.createGateway ?? createHostRelayGatewayHttpPort)({ registration_state_file: config.registration_state_file, host_source_ref: config.host_source_ref });
-  const bridge = new RelayGatewayBridge({ state_root: join7(config.state_root, "gateway"), host_source_ref: config.host_source_ref, gateway, timeout_ms: config.gateway_timeout_ms, on_request_bound: async (binding) => {
-    await bindings.bind(binding);
-  } });
+  const admission = new RelayAdmissionStore(join6(config.state_root, "admission"));
   let server;
   try {
-    server = await startHostRelayRuntimeIpc(config, admission, bindings, gateway, dependencies);
-    while (!signal.aborted) {
-      const round = await admission.drainRound((input) => bridge.deliver(input), { now_ms: (dependencies.now ?? Date.now)(), host_source_ref: config.host_source_ref });
-      if (round.delivered.length === 0 && round.refused.length === 0) await (dependencies.wait ?? ((milliseconds, waitSignal) => waitForAbort(waitSignal, milliseconds)))(config.drain_interval_ms, signal);
-    }
+    const pipeKey = process.platform === "win32" ? await loadRelayPipeKey(config.state_root) : void 0;
+    server = await startHostRelayRuntimeIpc(config, admission, dependencies, pipeKey);
+    await waitForRelayShutdown(config, signal, dependencies);
+  } catch (error) {
+    if (error instanceof HostRelayAlreadyRunningError) return;
+    throw error;
   } finally {
     await server?.close();
   }
 }
-async function startHostRelayRuntimeIpc(config, admission, bindings, gateway, dependencies) {
+async function waitForRelayShutdown(config, signal, dependencies) {
+  while (!signal.aborted) await (dependencies.wait ?? ((milliseconds, waitSignal) => waitForAbort(waitSignal, milliseconds)))(config.drain_interval_ms, signal);
+}
+async function startHostRelayRuntimeIpc(config, admission, dependencies, pipeKey) {
   return (dependencies.startIpc ?? startHostRelayIpcServer)({
     endpoint: config.ipc_endpoint,
     admission,
-    bindings,
-    mintInvocationContext: (input, invocationSignal) => mintInvocationContext(gateway, input, invocationSignal),
-    invocationMintTimeoutMs: config.gateway_timeout_ms,
-    scheduleInvocationMintDeadline: dependencies.scheduleInvocationMintDeadline ?? scheduleInvocationMintDeadline2,
-    observeInvocationMint: dependencies.observeInvocationMint ?? reportInvocationMint
+    ...pipeKey === void 0 ? {} : { pipeKey },
+    mintInvocationContext: async (input, signal) => {
+      let result2;
+      try {
+        result2 = await mintInvocationContextAtGateway(config, input, signal, dependencies.fetch ?? fetch);
+      } catch (error) {
+        const refused = { schema_version: "ceal.host_relay_invocation_context_result.v2", status: "refused", reason: "gateway_unavailable" };
+        (dependencies.logInvocationMint ?? reportInvocationMintLine)(`${formatHostRelayInvocationMintLine(refused)}
+`);
+        throw error;
+      }
+      (dependencies.logInvocationMint ?? reportInvocationMintLine)(`${formatHostRelayInvocationMintLine(result2)}
+`);
+      return result2;
+    }
   });
 }
-async function mintInvocationContext(gateway, input, signal) {
+async function mintInvocationContextAtGateway(config, input, signal, fetchGateway) {
   try {
-    return await gateway.mintInvocationContext(input, signal);
+    const registration = await readHostRegistrationAuthority(config.registration_state_file, config.host_source_ref);
+    return gatewayMintPost(registration, input, signal, fetchGateway);
   } catch (error) {
-    const cancellation = signal.reason === "deadline" ? "deadline" : signal.reason === "caller_cancelled" ? "caller_cancelled" : null;
-    throw new HostRelayInvocationMintRefusal(invocationMintRefusalReason(error, cancellation));
+    return gatewayMintFailure(signal, error);
   }
 }
-function invocationMintRefusalReason(error, cancellation) {
-  if (cancellation === "deadline") return "deadline";
-  if (cancellation === "caller_cancelled") return "cancelled";
-  if (!(error instanceof HostRelayGatewayError)) return "mint_failed";
-  if (error.code === "credential") return "host_credential_refused";
-  if (error.code === "gateway_unavailable") return "gateway_unavailable";
-  if (error.code === "invalid_response") return "gateway_response_invalid";
-  if (error.code !== "gateway_refused") return "mint_failed";
-  return gatewayMintRefusalReason(error);
-}
-function gatewayMintRefusalReason(error) {
-  if (error.error_code === "request_context_refused" && isVocabularyWord(CEAL_HOST_MINT_REQUEST_CONTEXT_REFUSAL_REASONS, error.refusal_reason)) return error.refusal_reason;
-  return GATEWAY_MINT_REFUSAL_REASONS.get(error.error_code ?? "") ?? "gateway_refused";
-}
-var GATEWAY_MINT_REFUSAL_REASONS = /* @__PURE__ */ new Map([
-  ["request_context_refused", "context_stale"],
-  ["context_expired", "context_expired"],
-  ["host_source_refused", "host_source_refused"],
-  ["host_invocation_context_unavailable", "gateway_unavailable"]
-]);
-function scheduleInvocationMintDeadline2(expire, milliseconds) {
-  const timeout = setTimeout(expire, milliseconds);
-  return () => clearTimeout(timeout);
+async function gatewayMintPost(registration, input, signal, fetchGateway) {
+  const serialized = JSON.stringify(gatewayMintBody(input));
+  if (Buffer.byteLength(serialized, "utf8") > CEAL_HOST_INVOCATION_CONTEXT_REQUEST_MAX_BYTES) return mintRefusal("producer_frame_invalid");
+  const response2 = await fetchGateway(`${registration.gateway_request_origin}${CEAL_HOST_INVOCATION_CONTEXT_PATH}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${registration.host_access_token}`, "content-type": "application/json" },
+    body: serialized,
+    signal
+  });
+  const raw = await readBoundedResponseText(response2, 8192);
+  return decodeGatewayMintResponse(response2, raw);
 }
-function reportInvocationMint(observation) {
-  process.stderr.write(`${formatHostRelayInvocationMintLine(observation)}
-`);
+function gatewayMintBody(input) {
+  return {
+    schema_version: CEAL_HOST_INVOCATION_CONTEXT_REQUEST_SCHEMA,
+    client_nonce: input.client_nonce,
+    context_expires_at: input.context_expires_at,
+    host_binding: input.host_binding,
+    human_message_window: input.human_message_window,
+    ...input.last_seen_request_ref === void 0 ? {} : { last_seen_request_ref: input.last_seen_request_ref },
+    ...input.visible_output_max_bytes === void 0 ? {} : { visible_output_max_bytes: input.visible_output_max_bytes }
+  };
 }
-function formatHostRelayInvocationMintLine(observation) {
-  return `${HOST_RELAY_INVOCATION_MINT_LOG_TAG} outcome=${observation.outcome}${observation.reason === void 0 ? "" : ` reason=${observation.reason}`} elapsed_ms=${observation.elapsed_ms}`;
+function decodeGatewayMintResponse(response2, raw) {
+  if (raw === null) return mintRefusal("gateway_response_invalid");
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    value = null;
+  }
+  if (!response2.ok) return mintRefusal(gatewayMintRefusal(response2.status, value));
+  if (!isMintResult(value)) return mintRefusal("gateway_response_invalid");
+  const requestRef = response2.headers.get("ceal-request-ref");
+  if (requestRef === null || !/^ceal-request:[a-f0-9-]{36}$/u.test(requestRef)) return mintRefusal("gateway_response_invalid");
+  const result2 = decodeCealHostInvocationAuthenticationResult(value, /* @__PURE__ */ new Date());
+  return { schema_version: "ceal.host_relay_invocation_context_result.v2", status: "ready", request_ref: requestRef, result: result2 };
+}
+function gatewayMintFailure(signal, _error) {
+  return mintRefusal(signal.aborted ? "transient_retryable" : "gateway_unavailable");
+}
+function mintRefusal(reason) {
+  return { schema_version: "ceal.host_relay_invocation_context_result.v2", status: "refused", reason };
+}
+async function readBoundedResponseText(response2, maximumBytes) {
+  if (response2.body === null) return null;
+  const reader = response2.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maximumBytes) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+    const output = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      output.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return new TextDecoder("utf-8", { fatal: true }).decode(output);
+  } catch {
+    return null;
+  }
+}
+function isMintResult(value) {
+  return record5(value) && Object.keys(value).length === 3 && value.schema_version === CEAL_HOST_INVOCATION_AUTHENTICATION_RESULT_SCHEMA && typeof value.context_token === "string" && typeof value.expires_at === "string";
+}
+function gatewayMintRefusal(status, value) {
+  if (status === 401) return "host_credential_refused";
+  if (status === 403 && record5(value)) {
+    if (value.error_code === "host_source_refused") return "host_source_refused";
+    if (value.error_code === "context_expired") return "context_expired";
+    if (value.error_code === "request_context_refused") return "context_stale";
+  }
+  if (status === 429) return "gateway_rate_limited";
+  if (status >= 500) return "gateway_unavailable";
+  return "gateway_refused";
 }
 async function runHostRelayCli(args, signal, dependencies = {}) {
   try {
@@ -4460,20 +4316,6 @@ function parseServeArgs(args) {
   }
   return args[2];
 }
-async function assertOwnerPrivateDirectory2(path) {
-  try {
-    const stats = await lstat4(path);
-    if (!stats.isDirectory() || stats.isSymbolicLink() || !ownerPrivate4(stats)) throw new HostRelayConfigError("config_not_private", "Host Relay config directory is not owner-private.");
-  } catch (error) {
-    if (error instanceof HostRelayConfigError) throw error;
-    throw new HostRelayConfigError("config_unavailable", "Host Relay config directory is unavailable.");
-  }
-}
-function ownerPrivate4(stats) {
-  if (process.platform === "win32") return true;
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : stats.uid;
-  return stats.uid === uid && (stats.mode & 63) === 0;
-}
 function assertNoDuplicateJsonKeys(text) {
   rejectDuplicateJsonKeys(text, {
     invalid: () => new HostRelayConfigError("invalid_json", "Host Relay config is not JSON."),
@@ -4492,12 +4334,14 @@ function exactOptionalKeys2(value, required, optional) {
 }
 
 // host/relay/bin/ceal-host-relay.ts
+var serviceArguments = consumeHostServiceLogArgument(process.argv.slice(2));
+if (serviceArguments.path !== void 0) process.env[HOST_SERVICE_LOG_ENVIRONMENT] = serviceArguments.path;
 var controller = new AbortController();
 var stop = () => controller.abort();
 process.once("SIGINT", stop);
 process.once("SIGTERM", stop);
 var stopLogBound = boundHostServiceLog();
-void runHostRelayCli(process.argv.slice(2), controller.signal).then((result2) => {
+void runHostRelayCli(serviceArguments.args, controller.signal).then((result2) => {
   process.stdout.write(`${JSON.stringify({ schema_version: "ceal.host_relay_command.v1", ...result2 })}
 `);
   process.exitCode = result2.ok ? 0 : 1;