@etiquekit/etq 1.0.13 → 1.0.15

package/packages/control/src/cli/commands/local-workflow.ts

@@ -1,4686 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { appendFile, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
-import { dirname, join, relative, resolve } from 'node:path';
-import { parse as parseYaml } from 'yaml';
-import { optionalString, parseList, requirePositional, requireString } from '../argv';
-import { askChoice, askConfirm, canPrompt } from '../prompt';
-import {
-  parsePacketProfileV0,
-  renderPacketProfileV0,
-  type PacketProfileValueV0,
-} from '../../../../protocol/src/index';
-import {
-  assertEngagementProject,
-  assertSessionProject,
-  ensureProjectBinding,
-  projectBindingPath,
-  readProjectBinding,
-} from '../../engagement/project';
-import { appendSessionRunbookNote, createSessionRunbook } from '../../session/runbook';
-import { reportSeatReadiness, type ModelTier, type SeatType } from '../../seat/readiness';
-import { assertSharedMemoryScopeId, assertSharedMemoryText } from '../../shared/sanitize';
-import {
-  buildLocalLedgerView,
-  renderLocalLedgerViewMarkdown,
-  renderLocalLedgerViewText,
-  type LocalEvent,
-  type LocalLedgerViewKind,
-} from '../../projection/local-ledger-view';
-import {
-  buildTimelineView,
-  renderTimelineViewMarkdown,
-  renderTimelineViewText,
-  type TimelineScope,
-} from '../../projection/timeline';
-import { timelinePreviewResponseForRequest } from '../../projection/timeline-preview';
-import {
-  detectReturnPackets,
-  type ReturnCheckVerdict,
-  type ReturnRole,
-} from '../../projection/return-enforcement';
-import { evaluateRigConductorEnvelope } from '../../authority/rig-conductor';
-
-type JsonRecord = Record<string, unknown>;
-
-const SEAT_LIFECYCLE_SCHEMA = 'seat_lifecycle.v0';
-const SEAT_LIFECYCLE_STATES = [
-  'enrolled',
-  'provisioned',
-  'ready',
-  'assigned',
-  'active',
-  'idle',
-  'away',
-  'absent',
-  'stale',
-  'resuming',
-  'retired',
-] as const;
-const ROUTABLE_LIFECYCLE_STATES = new Set(['ready', 'idle']);
-const DEFAULT_LIFECYCLE_TTL_SECONDS = 8 * 60 * 60;
-
-type SeatLifecycleState = typeof SEAT_LIFECYCLE_STATES[number];
-
-interface WakeQueueItem {
-  seq: number;
-  event_ref: string;
-  created_at: string;
-  type: string;
-  lane: string | null;
-  role: string | null;
-  to: string | null;
-  next_owner: string | null;
-  packet_ref: string | null;
-  requires_ack: boolean;
-  match: 'direct' | 'next_owner' | 'subscription';
-}
-
-interface WakeQueue {
-  schema: 'remote-wake-queue.v0';
-  seat: string;
-  updated_at: string;
-  source: {
-    event_log_ref: '.etiquette/events/local.ndjson';
-    after_seq: number;
-    max_seq_seen: number;
-    subscriptions_ref: string;
-  };
-  transport: {
-    mode: 'local-poll';
-    webhook_enabled: false;
-    sns_sqs_enabled: false;
-    external_delivery_enabled: false;
-  };
-  payload_boundary: {
-    pointers_only: true;
-    packet_body_included: false;
-    raw_prompt_included: false;
-    diff_included: false;
-    secret_values_included: false;
-  };
-  items: WakeQueueItem[];
-  authority_boundary: {
-    queue_is_authority: false;
-    notification_can_authorize: false;
-    notification_can_grant: false;
-    notification_can_merge: false;
-    notification_can_close: false;
-    can_write_global_ledger: false;
-  };
-}
-
-interface GitHubWebhookWake {
-  schema: 'github-webhook-wake.v0';
-  provider: 'github';
-  event: 'push';
-  delivery_id: string;
-  received_at: string;
-  repository: {
-    full_name: string;
-    html_url: string | null;
-    default_branch: string | null;
-  };
-  ref: string;
-  before: string | null;
-  after: string;
-  compare_url: string | null;
-  pusher: string | null;
-  sender: string | null;
-  source: {
-    payload_ref: string;
-    payload_sha256: string;
-    signature_header: 'X-Hub-Signature-256';
-    delivery_header: 'X-GitHub-Delivery';
-    event_header: 'X-GitHub-Event';
-  };
-  transport: {
-    mode: 'github-webhook';
-    webhook_enabled: true;
-    signature_verified: true;
-    receiver_network_required: true;
-    receiver_must_fetch_and_verify: true;
-    webhook_payload_trusted_as_truth: false;
-    sns_sqs_enabled: false;
-    aws_enabled: false;
-  };
-  payload_boundary: {
-    pointers_only: true;
-    raw_payload_included: false;
-    commit_messages_included: false;
-    diff_included: false;
-    secret_values_included: false;
-  };
-  authority_boundary: {
-    notification_is_authority: false;
-    webhook_can_authorize: false;
-    webhook_can_grant: false;
-    webhook_can_merge: false;
-    webhook_can_close: false;
-    webhook_can_write_global_ledger: false;
-    webhook_can_write_local_ledger: false;
-  };
-  next_action: 'receiver_fetch_and_verify_git_ref';
-}
-
-interface GitHubWebhookPing {
-  schema: 'github-webhook-ping.v0';
-  provider: 'github';
-  event: 'ping';
-  delivery_id: string;
-  received_at: string;
-  repository: {
-    full_name: string;
-    html_url: string | null;
-    default_branch: string | null;
-  };
-  sender: string | null;
-  hook_id: string | null;
-  source: {
-    payload_ref: string;
-    payload_sha256: string;
-    signature_header: 'X-Hub-Signature-256';
-    delivery_header: 'X-GitHub-Delivery';
-    event_header: 'X-GitHub-Event';
-  };
-  transport: {
-    mode: 'github-webhook';
-    webhook_enabled: true;
-    signature_verified: true;
-    receiver_network_required: true;
-    receiver_must_fetch_and_verify: false;
-    webhook_payload_trusted_as_truth: false;
-    sns_sqs_enabled: false;
-    aws_enabled: false;
-  };
-  payload_boundary: {
-    pointers_only: true;
-    raw_payload_included: false;
-    commit_messages_included: false;
-    diff_included: false;
-    secret_values_included: false;
-  };
-  authority_boundary: GitHubWebhookWake['authority_boundary'];
-  next_action: 'receiver_acknowledged_github_ping';
-}
-
-function wakeQueueTransport(): WakeQueue['transport'] {
-  return {
-    mode: 'local-poll',
-    webhook_enabled: false,
-    sns_sqs_enabled: false,
-    external_delivery_enabled: false,
-  };
-}
-
-function wakeQueuePayloadBoundary(): WakeQueue['payload_boundary'] {
-  return {
-    pointers_only: true,
-    packet_body_included: false,
-    raw_prompt_included: false,
-    diff_included: false,
-    secret_values_included: false,
-  };
-}
-
-function wakeQueueAuthorityBoundary(): WakeQueue['authority_boundary'] {
-  return {
-    queue_is_authority: false,
-    notification_can_authorize: false,
-    notification_can_grant: false,
-    notification_can_merge: false,
-    notification_can_close: false,
-    can_write_global_ledger: false,
-  };
-}
-
-function normalizeWakeQueue(queue: WakeQueue): WakeQueue {
-  return {
-    ...queue,
-    transport: queue.transport ?? wakeQueueTransport(),
-    payload_boundary: queue.payload_boundary ?? wakeQueuePayloadBoundary(),
-    authority_boundary: {
-      ...wakeQueueAuthorityBoundary(),
-      ...(queue.authority_boundary ?? {}),
-    },
-  };
-}
-
-function githubWebhookTransport(): GitHubWebhookWake['transport'] {
-  return {
-    mode: 'github-webhook',
-    webhook_enabled: true,
-    signature_verified: true,
-    receiver_network_required: true,
-    receiver_must_fetch_and_verify: true,
-    webhook_payload_trusted_as_truth: false,
-    sns_sqs_enabled: false,
-    aws_enabled: false,
-  };
-}
-
-function githubWebhookPingTransport(): GitHubWebhookPing['transport'] {
-  return {
-    ...githubWebhookTransport(),
-    receiver_must_fetch_and_verify: false,
-  };
-}
-
-function githubWebhookPayloadBoundary(): GitHubWebhookWake['payload_boundary'] {
-  return {
-    pointers_only: true,
-    raw_payload_included: false,
-    commit_messages_included: false,
-    diff_included: false,
-    secret_values_included: false,
-  };
-}
-
-function githubWebhookAuthorityBoundary(): GitHubWebhookWake['authority_boundary'] {
-  return {
-    notification_is_authority: false,
-    webhook_can_authorize: false,
-    webhook_can_grant: false,
-    webhook_can_merge: false,
-    webhook_can_close: false,
-    webhook_can_write_global_ledger: false,
-    webhook_can_write_local_ledger: false,
-  };
-}
-
-const LOCAL_WORKFLOW_COMMANDS = new Set([
-  'setup',
-  'handoff',
-  'init',
-  'bootstrap',
-  'whereami',
-  'join',
-  'pickup',
-  'enter',
-  'audit',
-  'roster',
-  'post',
-  'notify',
-  'return',
-  'retire',
-  'rig',
-  'doctor',
-  'bus',
-  'timeline',
-  'status',
-  'diagnostics',
-  'trash',
-]);
-
-const FALSE_AUTHORITY_FIELDS = [
-  'can_authorize_work',
-  'can_close_lane_without_grant',
-  'can_merge_or_push_without_grant',
-];
-
-const TASK_EXECUTION_STRATEGIES = ['solo', 'tango', 'rig', 'shadow'] as const;
-
-type TaskExecutionStrategy = typeof TASK_EXECUTION_STRATEGIES[number];
-
-const READ_ONLY_AUDIT_WRITE_PREFIXES = [
-  '.etiquette/events/local.ndjson',
-  '.etiquette/notify/',
-  'docs/work/ledger/',
-  'docs/work/packets/',
-  'docs/work/receipts/',
-  'docs/work/sessions/',
-];
-
-type RunnerDiagnosticKind =
-  | 'unsupported_content_type'
-  | 'tool_result_transport_error'
-  | 'rendering_error'
-  | 'unknown_runner_glitch';
-
-type RunnerDiagnosticSeverity = 'info' | 'warning' | 'blocked';
-
-interface BootstrapSeat {
-  seatId: string;
-  operatorPrincipal: string;
-  displayName: string;
-  seatType: SeatType;
-  asRole: string;
-  authorityScope: string;
-  mode: string;
-  modelRef: string;
-  modelTier: ModelTier;
-  modelId: string;
-  supportedStrategies: string[];
-  activeWorkers: number;
-  maxRecommendedWorkers: number;
-  supportsParallel: boolean;
-  allowedWork: string[];
-  forbiddenWork: string[];
-}
-
-interface BootstrapTask {
-  id: string;
-  title: string;
-  mode: string;
-  assignedTo: BootstrapSeat;
-  allowedWrites: string[];
-  validation: string[];
-  reviewFocus?: string[];
-  planNote: string;
-}
-
-interface BootstrapPlan {
-  profile: string;
-  taskPrefix: string;
-  lead: BootstrapSeat;
-  reviewers: BootstrapSeat[];
-  bootstrapSeat: BootstrapSeat | null;
-  tasks: BootstrapTask[];
-  onboarding: {
-    runtime: string;
-    runtimeCaption: string;
-    writeScope: string[];
-    twoSeatOffered: boolean;
-    twoSeatAccepted: boolean;
-    interactive: boolean;
-  };
-}
-
-type SetupTarget = 'codex' | 'claude-code' | 'gemini';
-
-interface SetupTargetConfig {
-  target: SetupTarget;
-  display: string;
-  cliCommand: string;
-  configDir: string;
-  skillRef: string;
-  notesRef: string;
-}
-
-interface SetupResult {
-  schema: 'agent-host-setup.v0';
-  project: string;
-  target_mode: string;
-  targets: Array<{
-    target: SetupTarget;
-    display: string;
-    detected: boolean;
-    config_dir: string;
-    skill_ref: string;
-    notes_ref: string;
-    action: 'installed' | 'dry-run' | 'skipped' | 'ejected';
-    generated: string[];
-    skipped: string[];
-    removed: string[];
-  }>;
-  dry_run: boolean;
-  ejected: boolean;
-  authority_boundary: {
-    setup_installs_project_guidance_only: true;
-    can_install_hooks: false;
-    can_write_global_config: false;
-    can_bootstrap_project: false;
-    can_join_seat: false;
-    can_pickup_task: false;
-    can_grant: false;
-    can_merge: false;
-    can_close: false;
-    can_push: false;
-  };
-  next_step: string;
-}
-
-interface TrashEntry extends JsonRecord {
-  schema: 'trash-index-entry.v0';
-  trash_id: string;
-  path: string;
-  removed_at: string;
-  removed_by: string;
-  reason: string;
-  retirable_class: string;
-  superseded_by: string | null;
-  evidence_ref: string;
-  last_commit: string;
-  restore_hint: string;
-  authority_boundary: {
-    trash_index_is_authority: false;
-    can_close: false;
-    can_merge: false;
-    can_grant: false;
-  };
-}
-
-export function isLocalWorkflowCommand(command: string): boolean {
-  return LOCAL_WORKFLOW_COMMANDS.has(command);
-}
-
-function projectRoot(flags: Record<string, string | boolean>): string {
-  return resolve(optionalString(flags, 'project') ?? process.cwd());
-}
-
-function gitStatusPorcelain(root: string): string {
-  const inside = git(root, ['rev-parse', '--is-inside-work-tree'], true);
-  if (inside.status !== 0 || inside.stdout.trim() !== 'true') return '';
-  return git(root, ['status', '--porcelain'], true).stdout.trim();
-}
-
-async function applyFirstRunOnboardingPrompts(
-  root: string,
-  flags: Record<string, string | boolean>,
-): Promise<void> {
-  const promptRequested = isTrueFlag(flags, 'ask');
-  const promptAllowed = promptRequested || (
-    flags.json !== true
-    && flags.yes !== true
-    && flags.profile === undefined
-    && canPrompt()
-  );
-  if (!promptAllowed) {
-    if (!optionalString(flags, 'runtime')) flags.runtime = detectRuntimeFromEnvironment();
-    return;
-  }
-
-  const dirty = gitStatusPorcelain(root);
-  if (dirty.length > 0) {
-    const proceed = await askConfirm({
-      label: 'This git worktree has uncommitted changes. Continue with repo-local Etiquette bootstrap?',
-      defaultValue: true,
-    });
-    if (!proceed) throw new Error('bootstrap cancelled by operator because the worktree is dirty');
-  }
-
-  const topology = await askChoice({
-    label: 'First run shape',
-    choices: [
-      { value: 'solo', label: 'Solo implementation seat' },
-      { value: 'lead-review', label: 'Implementation seat plus review seat' },
-    ],
-    defaultValue: 'solo',
-  });
-  flags.profile = topology;
-
-  const detected = detectRuntimeFromEnvironment();
-  flags.runtime = await askChoice({
-    label: 'Current runtime occupant (a seat is the durable role; the runtime is the temporary occupant)',
-    choices: [
-      { value: detected, label: detected === 'none' ? 'No runtime detected' : `Detected: ${detected}` },
-      { value: 'codex', label: 'Codex' },
-      { value: 'claude-code', label: 'Claude Code' },
-      { value: 'gemini', label: 'Gemini' },
-      { value: 'none', label: 'None / manual terminal' },
-    ],
-    defaultValue: detected,
-  });
-
-  const scopeAccepted = await askConfirm({
-    label: 'Use the default write boundary: root manifest plus src/**, app/**, tests/**; governance surfaces stay protected?',
-    defaultValue: true,
-  });
-  if (!scopeAccepted) {
-    throw new Error('bootstrap cancelled; choose a narrower task envelope before first pickup');
-  }
-
-  if (topology === 'solo') {
-    const addReview = await askConfirm({
-      label: 'Add a review seat now?',
-      defaultValue: false,
-    });
-    if (addReview) flags.profile = 'lead-review';
-  }
-  flags.ask = true;
-}
-
-function nowIso(flags?: Record<string, string | boolean>): string {
-  const raw = flags ? optionalString(flags, 'at') : undefined;
-  const value = raw ?? new Date().toISOString();
-  if (!Number.isFinite(Date.parse(value))) throw new Error('--at must be an ISO-8601 timestamp');
-  return new Date(value).toISOString();
-}
-
-function eventPath(root: string): string {
-  return join(root, '.etiquette', 'events', 'local.ndjson');
-}
-
-function ledgerPath(root: string): string {
-  return join(root, 'docs', 'work', 'ledger', 'LEDGER.md');
-}
-
-function isInitializedLocalProject(root: string): boolean {
-  return existsSync(projectBindingPath(root)) && existsSync(eventPath(root));
-}
-
-function relativeRef(root: string, path: string): string {
-  const rel = relative(root, resolve(path));
-  if (rel.length === 0 || rel.startsWith('..') || rel.includes('\\')) {
-    throw new Error(`path must stay inside project root: ${path}`);
-  }
-  return rel;
-}
-
-function pickupCommand(seat: string, task: string, projectId?: string | null): string {
-  const expectation = projectId ? ` --expect-project-id ${projectId}` : '';
-  return `etiquette pickup --project . --seat ${seat} --task ${task}${expectation} --text`;
-}
-
-function assertPickupProjectExpectation(projectId: string, flags: Record<string, string | boolean>): void {
-  const expectedProjectId = optionalString(flags, 'expect-project-id');
-  if (expectedProjectId) {
-    assertEngagementProject(projectId, expectedProjectId, 'current project');
-    return;
-  }
-  if (Boolean(flags['allow-current-project'])) return;
-  throw new Error(
-    'pickup requires --expect-project-id <project_id>; run etiquette whereami --project . --json or use a generated pickup command. For manual local-only pickup, pass --allow-current-project.',
-  );
-}
-
-function safeName(value: string): string {
-  const out = value.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
-  return out || 'item';
-}
-
-function yamlList(values: string[], indent = '  '): string {
-  if (values.length === 0) return `${indent}[]`;
-  return values.map((value) => `${indent}- ${value}`).join('\n');
-}
-
-function localWorkflowBookkeepingWrites(task: BootstrapTask): string[] {
-  return [
-    '.etiquette/events/local.ndjson',
-    `.etiquette/notify/queues/${task.assignedTo.seatId}.json`,
-    'docs/work/ledger/LEDGER.md',
-    `docs/work/packets/*${safeName(task.id)}*.json`,
-  ];
-}
-
-function taskAllowedWrites(task: BootstrapTask): string[] {
-  return [
-    ...task.allowedWrites,
-    ...localWorkflowBookkeepingWrites(task),
-  ];
-}
-
-function taskExecutionStrategy(task: BootstrapTask): TaskExecutionStrategy {
-  return task.mode === 'read-only-audit' ? 'tango' : 'solo';
-}
-
-function localReturnRole(task: BootstrapTask): string {
-  return task.mode === 'product-implementation' ? 'implementation-return' : 'review-return';
-}
-
-function localReturnTarget(plan: BootstrapPlan, task: BootstrapTask): string {
-  return task.mode === 'product-implementation'
-    ? (plan.reviewers[0]?.seatId ?? plan.lead.seatId)
-    : plan.lead.seatId;
-}
-
-function planSeats(plan: BootstrapPlan): BootstrapSeat[] {
-  return [plan.lead, ...plan.reviewers, ...(plan.bootstrapSeat ? [plan.bootstrapSeat] : [])];
-}
-
-function isReturnRole(role: string): boolean {
-  return role === 'implementation-return' || role === 'review-return';
-}
-
-function optionalFlag(flags: Record<string, string | boolean>, key: string, fallback: string): string {
-  return optionalString(flags, key) ?? fallback;
-}
-
-function detectRuntimeFromEnvironment(): string {
-  const agent = process.env.TERM_PROGRAM ?? process.env.CODEX_SANDBOX ?? process.env.CLAUDECODE ?? '';
-  const normalized = agent.toLowerCase();
-  if (normalized.includes('codex') || process.env.CODEX_SANDBOX) return 'codex';
-  if (normalized.includes('claude') || process.env.CLAUDECODE) return 'claude-code';
-  if (normalized.includes('gemini')) return 'gemini';
-  return 'none';
-}
-
-function isTrueFlag(flags: Record<string, string | boolean>, key: string): boolean {
-  const value = flags[key];
-  return value === true || value === 'true' || value === '1' || value === 'yes';
-}
-
-function makeSeat(input: {
-  seatId: string;
-  operatorPrincipal: string;
-  displayName: string;
-  seatType: SeatType;
-  asRole: string;
-  authorityScope: string;
-  mode: string;
-  modelRef: string;
-  modelTier: ModelTier;
-  modelId: string;
-  supportedStrategies: string[];
-  activeWorkers?: number;
-  maxRecommendedWorkers?: number;
-  supportsParallel?: boolean;
-  allowedWork: string[];
-  forbiddenWork: string[];
-}): BootstrapSeat {
-  return {
-    activeWorkers: input.activeWorkers ?? 0,
-    maxRecommendedWorkers: input.maxRecommendedWorkers ?? 1,
-    supportsParallel: input.supportsParallel ?? false,
-    ...input,
-  };
-}
-
-function buildBootstrapPlan(flags: Record<string, string | boolean>): BootstrapPlan {
-  const profile = optionalFlag(flags, 'profile', 'solo');
-  const taskPrefix = optionalFlag(flags, 'task-prefix', 'ETQ-BOOTSTRAP');
-  const runtime = optionalString(flags, 'runtime') ?? detectRuntimeFromEnvironment();
-
-  const solo = profile === 'solo';
-  const leadReview = profile === 'lead-review';
-  if (profile !== 'solo' && profile !== 'codex-cc-gemini' && profile !== 'lead-review') {
-    throw new Error('--profile must be solo, codex-cc-gemini, or lead-review');
-  }
-  const bootstrapSeat = solo
-    ? null
-    : makeSeat({
-        seatId: optionalFlag(flags, 'bootstrap-seat', 'manager-seat'),
-        operatorPrincipal: optionalFlag(flags, 'bootstrap-principal', 'manager'),
-        displayName: 'Bootstrap Provisioner Seat',
-        seatType: 'control_seat',
-        asRole: 'observer',
-        authorityScope: 'bootstrap-provenance',
-        mode: 'docs-only',
-        modelRef: 'bootstrap-provenance',
-        modelTier: 'local_unknown',
-        modelId: 'bootstrap-provenance',
-        supportedStrategies: ['bootstrap-provenance'],
-        allowedWork: ['repo-local bootstrap provenance', 'lead handoff records'],
-        forbiddenWork: [
-          'routine task ownership after lead handoff',
-          'external ledger writes for routine execution',
-          'merge, push, closeout, promotion, or grants',
-        ],
-      });
-
-  const lead = makeSeat({
-    seatId: optionalFlag(flags, 'lead-seat', leadReview || solo ? 'impl-seat' : 'codex-seat'),
-    operatorPrincipal: optionalFlag(flags, 'lead-principal', leadReview || solo ? 'impl' : 'codex'),
-    displayName: 'Local Lead Seat',
-    seatType: 'control_seat',
-    asRole: 'principal',
-    authorityScope: 'repo-local-routing',
-    mode: 'product-implementation',
-    modelRef: leadReview || solo ? 'local-implementation-session' : 'local-codex-session',
-    modelTier: 'frontier_high_reasoning',
-    modelId: leadReview || solo ? 'local-implementation-session' : 'local-codex-session',
-    supportedStrategies: ['local-routing', 'product-implementation', 'validation', 'review-gate'],
-    activeWorkers: 1,
-    maxRecommendedWorkers: 2,
-    supportsParallel: true,
-    allowedWork: [
-      'repo-local task routing',
-      'repo-local board updates',
-      'repo-local session creation',
-      'assigned implementation',
-      'local receipt review',
-    ],
-    forbiddenWork: [
-      'external ledger writes for routine execution',
-      'merge, push, closeout, promotion, or grants without explicit decision',
-    ],
-  });
-
-  const primaryReview = solo ? null : makeSeat({
-    seatId: optionalFlag(flags, 'review-seat', leadReview ? 'review-seat' : 'cc-seat'),
-    operatorPrincipal: optionalFlag(flags, 'review-principal', leadReview ? 'review' : 'cc'),
-    displayName: leadReview ? 'Local Review Seat' : 'Claude Code Review Seat',
-    seatType: 'review_seat',
-    asRole: 'reviewer',
-    authorityScope: 'review-only',
-    mode: 'read-only-audit',
-    modelRef: leadReview ? 'local-review-session' : 'local-claude-code-session',
-    modelTier: 'local_unknown',
-    modelId: leadReview ? 'local-review-session' : 'local-claude-code-session',
-    supportedStrategies: ['read-only-audit', 'receipt-review'],
-    allowedWork: [
-      'repo-local read-only review',
-      'product and docs critique',
-      'bounded session notes',
-      'receipt writing under docs/work/receipts',
-    ],
-    forbiddenWork: [
-      'external ledger writes',
-      'product file edits without a later implementation task',
-      'merge, push, closeout, promotion, or grants',
-    ],
-  });
-
-  const reviewers = primaryReview ? [primaryReview] : [];
-  const qaSeatRaw = optionalString(flags, 'qa-seat');
-  const includeQa = !solo && flags['no-qa'] !== true && (!leadReview || qaSeatRaw !== undefined);
-  if (includeQa) {
-    reviewers.push(makeSeat({
-      seatId: optionalFlag(flags, 'qa-seat', 'gemini-seat'),
-      operatorPrincipal: optionalFlag(flags, 'qa-principal', 'gemini'),
-      displayName: 'Gemini QA Seat',
-      seatType: 'review_seat',
-      asRole: 'reviewer',
-      authorityScope: 'review-only',
-      mode: 'read-only-audit',
-      modelRef: 'local-gemini-session',
-      modelTier: 'local_unknown',
-      modelId: 'local-gemini-session',
-      supportedStrategies: ['read-only-audit', 'adversarial-qa', 'receipt-review'],
-      allowedWork: [
-        'repo-local adversarial review',
-        'edge-case review',
-        'mobile usability review',
-        'bounded session notes',
-        'receipt writing under docs/work/receipts',
-      ],
-      forbiddenWork: [
-        'external ledger writes',
-        'product file edits without a later implementation task',
-        'merge, push, closeout, promotion, or grants',
-      ],
-    }));
-  }
-
-  const tasks: BootstrapTask[] = [
-    {
-      id: `${taskPrefix}-001`,
-      title: 'First local implementation lane',
-      mode: 'product-implementation',
-      assignedTo: lead,
-      allowedWrites: [
-        'package.json',
-        'bun.lock',
-        'package-lock.json',
-        'pnpm-lock.yaml',
-        'yarn.lock',
-        'src/**',
-        'app/**',
-        'test/**',
-        'tests/**',
-        `docs/work/receipts/${taskPrefix}-001-*.md`,
-        `docs/work/sessions/session-${taskPrefix}-001/**`,
-      ],
-      validation: ['git diff --check'],
-      planNote: `Lead pickup: execute ${taskPrefix}-001 using repo-local Etiquette only.`,
-    },
-    ...(!primaryReview ? [] : [{
-      id: `${taskPrefix}-002`,
-      title: 'Review first local implementation lane',
-      mode: 'read-only-audit',
-      assignedTo: primaryReview,
-      allowedWrites: [
-        `docs/work/receipts/${taskPrefix}-002-*.md`,
-        `docs/work/sessions/session-${taskPrefix}-002/**`,
-      ],
-      validation: [
-        'etiquette doctor --project .',
-        `etiquette console board --project . --seat ${primaryReview.seatId} --text`,
-      ],
-      planNote: `Review pickup: pressure-test ${taskPrefix}-001 for scope, validation, and authority drift.`,
-    }]),
-  ];
-
-  const qa = reviewers[1];
-  if (qa) {
-    tasks.push({
-      id: `${taskPrefix}-003`,
-      title: 'Adversarial QA for the first local implementation lane',
-      mode: 'read-only-audit',
-      assignedTo: qa,
-      allowedWrites: [
-        `docs/work/receipts/${taskPrefix}-003-*.md`,
-        `docs/work/sessions/session-${taskPrefix}-003/**`,
-      ],
-      validation: ['git diff --check'],
-      reviewFocus: [
-        'edge-case behavior',
-        'validation blind spots',
-        'mobile or repeated-use ergonomics',
-        'authority drift',
-      ],
-      planNote: `QA pickup: adversarial review for ${taskPrefix}-001 edge cases and validation gaps.`,
-    });
-  }
-
-  return {
-    profile,
-    taskPrefix,
-    lead,
-    reviewers,
-    bootstrapSeat,
-    tasks,
-    onboarding: {
-      runtime,
-      runtimeCaption: 'A seat is the durable role; the runtime is the temporary occupant.',
-      writeScope: ['package/root manifest', 'src/**', 'app/**', 'tests/**', 'docs/work receipts and sessions'],
-      twoSeatOffered: true,
-      twoSeatAccepted: !solo,
-      interactive: isTrueFlag(flags, 'ask') && canPrompt(),
-    },
-  };
-}
-
-function asRecord(value: unknown, label: string): JsonRecord {
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value as JsonRecord;
-}
-
-function stringField(record: JsonRecord, field: string): string | undefined {
-  const value = record[field];
-  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
-}
-
-function boolField(record: JsonRecord, field: string): boolean | undefined {
-  const value = record[field];
-  return typeof value === 'boolean' ? value : undefined;
-}
-
-function arrayField(record: JsonRecord, field: string): unknown[] | undefined {
-  const value = record[field];
-  return Array.isArray(value) ? value : undefined;
-}
-
-function assertLifecycleState(value: string, label = 'lifecycle_state'): asserts value is SeatLifecycleState {
-  if (!(SEAT_LIFECYCLE_STATES as readonly string[]).includes(value)) {
-    throw new Error(`${label} must be one of: ${SEAT_LIFECYCLE_STATES.join(', ')}`);
-  }
-}
-
-function addSecondsIso(at: string, seconds: number): string {
-  return new Date(Date.parse(at) + seconds * 1000).toISOString();
-}
-
-function lifecycleState(enrollment: JsonRecord): SeatLifecycleState {
-  const raw = stringField(enrollment, 'lifecycle_state');
-  if (raw) {
-    assertLifecycleState(raw);
-    return raw;
-  }
-  return enrollment.ready === true ? 'ready' : 'enrolled';
-}
-
-function lifecycleWorkflowId(projectId: string): string {
-  return projectId;
-}
-
-function runnerBinding(input: {
-  runnerProvider: string;
-  executionSurface: string;
-  modelId?: string | null;
-  modelTier?: string | null;
-  permissionProfileRef?: string | null;
-  capabilitySource?: string | null;
-  previous?: JsonRecord | null;
-}): JsonRecord {
-  return {
-    runner_provider: input.runnerProvider,
-    execution_surface: input.executionSurface,
-    model_id: input.modelId ?? null,
-    model_tier: input.modelTier ?? 'local_unknown',
-    permission_profile_ref: input.permissionProfileRef ?? null,
-    capability_source: input.capabilitySource ?? 'config',
-    runner_permission_profile_verified: true,
-    capability_tier_revalidated: true,
-    ...(input.previous ? { previous: input.previous } : {}),
-    authority_boundary: {
-      runner_binding_grants_authority: false,
-      runner_switch_grants_authority: false,
-    },
-  };
-}
-
-function lifecycleReadyPatch(input: {
-  projectId: string;
-  at: string;
-  runnerBinding?: JsonRecord;
-}): JsonRecord {
-  return {
-    lifecycle_schema: SEAT_LIFECYCLE_SCHEMA,
-    lifecycle_state: 'ready',
-    workflow_id: lifecycleWorkflowId(input.projectId),
-    ready: true,
-    ready_at: input.at,
-    readiness_ttl_seconds: DEFAULT_LIFECYCLE_TTL_SECONDS,
-    readiness_expires_at: addSecondsIso(input.at, DEFAULT_LIFECYCLE_TTL_SECONDS),
-    lifecycle_checks: {
-      remote_synced: true,
-      inbox_read: true,
-      workflow_binding_confirmed: true,
-      runner_binding_confirmed: true,
-      runner_permission_profile_verified: true,
-      capability_tier_revalidated: true,
-      stale_tasks_cleared: true,
-    },
-    ...(input.runnerBinding ? { runner_binding: input.runnerBinding } : {}),
-    authority_granted: false,
-    lifecycle_authority_boundary: {
-      lifecycle_grants_authority: false,
-      readiness_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-    },
-  };
-}
-
-function assertLifecycleRoutable(enrollment: JsonRecord, projectId: string, seat: string, at = new Date().toISOString()): void {
-  const state = lifecycleState(enrollment);
-  if (!ROUTABLE_LIFECYCLE_STATES.has(state)) {
-    throw new Error(`seat lifecycle not routable: ${seat} state=${state}; run etiquette roster ready ${seat} after lifecycle preflight`);
-  }
-  const workflowId = stringField(enrollment, 'workflow_id');
-  if (workflowId && workflowId !== lifecycleWorkflowId(projectId)) {
-    throw new Error(`seat workflow mismatch: ${seat} workflow_id=${workflowId} current=${lifecycleWorkflowId(projectId)}`);
-  }
-  const expiresAt = stringField(enrollment, 'readiness_expires_at');
-  if (expiresAt) {
-    const atMs = Date.parse(at);
-    const expiresAtMs = Date.parse(expiresAt);
-    if (!Number.isFinite(atMs) || !Number.isFinite(expiresAtMs)) {
-      throw new Error(`seat lifecycle readiness timestamp unparseable: ${seat}`);
-    }
-    if (atMs > expiresAtMs) {
-      throw new Error(`seat lifecycle readiness expired: ${seat}; run etiquette roster ready ${seat} after preflight`);
-    }
-  }
-  if (enrollment.authority_granted === true) {
-    throw new Error(`seat lifecycle must not grant authority: ${seat}`);
-  }
-  const binding = enrollment.runner_binding === undefined ? null : asRecord(enrollment.runner_binding, `${seat} runner_binding`);
-  if (!binding) return;
-  if (stringField(binding, 'capability_source') === 'agent_self_declared') {
-    throw new Error(`seat runner capability is self-declared: ${seat}; require local validation before pickup`);
-  }
-  if (binding.runner_switch_requires_preflight === true) {
-    throw new Error(`seat runner binding requires lifecycle preflight: ${seat}`);
-  }
-  if (binding.runner_permission_profile_verified === false) {
-    throw new Error(`seat runner permission profile not verified: ${seat}`);
-  }
-  if (binding.capability_tier_revalidated === false) {
-    throw new Error(`seat runner capability tier not revalidated: ${seat}`);
-  }
-}
-
-async function readTextIfExists(path: string): Promise<string | null> {
-  try {
-    return await readFile(path, 'utf-8');
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
-    throw err;
-  }
-}
-
-async function readJsonIfExists<T>(path: string, fallback: T): Promise<T> {
-  const raw = await readTextIfExists(path);
-  return raw ? JSON.parse(raw) as T : fallback;
-}
-
-async function writeJson(path: string, value: unknown): Promise<void> {
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
-}
-
-const ETIQUETTE_GITIGNORE_LINES = [
-  '.etiquette/state/',
-  '.etiquette/diagnostics/',
-  '.etiquette/notify/queues/',
-  '.etiquette/events/*.lock/',
-];
-
-async function ensureMachinePlaneGitignore(root: string, result: { generated: string[]; skipped: string[] }): Promise<void> {
-  const rel = '.gitignore';
-  const path = join(root, rel);
-  const raw = await readTextIfExists(path);
-  const existingLines = new Set((raw ?? '').split(/\r?\n/).map((line) => line.trim()).filter(Boolean));
-  const missing = ETIQUETTE_GITIGNORE_LINES.filter((line) => !existingLines.has(line));
-  if (missing.length === 0) {
-    result.skipped.push(rel);
-    return;
-  }
-
-  const prefix = raw && raw.length > 0
-    ? `${raw.replace(/\s*$/, '\n')}\n`
-    : '';
-  await writeFile(path, [
-    prefix,
-    '# Etiquette transient machine state',
-    ...missing,
-    '',
-  ].join('\n'));
-  result.generated.push(rel);
-}
-
-async function writeGeneratedText(
-  root: string,
-  rel: string,
-  content: string,
-  force: boolean,
-  result: { generated: string[]; skipped: string[] },
-): Promise<void> {
-  const path = join(root, rel);
-  if (existsSync(path) && !force) {
-    result.skipped.push(rel);
-    return;
-  }
-  await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, content.endsWith('\n') ? content : `${content}\n`);
-  result.generated.push(rel);
-}
-
-const SETUP_TARGETS: SetupTargetConfig[] = [
-  {
-    target: 'codex',
-    display: 'Codex',
-    cliCommand: 'codex',
-    configDir: '.codex',
-    skillRef: '.codex/skills/etiquette/SKILL.md',
-    notesRef: '.codex/etiquette-setup.md',
-  },
-  {
-    target: 'claude-code',
-    display: 'Claude Code',
-    cliCommand: 'claude',
-    configDir: '.claude',
-    skillRef: '.claude/skills/etiquette/SKILL.md',
-    notesRef: '.claude/etiquette-setup.md',
-  },
-  {
-    target: 'gemini',
-    display: 'Gemini CLI',
-    cliCommand: 'gemini',
-    configDir: '.gemini',
-    skillRef: '.gemini/skills/etiquette/SKILL.md',
-    notesRef: '.gemini/etiquette-setup.md',
-  },
-];
-
-function commandAvailable(command: string): boolean {
-  return spawnSync('which', [command], { encoding: 'utf-8' }).status === 0;
-}
-
-function setupTargetConfig(target: SetupTarget): SetupTargetConfig {
-  const config = SETUP_TARGETS.find((item) => item.target === target);
-  if (!config) throw new Error(`unsupported setup target: ${target}`);
-  return config;
-}
-
-function parseSetupTargets(root: string, flags: Record<string, string | boolean>): { mode: string; targets: SetupTargetConfig[] } {
-  const mode = optionalString(flags, 'target') ?? 'auto';
-  if (flags.global === true) {
-    throw new Error('setup --global is not available in v0; use project-local setup only');
-  }
-  if (mode === 'all') {
-    return { mode, targets: [...SETUP_TARGETS] };
-  }
-  if (mode === 'auto') {
-    const detected = SETUP_TARGETS.filter((target) => (
-      commandAvailable(target.cliCommand) || existsSync(join(root, target.configDir))
-    ));
-    if (detected.length === 0) {
-      throw new Error('setup --target auto found no supported agent host; rerun with --target codex, --target claude-code, --target gemini, or --target all');
-    }
-    if (detected.length > 1) {
-      throw new Error(`setup --target auto found multiple agent hosts (${detected.map((target) => target.target).join(', ')}); choose one with --target codex, --target claude-code, or --target gemini, or use --target all deliberately`);
-    }
-    return { mode, targets: detected };
-  }
-  const targets = mode.split(',').map((value) => value.trim()).filter(Boolean).map((value) => {
-    if (!['codex', 'claude-code', 'gemini'].includes(value)) {
-      throw new Error('--target must be one of: auto, all, codex, claude-code, gemini');
-    }
-    return setupTargetConfig(value as SetupTarget);
-  });
-  return { mode, targets };
-}
-
-function renderEtiquetteSkill(target: SetupTargetConfig): string {
-  return [
-    '---',
-    'name: etiquette-seat-pickup',
-    'description: Use when entering or resuming an Etiquette-managed project. Read the project head-start docs, orient with whereami, join the assigned seat, read the task envelope and runbook, respect allowed writes, run validation, and write a receipt before asking for promotion.',
-    '---',
-    '',
-    '# Etiquette Seat Pickup',
-    '',
-    `This project installed Etiquette guidance for ${target.display}.`,
-    '',
-    '## Start Here',
-    '',
-    'Before pickup, read the repo-local head-start surfaces when they exist:',
-    '',
-    '- `AGENTS.md`',
-    '- `docs/work/BOARD.md`',
-    '- `docs/work/runbooks/SESSION_PICKUP.md`',
-    '- `docs/work/manuals/SEAT_OPERATING_MANUAL.md`',
-    '- `docs/work/cookbooks/ADD_A_LANE.md`',
-    '',
-    'If the seat is interrupted, cwd/worktree ambiguous, role-swapped, or',
-    'vendor-swapped, re-check the live project before pickup:',
-    '',
-    '```sh',
-    'etiquette whereami --project . --seat <seat-id> --task <task-id>',
-    'etiquette doctor --project .',
-    'etiquette notify poll --project . --seat <seat-id> --text',
-    '```',
-    '',
-    'This rebind check verifies the live project, task, branch, worktree,',
-    'routing surface, evidence surface, and local event-log head. It grants no',
-    'authority. Lifecycle readiness is evidence only; the task envelope remains',
-    'the work authority.',
-    '',
-    'When a task gives you a seat id and task id, run:',
-    '',
-    '```sh',
-    'etiquette whereami --project . --seat <seat-id> --task <task-id>',
-    'etiquette join --project . --seat <seat-id>',
-    'etiquette pickup --project . --seat <seat-id> --task <task-id> --text',
-    '```',
-    '',
-    'If `pickup` prints an `--expect-project-id` command, use that exact command.',
-    '',
-    '## Operating Rules',
-    '',
-    '- Treat the task envelope as the write boundary.',
-    '- Read the runbook before editing.',
-    '- Hooks and readiness are evidence only; they never grant task authority.',
-    '- Use repo-local `.etiquette` and `docs/work` surfaces, not a global bus, unless explicitly routed.',
-    '- Run the task validation before returning.',
-    '- Write a receipt under `docs/work/receipts/` when the task asks for one.',
-    '- Stop if authority is unclear, validation cannot run, a secret appears, or writes exceed the envelope.',
-    '',
-    '## Authority Boundary',
-    '',
-    'This skill does not grant authority. It cannot merge, close, promote, push, sign, or approve work.',
-  ].join('\n');
-}
-
-function renderSetupNotes(target: SetupTargetConfig): string {
-  return [
-    '# Etiquette Agent Host Setup',
-    '',
-    `Target: ${target.display}`,
-    '',
-    'This directory contains project-local guidance for using Etiquette in this repository.',
-    '',
-    'The installed guidance is intentionally advisory:',
-    '',
-    '- no lifecycle hooks are installed in v0;',
-    '- no global agent config is written;',
-    '- no project bootstrap is performed;',
-    '- no seat is joined;',
-    '- no task is picked up;',
-    '- no authority is granted.',
-    '',
-    'Head-start read order for fresh sessions:',
-    '',
-    '1. `AGENTS.md`',
-    '2. `docs/work/BOARD.md`',
-    '3. `docs/work/runbooks/SESSION_PICKUP.md`',
-    '4. `docs/work/manuals/SEAT_OPERATING_MANUAL.md`',
-    '5. `docs/work/cookbooks/ADD_A_LANE.md`',
-    '',
-    'After interrupted sessions, cwd/worktree ambiguity, role changes, or',
-    'vendor swaps, verify `whereami`, `doctor`, local queue, branch, and',
-    'worktree before pickup. Lifecycle checks are evidence only; they do not',
-    'authorize work.',
-    '',
-    'A live seat should still run:',
-    '',
-    '```sh',
-    'etiquette whereami --project . --seat <seat-id> --task <task-id>',
-    'etiquette join --project . --seat <seat-id>',
-    'etiquette pickup --project . --seat <seat-id> --task <task-id> --text',
-    '```',
-  ].join('\n');
-}
-
-async function dispatchSetup(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  const dryRun = flags['dry-run'] === true;
-  const ejected = flags.eject === true;
-  const force = flags.force === true;
-  const { mode, targets } = parseSetupTargets(root, flags);
-
-  const result: SetupResult = {
-    schema: 'agent-host-setup.v0',
-    project: root,
-    target_mode: mode,
-    targets: [],
-    dry_run: dryRun,
-    ejected,
-    authority_boundary: {
-      setup_installs_project_guidance_only: true,
-      can_install_hooks: false,
-      can_write_global_config: false,
-      can_bootstrap_project: false,
-      can_join_seat: false,
-      can_pickup_task: false,
-      can_grant: false,
-      can_merge: false,
-      can_close: false,
-      can_push: false,
-    },
-    next_step: ejected
-      ? 'project-local Etiquette agent guidance removed; reinstall with etiquette setup --target <host>'
-      : 'restart or refresh the agent session, then run etiquette whereami/join/pickup for the assigned seat and task',
-  };
-
-  for (const target of targets) {
-    const detected = commandAvailable(target.cliCommand) || existsSync(join(root, target.configDir));
-    const generated: string[] = [];
-    const skipped: string[] = [];
-    const removed: string[] = [];
-    const files = [
-      { ref: target.skillRef, content: renderEtiquetteSkill(target) },
-      { ref: target.notesRef, content: renderSetupNotes(target) },
-    ];
-
-    if (ejected) {
-      for (const file of files) {
-        const path = join(root, file.ref);
-        if (existsSync(path)) {
-          if (!dryRun) await rm(path, { force: true });
-          removed.push(file.ref);
-        } else {
-          skipped.push(file.ref);
-        }
-      }
-    } else {
-      for (const file of files) {
-        if (dryRun) {
-          generated.push(file.ref);
-          continue;
-        }
-        await writeGeneratedText(root, file.ref, file.content, force, { generated, skipped });
-      }
-    }
-
-    result.targets.push({
-      target: target.target,
-      display: target.display,
-      detected,
-      config_dir: target.configDir,
-      skill_ref: target.skillRef,
-      notes_ref: target.notesRef,
-      action: dryRun ? 'dry-run' : ejected ? 'ejected' : generated.length > 0 ? 'installed' : 'skipped',
-      generated,
-      skipped,
-      removed,
-    });
-  }
-
-  if (flags.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-
-  console.log([
-    'agent_host_setup:',
-    `  project: ${result.project}`,
-    `  target_mode: ${result.target_mode}`,
-    `  dry_run: ${String(result.dry_run)}`,
-    `  eject: ${String(result.ejected)}`,
-    '  authority_boundary: project-local guidance only; no hooks, global config, bootstrap, join, pickup, push, merge, close, or grant',
-    'targets:',
-    ...result.targets.flatMap((target) => [
-      `  - ${target.target} detected=${String(target.detected)} action=${target.action}`,
-      `    skill_ref: ${target.skill_ref}`,
-      `    notes_ref: ${target.notes_ref}`,
-      `    generated: ${target.generated.join(', ') || 'none'}`,
-      `    skipped: ${target.skipped.join(', ') || 'none'}`,
-      `    removed: ${target.removed.join(', ') || 'none'}`,
-    ]),
-    `next_step: ${result.next_step}`,
-  ].join('\n'));
-}
-
-async function ensureLocalProject(root: string): Promise<void> {
-  await mkdir(join(root, '.etiquette', 'events'), { recursive: true });
-  await mkdir(join(root, '.etiquette', 'audit'), { recursive: true });
-  await mkdir(join(root, '.etiquette', 'diagnostics'), { recursive: true });
-  await mkdir(join(root, '.etiquette', 'notify', 'queues'), { recursive: true });
-  await mkdir(join(root, '.etiquette', 'notify', 'subscriptions'), { recursive: true });
-  await mkdir(join(root, '.etiquette', 'roster', 'enrollments'), { recursive: true });
-  await mkdir(join(root, '.etiquette', 'state'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'cookbooks'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'huddle-cards'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'ledger'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'manuals'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'onboarding'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'packets'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'receipts'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'runbooks'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'seat-cards'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'sessions'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'tasks'), { recursive: true });
-  await mkdir(join(root, 'docs', 'work', 'trash'), { recursive: true });
-
-  await ensureProjectBinding(root);
-  if (!existsSync(eventPath(root))) await writeFile(eventPath(root), '');
-  if (!existsSync(ledgerPath(root))) {
-    await writeFile(ledgerPath(root), '# Local Etiquette Ledger\n\n');
-  }
-}
-
-async function readEvents(root: string): Promise<LocalEvent[]> {
-  await ensureLocalProject(root);
-  const raw = await readFile(eventPath(root), 'utf-8');
-  return raw
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => JSON.parse(line) as LocalEvent);
-}
-
-async function readEventsIfInitialized(root: string): Promise<LocalEvent[]> {
-  const raw = await readTextIfExists(eventPath(root));
-  if (!raw) return [];
-  return raw
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => JSON.parse(line) as LocalEvent);
-}
-
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolveSleep) => {
-    setTimeout(resolveSleep, ms);
-  });
-}
-
-async function withEventLock<T>(root: string, fn: () => Promise<T>): Promise<T> {
-  const lockDir = join(root, '.etiquette', 'events', 'local.ndjson.lock');
-  for (let attempt = 0; attempt < 200; attempt += 1) {
-    try {
-      await mkdir(lockDir);
-      try {
-        return await fn();
-      } finally {
-        await rm(lockDir, { recursive: true, force: true });
-      }
-    } catch (err) {
-      if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
-      await sleep(10);
-    }
-  }
-  throw new Error('timed out waiting for local event lock');
-}
-
-async function appendLedger(root: string, event: LocalEvent): Promise<void> {
-  const fields = [
-    `type=${event.type}`,
-    typeof event.lane === 'string' ? `lane=${event.lane}` : undefined,
-    typeof event.from === 'string' ? `from=${event.from}` : undefined,
-    typeof event.to === 'string' ? `to=${event.to}` : undefined,
-    typeof event.next_owner === 'string' ? `next_owner=${event.next_owner}` : undefined,
-  ].filter(Boolean).join(' ');
-  await appendFile(ledgerPath(root), `- ${event.created_at} ${event.event_ref} ${fields}\n`);
-}
-
-async function appendLocalEventUnlocked(
-  root: string,
-  type: string,
-  payload: JsonRecord,
-  flags?: Record<string, string | boolean>,
-): Promise<LocalEvent> {
-  const events = await readEvents(root);
-  const seq = events.reduce((max, event) => Math.max(max, event.seq), 0) + 1;
-  const event: LocalEvent = {
-    schema: 'local-event.v0',
-    seq,
-    event_ref: `local://event/${seq}`,
-    created_at: nowIso(flags),
-    type,
-    ...payload,
-  };
-  await appendFile(eventPath(root), `${JSON.stringify(event)}\n`);
-  await appendLedger(root, event);
-  return event;
-}
-
-async function appendLocalEvent(
-  root: string,
-  type: string,
-  payload: JsonRecord,
-  flags?: Record<string, string | boolean>,
-): Promise<LocalEvent> {
-  await ensureLocalProject(root);
-  return withEventLock(root, () => appendLocalEventUnlocked(root, type, payload, flags));
-}
-
-function renderSeatCard(seat: BootstrapSeat): string {
-  return [
-    'schema: seat-model-card.v0',
-    `seat_id: ${seat.seatId}`,
-    `display_name: ${seat.displayName}`,
-    `operator_principal: ${seat.operatorPrincipal}`,
-    'execution_surface: local-etiquette',
-    `seat_type: ${seat.seatType}`,
-    `model_ref: ${seat.modelRef}`,
-    'model_posture_ref: docs/work/onboarding/local-etiquette-canary.md',
-    'authority_boundary:',
-    '  can_authorize_work: false',
-    '  can_close_lane_without_grant: false',
-    '  can_merge_or_push_without_grant: false',
-    'allowed_work:',
-    yamlList(seat.allowedWork),
-    'forbidden_work:',
-    yamlList(seat.forbiddenWork),
-    '',
-  ].join('\n');
-}
-
-function renderTask(root: string, plan: BootstrapPlan, task: BootstrapTask): string {
-  const taskIndex = task.id.slice(plan.taskPrefix.length + 1);
-  const reviewFocus = task.reviewFocus ? [
-    'review_focus:',
-    yamlList(task.reviewFocus),
-  ] : [];
-  return [
-    'schema: task-envelope.v0',
-    `task_id: ${task.id}`,
-    `title: ${task.title}`,
-    `mode: ${task.mode}`,
-    `owner: ${plan.lead.seatId}`,
-    `assigned_to: ${task.assignedTo.seatId}`,
-    'project_ref: .',
-    'startup_docs:',
-    '  - AGENTS.md',
-    '  - docs/work/BOARD.md',
-    '  - docs/work/onboarding/local-etiquette-canary.md',
-    `  - docs/work/huddle-cards/${task.id}.yaml`,
-    'allowed_writes:',
-    yamlList(taskAllowedWrites(task)),
-    'forbidden_sources:',
-    '  - external coordination repos unless explicitly routed',
-    '  - raw chat transcripts',
-    'validation:',
-    yamlList(task.validation),
-    'execution_strategy:',
-    `  strategy: ${taskExecutionStrategy(task)}`,
-    '  strategy_policy: executor_selected',
-    '  authority_boundary:',
-    '    strategy_metadata_grants_authority: false',
-    '    can_authorize: false',
-    '    can_merge: false',
-    '    can_close: false',
-    '    can_grant: false',
-    '    can_sign: false',
-    'topology_constraints:',
-    '  reviewers_read_only: true',
-    '  child_agents_cannot_promote: true',
-    '  one_writer_per_worktree: true',
-    '  runner_swaps_require_lifecycle_preflight: true',
-    '  strategy_metadata_grants_authority: false',
-    '  topology_grants_authority: false',
-    '  can_promote: false',
-    '  can_merge: false',
-    '  can_close: false',
-    '  can_grant: false',
-    '  can_sign: false',
-    'expected_return:',
-    `  receipt: docs/work/receipts/${task.id}-${task.assignedTo.seatId}.md`,
-    ...reviewFocus,
-    'stop_conditions:',
-    task.mode === 'product-implementation' ? '  - edit outside allowed_writes required' : '  - product edit requested',
-    '  - authority-bearing action requested',
-    'evidence_sink:',
-    `  session: session-${task.id}`,
-    `  runbook: docs/work/sessions/session-${task.id}/RUNBOOK.md`,
-    'authority_boundary:',
-    '  can_authorize: false',
-    '  can_merge: false',
-    '  can_close: false',
-    '  can_write_global_ledger: false',
-    `# task_index: ${taskIndex}`,
-    '',
-  ].join('\n');
-}
-
-function renderHuddleCard(root: string, plan: BootstrapPlan, task: BootstrapTask): string {
-  return [
-    'schema_version: huddle-card.v1',
-    `repo: ${safeName(root.split('/').pop() ?? 'repo')}`,
-    'repo_path: .',
-    `lane: ${task.id}`,
-    `task_id: ${task.id}`,
-    'status: open',
-    `mode: ${task.mode}`,
-    'startup_docs:',
-    '  - AGENTS.md',
-    '  - docs/work/BOARD.md',
-    '  - docs/work/onboarding/local-etiquette-canary.md',
-    `  - docs/work/tasks/${task.id}.yaml`,
-    'allowed_writes:',
-    yamlList(taskAllowedWrites(task)),
-    'forbidden_sources:',
-    '  - external coordination repos unless explicitly routed',
-    '  - raw chat transcripts',
-    'validation:',
-    yamlList(task.validation),
-    `current_owner: ${task.assignedTo.seatId}`,
-    `next_owner: ${task.assignedTo.seatId}`,
-    'expires_or_refresh_after: 2099-01-01T00:00:00Z',
-    `task_packet: docs/work/tasks/${task.id}.yaml`,
-    `evidence_sink: docs/work/sessions/session-${task.id}/RUNBOOK.md`,
-    '',
-  ].join('\n');
-}
-
-function renderWorkspacePrincipal(root: string, plan: BootstrapPlan): string {
-  const notes = [
-    `${plan.lead.seatId} is the local orchestration lead.`,
-    ...(plan.reviewers.length > 0
-      ? [`${plan.reviewers.map((seat) => seat.seatId).join(', ')} review or pressure-test the lead's work.`]
-      : []),
-    ...(plan.bootstrapSeat ? [`${plan.bootstrapSeat.seatId} is bootstrap provenance only after handoff.`] : []),
-  ];
-  return `${JSON.stringify({
-    schema: 'workspace-principal.v0',
-    workspace: root.split('/').pop() ?? 'workspace',
-    principal_seat: plan.lead.seatId,
-    operator_principal: plan.lead.operatorPrincipal,
-    execution_surface: 'local-etiquette',
-    bootstrap_profile: plan.profile,
-    authority_model: {
-      scope: 'repo-local',
-      source_of_truth: "this repository's .etiquette and docs/work surfaces",
-      global_bus_authority: false,
-      can_delegate_tasks: true,
-      delegation_grants_merge: false,
-      delegation_grants_close: false,
-      delegation_grants_push: false,
-    },
-    notes,
-  }, null, 2)}\n`;
-}
-
-function renderOnboarding(plan: BootstrapPlan): string {
-  return [
-    '# Local Etiquette Onboarding',
-    '',
-    'Start with `AGENTS.md` and `docs/work/BOARD.md`. Use the runbook and manuals',
-    'after pickup, when a specific task envelope is active.',
-    '',
-    '## Local Lead',
-    '',
-    `\`${plan.lead.seatId}\` is the repo-local orchestration lead for this workspace.`,
-    ...plan.reviewers.map((seat) => `\`${seat.seatId}\` is a review/pressure-test seat.`),
-    ...(plan.bootstrapSeat ? [`\`${plan.bootstrapSeat.seatId}\` is bootstrap provenance only after lead handoff.`] : []),
-    '',
-    '## Runtime Occupant',
-    '',
-    `Current runtime occupant: \`${plan.onboarding.runtime}\`.`,
-    plan.onboarding.runtimeCaption,
-    'Changing runtime does not change the seat, task envelope, or authority.',
-    '',
-    '## First Write Boundary',
-    '',
-    'The first implementation lane may write only:',
-    yamlList(plan.onboarding.writeScope),
-    'Governance surfaces such as `.etiquette/**` and `docs/work/tasks/**` are generated by the tool and are not app-code scratch space.',
-    '',
-    '## Boundaries',
-    '',
-    '- Use this repository\'s `.etiquette` and `docs/work/*` only.',
-    '- Do not use an external ledger for routine task pickup, execution notes, diagnostics, or receipts.',
-    '- Session runbooks are the bounded evidence sink for task-level detail.',
-    '- The task card controls allowed writes.',
-    '- No seat may merge, push, close, promote, or grant authority from readiness alone.',
-    '',
-  ].join('\n');
-}
-
-function renderAgents(plan: BootstrapPlan): string {
-  return [
-    '# AGENTS.md',
-    '',
-    '## Local Etiquette Workspace',
-    '',
-    `- Principal seat: \`${plan.lead.seatId}\``,
-    ...(plan.reviewers.length > 0 ? [`- Review seats: ${plan.reviewers.map((seat) => `\`${seat.seatId}\``).join(', ')}`] : []),
-    ...(plan.bootstrapSeat ? [`- Bootstrap provenance seat: \`${plan.bootstrapSeat.seatId}\``] : []),
-    '- Board: `docs/work/BOARD.md`',
-    '- Local event log: `.etiquette/events/local.ndjson`',
-    '',
-    '## Start Every Session',
-    '',
-    '1. Run `etiquette whereami --project . --seat <seat> --task <task>`.',
-    '2. Read `docs/work/BOARD.md`.',
-    '3. Run `etiquette join --project . --seat <seat>`.',
-    '4. Run the generated pickup command with `--expect-project-id <project_id>`.',
-    '5. Then read `docs/work/runbooks/SESSION_PICKUP.md` for the active task.',
-    '6. After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor swaps, rerun `whereami`, `doctor`, and `notify poll`.',
-    '',
-    'Detailed references, when needed:',
-    '- `docs/work/manuals/SEAT_OPERATING_MANUAL.md`',
-    '- `docs/work/cookbooks/ADD_A_LANE.md`',
-    '',
-    'The task envelope and session runbook are the active work contract.',
-    '',
-    '## Boundary',
-    '',
-    '- Use this repository\'s `.etiquette` and `docs/work/*`.',
-    '- Do not use an external ledger for routine task execution.',
-    '- Do not merge, push, close, promote, or grant authority from readiness alone.',
-    '',
-  ].join('\n');
-}
-
-function renderBoard(plan: BootstrapPlan): string {
-  return [
-    '# Local Etiquette Board',
-    '',
-    '## Local Lead',
-    '',
-    `- \`${plan.lead.seatId}\``,
-    `  - Operator principal: \`${plan.lead.operatorPrincipal}\``,
-    '  - Scope: repo-local orchestration.',
-    '  - Principal record: `docs/work/workspace-principal.v0.json`',
-    ...plan.reviewers.flatMap((seat) => [
-      `- \`${seat.seatId}\``,
-      `  - Operator principal: \`${seat.operatorPrincipal}\``,
-      `  - Role: ${seat.allowedWork[1] ?? 'review/pressure-test'}.`,
-    ]),
-    ...(plan.bootstrapSeat ? [
-      `- \`${plan.bootstrapSeat.seatId}\``,
-      `  - Operator principal: \`${plan.bootstrapSeat.operatorPrincipal}\``,
-      '  - Role: bootstrap provenance only after handoff.',
-    ] : []),
-    '',
-    '## Active Tasks',
-    '',
-    ...plan.tasks.map((task) => `- \`${task.id}\`: ${task.title} for \`${task.assignedTo.seatId}\``),
-    '',
-    '## Boundary',
-    '',
-    '- Repo-local read model only.',
-    '- No external-ledger traffic for routine execution.',
-    '- No merge, push, close, promote, or grants from readiness.',
-    '',
-  ].join('\n');
-}
-
-function renderSeatManual(plan: BootstrapPlan): string {
-  return [
-    '# Seat Operating Manual',
-    '',
-    '## Roles',
-    '',
-    `- \`${plan.lead.seatId}\`: routes local work, updates board/task evidence, and performs assigned implementation.`,
-    ...plan.reviewers.map((seat) => `- \`${seat.seatId}\`: reviews and challenges the lead's returns.`),
-    ...(plan.bootstrapSeat ? [`- \`${plan.bootstrapSeat.seatId}\`: records bootstrap provenance only after handoff.`] : []),
-    '',
-    '## Authority',
-    '',
-    'Readiness is not authority. These seats cannot merge, push, close, promote, or',
-    'grant authority unless a later explicit decision says so.',
-    '',
-    '## Lifecycle Preflight',
-    '',
-    'After interrupted sessions, cwd/worktree ambiguity, role changes, or',
-    'vendor swaps, rerun `whereami`, `doctor`, and `notify poll` before pickup.',
-    'Lifecycle output is readiness evidence only; the task envelope remains the',
-    'work authority.',
-    '',
-    '## Evidence',
-    '',
-    'Use local sessions for detail:',
-    '',
-    ...plan.tasks.map((task) => `- \`docs/work/sessions/session-${task.id}/RUNBOOK.md\``),
-    '',
-    'Use local receipts for completion summaries:',
-    '',
-    ...plan.tasks.map((task) => `- \`docs/work/receipts/${task.id}-${task.assignedTo.seatId}.md\``),
-    '',
-  ].join('\n');
-}
-
-function renderSessionPickup(plan: BootstrapPlan): string {
-  return [
-    '# Session Pickup Runbook',
-    '',
-    '## Before Pickup',
-    '',
-    '1. Read `AGENTS.md` and `docs/work/BOARD.md`.',
-    '2. Read `docs/work/manuals/SEAT_OPERATING_MANUAL.md`.',
-    '3. After interrupted sessions, cwd/worktree ambiguity, role changes, or vendor swaps, rerun `whereami`, `doctor`, and `notify poll`.',
-    '4. Treat hooks and readiness as evidence only, not authority.',
-    '',
-    ...plan.tasks.flatMap((task) => [
-      `## ${task.assignedTo.displayName}`,
-      '',
-      '```bash',
-      'ETQ_BIN="${ETQ_BIN:-etiquette}"',
-      `"$ETQ_BIN" notify poll --project . --seat ${task.assignedTo.seatId} --text`,
-      `"$ETQ_BIN" console board --project . --seat ${task.assignedTo.seatId} --text`,
-      `"$ETQ_BIN" notify feed --project . --seat ${task.assignedTo.seatId} --text`,
-      `"$ETQ_BIN" bus inbox --addressee ${task.assignedTo.seatId} --project . --text`,
-      `"$ETQ_BIN" session note --project . --session session-${task.id} --section note --message "Started pickup."`,
-      '```',
-      '',
-      `Work from \`docs/work/tasks/${task.id}.yaml\`.`,
-      `Write task detail to \`docs/work/sessions/session-${task.id}/RUNBOOK.md\`.`,
-      task.mode === 'read-only-audit' ? 'Do not edit product files unless a later task envelope allows it.' : 'Stay inside the task envelope allowed writes.',
-      '',
-      'After writing the receipt, post the local return so the next seat can see it:',
-      '',
-      '```bash',
-      'ETQ_BIN="${ETQ_BIN:-etiquette}"',
-      `"$ETQ_BIN" post --project . --role ${localReturnRole(task)} --lane ${task.id} --from ${task.assignedTo.seatId} --to ${localReturnTarget(plan, task)} --emit`,
-      `"$ETQ_BIN" notify feed --project . --seat ${localReturnTarget(plan, task)} --text`,
-      '```',
-      '',
-    ]),
-  ].join('\n');
-}
-
-function renderAddLaneCookbook(plan: BootstrapPlan): string {
-  return [
-    '# Add A Local Lane',
-    '',
-    '1. Create a task envelope under `docs/work/tasks/<task-id>.yaml`.',
-    '2. Create a huddle card under `docs/work/huddle-cards/<task-id>.yaml`.',
-    '3. Create a bounded session:',
-    '',
-    '```bash',
-    'ETQ_BIN="${ETQ_BIN:-etiquette}"',
-    `"$ETQ_BIN" session create --project . --seat ${plan.lead.seatId} --task <task-id> --session-id session-<task-id> --operator ${plan.lead.operatorPrincipal} --owner ${plan.lead.seatId}`,
-    '```',
-    '',
-    '4. Subscribe the target seat:',
-    '',
-    '```bash',
-    'ETQ_BIN="${ETQ_BIN:-etiquette}"',
-    '"$ETQ_BIN" notify subscribe --project . --seat <seat-id> --lane <task-id> --roles task-bundle,implementation-return',
-    '```',
-    '',
-    '5. Poll the local wake queue:',
-    '',
-    '```bash',
-    'ETQ_BIN="${ETQ_BIN:-etiquette}"',
-    '"$ETQ_BIN" notify poll --project . --seat <seat-id> --text',
-    '```',
-    '',
-    '6. Post the local packet:',
-    '',
-    '```bash',
-    'ETQ_BIN="${ETQ_BIN:-etiquette}"',
-    `"$ETQ_BIN" post --project . --role task-bundle --lane <task-id> --from ${plan.lead.seatId} --to <seat-id> --mode product-implementation --next-owner <seat-id> --emit`,
-    '```',
-    '',
-    'Keep routine execution in this repo. Do not write an external ledger for local task',
-    'pickup, retries, diagnostics, or runbook detail.',
-    '',
-  ].join('\n');
-}
-
-async function readStructured(path: string): Promise<unknown> {
-  const raw = await readFile(path, 'utf-8');
-  if (path.endsWith('.json')) return JSON.parse(raw) as unknown;
-  return parseYaml(raw) as unknown;
-}
-
-function validateSeatCardObject(card: JsonRecord): string {
-  if (card.schema !== 'seat-model-card.v0') throw new Error('seat card schema must be seat-model-card.v0');
-  const seatId = stringField(card, 'seat_id');
-  if (!seatId) throw new Error('seat_id is required');
-  const boundary = asRecord(card.authority_boundary, 'authority_boundary');
-  for (const field of FALSE_AUTHORITY_FIELDS) {
-    if (boolField(boundary, field) !== false) {
-      throw new Error(`authority_boundary.${field} must be false`);
-    }
-  }
-  return seatId;
-}
-
-async function validateSeatCard(path: string): Promise<string> {
-  return validateSeatCardObject(asRecord(await readStructured(path), 'seat card'));
-}
-
-async function enrollmentPath(root: string, seat: string): Promise<string> {
-  await ensureLocalProject(root);
-  return join(root, '.etiquette', 'roster', 'enrollments', `${safeName(seat)}.json`);
-}
-
-async function subscriptionPath(root: string, seat: string): Promise<string> {
-  await ensureLocalProject(root);
-  return join(root, '.etiquette', 'notify', 'subscriptions', `${safeName(seat)}.json`);
-}
-
-async function wakeQueuePath(root: string, seat: string): Promise<string> {
-  await ensureLocalProject(root);
-  return join(root, '.etiquette', 'notify', 'queues', `${safeName(seat)}.json`);
-}
-
-function parseOptionalPositiveInt(raw: string | boolean | undefined, key: string, fallback: number): number {
-  if (raw === undefined || raw === false) return fallback;
-  if (raw === true) throw new Error(`--${key} must be an integer`);
-  const n = Number.parseInt(raw, 10);
-  if (!Number.isFinite(n) || n < 0) throw new Error(`--${key} must be a non-negative integer`);
-  return n;
-}
-
-async function listJsonFiles(dir: string): Promise<string[]> {
-  if (!existsSync(dir)) return [];
-  const entries = await readdir(dir, { withFileTypes: true });
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith('.json')).map((entry) => join(dir, entry.name));
-}
-
-function renderEvents(events: LocalEvent[]): string {
-  if (events.length === 0) return 'no local events';
-  return events.map((event) => {
-    const parts = [
-      `${event.event_ref}`,
-      event.type,
-      typeof event.lane === 'string' ? `lane=${event.lane}` : undefined,
-      typeof event.from === 'string' ? `from=${event.from}` : undefined,
-      typeof event.to === 'string' ? `to=${event.to}` : undefined,
-      typeof event.next_owner === 'string' ? `next_owner=${event.next_owner}` : undefined,
-    ].filter(Boolean);
-    return parts.join(' ');
-  }).join('\n');
-}
-
-function busViewFormat(flags: Record<string, string | boolean>): 'text' | 'json' | 'markdown' {
-  const format = optionalString(flags, 'format') ?? (flags.json === true ? 'json' : 'text');
-  if (format !== 'text' && format !== 'json' && format !== 'markdown') {
-    throw new Error('--format must be one of: text, json, markdown');
-  }
-  return format;
-}
-
-function busViewKind(flags: Record<string, string | boolean>): LocalLedgerViewKind {
-  const kind = optionalString(flags, 'kind') ?? 'all';
-  if (kind !== 'all' && kind !== 'events' && kind !== 'packets') {
-    throw new Error('--kind must be one of: all, events, packets');
-  }
-  return kind;
-}
-
-function timelineScope(flags: Record<string, string | boolean>): TimelineScope {
-  const scope = optionalString(flags, 'scope') ?? 'project';
-  if (scope !== 'project' && scope !== 'seat' && scope !== 'lane' && scope !== 'principal') {
-    throw new Error('--scope must be one of: project, seat, lane, principal');
-  }
-  return scope;
-}
-
-type ReturnEnforcementTier = 'local-advisory' | 'remote-runner-hard-gate';
-
-interface ReturnCheckResult {
-  schema: 'return-enforcement-check.v0';
-  task: string;
-  seat: string;
-  seat_alias: string | null;
-  expected_roles: ('implementation-return' | 'review-return')[];
-  enforcement_tier: ReturnEnforcementTier;
-  verdict: ReturnCheckVerdict;
-  completion_gate_hard: boolean;
-  matched_return_packets: ReturnType<typeof detectReturnPackets>['matched_return_packets'];
-  posted_return_packets: ReturnType<typeof detectReturnPackets>['posted_return_packets'];
-  latest_event_ref: string;
-  event_log_hash: string;
-  advisory: string;
-  authority_boundary: {
-    check_can_authorize: false;
-    check_can_execute: false;
-    check_can_write: false;
-    check_can_post_return: false;
-    check_can_merge: false;
-    check_can_close: false;
-    check_can_grant: false;
-    check_can_write_global_ledger: false;
-  };
-}
-
-function boolFlag(flags: Record<string, string | boolean>, key: string): boolean {
-  const value = flags[key];
-  return value === true || value === 'true' || value === '1' || value === 'yes';
-}
-
-function returnCheckTier(flags: Record<string, string | boolean>): ReturnEnforcementTier {
-  if (boolFlag(flags, 'remote-runner')) return 'remote-runner-hard-gate';
-  const tier = optionalString(flags, 'tier') ?? 'local-advisory';
-  if (tier !== 'local-advisory' && tier !== 'remote-runner-hard-gate') {
-    throw new Error('--tier must be one of: local-advisory, remote-runner-hard-gate');
-  }
-  return tier;
-}
-
-function expectedReturnRoles(flags: Record<string, string | boolean>): ReturnRole[] {
-  const role = optionalString(flags, 'role') ?? 'any';
-  if (role === 'any') return ['implementation-return', 'review-return'];
-  if (role === 'implementation-return' || role === 'review-return') return [role];
-  throw new Error('--role must be one of: any, implementation-return, review-return');
-}
-
-function renderReturnCheck(result: ReturnCheckResult): string {
-  return [
-    `return_check: ${result.verdict}`,
-    `task: ${result.task}`,
-    `seat: ${result.seat}`,
-    result.seat_alias ? `seat_alias: ${result.seat_alias} -> ${result.seat}` : null,
-    `expected_roles: ${result.expected_roles.join(',')}`,
-    `enforcement_tier: ${result.enforcement_tier}`,
-    `completion_gate_hard: ${String(result.completion_gate_hard)}`,
-    `matched_return_packets: ${result.matched_return_packets.length}`,
-    `posted_return_packets: ${result.posted_return_packets.length}`,
-    `latest_event_ref: ${result.latest_event_ref}`,
-    `event_log_hash: ${result.event_log_hash}`,
-    `advisory: ${result.advisory}`,
-    'authority_boundary: read-only check; cannot authorize, execute, write, post returns, merge, close, grant, or write global ledger',
-  ].filter((line): line is string => line !== null).join('\n');
-}
-
-function queueMatch(event: LocalEvent, seat: string, lanes: Set<string>): WakeQueueItem['match'] | null {
-  if (event.to === seat) return 'direct';
-  if (event.next_owner === seat) return 'next_owner';
-  if (typeof event.lane === 'string' && lanes.has(event.lane)) return 'subscription';
-  return null;
-}
-
-function buildWakeQueueItem(event: LocalEvent, match: WakeQueueItem['match']): WakeQueueItem {
-  return {
-    seq: event.seq,
-    event_ref: event.event_ref,
-    created_at: event.created_at,
-    type: event.type,
-    lane: typeof event.lane === 'string' ? event.lane : null,
-    role: typeof event.role === 'string' ? event.role : null,
-    to: typeof event.to === 'string' ? event.to : null,
-    next_owner: typeof event.next_owner === 'string' ? event.next_owner : null,
-    packet_ref: typeof event.packet_ref === 'string' ? event.packet_ref : null,
-    requires_ack: event.requires_ack === true,
-    match,
-  };
-}
-
-async function buildWakeQueue(
-  root: string,
-  seat: string,
-  flags: Record<string, string | boolean>,
-): Promise<WakeQueue> {
-  assertSharedMemoryScopeId(seat, '--seat');
-  const subscriptionsRef = await subscriptionPath(root, seat);
-  const subscriptions = await readJsonIfExists<{ subscriptions: JsonRecord[] }>(
-    subscriptionsRef,
-    { subscriptions: [] },
-  );
-  const lanes = new Set(subscriptions.subscriptions.map((entry) => stringField(entry, 'lane')).filter((value): value is string => Boolean(value)));
-  const afterSeq = parseOptionalPositiveInt(flags['after-seq'], 'after-seq', 0);
-  const limit = parseOptionalPositiveInt(flags.limit, 'limit', 50);
-  const events = await readEvents(root);
-  const items = events
-    .filter((event) => event.seq > afterSeq)
-    .map((event) => {
-      const match = queueMatch(event, seat, lanes);
-      return match ? buildWakeQueueItem(event, match) : null;
-    })
-    .filter((item): item is WakeQueueItem => item !== null)
-    .slice(-limit);
-
-  return {
-    schema: 'remote-wake-queue.v0',
-    seat,
-    updated_at: nowIso(flags),
-    source: {
-      event_log_ref: '.etiquette/events/local.ndjson',
-      after_seq: afterSeq,
-      max_seq_seen: events.reduce((max, event) => Math.max(max, event.seq), 0),
-      subscriptions_ref: relativeRef(root, subscriptionsRef),
-    },
-    transport: wakeQueueTransport(),
-    payload_boundary: wakeQueuePayloadBoundary(),
-    items,
-    authority_boundary: wakeQueueAuthorityBoundary(),
-  };
-}
-
-async function wakeSeatsForEvent(root: string, event: LocalEvent): Promise<string[]> {
-  const seats = new Set<string>();
-  if (typeof event.to === 'string') seats.add(event.to);
-  if (typeof event.next_owner === 'string') seats.add(event.next_owner);
-
-  const subscriptionFiles = await listJsonFiles(join(root, '.etiquette', 'notify', 'subscriptions'));
-  for (const file of subscriptionFiles) {
-    const record = await readJsonIfExists<{ seat?: string; subscriptions?: JsonRecord[] }>(
-      file,
-      { subscriptions: [] },
-    );
-    const seat = typeof record.seat === 'string' ? record.seat : null;
-    if (!seat) continue;
-    const lanes = new Set((record.subscriptions ?? [])
-      .map((entry) => stringField(entry, 'lane'))
-      .filter((value): value is string => Boolean(value)));
-    if (queueMatch(event, seat, lanes)) seats.add(seat);
-  }
-
-  return [...seats].sort();
-}
-
-async function refreshWakeQueuesForEvent(root: string, event: LocalEvent, flags: Record<string, string | boolean>): Promise<void> {
-  for (const seat of await wakeSeatsForEvent(root, event)) {
-    const queue = await buildWakeQueue(root, seat, flags);
-    await writeJson(await wakeQueuePath(root, seat), queue);
-  }
-}
-
-function renderWakeQueue(queue: WakeQueue): string {
-  const rows = queue.items.length === 0
-    ? ['no queued wake items']
-    : queue.items.map((item) => [
-      item.event_ref,
-      item.type,
-      item.lane ? `lane=${item.lane}` : undefined,
-      item.role ? `role=${item.role}` : undefined,
-      item.to ? `to=${item.to}` : undefined,
-      item.next_owner ? `next_owner=${item.next_owner}` : undefined,
-      `match=${item.match}`,
-      item.requires_ack ? 'requires_ack=true' : undefined,
-      item.packet_ref ? `packet_ref=${item.packet_ref}` : undefined,
-    ].filter(Boolean).join(' '));
-  return [
-    `wake_queue: ${queue.seat}`,
-    `items: ${queue.items.length}`,
-    `after_seq: ${queue.source.after_seq}`,
-    `max_seq_seen: ${queue.source.max_seq_seen}`,
-    `transport: ${queue.transport.mode}`,
-    `pointers_only: ${String(queue.payload_boundary.pointers_only)}`,
-    `queue_is_authority: ${String(queue.authority_boundary.queue_is_authority)}`,
-    ...rows,
-  ].join('\n');
-}
-
-function parseGitHubSignature(signature: string): Buffer {
-  const prefix = 'sha256=';
-  if (!signature.startsWith(prefix)) {
-    throw new Error('--signature-256 must start with sha256=');
-  }
-  const hex = signature.slice(prefix.length);
-  if (!/^[0-9a-fA-F]{64}$/.test(hex)) {
-    throw new Error('--signature-256 must be a sha256 hex digest');
-  }
-  return Buffer.from(hex, 'hex');
-}
-
-function verifyGitHubSignature(rawPayload: Buffer, signature: string, secret: string): void {
-  const expected = createHmac('sha256', secret).update(rawPayload).digest();
-  const actual = parseGitHubSignature(signature);
-  if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
-    throw new Error('github webhook signature verification failed');
-  }
-}
-
-function commitRef(value: string | undefined, field: string): string | null {
-  if (!value) return null;
-  if (!/^[0-9a-f]{40}$/i.test(value)) throw new Error(`GitHub webhook ${field} must be a full commit SHA`);
-  return value;
-}
-
-function renderGitHubWebhookWake(wake: GitHubWebhookWake | GitHubWebhookPing): string {
-  if (wake.schema === 'github-webhook-ping.v0') {
-    return [
-      `github_webhook_ping: ${wake.repository.full_name}`,
-      `event: ${wake.event}`,
-      `delivery_id: ${wake.delivery_id}`,
-      `signature_verified: ${String(wake.transport.signature_verified)}`,
-      `pointers_only: ${String(wake.payload_boundary.pointers_only)}`,
-      `notification_is_authority: ${String(wake.authority_boundary.notification_is_authority)}`,
-      `next_action: ${wake.next_action}`,
-    ].join('\n');
-  }
-  return [
-    `github_webhook_wake: ${wake.repository.full_name}`,
-    `event: ${wake.event}`,
-    `delivery_id: ${wake.delivery_id}`,
-    `ref: ${wake.ref}`,
-    `after: ${wake.after}`,
-    wake.before ? `before: ${wake.before}` : null,
-    `signature_verified: ${String(wake.transport.signature_verified)}`,
-    `pointers_only: ${String(wake.payload_boundary.pointers_only)}`,
-    `notification_is_authority: ${String(wake.authority_boundary.notification_is_authority)}`,
-    `next_action: ${wake.next_action}`,
-  ].filter((line): line is string => line !== null).join('\n');
-}
-
-async function buildGitHubWebhookWake(flags: Record<string, string | boolean>): Promise<GitHubWebhookWake | GitHubWebhookPing> {
-  const provider = optionalString(flags, 'provider') ?? 'github';
-  if (provider !== 'github') throw new Error('--provider must be github');
-  const event = optionalString(flags, 'event') ?? 'push';
-  if (event !== 'push' && event !== 'ping') throw new Error('W1 supports only GitHub push and ping webhook events');
-  const deliveryId = requireString(flags, 'delivery');
-  assertSharedMemoryScopeId(deliveryId, '--delivery');
-  const signature = requireString(flags, 'signature-256');
-  const secretEnv = optionalString(flags, 'secret-env') ?? 'ETIQUETTE_GITHUB_WEBHOOK_SECRET';
-  assertSharedMemoryScopeId(secretEnv, '--secret-env');
-  const secret = process.env[secretEnv];
-  if (!secret) throw new Error(`missing GitHub webhook secret in ${secretEnv}`);
-
-  const payloadPath = resolve(requireString(flags, 'payload'));
-  const rawPayload = await readFile(payloadPath);
-  verifyGitHubSignature(rawPayload, signature, secret);
-
-  const payload = asRecord(JSON.parse(rawPayload.toString('utf-8')), 'GitHub webhook payload');
-  const repository = asRecord(payload.repository, 'GitHub webhook repository');
-  const sender = payload.sender ? asRecord(payload.sender, 'GitHub webhook sender') : null;
-  const fullName = stringField(repository, 'full_name');
-  if (!fullName) throw new Error('GitHub webhook repository.full_name is required');
-  const source = {
-    payload_ref: `github://delivery/${deliveryId}`,
-    payload_sha256: createHash('sha256').update(rawPayload).digest('hex'),
-    signature_header: 'X-Hub-Signature-256' as const,
-    delivery_header: 'X-GitHub-Delivery' as const,
-    event_header: 'X-GitHub-Event' as const,
-  };
-  if (event === 'ping') {
-    return {
-      schema: 'github-webhook-ping.v0',
-      provider: 'github',
-      event,
-      delivery_id: deliveryId,
-      received_at: nowIso(flags),
-      repository: {
-        full_name: fullName,
-        html_url: stringField(repository, 'html_url') ?? null,
-        default_branch: stringField(repository, 'default_branch') ?? null,
-      },
-      sender: sender ? (stringField(sender, 'login') ?? null) : null,
-      hook_id: payload.hook_id === undefined || payload.hook_id === null ? null : String(payload.hook_id),
-      source,
-      transport: githubWebhookPingTransport(),
-      payload_boundary: githubWebhookPayloadBoundary(),
-      authority_boundary: githubWebhookAuthorityBoundary(),
-      next_action: 'receiver_acknowledged_github_ping',
-    };
-  }
-  const pusher = payload.pusher ? asRecord(payload.pusher, 'GitHub webhook pusher') : null;
-  const ref = stringField(payload, 'ref');
-  const after = commitRef(stringField(payload, 'after'), 'after');
-  if (!ref) throw new Error('GitHub webhook ref is required');
-  if (!after) throw new Error('GitHub webhook after is required');
-
-  return {
-    schema: 'github-webhook-wake.v0',
-    provider: 'github',
-    event: 'push',
-    delivery_id: deliveryId,
-    received_at: nowIso(flags),
-    repository: {
-      full_name: fullName,
-      html_url: stringField(repository, 'html_url') ?? null,
-      default_branch: stringField(repository, 'default_branch') ?? null,
-    },
-    ref,
-    before: commitRef(stringField(payload, 'before'), 'before'),
-    after,
-    compare_url: stringField(payload, 'compare') ?? null,
-    pusher: pusher ? (stringField(pusher, 'name') ?? null) : null,
-    sender: sender ? (stringField(sender, 'login') ?? null) : null,
-    source,
-    transport: githubWebhookTransport(),
-    payload_boundary: githubWebhookPayloadBoundary(),
-    authority_boundary: githubWebhookAuthorityBoundary(),
-    next_action: 'receiver_fetch_and_verify_git_ref',
-  };
-}
-
-function trashIndexPath(root: string): string {
-  return join(root, 'docs', 'work', 'trash', 'TRASH.ndjson');
-}
-
-function escapeRegex(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-function pathPatternMatch(rel: string, pattern: string): boolean {
-  if (pattern.endsWith('/**')) return rel.startsWith(pattern.slice(0, -3));
-  return rel === pattern;
-}
-
-function hasYamlMarker(text: string, key: string, values: string[]): boolean {
-  const valuePattern = values.map(escapeRegex).join('|');
-  const re = new RegExp(`(?:^|\\n)\\s*${escapeRegex(key)}\\s*:\\s*(${valuePattern})\\s*(?:\\n|$)`, 'i');
-  return re.test(text);
-}
-
-function hasBooleanMarker(text: string, key: string): boolean {
-  const re = new RegExp(`(?:^|\\n)\\s*${escapeRegex(key)}\\s*:\\s*true\\s*(?:\\n|$)`, 'i');
-  return re.test(text);
-}
-
-function assertKnownReason(reason: string): void {
-  if (!['superseded', 'rejected', 'closed', 'duplicate'].includes(reason)) {
-    throw new Error('--reason must be one of: superseded, rejected, closed, duplicate');
-  }
-}
-
-function protectedReason(rel: string, text: string): string | null {
-  const protectedPatterns = [
-    '.etiquette/events/**',
-    'docs/work/ledger/**',
-    'docs/work/receipts/**',
-    'docs/work/trash/**',
-    'scripts/release-sign.sh',
-    'scripts/release-checksum.sh',
-  ];
-  const matched = protectedPatterns.find((pattern) => pathPatternMatch(rel, pattern));
-  if (matched) return `protected path pattern: ${matched}`;
-
-  if (hasBooleanMarker(text, 'append_only')) return 'content marker append_only:true';
-  if (hasYamlMarker(text, 'content_class', [
-    'append-only',
-    'canonical-evidence',
-    'decision',
-    'evidence',
-    'ledger',
-    'release-receipt',
-    'trusted-checksum',
-  ])) return 'protected content_class marker';
-  if (hasYamlMarker(text, 'role', ['closeout', 'decision', 'review-return', 'implementation-return'])) {
-    return 'protected role marker';
-  }
-  return null;
-}
-
-function retirableClass(rel: string, text: string, reason: string): string | null {
-  if (hasBooleanMarker(text, 'retirable')) return 'explicit-retirable-marker';
-  if (hasYamlMarker(text, 'content_class', [
-    'draft',
-    'rejected-draft',
-    'resolved-task-envelope',
-    'superseded-proposal',
-  ])) return 'content-class-allowlist';
-  if (rel.startsWith('docs/work/drafts/') && ['rejected', 'duplicate'].includes(reason)) {
-    return 'draft-path-allowlist';
-  }
-  if (rel.startsWith('docs/work/proposals/') && ['superseded', 'rejected'].includes(reason)
-    && hasYamlMarker(text, 'status', ['superseded', 'rejected'])) {
-    return 'proposal-status-allowlist';
-  }
-  if (rel.startsWith('docs/work/tasks/') && reason === 'closed'
-    && hasYamlMarker(text, 'status', ['closed', 'resolved'])) {
-    return 'resolved-task-envelope-allowlist';
-  }
-  return null;
-}
-
-function declaresSupersession(text: string, retiredRel: string): boolean {
-  const quoted = escapeRegex(retiredRel);
-  const singleLine = new RegExp(`(?:^|\\n)\\s*supersedes\\s*:\\s*["']?${quoted}["']?\\s*(?:\\n|$)`);
-  const listLine = new RegExp(`(?:^|\\n)\\s*-\\s*["']?${quoted}["']?\\s*(?:\\n|$)`);
-  return singleLine.test(text) || (/(?:^|\n)\s*supersedes\s*:\s*\n/.test(text) && listLine.test(text));
-}
-
-function git(root: string, args: string[], allowFailure = false): { status: number; stdout: string; stderr: string } {
-  const result = spawnSync('git', args, { cwd: root, encoding: 'utf-8' });
-  const status = result.status ?? 1;
-  const output = {
-    status,
-    stdout: result.stdout ?? '',
-    stderr: result.stderr ?? '',
-  };
-  if (!allowFailure && status !== 0) {
-    throw new Error(output.stderr.trim() || output.stdout.trim() || `git ${args.join(' ')} failed`);
-  }
-  return output;
-}
-
-function ensureTrackedCleanPath(root: string, rel: string): void {
-  git(root, ['ls-files', '--error-unmatch', '--', rel]);
-  const status = git(root, ['status', '--porcelain', '--', rel]).stdout.trim();
-  if (status.length > 0) {
-    throw new Error(`retire refuses dirty or staged path: ${rel}`);
-  }
-}
-
-function assertCleanIfTracked(root: string, rel: string): void {
-  const tracked = git(root, ['ls-files', '--error-unmatch', '--', rel], true);
-  if (tracked.status !== 0) return;
-  const status = git(root, ['status', '--porcelain', '--', rel]).stdout.trim();
-  if (status.length > 0) {
-    throw new Error(`retire refuses dirty or staged evidence surface: ${rel}`);
-  }
-}
-
-function headCommit(root: string): string {
-  return git(root, ['rev-parse', 'HEAD']).stdout.trim();
-}
-
-async function readTrashEntries(root: string): Promise<TrashEntry[]> {
-  const raw = await readTextIfExists(trashIndexPath(root));
-  if (!raw) return [];
-  return raw
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => JSON.parse(line) as TrashEntry);
-}
-
-async function writeTrashEntries(root: string, entries: TrashEntry[]): Promise<void> {
-  const path = trashIndexPath(root);
-  await mkdir(dirname(path), { recursive: true });
-  const seen = new Set<string>();
-  const compacted = entries.filter((entry) => {
-    if (seen.has(entry.trash_id)) return false;
-    seen.add(entry.trash_id);
-    return true;
-  });
-  await writeFile(path, compacted.map((entry) => JSON.stringify(entry)).join('\n') + (compacted.length > 0 ? '\n' : ''));
-}
-
-function renderTrashList(root: string, entries: TrashEntry[]): string {
-  if (entries.length === 0) return 'trash: empty';
-  return [
-    `trash: ${entries.length}`,
-    ...entries.map((entry) => `${entry.trash_id} ${entry.reason} ${entry.path} restore_hint=${entry.restore_hint}`),
-    `trash_index_ref: ${relativeRef(root, trashIndexPath(root))}`,
-    'trash_index_is_authority: false',
-  ].join('\n');
-}
-
-async function retirePath(
-  rawPath: string,
-  flags: Record<string, string | boolean>,
-): Promise<void> {
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-  const rel = relativeRef(root, resolve(root, rawPath));
-  const evidenceRef = requireString(flags, 'evidence-ref');
-  const removedBy = requireString(flags, 'removed-by');
-  const reason = requireString(flags, 'reason');
-  assertKnownReason(reason);
-  assertSharedMemoryScopeId(removedBy, '--removed-by');
-  assertSharedMemoryText(evidenceRef, '--evidence-ref');
-
-  await withEventLock(root, async () => {
-    const path = join(root, rel);
-    if (!existsSync(path)) throw new Error(`retire target does not exist: ${rel}`);
-    const text = await readFile(path, 'utf-8');
-    const blocked = protectedReason(rel, text);
-    if (blocked) throw new Error(`retire refused protected evidence (${blocked}): ${rel}`);
-    const klass = retirableClass(rel, text, reason);
-    if (!klass) {
-      throw new Error(`retire refused; path is not in the retirable allowlist: ${rel}`);
-    }
-    let supersededBy: string | null = null;
-    if (reason === 'superseded') {
-      const superseder = requireString(flags, 'superseded-by');
-      supersededBy = relativeRef(root, resolve(root, superseder));
-      const supersederText = await readFile(join(root, supersededBy), 'utf-8');
-      if (!declaresSupersession(supersederText, rel)) {
-        throw new Error(`--superseded-by must declare supersedes: ${rel}`);
-      }
-    }
-
-    ensureTrackedCleanPath(root, rel);
-    assertCleanIfTracked(root, '.etiquette/events/local.ndjson');
-    assertCleanIfTracked(root, 'docs/work/ledger/LEDGER.md');
-    assertCleanIfTracked(root, 'docs/work/trash/TRASH.ndjson');
-    const commit = headCommit(root);
-    git(root, ['show', `${commit}:${rel}`]);
-
-    const removedAt = nowIso(flags);
-    const entry: TrashEntry = {
-      schema: 'trash-index-entry.v0',
-      trash_id: `trash-${removedAt.replace(/[^0-9TZ]/g, '')}-${safeName(rel)}`,
-      path: rel,
-      removed_at: removedAt,
-      removed_by: removedBy,
-      reason,
-      retirable_class: klass,
-      superseded_by: supersededBy,
-      evidence_ref: evidenceRef,
-      last_commit: commit,
-      restore_hint: `git show ${commit}:${rel}`,
-      authority_boundary: {
-        trash_index_is_authority: false,
-        can_close: false,
-        can_merge: false,
-        can_grant: false,
-      },
-    };
-
-    const indexPath = trashIndexPath(root);
-    const previousIndex = await readTextIfExists(indexPath);
-    const previousEvents = await readTextIfExists(eventPath(root));
-    const previousLedger = await readTextIfExists(ledgerPath(root));
-    const entries = await readTrashEntries(root);
-    git(root, ['rm', '--', rel]);
-    try {
-      await writeTrashEntries(root, [...entries, entry]);
-      const event = await appendLocalEventUnlocked(root, 'trash_retired', {
-        trash_entry: entry,
-        authority_boundary: {
-          retirement_authorizes_work: false,
-          can_close: false,
-          can_merge: false,
-          can_grant: false,
-        },
-      }, flags);
-      git(root, ['add', '--', relativeRef(root, indexPath), '.etiquette/events/local.ndjson', 'docs/work/ledger/LEDGER.md']);
-      if (flags.json) {
-        console.log(JSON.stringify({ ...entry, event_ref: event.event_ref, trash_index_ref: relativeRef(root, indexPath) }, null, 2));
-        return;
-      }
-      console.log([
-        `trash_retired: ${entry.trash_id}`,
-        `path: ${entry.path}`,
-        `event: ${event.event_ref}`,
-        `trash_index_ref: ${relativeRef(root, indexPath)}`,
-        'trash_index_is_authority: false',
-      ].join('\n'));
-    } catch (err) {
-      if (previousIndex === null) {
-        await rm(indexPath, { force: true });
-      } else {
-        await writeFile(indexPath, previousIndex);
-      }
-      if (previousEvents !== null) await writeFile(eventPath(root), previousEvents);
-      if (previousLedger !== null) await writeFile(ledgerPath(root), previousLedger);
-      git(root, ['checkout', '--', rel], true);
-      throw err;
-    }
-  });
-}
-
-async function dispatchTrash(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-
-  if (verb === 'retire') {
-    await retirePath(requirePositional(positionals, 2, 'path'), flags);
-    return;
-  }
-
-  if (verb === 'list') {
-    const entries = await readTrashEntries(root);
-    console.log(flags.json ? JSON.stringify({ schema: 'trash-index.v0', entries, trash_index_ref: relativeRef(root, trashIndexPath(root)) }, null, 2) : renderTrashList(root, entries));
-    return;
-  }
-
-  if (verb === 'show') {
-    const trashId = requirePositional(positionals, 2, 'trash-id');
-    const entry = (await readTrashEntries(root)).find((candidate) => candidate.trash_id === trashId);
-    if (!entry) throw new Error(`trash entry not found: ${trashId}`);
-    console.log(flags.json ? JSON.stringify(entry, null, 2) : [
-      `trash_id: ${entry.trash_id}`,
-      `path: ${entry.path}`,
-      `reason: ${entry.reason}`,
-      `superseded_by: ${entry.superseded_by ?? 'none'}`,
-      `restore_hint: ${entry.restore_hint}`,
-      'trash_index_is_authority: false',
-    ].join('\n'));
-    return;
-  }
-
-  if (verb === 'restore') {
-    const trashId = requirePositional(positionals, 2, 'trash-id');
-    const entries = await readTrashEntries(root);
-    const entry = entries.find((candidate) => candidate.trash_id === trashId);
-    if (!entry) throw new Error(`trash entry not found: ${trashId}`);
-    const targetRel = optionalString(flags, 'to') ? relativeRef(root, resolve(root, optionalString(flags, 'to') as string)) : entry.path;
-    const targetPath = join(root, targetRel);
-    if (existsSync(targetPath)) throw new Error(`restore refuses to overwrite existing path: ${targetRel}`);
-    const content = git(root, ['show', `${entry.last_commit}:${entry.path}`]).stdout;
-    await mkdir(dirname(targetPath), { recursive: true });
-    await writeFile(targetPath, content);
-    const event = await appendLocalEvent(root, 'trash_restored', {
-      trash_id: entry.trash_id,
-      restored_path: targetRel,
-      source_path: entry.path,
-      restore_is_content_only: true,
-      authority_boundary: {
-        restore_authorizes_work: false,
-        can_close: false,
-        can_merge: false,
-        can_grant: false,
-      },
-    }, flags);
-    console.log(flags.json
-      ? JSON.stringify({ trash_id: entry.trash_id, restored_path: targetRel, event_ref: event.event_ref, restore_is_content_only: true }, null, 2)
-      : [`trash_restored: ${entry.trash_id}`, `path: ${targetRel}`, `event: ${event.event_ref}`, 'restore_is_content_only: true'].join('\n'));
-    return;
-  }
-
-  if (verb === 'rebuild') {
-    const events = await readEvents(root);
-    const entries = events
-      .map((event) => asRecord(event, 'local event').trash_entry)
-      .filter((entry): entry is TrashEntry => typeof entry === 'object' && entry !== null && (entry as TrashEntry).schema === 'trash-index-entry.v0');
-    await writeTrashEntries(root, entries);
-    console.log(flags.json
-      ? JSON.stringify({ schema: 'trash-rebuild-result.v0', rebuilt_entries: entries.length, trash_index_ref: relativeRef(root, trashIndexPath(root)) }, null, 2)
-      : [`trash_rebuild: ok entries=${entries.length}`, `trash_index_ref: ${relativeRef(root, trashIndexPath(root))}`].join('\n'));
-    return;
-  }
-
-  throw new Error('trash verb must be one of: retire, list, show, restore, rebuild');
-}
-
-async function dispatchInit(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-  await ensureLocalProject(root);
-  const event = await appendLocalEvent(root, 'workspace_initialized', {
-    project_ref: '.',
-    project_id: project.project_id,
-    authority_boundary: {
-      can_authorize_work: false,
-      can_merge: false,
-      can_close: false,
-    },
-  }, flags);
-  console.log(`initialized: ${root}`);
-  console.log(`project_id: ${project.project_id}`);
-  console.log(`event: ${event.event_ref}`);
-}
-
-async function enrollBootstrapSeat(
-  root: string,
-  seat: BootstrapSeat,
-  projectId: string,
-  flags: Record<string, string | boolean>,
-): Promise<LocalEvent> {
-  const cardRef = `docs/work/seat-cards/${seat.seatId}.yaml`;
-  const cardPath = join(root, cardRef);
-  const cardSeat = await validateSeatCard(cardPath);
-  if (cardSeat !== seat.seatId) throw new Error(`seat card seat_id ${cardSeat} does not match ${seat.seatId}`);
-  const enrollment = {
-    schema: 'seat-enrollment.v0',
-    seat_id: seat.seatId,
-    card_ref: cardRef,
-    operator_principal: seat.operatorPrincipal,
-    execution_seat: 'local-etiquette',
-    as_role: seat.asRole,
-    authority_scope: seat.authorityScope,
-    mode: seat.mode,
-    orientation_ref: seat.authorityScope === 'bootstrap-provenance' ? 'docs/work/workspace-principal.v0.json' : 'docs/work/onboarding/local-etiquette-canary.md',
-    ready: false,
-    lifecycle_schema: SEAT_LIFECYCLE_SCHEMA,
-    lifecycle_state: 'enrolled',
-    workflow_id: lifecycleWorkflowId(projectId),
-    runner_binding: runnerBinding({
-      runnerProvider: seat.modelRef,
-      executionSurface: 'local-etiquette',
-      modelId: seat.modelId,
-      modelTier: seat.modelTier,
-      capabilitySource: 'config',
-    }),
-    authority_granted: false,
-    lifecycle_authority_boundary: {
-      lifecycle_grants_authority: false,
-      readiness_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-    },
-    enrolled_at: nowIso(flags),
-    authority_boundary: {
-      enrollment_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-    },
-  };
-  await writeJson(await enrollmentPath(root, seat.seatId), enrollment);
-  return appendLocalEvent(root, 'seat_enrolled', enrollment, flags);
-}
-
-async function readyBootstrapSeat(
-  root: string,
-  seat: BootstrapSeat,
-  projectId: string,
-  flags: Record<string, string | boolean>,
-): Promise<LocalEvent> {
-  const path = await enrollmentPath(root, seat.seatId);
-  const enrollment = await readJsonIfExists<JsonRecord | null>(path, null);
-  if (!enrollment) throw new Error(`seat is not enrolled: ${seat.seatId}`);
-  const orientationRef = seat.authorityScope === 'bootstrap-provenance' ? 'docs/work/workspace-principal.v0.json' : 'docs/work/onboarding/local-etiquette-canary.md';
-  const readyAt = nowIso(flags);
-  const updated = {
-    ...enrollment,
-    ...lifecycleReadyPatch({
-      projectId,
-      at: readyAt,
-      runnerBinding: runnerBinding({
-        runnerProvider: seat.modelRef,
-        executionSurface: 'local-etiquette',
-        modelId: seat.modelId,
-        modelTier: seat.modelTier,
-        capabilitySource: 'config',
-      }),
-    }),
-    ack_ref: `docs/work/seat-cards/${seat.seatId}.yaml`,
-    orientation_ref: orientationRef,
-  };
-  await writeJson(path, updated);
-  return appendLocalEvent(root, 'seat_ready', {
-    seat_id: seat.seatId,
-    lifecycle_state: 'ready',
-    workflow_id: lifecycleWorkflowId(projectId),
-    ack_ref: updated.ack_ref,
-    orientation_ref: updated.orientation_ref,
-    authority_granted: false,
-    authority_boundary: {
-      readiness_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-    },
-  }, flags);
-}
-
-async function subscribeBootstrapSeat(
-  root: string,
-  seat: BootstrapSeat,
-  task: BootstrapTask,
-  flags: Record<string, string | boolean>,
-): Promise<void> {
-  const current = await readJsonIfExists<{ schema: string; seat: string; subscriptions: JsonRecord[] }>(
-    await subscriptionPath(root, seat.seatId),
-    { schema: 'seat-subscriptions.v0', seat: seat.seatId, subscriptions: [] },
-  );
-  current.subscriptions.push({
-    lane: task.id,
-    roles: task.mode === 'product-implementation' ? ['task-bundle', 'implementation-return'] : ['task-bundle', 'review-return'],
-    subscribed_at: nowIso(flags),
-  });
-  await writeJson(await subscriptionPath(root, seat.seatId), current);
-}
-
-async function postBootstrapPacket(
-  root: string,
-  plan: BootstrapPlan,
-  task: BootstrapTask,
-  flags: Record<string, string | boolean>,
-): Promise<LocalEvent> {
-  const packet = {
-    schema: 'local-packet.v0',
-    role: 'task-bundle',
-    lane: task.id,
-    from: plan.lead.seatId,
-    to: task.assignedTo.seatId,
-    verdict: 'routed',
-    packet_tier: '3',
-    mode: task.mode,
-    next_owner: task.assignedTo.seatId,
-    created_at: nowIso(flags),
-    changes_state: true,
-    authority_boundary: {
-      packet_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-    },
-  };
-  const packetName = `${safeName(packet.created_at)}-${safeName(task.id)}-task-bundle.json`;
-  const packetPath = join(root, 'docs', 'work', 'packets', packetName);
-  await writeJson(packetPath, packet);
-  const event = await appendLocalEvent(root, 'packet_posted', {
-    ...packet,
-    packet_ref: relativeRef(root, packetPath),
-  }, flags);
-  await refreshWakeQueuesForEvent(root, event, flags);
-  return event;
-}
-
-async function dispatchBootstrap(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  if (verb !== 'local') throw new Error('bootstrap verb must be: local');
-  const root = projectRoot(flags);
-  const force = flags.force === true;
-  const json = Boolean(flags.json);
-  await applyFirstRunOnboardingPrompts(root, flags);
-  const plan = buildBootstrapPlan(flags);
-  const result = {
-    schema: 'local-bootstrap-result.v0',
-    profile: plan.profile,
-    project: root,
-    project_id: null as string | null,
-    lead_start: null as JsonRecord | null,
-    generated: [] as string[],
-    skipped: [] as string[],
-    events: [] as string[],
-    seats: planSeats(plan).map((seat) => seat.seatId),
-    tasks: plan.tasks.map((task) => task.id),
-    sessions: plan.tasks.map((task) => `session-${task.id}`),
-    onboarding: plan.onboarding,
-    authority_boundary: {
-      can_authorize: false,
-      can_merge: false,
-      can_close: false,
-      can_write_global_ledger: false,
-    },
-  };
-
-  const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-  await ensureLocalProject(root);
-  await ensureMachinePlaneGitignore(root, result);
-  result.project_id = project.project_id;
-  const leadTask = plan.tasks[0]?.id ?? `${plan.taskPrefix}-001`;
-  result.lead_start = {
-    seat: plan.lead.seatId,
-    operator_principal: plan.lead.operatorPrincipal,
-    task: leadTask,
-    task_ref: `docs/work/tasks/${leadTask}.yaml`,
-    runbook_ref: `docs/work/sessions/session-${leadTask}/RUNBOOK.md`,
-    commands: [
-      `etiquette whereami --project . --seat ${plan.lead.seatId} --task ${leadTask} --expect-project-id ${project.project_id}`,
-      `etiquette join --project . --seat ${plan.lead.seatId}`,
-      pickupCommand(plan.lead.seatId, leadTask, project.project_id),
-      `etiquette console board --project . --seat ${plan.lead.seatId} --text`,
-      `etiquette notify feed --project . --seat ${plan.lead.seatId} --text`,
-    ],
-  };
-  result.events.push((await appendLocalEvent(root, 'workspace_initialized', {
-    project_ref: '.',
-    project_id: project.project_id,
-    bootstrap_profile: plan.profile,
-    authority_boundary: {
-      can_authorize_work: false,
-      can_merge: false,
-      can_close: false,
-    },
-  }, flags)).event_ref);
-
-  await writeGeneratedText(root, 'docs/work/workspace-principal.v0.json', renderWorkspacePrincipal(root, plan), force, result);
-  await writeGeneratedText(root, 'docs/work/onboarding/local-etiquette-canary.md', renderOnboarding(plan), force, result);
-  await writeGeneratedText(root, 'docs/work/BOARD.md', renderBoard(plan), force, result);
-  await writeGeneratedText(root, 'docs/work/manuals/SEAT_OPERATING_MANUAL.md', renderSeatManual(plan), force, result);
-  await writeGeneratedText(root, 'docs/work/runbooks/SESSION_PICKUP.md', renderSessionPickup(plan), force, result);
-  await writeGeneratedText(root, 'docs/work/cookbooks/ADD_A_LANE.md', renderAddLaneCookbook(plan), force, result);
-  if (!existsSync(join(root, 'AGENTS.md'))) {
-    await writeGeneratedText(root, 'AGENTS.md', renderAgents(plan), force, result);
-  } else {
-    result.skipped.push('AGENTS.md');
-  }
-
-  for (const seat of planSeats(plan)) {
-    await writeGeneratedText(root, `docs/work/seat-cards/${seat.seatId}.yaml`, renderSeatCard(seat), force, result);
-  }
-  for (const task of plan.tasks) {
-    await writeGeneratedText(root, `docs/work/tasks/${task.id}.yaml`, renderTask(root, plan, task), force, result);
-    await writeGeneratedText(root, `docs/work/huddle-cards/${task.id}.yaml`, renderHuddleCard(root, plan, task), force, result);
-  }
-
-  for (const seat of planSeats(plan)) {
-    result.events.push((await enrollBootstrapSeat(root, seat, project.project_id, flags)).event_ref);
-    result.events.push((await readyBootstrapSeat(root, seat, project.project_id, flags)).event_ref);
-    await reportSeatReadiness({
-      projectRoot: root,
-      seat: seat.seatId,
-      seatType: seat.seatType,
-      executionSurface: 'local-etiquette',
-      declaredBy: 'config',
-      capabilitySource: 'config',
-      operationalStatus: 'operational',
-      modelTier: seat.modelTier,
-      modelId: seat.modelId,
-      activeWorkers: seat.activeWorkers,
-      maxRecommendedWorkers: seat.maxRecommendedWorkers,
-      supportsParallel: seat.supportsParallel,
-      supportedStrategies: seat.supportedStrategies,
-      unsupportedStrategies: [],
-      constraints: [],
-      at: optionalString(flags, 'at'),
-    });
-  }
-
-  for (const task of plan.tasks) {
-    await createSessionRunbook({
-      projectRoot: root,
-      seat: task.assignedTo.seatId,
-      taskRef: task.id,
-      sessionId: `session-${task.id}`,
-      operatorPrincipal: task.assignedTo.operatorPrincipal,
-      ownerPrincipal: plan.lead.seatId,
-      creationMode: 'explicit',
-      at: optionalString(flags, 'at'),
-    });
-    await appendSessionRunbookNote({
-      projectRoot: root,
-      sessionId: `session-${task.id}`,
-      section: 'plan',
-      message: task.planNote,
-      at: optionalString(flags, 'at'),
-    });
-    await subscribeBootstrapSeat(root, task.assignedTo, task, flags);
-    result.events.push((await postBootstrapPacket(root, plan, task, flags)).event_ref);
-  }
-
-  const cardDir = join(root, 'docs', 'work', 'seat-cards');
-  const cardFiles = await readdir(cardDir, { withFileTypes: true });
-  for (const entry of cardFiles) {
-    if (entry.isFile() && (entry.name.endsWith('.yaml') || entry.name.endsWith('.yml') || entry.name.endsWith('.json'))) {
-      await validateSeatCard(join(cardDir, entry.name));
-    }
-  }
-
-  if (json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  console.log([
-    `bootstrap_local: ok project=${root}`,
-    `project_id: ${project.project_id}`,
-    'ledger: .etiquette/events/local.ndjson',
-    `profile: ${plan.profile}`,
-    `runtime_occupant: ${plan.onboarding.runtime}`,
-    `seats: ${result.seats.join(', ')}`,
-    `tasks: ${result.tasks.join(', ')}`,
-    `sessions: ${result.sessions.join(', ')}`,
-    `events: ${result.events.join(', ')}`,
-    `generated: ${result.generated.length}`,
-    `skipped: ${result.skipped.length}`,
-    'start_here:',
-    '  1. AGENTS.md',
-    '  2. docs/work/BOARD.md',
-    '  details_after_pickup: docs/work/runbooks/SESSION_PICKUP.md',
-    'lead_start:',
-    `  seat: ${plan.lead.seatId}`,
-    `  operator_principal: ${plan.lead.operatorPrincipal}`,
-    `  task: ${leadTask}`,
-    `  task_ref: docs/work/tasks/${leadTask}.yaml`,
-    `  runbook_ref: docs/work/sessions/session-${leadTask}/RUNBOOK.md`,
-    '  commands:',
-    ...((result.lead_start?.commands as string[] | undefined) ?? []).map((command) => `    ${command}`),
-    'next:',
-    `  etiquette console board --project . --seat ${plan.lead.seatId} --text`,
-    `  etiquette notify feed --project . --seat ${plan.lead.seatId} --text`,
-    `  etiquette bus inbox --addressee ${plan.lead.seatId} --project . --text`,
-  ].join('\n'));
-}
-
-async function dispatchEnter(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  const task = requirePositional(positionals, 1, 'task');
-  const seat = requireString(flags, 'seat');
-  const operator = requireString(flags, 'operator');
-  const event = await appendLocalEvent(root, 'seat_entered', {
-    task,
-    seat,
-    operator_principal: operator,
-    authority_boundary: {
-      authentication_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-    },
-  }, flags);
-  console.log(`entered: ${seat} task=${task} operator=${operator}`);
-  console.log(`event: ${event.event_ref}`);
-}
-
-async function dispatchHandoff(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  const plan = buildBootstrapPlan(flags);
-  const initialized = existsSync(join(root, '.etiquette')) && existsSync(join(root, 'docs', 'work'));
-  const project = initialized ? await readProjectBinding(root) : null;
-  const taskIds = initialized ? await listTaskIds(root) : plan.tasks.map((task) => task.id);
-  const leadTask = taskIds.find((task) => task.endsWith('-001')) ?? plan.tasks[0]?.id ?? `${plan.taskPrefix}-001`;
-  const reviewTask = taskIds.find((task) => task.endsWith('-002')) ?? plan.tasks[1]?.id ?? `${plan.taskPrefix}-002`;
-  const qaTask = taskIds.find((task) => task.endsWith('-003')) ?? plan.tasks[2]?.id ?? null;
-  const seatCommands = [
-    {
-      label: 'lead',
-      seat: plan.lead.seatId,
-      principal: plan.lead.operatorPrincipal,
-      task: leadTask,
-    },
-    {
-      label: 'review',
-      seat: plan.reviewers[0]?.seatId ?? 'review-seat',
-      principal: plan.reviewers[0]?.operatorPrincipal ?? 'reviewer',
-      task: reviewTask,
-    },
-    ...(qaTask && plan.reviewers[1]
-      ? [{
-          label: 'qa',
-          seat: plan.reviewers[1].seatId,
-          principal: plan.reviewers[1].operatorPrincipal,
-          task: qaTask,
-        }]
-      : []),
-  ];
-
-  const result = {
-    schema: 'local-handoff-plan.v0',
-    project_ref: '.',
-    initialized,
-    profile: plan.profile,
-    task_prefix: plan.taskPrefix,
-    seats: seatCommands,
-    install_env: {
-      ETQ_VERSION: '<release-version>',
-      ETQ_INSTALLER_URL: '<signed-installer-url>',
-      ETQ_RELEASES_URL: '<signed-release-base-url>',
-      ETQ_PUBLIC_KEY: '<public-key-path-or-url>',
-    },
-    commands: {
-      install: [
-        'curl -fsSL "$ETQ_INSTALLER_URL" -o "${TMPDIR:-.}/etiquette-install.sh"',
-        'sh "${TMPDIR:-.}/etiquette-install.sh" --version "$ETQ_VERSION" --base-url "$ETQ_RELEASES_URL" --public-key "$ETQ_PUBLIC_KEY" --install-root "$HOME/.etiquette" --modify-profile',
-        'export PATH="$HOME/.etiquette/bin:$PATH"',
-        'etiquette help',
-      ],
-      bootstrap: [
-        `etiquette bootstrap local --project . --profile ${plan.profile} --task-prefix ${plan.taskPrefix}`,
-        'etiquette doctor --project .',
-        'etiquette console board --project . --text',
-      ],
-      seats: seatCommands.flatMap((item) => [
-        `etiquette whereami --project . --seat ${item.principal} --task ${item.task}`,
-        `etiquette join --project . --seat ${item.principal}`,
-        pickupCommand(item.principal, item.task, project?.project_id ?? null),
-      ]),
-    },
-    docs: [
-      'AGENTS.md',
-      'docs/work/BOARD.md',
-      'docs/work/onboarding/local-etiquette-canary.md',
-      'docs/work/runbooks/SESSION_PICKUP.md',
-      'docs/work/manuals/SEAT_OPERATING_MANUAL.md',
-      'docs/work/cookbooks/ADD_A_LANE.md',
-    ],
-    authority_boundary: {
-      handoff_is_read_only: true,
-      handoff_installs_nothing: true,
-      handoff_bootstraps_nothing: true,
-      can_merge: false,
-      can_push: false,
-      can_close: false,
-      can_grant: false,
-      can_write_global_ledger: false,
-    },
-  };
-
-  if (flags.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-
-  console.log([
-    'handoff_plan:',
-    `  project: ${result.project_ref}`,
-    `  initialized: ${String(result.initialized)}`,
-    `  profile: ${result.profile}`,
-    `  task_prefix: ${result.task_prefix}`,
-    '  authority_boundary: read-only guide; installs nothing, bootstraps nothing, grants nothing',
-    '',
-    'install_env:',
-    ...Object.entries(result.install_env).map(([key, value]) => `  ${key}=${value}`),
-    '',
-    'install:',
-    ...result.commands.install.map((command) => `  ${command}`),
-    '',
-    'bootstrap:',
-    ...result.commands.bootstrap.map((command) => `  ${command}`),
-    '',
-    'seat_pickups:',
-    ...seatCommands.flatMap((item) => [
-      `  # ${item.label}: ${item.seat} (${item.principal})`,
-      `  etiquette whereami --project . --seat ${item.principal} --task ${item.task}`,
-      `  etiquette join --project . --seat ${item.principal}`,
-      `  ${pickupCommand(item.principal, item.task, project?.project_id ?? null)}`,
-    ]),
-    '',
-    'docs:',
-    ...result.docs.map((ref) => `  - ${ref}`),
-    '',
-    'stop_conditions:',
-    '  - task needs writes outside its envelope',
-    '  - secret or credential appears',
-    '  - validation cannot run',
-    '  - authority is unclear',
-  ].join('\n'));
-}
-
-async function dispatchJoin(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-  const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-  assertEngagementProject(project.project_id, optionalString(flags, 'expect-project-id'), 'current project');
-  const seatInput = requireString(flags, 'seat');
-  const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-  const seat = resolvedSeat.seat;
-  const enrollment = resolvedSeat.enrollment;
-  if (!enrollment) throw new Error(`seat is not enrolled: ${seatInput}`);
-  const queue = await buildWakeQueue(root, seat, flags);
-  const firstTask = queue.items.find((item) => item.lane)?.lane ?? null;
-  const result = {
-    schema: 'seat-join.v0',
-    requested_seat: seatInput,
-    seat,
-    seat_alias_used: resolvedSeat.aliasUsed,
-    project_id: project.project_id,
-    ready: enrollment.ready === true,
-    lifecycle_state: lifecycleState(enrollment),
-    workflow_id: enrollment.workflow_id ?? null,
-    operator_principal: stringField(enrollment, 'operator_principal') ?? null,
-    orientation_ref: stringField(enrollment, 'orientation_ref') ?? null,
-    board_ref: 'docs/work/BOARD.md',
-    event_log_ref: '.etiquette/events/local.ndjson',
-    queued_items: queue.items.length,
-    next_task: firstTask,
-    next_commands: [
-      `etiquette console board --project . --seat ${seat} --text`,
-      `etiquette notify feed --project . --seat ${seat} --text`,
-      firstTask ? pickupCommand(seat, firstTask, project.project_id) : null,
-    ].filter((value): value is string => Boolean(value)),
-    authority_boundary: {
-      join_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-      can_write_global_ledger: false,
-    },
-  };
-  if (flags.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  console.log([
-    `seat_join: ${seat}`,
-    resolvedSeat.aliasUsed ? `seat_alias: ${seatInput} -> ${seat}` : null,
-    `project_id: ${project.project_id}`,
-    `ready: ${String(result.ready)}`,
-    `lifecycle_state: ${result.lifecycle_state}`,
-    `workflow_id: ${String(result.workflow_id ?? 'legacy')}`,
-    `operator_principal: ${result.operator_principal ?? 'unknown'}`,
-    `orientation_ref: ${result.orientation_ref ?? 'none'}`,
-    `queued_items: ${result.queued_items}`,
-    `next_task: ${result.next_task ?? 'none'}`,
-    'next:',
-    ...result.next_commands.map((command) => `  ${command}`),
-    'can_authorize: false',
-  ].filter((line): line is string => line !== null).join('\n'));
-}
-
-async function listTaskIds(root: string): Promise<string[]> {
-  const dir = join(root, 'docs', 'work', 'tasks');
-  if (!existsSync(dir)) return [];
-  const entries = await readdir(dir, { withFileTypes: true });
-  return entries
-    .filter((entry) => entry.isFile() && (entry.name.endsWith('.yaml') || entry.name.endsWith('.yml') || entry.name.endsWith('.json')))
-    .map((entry) => entry.name.replace(/\.(ya?ml|json)$/i, ''))
-    .sort();
-}
-
-async function listSessions(root: string): Promise<JsonRecord[]> {
-  const dir = join(root, 'docs', 'work', 'sessions');
-  if (!existsSync(dir)) return [];
-  const entries = await readdir(dir, { withFileTypes: true });
-  const sessions: JsonRecord[] = [];
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const manifestRef = join('docs', 'work', 'sessions', entry.name, 'session.json');
-    const manifest = await readJsonIfExists<JsonRecord | null>(join(root, manifestRef), null);
-    sessions.push(manifest ?? {
-      session_id: entry.name,
-      manifest_ref: manifestRef,
-      runbook_ref: join('docs', 'work', 'sessions', entry.name, 'RUNBOOK.md'),
-    });
-  }
-  return sessions.sort((left, right) => String(left.session_id ?? '').localeCompare(String(right.session_id ?? '')));
-}
-
-async function readTaskEnvelope(root: string, task: string): Promise<JsonRecord> {
-  return asRecord(await readStructured(join(root, 'docs', 'work', 'tasks', `${task}.yaml`)), `task envelope ${task}`);
-}
-
-async function listEnrollments(root: string): Promise<JsonRecord[]> {
-  const files = await listJsonFiles(join(root, '.etiquette', 'roster', 'enrollments'));
-  const rows = await Promise.all(files.map((path) => readJsonIfExists<JsonRecord>(path, {})));
-  return rows.sort((left, right) => String(left.seat_id ?? '').localeCompare(String(right.seat_id ?? '')));
-}
-
-function assertReadyEnrollment(resolvedSeat: {
-  requestedSeat: string;
-  seat: string;
-  enrollment: JsonRecord | null;
-  aliasUsed: boolean;
-}, projectId?: string, at?: string): void {
-  if (!resolvedSeat.enrollment) throw new Error(`seat is not enrolled: ${resolvedSeat.requestedSeat}`);
-  if (resolvedSeat.enrollment.ready !== true) {
-    throw new Error(`seat is not ready: ${resolvedSeat.seat}; run etiquette roster ready ${resolvedSeat.seat} after onboarding`);
-  }
-  if (projectId) assertLifecycleRoutable(resolvedSeat.enrollment, projectId, resolvedSeat.seat, at);
-}
-
-function assertFalseAuthorityBoundary(record: JsonRecord, label: string, fields: string[]): void {
-  const boundary = asRecord(record.authority_boundary, `${label} authority_boundary`);
-  for (const field of fields) {
-    if (boolField(boundary, field) !== false) throw new Error(`${label} authority_boundary.${field} must be false`);
-  }
-}
-
-function assertKnownTaskStrategy(value: string, label: string): void {
-  if (!(TASK_EXECUTION_STRATEGIES as readonly string[]).includes(value)) {
-    throw new Error(`${label} execution_strategy.strategy must be one of: ${TASK_EXECUTION_STRATEGIES.join(', ')}`);
-  }
-}
-
-function assertNoAuthorityClaims(value: unknown, label: string): void {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return;
-  for (const [key, child] of Object.entries(value as JsonRecord)) {
-    const path = `${label}.${key}`;
-    const normalizedKey = key.toLowerCase();
-    const isProhibition = normalizedKey.includes('cannot')
-      || normalizedKey.includes('require')
-      || normalizedKey.includes('read_only')
-      || normalizedKey.includes('one_writer');
-    if (!isProhibition && /(authorize|authority|grant|merge|close|promote|push|sign)/i.test(key) && child === true) {
-      throw new Error(`${path} must not claim authority`);
-    }
-    assertNoAuthorityClaims(child, path);
-  }
-}
-
-function isReadOnlyAuditWrite(ref: string): boolean {
-  return READ_ONLY_AUDIT_WRITE_PREFIXES.some((prefix) => (
-    prefix.endsWith('/') ? ref.startsWith(prefix) : ref === prefix
-  ));
-}
-
-function assertTaskStrategyConstraints(taskEnvelope: JsonRecord, task: string): void {
-  let strategyName: string | undefined;
-  if (taskEnvelope.execution_strategy !== undefined) {
-    const strategy = asRecord(taskEnvelope.execution_strategy, `task envelope ${task} execution_strategy`);
-    strategyName = stringField(strategy, 'strategy');
-    if (!strategyName) throw new Error(`task envelope ${task} execution_strategy.strategy is required`);
-    assertKnownTaskStrategy(strategyName, `task envelope ${task}`);
-    if (strategyName === 'shadow') {
-      throw new Error(`task envelope ${task} execution_strategy.strategy=shadow is reserved and not executable in V0`);
-    }
-    assertNoAuthorityClaims(strategy, `task envelope ${task} execution_strategy`);
-  }
-
-  if (taskEnvelope.rig_conductor !== undefined) {
-    if (strategyName !== 'rig') {
-      throw new Error(`task envelope ${task} rig_conductor requires execution_strategy.strategy=rig`);
-    }
-    const result = evaluateRigConductorEnvelope(taskEnvelope.rig_conductor);
-    if (result.verdict !== 'legitimate') {
-      throw new Error(`task envelope ${task} rig_conductor blocked: ${result.reasons.join(', ')}`);
-    }
-  } else if (strategyName === 'rig') {
-    throw new Error(`task envelope ${task} execution_strategy.strategy=rig requires rig_conductor`);
-  }
-
-  if (taskEnvelope.topology_constraints === undefined) return;
-  const constraints = asRecord(taskEnvelope.topology_constraints, `task envelope ${task} topology_constraints`);
-  for (const field of [
-    'reviewers_read_only',
-    'child_agents_cannot_promote',
-    'one_writer_per_worktree',
-    'runner_swaps_require_lifecycle_preflight',
-  ]) {
-    if (boolField(constraints, field) !== true) {
-      throw new Error(`task envelope ${task} topology_constraints.${field} must be true`);
-    }
-  }
-  assertNoAuthorityClaims(constraints, `task envelope ${task} topology_constraints`);
-
-  const mode = stringField(taskEnvelope, 'mode');
-  if (mode === 'read-only-audit' && boolField(constraints, 'reviewers_read_only') === true) {
-    for (const ref of (arrayField(taskEnvelope, 'allowed_writes') ?? [])) {
-      if (typeof ref !== 'string' || !isReadOnlyAuditWrite(ref)) {
-        throw new Error(`task envelope ${task} reviewers_read_only prohibits write path: ${String(ref)}`);
-      }
-    }
-  }
-
-  const maxParallelWriters = taskEnvelope.max_parallel_writers;
-  if (
-    boolField(constraints, 'one_writer_per_worktree') === true
-    && maxParallelWriters !== undefined
-    && maxParallelWriters !== 1
-  ) {
-    throw new Error(`task envelope ${task} max_parallel_writers must be 1 when one_writer_per_worktree is true`);
-  }
-}
-
-function assertTaskEnvelopeIntegrity(taskEnvelope: JsonRecord, task: string, seat: string): void {
-  if (taskEnvelope.schema !== 'task-envelope.v0') throw new Error(`task envelope ${task} schema must be task-envelope.v0`);
-  if (stringField(taskEnvelope, 'task_id') !== task) {
-    throw new Error(`task envelope mismatch: ${task} has task_id=${String(taskEnvelope.task_id ?? 'missing')}`);
-  }
-  const assignedTo = stringField(taskEnvelope, 'assigned_to');
-  if (!assignedTo) throw new Error(`task envelope ${task} missing assigned_to`);
-  if (assignedTo !== seat) {
-    throw new Error(`task/seat mismatch: ${task} assigned_to=${assignedTo} but pickup seat=${seat}`);
-  }
-  if (!stringField(taskEnvelope, 'mode')) throw new Error(`task envelope ${task} missing mode`);
-  if ((arrayField(taskEnvelope, 'allowed_writes') ?? []).length === 0) {
-    throw new Error(`task envelope ${task} missing allowed_writes`);
-  }
-  if ((arrayField(taskEnvelope, 'validation') ?? []).length === 0) {
-    throw new Error(`task envelope ${task} missing validation`);
-  }
-  assertFalseAuthorityBoundary(taskEnvelope, `task envelope ${task}`, [
-    'can_authorize',
-    'can_merge',
-    'can_close',
-    'can_write_global_ledger',
-  ]);
-  assertTaskStrategyConstraints(taskEnvelope, task);
-}
-
-function assertSessionManifestIntegrity(sessionManifest: JsonRecord, task: string, seat: string): void {
-  if (sessionManifest.schema !== 'session-runbook.v0') throw new Error(`session session-${task} schema must be session-runbook.v0`);
-  if (stringField(sessionManifest, 'session_id') !== `session-${task}`) {
-    throw new Error(`session manifest mismatch: expected session-${task} got ${String(sessionManifest.session_id ?? 'missing')}`);
-  }
-  if (stringField(sessionManifest, 'task_ref') !== task) {
-    throw new Error(`session/task mismatch: session-${task} task_ref=${String(sessionManifest.task_ref ?? 'missing')} expected ${task}`);
-  }
-  if (stringField(sessionManifest, 'seat') !== seat) {
-    throw new Error(`session/seat mismatch: session-${task} seat=${String(sessionManifest.seat ?? 'missing')} expected ${seat}`);
-  }
-  assertFalseAuthorityBoundary(sessionManifest, `session session-${task}`, [
-    'can_authorize',
-    'can_merge',
-    'can_close',
-    'can_write_global_ledger',
-  ]);
-}
-
-async function collectRosterSessionIntegrityErrors(root: string, projectId: string): Promise<string[]> {
-  const errors: string[] = [];
-  const enrollments = await listEnrollments(root);
-  const enrolledSeats = new Set(enrollments.map((row) => stringField(row, 'seat_id')).filter((seat): seat is string => Boolean(seat)));
-  const readySeats = new Set(enrollments.filter((row) => row.ready === true).map((row) => stringField(row, 'seat_id')).filter((seat): seat is string => Boolean(seat)));
-  const enrollmentBySeat = new Map(enrollments.map((row) => [stringField(row, 'seat_id'), row]).filter((entry): entry is [string, JsonRecord] => Boolean(entry[0])));
-  for (const task of await listTaskIds(root)) {
-    let taskEnvelope: JsonRecord;
-    try {
-      taskEnvelope = await readTaskEnvelope(root, task);
-    } catch (err) {
-      errors.push((err as Error).message);
-      continue;
-    }
-    const assignedTo = stringField(taskEnvelope, 'assigned_to');
-    const session = await readJsonIfExists<JsonRecord | null>(
-      join(root, 'docs', 'work', 'sessions', `session-${task}`, 'session.json'),
-      null,
-    );
-    if (!assignedTo && !session) continue;
-    if (!assignedTo) {
-      errors.push(`task envelope ${task} missing assigned_to`);
-      continue;
-    }
-    if (!enrolledSeats.has(assignedTo)) errors.push(`task envelope ${task} assigned_to ${assignedTo} is not enrolled`);
-    if (!readySeats.has(assignedTo)) errors.push(`task envelope ${task} assigned_to ${assignedTo} is not ready`);
-    const enrollment = enrollmentBySeat.get(assignedTo);
-    if (enrollment) {
-      try {
-        assertLifecycleRoutable(enrollment, projectId, assignedTo);
-      } catch (err) {
-        errors.push((err as Error).message);
-      }
-    }
-    try {
-      assertTaskEnvelopeIntegrity(taskEnvelope, task, assignedTo);
-    } catch (err) {
-      errors.push((err as Error).message);
-    }
-    if (!session) {
-      errors.push(`session manifest missing: docs/work/sessions/session-${task}/session.json`);
-      continue;
-    }
-    try {
-      assertSessionProject(typeof session.project_id === 'string' ? session.project_id : null, projectId, `session session-${task}`);
-      assertSessionManifestIntegrity(session, task, assignedTo);
-    } catch (err) {
-      errors.push((err as Error).message);
-    }
-  }
-  return [...new Set(errors)];
-}
-
-function resolveSeatFromEnrollments(enrollments: JsonRecord[], requestedSeat: string, label = '--seat'): {
-  requestedSeat: string;
-  seat: string;
-  enrollment: JsonRecord | null;
-  aliasUsed: boolean;
-} {
-  assertSharedMemoryScopeId(requestedSeat, label);
-  const exact = enrollments.find((row) => stringField(row, 'seat_id') === requestedSeat) ?? null;
-  if (exact) {
-    return { requestedSeat, seat: requestedSeat, enrollment: exact, aliasUsed: false };
-  }
-
-  const principalMatches = enrollments.filter((row) => stringField(row, 'operator_principal') === requestedSeat);
-  if (principalMatches.length === 1) {
-    const seat = stringField(principalMatches[0], 'seat_id');
-    if (seat) return { requestedSeat, seat, enrollment: principalMatches[0], aliasUsed: true };
-  }
-  if (principalMatches.length > 1) {
-    throw new Error(`seat alias is ambiguous: ${requestedSeat}`);
-  }
-  return { requestedSeat, seat: requestedSeat, enrollment: null, aliasUsed: false };
-}
-
-function gitInfo(root: string): JsonRecord {
-  const top = git(root, ['rev-parse', '--show-toplevel'], true);
-  if (top.status !== 0) {
-    return {
-      inside_worktree: false,
-      root: null,
-      branch: null,
-      dirty: null,
-      status_ref: 'git unavailable',
-    };
-  }
-  const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD'], true);
-  const status = git(root, ['status', '--short', '--branch'], true);
-  const statusLines = status.stdout.split('\n').filter((line) => line.trim().length > 0);
-  const dirtyLines = statusLines.filter((line) => !line.startsWith('## '));
-  return {
-    inside_worktree: true,
-    root: top.stdout.trim(),
-    branch: branch.status === 0 ? branch.stdout.trim() : null,
-    dirty: dirtyLines.length > 0,
-    status_ref: statusLines[0] ?? null,
-    dirty_entries: dirtyLines.length,
-  };
-}
-
-async function dispatchWhereami(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  const initialized = existsSync(join(root, '.etiquette')) || existsSync(join(root, 'docs', 'work'));
-  const project = initialized ? await readProjectBinding(root) : null;
-  assertEngagementProject(project?.project_id, optionalString(flags, 'expect-project-id'), 'current project');
-  const events = await readEventsIfInitialized(root);
-  const enrollments = await listEnrollments(root);
-  const tasks = await listTaskIds(root);
-  const sessions = await listSessions(root);
-  const seatInput = optionalString(flags, 'seat') ?? null;
-  const task = optionalString(flags, 'task') ?? null;
-  if (task) assertSharedMemoryScopeId(task, '--task');
-  const resolvedSeat = seatInput ? resolveSeatFromEnrollments(enrollments, seatInput) : null;
-  const seat = resolvedSeat?.seat ?? null;
-  const enrollment = resolvedSeat?.enrollment ?? null;
-  const taskRef = task ? `docs/work/tasks/${task}.yaml` : null;
-  const runbookRef = task ? `docs/work/sessions/session-${task}/RUNBOOK.md` : null;
-  const matchingSessions = task
-    ? sessions.filter((session) => session.task_ref === task || session.session_id === `session-${task}`)
-    : sessions;
-  if (project && task) {
-    for (const session of matchingSessions) {
-      assertSessionProject(
-        typeof session.project_id === 'string' ? session.project_id : null,
-        project.project_id,
-        `session ${String(session.session_id ?? 'unknown')}`,
-      );
-    }
-  }
-  const result = {
-    schema: 'workspace-context-readback.v0',
-    cwd: process.cwd(),
-    project: root,
-    project_id: project?.project_id ?? null,
-    project_ref: project ? '.etiquette/project.yaml' : null,
-    initialized,
-    git: gitInfo(root),
-    events: events.length,
-    seats: enrollments.map((row) => ({
-      seat_id: row.seat_id,
-      ready: row.ready === true,
-      lifecycle_state: lifecycleState(row),
-      workflow_id: row.workflow_id ?? null,
-      operator_principal: row.operator_principal ?? null,
-    })),
-    tasks,
-    sessions: matchingSessions.map((session) => ({
-      session_id: session.session_id ?? null,
-      project_id: session.project_id ?? null,
-      seat: session.seat ?? null,
-      task_ref: session.task_ref ?? null,
-      runbook_ref: session.runbook_ref ?? null,
-      manifest_ref: session.manifest_ref ?? null,
-    })),
-    requested: {
-      seat_input: seatInput,
-      seat,
-      seat_alias_used: resolvedSeat?.aliasUsed ?? false,
-      seat_ready: enrollment ? enrollment.ready === true : null,
-      lifecycle_state: enrollment ? lifecycleState(enrollment) : null,
-      workflow_id: enrollment?.workflow_id ?? null,
-      task,
-      task_ref: taskRef && existsSync(join(root, taskRef)) ? taskRef : null,
-      runbook_ref: runbookRef && existsSync(join(root, runbookRef)) ? runbookRef : null,
-    },
-    guidance: {
-      resume_conversation: 'Use your agent runner resume command for chat context; do not git checkout for conversation history.',
-      enter_code_context: 'Use the project/worktree path shown here for code context.',
-      avoid_checkout_when_dirty: 'If git_dirty is true, do not checkout another branch until the dirty worktree is triaged or moved to a separate worktree.',
-    },
-    next_commands: [
-      `cd ${root}`,
-      seat ? `etiquette join --project . --seat ${seat}` : null,
-      seat && task ? pickupCommand(seat, task, project?.project_id ?? null) : null,
-      'etiquette status --project .',
-    ].filter((value): value is string => Boolean(value)),
-    authority_boundary: {
-      whereami_authorizes_work: false,
-      can_checkout: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-      can_write_global_ledger: false,
-    },
-  };
-  if (flags.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  const gitRecord = result.git as JsonRecord;
-  const lines = [
-    'whereami:',
-    `  cwd: ${result.cwd}`,
-    `  project: ${result.project}`,
-    `  project_id: ${result.project_id ?? 'none'}`,
-    `  initialized: ${String(result.initialized)}`,
-    `  git_root: ${String(gitRecord.root ?? 'none')}`,
-    `  git_branch: ${String(gitRecord.branch ?? 'none')}`,
-    `  git_dirty: ${String(gitRecord.dirty ?? 'unknown')}`,
-    `  events: ${result.events}`,
-    `  seats: ${result.seats.length === 0 ? 'none' : result.seats.map((row) => `${String(row.seat_id)}(ready=${String(row.ready)} lifecycle=${row.lifecycle_state})`).join(', ')}`,
-    `  tasks: ${result.tasks.length === 0 ? 'none' : result.tasks.join(', ')}`,
-    `  sessions: ${result.sessions.length === 0 ? 'none' : result.sessions.map((session) => String(session.session_id ?? 'unknown')).join(', ')}`,
-  ];
-  if (seat) {
-    if (resolvedSeat?.aliasUsed) lines.push(`  seat_alias: ${resolvedSeat.requestedSeat} -> ${seat}`);
-    lines.push(`  requested_seat: ${seat} ready=${String(result.requested.seat_ready ?? 'unknown')}`);
-    lines.push(`  lifecycle_state: ${String(result.requested.lifecycle_state ?? 'unknown')}`);
-    lines.push(`  workflow_id: ${String(result.requested.workflow_id ?? 'legacy')}`);
-  }
-  if (task) {
-    lines.push(`  requested_task: ${task}`);
-    lines.push(`  task_ref: ${result.requested.task_ref ?? 'missing'}`);
-    lines.push(`  runbook_ref: ${result.requested.runbook_ref ?? 'missing'}`);
-  }
-  lines.push(
-    'next:',
-    ...result.next_commands.map((command) => `  ${command}`),
-    'guidance:',
-    `  ${result.guidance.resume_conversation}`,
-    `  ${result.guidance.enter_code_context}`,
-    `  ${result.guidance.avoid_checkout_when_dirty}`,
-    'authority_boundary: read-only; no checkout, merge, close, grant, or global ledger write',
-  );
-  console.log(lines.join('\n'));
-}
-
-async function dispatchPickup(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-  const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-  assertPickupProjectExpectation(project.project_id, flags);
-  const seatInput = requireString(flags, 'seat');
-  const task = requireString(flags, 'task');
-  const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-  const seat = resolvedSeat.seat;
-  assertReadyEnrollment(resolvedSeat, project.project_id, optionalString(flags, 'at'));
-  assertSharedMemoryScopeId(task, '--task');
-  const taskRef = `docs/work/tasks/${task}.yaml`;
-  const runbookRef = `docs/work/sessions/session-${task}/RUNBOOK.md`;
-  const taskText = await readTextIfExists(join(root, taskRef));
-  if (!taskText) throw new Error(`task envelope not found: ${taskRef}`);
-  const taskEnvelope = await readTaskEnvelope(root, task);
-  assertTaskEnvelopeIntegrity(taskEnvelope, task, seat);
-  const runbookText = await readTextIfExists(join(root, runbookRef));
-  if (!runbookText) throw new Error(`session runbook not found: ${runbookRef}`);
-  const sessionManifest = await readJsonIfExists<JsonRecord | null>(
-    join(root, 'docs', 'work', 'sessions', `session-${task}`, 'session.json'),
-    null,
-  );
-  if (!sessionManifest) throw new Error(`session manifest not found: docs/work/sessions/session-${task}/session.json`);
-  assertSessionProject(
-    typeof sessionManifest.project_id === 'string' ? sessionManifest.project_id : null,
-    project.project_id,
-    `session session-${task}`,
-  );
-  assertSessionManifestIntegrity(sessionManifest, task, seat);
-  const queue = await buildWakeQueue(root, seat, flags);
-  const result = {
-    schema: 'seat-pickup.v0',
-    requested_seat: seatInput,
-    seat,
-    seat_alias_used: resolvedSeat.aliasUsed,
-    project_id: project.project_id,
-    task,
-    task_ref: taskRef,
-    runbook_ref: runbookRef,
-    roster_integrity: 'pass',
-    lifecycle_state: lifecycleState(resolvedSeat.enrollment ?? {}),
-    workflow_id: resolvedSeat.enrollment?.workflow_id ?? null,
-    feed_items: queue.items.length,
-    authority_boundary: {
-      pickup_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-      can_write_global_ledger: false,
-    },
-  };
-  if (flags.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  console.log([
-    `pickup: ${seat} task=${task}`,
-    resolvedSeat.aliasUsed ? `seat_alias: ${seatInput} -> ${seat}` : null,
-    `project_id: ${project.project_id}`,
-    `task_ref: ${taskRef}`,
-    `runbook_ref: ${runbookRef}`,
-    'roster_integrity: pass',
-    `lifecycle_state: ${lifecycleState(resolvedSeat.enrollment ?? {})}`,
-    `workflow_id: ${String(resolvedSeat.enrollment?.workflow_id ?? 'legacy')}`,
-    'authority_boundary: read-only; no grants, merge, close, push, or global ledger writes',
-    '',
-    '## Wake Queue',
-    '',
-    renderWakeQueue(queue),
-    '',
-    '## Task Envelope',
-    '',
-    taskText.trim(),
-    '',
-    '## Runbook',
-    '',
-    runbookText.trim(),
-    '',
-  ].filter((line): line is string => line !== null).join('\n'));
-}
-
-async function dispatchAudit(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  if (verb !== 'append') throw new Error('audit verb must be: append');
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-  const event = await appendLocalEvent(root, 'audit_appended', {
-    audit_schema: optionalString(flags, 'schema') ?? 'audit-event.v0',
-    actor: requireString(flags, 'actor'),
-    org_id: optionalString(flags, 'org-id'),
-    workspace_id: optionalString(flags, 'workspace-id'),
-    action: requireString(flags, 'action'),
-    target_type: optionalString(flags, 'target-type'),
-    target_id: optionalString(flags, 'target-id'),
-    grant_ref: optionalString(flags, 'grant-ref'),
-    result: optionalString(flags, 'result') ?? 'recorded',
-    reason: optionalString(flags, 'reason'),
-    refs: parseList(flags.refs),
-  }, flags);
-  await appendFile(join(root, '.etiquette', 'audit', 'audit.ndjson'), `${JSON.stringify(event)}\n`);
-  console.log(`audit_appended: ${event.event_ref}`);
-}
-
-async function dispatchRoster(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-
-  if (verb === 'card') {
-    const cardVerb = positionals[2];
-    if (cardVerb !== 'validate') throw new Error('roster card verb must be: validate');
-    const cardPath = resolve(requireString(flags, 'card'));
-    const seatId = await validateSeatCard(cardPath);
-    console.log(`seat_card_valid: ${seatId}`);
-    return;
-  }
-
-  if (verb === 'enroll') {
-    const seat = requirePositional(positionals, 2, 'seat');
-    const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-    const card = requireString(flags, 'card');
-    const cardPath = resolve(root, card);
-    const cardSeat = await validateSeatCard(cardPath);
-    const executionSeat = requireString(flags, 'execution-seat');
-    if (cardSeat !== seat) throw new Error(`seat card seat_id ${cardSeat} does not match ${seat}`);
-    const enrollment = {
-      schema: 'seat-enrollment.v0',
-      seat_id: seat,
-      card_ref: relativeRef(root, cardPath),
-      operator_principal: requireString(flags, 'operator-principal'),
-      execution_seat: executionSeat,
-      as_role: requireString(flags, 'as-role'),
-      authority_scope: requireString(flags, 'authority-scope'),
-      mode: requireString(flags, 'mode'),
-      orientation_ref: requireString(flags, 'orientation-ref'),
-      ready: false,
-      lifecycle_schema: SEAT_LIFECYCLE_SCHEMA,
-      lifecycle_state: 'enrolled',
-      workflow_id: lifecycleWorkflowId(project.project_id),
-      runner_binding: runnerBinding({
-        runnerProvider: optionalString(flags, 'runner-provider') ?? executionSeat,
-        executionSurface: optionalString(flags, 'execution-surface') ?? executionSeat,
-        modelId: optionalString(flags, 'model-id'),
-        modelTier: optionalString(flags, 'model-tier'),
-        permissionProfileRef: optionalString(flags, 'permission-profile-ref'),
-        capabilitySource: optionalString(flags, 'capability-source') ?? 'config',
-      }),
-      authority_granted: false,
-      lifecycle_authority_boundary: {
-        lifecycle_grants_authority: false,
-        readiness_authorizes_work: false,
-        can_merge: false,
-        can_close: false,
-        can_grant: false,
-      },
-      enrolled_at: nowIso(flags),
-      authority_boundary: {
-        enrollment_authorizes_work: false,
-        can_merge: false,
-        can_close: false,
-      },
-    };
-    await writeJson(await enrollmentPath(root, seat), enrollment);
-    const event = await appendLocalEvent(root, 'seat_enrolled', enrollment, flags);
-    console.log(`seat_enrolled: ${seat} ${event.event_ref}`);
-    return;
-  }
-
-  if (verb === 'ready') {
-    const seat = requirePositional(positionals, 2, 'seat');
-    const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-    const path = await enrollmentPath(root, seat);
-    const enrollment = await readJsonIfExists<JsonRecord | null>(path, null);
-    if (!enrollment) throw new Error(`seat is not enrolled: ${seat}`);
-    const readyAt = nowIso(flags);
-    const previousBinding = enrollment.runner_binding === undefined ? null : asRecord(enrollment.runner_binding, `${seat} runner_binding`);
-    const executionSurface = optionalString(flags, 'execution-surface') ?? stringField(previousBinding ?? {}, 'execution_surface') ?? stringField(enrollment, 'execution_seat') ?? 'local-etiquette';
-    const updated = {
-      ...enrollment,
-      ...lifecycleReadyPatch({
-        projectId: project.project_id,
-        at: readyAt,
-        runnerBinding: runnerBinding({
-          runnerProvider: optionalString(flags, 'runner-provider') ?? stringField(previousBinding ?? {}, 'runner_provider') ?? executionSurface,
-          executionSurface,
-          modelId: optionalString(flags, 'model-id') ?? stringField(previousBinding ?? {}, 'model_id') ?? null,
-          modelTier: optionalString(flags, 'model-tier') ?? stringField(previousBinding ?? {}, 'model_tier') ?? null,
-          permissionProfileRef: optionalString(flags, 'permission-profile-ref') ?? stringField(previousBinding ?? {}, 'permission_profile_ref') ?? null,
-          capabilitySource: optionalString(flags, 'capability-source') ?? stringField(previousBinding ?? {}, 'capability_source') ?? 'config',
-          previous: previousBinding,
-        }),
-      }),
-      ack_ref: requireString(flags, 'ack-ref'),
-      orientation_ref: requireString(flags, 'orientation-ref'),
-    };
-    await writeJson(path, updated);
-    const event = await appendLocalEvent(root, 'seat_ready', {
-      seat_id: seat,
-      lifecycle_state: 'ready',
-      workflow_id: lifecycleWorkflowId(project.project_id),
-      ack_ref: updated.ack_ref,
-      orientation_ref: updated.orientation_ref,
-      authority_granted: false,
-      authority_boundary: {
-        readiness_authorizes_work: false,
-        can_merge: false,
-        can_close: false,
-      },
-    }, flags);
-    console.log(`seat_ready: ${seat} ${event.event_ref}`);
-    return;
-  }
-
-  if (verb === 'lifecycle') {
-    const seat = requirePositional(positionals, 2, 'seat');
-    const rawState = requireString(flags, 'state');
-    assertLifecycleState(rawState, '--state');
-    if (rawState === 'ready' || rawState === 'idle') {
-      throw new Error('use roster ready to move a seat to ready/idle after preflight');
-    }
-    const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-    const path = await enrollmentPath(root, seat);
-    const enrollment = await readJsonIfExists<JsonRecord | null>(path, null);
-    if (!enrollment) throw new Error(`seat is not enrolled: ${seat}`);
-    const at = nowIso(flags);
-    const updated = {
-      ...enrollment,
-      ready: false,
-      lifecycle_schema: SEAT_LIFECYCLE_SCHEMA,
-      lifecycle_state: rawState,
-      workflow_id: lifecycleWorkflowId(project.project_id),
-      lifecycle_reason: requireString(flags, 'reason'),
-      lifecycle_updated_at: at,
-      authority_granted: false,
-      lifecycle_authority_boundary: {
-        lifecycle_grants_authority: false,
-        readiness_authorizes_work: false,
-        can_merge: false,
-        can_close: false,
-        can_grant: false,
-      },
-    };
-    await writeJson(path, updated);
-    const event = await appendLocalEvent(root, 'seat_lifecycle', {
-      seat_id: seat,
-      workflow_id: lifecycleWorkflowId(project.project_id),
-      lifecycle_state: rawState,
-      reason: updated.lifecycle_reason,
-      authority_granted: false,
-      authority_boundary: {
-        lifecycle_authorizes_work: false,
-        can_merge: false,
-        can_close: false,
-        can_grant: false,
-      },
-    }, flags);
-    console.log(`seat_lifecycle: ${seat} state=${rawState} ${event.event_ref}`);
-    return;
-  }
-
-  if (verb === 'list') {
-    const files = await listJsonFiles(join(root, '.etiquette', 'roster', 'enrollments'));
-    const rows = await Promise.all(files.map(async (path) => readJsonIfExists<JsonRecord>(path, {})));
-    if (flags.json) {
-      console.log(JSON.stringify(rows, null, 2));
-      return;
-    }
-    console.log(rows.length === 0 ? 'no enrolled seats' : rows.map((row) => `${row.seat_id} ready=${String(row.ready)} lifecycle=${lifecycleState(row)} operator=${row.operator_principal}`).join('\n'));
-    return;
-  }
-
-  if (verb === 'show' || verb === 'posture') {
-    const seat = requirePositional(positionals, 2, 'seat');
-    const enrollment = await readJsonIfExists<JsonRecord | null>(await enrollmentPath(root, seat), null);
-    if (!enrollment) throw new Error(`seat is not enrolled: ${seat}`);
-    if (verb === 'show') {
-      console.log(flags.json ? JSON.stringify(enrollment, null, 2) : [
-        `seat: ${enrollment.seat_id}`,
-        `operator_principal: ${enrollment.operator_principal}`,
-        `execution_seat: ${enrollment.execution_seat}`,
-        `as_role: ${enrollment.as_role}`,
-        `authority_scope: ${enrollment.authority_scope}`,
-        `mode: ${enrollment.mode}`,
-        `ready: ${String(enrollment.ready)}`,
-        `lifecycle_state: ${lifecycleState(enrollment)}`,
-        `workflow_id: ${String(enrollment.workflow_id ?? 'legacy')}`,
-      ].join('\n'));
-      return;
-    }
-    const cardRef = stringField(enrollment, 'card_ref');
-    const card = cardRef ? asRecord(await readStructured(join(root, cardRef)), 'seat card') : {};
-    console.log(flags.json ? JSON.stringify({ enrollment, card }, null, 2) : [
-      `seat_posture: ${seat}`,
-      `model_ref: ${String(card.model_ref ?? 'unknown')}`,
-      `model_posture_ref: ${String(card.model_posture_ref ?? 'unknown')}`,
-      'authority_boundary:',
-      '  can_authorize_work: false',
-      '  can_close_lane_without_grant: false',
-      '  can_merge_or_push_without_grant: false',
-    ].join('\n'));
-    return;
-  }
-
-  if (verb === 'doctor') {
-    const cardsDir = resolve(root, optionalString(flags, 'cards') ?? join('docs', 'work', 'seat-cards'));
-    const cardFiles = existsSync(cardsDir)
-      ? (await readdir(cardsDir, { withFileTypes: true })).filter((entry) => entry.isFile()).map((entry) => join(cardsDir, entry.name))
-      : [];
-    const validated: string[] = [];
-    for (const path of cardFiles) {
-      if (!path.endsWith('.yaml') && !path.endsWith('.yml') && !path.endsWith('.json')) continue;
-      validated.push(await validateSeatCard(path));
-    }
-    const enrollments = await listJsonFiles(join(root, '.etiquette', 'roster', 'enrollments'));
-    const result = {
-      schema: 'roster-doctor.v0',
-      verdict: 'pass',
-      cards_validated: validated.length,
-      enrolled_seats: enrollments.length,
-      authority_boundary: {
-        can_authorize_work: false,
-        can_merge: false,
-        can_close: false,
-      },
-    };
-    console.log(flags.json ? JSON.stringify(result, null, 2) : `roster_doctor: pass cards=${validated.length} enrolled=${enrollments.length}`);
-    return;
-  }
-
-  throw new Error('roster verb must be one of: card, enroll, ready, lifecycle, list, show, posture, doctor');
-}
-
-async function dispatchPost(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  const draft = isTrueFlag(flags, 'draft');
-  const profileRef = optionalString(flags, 'profile');
-  const outputRef = optionalString(flags, 'out');
-
-  if (draft || profileRef || outputRef) {
-    if (!draft) throw new Error('--profile and --out are available only with --draft in v0');
-    if (!profileRef) throw new Error('--profile is required with --draft');
-    if (!outputRef) throw new Error('--out is required with --draft');
-
-    const profilePath = resolve(profileRef);
-    const outputPath = resolve(outputRef);
-    const profile = parsePacketProfileV0(await readStructured(profilePath));
-    const profileInput: Record<string, PacketProfileValueV0> = {
-      created_at: nowIso(flags),
-    };
-    const aliases: Record<string, string> = { tier: 'packet_tier' };
-    const reserved = new Set(['project', 'profile', 'draft', 'out', 'force', 'emit', 'json', 'at']);
-    for (const [rawKey, rawValue] of Object.entries(flags)) {
-      if (reserved.has(rawKey)) continue;
-      const normalized = aliases[rawKey] ?? rawKey.replaceAll('-', '_');
-      const declaredDefault = profile.frontmatter.fields.find((field) => field.key === normalized)?.default;
-      if (typeof rawValue === 'string' && typeof declaredDefault === 'boolean') {
-        const lowered = rawValue.toLowerCase();
-        if (['true', 'yes', '1'].includes(lowered)) profileInput[normalized] = true;
-        else if (['false', 'no', '0'].includes(lowered)) profileInput[normalized] = false;
-        else throw new Error(`--${rawKey} must be true or false`);
-      } else if (typeof rawValue === 'string' && typeof declaredDefault === 'number') {
-        const value = Number(rawValue);
-        if (!Number.isFinite(value)) throw new Error(`--${rawKey} must be a number`);
-        profileInput[normalized] = value;
-      } else if (typeof rawValue === 'string' && Array.isArray(declaredDefault)) {
-        profileInput[normalized] = rawValue.split(',').map((value) => value.trim()).filter(Boolean);
-      } else {
-        profileInput[normalized] = rawValue;
-      }
-    }
-    const rendered = renderPacketProfileV0(profile, profileInput);
-    if (existsSync(outputPath) && !isTrueFlag(flags, 'force')) {
-      throw new Error(`refusing to overwrite existing draft: ${outputPath}; pass --force to replace it`);
-    }
-    await writeFile(outputPath, rendered.markdown, isTrueFlag(flags, 'force') ? undefined : { flag: 'wx' });
-    console.log(`packet_drafted: ${outputPath} profile=${profilePath} filename=${rendered.filename}`);
-    return;
-  }
-
-  const role = requireString(flags, 'role');
-  const emit = flags.emit === true || isReturnRole(role);
-  if (emit) {
-    const eventsDir = join(root, '.etiquette', 'events');
-    let entries: string[] = [];
-    try {
-      entries = await readdir(eventsDir);
-    } catch (err) {
-      if ((err as NodeJS.ErrnoException).code !== 'ENOENT') throw err;
-    }
-    const foreignStreams = entries.filter((name) => name.endsWith('.ndjson') && name !== 'local.ndjson');
-    if (foreignStreams.length > 0) {
-      throw new Error(`refusing local emit because foreign event streams exist: ${foreignStreams.sort().join(', ')}`);
-    }
-  }
-  await ensureLocalProject(root);
-  const lane = requireString(flags, 'lane');
-  const packet = {
-    schema: 'local-packet.v0',
-    role,
-    lane,
-    from: requireString(flags, 'from'),
-    to: requireString(flags, 'to'),
-    verdict: optionalString(flags, 'verdict') ?? 'routed',
-    packet_tier: optionalString(flags, 'tier') ?? '3',
-    mode: optionalString(flags, 'mode') ?? 'read-only-audit',
-    next_owner: optionalString(flags, 'next-owner') ?? requireString(flags, 'to'),
-    created_at: nowIso(flags),
-    changes_state: isTrueFlag(flags, 'changes-state'),
-    authority_boundary: {
-      packet_authorizes_work: false,
-      can_merge: false,
-      can_close: false,
-      can_grant: false,
-    },
-  };
-  const packetName = `${safeName(packet.created_at)}-${safeName(lane)}-${safeName(role)}.json`;
-  const packetPath = join(root, 'docs', 'work', 'packets', packetName);
-  await writeJson(packetPath, packet);
-  if (emit) {
-    const event = await appendLocalEvent(root, 'packet_posted', {
-      ...packet,
-      packet_ref: relativeRef(root, packetPath),
-    }, flags);
-    await refreshWakeQueuesForEvent(root, event, flags);
-    console.log(`packet_posted: ${event.event_ref} ${relativeRef(root, packetPath)}`);
-    return;
-  }
-  console.log(`packet_written: ${relativeRef(root, packetPath)}`);
-}
-
-async function dispatchNotify(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  const root = projectRoot(flags);
-
-  if (verb === 'webhook') {
-    const provider = positionals[2] ?? optionalString(flags, 'provider') ?? 'github';
-    const wake = await buildGitHubWebhookWake({ ...flags, provider });
-    if (flags.json) {
-      console.log(JSON.stringify(wake, null, 2));
-      return;
-    }
-    console.log(renderGitHubWebhookWake(wake));
-    return;
-  }
-
-  await ensureLocalProject(root);
-
-  if (verb === 'subscribe') {
-    const seatInput = requireString(flags, 'seat');
-    const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-    const seat = resolvedSeat.seat;
-    const current = await readJsonIfExists<{ schema: string; seat: string; subscriptions: JsonRecord[] }>(
-      await subscriptionPath(root, seat),
-      { schema: 'seat-subscriptions.v0', seat, subscriptions: [] },
-    );
-    current.subscriptions.push({
-      lane: requireString(flags, 'lane'),
-      roles: parseList(flags.roles),
-      subscribed_at: nowIso(flags),
-    });
-    await writeJson(await subscriptionPath(root, seat), current);
-    if (resolvedSeat.aliasUsed) console.log(`seat_alias: ${seatInput} -> ${seat}`);
-    console.log(`subscribed: ${seat} lane=${requireString(flags, 'lane')}`);
-    return;
-  }
-
-  if (verb === 'feed') {
-    const seatInput = requireString(flags, 'seat');
-    const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-    const seat = resolvedSeat.seat;
-    const subscriptions = await readJsonIfExists<{ subscriptions: JsonRecord[] }>(
-      await subscriptionPath(root, seat),
-      { subscriptions: [] },
-    );
-    const lanes = new Set(subscriptions.subscriptions.map((entry) => stringField(entry, 'lane')).filter((value): value is string => Boolean(value)));
-    const events = (await readEvents(root)).filter((event) => event.to === seat || event.next_owner === seat || (typeof event.lane === 'string' && lanes.has(event.lane)));
-    console.log([
-      `feed: ${seat}`,
-      resolvedSeat.aliasUsed ? `seat_alias: ${seatInput} -> ${seat}` : null,
-      `subscriptions: ${subscriptions.subscriptions.length}`,
-      renderEvents(events),
-    ].filter((line): line is string => line !== null).join('\n'));
-    return;
-  }
-
-  if (verb === 'poll') {
-    const seatInput = requireString(flags, 'seat');
-    const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-    const seat = resolvedSeat.seat;
-    const queue = await buildWakeQueue(root, seat, flags);
-    const path = await wakeQueuePath(root, seat);
-    await writeJson(path, queue);
-    if (flags.json) {
-      console.log(JSON.stringify({
-        ...queue,
-        queue_ref: relativeRef(root, path),
-      }, null, 2));
-      return;
-    }
-    console.log([
-      resolvedSeat.aliasUsed ? `seat_alias: ${seatInput} -> ${seat}` : null,
-      renderWakeQueue(queue),
-      `queue_ref: ${relativeRef(root, path)}`,
-    ].filter((line): line is string => line !== null).join('\n'));
-    return;
-  }
-
-  if (verb === 'queue') {
-    const seatInput = requireString(flags, 'seat');
-    const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-    const seat = resolvedSeat.seat;
-    const path = await wakeQueuePath(root, seat);
-    const queue = normalizeWakeQueue(await readJsonIfExists<WakeQueue>(path, {
-      schema: 'remote-wake-queue.v0',
-      seat,
-      updated_at: nowIso(flags),
-      source: {
-        event_log_ref: '.etiquette/events/local.ndjson',
-        after_seq: 0,
-        max_seq_seen: 0,
-        subscriptions_ref: relativeRef(root, await subscriptionPath(root, seat)),
-      },
-      transport: wakeQueueTransport(),
-      payload_boundary: wakeQueuePayloadBoundary(),
-      items: [],
-      authority_boundary: wakeQueueAuthorityBoundary(),
-    }));
-    if (flags.json) {
-      console.log(JSON.stringify({
-        ...queue,
-        queue_ref: relativeRef(root, path),
-      }, null, 2));
-      return;
-    }
-    console.log([
-      resolvedSeat.aliasUsed ? `seat_alias: ${seatInput} -> ${seat}` : null,
-      renderWakeQueue(queue),
-    ].filter((line): line is string => line !== null).join('\n'));
-    return;
-  }
-
-  throw new Error('notify verb must be one of: subscribe, feed, poll, queue, webhook');
-}
-
-async function dispatchReturn(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  if (verb !== 'check') throw new Error('return verb must be: check');
-  const root = projectRoot(flags);
-  const task = optionalString(flags, 'task') ?? requirePositional(positionals, 2, 'task');
-  const seatInput = requireString(flags, 'seat');
-  assertSharedMemoryScopeId(task, '--task');
-  assertSharedMemoryScopeId(seatInput, '--seat');
-
-  const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-  const seat = resolvedSeat.seat;
-  const expectedRoles = expectedReturnRoles(flags);
-  const tier = returnCheckTier(flags);
-  const projection = await buildLocalLedgerView(root, {
-    lane: task,
-    from: seat,
-    kind: 'packets',
-    limit: parseOptionalPositiveInt(flags.limit, 'limit', 50),
-    computedAt: nowIso(flags),
-  });
-  const detection = detectReturnPackets(projection, { task, seat, expectedRoles });
-  const result: ReturnCheckResult = {
-    schema: 'return-enforcement-check.v0',
-    task,
-    seat,
-    seat_alias: resolvedSeat.aliasUsed ? seatInput : null,
-    expected_roles: expectedRoles,
-    enforcement_tier: tier,
-    verdict: detection.verdict,
-    completion_gate_hard: tier === 'remote-runner-hard-gate',
-    matched_return_packets: detection.matched_return_packets,
-    posted_return_packets: detection.posted_return_packets,
-    latest_event_ref: detection.latest_event_ref,
-    event_log_hash: detection.event_log_hash,
-    advisory: detection.verdict === 'pass'
-      ? 'posted return found'
-      : tier === 'remote-runner-hard-gate'
-        ? 'remote runner completion must stop until the seat emits a return packet'
-        : 'local advisory only; write the receipt and emit the return packet so the next seat can wake',
-    authority_boundary: {
-      check_can_authorize: false,
-      check_can_execute: false,
-      check_can_write: false,
-      check_can_post_return: false,
-      check_can_merge: false,
-      check_can_close: false,
-      check_can_grant: false,
-      check_can_write_global_ledger: false,
-    },
-  };
-
-  console.log(flags.json ? JSON.stringify(result, null, 2) : renderReturnCheck(result));
-  if (tier === 'remote-runner-hard-gate' && detection.verdict !== 'pass') process.exit(1);
-}
-
-async function dispatchRig(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  if (verb !== 'doctor') throw new Error('rig verb must be: doctor');
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-  const required = [
-    projectBindingPath(root),
-    eventPath(root),
-    ledgerPath(root),
-    join(root, 'docs', 'work', 'tasks'),
-  ];
-  const missing = required.filter((path) => !existsSync(path));
-  if (missing.length > 0) throw new Error(`rig doctor failed; missing: ${missing.map((path) => relativeRef(root, path)).join(', ')}`);
-  const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-  const sessions = await listSessions(root);
-  const mismatched = sessions.filter((session) => session.project_id !== project.project_id);
-  if (mismatched.length > 0) {
-    throw new Error(`rig doctor failed; session project_id mismatch: ${mismatched.map((session) => String(session.session_id ?? 'unknown')).join(', ')}`);
-  }
-  const integrityErrors = await collectRosterSessionIntegrityErrors(root, project.project_id);
-  if (integrityErrors.length > 0) {
-    throw new Error(`rig doctor failed; roster/session integrity: ${integrityErrors.join('; ')}`);
-  }
-  console.log(`rig_doctor: pass project_id=${project.project_id} roster_session_integrity=pass`);
-}
-
-async function dispatchTimeline(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  if (verb !== 'view' && verb !== 'preview') throw new Error('timeline verb must be one of: view, preview');
-  const root = projectRoot(flags);
-  const viewOptions = {
-    scope: timelineScope(flags),
-    since: optionalString(flags, 'since') ?? null,
-    until: optionalString(flags, 'until') ?? null,
-    lane: optionalString(flags, 'lane') ?? null,
-    seat: optionalString(flags, 'seat') ?? null,
-    from: optionalString(flags, 'from') ?? null,
-    to: optionalString(flags, 'to') ?? null,
-    role: optionalString(flags, 'role') ?? null,
-    action: optionalString(flags, 'action') ?? null,
-    match: optionalString(flags, 'match') ?? null,
-    limit: parseOptionalPositiveInt(flags.limit, 'limit', 20),
-    computedAt: nowIso(flags),
-  };
-
-  if (verb === 'preview') {
-    await runTimelinePreviewServer(root, flags, viewOptions);
-    return;
-  }
-
-  const view = await buildTimelineView(root, viewOptions);
-  const format = busViewFormat(flags);
-  if (format === 'json') {
-    console.log(JSON.stringify(view, null, 2));
-    return;
-  }
-  console.log(format === 'markdown' ? renderTimelineViewMarkdown(view) : renderTimelineViewText(view));
-}
-
-function parseTimelinePreviewPort(flags: Record<string, string | boolean>): number {
-  const port = parseOptionalPositiveInt(flags.port, 'port', 4174);
-  if (port > 65535) throw new Error('--port must be between 1 and 65535');
-  return port;
-}
-
-function assertTimelinePreviewLoopbackHost(host: string): string {
-  const normalized = host.trim().toLowerCase();
-  if (normalized === '127.0.0.1' || normalized === 'localhost' || normalized === '::1') return normalized;
-  throw new Error('--host for timeline preview must be loopback-only in v0: use 127.0.0.1, localhost, or ::1');
-}
-
-async function runTimelinePreviewServer(
-  root: string,
-  flags: Record<string, string | boolean>,
-  viewOptions: Parameters<typeof buildTimelineView>[1],
-): Promise<never> {
-  const host = assertTimelinePreviewLoopbackHost(optionalString(flags, 'host') ?? '127.0.0.1');
-  const port = parseTimelinePreviewPort(flags);
-  const server = Bun.serve({
-    hostname: host,
-    port,
-    fetch: (request) => timelinePreviewResponseForRequest(
-      request,
-      () => buildTimelineView(root, viewOptions),
-    ),
-  });
-  console.log(`etiquette timeline preview listening on http://${server.hostname}:${server.port}/`);
-  console.log('boundary: read-only loopback GET/HEAD/OPTIONS surface; no auth, hosted backend, execution, write-back, grants, merge, close, or signing');
-  return new Promise<never>(() => {
-    // Keep the CLI process alive for the browser preview.
-  });
-}
-
-async function dispatchBus(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  const root = projectRoot(flags);
-  if (verb === 'view') {
-    const view = await buildLocalLedgerView(root, {
-      since: optionalString(flags, 'since') ?? null,
-      until: optionalString(flags, 'until') ?? null,
-      lane: optionalString(flags, 'lane') ?? null,
-      seat: optionalString(flags, 'seat') ?? null,
-      from: optionalString(flags, 'from') ?? null,
-      to: optionalString(flags, 'to') ?? null,
-      role: optionalString(flags, 'role') ?? null,
-      action: optionalString(flags, 'action') ?? null,
-      match: optionalString(flags, 'match') ?? null,
-      kind: busViewKind(flags),
-      limit: parseOptionalPositiveInt(flags.limit, 'limit', 20),
-      computedAt: nowIso(flags),
-    });
-    const format = busViewFormat(flags);
-    if (format === 'json') {
-      console.log(JSON.stringify(view, null, 2));
-      return;
-    }
-    console.log(format === 'markdown' ? renderLocalLedgerViewMarkdown(view) : renderLocalLedgerViewText(view));
-    return;
-  }
-  await ensureLocalProject(root);
-  const events = await readEvents(root);
-
-  if (verb === 'status') {
-    const rawLimit = positionals[2] ? Number.parseInt(positionals[2], 10) : 20;
-    const limit = Number.isFinite(rawLimit) ? rawLimit : 20;
-    console.log(renderEvents(events.slice(-limit)));
-    return;
-  }
-
-  if (verb === 'inbox') {
-    const addresseeInput = requireString(flags, 'addressee');
-    const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), addresseeInput, '--addressee');
-    const addressee = resolvedSeat.seat;
-    const inbox = events.filter((event) => event.to === addressee || event.next_owner === addressee);
-    console.log([
-      resolvedSeat.aliasUsed ? `addressee_alias: ${addresseeInput} -> ${addressee}` : null,
-      renderEvents(inbox),
-    ].filter((line): line is string => line !== null).join('\n'));
-    return;
-  }
-
-  throw new Error('bus verb must be one of: status, inbox, view');
-}
-
-async function dispatchStatus(flags: Record<string, string | boolean>): Promise<void> {
-  const root = projectRoot(flags);
-  await ensureLocalProject(root);
-  const project = await ensureProjectBinding(root, optionalString(flags, 'at'));
-  const events = await readEvents(root);
-  const enrollments = await listJsonFiles(join(root, '.etiquette', 'roster', 'enrollments'));
-  console.log([
-    'workspace_status:',
-    `  project: ${root}`,
-    `  project_id: ${project.project_id}`,
-    `  events: ${events.length}`,
-    `  enrolled_seats: ${enrollments.length}`,
-    '  authority_boundary: read_only_without_grant',
-  ].join('\n'));
-}
-
-function classifyRunnerDiagnostic(symptom: string): RunnerDiagnosticKind {
-  const normalized = symptom.toLowerCase();
-  if (normalized.includes('unsupported content type')) return 'unsupported_content_type';
-  if (normalized.includes('content type')) return 'tool_result_transport_error';
-  if (normalized.includes('render')) return 'rendering_error';
-  return 'unknown_runner_glitch';
-}
-
-function runnerDiagnosticSeverity(
-  flags: Record<string, string | boolean>,
-  kind: RunnerDiagnosticKind,
-): RunnerDiagnosticSeverity {
-  const explicit = optionalString(flags, 'severity');
-  if (explicit) {
-    if (explicit !== 'info' && explicit !== 'warning' && explicit !== 'blocked') {
-      throw new Error('--severity must be one of: info, warning, blocked');
-    }
-    return explicit;
-  }
-  return kind === 'unknown_runner_glitch' ? 'info' : 'warning';
-}
-
-function noReturnDiagnosticSeverity(verdict: ReturnCheckVerdict): RunnerDiagnosticSeverity {
-  return verdict === 'pass' ? 'info' : 'warning';
-}
-
-function noReturnNextAction(verdict: ReturnCheckVerdict): string {
-  if (verdict === 'pass') return 'none';
-  if (verdict === 'unposted_return') return 'emit_return_packet';
-  return 'write_and_emit_return_packet';
-}
-
-function sameStringArray(actual: unknown[] | undefined, expected: string[]): boolean {
-  if (!actual || actual.length !== expected.length) return false;
-  return actual.every((value, index) => value === expected[index]);
-}
-
-function numberField(record: JsonRecord, field: string): number | undefined {
-  const value = record[field];
-  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
-}
-
-async function readNoReturnDiagnostics(path: string): Promise<JsonRecord[]> {
-  const raw = await readTextIfExists(path);
-  if (!raw) return [];
-  return raw
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .map((line) => JSON.parse(line) as JsonRecord);
-}
-
-function findExistingNoReturnDiagnostic(
-  diagnostics: JsonRecord[],
-  expected: {
-    task: string;
-    seat: string;
-    expectedRoles: ReturnRole[];
-    verdict: ReturnCheckVerdict;
-    severity: RunnerDiagnosticSeverity;
-    matchedReturnPackets: number;
-    postedReturnPackets: number;
-    nextAction: string;
-  },
-): JsonRecord | null {
-  const matches = diagnostics.filter((diagnostic) => (
-    stringField(diagnostic, 'schema') === 'no-return-diagnostic.v0' &&
-    stringField(diagnostic, 'task') === expected.task &&
-    stringField(diagnostic, 'seat') === expected.seat &&
-    sameStringArray(arrayField(diagnostic, 'expected_roles'), expected.expectedRoles) &&
-    stringField(diagnostic, 'verdict') === expected.verdict &&
-    stringField(diagnostic, 'severity') === expected.severity &&
-    numberField(diagnostic, 'matched_return_packets') === expected.matchedReturnPackets &&
-    numberField(diagnostic, 'posted_return_packets') === expected.postedReturnPackets &&
-    stringField(diagnostic, 'next_action') === expected.nextAction
-  ));
-  return matches.length > 0 ? matches[matches.length - 1] : null;
-}
-
-async function dispatchDiagnostics(positionals: string[], flags: Record<string, string | boolean>): Promise<void> {
-  const verb = positionals[1];
-  const root = projectRoot(flags);
-
-  if (verb === 'no-return') {
-    if (!isInitializedLocalProject(root)) {
-      throw new Error('diagnostics no-return requires an initialized local Etiquette project; run etiquette init --project <path> first');
-    }
-    const task = optionalString(flags, 'task') ?? requirePositional(positionals, 2, 'task');
-    const seatInput = requireString(flags, 'seat');
-    assertSharedMemoryScopeId(task, '--task');
-    assertSharedMemoryScopeId(seatInput, '--seat');
-
-    const resolvedSeat = resolveSeatFromEnrollments(await listEnrollments(root), seatInput);
-    const seat = resolvedSeat.seat;
-    const expectedRoles = expectedReturnRoles(flags);
-    const projection = await buildLocalLedgerView(root, {
-      lane: task,
-      from: seat,
-      kind: 'packets',
-      limit: parseOptionalPositiveInt(flags.limit, 'limit', 50),
-      computedAt: nowIso(flags),
-    });
-    const detection = detectReturnPackets(projection, { task, seat, expectedRoles });
-    const severity = noReturnDiagnosticSeverity(detection.verdict);
-    const nextAction = noReturnNextAction(detection.verdict);
-    const diagnosticPath = join(root, '.etiquette', 'diagnostics', 'no-return.ndjson');
-    const existingDiagnostic = findExistingNoReturnDiagnostic(await readNoReturnDiagnostics(diagnosticPath), {
-      task,
-      seat,
-      expectedRoles,
-      verdict: detection.verdict,
-      severity,
-      matchedReturnPackets: detection.matched_return_packets.length,
-      postedReturnPackets: detection.posted_return_packets.length,
-      nextAction,
-    });
-    if (existingDiagnostic) {
-      const output = {
-        ...existingDiagnostic,
-        deduped: true,
-        diagnostic_ref: relativeRef(root, diagnosticPath),
-      };
-      if (flags.json) {
-        console.log(JSON.stringify(output, null, 2));
-        return;
-      }
-      console.log([
-        `no_return_diagnostic: ${stringField(existingDiagnostic, 'diagnostic_id') ?? 'existing'}`,
-        `event: ${stringField(existingDiagnostic, 'event_ref') ?? 'existing'}`,
-        `verdict: ${detection.verdict}`,
-        `severity: ${severity}`,
-        `task: ${task}`,
-        `seat: ${seat}`,
-        `diagnostic_ref: ${output.diagnostic_ref}`,
-        'deduped: true',
-        'can_authorize: false',
-        `next_action: ${nextAction}`,
-      ].join('\n'));
-      return;
-    }
-    await mkdir(dirname(diagnosticPath), { recursive: true });
-    const event = await appendLocalEvent(root, 'no_return_diagnostic', {
-      diagnostic_schema: 'no-return-diagnostic.v0',
-      task,
-      seat,
-      seat_alias: resolvedSeat.aliasUsed ? seatInput : null,
-      expected_roles: expectedRoles,
-      verdict: detection.verdict,
-      severity,
-      matched_return_packets: detection.matched_return_packets.length,
-      posted_return_packets: detection.posted_return_packets.length,
-      latest_event_ref: detection.latest_event_ref,
-      event_log_hash: detection.event_log_hash,
-      next_action: nextAction,
-      authority_boundary: {
-        diagnostic_can_authorize: false,
-        diagnostic_can_merge: false,
-        diagnostic_can_close: false,
-        diagnostic_can_promote: false,
-        diagnostic_can_post_return: false,
-        diagnostic_can_write_global_ledger: false,
-      },
-    }, flags);
-    const diagnostic = {
-      schema: 'no-return-diagnostic.v0',
-      diagnostic_id: `no-return-${event.seq}`,
-      event_ref: event.event_ref,
-      created_at: event.created_at,
-      task,
-      seat,
-      seat_alias: resolvedSeat.aliasUsed ? seatInput : null,
-      expected_roles: expectedRoles,
-      verdict: detection.verdict,
-      severity,
-      matched_return_packets: detection.matched_return_packets.length,
-      posted_return_packets: detection.posted_return_packets.length,
-      latest_event_ref: detection.latest_event_ref,
-      event_log_hash: detection.event_log_hash,
-      next_action: nextAction,
-      authority_boundary: {
-        diagnostic_can_authorize: false,
-        diagnostic_can_merge: false,
-        diagnostic_can_close: false,
-        diagnostic_can_promote: false,
-        diagnostic_can_post_return: false,
-        diagnostic_can_write_global_ledger: false,
-      },
-    };
-    await appendFile(diagnosticPath, `${JSON.stringify(diagnostic)}\n`);
-    const output = {
-      ...diagnostic,
-      deduped: false,
-      diagnostic_ref: relativeRef(root, diagnosticPath),
-    };
-    if (flags.json) {
-      console.log(JSON.stringify(output, null, 2));
-      return;
-    }
-
-    console.log([
-      `no_return_diagnostic: ${diagnostic.diagnostic_id}`,
-      `event: ${event.event_ref}`,
-      `verdict: ${detection.verdict}`,
-      `severity: ${severity}`,
-      `task: ${task}`,
-      `seat: ${seat}`,
-      `diagnostic_ref: ${output.diagnostic_ref}`,
-      'can_authorize: false',
-      `next_action: ${nextAction}`,
-    ].join('\n'));
-    return;
-  }
-
-  await ensureLocalProject(root);
-  if (verb !== 'runner-glitch') throw new Error('diagnostics verb must be one of: runner-glitch, no-return');
-
-  const runner = optionalString(flags, 'runner') ?? 'codex';
-  const symptom = requireString(flags, 'symptom');
-  const sessionId = optionalString(flags, 'session');
-  const commandRef = optionalString(flags, 'command-ref');
-  assertSharedMemoryScopeId(runner, '--runner');
-  assertSharedMemoryText(symptom, '--symptom');
-  if (sessionId) {
-    assertSharedMemoryScopeId(sessionId, '--session');
-    const sessionManifest = join(root, 'docs', 'work', 'sessions', sessionId, 'session.json');
-    if (!existsSync(sessionManifest)) throw new Error(`session does not exist: ${sessionId}`);
-  }
-  if (commandRef) assertSharedMemoryText(commandRef, '--command-ref');
-
-  const kind = classifyRunnerDiagnostic(symptom);
-  const severity = runnerDiagnosticSeverity(flags, kind);
-  const event = await appendLocalEvent(root, 'runner_glitch_diagnostic', {
-    diagnostic_schema: 'runner-glitch-diagnostic.v0',
-    runner,
-    kind,
-    severity,
-    symptom,
-    command_ref: commandRef ?? null,
-    session_id: sessionId ?? null,
-    next_action: 'verify_underlying_command_directly',
-    authority_boundary: {
-      diagnostic_can_authorize: false,
-      diagnostic_can_merge: false,
-      diagnostic_can_close: false,
-      diagnostic_can_promote: false,
-      diagnostic_can_write_global_ledger: false,
-    },
-  }, flags);
-
-  const diagnostic = {
-    schema: 'runner-glitch-diagnostic.v0',
-    diagnostic_id: `runner-glitch-${event.seq}`,
-    event_ref: event.event_ref,
-    created_at: event.created_at,
-    runner,
-    kind,
-    severity,
-    symptom,
-    command_ref: commandRef ?? null,
-    session_id: sessionId ?? null,
-    next_action: 'verify_underlying_command_directly',
-    authority_boundary: {
-      diagnostic_can_authorize: false,
-      diagnostic_can_merge: false,
-      diagnostic_can_close: false,
-      diagnostic_can_promote: false,
-      diagnostic_can_write_global_ledger: false,
-    },
-  };
-
-  const diagnosticPath = join(root, '.etiquette', 'diagnostics', 'runner-glitches.ndjson');
-  await appendFile(diagnosticPath, `${JSON.stringify(diagnostic)}\n`);
-
-  let sessionNoteRef: string | null = null;
-  if (sessionId) {
-    const note = [
-      `Runner diagnostic ${diagnostic.diagnostic_id} recorded ${kind};`,
-      'verify underlying command directly before treating client output as truth.',
-      commandRef ? `Command ref: ${commandRef}.` : '',
-    ].filter(Boolean).join(' ');
-    const result = await appendSessionRunbookNote({
-      projectRoot: root,
-      sessionId,
-      section: 'retry',
-      message: note,
-      at: optionalString(flags, 'at'),
-    });
-    sessionNoteRef = relativeRef(root, result.runbookPath);
-  }
-
-  const output = {
-    ...diagnostic,
-    diagnostic_ref: relativeRef(root, diagnosticPath),
-    session_note_ref: sessionNoteRef,
-  };
-  if (flags.json) {
-    console.log(JSON.stringify(output, null, 2));
-    return;
-  }
-
-  console.log([
-    `runner_glitch_diagnostic: ${diagnostic.diagnostic_id}`,
-    `event: ${event.event_ref}`,
-    `kind: ${kind}`,
-    `severity: ${severity}`,
-    `runner: ${runner}`,
-    `diagnostic_ref: ${output.diagnostic_ref}`,
-    `session_note_ref: ${sessionNoteRef ?? 'none'}`,
-    'can_authorize: false',
-    'next_action: verify_underlying_command_directly',
-  ].join('\n'));
-}
-
-export async function dispatchLocalWorkflow(
-  positionals: string[],
-  flags: Record<string, string | boolean>,
-): Promise<void> {
-  const command = positionals[0];
-  switch (command) {
-    case 'setup':
-      await dispatchSetup(flags);
-      return;
-    case 'handoff':
-      await dispatchHandoff(flags);
-      return;
-    case 'init':
-      await dispatchInit(flags);
-      return;
-    case 'bootstrap':
-      await dispatchBootstrap(positionals, flags);
-      return;
-    case 'whereami':
-      await dispatchWhereami(flags);
-      return;
-    case 'join':
-      await dispatchJoin(flags);
-      return;
-    case 'pickup':
-      await dispatchPickup(flags);
-      return;
-    case 'enter':
-      await dispatchEnter(positionals, flags);
-      return;
-    case 'audit':
-      await dispatchAudit(positionals, flags);
-      return;
-    case 'roster':
-      await dispatchRoster(positionals, flags);
-      return;
-    case 'post':
-      await dispatchPost(flags);
-      return;
-    case 'notify':
-      await dispatchNotify(positionals, flags);
-      return;
-    case 'return':
-      await dispatchReturn(positionals, flags);
-      return;
-    case 'retire':
-      await retirePath(requirePositional(positionals, 1, 'path'), flags);
-      return;
-    case 'rig':
-      await dispatchRig(positionals, flags);
-      return;
-    case 'doctor':
-      await dispatchRig(['rig', 'doctor'], flags);
-      return;
-    case 'bus':
-      await dispatchBus(positionals, flags);
-      return;
-    case 'timeline':
-      await dispatchTimeline(positionals, flags);
-      return;
-    case 'status':
-      await dispatchStatus(flags);
-      return;
-    case 'diagnostics':
-      await dispatchDiagnostics(positionals, flags);
-      return;
-    case 'trash':
-      await dispatchTrash(positionals, flags);
-      return;
-    default:
-      throw new Error(`unknown local workflow command: ${command}`);
-  }
-}
-
-export async function renderLocalBoard(projectRoot: string, seat?: string): Promise<string> {
-  const root = resolve(projectRoot);
-  await ensureLocalProject(root);
-  const resolvedSeat = seat ? resolveSeatFromEnrollments(await listEnrollments(root), seat) : null;
-  const boardSeat = resolvedSeat?.seat ?? null;
-  const board = await readTextIfExists(join(root, 'docs', 'work', 'BOARD.md'));
-  const events = await readEvents(root);
-  const lines = [
-    `console_board: ${boardSeat ?? 'all-seats'}`,
-    resolvedSeat?.aliasUsed ? `seat_alias: ${resolvedSeat.requestedSeat} -> ${boardSeat}` : null,
-    '',
-    board?.trim() || 'No docs/work/BOARD.md found.',
-    '',
-    'Recent events:',
-    renderEvents(events.slice(-10)),
-    '',
-    'authority_boundary: read-only; no grants, merge, or close',
-  ];
-  return lines.filter((line): line is string => line !== null).join('\n');
-}