Owner of one bounded code-owned analysis mission continuation.

Sessions are created only from a builder-attested, independently validated assembly. One GenServer serializes evaluations, owns the deadline transition, monitors its trace owner, and delegates all Lisp execution to PtcRunner.Kernel.Evaluation. Return and fail are per-form outcomes; only lifecycle close, abort, deadline, or terminal Kernel budgets close the session against new forms. Close and abort finalize resources and persistence but deliberately leave this GenServer alive for idempotent close retry and info; every host must eventually call stop/1.

A session whose profile declares a private result class projects its failure messages through PtcRunner.Kernel.PrivateDiagnostic, which rebuilds source-derived names or admits bounded pre-execution diagnostics instead of forwarding arbitrary evaluator text. Every error map this module emits carries message_redacted? so a withheld diagnostic is distinguishable from one that was never produced.