refactor(cli): spell a session's address from the one prefix constant, off the codec's module graph

The Orca session address prefix moves to a leaf module with no imports, re-exported by
the address codec, so the CLI entry check derives `session:<id>` from that constant
instead of re-typing it and still stays off the codec's zod graph. Prose and test names
say caller or Orca session id, not actor.

src/cli/index-orchestration.test.ts

@@ -85,7 +85,7 @@ describe('orca cli worktree awareness', () => {
     expect(logSpy).toHaveBeenCalledWith('Sent 2 messages to 2 recipients')
   })
 
-  it("refuses an agent session's caller flag naming another actor before any request", async () => {
+  it("refuses an agent session's caller flag naming another caller before any request", async () => {
     // One chokepoint for every verb: the spec says which flag names the caller.
     process.env.ORCA_AGENT_SESSION_ID = 'f7a1c0de-1111-4222-8333-444455556666'
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {})

src/cli/orchestration-session-caller-cli.test.ts

@@ -279,7 +279,7 @@ describe.each(CALLER_VERBS)('orchestration $command run as an agent session', (v
   })
 
   it.runIf(verb.callerFlag !== undefined)(
-    'refuses a caller flag naming another actor, before any request',
+    'refuses a caller flag naming another caller, before any request',
     async () => {
       const flags = flagMap({ ...verb.flags, [verb.callerFlag ?? 'from']: 'term_sibling' })
 
@@ -320,7 +320,7 @@ describe.each([
 ])('orchestration $command --run run as an agent session', ({ command, method, callerParam }) => {
   beforeEach(asSessionInTerminalView)
 
-  it('needs no caller, but refuses a --from naming another actor, before any request', async () => {
+  it('needs no caller, but refuses a --from naming another caller, before any request', async () => {
     await invoke(command, flagMap({ run: 'run_1' }))
     expect(callsTo(method)[0]).toMatchObject({ run: 'run_1' })
     expect(callsTo(method)[0]?.[callerParam]).toBeUndefined()
@@ -537,7 +537,7 @@ describe('which flag names the caller, declared on every spec', () => {
   })
 
   it.each(callerFlagVerbs)(
-    '$command refuses --$flag naming another actor, before any request',
+    '$command refuses --$flag naming another caller, before any request',
     async ({ command, flag }) => {
       asSessionInTerminalView()
       await expect(

src/cli/session-caller-flags.ts

@@ -12,6 +12,7 @@ import type { CommandSpec, IdentityFlag } from './command-spec'
 import { RuntimeClientError } from './runtime/types'
 import { readInjectedAgentSessionId } from '../shared/agent-session-caller-env'
 import { isStructuredWorkerHandle } from '../shared/structured-worker-handle'
+import { ORCA_SESSION_ADDRESS_PREFIX } from '../shared/orca-session-address-prefix'
 
 export function refuseConflictingSessionCallerFlags(
   spec: CommandSpec | undefined,
@@ -33,7 +34,7 @@ export function refuseConflictingSessionCallerFlags(
         'consumer_fenced',
         `This command runs as agent session ${sessionId}, so --${flagName} ${declared} would act as a ` +
           `different caller. Drop --${flagName}: this session's orchestration commands already act as ` +
-          `session:${sessionId}. No request was sent.`
+          `${ORCA_SESSION_ADDRESS_PREFIX}${sessionId}. No request was sent.`
       )
     }
   }
@@ -43,11 +44,13 @@ const IDENTITY_FLAGS: readonly IdentityFlag[] = ['from', 'terminal']
 
 /**
  * The session's own spellings, plus the handle a structured worker session was minted. Plain
- * strings: this runs at the CLI entry for every command, before the actor codec's module graph.
+ * strings: this runs at the CLI entry for every command, before the address codec's module graph.
  */
 function namesInjectedSession(value: string, sessionId: string, env: NodeJS.ProcessEnv): boolean {
   return (
-    value === sessionId || value === `session:${sessionId}` || value === injectedSessionAddress(env)
+    value === sessionId ||
+    value === `${ORCA_SESSION_ADDRESS_PREFIX}${sessionId}` ||
+    value === injectedSessionAddress(env)
   )
 }
 
@@ -61,5 +64,7 @@ export function injectedSessionAddress(env: NodeJS.ProcessEnv = process.env): st
     return undefined
   }
   const ownHandle = env.ORCA_TERMINAL_HANDLE
-  return isStructuredWorkerHandle(ownHandle) ? ownHandle : `session:${sessionId}`
+  return isStructuredWorkerHandle(ownHandle)
+    ? ownHandle
+    : `${ORCA_SESSION_ADDRESS_PREFIX}${sessionId}`
 }

src/shared/agent-session-caller-env.ts

@@ -1,7 +1,7 @@
 /**
  * The Orca-minted agent session id, injected into a structured session's own child processes, in
  * native chat and in terminal view alike. When it is present it IS the orchestration caller: the
- * CLI sends it in the orchestration envelope and the host resolves it to the session's actor, so no
+ * CLI sends it in the orchestration envelope and the host resolves the session it names, so no
  * terminal is resolved or guessed on its behalf.
  *
  * Identity by session id assumes one machine and one user. A host boundary (SSH, a paired peer,

src/shared/orca-session-address-prefix.ts

@@ -0,0 +1,2 @@
+// A leaf with no imports, so the CLI entry can spell a session address without the codec's zod graph.
+export const ORCA_SESSION_ADDRESS_PREFIX = 'session:'

src/shared/orca-session-address.ts

@@ -1,5 +1,6 @@
 import { isAgentSessionId } from './agent-session-record'
 import { STRUCTURED_WORKER_HANDLE_PREFIX } from './structured-worker-handle'
+import { ORCA_SESSION_ADDRESS_PREFIX } from './orca-session-address-prefix'
 
 /**
  * The Orca session id is the id Orca minted for a structured session (its session record id, the
@@ -12,7 +13,7 @@ import { STRUCTURED_WORKER_HANDLE_PREFIX } from './structured-worker-handle'
  * agents have none today, and never a pane-keyed one: a pane outlives the agent in it, so such an id
  * would be inherited by the pane's next occupant.
  */
-export const ORCA_SESSION_ADDRESS_PREFIX = 'session:'
+export { ORCA_SESSION_ADDRESS_PREFIX }
 
 declare const orcaSessionIdBrand: unique symbol
 declare const orcaSessionAddressBrand: unique symbol