A4's hire writes an org:hire-<uuid> definition, so the chief's in-session launch of its hire now reaches the launcher's held-secret check. The fixture's op table lacked definitionScan and refused invalid-host-request; process.mjs answers it.