Function resolved_live_roles 

pub fn resolved_live_roles(
    config_dir: &Path,
    app_support: &Path,
) -> Result<LiveRoles, String>

The models the live roles resolve to, read by a process that is not forge.

redb takes an exclusive lock, so a running forge holds the live store; the rows are read off a copy. On macOS the copy is an APFS clone, so it is a point-in-time snapshot; a plain byte copy racing a commit can land on the previous one, so these answers are the store as of the copy rather than what a running engine holds mid-activation. A role whose config key names a variant this machine has not installed is an error rather than a feed lookup: the caller is a bench, and a bench fetches nothing.