@akagilnc/pi-workflow-roles 0.1.1815 → 0.1.1831

package/dist/audit-escalation.js

@@ -101,7 +101,7 @@ export async function disposeComplianceDecision(decision, handlers, deliveredOut
             if (handlers.noReceipt === undefined) {
                 throw new Error("Compliance no-receipt projection handler is unavailable");
             }
-            return await handlers.noReceipt(decision);
+            return await handlers.noReceipt(decision, decision.usage === undefined ? {} : { usage: decision.usage });
         case "revise":
             return await handlers.revise(decision.violations);
         case "escalate":

package/dist/compliance-transport.js

@@ -1,7 +1,6 @@
 import { Type } from "typebox";
 import { executeAuditorChild, } from "./evidence-child-executor.js";
 import { createAuditorDossierTool } from "./auditor-dossier-tool.js";
-import { parseNoReceiptLifecycleFacts } from "./receipt-delivery-policy.js";
 /** Zero-projection kickoff — soul already carries dossier-fetch duty; no hand-delivered materials. */
 export const AUDITOR_DOSSIER_PROMPT = "Audit the current run dossier.";
 const nonblank = Type.String({ minLength: 1, pattern: "\\S" });
@@ -74,10 +73,12 @@ export async function runComplianceAudit(options) {
         ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
         ...(options.signal === undefined ? {} : { signal: options.signal }),
     });
-    try {
-        return { status: "no-receipt", ...parseNoReceiptLifecycleFacts(receipt.decision) };
-    }
-    catch {
-        return readComplianceCandidate(receipt.decision, receipt.response.usage);
+    if (receipt.noReceiptLifecycle !== undefined) {
+        return {
+            status: "no-receipt",
+            ...receipt.noReceiptLifecycle,
+            ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
+        };
     }
+    return readComplianceCandidate(receipt.decision, receipt.response.usage);
 }

package/dist/evidence-child-executor.js

@@ -428,10 +428,12 @@ export async function executeAuditorChild(options) {
         });
         const cwd = options.context.cwd ?? process.cwd();
         let decision;
+        let noReceiptLifecycle;
         let decisionSubmitted = false;
         let decisionCallId;
         let decisionToolFailure;
         const decisionToolFailures = new Map();
+        const delivery = createReceiptDeliveryPolicy();
         const tool = wrapPackageOwnedToolDefinition({
             ...options.tool,
             label: options.roleLabel,
@@ -439,8 +441,12 @@ export async function executeAuditorChild(options) {
                 if (decisionSubmitted && decisionCallId !== args[0]) {
                     throw new Error("Auditor decision was submitted more than once");
                 }
+                // Pi may already have issued several decision calls in one assistant
+                // response. Execute every issued call: the budget limits future
+                // solicitations, not terminal calls already in flight.
                 try {
                     const result = await options.tool.execute(...args);
+                    delivery.recordAccepted();
                     decision = args[1];
                     decisionCallId = args[0];
                     decisionToolFailure = undefined;
@@ -490,11 +496,13 @@ export async function executeAuditorChild(options) {
         // response could not later be tied to the current parent attempt.
         auditorSessionManager.appendCustomEntry(AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, binding);
         let turns = 0;
+        const sessionUsage = emptyUsage();
         let boundaryResponse;
         let retentionFailure;
         let retainedResponse;
         let rejectedDecisionResponse;
         let promptNeighboringFailure;
+        let promptDecisionFailures = [];
         const registeredToolNames = new Set(session.getAllTools().map((entry) => entry.name));
         const evidenceToolFailures = new Map();
         for (const name of registeredToolNames) {
@@ -523,9 +531,19 @@ export async function executeAuditorChild(options) {
             const callIdSet = new Set(callIds);
             return [...session.messages].reverse().find((message) => message.role === "toolResult" && callIdSet.has(message.toolCallId) && message.isError);
         };
+        const drainRejectedDecisionFailures = (response) => {
+            for (const part of response.content) {
+                if (part.type !== "toolCall" || part.name !== tool.name || !decisionToolFailures.has(part.id))
+                    continue;
+                decisionToolFailure = decisionToolFailures.get(part.id);
+                promptDecisionFailures.push(decisionToolFailure);
+                decisionToolFailures.delete(part.id);
+            }
+        };
         const unsubscribe = session.subscribe((event) => {
             if (event.type === "message_end" && event.message.role === "assistant" && boundaryResponse === undefined) {
                 turns += 1;
+                addUsage(sessionUsage, event.message.usage);
                 retainedResponse = event.message;
                 try {
                     options.retainResponse?.(event.message);
@@ -556,14 +574,11 @@ export async function executeAuditorChild(options) {
             if (event.type === "turn_end") {
                 if (rejectedDecisionResponse !== undefined) {
                     promptNeighboringFailure = findToolFailure(rejectedDecisionResponse);
-                    const rejectedCall = rejectedDecisionResponse.content.find((part) => part.type === "toolCall" && part.name === tool.name && decisionToolFailures.has(part.id));
-                    if (rejectedCall?.type === "toolCall") {
-                        decisionToolFailure = decisionToolFailures.get(rejectedCall.id);
-                        decisionToolFailures.delete(rejectedCall.id);
-                    }
+                    drainRejectedDecisionFailures(rejectedDecisionResponse);
                 }
                 if (decisionSubmitted || promptNeighboringFailure !== undefined
-                    || boundaryResponse !== undefined || retentionFailure !== undefined) {
+                    || (boundaryResponse !== undefined && rejectedDecisionResponse === undefined)
+                    || retentionFailure !== undefined) {
                     void session.abort();
                 }
             }
@@ -575,11 +590,11 @@ export async function executeAuditorChild(options) {
             options.signal?.addEventListener("abort", abort, { once: true });
         try {
             try {
-                const delivery = createReceiptDeliveryPolicy();
                 const promptAllowingRejectedDecision = async (prompt) => {
                     rejectedDecisionResponse = undefined;
                     promptNeighboringFailure = undefined;
                     decisionToolFailure = undefined;
+                    promptDecisionFailures = [];
                     let promptFailure;
                     try {
                         await session.prompt(prompt);
@@ -593,28 +608,47 @@ export async function executeAuditorChild(options) {
                     const correlatedResponse = rejectedDecisionResponse;
                     if (correlatedResponse !== undefined) {
                         promptNeighboringFailure ??= findToolFailure(correlatedResponse);
-                        const rejectedCall = correlatedResponse.content.find((part) => part.type === "toolCall" && part.name === tool.name && decisionToolFailures.has(part.id));
-                        if (rejectedCall?.type === "toolCall") {
-                            decisionToolFailure = decisionToolFailures.get(rejectedCall.id);
-                            decisionToolFailures.delete(rejectedCall.id);
-                        }
+                        drainRejectedDecisionFailures(correlatedResponse);
                     }
                     // An adjacent failure outranks correctable decision feedback.
                     if (promptNeighboringFailure !== undefined)
                         throw promptNeighboringFailure;
+                    // An accepted correction in the same response owns the terminal
+                    // outcome; correlated rejected siblings remain observations, not a
+                    // stale failure capable of replacing that accepted receipt.
+                    if (decisionSubmitted) {
+                        decisionToolFailure = undefined;
+                        return;
+                    }
                     if (decisionToolFailure !== undefined)
                         return;
                     if (promptFailure !== undefined)
                         throw promptFailure;
                 };
+                const chargeAndClearRejectedDecisionFailures = (failures) => {
+                    for (const failure of failures) {
+                        delivery.recordRejected(failure instanceof Error ? failure.message : String(failure));
+                    }
+                    decisionToolFailure = undefined;
+                    promptDecisionFailures = [];
+                };
                 await promptAllowingRejectedDecision(options.prompt);
-                while (!decisionSubmitted && boundaryResponse === undefined && inherited.streamFailure === undefined
-                    && delivery.nextAction() === "request-delivery") {
+                while (!decisionSubmitted && (boundaryResponse === undefined || decisionToolFailure !== undefined)
+                    && inherited.streamFailure === undefined && delivery.nextAction() === "request-delivery") {
                     if (decisionToolFailure !== undefined) {
-                        delivery.recordRejected(decisionToolFailure instanceof Error ? decisionToolFailure.message : String(decisionToolFailure));
-                        decisionToolFailure = undefined;
+                        const failures = promptDecisionFailures.length === 0
+                            ? [decisionToolFailure]
+                            : promptDecisionFailures;
+                        chargeAndClearRejectedDecisionFailures(failures);
+                        if (delivery.nextAction() === "no-receipt")
+                            boundaryResponse = undefined;
                         if (delivery.nextAction() === "request-delivery") {
-                            await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
+                            // A rejection and its correction solicitation are one budget unit;
+                            // recordRejected already charged it.
+                            if (retainedResponse === rejectedDecisionResponse) {
+                                await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
+                                chargeAndClearRejectedDecisionFailures(promptDecisionFailures);
+                            }
                         }
                     }
                     else {
@@ -622,15 +656,19 @@ export async function executeAuditorChild(options) {
                         await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
                     }
                 }
-                if (!decisionSubmitted && boundaryResponse === undefined && inherited.streamFailure === undefined
+                if (!decisionSubmitted && inherited.streamFailure === undefined
                     && delivery.nextAction() === "no-receipt") {
                     const runPointer = options.context.sessionManager.getSessionFile() ?? options.context.cwd ?? process.cwd();
                     const attemptPointer = binding.parent.attemptEntryId ?? binding.parent.sessionId ?? `current:${runPointer}`;
-                    decision = delivery.facts({ runPointer, attemptPointer });
+                    const facts = delivery.facts({ runPointer, attemptPointer });
+                    decision = facts;
                     // Late turn_end feedback cannot overturn a lifecycle that has already
                     // charged this prompt to the exhausted shared budget.
                     decisionToolFailure = undefined;
-                    auditorSessionManager.appendCustomEntry(NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, decision);
+                    auditorSessionManager.appendCustomEntry(NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, facts);
+                    // Provenance is granted only after the lifecycle owner persisted the
+                    // current child record; accepted model arguments can never set it.
+                    noReceiptLifecycle = facts;
                 }
             }
             catch (error) {
@@ -644,7 +682,7 @@ export async function executeAuditorChild(options) {
                 throw options.signal.reason;
             if (inherited.streamFailure !== undefined)
                 throw inherited.streamFailure;
-            if (decisionToolFailure !== undefined)
+            if (!decisionSubmitted && decisionToolFailure !== undefined)
                 throw decisionToolFailure;
             const relevantResponse = !decisionSubmitted
                 ? boundaryResponse
@@ -656,7 +694,7 @@ export async function executeAuditorChild(options) {
             }
             if (retentionFailure !== undefined && retainedResponse?.stopReason !== "error")
                 throw retentionFailure;
-            if (boundaryResponse !== undefined && !decisionSubmitted) {
+            if (boundaryResponse !== undefined && !decisionSubmitted && noReceiptLifecycle === undefined) {
                 const toolNames = boundaryResponse.content.flatMap((part) => part.type === "toolCall" ? [part.name] : []);
                 throw new AuditorTurnLimitError(AUDITOR_TURN_LIMIT, turns, {
                     stopReason: boundaryResponse.stopReason,
@@ -728,7 +766,11 @@ export async function executeAuditorChild(options) {
                 || (!decisionSubmitted && decision === undefined)) {
                 throw new Error(`${options.roleLabel} exited without a readable decision receipt`);
             }
-            return { decision, response };
+            return {
+                decision,
+                response: { ...response, usage: sessionUsage },
+                ...(noReceiptLifecycle === undefined ? {} : { noReceiptLifecycle }),
+            };
         }
         finally {
             options.signal?.removeEventListener("abort", abort);

package/dist/navigator-attendance.js

@@ -438,8 +438,13 @@ function createNavigatorAttendance(options) {
 ${text}
 </role_help>`).join("\n");
     let output;
+    let prepareBatchRejected = false;
     outputSink = (value) => {
-      if (output !== void 0) throw new Error("Navigator preparation must submit exactly one typed candidate batch");
+      if (prepareBatchRejected || output !== void 0) {
+        output = void 0;
+        prepareBatchRejected = true;
+        throw new Error("Navigator preparation must submit exactly one typed candidate batch");
+      }
       output = value;
     };
     const tool = createNavigatorPrepareTool((value) => {
@@ -553,6 +558,7 @@ ${helpContext}
         const delivery = createReceiptDeliveryPolicy();
         const promptAllowingRejectedPrepare = async (text, deliveryRequest) => {
           const entryStart = activeSession.entries().length;
+          prepareBatchRejected = false;
           let promptFailure;
           try {
             await activeSession.prompt(text);
@@ -565,6 +571,8 @@ ${helpContext}
           }
           const rejectedReason = rejectedPrepareReason(activeSession.entries(), entryStart);
           if (rejectedReason !== void 0) {
+            output = void 0;
+            prepareBatchRejected = true;
             delivery.recordRejected(rejectedReason);
             return;
           }

package/dist/public-cli/main.js

@@ -17909,12 +17909,15 @@ function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseNoReceiptLifecycleFacts(input) {
-  if (!isRecord4(input) || typeof input.terminalToolCalled !== "boolean" || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT || input.sessionCompletion !== "settled-without-accepted-receipt" || input.acceptedReceipt !== false || typeof input.runPointer !== "string" || input.runPointer.trim() === "" || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === "" || !Array.isArray(input.rejectedReceipts) || !input.rejectedReceipts.every((item) => isRecord4(item) && typeof item.reason === "string" && item.reason.trim() !== "")) {
+  if (!isRecord4(input) || typeof input.terminalToolCalled !== "boolean" || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT || input.sessionCompletion !== "settled-without-accepted-receipt" || input.acceptedReceipt !== false || typeof input.runPointer !== "string" || input.runPointer.trim() === "" || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === "" || !Array.isArray(input.rejectedReceipts) || !input.rejectedReceipts.every((item) => isRecord4(item) && typeof item.reason === "string")) {
     throw new TypeError("malformed no-receipt lifecycle facts");
   }
   return {
     terminalToolCalled: input.terminalToolCalled,
-    rejectedReceipts: input.rejectedReceipts.map((item) => ({ reason: item.reason })),
+    rejectedReceipts: input.rejectedReceipts.map((item) => ({
+      reason: item.reason,
+      diagnosticAvailable: item.reason.trim() !== ""
+    })),
     deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
     sessionCompletion: "settled-without-accepted-receipt",
     runPointer: input.runPointer,
@@ -17967,7 +17970,6 @@ var init_compliance_transport = __esm({
     init_build();
     init_evidence_child_executor();
     init_auditor_dossier_tool();
-    init_receipt_delivery_policy();
     nonblank2 = typebox_exports.String({ minLength: 1, pattern: "\\S" });
     decisionGateSchema = typebox_exports.Object({ question: nonblank2, options: typebox_exports.Array(nonblank2, { minItems: 1 }) }, { additionalProperties: false });
     complianceDecisionSchema = typebox_exports.Object({ status: typebox_exports.Unknown({ description: "Auditor decision status." }), violations: typebox_exports.Array(nonblank2, { description: "Observed compliance violations." }), conflicts: typebox_exports.Array(nonblank2, { description: "Unresolved authority or execution conflicts." }), decisionGate: typebox_exports.Union([decisionGateSchema, typebox_exports.Null()], { description: "Escalation question and available options." }) }, { additionalProperties: true, required: [] });

package/dist/receipt-delivery-policy.js

@@ -16,12 +16,15 @@ export function parseNoReceiptLifecycleFacts(input) {
         || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === ""
         || !Array.isArray(input.rejectedReceipts)
         || !input.rejectedReceipts.every((item) => isRecord(item)
-            && typeof item.reason === "string" && item.reason.trim() !== "")) {
+            && typeof item.reason === "string")) {
         throw new TypeError("malformed no-receipt lifecycle facts");
     }
     return {
         terminalToolCalled: input.terminalToolCalled,
-        rejectedReceipts: input.rejectedReceipts.map((item) => ({ reason: item.reason })),
+        rejectedReceipts: input.rejectedReceipts.map((item) => ({
+            reason: item.reason,
+            diagnosticAvailable: item.reason.trim() !== "",
+        })),
         deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
         sessionCompletion: "settled-without-accepted-receipt",
         runPointer: input.runPointer,
@@ -35,7 +38,10 @@ export function noReceiptLifecycleFacts(input) {
     }
     return {
         terminalToolCalled: input.terminalToolCalled,
-        rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({ reason })),
+        rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({
+            reason,
+            diagnosticAvailable: reason.trim() !== "",
+        })),
         deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
         sessionCompletion: "settled-without-accepted-receipt",
         runPointer: input.runPointer,
@@ -49,12 +55,15 @@ export function createReceiptDeliveryPolicy() {
     let deliveryTurns = 0;
     const rejectedReceipts = [];
     return {
-        recordAccepted() { accepted = true; terminalToolCalled = true; },
+        recordAccepted() {
+            accepted = true;
+            terminalToolCalled = true;
+        },
         /** Infrastructure owns terminality and must never trigger receipt催交. */
         stopForInfrastructure() { accepted = true; },
         recordRejected(reason) {
             terminalToolCalled = true;
-            rejectedReceipts.push({ reason });
+            rejectedReceipts.push({ reason, diagnosticAvailable: reason.trim() !== "" });
             deliveryTurns = Math.min(RECEIPT_DELIVERY_TURN_LIMIT, deliveryTurns + 1);
         },
         recordDeliveryRequest() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.1815",
+  "version": "0.1.1831",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/audit-escalation.ts

@@ -148,6 +148,7 @@ export type ComplianceDecisionHandlers<T> = {
   /** Project the accepted parent candidate beside the typed audit-leg facts. */
   noReceipt?: (
     facts: Extract<ComplianceDecision, { status: "no-receipt" }>,
+    usageProjection: { usage?: Usage },
   ) => T | PromiseLike<T>;
   revise: (violations: readonly unknown[]) => T | PromiseLike<T>;
   escalate: (result: AuditEscalationToolResult) => T | PromiseLike<T>;
@@ -172,7 +173,10 @@ export async function disposeComplianceDecision<T>(
       if (handlers.noReceipt === undefined) {
         throw new Error("Compliance no-receipt projection handler is unavailable");
       }
-      return await handlers.noReceipt(decision);
+      return await handlers.noReceipt(
+        decision,
+        decision.usage === undefined ? {} : { usage: decision.usage },
+      );
     case "revise":
       return await handlers.revise(decision.violations);
     case "escalate":

package/src/compliance-transport.ts

@@ -7,7 +7,7 @@ import {
 } from "./evidence-child-executor.ts";
 import { createAuditorDossierTool } from "./auditor-dossier-tool.ts";
 import type { DossierObservation } from "./dossier-resolution.ts";
-import { parseNoReceiptLifecycleFacts, type NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
+import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 
 export type ComplianceCompletion = AuditorCompletion;
 export type ComplianceArgumentRootType = "null" | "array" | "undefined" | "string" | "number" | "boolean" | "bigint" | "symbol" | "function";
@@ -16,7 +16,7 @@ export type ComplianceAuditObservation =
   | { kind: "object-status-unreadable"; status: "missing" | "unknown" }
   | DossierObservation;
 export type ComplianceAuditIncomplete = { status: "audit-incomplete"; observation: ComplianceAuditObservation; candidate: unknown; usage?: Usage };
-export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt" };
+export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt"; usage?: Usage };
 export type ComplianceDecision = { status: "pass"; usage?: Usage } | { status: "revise"; violations: readonly unknown[]; usage?: Usage } | { status: "escalate"; conflicts?: unknown; decisionGate?: unknown; usage?: Usage } | ComplianceNoReceipt | ComplianceAuditIncomplete;
 export type ComplianceDispatch = { model: Model<Api>; auth: { apiKey?: string; headers?: Record<string, string | null>; env?: Record<string, string> } };
 
@@ -128,9 +128,12 @@ export async function runComplianceAudit(options: RunComplianceAuditOptions): Pr
     ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
     ...(options.signal === undefined ? {} : { signal: options.signal }),
   });
-  try {
-    return { status: "no-receipt", ...parseNoReceiptLifecycleFacts(receipt.decision) };
-  } catch {
-    return readComplianceCandidate(receipt.decision, receipt.response.usage);
+  if (receipt.noReceiptLifecycle !== undefined) {
+    return {
+      status: "no-receipt",
+      ...receipt.noReceiptLifecycle,
+      ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
+    };
   }
+  return readComplianceCandidate(receipt.decision, receipt.response.usage);
 }

package/src/doctor-role.ts

@@ -12,7 +12,7 @@ export function createDoctorRoleRuntime(pi: ExtensionAPI, dependencies: DoctorRo
   let activation: { soul: string; patient: DoctorCase; store: DoctorEvidenceStore } | undefined; let registered = false; pi.registerFlag(DOCTOR_CASE_FLAG.name, DOCTOR_CASE_FLAG.definition);
   return { async activate() { const path = pi.getFlag(DOCTOR_CASE_FLAG.name); if (typeof path !== "string" || !path.trim()) throw new Error("Doctor requires --ak-doctor-case"); const soul = (await dependencies.loadSoul()).trim(); if (!soul) throw new Error("Doctor soul is empty"); const patient = await dependencies.loadCase(path); activation = { soul, patient, store: new DoctorEvidenceStore(patient) };
     if (!registered) { registered = true; pi.registerTool({ name: DOCTOR_EVIDENCE_TOOL_NAME, label: "Doctor Evidence", description: "Read retained Pi session bytes with bounded pagination.", parameters: doctorEvidenceReadSchema, async execute(_id, params: { evidenceId: string; offset?: number; limit?: number }) { if (!activation) throw new Error("Doctor is not activated"); const details = activation.store.read(params.evidenceId, params.offset, params.limit); return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details }; } });
-      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "Doctor Output", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id, params, signal, _update, ctx): Promise<AgentToolResult<unknown>> { if (!activation) throw new Error("Doctor is not activated"); singleton(id, ctx); const testimony = validateDoctorOutput(params, activation.patient, activation.store); try { appendActiveSessionCustomEntry(ctx, DOCTOR_CANDIDATE_ENTRY_TYPE, { version: 1, testimony, readRecord: activation.store.readRecord(), patientIdentity: activation.patient.identity }, { unavailable: "doctor candidate retention is unavailable", failed: "doctor candidate retention failed" }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx } : { context: ctx, signal }); } catch (error) { host.failInfrastructure(error, ctx, id); } const details = testimony.status === "completed" ? { ...testimony, cost: activation.patient.cost } : testimony; return disposeComplianceDecision<AgentToolResult<unknown>>(audit, { pass: (usage) => ({ content: [{ type: "text" as const, text: "Doctor output accepted" }], details, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt) => ({ content: [{ type: "text" as const, text: "Doctor output accepted; compliance audit produced no receipt" }], details: { ...details, auditNoReceipt }, terminate: true as const }), revise: (violations) => { throw new Error(`Doctor output violates its soul: ${violations.join("; ")}`); }, escalate: (result) => result, auditIncomplete: (result) => result }, details); } });
+      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "Doctor Output", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id, params, signal, _update, ctx): Promise<AgentToolResult<unknown>> { if (!activation) throw new Error("Doctor is not activated"); singleton(id, ctx); const testimony = validateDoctorOutput(params, activation.patient, activation.store); try { appendActiveSessionCustomEntry(ctx, DOCTOR_CANDIDATE_ENTRY_TYPE, { version: 1, testimony, readRecord: activation.store.readRecord(), patientIdentity: activation.patient.identity }, { unavailable: "doctor candidate retention is unavailable", failed: "doctor candidate retention failed" }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx } : { context: ctx, signal }); } catch (error) { host.failInfrastructure(error, ctx, id); } const details = testimony.status === "completed" ? { ...testimony, cost: activation.patient.cost } : testimony; return disposeComplianceDecision<AgentToolResult<unknown>>(audit, { pass: (usage) => ({ content: [{ type: "text" as const, text: "Doctor output accepted" }], details, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt, usageProjection) => ({ content: [{ type: "text" as const, text: "Doctor output accepted; compliance audit produced no receipt" }], details: { ...details, auditNoReceipt }, terminate: true as const, ...usageProjection }), revise: (violations) => { throw new Error(`Doctor output violates its soul: ${violations.join("; ")}`); }, escalate: (result) => result, auditIncomplete: (result) => result }, details); } });
       pi.on("before_agent_start", (event) => { if (!activation) throw new Error("Doctor is not activated"); const catalog = { version: activation.patient.version, identity: activation.patient.identity, admittedMetrics: { provenance: "runtime-derived from retained session bytes and sealed into the accepted receipt", cost: activation.patient.cost }, lawfulTargetKeys: ["case", ...activation.patient.cost.invocations.sources], evidence: activation.patient.evidence.map(({ id, kind, sha256, byteLength, contentLength }) => ({ id, kind, sha256, byteLength, contentLength })) }; return { systemPrompt: `${event.systemPrompt}\n\n<doctor_soul>\n${activation.soul}\n</doctor_soul>\n\n<doctor_case>\n${JSON.stringify(catalog)}\n</doctor_case>` }; }); }
     const required = [DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME]; const names = pi.getAllTools().map((tool) => tool.name); for (const name of required) if (names.filter((item) => item === name).length !== 1) throw new Error(`Doctor required tool collision or missing: ${name}`); pi.setActiveTools(required); const active = pi.getActiveTools?.() ?? required; if (active.length !== 2 || !required.every((name) => active.includes(name))) throw new Error("Doctor active tool narrowing failed"); } };
 }

package/src/evidence-child-executor.ts

@@ -32,7 +32,7 @@ import {
 import { wrapPackageOwnedToolDefinition } from "./package-owned-tool-idle.ts";
 import type { ReviewerPromptText } from "./reviewer-prompt-identity.ts";
 import { createStreamIdleGuard, isStreamIdleTimeoutError } from "./stream-idle-guard.ts";
-import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.ts";
+import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT, type NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 
 // ── shared constants / types ──────────────────────────────────────────────
 
@@ -532,7 +532,7 @@ export type AuditorRoleOptions = {
  */
 export async function executeAuditorChild(
   options: AuditorRoleOptions,
-): Promise<{ decision: unknown; response: AssistantMessage }> {
+): Promise<{ decision: unknown; response: AssistantMessage; noReceiptLifecycle?: NoReceiptLifecycleFacts }> {
   const { createRecordSession } = await import("./sitian-record-entry.ts");
 
   return withInProcessScratch({ prefix: "ak-auditor-role-" }, async (scratch) => {
@@ -549,10 +549,12 @@ export async function executeAuditorChild(
     const cwd = options.context.cwd ?? process.cwd();
 
     let decision: unknown;
+    let noReceiptLifecycle: NoReceiptLifecycleFacts | undefined;
     let decisionSubmitted = false;
     let decisionCallId: string | undefined;
     let decisionToolFailure: unknown;
     const decisionToolFailures = new Map<string, unknown>();
+    const delivery = createReceiptDeliveryPolicy();
     const tool = wrapPackageOwnedToolDefinition({
       ...options.tool,
       label: options.roleLabel,
@@ -560,8 +562,12 @@ export async function executeAuditorChild(
         if (decisionSubmitted && decisionCallId !== args[0]) {
           throw new Error("Auditor decision was submitted more than once");
         }
+        // Pi may already have issued several decision calls in one assistant
+        // response. Execute every issued call: the budget limits future
+        // solicitations, not terminal calls already in flight.
         try {
           const result = await options.tool.execute(...args);
+          delivery.recordAccepted();
           decision = args[1];
           decisionCallId = args[0];
           decisionToolFailure = undefined;
@@ -614,11 +620,13 @@ export async function executeAuditorChild(
     auditorSessionManager.appendCustomEntry(AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, binding);
 
     let turns = 0;
+    const sessionUsage = emptyUsage();
     let boundaryResponse: AssistantMessage | undefined;
     let retentionFailure: unknown;
     let retainedResponse: AssistantMessage | undefined;
     let rejectedDecisionResponse: AssistantMessage | undefined;
     let promptNeighboringFailure: unknown;
+    let promptDecisionFailures: unknown[] = [];
     const registeredToolNames = new Set(session.getAllTools().map((entry) => entry.name));
     const evidenceToolFailures = new Map<string, unknown>();
     for (const name of registeredToolNames) {
@@ -645,9 +653,18 @@ export async function executeAuditorChild(
       return [...session.messages].reverse().find((message) =>
         message.role === "toolResult" && callIdSet.has(message.toolCallId) && message.isError);
     };
+    const drainRejectedDecisionFailures = (response: AssistantMessage) => {
+      for (const part of response.content) {
+        if (part.type !== "toolCall" || part.name !== tool.name || !decisionToolFailures.has(part.id)) continue;
+        decisionToolFailure = decisionToolFailures.get(part.id);
+        promptDecisionFailures.push(decisionToolFailure);
+        decisionToolFailures.delete(part.id);
+      }
+    };
     const unsubscribe = session.subscribe((event) => {
       if (event.type === "message_end" && event.message.role === "assistant" && boundaryResponse === undefined) {
         turns += 1;
+        addUsage(sessionUsage, event.message.usage);
         retainedResponse = event.message;
         try { options.retainResponse?.(event.message); } catch (error) { retentionFailure = error; }
         // A tool call in assistant output is only an observation. Preserve its
@@ -671,15 +688,11 @@ export async function executeAuditorChild(
       if (event.type === "turn_end") {
         if (rejectedDecisionResponse !== undefined) {
           promptNeighboringFailure = findToolFailure(rejectedDecisionResponse);
-          const rejectedCall = rejectedDecisionResponse.content.find((part) =>
-            part.type === "toolCall" && part.name === tool.name && decisionToolFailures.has(part.id));
-          if (rejectedCall?.type === "toolCall") {
-            decisionToolFailure = decisionToolFailures.get(rejectedCall.id);
-            decisionToolFailures.delete(rejectedCall.id);
-          }
+          drainRejectedDecisionFailures(rejectedDecisionResponse);
         }
         if (decisionSubmitted || promptNeighboringFailure !== undefined
-          || boundaryResponse !== undefined || retentionFailure !== undefined) {
+          || (boundaryResponse !== undefined && rejectedDecisionResponse === undefined)
+          || retentionFailure !== undefined) {
           void session.abort();
         }
       }
@@ -690,11 +703,11 @@ export async function executeAuditorChild(
 
     try {
       try {
-        const delivery = createReceiptDeliveryPolicy();
         const promptAllowingRejectedDecision = async (prompt: string) => {
           rejectedDecisionResponse = undefined;
           promptNeighboringFailure = undefined;
           decisionToolFailure = undefined;
+          promptDecisionFailures = [];
           let promptFailure: unknown;
           try {
             await session.prompt(prompt);
@@ -707,41 +720,62 @@ export async function executeAuditorChild(
           const correlatedResponse = rejectedDecisionResponse as AssistantMessage | undefined;
           if (correlatedResponse !== undefined) {
             promptNeighboringFailure ??= findToolFailure(correlatedResponse);
-            const rejectedCall = correlatedResponse.content.find((part) =>
-              part.type === "toolCall" && part.name === tool.name && decisionToolFailures.has(part.id));
-            if (rejectedCall?.type === "toolCall") {
-              decisionToolFailure = decisionToolFailures.get(rejectedCall.id);
-              decisionToolFailures.delete(rejectedCall.id);
-            }
+            drainRejectedDecisionFailures(correlatedResponse);
           }
           // An adjacent failure outranks correctable decision feedback.
           if (promptNeighboringFailure !== undefined) throw promptNeighboringFailure;
+          // An accepted correction in the same response owns the terminal
+          // outcome; correlated rejected siblings remain observations, not a
+          // stale failure capable of replacing that accepted receipt.
+          if (decisionSubmitted) {
+            decisionToolFailure = undefined;
+            return;
+          }
           if (decisionToolFailure !== undefined) return;
           if (promptFailure !== undefined) throw promptFailure;
         };
+        const chargeAndClearRejectedDecisionFailures = (failures: unknown[]) => {
+          for (const failure of failures) {
+            delivery.recordRejected(failure instanceof Error ? failure.message : String(failure));
+          }
+          decisionToolFailure = undefined;
+          promptDecisionFailures = [];
+        };
         await promptAllowingRejectedDecision(options.prompt);
-        while (!decisionSubmitted && boundaryResponse === undefined && inherited.streamFailure === undefined
-          && delivery.nextAction() === "request-delivery") {
+        while (!decisionSubmitted && (boundaryResponse === undefined || decisionToolFailure !== undefined)
+          && inherited.streamFailure === undefined && delivery.nextAction() === "request-delivery") {
           if (decisionToolFailure !== undefined) {
-            delivery.recordRejected(decisionToolFailure instanceof Error ? decisionToolFailure.message : String(decisionToolFailure));
-            decisionToolFailure = undefined;
+            const failures = promptDecisionFailures.length === 0
+              ? [decisionToolFailure]
+              : promptDecisionFailures;
+            chargeAndClearRejectedDecisionFailures(failures);
+            if (delivery.nextAction() === "no-receipt") boundaryResponse = undefined;
             if (delivery.nextAction() === "request-delivery") {
-              await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
+              // A rejection and its correction solicitation are one budget unit;
+              // recordRejected already charged it.
+              if (retainedResponse === rejectedDecisionResponse) {
+                await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
+                chargeAndClearRejectedDecisionFailures(promptDecisionFailures);
+              }
             }
           } else {
             delivery.recordDeliveryRequest();
             await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
           }
         }
-        if (!decisionSubmitted && boundaryResponse === undefined && inherited.streamFailure === undefined
+        if (!decisionSubmitted && inherited.streamFailure === undefined
           && delivery.nextAction() === "no-receipt") {
           const runPointer = options.context.sessionManager.getSessionFile() ?? options.context.cwd ?? process.cwd();
           const attemptPointer = binding.parent.attemptEntryId ?? binding.parent.sessionId ?? `current:${runPointer}`;
-          decision = delivery.facts({ runPointer, attemptPointer });
+          const facts = delivery.facts({ runPointer, attemptPointer });
+          decision = facts;
           // Late turn_end feedback cannot overturn a lifecycle that has already
           // charged this prompt to the exhausted shared budget.
           decisionToolFailure = undefined;
-          auditorSessionManager.appendCustomEntry(NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, decision);
+          auditorSessionManager.appendCustomEntry(NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, facts);
+          // Provenance is granted only after the lifecycle owner persisted the
+          // current child record; accepted model arguments can never set it.
+          noReceiptLifecycle = facts;
         }
       } catch (error) {
         if (options.signal?.aborted) throw options.signal.reason;
@@ -750,7 +784,7 @@ export async function executeAuditorChild(
       }
       if (options.signal?.aborted) throw options.signal.reason;
       if (inherited.streamFailure !== undefined) throw inherited.streamFailure;
-      if (decisionToolFailure !== undefined) throw decisionToolFailure;
+      if (!decisionSubmitted && decisionToolFailure !== undefined) throw decisionToolFailure;
       const relevantResponse = !decisionSubmitted
         ? boundaryResponse
         : [...session.messages].reverse().find((message): message is AssistantMessage =>
@@ -760,7 +794,7 @@ export async function executeAuditorChild(
         if (toolFailure !== undefined) throw toolFailure;
       }
       if (retentionFailure !== undefined && retainedResponse?.stopReason !== "error") throw retentionFailure;
-      if (boundaryResponse !== undefined && !decisionSubmitted) {
+      if (boundaryResponse !== undefined && !decisionSubmitted && noReceiptLifecycle === undefined) {
         const toolNames = boundaryResponse.content.flatMap((part) => part.type === "toolCall" ? [part.name] : []);
         throw new AuditorTurnLimitError(AUDITOR_TURN_LIMIT, turns, {
           stopReason: boundaryResponse.stopReason,
@@ -841,7 +875,11 @@ export async function executeAuditorChild(
       ) {
         throw new Error(`${options.roleLabel} exited without a readable decision receipt`);
       }
-      return { decision, response };
+      return {
+        decision,
+        response: { ...response, usage: sessionUsage },
+        ...(noReceiptLifecycle === undefined ? {} : { noReceiptLifecycle }),
+      };
     } finally {
       options.signal?.removeEventListener("abort", abort);
       unsubscribe();

package/src/judge-role.ts

@@ -135,10 +135,11 @@ export function createJudgeRoleRuntime(
                   terminate: true as const,
                   ...(usage === undefined ? {} : { usage }),
                 }),
-                noReceipt: (auditNoReceipt) => ({
+                noReceipt: (auditNoReceipt, usageProjection) => ({
                   content: [{ type: "text" as const, text: "Judge verdict accepted; compliance audit produced no receipt" }],
                   details: { ...verdict, auditNoReceipt },
                   terminate: true as const,
+                  ...usageProjection,
                 }),
                 revise: (violations) => {
                   throw new Error(

package/src/navigator-attendance.ts

@@ -704,8 +704,16 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
       }
       const helpContext = help.map(({ role, help: text }) => `<role_help role="${role}">\n${text}\n</role_help>`).join("\n");
       let output: PrepareOutput | undefined;
+      let prepareBatchRejected = false;
       outputSink = (value) => {
-        if (output !== undefined) throw new Error("Navigator preparation must submit exactly one typed candidate batch");
+        if (prepareBatchRejected || output !== undefined) {
+          // Tool executions in one assistant response are provisional until the
+          // whole response is known to contain exactly one submission. A
+          // duplicate invalidates the batch, including its first call.
+          output = undefined;
+          prepareBatchRejected = true;
+          throw new Error("Navigator preparation must submit exactly one typed candidate batch");
+        }
         output = value;
       };
       const tool = createNavigatorPrepareTool((value) => { outputSink?.(value); });
@@ -805,6 +813,7 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
           const delivery = createReceiptDeliveryPolicy();
           const promptAllowingRejectedPrepare = async (text: string, deliveryRequest: boolean) => {
             const entryStart = activeSession.entries().length;
+            prepareBatchRejected = false;
             let promptFailure: unknown;
             try {
               await activeSession.prompt(text);
@@ -817,6 +826,10 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
             }
             const rejectedReason = rejectedPrepareReason(activeSession.entries(), entryStart);
             if (rejectedReason !== undefined) {
+              // A rejected call makes every provisional output from this prompt
+              // ineligible for publication before the correction turn starts.
+              output = undefined;
+              prepareBatchRejected = true;
               delivery.recordRejected(rejectedReason);
               return;
             }

package/src/receipt-delivery-policy.ts

@@ -7,7 +7,7 @@ export const NO_RECEIPT_LIFECYCLE_ENTRY_TYPE = "ak-no-receipt-lifecycle" as cons
 /** The sole schema shared by lifecycle owners and Terminal projections. */
 export type NoReceiptLifecycleFacts = {
   terminalToolCalled: boolean;
-  rejectedReceipts: readonly { reason: string }[];
+  rejectedReceipts: readonly { reason: string; diagnosticAvailable: boolean }[];
   deliveryTurns: typeof RECEIPT_DELIVERY_TURN_LIMIT;
   sessionCompletion: "settled-without-accepted-receipt";
   runPointer: string;
@@ -30,12 +30,15 @@ export function parseNoReceiptLifecycleFacts(input: unknown): NoReceiptLifecycle
     || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === ""
     || !Array.isArray(input.rejectedReceipts)
     || !input.rejectedReceipts.every((item) => isRecord(item)
-      && typeof item.reason === "string" && item.reason.trim() !== "")) {
+      && typeof item.reason === "string")) {
     throw new TypeError("malformed no-receipt lifecycle facts");
   }
   return {
     terminalToolCalled: input.terminalToolCalled,
-    rejectedReceipts: input.rejectedReceipts.map((item) => ({ reason: item.reason as string })),
+    rejectedReceipts: input.rejectedReceipts.map((item) => ({
+      reason: item.reason as string,
+      diagnosticAvailable: (item.reason as string).trim() !== "",
+    })),
     deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
     sessionCompletion: "settled-without-accepted-receipt",
     runPointer: input.runPointer,
@@ -45,14 +48,20 @@ export function parseNoReceiptLifecycleFacts(input: unknown): NoReceiptLifecycle
 }
 
 export function noReceiptLifecycleFacts(
-  input: Omit<NoReceiptLifecycleFacts, "deliveryTurns" | "sessionCompletion" | "acceptedReceipt"> & { deliveryTurns: number },
+  input: Omit<NoReceiptLifecycleFacts, "rejectedReceipts" | "deliveryTurns" | "sessionCompletion" | "acceptedReceipt"> & {
+    rejectedReceipts: readonly { reason: string }[];
+    deliveryTurns: number;
+  },
 ): NoReceiptLifecycleFacts {
   if (input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT) {
     throw new TypeError("no-receipt lifecycle requires an exhausted delivery budget");
   }
   return {
     terminalToolCalled: input.terminalToolCalled,
-    rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({ reason })),
+    rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({
+      reason,
+      diagnosticAvailable: reason.trim() !== "",
+    })),
     deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
     sessionCompletion: "settled-without-accepted-receipt",
     runPointer: input.runPointer,
@@ -65,14 +74,17 @@ export function createReceiptDeliveryPolicy() {
   let accepted = false;
   let terminalToolCalled = false;
   let deliveryTurns = 0;
-  const rejectedReceipts: { reason: string }[] = [];
+  const rejectedReceipts: { reason: string; diagnosticAvailable: boolean }[] = [];
   return {
-    recordAccepted() { accepted = true; terminalToolCalled = true; },
+    recordAccepted() {
+      accepted = true;
+      terminalToolCalled = true;
+    },
     /** Infrastructure owns terminality and must never trigger receipt催交. */
     stopForInfrastructure() { accepted = true; },
     recordRejected(reason: string) {
       terminalToolCalled = true;
-      rejectedReceipts.push({ reason });
+      rejectedReceipts.push({ reason, diagnosticAvailable: reason.trim() !== "" });
       deliveryTurns = Math.min(RECEIPT_DELIVERY_TURN_LIMIT, deliveryTurns + 1);
     },
     recordDeliveryRequest() {

package/src/reviewer-role.ts

@@ -163,9 +163,9 @@ export function createReviewerRoleRuntime(pi: ExtensionAPI, dependencies: Review
                 try { await dependencies.shutdownAgent?.(); } catch (error) { hostActions.failInfrastructure(ledger.recordInfrastructureFailure(error), toolCtx, id); }
                 return { content: [{ type: "text" as const, text: "Reviewer report accepted" }], details: candidate, terminate: true as const, ...(usage === undefined ? {} : { usage }) };
               },
-              noReceipt: async (auditNoReceipt) => {
+              noReceipt: async (auditNoReceipt, usageProjection) => {
                 try { await dependencies.shutdownAgent?.(); } catch (error) { hostActions.failInfrastructure(ledger.recordInfrastructureFailure(error), toolCtx, id); }
-                return { content: [{ type: "text" as const, text: "Reviewer report accepted; compliance audit produced no receipt" }], details: { ...candidate, auditNoReceipt }, terminate: true as const };
+                return { content: [{ type: "text" as const, text: "Reviewer report accepted; compliance audit produced no receipt" }], details: { ...candidate, auditNoReceipt }, terminate: true as const, ...usageProjection };
               },
               revise: (violations) => {
                 throw new AggregateError([], `Reviewer receipt rejected:\n${violations.join("\n")}`, { cause: Object.freeze([...violations]) });

package/src/role-runtime.ts

@@ -567,8 +567,9 @@ export function createRoleRuntimeExtension(
     // whose queued next turn is consumed before settlement.
     pi.on("agent_end", (event) => {
       const lastMessage = event.messages.at(-1);
-      if (lastMessage?.role === "assistant" && lastMessage.stopReason === "error") {
-        // Provider failure has no tool_result event; classify it here so the
+      if (lastMessage?.role === "assistant"
+        && (lastMessage.stopReason === "error" || lastMessage.stopReason === "aborted")) {
+        // Provider failure/abort has no tool_result event; classify it here so the
         // receipt policy cannot turn infrastructure death into an exit-0 lifecycle.
         receiptDelivery.stopForInfrastructure();
         return;