@akagilnc/pi-workflow-roles 0.1.1817 → 0.1.1837

package/dist/receipt-delivery-policy.js

@@ -16,12 +16,15 @@ export function parseNoReceiptLifecycleFacts(input) {
         || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === ""
         || !Array.isArray(input.rejectedReceipts)
         || !input.rejectedReceipts.every((item) => isRecord(item)
-            && typeof item.reason === "string" && item.reason.trim() !== "")) {
+            && typeof item.reason === "string")) {
         throw new TypeError("malformed no-receipt lifecycle facts");
     }
     return {
         terminalToolCalled: input.terminalToolCalled,
-        rejectedReceipts: input.rejectedReceipts.map((item) => ({ reason: item.reason })),
+        rejectedReceipts: input.rejectedReceipts.map((item) => ({
+            reason: item.reason,
+            diagnosticAvailable: item.reason.trim() !== "",
+        })),
         deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
         sessionCompletion: "settled-without-accepted-receipt",
         runPointer: input.runPointer,
@@ -35,7 +38,10 @@ export function noReceiptLifecycleFacts(input) {
     }
     return {
         terminalToolCalled: input.terminalToolCalled,
-        rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({ reason })),
+        rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({
+            reason,
+            diagnosticAvailable: reason.trim() !== "",
+        })),
         deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
         sessionCompletion: "settled-without-accepted-receipt",
         runPointer: input.runPointer,
@@ -49,12 +55,15 @@ export function createReceiptDeliveryPolicy() {
     let deliveryTurns = 0;
     const rejectedReceipts = [];
     return {
-        recordAccepted() { accepted = true; terminalToolCalled = true; },
+        recordAccepted() {
+            accepted = true;
+            terminalToolCalled = true;
+        },
         /** Infrastructure owns terminality and must never trigger receipt催交. */
         stopForInfrastructure() { accepted = true; },
         recordRejected(reason) {
             terminalToolCalled = true;
-            rejectedReceipts.push({ reason });
+            rejectedReceipts.push({ reason, diagnosticAvailable: reason.trim() !== "" });
             deliveryTurns = Math.min(RECEIPT_DELIVERY_TURN_LIMIT, deliveryTurns + 1);
         },
         recordDeliveryRequest() {

package/dist/sitian-record-entry.js

@@ -1,33 +1,28 @@
-/**
- * 司天台唯一 Pi session 记录落盘入口（ADR 0065）。
- * 调用方只声明自己是谁的什么；落点由候簿拓扑算出，签名不含任何落点/路径参数。
- * 「谁调了谁」复用 Pi parentSession + ADR 0047 correlation，不新增 caller 字段。
- */
 import { dirname, resolve, join } from "node:path";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
-import { activationBookDirectory, ensureRealDirectoryTree, physicallyContainedIn, resolveActivationLedgerHome, } from "./activation-ledger-topology.js";
-/**
- * Sole package entry that constructs a durable Pi session record (ADR 0065).
- * No destination/path parameters — location is computed from ledger topology only.
- */
-export function createRecordSession(options) {
-    const cwd = options.cwd;
-    const parentFile = options.parent?.getSessionFile();
-    if (parentFile === undefined || parentFile.length === 0) {
-        // No durable parent principal — preserve prior in-memory child behavior.
-        return SessionManager.inMemory(cwd);
-    }
-    const ledgerHome = resolveActivationLedgerHome();
-    const parentResolved = resolve(parentFile);
-    // Nest under parent only when the parent record already lives under the package home.
-    // Nest base is dirname(parent file) — the durable principal's directory — never a
-    // separate getSessionDir() that can diverge (empty in-memory dir + durable file).
-    // Otherwise the book is resolved from cwd (ADR 0048) and the kind sits under that book —
-    // workspace / foreign parents cannot drag records out of home.
-    const sessionDir = physicallyContainedIn(ledgerHome, parentResolved)
-        ? join(dirname(parentResolved), options.kind)
-        : join(activationBookDirectory(ledgerHome, resolveBookKeyFromGit(cwd)), options.kind);
-    ensureRealDirectoryTree(ledgerHome, sessionDir);
-    return SessionManager.create(cwd, sessionDir, { parentSession: parentFile });
+import {
+  roleRunSessionCoordinates
+} from "./sitian-role-run-coordinates.js";
+import {
+  activationBookDirectory,
+  ensureRealDirectoryTree,
+  physicallyContainedIn,
+  resolveActivationLedgerHome
+} from "./activation-ledger-topology.js";
+function createRecordSession(options) {
+  const cwd = options.cwd;
+  const parentFile = options.parent?.getSessionFile();
+  if (parentFile === void 0 || parentFile.length === 0) {
+    return SessionManager.inMemory(cwd);
+  }
+  const ledgerHome = resolveActivationLedgerHome();
+  const parentResolved = resolve(parentFile);
+  const sessionDir = physicallyContainedIn(ledgerHome, parentResolved) ? join(dirname(parentResolved), options.kind) : join(activationBookDirectory(ledgerHome, resolveBookKeyFromGit(cwd)), options.kind);
+  ensureRealDirectoryTree(ledgerHome, sessionDir);
+  return SessionManager.create(cwd, sessionDir, { parentSession: parentFile });
 }
+export {
+  createRecordSession,
+  roleRunSessionCoordinates
+};

package/dist/sitian-role-run-coordinates.js

@@ -0,0 +1,28 @@
+import { join } from "node:path";
+import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
+import {
+  activationBookDirectory,
+  resolveActivationLedgerHome
+} from "./activation-ledger-topology.js";
+function roleRunSessionCoordinates(options) {
+  const ledgerHome = resolveActivationLedgerHome(
+    options.home === void 0 ? void 0 : () => options.home
+  );
+  const bookKey = resolveBookKeyFromGit(options.cwd);
+  const runDirectory = join(
+    activationBookDirectory(ledgerHome, bookKey),
+    "runs",
+    `${options.runId}@${options.role}`
+  );
+  const sessionDirectory = join(runDirectory, "session");
+  return {
+    ledgerHome,
+    bookKey,
+    runDirectory,
+    sessionDirectory,
+    sessionFile: join(sessionDirectory, "session.jsonl")
+  };
+}
+export {
+  roleRunSessionCoordinates
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.1817",
+  "version": "0.1.1837",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/scripts/build-package.mjs

@@ -12,6 +12,8 @@ const entries = [
   "activation-ledger-git",
   "activation-ledger-topology",
   "activation-reconciliation",
+  "sitian-role-run-coordinates",
+  "sitian-record-entry",
 ];
 
 /**

package/src/audit-escalation.ts

@@ -148,6 +148,7 @@ export type ComplianceDecisionHandlers<T> = {
   /** Project the accepted parent candidate beside the typed audit-leg facts. */
   noReceipt?: (
     facts: Extract<ComplianceDecision, { status: "no-receipt" }>,
+    usageProjection: { usage?: Usage },
   ) => T | PromiseLike<T>;
   revise: (violations: readonly unknown[]) => T | PromiseLike<T>;
   escalate: (result: AuditEscalationToolResult) => T | PromiseLike<T>;
@@ -172,7 +173,10 @@ export async function disposeComplianceDecision<T>(
       if (handlers.noReceipt === undefined) {
         throw new Error("Compliance no-receipt projection handler is unavailable");
       }
-      return await handlers.noReceipt(decision);
+      return await handlers.noReceipt(
+        decision,
+        decision.usage === undefined ? {} : { usage: decision.usage },
+      );
     case "revise":
       return await handlers.revise(decision.violations);
     case "escalate":

package/src/compliance-transport.ts

@@ -7,7 +7,7 @@ import {
 } from "./evidence-child-executor.ts";
 import { createAuditorDossierTool } from "./auditor-dossier-tool.ts";
 import type { DossierObservation } from "./dossier-resolution.ts";
-import { parseNoReceiptLifecycleFacts, type NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
+import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 
 export type ComplianceCompletion = AuditorCompletion;
 export type ComplianceArgumentRootType = "null" | "array" | "undefined" | "string" | "number" | "boolean" | "bigint" | "symbol" | "function";
@@ -16,7 +16,7 @@ export type ComplianceAuditObservation =
   | { kind: "object-status-unreadable"; status: "missing" | "unknown" }
   | DossierObservation;
 export type ComplianceAuditIncomplete = { status: "audit-incomplete"; observation: ComplianceAuditObservation; candidate: unknown; usage?: Usage };
-export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt" };
+export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt"; usage?: Usage };
 export type ComplianceDecision = { status: "pass"; usage?: Usage } | { status: "revise"; violations: readonly unknown[]; usage?: Usage } | { status: "escalate"; conflicts?: unknown; decisionGate?: unknown; usage?: Usage } | ComplianceNoReceipt | ComplianceAuditIncomplete;
 export type ComplianceDispatch = { model: Model<Api>; auth: { apiKey?: string; headers?: Record<string, string | null>; env?: Record<string, string> } };
 
@@ -128,9 +128,12 @@ export async function runComplianceAudit(options: RunComplianceAuditOptions): Pr
     ...(options.runCompletion === undefined ? {} : { runCompletion: options.runCompletion }),
     ...(options.signal === undefined ? {} : { signal: options.signal }),
   });
-  try {
-    return { status: "no-receipt", ...parseNoReceiptLifecycleFacts(receipt.decision) };
-  } catch {
-    return readComplianceCandidate(receipt.decision, receipt.response.usage);
+  if (receipt.noReceiptLifecycle !== undefined) {
+    return {
+      status: "no-receipt",
+      ...receipt.noReceiptLifecycle,
+      ...(receipt.response.usage === undefined ? {} : { usage: receipt.response.usage }),
+    };
   }
+  return readComplianceCandidate(receipt.decision, receipt.response.usage);
 }

package/src/doctor-role.ts

@@ -12,7 +12,7 @@ export function createDoctorRoleRuntime(pi: ExtensionAPI, dependencies: DoctorRo
   let activation: { soul: string; patient: DoctorCase; store: DoctorEvidenceStore } | undefined; let registered = false; pi.registerFlag(DOCTOR_CASE_FLAG.name, DOCTOR_CASE_FLAG.definition);
   return { async activate() { const path = pi.getFlag(DOCTOR_CASE_FLAG.name); if (typeof path !== "string" || !path.trim()) throw new Error("Doctor requires --ak-doctor-case"); const soul = (await dependencies.loadSoul()).trim(); if (!soul) throw new Error("Doctor soul is empty"); const patient = await dependencies.loadCase(path); activation = { soul, patient, store: new DoctorEvidenceStore(patient) };
     if (!registered) { registered = true; pi.registerTool({ name: DOCTOR_EVIDENCE_TOOL_NAME, label: "Doctor Evidence", description: "Read retained Pi session bytes with bounded pagination.", parameters: doctorEvidenceReadSchema, async execute(_id, params: { evidenceId: string; offset?: number; limit?: number }) { if (!activation) throw new Error("Doctor is not activated"); const details = activation.store.read(params.evidenceId, params.offset, params.limit); return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details }; } });
-      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "Doctor Output", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id, params, signal, _update, ctx): Promise<AgentToolResult<unknown>> { if (!activation) throw new Error("Doctor is not activated"); singleton(id, ctx); const testimony = validateDoctorOutput(params, activation.patient, activation.store); try { appendActiveSessionCustomEntry(ctx, DOCTOR_CANDIDATE_ENTRY_TYPE, { version: 1, testimony, readRecord: activation.store.readRecord(), patientIdentity: activation.patient.identity }, { unavailable: "doctor candidate retention is unavailable", failed: "doctor candidate retention failed" }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx } : { context: ctx, signal }); } catch (error) { host.failInfrastructure(error, ctx, id); } const details = testimony.status === "completed" ? { ...testimony, cost: activation.patient.cost } : testimony; return disposeComplianceDecision<AgentToolResult<unknown>>(audit, { pass: (usage) => ({ content: [{ type: "text" as const, text: "Doctor output accepted" }], details, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt) => ({ content: [{ type: "text" as const, text: "Doctor output accepted; compliance audit produced no receipt" }], details: { ...details, auditNoReceipt }, terminate: true as const }), revise: (violations) => { throw new Error(`Doctor output violates its soul: ${violations.join("; ")}`); }, escalate: (result) => result, auditIncomplete: (result) => result }, details); } });
+      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "Doctor Output", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id, params, signal, _update, ctx): Promise<AgentToolResult<unknown>> { if (!activation) throw new Error("Doctor is not activated"); singleton(id, ctx); const testimony = validateDoctorOutput(params, activation.patient, activation.store); try { appendActiveSessionCustomEntry(ctx, DOCTOR_CANDIDATE_ENTRY_TYPE, { version: 1, testimony, readRecord: activation.store.readRecord(), patientIdentity: activation.patient.identity }, { unavailable: "doctor candidate retention is unavailable", failed: "doctor candidate retention failed" }); } catch (error) { host.failInfrastructure(error, ctx, id); } let audit: ComplianceDecision; try { audit = await dependencies.auditCompliance(signal === undefined ? { context: ctx } : { context: ctx, signal }); } catch (error) { host.failInfrastructure(error, ctx, id); } const details = testimony.status === "completed" ? { ...testimony, cost: activation.patient.cost } : testimony; return disposeComplianceDecision<AgentToolResult<unknown>>(audit, { pass: (usage) => ({ content: [{ type: "text" as const, text: "Doctor output accepted" }], details, terminate: true as const, ...(usage === undefined ? {} : { usage }) }), noReceipt: (auditNoReceipt, usageProjection) => ({ content: [{ type: "text" as const, text: "Doctor output accepted; compliance audit produced no receipt" }], details: { ...details, auditNoReceipt }, terminate: true as const, ...usageProjection }), revise: (violations) => { throw new Error(`Doctor output violates its soul: ${violations.join("; ")}`); }, escalate: (result) => result, auditIncomplete: (result) => result }, details); } });
       pi.on("before_agent_start", (event) => { if (!activation) throw new Error("Doctor is not activated"); const catalog = { version: activation.patient.version, identity: activation.patient.identity, admittedMetrics: { provenance: "runtime-derived from retained session bytes and sealed into the accepted receipt", cost: activation.patient.cost }, lawfulTargetKeys: ["case", ...activation.patient.cost.invocations.sources], evidence: activation.patient.evidence.map(({ id, kind, sha256, byteLength, contentLength }) => ({ id, kind, sha256, byteLength, contentLength })) }; return { systemPrompt: `${event.systemPrompt}\n\n<doctor_soul>\n${activation.soul}\n</doctor_soul>\n\n<doctor_case>\n${JSON.stringify(catalog)}\n</doctor_case>` }; }); }
     const required = [DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME]; const names = pi.getAllTools().map((tool) => tool.name); for (const name of required) if (names.filter((item) => item === name).length !== 1) throw new Error(`Doctor required tool collision or missing: ${name}`); pi.setActiveTools(required); const active = pi.getActiveTools?.() ?? required; if (active.length !== 2 || !required.every((name) => active.includes(name))) throw new Error("Doctor active tool narrowing failed"); } };
 }

package/src/evidence-child-executor.ts

@@ -32,7 +32,7 @@ import {
 import { wrapPackageOwnedToolDefinition } from "./package-owned-tool-idle.ts";
 import type { ReviewerPromptText } from "./reviewer-prompt-identity.ts";
 import { createStreamIdleGuard, isStreamIdleTimeoutError } from "./stream-idle-guard.ts";
-import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.ts";
+import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT, type NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 
 // ── shared constants / types ──────────────────────────────────────────────
 
@@ -532,7 +532,7 @@ export type AuditorRoleOptions = {
  */
 export async function executeAuditorChild(
   options: AuditorRoleOptions,
-): Promise<{ decision: unknown; response: AssistantMessage }> {
+): Promise<{ decision: unknown; response: AssistantMessage; noReceiptLifecycle?: NoReceiptLifecycleFacts }> {
   const { createRecordSession } = await import("./sitian-record-entry.ts");
 
   return withInProcessScratch({ prefix: "ak-auditor-role-" }, async (scratch) => {
@@ -549,10 +549,12 @@ export async function executeAuditorChild(
     const cwd = options.context.cwd ?? process.cwd();
 
     let decision: unknown;
+    let noReceiptLifecycle: NoReceiptLifecycleFacts | undefined;
     let decisionSubmitted = false;
     let decisionCallId: string | undefined;
     let decisionToolFailure: unknown;
     const decisionToolFailures = new Map<string, unknown>();
+    const delivery = createReceiptDeliveryPolicy();
     const tool = wrapPackageOwnedToolDefinition({
       ...options.tool,
       label: options.roleLabel,
@@ -560,8 +562,12 @@ export async function executeAuditorChild(
         if (decisionSubmitted && decisionCallId !== args[0]) {
           throw new Error("Auditor decision was submitted more than once");
         }
+        // Pi may already have issued several decision calls in one assistant
+        // response. Execute every issued call: the budget limits future
+        // solicitations, not terminal calls already in flight.
         try {
           const result = await options.tool.execute(...args);
+          delivery.recordAccepted();
           decision = args[1];
           decisionCallId = args[0];
           decisionToolFailure = undefined;
@@ -614,11 +620,13 @@ export async function executeAuditorChild(
     auditorSessionManager.appendCustomEntry(AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, binding);
 
     let turns = 0;
+    const sessionUsage = emptyUsage();
     let boundaryResponse: AssistantMessage | undefined;
     let retentionFailure: unknown;
     let retainedResponse: AssistantMessage | undefined;
     let rejectedDecisionResponse: AssistantMessage | undefined;
     let promptNeighboringFailure: unknown;
+    let promptDecisionFailures: unknown[] = [];
     const registeredToolNames = new Set(session.getAllTools().map((entry) => entry.name));
     const evidenceToolFailures = new Map<string, unknown>();
     for (const name of registeredToolNames) {
@@ -645,9 +653,18 @@ export async function executeAuditorChild(
       return [...session.messages].reverse().find((message) =>
         message.role === "toolResult" && callIdSet.has(message.toolCallId) && message.isError);
     };
+    const drainRejectedDecisionFailures = (response: AssistantMessage) => {
+      for (const part of response.content) {
+        if (part.type !== "toolCall" || part.name !== tool.name || !decisionToolFailures.has(part.id)) continue;
+        decisionToolFailure = decisionToolFailures.get(part.id);
+        promptDecisionFailures.push(decisionToolFailure);
+        decisionToolFailures.delete(part.id);
+      }
+    };
     const unsubscribe = session.subscribe((event) => {
       if (event.type === "message_end" && event.message.role === "assistant" && boundaryResponse === undefined) {
         turns += 1;
+        addUsage(sessionUsage, event.message.usage);
         retainedResponse = event.message;
         try { options.retainResponse?.(event.message); } catch (error) { retentionFailure = error; }
         // A tool call in assistant output is only an observation. Preserve its
@@ -671,15 +688,11 @@ export async function executeAuditorChild(
       if (event.type === "turn_end") {
         if (rejectedDecisionResponse !== undefined) {
           promptNeighboringFailure = findToolFailure(rejectedDecisionResponse);
-          const rejectedCall = rejectedDecisionResponse.content.find((part) =>
-            part.type === "toolCall" && part.name === tool.name && decisionToolFailures.has(part.id));
-          if (rejectedCall?.type === "toolCall") {
-            decisionToolFailure = decisionToolFailures.get(rejectedCall.id);
-            decisionToolFailures.delete(rejectedCall.id);
-          }
+          drainRejectedDecisionFailures(rejectedDecisionResponse);
         }
         if (decisionSubmitted || promptNeighboringFailure !== undefined
-          || boundaryResponse !== undefined || retentionFailure !== undefined) {
+          || (boundaryResponse !== undefined && rejectedDecisionResponse === undefined)
+          || retentionFailure !== undefined) {
           void session.abort();
         }
       }
@@ -690,11 +703,11 @@ export async function executeAuditorChild(
 
     try {
       try {
-        const delivery = createReceiptDeliveryPolicy();
         const promptAllowingRejectedDecision = async (prompt: string) => {
           rejectedDecisionResponse = undefined;
           promptNeighboringFailure = undefined;
           decisionToolFailure = undefined;
+          promptDecisionFailures = [];
           let promptFailure: unknown;
           try {
             await session.prompt(prompt);
@@ -707,41 +720,62 @@ export async function executeAuditorChild(
           const correlatedResponse = rejectedDecisionResponse as AssistantMessage | undefined;
           if (correlatedResponse !== undefined) {
             promptNeighboringFailure ??= findToolFailure(correlatedResponse);
-            const rejectedCall = correlatedResponse.content.find((part) =>
-              part.type === "toolCall" && part.name === tool.name && decisionToolFailures.has(part.id));
-            if (rejectedCall?.type === "toolCall") {
-              decisionToolFailure = decisionToolFailures.get(rejectedCall.id);
-              decisionToolFailures.delete(rejectedCall.id);
-            }
+            drainRejectedDecisionFailures(correlatedResponse);
           }
           // An adjacent failure outranks correctable decision feedback.
           if (promptNeighboringFailure !== undefined) throw promptNeighboringFailure;
+          // An accepted correction in the same response owns the terminal
+          // outcome; correlated rejected siblings remain observations, not a
+          // stale failure capable of replacing that accepted receipt.
+          if (decisionSubmitted) {
+            decisionToolFailure = undefined;
+            return;
+          }
           if (decisionToolFailure !== undefined) return;
           if (promptFailure !== undefined) throw promptFailure;
         };
+        const chargeAndClearRejectedDecisionFailures = (failures: unknown[]) => {
+          for (const failure of failures) {
+            delivery.recordRejected(failure instanceof Error ? failure.message : String(failure));
+          }
+          decisionToolFailure = undefined;
+          promptDecisionFailures = [];
+        };
         await promptAllowingRejectedDecision(options.prompt);
-        while (!decisionSubmitted && boundaryResponse === undefined && inherited.streamFailure === undefined
-          && delivery.nextAction() === "request-delivery") {
+        while (!decisionSubmitted && (boundaryResponse === undefined || decisionToolFailure !== undefined)
+          && inherited.streamFailure === undefined && delivery.nextAction() === "request-delivery") {
           if (decisionToolFailure !== undefined) {
-            delivery.recordRejected(decisionToolFailure instanceof Error ? decisionToolFailure.message : String(decisionToolFailure));
-            decisionToolFailure = undefined;
+            const failures = promptDecisionFailures.length === 0
+              ? [decisionToolFailure]
+              : promptDecisionFailures;
+            chargeAndClearRejectedDecisionFailures(failures);
+            if (delivery.nextAction() === "no-receipt") boundaryResponse = undefined;
             if (delivery.nextAction() === "request-delivery") {
-              await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
+              // A rejection and its correction solicitation are one budget unit;
+              // recordRejected already charged it.
+              if (retainedResponse === rejectedDecisionResponse) {
+                await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
+                chargeAndClearRejectedDecisionFailures(promptDecisionFailures);
+              }
             }
           } else {
             delivery.recordDeliveryRequest();
             await promptAllowingRejectedDecision(RECEIPT_DELIVERY_PROMPT);
           }
         }
-        if (!decisionSubmitted && boundaryResponse === undefined && inherited.streamFailure === undefined
+        if (!decisionSubmitted && inherited.streamFailure === undefined
           && delivery.nextAction() === "no-receipt") {
           const runPointer = options.context.sessionManager.getSessionFile() ?? options.context.cwd ?? process.cwd();
           const attemptPointer = binding.parent.attemptEntryId ?? binding.parent.sessionId ?? `current:${runPointer}`;
-          decision = delivery.facts({ runPointer, attemptPointer });
+          const facts = delivery.facts({ runPointer, attemptPointer });
+          decision = facts;
           // Late turn_end feedback cannot overturn a lifecycle that has already
           // charged this prompt to the exhausted shared budget.
           decisionToolFailure = undefined;
-          auditorSessionManager.appendCustomEntry(NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, decision);
+          auditorSessionManager.appendCustomEntry(NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, facts);
+          // Provenance is granted only after the lifecycle owner persisted the
+          // current child record; accepted model arguments can never set it.
+          noReceiptLifecycle = facts;
         }
       } catch (error) {
         if (options.signal?.aborted) throw options.signal.reason;
@@ -750,7 +784,7 @@ export async function executeAuditorChild(
       }
       if (options.signal?.aborted) throw options.signal.reason;
       if (inherited.streamFailure !== undefined) throw inherited.streamFailure;
-      if (decisionToolFailure !== undefined) throw decisionToolFailure;
+      if (!decisionSubmitted && decisionToolFailure !== undefined) throw decisionToolFailure;
       const relevantResponse = !decisionSubmitted
         ? boundaryResponse
         : [...session.messages].reverse().find((message): message is AssistantMessage =>
@@ -760,7 +794,7 @@ export async function executeAuditorChild(
         if (toolFailure !== undefined) throw toolFailure;
       }
       if (retentionFailure !== undefined && retainedResponse?.stopReason !== "error") throw retentionFailure;
-      if (boundaryResponse !== undefined && !decisionSubmitted) {
+      if (boundaryResponse !== undefined && !decisionSubmitted && noReceiptLifecycle === undefined) {
         const toolNames = boundaryResponse.content.flatMap((part) => part.type === "toolCall" ? [part.name] : []);
         throw new AuditorTurnLimitError(AUDITOR_TURN_LIMIT, turns, {
           stopReason: boundaryResponse.stopReason,
@@ -841,7 +875,11 @@ export async function executeAuditorChild(
       ) {
         throw new Error(`${options.roleLabel} exited without a readable decision receipt`);
       }
-      return { decision, response };
+      return {
+        decision,
+        response: { ...response, usage: sessionUsage },
+        ...(noReceiptLifecycle === undefined ? {} : { noReceiptLifecycle }),
+      };
     } finally {
       options.signal?.removeEventListener("abort", abort);
       unsubscribe();

package/src/judge-role.ts

@@ -135,10 +135,11 @@ export function createJudgeRoleRuntime(
                   terminate: true as const,
                   ...(usage === undefined ? {} : { usage }),
                 }),
-                noReceipt: (auditNoReceipt) => ({
+                noReceipt: (auditNoReceipt, usageProjection) => ({
                   content: [{ type: "text" as const, text: "Judge verdict accepted; compliance audit produced no receipt" }],
                   details: { ...verdict, auditNoReceipt },
                   terminate: true as const,
+                  ...usageProjection,
                 }),
                 revise: (violations) => {
                   throw new Error(

package/src/navigator-attendance.ts

@@ -704,8 +704,16 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
       }
       const helpContext = help.map(({ role, help: text }) => `<role_help role="${role}">\n${text}\n</role_help>`).join("\n");
       let output: PrepareOutput | undefined;
+      let prepareBatchRejected = false;
       outputSink = (value) => {
-        if (output !== undefined) throw new Error("Navigator preparation must submit exactly one typed candidate batch");
+        if (prepareBatchRejected || output !== undefined) {
+          // Tool executions in one assistant response are provisional until the
+          // whole response is known to contain exactly one submission. A
+          // duplicate invalidates the batch, including its first call.
+          output = undefined;
+          prepareBatchRejected = true;
+          throw new Error("Navigator preparation must submit exactly one typed candidate batch");
+        }
         output = value;
       };
       const tool = createNavigatorPrepareTool((value) => { outputSink?.(value); });
@@ -805,6 +813,7 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
           const delivery = createReceiptDeliveryPolicy();
           const promptAllowingRejectedPrepare = async (text: string, deliveryRequest: boolean) => {
             const entryStart = activeSession.entries().length;
+            prepareBatchRejected = false;
             let promptFailure: unknown;
             try {
               await activeSession.prompt(text);
@@ -817,6 +826,10 @@ export function createNavigatorAttendance(options: NavigatorAttendanceOptions) {
             }
             const rejectedReason = rejectedPrepareReason(activeSession.entries(), entryStart);
             if (rejectedReason !== undefined) {
+              // A rejected call makes every provisional output from this prompt
+              // ineligible for publication before the correction turn starts.
+              output = undefined;
+              prepareBatchRejected = true;
               delivery.recordRejected(rejectedReason);
               return;
             }