@akagilnc/pi-workflow-roles 0.1.2157 → 0.1.2169

package/dist/public-cli/main.js

@@ -18866,7 +18866,22 @@ async function isSessionPrincipalAvailable(sessionFile) {
     return false;
   }
 }
-async function acquireRunWriterLease(runDirectory) {
+function describeErrorIdentity(error) {
+  const candidate = error;
+  const name = typeof candidate?.name === "string" && candidate.name !== "" ? candidate.name : typeof error;
+  const code = typeof candidate?.code === "string" || typeof candidate?.code === "number" ? ` code=${String(candidate.code)}` : "";
+  const message = typeof candidate?.message === "string" && candidate.message !== "" ? `: ${candidate.message}` : "";
+  return `${name}${code}${message}`;
+}
+async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
+  const reportCleanupFailure = (error) => {
+    try {
+      onCleanupFailure?.(
+        `writer lease lock cleanup failed (best-effort continue; stale lock resurfaces as lease-held on next acquire) at ${join10(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
+      );
+    } catch {
+    }
+  };
   const lockPath = join10(runDirectory, WRITER_LOCK_FILE);
   try {
     const handle = await open(lockPath, "wx");
@@ -18892,8 +18907,11 @@ async function acquireRunWriterLease(runDirectory) {
             try {
               await chmod(runDirectory, 493);
               await unlink3(lockPath);
-            } catch {
+            } catch (retryError) {
+              reportCleanupFailure(retryError);
             }
+          } else {
+            reportCleanupFailure(error);
           }
         }
       }
@@ -19886,7 +19904,8 @@ var init_navigator_invocation_identity = __esm({
 
 // src/public-cli/settlement.ts
 import { randomUUID } from "node:crypto";
-import { lstat as lstat3, mkdir as mkdir3, open as open2, readFile as readFile9, readdir as readdir3, writeFile as writeFile5 } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { appendFile, lstat as lstat3, mkdir as mkdir3, open as open2, readFile as readFile9, readdir as readdir3, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname6, join as join11 } from "node:path";
 function isChildDiagnosticFloodLine(line2) {
   if (/^at\s+/.test(line2)) return true;
@@ -20200,12 +20219,24 @@ async function readBoundAuditorKnownFailure(sessionFile) {
   }
   const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
   if (parentId === void 0) return void 0;
+  const RESUME_ENVELOPE = RESUME_TRANSPORT_ENVELOPE;
+  const isResumeEnvelope = (msg) => {
+    if (!isRecord5(msg) || msg.role !== "user") return false;
+    const text = typeof msg.text === "string" ? msg.text : typeof msg.content === "string" ? msg.content : void 0;
+    if (text === RESUME_ENVELOPE) return true;
+    const content = msg.content;
+    if (Array.isArray(content)) {
+      return content.some((p) => isRecord5(p) && (p.text === RESUME_ENVELOPE || p.content === RESUME_ENVELOPE));
+    }
+    return false;
+  };
   let latestParentUserIndex = -1;
   for (let i = parentEntries.length - 1; i >= 0; i -= 1) {
-    if (parentEntries[i]?.type === "message" && parentEntries[i]?.message?.role === "user") {
-      latestParentUserIndex = i;
-      break;
-    }
+    const entry = parentEntries[i];
+    if (entry?.type !== "message" || entry.message?.role !== "user") continue;
+    if (isResumeEnvelope(entry.message)) continue;
+    latestParentUserIndex = i;
+    break;
   }
   const childDirectory = join11(dirname6(sessionFile), "auditor-roles");
   let names;
@@ -20215,6 +20246,7 @@ async function readBoundAuditorKnownFailure(sessionFile) {
     if (isMissingPathError2(error)) return void 0;
     throw sessionReadFailure(error, "failed to read bound auditor session directory");
   }
+  const validAuditorFiles = [];
   for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
     let entries;
     try {
@@ -20229,6 +20261,9 @@ async function readBoundAuditorKnownFailure(sessionFile) {
     const attemptEntryId = typeof bindingParent?.attemptEntryId === "string" ? bindingParent.attemptEntryId : void 0;
     const attemptEntryIndex = attemptEntryId === void 0 ? -1 : parentEntries.findIndex((entry) => entry.id === attemptEntryId);
     if (bindingParent?.sessionId !== parentId || bindingParent.sessionFile !== sessionFile || attemptEntryIndex < latestParentUserIndex) continue;
+    validAuditorFiles.push({ file, entries, ...attemptEntryId === void 0 ? {} : { attemptEntryId } });
+  }
+  for (const { entries, attemptEntryId } of validAuditorFiles) {
     const stop = extractSessionProviderStop(entries);
     if (stop === void 0) continue;
     for (let i = entries.length - 1; i >= 0; i -= 1) {
@@ -20248,6 +20283,10 @@ async function readBoundAuditorKnownFailure(sessionFile) {
         ...isRecord5(failure.details) ? { details: failure.details } : {}
       };
     }
+  }
+  for (const { entries } of validAuditorFiles) {
+    const stop = extractSessionProviderStop(entries);
+    if (stop === void 0) continue;
     const primary = knownFailureFromProviderStop(stop);
     return {
       ...primary,
@@ -20981,20 +21020,74 @@ async function ensureAuditEvidenceDirectory(runDirectory) {
   }
   return artifactsDir;
 }
+async function appendRunAttemptHistory(admitted, outcome) {
+  const entries = await readBoundSessionEntries(admitted.sessionFile);
+  let parentId = null;
+  let priorEntries = 0;
+  for (const entry of entries) {
+    if (typeof entry.id === "string" && entry.type !== "session") parentId = entry.id;
+    if (entry.type === "custom" && entry.customType === ATTEMPT_HISTORY_ENTRY_TYPE) {
+      priorEntries += 1;
+    }
+  }
+  const timestamp2 = (/* @__PURE__ */ new Date()).toISOString();
+  const line2 = `${JSON.stringify({
+    type: "custom",
+    customType: ATTEMPT_HISTORY_ENTRY_TYPE,
+    data: {
+      sequence: priorEntries + 1,
+      role: admitted.role,
+      runId: admitted.runId,
+      recordedAt: timestamp2,
+      outcome
+    },
+    id: randomUUID(),
+    parentId,
+    timestamp: timestamp2
+  })}
+`;
+  await appendFile(admitted.sessionFile, line2, "utf8");
+}
 async function publishComplianceAuditIncompleteEvidence(admitted, outcome) {
+  await appendRunAttemptHistory(admitted, outcome);
+  if (typeof fsConstants.O_NOFOLLOW !== "number" || typeof fsConstants.O_NONBLOCK !== "number") {
+    throw auditArtifactPublicationError(
+      "audit evidence publication requires O_NOFOLLOW|O_NONBLOCK open-flag support (anti-symlink/anti-planted protection must not be silently dropped); refusing to publish",
+      "ENOSYS"
+    );
+  }
   const artifactsDir = await ensureAuditEvidenceDirectory(admitted.runDirectory);
   const evidencePath = join11(artifactsDir, "audit-incomplete.json");
+  let existing;
   try {
-    const existing = await lstat3(evidencePath);
-    throw auditArtifactPublicationError(
-      existing.isSymbolicLink() ? "audit evidence destination is a symlink" : "audit evidence destination collision",
-      existing.isSymbolicLink() ? "ELOOP" : "EEXIST"
-    );
+    existing = await lstat3(evidencePath);
   } catch (error) {
     if (!isMissingPathError2(error)) throw error;
   }
-  const handle = await open2(evidencePath, "wx", 384);
+  if (existing?.isSymbolicLink()) {
+    throw auditArtifactPublicationError(
+      "audit evidence destination is a symlink",
+      "ELOOP"
+    );
+  }
+  if (existing && !existing.isFile()) {
+    throw auditArtifactPublicationError(
+      "audit evidence destination is not a regular file",
+      "EEXIST"
+    );
+  }
+  const handle = await open2(
+    evidencePath,
+    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_TRUNC | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK,
+    384
+  );
   try {
+    if (!(await handle.stat()).isFile()) {
+      throw auditArtifactPublicationError(
+        "audit evidence destination is not a regular file",
+        "EEXIST"
+      );
+    }
     await handle.writeFile(`${JSON.stringify(outcome, null, 2)}
 `, "utf8");
     await handle.sync();
@@ -21247,6 +21340,7 @@ async function extractNavigatorFactFromAdmittedSession(admitted) {
   }
 }
 async function publishJudgeArtifacts(admitted, roleOutcome, sessionDirectory) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -21291,6 +21385,7 @@ async function publishJudgeArtifacts(admitted, roleOutcome, sessionDirectory) {
   ];
 }
 async function publishCoderArtifacts(admitted, roleOutcome, sessionDirectory, options = {}) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -21460,6 +21555,7 @@ function extractFixerMethodInvocations(entries, options) {
   return Object.freeze(observed);
 }
 async function publishFixerArtifacts(admitted, roleOutcome, sessionDirectory, options) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -21571,6 +21667,7 @@ async function settleLawfulFixerTerminalResult(admitted, options) {
   };
 }
 async function publishCollectorArtifacts(admitted, roleOutcome, sessionDirectory, options = {}) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -21690,6 +21787,7 @@ async function trySettleCollectorTerminalResult(admitted) {
   return settleLawfulCollectorTerminalResult(admitted);
 }
 async function publishDoctorArtifacts(admitted, roleOutcome, sessionDirectory, options = {}) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -21857,6 +21955,7 @@ function extractReviewerMethodInvocations(entries, options) {
   return Object.freeze(observed);
 }
 async function publishReviewerArtifacts(admitted, roleOutcome, sessionDirectory, options) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -22025,6 +22124,7 @@ function extractMergerMethodInvocations(entries, options) {
   return Object.freeze(observed);
 }
 async function publishMergerArtifacts(admitted, roleOutcome, sessionDirectory, options) {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join11(artifactsDir, "report.json");
   const evidencePath = join11(artifactsDir, "evidence.json");
@@ -22246,6 +22346,15 @@ async function publishFailureArtifacts(admitted, failure) {
     admitted.runDirectory
   );
   const priorIssues = baseAttempt === void 0 ? [] : [baseAttempt];
+  try {
+    await appendRunAttemptHistory(admitted, {
+      kind: "failure",
+      role: admitted.role,
+      ...failure
+    });
+  } catch (error) {
+    priorIssues.push(publicationAttemptFromError(admitted.sessionFile, error));
+  }
   const underArtifacts = baseDir === join11(admitted.runDirectory, "artifacts");
   const uniqueFallbackDirs = uniqueFailureFallbackDirs(
     admitted.runDirectory,
@@ -22442,7 +22551,7 @@ function presentFailureTerminal(terminal, io) {
     }));
   }
 }
-var CONCISE_DIAGNOSTIC_MAX_CHARS, COLLECTOR_INFRASTRUCTURE_TOOLS, COLLECTOR_INFRASTRUCTURE_FAILURE_SPEC, ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC;
+var CONCISE_DIAGNOSTIC_MAX_CHARS, COLLECTOR_INFRASTRUCTURE_TOOLS, COLLECTOR_INFRASTRUCTURE_FAILURE_SPEC, ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC, ATTEMPT_HISTORY_ENTRY_TYPE;
 var init_settlement = __esm({
   "src/public-cli/settlement.ts"() {
     "use strict";
@@ -22485,10 +22594,18 @@ var init_settlement = __esm({
       cause: "output",
       identityName: "EngineDetourInfrastructureError"
     };
+    ATTEMPT_HISTORY_ENTRY_TYPE = "ak_run_attempt_history";
   }
 });
 
 // src/public-cli/auto-resume.ts
+function presentTerminal(terminal, io) {
+  if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
+    presentFailureTerminal(terminal, io);
+  } else {
+    io.stdout(formatTerminalResult(terminal));
+  }
+}
 async function runWithAutoResumeLoop(options) {
   let autoResumeAttempts = 0;
   let isFirst = true;
@@ -22496,7 +22613,10 @@ async function runWithAutoResumeLoop(options) {
   while (true) {
     let lease;
     try {
-      lease = await acquireRunWriterLease(options.admitted.runDirectory);
+      lease = await acquireRunWriterLease(
+        options.admitted.runDirectory,
+        (diagnostic) => options.io.stderr(diagnostic)
+      );
     } catch (error) {
       if (error instanceof RunWriterLeaseHeldError) {
         presentStructuralRejection(error, options.io);
@@ -22516,39 +22636,12 @@ async function runWithAutoResumeLoop(options) {
       }
       return result2;
     }
-    if (terminal !== void 0 && (terminal.roleOutcome.kind === "incomplete" || terminal.roleOutcome.kind === "audit_incomplete")) {
-      if (terminal.roleOutcome.kind === "audit_incomplete") {
-        options.io.stdout(formatTerminalResult(terminal));
-      } else {
-        options.io.stdout(formatTerminalResult(terminal));
-      }
-      return result2;
-    }
-    if (terminal !== void 0 && terminal.roleOutcome.kind === "failure") {
-      const terminalJson = JSON.stringify(terminal);
-      if (terminalJson.includes("retentionFailure") || terminalJson.includes("ComplianceResponseRetentionError")) {
-        presentFailureTerminal(terminal, options.io);
-        return result2;
-      }
-    }
     if (autoResumeAttempts >= AUTO_RESUME_LIMIT) {
-      if (terminal !== void 0) {
-        if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
-          presentFailureTerminal(terminal, options.io);
-        } else {
-          options.io.stdout(formatTerminalResult(terminal));
-        }
-      }
+      if (terminal !== void 0) presentTerminal(terminal, options.io);
       return result2;
     }
     if (!await isSessionPrincipalAvailable(options.admitted.sessionFile)) {
-      if (terminal !== void 0) {
-        if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
-          presentFailureTerminal(terminal, options.io);
-        } else {
-          options.io.stdout(formatTerminalResult(terminal));
-        }
-      }
+      if (terminal !== void 0) presentTerminal(terminal, options.io);
       return result2;
     }
     autoResumeAttempts++;
@@ -22891,7 +22984,7 @@ async function runPublicCoderResume(argv, env, io) {
   const { admitted } = loaded;
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));
@@ -23155,7 +23248,7 @@ async function runPublicCollector(argv, env, io, parseCollectorArgv2) {
   await markRunAdmitted(admitted);
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       presentStructuralRejection(error, io);
@@ -23390,7 +23483,7 @@ async function runPublicDoctor(argv, env, io, parseDoctorArgv2) {
   await markRunAdmitted(admitted);
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       presentStructuralRejection(error, io);
@@ -23775,7 +23868,7 @@ async function runPublicFixerResume(argv, env, io) {
   const { admitted } = loaded;
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));
@@ -24137,7 +24230,7 @@ async function runPublicResume(argv, env, io) {
   const { admitted } = loaded;
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));
@@ -24586,7 +24679,7 @@ async function runPublicMergerResume(argv, env, io) {
   const { admitted } = loaded;
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));
@@ -25002,7 +25095,7 @@ async function runPublicReviewerResume(argv, env, io) {
   const { admitted } = loaded;
   let lease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.2157",
+  "version": "0.1.2169",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/public-cli/auto-resume.ts

@@ -10,6 +10,14 @@ import type { CliIo } from "./cli-io.ts";
 
 const dummyIo: CliIo = { stdout: () => {}, stderr: () => {} };
 
+function presentTerminal(terminal: TerminalResult, io: CliIo): void {
+  if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
+    presentFailureTerminal(terminal, io);
+  } else {
+    io.stdout(formatTerminalResult(terminal));
+  }
+}
+
 export type AutoResumeDispatchResult = {
   exitCode: number;
   terminal?: TerminalResult;
@@ -29,7 +37,9 @@ export async function runWithAutoResumeLoop<T extends AutoResumeDispatchResult>(
   while (true) {
     let lease: RunWriterLease;
     try {
-      lease = await acquireRunWriterLease(options.admitted.runDirectory);
+      lease = await acquireRunWriterLease(options.admitted.runDirectory, (diagnostic) =>
+        options.io.stderr(diagnostic),
+      );
     } catch (error) {
       if (error instanceof RunWriterLeaseHeldError) {
         presentStructuralRejection(error, options.io);
@@ -54,42 +64,12 @@ export async function runWithAutoResumeLoop<T extends AutoResumeDispatchResult>(
       return result;
     }
 
-    // Deterministic incomplete/audit_incomplete (merger/collector/judge) would duplicate callId bindings on retry and lose settlement
-    if (terminal !== undefined && (terminal.roleOutcome.kind === "incomplete" || terminal.roleOutcome.kind === "audit_incomplete")) {
-      if (terminal.roleOutcome.kind === "audit_incomplete") {
-        options.io.stdout(formatTerminalResult(terminal));
-      } else {
-        options.io.stdout(formatTerminalResult(terminal));
-      }
-      return result;
-    }
-    // Rich auditor retention detail would be lost on retry (stale child binding)
-    if (terminal !== undefined && terminal.roleOutcome.kind === "failure") {
-      const terminalJson = JSON.stringify(terminal);
-      if (terminalJson.includes("retentionFailure") || terminalJson.includes("ComplianceResponseRetentionError")) {
-        presentFailureTerminal(terminal, options.io);
-        return result;
-      }
-    }
-
     if (autoResumeAttempts >= AUTO_RESUME_LIMIT) {
-      if (terminal !== undefined) {
-        if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
-          presentFailureTerminal(terminal, options.io);
-        } else {
-          options.io.stdout(formatTerminalResult(terminal));
-        }
-      }
+      if (terminal !== undefined) presentTerminal(terminal, options.io);
       return result;
     }
     if (!(await isSessionPrincipalAvailable(options.admitted.sessionFile))) {
-      if (terminal !== undefined) {
-        if (terminal.roleOutcome.kind === "failure" || terminal.roleOutcome.kind === "no_receipt") {
-          presentFailureTerminal(terminal, options.io);
-        } else {
-          options.io.stdout(formatTerminalResult(terminal));
-        }
-      }
+      if (terminal !== undefined) presentTerminal(terminal, options.io);
       return result;
     }
 

package/src/public-cli/coder-run.ts

@@ -548,7 +548,7 @@ export async function runPublicCoderResume(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       // Concurrent resume: reject without second writer or dispatch.

package/src/public-cli/collector-run.ts

@@ -355,7 +355,7 @@ export async function runPublicCollector(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       presentStructuralRejection(error, io);

package/src/public-cli/doctor-run.ts

@@ -334,7 +334,7 @@ export async function runPublicDoctor(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       presentStructuralRejection(error, io);

package/src/public-cli/fixer-run.ts

@@ -567,7 +567,7 @@ export async function runPublicFixerResume(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));

package/src/public-cli/judge-run.ts

@@ -536,7 +536,7 @@ export async function runPublicResume(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       // Concurrent resume: reject without second writer or dispatch.

package/src/public-cli/merger-run.ts

@@ -648,7 +648,7 @@ export async function runPublicMergerResume(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));

package/src/public-cli/reviewer-run.ts

@@ -587,7 +587,7 @@ export async function runPublicReviewerResume(
 
   let lease: RunWriterLease;
   try {
-    lease = await acquireRunWriterLease(admitted.runDirectory);
+    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
   } catch (error) {
     if (error instanceof RunWriterLeaseHeldError) {
       io.stderr(formatCliDiagnostic(error.message));

package/src/public-cli/run-lifecycle.ts

@@ -340,13 +340,52 @@ export type RunWriterLease = {
   release(): Promise<void>;
 };
 
+/**
+ * True error identity for diagnostics — name/code/message as-is, never a
+ * guessed label (failure-honesty constitution).
+ */
+function describeErrorIdentity(error: unknown): string {
+  const candidate = error as { name?: unknown; code?: unknown; message?: unknown };
+  const name =
+    typeof candidate?.name === "string" && candidate.name !== ""
+      ? candidate.name
+      : typeof error;
+  const code =
+    typeof candidate?.code === "string" || typeof candidate?.code === "number"
+      ? ` code=${String(candidate.code)}`
+      : "";
+  const message =
+    typeof candidate?.message === "string" && candidate.message !== ""
+      ? `: ${candidate.message}`
+      : "";
+  return `${name}${code}${message}`;
+}
+
 /**
  * Acquire the one-writer lease for a Role run. Concurrent acquire rejects
  * without dispatch. Exclusive create — no second writer.
+ *
+ * `onCleanupFailure` receives a non-terminal diagnostic line when release-time
+ * lock cleanup fails. Release stays best-effort (a stale lock resurfaces as
+ * RunWriterLeaseHeldError on next acquire), but the true error identity must
+ * still land somewhere observable — silent swallowing is forbidden.
  */
 export async function acquireRunWriterLease(
   runDirectory: string,
+  onCleanupFailure?: (diagnostic: string) => void,
 ): Promise<RunWriterLease> {
+  const reportCleanupFailure = (error: unknown): void => {
+    // Sink isolation: a throwing onCleanupFailure must not propagate through
+    // release() — release stays best-effort by contract. The true cleanup
+    // cause has already been handed to the sink as its argument.
+    try {
+      onCleanupFailure?.(
+        `writer lease lock cleanup failed (best-effort continue; stale lock resurfaces as lease-held on next acquire) at ${join(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`,
+      );
+    } catch {
+      // diagnostic-sink failure is itself best-effort; never break release().
+    }
+  };
   const lockPath = join(runDirectory, WRITER_LOCK_FILE);
   try {
     const handle = await open(lockPath, "wx");
@@ -371,7 +410,14 @@ export async function acquireRunWriterLease(
             try {
               await chmod(runDirectory, 0o755);
               await unlink(lockPath);
-            } catch {}
+            } catch (retryError) {
+              // best-effort cleanup: stale lock will surface as lease-held on next acquire (exit 2),
+              // but the true chmod/unlink cause must be recorded, not swallowed.
+              reportCleanupFailure(retryError);
+            }
+          } else {
+            // non-EACCES unlink failure is best-effort settlement cleanup; record true cause.
+            reportCleanupFailure(error);
           }
         }
       },

package/src/public-cli/settlement.ts

@@ -4,7 +4,8 @@
  * Controlled failures and audit human decisions settle here without washing causes.
  */
 import { randomUUID } from "node:crypto";
-import { lstat, mkdir, open, readFile, readdir, writeFile } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { appendFile, lstat, mkdir, open, readFile, readdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 
 import { isAuditEscalationResult } from "../audit-escalation.ts";
@@ -14,6 +15,7 @@ import { JUDGE_AUDIT_TOOL_NAME } from "../judge-auditor.ts";
 import { REVIEWER_AUDIT_TOOL_NAME } from "../reviewer-auditor.ts";
 import { knownFailureFromProviderStop, type ExplicitInternalKnownFailure, readReviewerDispatchRejection } from "./explicit-internal.ts";
 import {
+  RESUME_TRANSPORT_ENVELOPE,
   isV1ResumableProvider,
   readLatestTypedProviderHttpObservation,
   readTypedHttp429Observation,
@@ -725,12 +727,24 @@ export async function readBoundAuditorKnownFailure(
   }
   const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
   if (parentId === undefined) return undefined;
+  const RESUME_ENVELOPE = RESUME_TRANSPORT_ENVELOPE;
+  const isResumeEnvelope = (msg: unknown): boolean => {
+    if (!isRecord(msg) || msg.role !== "user") return false;
+    const text = typeof msg.text === "string" ? msg.text : typeof (msg as { content?: unknown }).content === "string" ? (msg as { content: string }).content : undefined;
+    if (text === RESUME_ENVELOPE) return true;
+    const content = (msg as { content?: unknown }).content;
+    if (Array.isArray(content)) {
+      return content.some((p) => isRecord(p) && (p.text === RESUME_ENVELOPE || p.content === RESUME_ENVELOPE));
+    }
+    return false;
+  };
   let latestParentUserIndex = -1;
   for (let i = parentEntries.length - 1; i >= 0; i -= 1) {
-    if (parentEntries[i]?.type === "message" && parentEntries[i]?.message?.role === "user") {
-      latestParentUserIndex = i;
-      break;
-    }
+    const entry = parentEntries[i];
+    if (entry?.type !== "message" || entry.message?.role !== "user") continue;
+    if (isResumeEnvelope(entry.message)) continue;
+    latestParentUserIndex = i;
+    break;
   }
   const childDirectory = join(dirname(sessionFile), "auditor-roles");
   let names: string[];
@@ -740,6 +754,12 @@ export async function readBoundAuditorKnownFailure(
     if (isMissingPathError(error)) return undefined;
     throw sessionReadFailure(error, "failed to read bound auditor session directory");
   }
+  // Auto-resume seam (owner A): stale check must ignore resume envelope and
+  // prioritize retention. Previous `attemptEntryIndex < latest` discarded the
+  // first attempt's child after resume advanced latest, losing retentionFailure
+  // when retry had no compliance entry. Fix: ignore envelope for staleness and
+  // prefer any valid compliance failure before falling back to primary.
+  const validAuditorFiles: Array<{ file: string; entries: SessionEntry[]; attemptEntryId?: string }> = [];
   for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
     let entries: SessionEntry[];
     try {
@@ -754,7 +774,10 @@ export async function readBoundAuditorKnownFailure(
     const attemptEntryId = typeof bindingParent?.attemptEntryId === "string" ? bindingParent.attemptEntryId : undefined;
     const attemptEntryIndex = attemptEntryId === undefined ? -1 : parentEntries.findIndex((entry) => entry.id === attemptEntryId);
     if (bindingParent?.sessionId !== parentId || bindingParent.sessionFile !== sessionFile || attemptEntryIndex < latestParentUserIndex) continue;
-
+    validAuditorFiles.push({ file, entries, ...(attemptEntryId === undefined ? {} : { attemptEntryId }) });
+  }
+  // Prefer compliance failure (retention) from any valid attempt, newest first.
+  for (const { entries, attemptEntryId } of validAuditorFiles) {
     const stop = extractSessionProviderStop(entries);
     if (stop === undefined) continue;
     for (let i = entries.length - 1; i >= 0; i -= 1) {
@@ -774,6 +797,11 @@ export async function readBoundAuditorKnownFailure(
         ...(isRecord(failure.details) ? { details: failure.details } : {}),
       };
     }
+  }
+  // No compliance failure: fall back to most recent provider stop (auto-resume latest attempt).
+  for (const { entries } of validAuditorFiles) {
+    const stop = extractSessionProviderStop(entries);
+    if (stop === undefined) continue;
     const primary = knownFailureFromProviderStop(stop)!;
     return {
       ...primary,
@@ -1852,26 +1880,131 @@ async function ensureAuditEvidenceDirectory(runDirectory: string): Promise<strin
   return artifactsDir;
 }
 
-/** Publish the retained residual with exclusive, complete-write semantics. */
+/**
+ * #419 per-attempt process history. 史必追加，指针可覆盖；指针可以覆盖的前提是史已落。
+ * Reuses the run session principal's append-only JSONL custom-entry shape
+ * (plain custom entries are state records and never enter LLM context), so no
+ * second ledger mechanism is introduced.
+ */
+export const ATTEMPT_HISTORY_ENTRY_TYPE = "ak_run_attempt_history" as const;
+
+/** Complete per-attempt result as recorded in the appended history. */
+type AttemptHistoryOutcome =
+  | TerminalRoleOutcome
+  | ({ kind: "failure"; role: string } & ControlledFailure);
+
+type AttemptHistorySource = {
+  readonly role: string;
+  readonly runId: string;
+  readonly sessionFile: string;
+};
+
+/**
+ * Append one attempt's complete result to the run's session principal.
+ * Append failure throws — callers must not overwrite a pointer artifact when
+ * the history entry backing the overwrite did not land (fail closed).
+ */
+export async function appendRunAttemptHistory(
+  admitted: AttemptHistorySource,
+  outcome: AttemptHistoryOutcome,
+): Promise<void> {
+  const entries = await readBoundSessionEntries(admitted.sessionFile);
+  let parentId: string | null = null;
+  let priorEntries = 0;
+  for (const entry of entries) {
+    if (typeof entry.id === "string" && entry.type !== "session") parentId = entry.id;
+    if (
+      entry.type === "custom" &&
+      entry.customType === ATTEMPT_HISTORY_ENTRY_TYPE
+    ) {
+      priorEntries += 1;
+    }
+  }
+  const timestamp = new Date().toISOString();
+  // Shape mirrors pi SessionManager.appendCustomEntry.
+  const line = `${JSON.stringify({
+    type: "custom",
+    customType: ATTEMPT_HISTORY_ENTRY_TYPE,
+    data: {
+      sequence: priorEntries + 1,
+      role: admitted.role,
+      runId: admitted.runId,
+      recordedAt: timestamp,
+      outcome,
+    },
+    id: randomUUID(),
+    parentId,
+    timestamp,
+  })}\n`;
+  await appendFile(admitted.sessionFile, line, "utf8");
+}
+
+/**
+ * Publish the retained residual with complete-write semantics (#419: the
+ * previous attempt's pointer file is a rebuildable view once this attempt's
+ * complete result is in the appended history; planted symlinks/directories
+ * still fail loudly with their #182-A identities).
+ */
 export async function publishComplianceAuditIncompleteEvidence(
   admitted: AdmittedRoleInvocation,
   outcome: ReturnType<typeof buildAuditIncompleteTerminalOutcome>,
 ): Promise<TerminalArtifactRef> {
+  await appendRunAttemptHistory(admitted, outcome);
+  if (
+    typeof fsConstants.O_NOFOLLOW !== "number" ||
+    typeof fsConstants.O_NONBLOCK !== "number"
+  ) {
+    // #418 fail-closed: on platforms without O_NOFOLLOW (e.g. Windows,
+    // nodejs/node#41590) the JS bitwise-or below would silently drop the flag
+    // and the #182-A anti-symlink protection would vanish. Refuse loudly via
+    // the existing publication-failure channel instead of publishing
+    // unprotected; the complete attempt result above stays in appended history.
+    throw auditArtifactPublicationError(
+      "audit evidence publication requires O_NOFOLLOW|O_NONBLOCK open-flag support (anti-symlink/anti-planted protection must not be silently dropped); refusing to publish",
+      "ENOSYS",
+    );
+  }
   const artifactsDir = await ensureAuditEvidenceDirectory(admitted.runDirectory);
   const evidencePath = join(artifactsDir, "audit-incomplete.json");
+  let existing: Awaited<ReturnType<typeof lstat>> | undefined;
   try {
-    const existing = await lstat(evidencePath);
-    throw auditArtifactPublicationError(
-      existing.isSymbolicLink()
-        ? "audit evidence destination is a symlink"
-        : "audit evidence destination collision",
-      existing.isSymbolicLink() ? "ELOOP" : "EEXIST",
-    );
+    existing = await lstat(evidencePath);
   } catch (error) {
     if (!isMissingPathError(error)) throw error;
   }
-  const handle = await open(evidencePath, "wx", 0o600);
+  if (existing?.isSymbolicLink()) {
+    throw auditArtifactPublicationError(
+      "audit evidence destination is a symlink",
+      "ELOOP",
+    );
+  }
+  if (existing && !existing.isFile()) {
+    throw auditArtifactPublicationError(
+      "audit evidence destination is not a regular file",
+      "EEXIST",
+    );
+  }
+  // #182-A protection restored atomically at this open seam: O_NOFOLLOW makes
+  // the open itself refuse symlinks (ELOOP), so one swapped in after the lstat
+  // above can never be followed or written through; O_NONBLOCK keeps a
+  // race-planted FIFO from blocking this open forever. The fstat below
+  // backstops any non-regular object that wins the window.
+  const handle = await open(
+    evidencePath,
+    fsConstants.O_WRONLY |
+      fsConstants.O_CREAT |
+      fsConstants.O_TRUNC |
+      fsConstants.O_NOFOLLOW |
+      fsConstants.O_NONBLOCK,
+    0o600,
+  );
   try {
+    if (!(await handle.stat()).isFile()) {
+      throw auditArtifactPublicationError(
+        "audit evidence destination is not a regular file",
+        "EEXIST",
+      );
+    }
     await handle.writeFile(`${JSON.stringify(outcome, null, 2)}\n`, "utf8");
     await handle.sync();
   } finally {
@@ -2213,6 +2346,9 @@ export async function publishJudgeArtifacts(
   roleOutcome: TerminalRoleOutcome,
   sessionDirectory: string,
 ): Promise<TerminalArtifactRef[]> {
+  // #419: history first — report/evidence stay last-write-wins views only
+  // because every attempt's complete result has already been appended.
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -2268,6 +2404,7 @@ export async function publishCoderArtifacts(
     readonly coderOutput?: CoderOutput;
   } = {},
 ): Promise<TerminalArtifactRef[]> {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -2573,6 +2710,7 @@ export async function publishFixerArtifacts(
     readonly fixerOutput?: FixerOutput;
   },
 ): Promise<TerminalArtifactRef[]> {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -2732,6 +2870,7 @@ export async function publishCollectorArtifacts(
     readonly collectorReceipt?: CollectorReceipt;
   } = {},
 ): Promise<TerminalArtifactRef[]> {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -2891,6 +3030,7 @@ export async function publishDoctorArtifacts(
     readonly doctorOutput?: DoctorOutput;
   } = {},
 ): Promise<TerminalArtifactRef[]> {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -3155,6 +3295,7 @@ export async function publishReviewerArtifacts(
     readonly reviewerReceipt?: RuntimeReviewerReceiptV2;
   },
 ): Promise<TerminalArtifactRef[]> {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -3412,6 +3553,7 @@ export async function publishMergerArtifacts(
     readonly mergerOutput?: MergerOutput;
   },
 ): Promise<TerminalArtifactRef[]> {
+  await appendRunAttemptHistory(admitted, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
   const reportPath = join(artifactsDir, "report.json");
   const evidencePath = join(artifactsDir, "evidence.json");
@@ -3746,6 +3888,19 @@ export async function publishFailureArtifacts(
   );
   const priorIssues: PublicationAttempt[] =
     baseAttempt === undefined ? [] : [baseAttempt];
+  // #419: each attempt's complete failure result joins the appended history
+  // before any fixed-name artifact view is rewritten. History failure must not
+  // strand the original controlled failure outside settlement — it rides
+  // publicationIssues instead of aborting durability.
+  try {
+    await appendRunAttemptHistory(admitted, {
+      kind: "failure",
+      role: admitted.role,
+      ...failure,
+    });
+  } catch (error) {
+    priorIssues.push(publicationAttemptFromError(admitted.sessionFile, error));
+  }
 
   // Prefer conventional names; unique fallback dirs keep colliding fixed paths
   // from stranding the original failure outside settlement. Include the ledger