@akagilnc/pi-workflow-roles 0.1.3572 → 0.1.3621

package/dist/public-cli/settlement.js

@@ -0,0 +1,3441 @@
+/**
+ * Shared settlement for public Role runs: role outcome + Navigator fact + artifacts
+ * into one Terminal result (ADR 0052 / #106 / #107 / #101).
+ * Controlled failures and audit human decisions settle here without washing causes.
+ */
+import { randomUUID } from "node:crypto";
+import { appendFile, lstat, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { readAnalystGateCyclesFromAuditorRoles, } from "../analyst-gate-cycles-read.js";
+import { readSitianRecords, resolveSitianRecordPath, sitianReport } from "../sitian-facade.js";
+import { readAuditEscalationSubmission, readLatestSubmissionOutcome, readSealedSubmission, } from "../submission-ledger.js";
+import { isAuditEscalationResult } from "../audit-escalation.js";
+import { AUDITOR_SOUL_ROLES } from "../auditor-soul.js";
+import { DOCTOR_AUDIT_TOOL_NAME } from "../doctor-auditor.js";
+import { JUDGE_AUDIT_TOOL_NAME } from "../judge-auditor.js";
+import { stampShapeUnreadableDetails } from "../shape-unreadable-failure.js";
+import { knownFailureFromProviderStop } from "../pi/known-failure.js";
+import { readReviewerDispatchRejection } from "./reviewer-dispatch-rejection.js";
+import { RESUME_TRANSPORT_ENVELOPE, isV1ResumableProvider, readLatestTypedProviderHttpObservation, readTypedHttp429Observation, } from "./run-lifecycle.js";
+import { AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE, AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, COMPLIANCE_RESPONSE_ENTRY_TYPE, readComplianceCandidate, } from "../compliance-transport.js";
+// COMPLIANCE_RESPONSE_ENTRY_TYPE remains for boundRetainedAuditResponse (call/result
+// interval binding on historical session bytes). Provider-stop retain authority is Sitian.
+import { COLLECTOR_OBSERVE_TOOL, COLLECTOR_READ_TOOL, COLLECTOR_REQUEST_TOOL, COLLECTOR_WAIT_TOOL, } from "../collector-ledger.js";
+import { ENGINE_DETOUR_TOOL_NAME } from "../engine-detour.js";
+import { JUDGE_OUTPUT_TOOL_NAME, } from "../package-contracts/judge-output.js";
+import { COLLECTOR_OUTPUT_TOOL, validateAcceptedCollectorReceipt, } from "../package-contracts/collector-output.js";
+import { CODER_OUTPUT_TOOL_NAME, FIXER_OUTPUT_TOOL_NAME, validateAcceptedCoderDetails, validateFixerOutput, } from "../package-contracts/worker-output.js";
+import { validateAcceptedDetails } from "../package-contracts/terminating-tools.js";
+import { DOCTOR_OUTPUT_TOOL_NAME, validateRecordedDoctorOutput, } from "../doctor-contracts.js";
+import { REVIEWER_OUTPUT_TOOL_NAME, validateRuntimeReviewerReceipt, } from "../package-contracts/reviewer-output.js";
+import { MERGER_OUTPUT_TOOL_NAME, validateMergerOutput, } from "../merger-contracts.js";
+import { NOTARY_OUTPUT_TOOL_NAME, notaryDecisiveFacts, validateRecordedNotaryOutput, } from "../notary-contracts.js";
+import { COUNTERSIGN_OUTPUT_TOOL_NAME, validateRecordedCountersignOutput, } from "../countersign-contracts.js";
+import { GLEANER_LEFT_OUTPUT_TOOL_NAME, gleanerLeftDecisiveFacts, validateRecordedGleanerLeftOutput, } from "../gleaner-left-contracts.js";
+import { DIARIST_OUTPUT_TOOL_NAME, diaristDecisiveFacts, validateRecordedDiaristOutput, } from "../diarist-contracts.js";
+import { INSPECTOR_OUTPUT_TOOL_NAME, inspectorDecisiveFacts, validateRecordedInspectorOutput, } from "../inspector-contracts.js";
+import { GATEKEEPER_OUTPUT_TOOL_NAME, gatekeeperDecisiveFacts, validateRecordedGatekeeperOutput, } from "../package-contracts/gatekeeper-output.js";
+import { NAVIGATOR_OUTPUT_TOOL_NAME, navigatorDecisiveFacts, validateRecordedNavigatorOutput, } from "../package-contracts/navigator-output.js";
+import { AUDITOR_OUTPUT_TOOL_NAME, auditorDecisiveFacts, projectLawfulAuditorOutput, validateRecordedAuditorOutput, } from "../package-contracts/auditor-output.js";
+import { EVIDENCE_CHILD_OUTPUT_TOOL_NAME, evidenceChildDecisiveFacts, validateRecordedEvidenceChildOutput, } from "../package-contracts/evidence-child-output.js";
+import { observePackagedMethodSkillInvocation, } from "../package-resources/method-skill.js";
+import { classifyPackagedRoleTerminalResult, findLatestDurablePackagedRoleTerminal, hasNavigatorInfrastructureFailureBase, isAcceptedPackagedRoleTerminalResult, isReceiptSettlementBindingClear, NAVIGATOR_INVOCATION_ENTRY, parseInvocationMarkerIdentity, } from "../navigator-invocation-identity.js";
+import { NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, parseNoReceiptLifecycleFacts } from "../receipt-delivery-policy.js";
+import { ensureRunArtifactsDir, homeFromRunDirectory, } from "./invocation.js";
+/** Ledger reads use the run's machine home — not ambient process HOME (child write vs parent settle). */
+function sealedLedgerHome(admitted) {
+    return homeFromRunDirectory(admitted.runDirectory);
+}
+function ledgerReadScope(admitted, scope) {
+    return {
+        home: sealedLedgerHome(admitted),
+        ...(scope?.courtAttemptId === undefined || scope.courtAttemptId.length === 0
+            ? {}
+            : { attemptId: scope.courtAttemptId }),
+    };
+}
+async function sealedLedgerOutcome(admitted, scope) {
+    return readSealedSubmission(admitted.projectRoot, admitted.runId, ledgerReadScope(admitted, scope));
+}
+export async function sealedAcceptanceRedispatchDisposition(admitted) {
+    try {
+        if ((await sealedLedgerOutcome(admitted)) !== undefined) {
+            return { kind: "block", reason: "sealed-accepted" };
+        }
+        return { kind: "allow" };
+    }
+    catch (cause) {
+        // Ledger authority must not wash read failure into "unsealed" (#648).
+        return { kind: "block", reason: "authority-failed", cause };
+    }
+}
+async function auditEscalationLedgerOutcome(admitted, role, scope) {
+    const projection = await readAuditEscalationSubmission(admitted.projectRoot, admitted.runId, ledgerReadScope(admitted, scope));
+    if (projection?.role !== role)
+        return undefined;
+    return projection;
+}
+async function closedLedgerOutcome(admitted, role, scope) {
+    const sealed = await sealedLedgerOutcome(admitted, scope);
+    return sealed?.role === role
+        ? sealed
+        : auditEscalationLedgerOutcome(admitted, role, scope);
+}
+/** Transitional host-session reads remain only for non-sealed failure and audit evidence. */
+function coordinatesFromAdmitted(authority, admitted) {
+    return authority.decode(admitted.principal);
+}
+import { exitCodeForTerminalOutcome, formatTerminalResult, isLawfulTypedTerminalOutcome, recommendationNavigatorFact, buildResidualIncompleteTerminalOutcome, redactExactRunId, } from "./terminal.js";
+export { exitCodeForTerminalOutcome, formatTerminalResult, isLawfulTypedTerminalOutcome, };
+/** Presentation bound for one stderr diagnostic line (durable artifact keeps full text). */
+export const CONCISE_DIAGNOSTIC_MAX_CHARS = 480;
+/**
+ * True when a stderr line is observation/event/token/stack flood rather than a diagnostic.
+ * Recognizes both `event:` prefixes and real JSONL records with an `event` key
+ * (tool_execution_* observation face).
+ */
+export function isChildDiagnosticFloodLine(line) {
+    if (/^at\s+/.test(line))
+        return true;
+    if (line.startsWith("event:"))
+        return true;
+    if (/\btokens?=/.test(line))
+        return true;
+    if (/\btool_calls?=/.test(line))
+        return true;
+    if (line.startsWith("{")) {
+        try {
+            const parsed = JSON.parse(line);
+            if (typeof parsed === "object" &&
+                parsed !== null &&
+                !Array.isArray(parsed) &&
+                typeof parsed.event === "string") {
+                return true;
+            }
+        }
+        catch {
+            // Not JSON — may still be a real diagnostic.
+        }
+    }
+    return false;
+}
+/**
+ * True when a stderr line is Pi auth/model help scaffolding rather than the failure identity.
+ * Real counterexample: multi-line "No API key…" guidance ends with docs/*.md path lines;
+ * those footers must not displace the primary diagnostic.
+ */
+export function isChildDiagnosticHelpFooterLine(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+        return false;
+    // Path-only doc references (indented or bare).
+    if (/^\S+\.(md|txt)$/i.test(trimmed))
+        return true;
+    // Auth guidance continuations from Pi formatNoApiKeyFoundMessage / getProviderLoginHelp.
+    if (/^Use \//i.test(trimmed))
+        return true;
+    if (/^Then use \//i.test(trimmed))
+        return true;
+    if (/^See:\s*$/i.test(trimmed))
+        return true;
+    return false;
+}
+/** Bound one diagnostic for human stderr presentation; durable evidence stays full. */
+export function boundConciseDiagnostic(diagnostic, maxChars = CONCISE_DIAGNOSTIC_MAX_CHARS) {
+    if (diagnostic.length <= maxChars)
+        return diagnostic;
+    if (maxChars <= 1)
+        return "…";
+    return `${diagnostic.slice(0, maxChars - 1)}…`;
+}
+/**
+ * Pick one concise diagnostic line from child stderr without stacks/events/tokens/help footers.
+ * Prefers the last nonblank line that is not a frame, observation flood, or docs-path footer.
+ * Returns the full selected diagnostic (bound only at presentation).
+ */
+export function conciseChildDiagnostic(stderr, fallback) {
+    const lines = stderr
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+        const line = lines[i];
+        if (isChildDiagnosticFloodLine(line))
+            continue;
+        if (isChildDiagnosticHelpFooterLine(line))
+            continue;
+        // Strip a leading "Error:" label but keep the message identity.
+        return line.replace(/^Error:\s*/i, "").trim() || fallback;
+    }
+    return fallback;
+}
+export function formatCliDiagnostic(message) {
+    return `ak-role: ${message}\n`;
+}
+/**
+ * One concise stderr line for humans. Durable Error Artifact / Terminal keep the
+ * full original diagnostic — presentation collapses newlines and flood frames.
+ */
+export function formatFailureStderrDiagnostic(failure) {
+    const selected = conciseChildDiagnostic(failure.diagnostic, "failure");
+    // conciseChildDiagnostic already returns one split line; defend fallback paths.
+    const oneLine = selected
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line.length > 0) ?? "failure";
+    return formatCliDiagnostic(boundConciseDiagnostic(oneLine));
+}
+/** Pre-admission structural rejection: stderr only, no run, no Terminal. */
+export function presentStructuralRejection(error, io) {
+    io.stderr(formatCliDiagnostic(error.message));
+}
+/** ControlledFailure face without admitted-run Terminal (stdout body + stderr line). */
+export function presentControlledFailure(failure, io) {
+    io.stdout(`${JSON.stringify(failure, null, 2)}\n`);
+    io.stderr(formatFailureStderrDiagnostic(failure));
+}
+export async function inspectJudgeSession(sessionFile) {
+    try {
+        await readFile(sessionFile, "utf8");
+        return { state: "present" };
+    }
+    catch (error) {
+        if (isMissingPathError(error))
+            return { state: "missing" };
+        return {
+            state: "unreadable",
+            diagnostic: error instanceof Error
+                ? error.message || error.name
+                : String(error),
+        };
+    }
+}
+function thrownIdentity(error) {
+    const identity = {
+        name: error.name,
+    };
+    const code = error.code;
+    if (typeof code === "string" || typeof code === "number") {
+        identity.code = code;
+    }
+    return identity;
+}
+/** Production-owned typed thrown failure (explicit-internal channel). */
+function isTypedActivationError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const cause = error.knownCause;
+    return (cause === "provider" ||
+        cause === "activation" ||
+        cause === "session" ||
+        cause === "output" ||
+        cause === "timeout" ||
+        cause === "unrecognized");
+}
+/** Flatten nested AggregateError leaves; non-aggregate values stay as one fact. */
+function flattenThrownFailureLeaves(error) {
+    if (!(error instanceof AggregateError)) {
+        return [error];
+    }
+    const leaves = [];
+    for (const item of error.errors) {
+        leaves.push(...flattenThrownFailureLeaves(item));
+    }
+    return leaves;
+}
+/**
+ * Project one thrown value into a ControlledFailure leaf.
+ * Sole owner for thrown-leaf identity/diagnostic mapping.
+ * AggregateError nesting is handled by classifyThrownFailure.
+ */
+export function projectThrownFailureLeaf(error) {
+    if (isTypedActivationError(error)) {
+        const identity = thrownIdentity(error);
+        if (error.failureCode !== undefined && identity.code === undefined) {
+            identity.code = error.failureCode;
+        }
+        return {
+            cause: error.knownCause,
+            diagnostic: error.message || error.name || "unrecognized exception",
+            identity,
+            ...(error.details === undefined ? {} : { details: error.details }),
+        };
+    }
+    if (error instanceof Error) {
+        const identity = thrownIdentity(error);
+        return {
+            cause: "unrecognized",
+            diagnostic: error.message || error.name || "unrecognized exception",
+            identity,
+        };
+    }
+    return {
+        cause: "unrecognized",
+        diagnostic: String(error),
+    };
+}
+/**
+ * Concurrent thrown failures (host + cleanup, etc.):
+ * primary leaf owns cause/diagnostic/identity; remaining leaves stay as
+ * details.concurrentFailures so neither fact covers the other.
+ */
+function classifyThrownFailure(error) {
+    if (!(error instanceof AggregateError)) {
+        return projectThrownFailureLeaf(error);
+    }
+    const leaves = flattenThrownFailureLeaves(error);
+    if (leaves.length === 0) {
+        // Empty aggregate — retain the aggregate shell rather than invent a cause.
+        return projectThrownFailureLeaf(error);
+    }
+    const primary = projectThrownFailureLeaf(leaves[0]);
+    if (leaves.length === 1) {
+        return primary;
+    }
+    const priorConcurrent = Array.isArray(primary.details?.concurrentFailures)
+        ? primary.details.concurrentFailures
+        : [];
+    const concurrentFailures = [
+        ...priorConcurrent,
+        ...leaves.slice(1).map((leaf) => {
+            const secondary = projectThrownFailureLeaf(leaf);
+            return {
+                cause: secondary.cause,
+                diagnostic: secondary.diagnostic,
+                ...(secondary.identity === undefined ? {} : { identity: secondary.identity }),
+                ...(secondary.details === undefined ? {} : { details: secondary.details }),
+            };
+        }),
+    ];
+    return {
+        cause: primary.cause,
+        diagnostic: primary.diagnostic,
+        ...(primary.identity === undefined ? {} : { identity: primary.identity }),
+        details: {
+            ...(primary.details ?? {}),
+            concurrentFailures,
+        },
+    };
+}
+/** Merge caller-owned secondary evidence into a classified failure without washing path facts. */
+function withKnownDetails(failure, knownDetails) {
+    if (knownDetails === undefined)
+        return failure;
+    const { timedOut: _knownTimedOut, ...rest } = knownDetails;
+    return {
+        ...failure,
+        details: {
+            ...rest,
+            ...(failure.details ?? {}),
+        },
+    };
+}
+/**
+ * Classify a controlled post-admission failure without washing unrecognized identities.
+ * Cause classes are closed; diagnostic text retains the original identity when known.
+ *
+ * Order: thrown → knownCause → timeout → activation (nonzero) → session → output.
+ * knownCause precedes timeout so a co-present typed provider/session identity is not
+ * washed when the child also timed out. Cause is never inferred from stderr wording.
+ * AggregateError concurrent leaves keep primary identity and secondary facts in details.
+ */
+export function classifyPostAdmissionFailure(input) {
+    // Own-key presence, not value: `throw undefined` is a real caught exception.
+    if (Object.hasOwn(input, "thrown")) {
+        return classifyThrownFailure(input.thrown);
+    }
+    if (input.knownCause !== undefined) {
+        const fallback = input.knownCause === "provider"
+            ? "provider failure"
+            : input.knownCause === "session"
+                ? "session unreadable"
+                : input.knownCause === "output"
+                    ? "role run completed without a lawful typed terminal result"
+                    : `role run failed (${input.knownCause})`;
+        const diagnostic = input.knownDiagnostic !== undefined && input.knownDiagnostic.trim() !== ""
+            ? input.knownDiagnostic
+            : conciseChildDiagnostic(input.stderr, fallback);
+        const { timedOut: _knownTimedOut, ...knownDetails } = input.knownDetails ?? {};
+        const remoteCode = knownDetails.code;
+        return {
+            cause: input.knownCause,
+            diagnostic,
+            details: {
+                ...knownDetails,
+                ...(remoteCode === undefined ? {} : { code: remoteCode }),
+                exitCode: input.code,
+                ...(input.timedOut ? { timedOut: true } : {}),
+            },
+            ...(input.knownIdentity === undefined
+                ? {}
+                : { identity: input.knownIdentity }),
+        };
+    }
+    if (input.timedOut) {
+        return withKnownDetails({
+            cause: "timeout",
+            diagnostic: "role run timed out",
+            details: { timedOut: true, exitCode: input.code },
+        }, input.knownDetails);
+    }
+    if (input.code !== 0) {
+        const fallback = `role run failed with exit ${input.code ?? "null"}`;
+        return withKnownDetails({
+            cause: "activation",
+            diagnostic: conciseChildDiagnostic(input.stderr, fallback),
+            details: { exitCode: input.code },
+        }, input.knownDetails);
+    }
+    if (input.session?.state === "missing") {
+        return withKnownDetails({
+            cause: "session",
+            diagnostic: "role run left no readable session transcript",
+            details: { exitCode: input.code, session: "missing" },
+        }, input.knownDetails);
+    }
+    if (input.session?.state === "unreadable") {
+        return withKnownDetails({
+            cause: "session",
+            diagnostic: input.session.diagnostic,
+            details: { exitCode: input.code, session: "unreadable" },
+        }, input.knownDetails);
+    }
+    return withKnownDetails({
+        cause: "output",
+        diagnostic: "role run completed without a lawful typed terminal result",
+        details: { exitCode: input.code },
+    }, input.knownDetails);
+}
+/** One projection owner for the four audited public runners. */
+export function explicitInternalKnownFailureClassificationInput(failure) {
+    if (failure === undefined)
+        return {};
+    return {
+        knownCause: failure.cause,
+        ...(failure.identity === undefined ? {} : { knownIdentity: failure.identity }),
+        ...(failure.diagnostic === undefined ? {} : { knownDiagnostic: failure.diagnostic }),
+        ...(failure.details === undefined ? {} : { knownDetails: failure.details }),
+    };
+}
+/** Post-role Navigator delivery grace (Issue #11 / #101 / #106 / #159). */
+export const NAVIGATOR_POST_ROLE_GRACE_MS = 10_000;
+function isMissingPathError(error) {
+    return (error instanceof Error &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+/**
+ * Preserve session-read failure identity as a typed session cause.
+ * SyntaxError keeps its name so durable settlement does not wash malformed JSONL
+ * into generic output absence.
+ */
+function sessionReadFailure(error, fallbackMessage) {
+    if (error instanceof SyntaxError) {
+        const failed = new SyntaxError(error.message || fallbackMessage);
+        failed.knownCause = "session";
+        return failed;
+    }
+    if (error instanceof Error) {
+        const failed = new Error(error.message || error.name || fallbackMessage);
+        failed.name = error.name || "Error";
+        failed.knownCause = "session";
+        const code = error.code;
+        if (typeof code === "string" || typeof code === "number") {
+            failed.failureCode = code;
+            failed.code = code;
+        }
+        return failed;
+    }
+    const failed = new Error(String(error));
+    failed.knownCause = "session";
+    return failed;
+}
+/**
+ * Read the exact bound Pi session file principal.
+ * Does not scan the session directory for "latest" — resume identity is the file.
+ */
+async function readBoundSessionEntries(sessionFile) {
+    const text = await readFile(sessionFile, "utf8");
+    const entries = [];
+    for (const line of text.trim().split("\n").filter(Boolean)) {
+        try {
+            entries.push(JSON.parse(line));
+        }
+        catch (error) {
+            throw sessionReadFailure(error, "malformed session JSONL");
+        }
+    }
+    return entries;
+}
+function typedHttpStatusFromMessage(message) {
+    for (const candidate of [message.httpStatus, message.statusCode, message.status]) {
+        if (typeof candidate === "number" && (candidate < 200 || candidate >= 300))
+            return candidate;
+    }
+    return undefined;
+}
+function sessionProviderStopFromAssistant(message) {
+    if (message?.role !== "assistant")
+        return undefined;
+    if (message.stopReason !== "error" && message.stopReason !== "aborted")
+        return undefined;
+    const httpStatus = typedHttpStatusFromMessage(message);
+    return {
+        stopReason: message.stopReason,
+        // Preserve held errorMessage bytes — emptiness check must not rewrite.
+        ...(typeof message.errorMessage === "string" && message.errorMessage.trim() !== ""
+            ? { errorMessage: message.errorMessage }
+            : {}),
+        ...(typeof message.provider === "string" && message.provider.trim() !== ""
+            ? { provider: message.provider }
+            : {}),
+        ...(typeof message.model === "string" && message.model.trim() !== ""
+            ? { model: message.model }
+            : {}),
+        ...(typeof message.api === "string" && message.api.trim() !== ""
+            ? { api: message.api }
+            : {}),
+        ...(typeof message.rawStopReason === "string" && message.rawStopReason.trim() !== ""
+            ? { rawStopReason: message.rawStopReason }
+            : {}),
+        ...(message.diagnostics === undefined ? {} : { diagnostics: message.diagnostics }),
+        ...(httpStatus === undefined ? {} : { httpStatus }),
+        ...(message.body === undefined ? {} : { body: message.body }),
+        ...(message.code === undefined ? {} : { code: message.code }),
+        ...(message.errno === undefined ? {} : { errno: message.errno }),
+    };
+}
+export function extractSessionProviderStop(entries) {
+    // A resumed dispatch appends a typed top-level user turn to the same session.
+    // Older attempt native stops must not replace the newer attempt's stop.
+    // Sessions without a user turn are the initial attempt.
+    // Auditor retained responses live in Sitian (kind=auditor); see readSessionProviderStop.
+    let attemptStart = 0;
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (entry?.type === "message" && entry.message?.role === "user") {
+            attemptStart = i;
+            break;
+        }
+    }
+    for (let i = entries.length - 1; i >= attemptStart; i -= 1) {
+        const entry = entries[i];
+        if (entry?.type !== "message")
+            continue;
+        const message = entry.message;
+        if (message?.role !== "assistant")
+            continue;
+        // Latest assistant in the current attempt only (reviewer-child-executor lastAssistant pattern).
+        return sessionProviderStopFromAssistant(message);
+    }
+    return undefined;
+}
+/**
+ * Latest Sitian-retained auditor response stop for this parent session principal.
+ * Writer: retainComplianceResponse → sitianReport(kind=auditor, payload={version,response}).
+ * Payload stopReason is preserved as retained — aborted stays aborted; no 500/error wash here.
+ */
+async function readSitianRetainedAuditorProviderStop(sessionFile) {
+    try {
+        const { recordFile } = resolveSitianRecordPath({
+            level: "event",
+            kind: "auditor",
+            sessionParent: sessionFile,
+            // Path is driven by sessionParent when under ledger home; cwd is a fallback only.
+            cwd: dirname(sessionFile),
+        });
+        const { records } = await readSitianRecords(recordFile);
+        for (let i = records.length - 1; i >= 0; i -= 1) {
+            const payload = records[i]?.payload;
+            if (!isRecord(payload) || !isRecord(payload.response))
+                continue;
+            // Lifecycle events carry `type` (binding / compliance_failure); retain does not.
+            if (typeof payload.type === "string")
+                continue;
+            const stop = sessionProviderStopFromAssistant(payload.response);
+            if (stop !== undefined)
+                return stop;
+            // Latest retain exists but is not a provider-stop — do not scan older retains
+            // (mirrors former session COMPLIANCE_RESPONSE preference break).
+            break;
+        }
+    }
+    catch {
+        // Missing volume or unreadable path is absence, not a settlement failure.
+    }
+    return undefined;
+}
+/** Read retained auditor stop (Sitian) then native session assistant stop, if any. */
+export async function readSessionProviderStop(sessionFile) {
+    const retained = await readSitianRetainedAuditorProviderStop(sessionFile);
+    if (retained !== undefined)
+        return retained;
+    try {
+        const entries = await readBoundSessionEntries(sessionFile);
+        return extractSessionProviderStop(entries);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Recover a provider stop from Reviewer fixed-axis evidence children bound to this parent.
+ * Dispatch runs during activation before the parent model turn; leg failures leave durable
+ * stops under session/evidence-children/ and must not wash into generic activation.
+ */
+export async function readBoundEvidenceChildKnownFailure(sessionFile) {
+    const childDirectory = join(dirname(sessionFile), "evidence-children");
+    let names;
+    try {
+        names = await readdir(childDirectory);
+    }
+    catch (error) {
+        if (isMissingPathError(error))
+            return undefined;
+        throw sessionReadFailure(error, "failed to read bound evidence-child session directory");
+    }
+    for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
+        let entries;
+        try {
+            entries = await readBoundSessionEntries(join(childDirectory, file));
+        }
+        catch (error) {
+            throw sessionReadFailure(error, "failed to read discovered evidence-child session");
+        }
+        const header = entries.find((entry) => entry.type === "session");
+        if (!isRecord(header) || header.parentSession !== sessionFile)
+            continue;
+        const stop = extractSessionProviderStop(entries);
+        if (stop === undefined)
+            continue;
+        const primary = knownFailureFromProviderStop(stop);
+        return {
+            ...primary,
+            details: {
+                ...(primary.details ?? {}),
+                secondaryEvidence: "evidence-child",
+            },
+        };
+    }
+    return undefined;
+}
+async function loadBoundAuditorVolumes(sessionFile) {
+    let parentEntries;
+    try {
+        parentEntries = await readBoundSessionEntries(sessionFile);
+    }
+    catch (error) {
+        if (isMissingPathError(error))
+            return undefined;
+        throw sessionReadFailure(error, "failed to read parent session for auditor binding");
+    }
+    const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
+    if (parentId === undefined)
+        return undefined;
+    const RESUME_ENVELOPE = RESUME_TRANSPORT_ENVELOPE;
+    // Keyed prefix on the transport token line only (#600 / 8e767152). Resume may
+    // append engine handbook presentation after the token; settlement must not
+    // treat those prose lines as a real user turn or key on their shape.
+    const isResumeEnvelopeBytes = (value) => {
+        if (typeof value !== "string")
+            return false;
+        const nl = value.indexOf("\n");
+        const firstLine = nl === -1 ? value : value.slice(0, nl);
+        return firstLine === RESUME_ENVELOPE;
+    };
+    const isResumeEnvelope = (msg) => {
+        if (!isRecord(msg) || msg.role !== "user")
+            return false;
+        const text = typeof msg.text === "string" ? msg.text : typeof msg.content === "string" ? msg.content : undefined;
+        if (isResumeEnvelopeBytes(text))
+            return true;
+        const content = msg.content;
+        if (Array.isArray(content)) {
+            return content.some((p) => isRecord(p) && (isResumeEnvelopeBytes(p.text) || isResumeEnvelopeBytes(p.content)));
+        }
+        return false;
+    };
+    let latestParentUserIndex = -1;
+    for (let i = parentEntries.length - 1; i >= 0; i -= 1) {
+        const entry = parentEntries[i];
+        if (entry?.type !== "message" || entry.message?.role !== "user")
+            continue;
+        if (isResumeEnvelope(entry.message))
+            continue;
+        latestParentUserIndex = i;
+        break;
+    }
+    const childDirectories = [join(dirname(sessionFile), "auditor-roles")];
+    // Auto-resume seam (owner A): stale check must ignore resume envelope and
+    // prioritize retention. Previous `attemptEntryIndex < latest` discarded the
+    // first attempt's child after resume advanced latest, losing retentionFailure
+    // when retry had no compliance entry. Fix: ignore envelope for staleness and
+    // prefer any valid compliance failure before falling back to primary.
+    const valid = [];
+    let sawAnyDirectory = false;
+    for (const childDirectory of childDirectories) {
+        let names;
+        try {
+            names = await readdir(childDirectory);
+            sawAnyDirectory = true;
+        }
+        catch (error) {
+            if (isMissingPathError(error))
+                continue;
+            throw sessionReadFailure(error, "failed to read bound auditor session directory");
+        }
+        for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
+            let entries;
+            try {
+                entries = await readBoundSessionEntries(join(childDirectory, file));
+            }
+            catch (error) {
+                throw sessionReadFailure(error, "failed to read discovered auditor session");
+            }
+            const header = entries.find((entry) => entry.type === "session");
+            if (!isRecord(header))
+                continue;
+            // Parent-attempt binding owns its interval on multi-attempt volumes
+            // (never whole-volume provider/compliance).
+            const bindingIndexes = [];
+            for (let i = 0; i < entries.length; i += 1) {
+                const entry = entries[i];
+                if (entry?.type === "custom" && entry.customType === AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE) {
+                    bindingIndexes.push(i);
+                }
+            }
+            const bindingPasses = bindingIndexes.length > 0
+                ? bindingIndexes.map((start, idx) => ({
+                    entry: entries[start],
+                    start,
+                    end: idx + 1 < bindingIndexes.length ? bindingIndexes[idx + 1] : entries.length,
+                }))
+                : [{ entry: undefined, start: 0, end: entries.length }];
+            for (const { entry: bindingEntry, start, end } of bindingPasses) {
+                const bindingParent = bindingEntry !== undefined &&
+                    isRecord(bindingEntry.data) &&
+                    isRecord(bindingEntry.data.parent)
+                    ? bindingEntry.data.parent
+                    : undefined;
+                const attemptEntryId = typeof bindingParent?.attemptEntryId === "string"
+                    ? bindingParent.attemptEntryId
+                    : undefined;
+                const attemptEntryIndex = attemptEntryId === undefined
+                    ? -1
+                    : parentEntries.findIndex((entry) => entry.id === attemptEntryId);
+                const boundSessionFile = typeof bindingParent?.sessionFile === "string"
+                    ? bindingParent.sessionFile
+                    : typeof header.parentSession === "string"
+                        ? header.parentSession
+                        : undefined;
+                if (boundSessionFile !== sessionFile)
+                    continue;
+                if (bindingParent !== undefined &&
+                    (bindingParent.sessionId !== parentId || attemptEntryIndex < latestParentUserIndex)) {
+                    continue;
+                }
+                if (bindingParent === undefined && header.parentSession !== sessionFile)
+                    continue;
+                valid.push({
+                    entries: entries.slice(start, end),
+                    parentId,
+                    sessionFile,
+                    ...(attemptEntryId === undefined ? {} : { attemptEntryId }),
+                });
+                // Keep every qualifying interval in the current parent-user range.
+                // A single first-match break drops later same-user summons failures (#636).
+            }
+        }
+    }
+    if (!sawAnyDirectory && valid.length === 0)
+        return undefined;
+    return valid;
+}
+function complianceFailureFromAuditorVolumes(volumes) {
+    for (const { entries, attemptEntryId, parentId, sessionFile } of volumes) {
+        const stop = extractSessionProviderStop(entries);
+        if (stop === undefined)
+            continue;
+        for (let i = entries.length - 1; i >= 0; i -= 1) {
+            const entry = entries[i];
+            if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord(entry.data))
+                continue;
+            const parent = isRecord(entry.data.parent) ? entry.data.parent : undefined;
+            const failure = isRecord(entry.data.failure) ? entry.data.failure : undefined;
+            if (parent?.sessionId !== parentId || parent.sessionFile !== sessionFile || parent.attemptEntryId !== attemptEntryId || (failure?.cause !== "provider" && failure?.cause !== "unrecognized"))
+                continue;
+            const identity = isRecord(failure.identity) ? failure.identity : undefined;
+            return {
+                cause: failure.cause === "provider" ? "provider" : "unrecognized",
+                ...(identity === undefined ? {} : { identity: {
+                        ...(typeof identity.name === "string" ? { name: identity.name } : {}),
+                        ...(typeof identity.code === "string" || typeof identity.code === "number" ? { code: identity.code } : {}),
+                    } }),
+                ...(typeof failure.diagnostic === "string" ? { diagnostic: failure.diagnostic } : {}),
+                ...(isRecord(failure.details) ? { details: failure.details } : {}),
+            };
+        }
+    }
+    return undefined;
+}
+function providerStopFallbackFromAuditorVolumes(volumes) {
+    for (const { entries } of volumes) {
+        const stop = extractSessionProviderStop(entries);
+        if (stop === undefined)
+            continue;
+        const primary = knownFailureFromProviderStop(stop);
+        return {
+            ...primary,
+            details: {
+                ...(primary.details ?? {}),
+                secondaryEvidence: "unavailable",
+            },
+        };
+    }
+    return undefined;
+}
+/** Recover a provider stop from the auditor child bound to the current parent attempt. */
+export async function readBoundAuditorKnownFailure(sessionFile) {
+    const volumes = await loadBoundAuditorVolumes(sessionFile);
+    if (volumes === undefined)
+        return undefined;
+    return complianceFailureFromAuditorVolumes(volumes)
+        ?? providerStopFallbackFromAuditorVolumes(volumes);
+}
+/** Strong auditor tier only — retained compliance-failure entries, no provider-stop fallback. */
+async function readBoundAuditorComplianceFailure(sessionFile) {
+    const volumes = await loadBoundAuditorVolumes(sessionFile);
+    if (volumes === undefined)
+        return undefined;
+    return complianceFailureFromAuditorVolumes(volumes);
+}
+/** Weaker auditor tier: provider stop without a retained compliance-failure entry. */
+async function readBoundAuditorProviderStopFallback(sessionFile) {
+    const volumes = await loadBoundAuditorVolumes(sessionFile);
+    if (volumes === undefined)
+        return undefined;
+    return providerStopFallbackFromAuditorVolumes(volumes);
+}
+function typedFailedTerminatingToolKnownFailure(entries) {
+    let attemptStart = 0;
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        if (entries[i]?.type === "message" && entries[i]?.message?.role === "user") {
+            attemptStart = i;
+            break;
+        }
+    }
+    const attemptEntries = entries.slice(attemptStart);
+    for (let i = attemptEntries.length - 1; i >= 0; i -= 1) {
+        const message = attemptEntries[i]?.message;
+        if (attemptEntries[i]?.type !== "message" || message?.role !== "toolResult")
+            continue;
+        const classification = classifyPackagedRoleTerminalResult(message);
+        if (classification.kind !== "infrastructure")
+            continue;
+        if (typeof message.toolCallId !== "string" || typeof message.toolName !== "string")
+            continue;
+        if (boundRoleToolCallForResult(attemptEntries, i, message, message.toolName) === undefined)
+            continue;
+        const textPart = Array.isArray(message.content)
+            ? message.content.find((part) => isRecord(part) && part.type === "text" && typeof part.text === "string")
+            : undefined;
+        const diagnostic = isRecord(textPart) ? textPart.text : undefined;
+        // Durable details already carry fact + typed evidence from envelope one-shot projection (#475).
+        // Do not re-parse retained compliance responses here.
+        // Host infrastructure must NOT map to cause=output — that cause is reserved for
+        // shape-unreadable retained candidates (ADR 0055 / #675 producer→consumer diversion).
+        const details = isRecord(message.details) ? message.details : classification.fact;
+        return {
+            cause: "activation",
+            identity: { name: message.toolName, code: message.toolCallId },
+            ...(typeof diagnostic === "string" && diagnostic.trim() !== "" ? { diagnostic } : {}),
+            details,
+        };
+    }
+    return undefined;
+}
+function resolutionOf(knownFailure, typedHttp = { settled: false }) {
+    return {
+        ...(knownFailure === undefined ? {} : { knownFailure }),
+        ...(typedHttp.observation === undefined ? {} : { typedHttpObservation: typedHttp.observation }),
+        typedHttpObservationSettled: typedHttp.settled,
+    };
+}
+/** Sole evidence-priority owner for public runners with Soul auditors. */
+export async function resolveAuditedRunnerFailureResolution(input) {
+    if (input.runner !== undefined)
+        return resolutionOf(input.runner);
+    if (input.runDirectory !== undefined) {
+        try {
+            const rejection = await readReviewerDispatchRejection(input.runDirectory);
+            if (rejection !== undefined)
+                return resolutionOf(rejection);
+        }
+        catch (error) {
+            const failure = error instanceof Error ? error : new Error(String(error));
+            return resolutionOf({
+                cause: "activation",
+                identity: thrownIdentity(failure),
+                diagnostic: failure.message || failure.name,
+            });
+        }
+    }
+    // Bound auditor compliance-failure retention outranks a parent failure that the
+    // auditor path itself caused (retention EISDIR race). A typed terminating-tool
+    // host failure is next — it outranks weaker auditor provider-stop fallback so
+    // parent failInfrastructure abort pollution cannot wash a real diagnostic (#475).
+    try {
+        const auditorCompliance = await readBoundAuditorComplianceFailure(input.sessionFile);
+        if (auditorCompliance !== undefined)
+            return resolutionOf(auditorCompliance);
+    }
+    catch (error) {
+        const failure = sessionReadFailure(error, "failed to recover bound auditor failure");
+        return resolutionOf({
+            cause: "session",
+            identity: thrownIdentity(failure),
+            diagnostic: failure.message || failure.name,
+        });
+    }
+    try {
+        const terminatingFailure = typedFailedTerminatingToolKnownFailure(await readBoundSessionEntries(input.sessionFile));
+        if (terminatingFailure !== undefined)
+            return resolutionOf(terminatingFailure);
+    }
+    catch (error) {
+        if (!isMissingPathError(error)) {
+            const failure = sessionReadFailure(error, "failed to recover typed terminating-tool failure");
+            return resolutionOf({
+                cause: "session",
+                identity: thrownIdentity(failure),
+                diagnostic: failure.message || failure.name,
+            });
+        }
+    }
+    try {
+        const auditorStop = await readBoundAuditorProviderStopFallback(input.sessionFile);
+        if (auditorStop !== undefined)
+            return resolutionOf(auditorStop);
+    }
+    catch (error) {
+        const failure = sessionReadFailure(error, "failed to recover bound auditor provider stop");
+        return resolutionOf({
+            cause: "session",
+            identity: thrownIdentity(failure),
+            diagnostic: failure.message || failure.name,
+        });
+    }
+    // Reviewer axis evidence-children are next: fixed two-axis dispatch fails
+    // during activation with only child stops durable. Parent stop remains the
+    // fallback; credential is last.
+    try {
+        const evidenceChildFailure = await readBoundEvidenceChildKnownFailure(input.sessionFile);
+        if (evidenceChildFailure !== undefined)
+            return resolutionOf(evidenceChildFailure);
+    }
+    catch (error) {
+        const failure = sessionReadFailure(error, "failed to recover bound evidence-child failure");
+        return resolutionOf({
+            cause: "session",
+            identity: thrownIdentity(failure),
+            diagnostic: failure.message || failure.name,
+        });
+    }
+    const parentStop = await readSessionProviderStop(input.sessionFile);
+    // Typed HTTP observation: ENOENT=absence; other read/parse/shape failures keep real cause.
+    // This is the single sidecar read for both knownFailure projection and v1 resume.
+    let httpObservation;
+    if (input.runDirectory !== undefined) {
+        try {
+            httpObservation = await readLatestTypedProviderHttpObservation(input.runDirectory);
+        }
+        catch (error) {
+            const failure = error instanceof Error ? error : new Error(String(error));
+            return resolutionOf({
+                cause: "session",
+                identity: thrownIdentity(failure),
+                diagnostic: failure.message || failure.name,
+            }, { settled: true });
+        }
+    }
+    const typedHttp = {
+        settled: input.runDirectory !== undefined,
+        ...(httpObservation === undefined ? {} : { observation: httpObservation }),
+    };
+    if (parentStop === undefined) {
+        if (input.credential !== undefined)
+            return resolutionOf(input.credential, typedHttp);
+        if (httpObservation === undefined)
+            return resolutionOf(undefined, typedHttp);
+        // Project the HTTP observation's status + provider/source association.
+        return resolutionOf(knownFailureFromProviderStop({
+            stopReason: "error",
+            httpStatus: httpObservation.httpStatus,
+            provider: httpObservation.provider,
+        }), typedHttp);
+    }
+    return resolutionOf(knownFailureFromProviderStop({
+        ...parentStop,
+        ...(httpObservation === undefined
+            ? {}
+            : {
+                httpStatus: httpObservation.httpStatus,
+                // Observation association outranks session-configured provider name alone.
+                provider: httpObservation.provider,
+            }),
+    }), typedHttp);
+}
+/** Sole evidence-priority owner for public runners with Soul auditors. */
+export async function resolveAuditedRunnerKnownFailure(input) {
+    return (await resolveAuditedRunnerFailureResolution(input)).knownFailure;
+}
+/**
+ * v1 resume observation for controlled-failure settlement — at most one sidecar read.
+ * Prefer the pre-resolved outcome from resolveAuditedRunnerFailureResolution.
+ * Non-absence failures never throw: they return observationReadFailure for the
+ * existing controlled-failure → error.json chain.
+ */
+export async function resolveControlledFailureResumeObservation(input) {
+    if (input.typedHttpObservationSettled === true) {
+        const observation = input.typedHttpObservation;
+        if (observation !== undefined &&
+            observation.httpStatus === 429 &&
+            isV1ResumableProvider(observation.provider)) {
+            return {
+                typedHttp429: { httpStatus: 429, provider: observation.provider },
+            };
+        }
+        return {};
+    }
+    try {
+        const typedHttp429 = await readTypedHttp429Observation(input.runDirectory);
+        return typedHttp429 === undefined ? {} : { typedHttp429 };
+    }
+    catch (error) {
+        const failure = error instanceof Error ? error : new Error(String(error));
+        return {
+            observationReadFailure: {
+                cause: "session",
+                identity: thrownIdentity(failure),
+                diagnostic: failure.message || failure.name,
+            },
+        };
+    }
+}
+/** Spread into presentControlledFailure failureInput from one audited resolution. */
+export function controlledFailureInputFromResolution(resolution) {
+    return {
+        ...(resolution.knownFailure === undefined ? {} : { knownFailure: resolution.knownFailure }),
+        ...(resolution.typedHttpObservationSettled
+            ? {
+                typedHttpObservationSettled: true,
+                ...(resolution.typedHttpObservation === undefined
+                    ? {}
+                    : { typedHttpObservation: resolution.typedHttpObservation }),
+            }
+            : {}),
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function safelyRead(object, key) {
+    try {
+        return { readable: true, value: object[key] };
+    }
+    catch {
+        return { readable: false };
+    }
+}
+function auditNoReceiptDecisiveFact(candidate) {
+    const projected = safelyRead(candidate, "auditNoReceipt");
+    if (!projected.readable || projected.value === undefined)
+        return {};
+    try {
+        return { auditNoReceipt: parseNoReceiptLifecycleFacts(projected.value) };
+    }
+    catch {
+        return {};
+    }
+}
+/** Typed unreadable audit leg beside accepted parent candidate (ADR 0055 / #675). */
+function auditUnreadableDecisiveFact(candidate) {
+    const projected = safelyRead(candidate, "auditUnreadable");
+    if (!projected.readable || projected.value === undefined)
+        return {};
+    if (typeof projected.value !== "object" || projected.value === null || Array.isArray(projected.value)) {
+        return { auditUnreadable: projected.value };
+    }
+    return { auditUnreadable: projected.value };
+}
+/** Countersign terminal projection — escalate keeps decisionGate; continue keeps fix (#572 / ADR 0074). */
+function countersignDecisiveFacts(verdict, countersignStatus) {
+    const facts = { countersignStatus };
+    if (countersignStatus === "continue") {
+        const fix = safelyRead(verdict, "fix");
+        if (fix.readable && isRecord(fix.value)) {
+            const summary = safelyRead(fix.value, "summary");
+            if (summary.readable && typeof summary.value === "string") {
+                facts.fixSummary = summary.value;
+            }
+        }
+    }
+    if (countersignStatus === "escalate") {
+        const gate = safelyRead(verdict, "decisionGate");
+        if (gate.readable && isRecord(gate.value)) {
+            const question = safelyRead(gate.value, "question");
+            const options = safelyRead(gate.value, "options");
+            if (question.readable && typeof question.value === "string") {
+                facts.decisionQuestion = question.value;
+            }
+            if (options.readable && Array.isArray(options.value)) {
+                facts.decisionOptions = [...options.value];
+            }
+        }
+    }
+    const note = safelyRead(verdict, "note");
+    if (note.readable && note.value !== undefined)
+        facts.note = note.value;
+    const evidence = safelyRead(verdict, "evidence");
+    if (evidence.readable && evidence.value !== undefined)
+        facts.evidence = evidence.value;
+    return facts;
+}
+function judgeDecisiveFacts(verdict, judgeStatus) {
+    const facts = {
+        judgeStatus,
+        ...auditNoReceiptDecisiveFact(verdict),
+        ...auditUnreadableDecisiveFact(verdict),
+    };
+    const statusBase = judgeStatus;
+    if (statusBase === "continue") {
+        const fix = safelyRead(verdict, "fix");
+        if (fix.readable && isRecord(fix.value)) {
+            const summary = safelyRead(fix.value, "summary");
+            if (summary.readable && typeof summary.value === "string") {
+                facts.fixSummary = summary.value;
+            }
+        }
+        const classes = safelyRead(verdict, "classes");
+        if (classes.readable && Array.isArray(classes.value)) {
+            try {
+                facts.classes = classes.value.map((entry) => {
+                    if (!isRecord(entry))
+                        throw new Error("unreadable Judge class");
+                    return {
+                        name: entry.name,
+                        owner: entry.owner,
+                        boundary: entry.boundary,
+                        disposition: entry.disposition,
+                    };
+                });
+                facts.classCount = classes.value.length;
+            }
+            catch {
+                // Optional class material is omitted as a unit when any row is unreadable.
+            }
+        }
+    }
+    if (statusBase === "escalate") {
+        const gate = safelyRead(verdict, "decisionGate");
+        if (gate.readable && isRecord(gate.value)) {
+            const question = safelyRead(gate.value, "question");
+            const options = safelyRead(gate.value, "options");
+            if (question.readable && typeof question.value === "string") {
+                facts.decisionQuestion = question.value;
+            }
+            if (options.readable && Array.isArray(options.value)) {
+                facts.decisionOptions = [...options.value];
+            }
+        }
+    }
+    const note = safelyRead(verdict, "note");
+    if (note.readable && note.value !== undefined)
+        facts.note = note.value;
+    const evidence = safelyRead(verdict, "evidence");
+    if (evidence.readable && evidence.value !== undefined)
+        facts.evidence = evidence.value;
+    return facts;
+}
+function coderDecisiveFacts(output) {
+    const candidate = output;
+    const status = safelyRead(candidate, "status");
+    const facts = {};
+    if (status.readable && typeof status.value === "string")
+        facts.coderStatus = status.value;
+    const statusBase = status.readable && typeof status.value === "string"
+        ? (status.value)
+        : undefined;
+    const remainingScope = safelyRead(candidate, "remainingScope");
+    if (statusBase === "unfinished" && remainingScope.readable && typeof remainingScope.value === "string")
+        facts.remainingScope = remainingScope.value;
+    const reason = safelyRead(candidate, "reason");
+    if (statusBase === "unfinished" && reason.readable && typeof reason.value === "string" && reason.value.trim().length > 0) {
+        facts.reason = reason.value;
+    }
+    const report = safelyRead(candidate, "report");
+    if (report.readable && typeof report.value === "string")
+        facts.reportPresent = report.value.trim().length > 0;
+    return facts;
+}
+function fixerDecisiveFacts(output) {
+    const candidate = output;
+    const status = safelyRead(candidate, "status");
+    const facts = {};
+    if (status.readable && typeof status.value === "string")
+        facts.fixerStatus = status.value;
+    const statusBase = status.readable && typeof status.value === "string"
+        ? (status.value)
+        : undefined;
+    const remainingScope = safelyRead(candidate, "remainingScope");
+    if ((statusBase === "unfinished" || statusBase === "refused") && remainingScope.readable && typeof remainingScope.value === "string")
+        facts.remainingScope = remainingScope.value;
+    const reason = safelyRead(candidate, "reason");
+    if (statusBase === "unfinished" && reason.readable && typeof reason.value === "string" && reason.value.trim().length > 0) {
+        facts.reason = reason.value;
+    }
+    const blockerRead = safelyRead(candidate, "blocker");
+    if (statusBase === "refused" && blockerRead.readable && isRecord(blockerRead.value)) {
+        const cause = safelyRead(blockerRead.value, "cause");
+        if (cause.readable && typeof cause.value === "string")
+            facts.blockerCause = cause.value;
+        const prerequisiteId = safelyRead(blockerRead.value, "prerequisiteId");
+        if (cause.readable && cause.value === "prerequisite_unmet" && prerequisiteId.readable && typeof prerequisiteId.value === "string")
+            facts.prerequisiteId = prerequisiteId.value;
+    }
+    const classResults = safelyRead(candidate, "classResults");
+    if (classResults.readable && Array.isArray(classResults.value)) {
+        const rows = [];
+        const blockers = [];
+        try {
+            for (const entry of classResults.value) {
+                if (!isRecord(entry))
+                    throw new Error("unreadable class result");
+                const name = safelyRead(entry, "name");
+                const disposition = safelyRead(entry, "disposition");
+                if (!name.readable || !disposition.readable)
+                    throw new Error("unreadable class result");
+                rows.push({ name: name.value, disposition: disposition.value });
+                const blocker = safelyRead(entry, "blocker");
+                if (disposition.value === "refused" && blocker.readable && isRecord(blocker.value))
+                    blockers.push(blocker.value);
+            }
+            facts.classResultCount = rows.length;
+            facts.classDispositions = rows;
+            const causes = blockers.flatMap((blocker) => {
+                const cause = safelyRead(blocker, "cause");
+                return cause.readable && typeof cause.value === "string" ? [cause.value] : [];
+            });
+            if (causes.length > 0)
+                facts.blockerCauses = causes;
+            const prerequisiteIds = blockers.flatMap((blocker) => {
+                const cause = safelyRead(blocker, "cause");
+                const id = safelyRead(blocker, "prerequisiteId");
+                return cause.readable && cause.value === "prerequisite_unmet" && id.readable && typeof id.value === "string" ? [id.value] : [];
+            });
+            if (prerequisiteIds.length > 0)
+                facts.prerequisiteIds = prerequisiteIds;
+        }
+        catch {
+            // Optional class projection is omitted as a unit when any row is unreadable.
+        }
+    }
+    const report = safelyRead(candidate, "report");
+    if (report.readable && typeof report.value === "string")
+        facts.reportPresent = report.value.trim().length > 0;
+    return facts;
+}
+function collectorDecisiveFacts(receipt) {
+    const candidate = receipt;
+    const facts = {};
+    for (const key of ["repository", "prNumber", "targetHead", "manifestDigest"]) {
+        const value = safelyRead(candidate, key);
+        if (value.readable && value.value !== undefined)
+            facts[key] = value.value;
+    }
+    const groups = safelyRead(candidate, "groups");
+    if (groups.readable && Array.isArray(groups.value)) {
+        try {
+            facts.groups = groups.value.map((group) => {
+                if (!isRecord(group))
+                    throw new Error("unreadable Collector group");
+                const identity = safelyRead(group, "identity");
+                const attendance = safelyRead(group, "attendance");
+                const materials = safelyRead(group, "materials");
+                const findings = safelyRead(group, "findings");
+                if (!identity.readable || !attendance.readable ||
+                    !materials.readable || !Array.isArray(materials.value) ||
+                    !findings.readable || !Array.isArray(findings.value)) {
+                    throw new Error("unreadable Collector group");
+                }
+                return {
+                    identity: identity.value,
+                    attendance: attendance.value,
+                    materialCount: materials.value.length,
+                    findingCount: findings.value.length,
+                };
+            });
+        }
+        catch { /* omit unreadable optional projection */ }
+    }
+    return facts;
+}
+function doctorDecisiveFacts(output) {
+    const candidate = output;
+    const status = safelyRead(candidate, "status");
+    const facts = {
+        ...auditNoReceiptDecisiveFact(candidate),
+        ...auditUnreadableDecisiveFact(candidate),
+    };
+    if (status.readable && typeof status.value === "string")
+        facts.doctorStatus = status.value;
+    const statusBase = status.readable && typeof status.value === "string"
+        ? (status.value)
+        : undefined;
+    if (statusBase === "refused") {
+        const reason = safelyRead(candidate, "reason");
+        if (reason.readable && reason.value !== undefined)
+            facts.reason = reason.value;
+        const missing = safelyRead(candidate, "missingEvidence");
+        if (missing.readable && Array.isArray(missing.value))
+            facts.missingEvidenceCount = missing.value.length;
+        return facts;
+    }
+    const caseValue = safelyRead(candidate, "case");
+    if (caseValue.readable && isRecord(caseValue.value)) {
+        const issueNumber = safelyRead(caseValue.value, "issueNumber");
+        const runsPath = safelyRead(caseValue.value, "runsPath");
+        if (issueNumber.readable && issueNumber.value !== undefined)
+            facts.issueNumber = issueNumber.value;
+        if (runsPath.readable && runsPath.value !== undefined)
+            facts.runsPath = runsPath.value;
+    }
+    const findings = safelyRead(candidate, "findings");
+    if (findings.readable && Array.isArray(findings.value))
+        facts.findingsCount = findings.value.length;
+    return facts;
+}
+function reviewerAxes(value) {
+    if (!isRecord(value))
+        return [];
+    return ["standards", "spec"].filter((axis) => {
+        const projected = safelyRead(value, axis);
+        return projected.readable && projected.value !== undefined;
+    });
+}
+function reviewerDecisiveFacts(output) {
+    const candidate = output;
+    const status = safelyRead(candidate, "status");
+    const outcomes = safelyRead(candidate, "outcomes");
+    const reports = safelyRead(candidate, "reports");
+    const amendments = safelyRead(candidate, "amendments");
+    const axes = reviewerAxes(outcomes.readable ? outcomes.value : undefined);
+    const reportAxes = reviewerAxes(reports.readable ? reports.value : undefined);
+    // Typed presence only — never copy amendment prose into public facts.
+    const amendmentAxes = reviewerAxes(amendments.readable ? amendments.value : undefined);
+    const acceptedBatch = safelyRead(candidate, "acceptedBatch");
+    const specDisposition = safelyRead(candidate, "specDisposition");
+    const facts = {
+        axes,
+        reportAxes,
+        amendmentAxes,
+        acceptedBatchPresent: acceptedBatch.readable && acceptedBatch.value !== undefined,
+        ...auditNoReceiptDecisiveFact(candidate),
+    };
+    if (status.readable && typeof status.value === "string")
+        facts.reviewerStatus = status.value;
+    if (specDisposition.readable &&
+        (specDisposition.value === "launched" || specDisposition.value === "skipped-missing")) {
+        facts.specDisposition = specDisposition.value;
+    }
+    const diagnostic = safelyRead(candidate, "diagnostic");
+    const statusBase = status.readable && typeof status.value === "string"
+        ? (status.value)
+        : undefined;
+    if (statusBase === "refused" && diagnostic.readable) {
+        facts.diagnosticPresent = typeof diagnostic.value === "string" && diagnostic.value.trim().length > 0;
+    }
+    return facts;
+}
+/**
+ * ADR 0037: a shape-valid Collector receipt may still name the wrong live target.
+ * Public success binds receipt identity to this admitted repository/PR/request manifest
+ * at the existing settlement seam — not a second receipt factory or validator.
+ */
+function collectorReceiptBindingFailure(diagnostic) {
+    const error = new Error(diagnostic);
+    error.name = "CollectorReceiptBindingError";
+    error.knownCause = "output";
+    return error;
+}
+function toolResultText(message) {
+    const content = message.content;
+    if (typeof content === "string")
+        return content.trim();
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((part) => {
+        if (typeof part === "object" &&
+            part !== null &&
+            !Array.isArray(part) &&
+            typeof part.text === "string") {
+            return part.text;
+        }
+        return "";
+    })
+        .join("")
+        .trim();
+}
+function boundErroredToolCandidate(entries, resultIndex, message, toolName) {
+    if (message.toolName !== toolName || message.isError !== true)
+        return undefined;
+    const bound = boundRoleToolCallForResult(entries, resultIndex, message, toolName);
+    const diagnostic = toolResultText(message);
+    return bound === undefined || diagnostic === ""
+        ? undefined
+        : { candidate: bound.candidate, diagnostic, callIndex: bound.callIndex };
+}
+/** Collector operational tools that fail closed via host infrastructure abort. */
+const COLLECTOR_INFRASTRUCTURE_TOOLS = new Set([
+    COLLECTOR_OBSERVE_TOOL,
+    COLLECTOR_READ_TOOL,
+    COLLECTOR_REQUEST_TOOL,
+    COLLECTOR_WAIT_TOOL,
+]);
+const COLLECTOR_INFRASTRUCTURE_FAILURE_SPEC = {
+    matchTool: (toolName) => COLLECTOR_INFRASTRUCTURE_TOOLS.has(toolName),
+    cause: "activation",
+    identityName: "CollectorInfrastructureError",
+    // read alone has a correctable rejection mode (unknown/non-openable pointers);
+    // only its typed infrastructure-failure fact counts as a real host failure.
+    requireInfrastructureFact: (toolName) => toolName === COLLECTOR_READ_TOOL,
+};
+const ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC = {
+    matchTool: (toolName) => toolName === ENGINE_DETOUR_TOOL_NAME,
+    cause: "output",
+    identityName: "EngineDetourInfrastructureError",
+};
+/**
+ * Prefer a real infrastructure tool failure already on the session principal
+ * over a later secondary provider-stop (failure-honesty).
+ * Tool match + cause + identity are call-site parameters — one extraction body.
+ */
+function extractInfrastructureToolFailure(entries, spec) {
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (entry?.type !== "message")
+            continue;
+        const message = entry.message;
+        if (message?.role !== "toolResult")
+            continue;
+        if (message.isError !== true)
+            continue;
+        if (typeof message.toolName !== "string" ||
+            !spec.matchTool(message.toolName)) {
+            continue;
+        }
+        if (spec.requireInfrastructureFact?.(message.toolName) === true) {
+            if (!hasNavigatorInfrastructureFailureBase(message.details))
+                continue;
+        }
+        const diagnostic = toolResultText(message);
+        if (diagnostic.length === 0)
+            continue;
+        return {
+            cause: spec.cause,
+            diagnostic,
+            identity: { name: spec.identityName },
+        };
+    }
+    return undefined;
+}
+/**
+ * Read the bound session principal for a parameterized infrastructure tool failure.
+ * `currentAttemptOnly` bounds the reverse scan to the latest top-level user turn
+ * so a prior attempt's residual cannot mask the current failure (#633).
+ */
+async function readInfrastructureToolFailure(sessionFile, spec, options = {}) {
+    try {
+        let entries = await readBoundSessionEntries(sessionFile);
+        if (options.currentAttemptOnly === true) {
+            entries = entries.slice(currentAttemptStartIndex(entries));
+        }
+        return extractInfrastructureToolFailure(entries, spec);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Prefer a real Collector infrastructure tool failure already on the session
+ * principal over a later secondary provider-stop (failure-honesty).
+ * Observe/request/wait host failures keep their diagnostic identity (e.g. HTTP 404).
+ */
+export function extractCollectorInfrastructureFailure(entries) {
+    return extractInfrastructureToolFailure(entries, COLLECTOR_INFRASTRUCTURE_FAILURE_SPEC);
+}
+/** Read the bound session principal for a Collector infrastructure tool failure. */
+export async function readCollectorInfrastructureFailure(sessionFile) {
+    return readInfrastructureToolFailure(sessionFile, COLLECTOR_INFRASTRUCTURE_FAILURE_SPEC, 
+    // Multi-attempt resume: only a current-attempt infrastructure failure
+    // may preempt the current failure cause (#633).
+    { currentAttemptOnly: true });
+}
+/**
+ * Prefer a real engine-detour infrastructure tool failure already on the session
+ * principal over a later secondary provider-stop (failure-honesty / #357 T2).
+ * Cause stays `output` — labor leg failed before accepted typed Receipt.
+ */
+export function extractEngineDetourInfrastructureFailure(entries) {
+    return extractInfrastructureToolFailure(entries, ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC);
+}
+/** Read the bound session principal for an engine-detour infrastructure failure. */
+export async function readEngineDetourInfrastructureFailure(sessionFile) {
+    return readInfrastructureToolFailure(sessionFile, ENGINE_DETOUR_INFRASTRUCTURE_FAILURE_SPEC);
+}
+/**
+ * Compare a validated receipt with the admitted Collector invocation identity.
+ * Throws a typed output failure when any identity field mismatches.
+ */
+export function assertCollectorReceiptMatchesAdmitted(receipt, admitted) {
+    if (receipt.repository !== admitted.repository.canonical) {
+        throw collectorReceiptBindingFailure(`Collector receipt repository "${receipt.repository}" does not match admitted repository "${admitted.repository.canonical}"`);
+    }
+    if (receipt.prNumber !== admitted.prNumber) {
+        throw collectorReceiptBindingFailure(`Collector receipt prNumber ${receipt.prNumber} does not match admitted prNumber ${admitted.prNumber}`);
+    }
+    if (receipt.manifestDigest !== admitted.manifestDigest) {
+        throw collectorReceiptBindingFailure(`Collector receipt manifestDigest does not match admitted manifestDigest`);
+    }
+}
+function auditToolNameForRole(role) {
+    switch (role) {
+        case "judge":
+            return JUDGE_AUDIT_TOOL_NAME;
+        case "doctor":
+            return DOCTOR_AUDIT_TOOL_NAME;
+    }
+}
+function boundRoleToolCallForResult(entries, resultIndex, message, outputToolName) {
+    const callId = message.toolCallId;
+    if (typeof callId !== "string" || callId.trim() === "")
+        return undefined;
+    const calls = [];
+    let resultCount = 0;
+    let matchingResultIndex = -1;
+    for (let index = 0; index < entries.length; index += 1) {
+        const candidateMessage = entries[index]?.message;
+        if (candidateMessage?.role === "assistant" &&
+            Array.isArray(candidateMessage.content)) {
+            for (const part of candidateMessage.content) {
+                if (!isRecord(part) || part.type !== "toolCall" || part.id !== callId) {
+                    continue;
+                }
+                if (part.name !== outputToolName)
+                    return undefined;
+                calls.push({ callIndex: index, candidate: part.arguments });
+            }
+        }
+        if (candidateMessage?.role === "toolResult" &&
+            candidateMessage.toolCallId === callId) {
+            resultCount += 1;
+            if (candidateMessage.toolName !== outputToolName)
+                return undefined;
+            matchingResultIndex = index;
+        }
+    }
+    // A binding is an event-bound one-to-one relation, not a reverse lookup of
+    // whichever result happens to be last in the session.
+    return calls.length === 1 && resultCount === 1 && matchingResultIndex === resultIndex
+        && calls[0].callIndex < resultIndex
+        ? calls[0]
+        : undefined;
+}
+function sameAuditValue(left, right) {
+    if (Object.is(left, right))
+        return true;
+    if (Array.isArray(left) && Array.isArray(right)) {
+        return left.length === right.length && left.every((value, index) => sameAuditValue(value, right[index]));
+    }
+    if (isRecord(left) && isRecord(right)) {
+        const leftKeys = Object.keys(left);
+        const rightKeys = Object.keys(right);
+        return leftKeys.length === rightKeys.length &&
+            leftKeys.every((key) => Object.hasOwn(right, key) && sameAuditValue(left[key], right[key]));
+    }
+    return false;
+}
+/** Snapshot the exact enumerable string face that final Terminal projection uses. */
+function snapshotAuditDetails(details) {
+    const snapshot = Object.create(null);
+    for (const key of Object.keys(details)) {
+        Object.defineProperty(snapshot, key, {
+            value: details[key],
+            enumerable: true,
+            configurable: true,
+            writable: true,
+        });
+    }
+    return snapshot;
+}
+/**
+ * Bind the public escalation face to the one retained response that sits inside
+ * the same role output call/result interval. A `kind` field alone is never a
+ * terminal identity; the retained response must be this seat's real escalate
+ * decision and its projected audit-owned fields must agree with it.
+ */
+function boundAuditEscalationForResult(entries, resultIndex, message, role, outputToolName) {
+    const roleCall = boundRoleToolCallForResult(entries, resultIndex, message, outputToolName);
+    if (roleCall === undefined)
+        return undefined;
+    const retained = boundRetainedAuditResponse(entries, roleCall.callIndex, resultIndex, auditToolNameForRole(role));
+    if (retained === undefined)
+        return undefined;
+    try {
+        const decision = readComplianceCandidate(retained.candidate);
+        if (decision.status !== "escalate")
+            return undefined;
+        const details = message.details;
+        if (!isAuditEscalationResult(details) || !isRecord(details))
+            return undefined;
+        // Read the public face exactly once. Besides making key enumeration and
+        // getters fail closed, this prevents a stateful accessor from authenticating
+        // one value and yielding another during final Terminal projection.
+        const projectedDetails = snapshotAuditDetails(details);
+        const hasDecisionConflicts = Object.hasOwn(decision, "conflicts");
+        const hasDetailsConflicts = Object.hasOwn(projectedDetails, "conflicts");
+        if (hasDecisionConflicts !== hasDetailsConflicts)
+            return undefined;
+        if (hasDecisionConflicts && !sameAuditValue(projectedDetails.conflicts, decision.conflicts))
+            return undefined;
+        const hasDecisionGate = Object.hasOwn(decision, "decisionGate");
+        const hasDetailsGate = Object.hasOwn(projectedDetails, "auditDecisionGate");
+        if (hasDecisionGate !== hasDetailsGate)
+            return undefined;
+        if (hasDecisionGate && !sameAuditValue(projectedDetails.auditDecisionGate, decision.decisionGate))
+            return undefined;
+        return { decision, details: projectedDetails };
+    }
+    catch {
+        // Retained/public own-key enumeration, property reads, recursive equality,
+        // and projection are all untrusted session evidence.
+        return undefined;
+    }
+}
+function isUnboundAuditEscalationFace(details) {
+    try {
+        if (isAuditEscalationResult(details))
+            return true;
+    }
+    catch {
+        // Hostile access is not authentic escalation evidence.
+    }
+    if (!isRecord(details))
+        return false;
+    const kind = safelyRead(details, "kind");
+    return kind.readable && kind.value === "audit_escalation";
+}
+function boundRetainedAuditResponse(entries, callIndex, resultIndex, auditToolName) {
+    const matches = [];
+    for (let index = callIndex + 1; index < resultIndex; index += 1) {
+        const entry = entries[index];
+        if (entry?.type !== "custom" || entry.customType !== COMPLIANCE_RESPONSE_ENTRY_TYPE) {
+            continue;
+        }
+        if (!isRecord(entry.data) || !isRecord(entry.data.response))
+            continue;
+        const response = entry.data.response;
+        if (!Array.isArray(response.content))
+            continue;
+        const calls = response.content.filter((part) => isRecord(part) && part.type === "toolCall");
+        if (calls.length !== 1 || calls[0]?.name !== auditToolName)
+            continue;
+        matches.push({ candidate: calls[0]?.arguments });
+    }
+    // Unique seat-bound match binds even when multi-turn investigation retained
+    // intermediate non-decision responses in the same call/result interval.
+    return matches.length === 1 ? matches[0] : undefined;
+}
+/**
+ * #419 per-attempt process history. 史必追加，指针可覆盖；指针可以覆盖的前提是史已落。
+ * Reuses the run session principal's append-only JSONL custom-entry shape
+ * (plain custom entries are state records and never enter LLM context), so no
+ * second ledger mechanism is introduced.
+ */
+export const ATTEMPT_HISTORY_ENTRY_TYPE = "ak_run_attempt_history";
+/**
+ * Append one attempt's complete result to the run's session principal.
+ * Append failure throws — callers must not overwrite a pointer artifact when
+ * the history entry backing the overwrite did not land (fail closed).
+ */
+export async function appendRunAttemptHistory(source, outcome) {
+    const entries = await readBoundSessionEntries(source.sessionFile);
+    let parentId = null;
+    let priorEntries = 0;
+    for (const entry of entries) {
+        if (typeof entry.id === "string" && entry.type !== "session")
+            parentId = entry.id;
+        if (entry.type === "custom" &&
+            entry.customType === ATTEMPT_HISTORY_ENTRY_TYPE) {
+            priorEntries += 1;
+        }
+    }
+    const timestamp = new Date().toISOString();
+    const attemptData = {
+        sequence: priorEntries + 1,
+        role: source.role,
+        runId: source.runId,
+        recordedAt: timestamp,
+        outcome,
+    };
+    const line = `${JSON.stringify({
+        type: "custom",
+        customType: ATTEMPT_HISTORY_ENTRY_TYPE,
+        data: attemptData,
+        id: randomUUID(),
+        parentId,
+        timestamp,
+    })}\n`;
+    await appendFile(source.sessionFile, line, "utf8");
+    try {
+        sitianReport({
+            level: "event",
+            kind: "attempt-history",
+            subject: { runId: source.runId },
+            sessionParent: source.sessionFile,
+            payload: {
+                type: ATTEMPT_HISTORY_ENTRY_TYPE,
+                ...attemptData,
+            },
+            source: "settlement",
+        });
+    }
+    catch { }
+}
+function navigatorPhaseValue(value) {
+    if (value === "plan" || value === "apply")
+        return value;
+    return null;
+}
+/**
+ * Minimal attendance provenance against the bound marker (ADR 0043).
+ * Keep only invocationId + post-terminal ordering. Runtime-self-produced
+ * role/phase/subject/version are not re-reconciled here (ADR 0042).
+ */
+function navigatorAttendanceCorrelatedWithBoundMarker(details, attendanceIndex, terminalIndex, marker) {
+    if (attendanceIndex <= terminalIndex)
+        return false;
+    // Exact current invocation token is the bound marker principal.
+    if (details.invocationId !== marker.invocationId)
+        return false;
+    return true;
+}
+function parseNavigatorAttendanceDetails(details) {
+    const disposition = details.disposition;
+    const advisoryDiagnostic = typeof details.routePlaybookReadFailure === "string"
+        ? { advisoryDiagnostic: details.routePlaybookReadFailure }
+        : {};
+    if (disposition === "recommendation") {
+        const next = details.next;
+        if (!isRecord(next) || typeof next.role !== "string") {
+            return {
+                disposition: "unavailable",
+                source: "unknown",
+                reason: "navigator recommendation missing typed next role",
+            };
+        }
+        const reason = typeof details.reason === "string" ? details.reason : "";
+        const route = Array.isArray(details.route)
+            ? details.route
+                .filter(isRecord)
+                .map((target) => ({
+                role: String(target.role),
+                phase: navigatorPhaseValue(target.phase),
+            }))
+            : undefined;
+        return recommendationNavigatorFact({
+            ...advisoryDiagnostic,
+            next: {
+                role: next.role,
+                phase: navigatorPhaseValue(next.phase),
+            },
+            reason,
+            ...(route === undefined ? {} : { route }),
+            ...(typeof details.command === "string"
+                ? { modelCommand: details.command }
+                : {}),
+        });
+    }
+    if (disposition === "unavailable") {
+        return {
+            disposition: "unavailable",
+            ...advisoryDiagnostic,
+            source: typeof details.unavailableSource === "string"
+                ? details.unavailableSource
+                : "unknown",
+            reason: typeof details.unavailableReason === "string"
+                ? details.unavailableReason
+                : "Navigator unavailable",
+        };
+    }
+    // arrival and legacy silence both mean affirmative lawful no next-role advice.
+    if (disposition === "no-advice" || disposition === "arrival" || disposition === "silence") {
+        return {
+            disposition: "no-advice",
+            ...advisoryDiagnostic,
+        };
+    }
+    return {
+        disposition: "unavailable",
+        source: "unknown",
+        reason: "Navigator attendance disposition is unparseable",
+    };
+}
+/**
+ * Project direct and historical paired gate rounds onto the public Terminal.
+ * actualSeats derive only from accepted receipts, never expected/missing seats.
+ */
+export function projectTerminalGateFact(rounds) {
+    if (rounds.length === 0)
+        return undefined;
+    const seen = new Set();
+    for (const round of rounds) {
+        if (round.origin.kind === "historical_dispatch")
+            seen.add("gatekeeper");
+        seen.add(round.officer);
+    }
+    const actualSeats = ["gatekeeper", "inspector", "notary"].filter((seat) => seen.has(seat));
+    return {
+        actualSeats,
+        rounds: rounds.map((round) => ({
+            roundIndex: round.roundIndex,
+            dispatch: round.origin.kind === "direct"
+                ? { kind: "direct", officer: round.officer }
+                : {
+                    kind: "historical_dispatch",
+                    officer: round.officer,
+                    ...(round.origin.reason === undefined
+                        ? {}
+                        : { reason: round.origin.reason }),
+                },
+            officer: {
+                seat: round.officer,
+                status: round.status,
+                findings: round.findings,
+            },
+        })),
+    };
+}
+/**
+ * Read gate facts from the run's session/auditor-roles nest (#446/#478).
+ * Missing directories → undefined (no-gate zero change).
+ * Damaged discovered volumes propagate — never wash to "no gate".
+ */
+export async function extractGateFactFromSessionDirectory(sessionDirectory, options = {}) {
+    const directories = [join(sessionDirectory, "auditor-roles")];
+    const parentSessionFile = options.parentSessionFile ?? join(sessionDirectory, "session.jsonl");
+    const rounds = await readAnalystGateCyclesFromAuditorRoles(directories, {
+        parentSessionFile,
+    });
+    return projectTerminalGateFact(rounds);
+}
+/**
+ * Attach optional gate projection onto a settled Terminal base.
+ * Shared by every settle path so auditor-roles is scanned once here only.
+ * `runId` is not required — resumable failures omit it by contract.
+ * Gate read damage propagates with its real identity (never washed to no-gate
+ * or swallowed); callers that already hold a controlled failure still surface the
+ * JSONL/session cause rather than pretend the gate was absent.
+ */
+async function withOptionalGateProjection(base, sessionDirectory, gateContext = {}) {
+    // A gate transport failure is already represented by typed evidence and has no
+    // accepted gate cycle to project. Re-reading that rejected receipt as an
+    // accepted cycle would replace the original failure with a projection error.
+    const secondaryEvidence = base.roleOutcome.kind === "failure"
+        ? base.roleOutcome.decisiveFacts.secondaryEvidence
+        : undefined;
+    if (isRecord(secondaryEvidence)
+        && secondaryEvidence.kind === "role_infrastructure_failure"
+        && (secondaryEvidence.stage === "gatekeeper"
+            || secondaryEvidence.stage === "inspector"
+            || secondaryEvidence.stage === "notary"))
+        return base;
+    // Defaults live solely in extractGateFactFromSessionDirectory — do not re-derive.
+    const gate = await extractGateFactFromSessionDirectory(sessionDirectory, gateContext);
+    return gate === undefined ? base : { ...base, gate };
+}
+export function extractNavigatorFact(entries) {
+    // Affirmative attendance only. Missing / uncorrelated / unparseable is never no-advice.
+    // Minimal provenance: latest durable terminal + nearest preceding marker +
+    // invocationId + post-terminal order. Marker↔terminal cardinality belongs to
+    // receipt settlement (isReceiptSettlementBindingClear), not attendance extraction.
+    const terminal = findLatestDurablePackagedRoleTerminal(entries);
+    if (terminal === undefined) {
+        return {
+            disposition: "unavailable",
+            source: "unknown",
+            reason: "Navigator attendance has no durable packaged role terminal",
+        };
+    }
+    let markerIndex = -1;
+    for (let i = terminal.index - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (entry?.type === "custom" && entry.customType === NAVIGATOR_INVOCATION_ENTRY) {
+            markerIndex = i;
+            break;
+        }
+    }
+    if (markerIndex < 0) {
+        return {
+            disposition: "unavailable",
+            source: "unknown",
+            reason: "Navigator attendance is uncorrelated with session invocation facts",
+        };
+    }
+    const marker = parseInvocationMarkerIdentity(entries[markerIndex]?.data);
+    if (marker === undefined) {
+        return {
+            disposition: "unavailable",
+            source: "unknown",
+            reason: "Navigator attendance is uncorrelated with session invocation facts",
+        };
+    }
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (entry?.type === "custom_message" && entry.customType === "ak-navigator-attendance") {
+            const details = entry.message?.details ?? entry.details;
+            if (!isRecord(details)) {
+                return {
+                    disposition: "unavailable",
+                    source: "unknown",
+                    reason: "Navigator attendance is unparseable",
+                };
+            }
+            if (!navigatorAttendanceCorrelatedWithBoundMarker(details, i, terminal.index, marker)) {
+                return {
+                    disposition: "unavailable",
+                    source: "unknown",
+                    reason: "Navigator attendance is uncorrelated with session invocation facts",
+                };
+            }
+            return parseNavigatorAttendanceDetails(details);
+        }
+    }
+    // Absence is not successful no-advice — require affirmative typed attendance.
+    return {
+        disposition: "unavailable",
+        source: "unknown",
+        reason: "Navigator attendance is missing from the session",
+    };
+}
+/**
+ * Exact-session Navigator fact for failure Terminal settlement.
+ * Never infers no-advice from omission; session read failures stay typed unavailable
+ * so the controlled-failure Terminal itself still settles.
+ */
+async function extractNavigatorFactFromAdmittedSession(sessionFile) {
+    try {
+        const entries = await readBoundSessionEntries(sessionFile);
+        return extractNavigatorFact(entries);
+    }
+    catch (error) {
+        if (isMissingPathError(error)) {
+            return {
+                disposition: "unavailable",
+                source: "unknown",
+                reason: "Navigator attendance is missing from the session",
+            };
+        }
+        return {
+            disposition: "unavailable",
+            source: "unknown",
+            reason: "Navigator attendance is unavailable because the session could not be read",
+        };
+    }
+}
+export async function publishJudgeArtifacts(admitted, roleOutcome, coordinates) {
+    // #419: history first — report/evidence stay last-write-wins views only
+    // because every attempt's complete result has already been appended.
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "judge",
+        runId: admitted.runId,
+        outcome: roleOutcome,
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+/**
+ * Publish lawful Coder success Artifacts on the shared #106 success interface.
+ * Evidence records package method provenance without ambient home Skill paths.
+ */
+export async function publishCoderArtifacts(admitted, roleOutcome, coordinates, options = {}) {
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "coder",
+        runId: admitted.runId,
+        phase: admitted.phase,
+        outcome: roleOutcome,
+        ...(options.coderOutput === undefined
+            ? {}
+            : { receipt: options.coderOutput }),
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        role: "coder",
+        phase: admitted.phase,
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        taskPath: admitted.taskPath,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+        ...(options.methodProvenance === undefined
+            ? {}
+            : { methodProvenance: options.methodProvenance }),
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+/**
+ * Read session entries for lawful settlement. Missing path → undefined (absence).
+ * Malformed JSONL / other read failures throw with knownCause=session.
+ */
+async function readLawfulSettlementEntries(sessionFile) {
+    try {
+        return await readBoundSessionEntries(sessionFile);
+    }
+    catch (error) {
+        // Missing path is absence of a lawful outcome; callers classify via session inspect.
+        if (isMissingPathError(error))
+            return undefined;
+        // Malformed JSONL and other read failures keep typed session identity.
+        throw error instanceof Error &&
+            error.knownCause === "session"
+            ? error
+            : sessionReadFailure(error, "session unreadable");
+    }
+}
+/**
+ * Lawful Judge outcome presence only — no artifact publication.
+ * Returns undefined for genuine absence (missing path / no lawful verdict).
+ * Session-read failures propagate with typed identity.
+ */
+export async function readLawfulJudgeRoleOutcome(admitted, authority) {
+    const sealed = await sealedLedgerOutcome(admitted);
+    if (sealed?.role === "judge") {
+        const details = sealed.decisiveFacts;
+        // sealed.status is the sole authority (written by acceptedFacts at seal).
+        return {
+            kind: "accepted",
+            role: "judge",
+            status: sealed.status,
+            decisiveFacts: judgeDecisiveFacts(details, sealed.status),
+        };
+    }
+    // Non-final: consume ledger audit-escalation projection (no JSONL accepted rebuild).
+    return auditEscalationLedgerOutcome(admitted, "judge");
+}
+/**
+ * Single lawful-settlement implementation (session → outcome/Navigator/artifacts).
+ *
+ * - Returns undefined only for genuine absence (missing session path, or no
+ *   lawful verdict in an otherwise readable session).
+ * - Malformed JSONL / other session-read failures throw with knownCause=session
+ *   and original identity (SyntaxError name retained).
+ * - Artifact publication failures propagate with their original typed identity.
+ * - Lawful outcome presence is decided before publication so a later write error
+ *   cannot erase the fact that a lawful result already exists.
+ */
+async function settleLawfulJudgeTerminalResult(admitted, authority) {
+    const roleOutcome = await readLawfulJudgeRoleOutcome(admitted, authority);
+    if (roleOutcome === undefined)
+        return undefined;
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+    const navigator = extractNavigatorFact(entries);
+    // Lawful outcome exists — artifact publication keeps original errno/name.
+    const artifacts = await publishJudgeArtifacts(admitted, roleOutcome, coordinates);
+    return withOptionalGateProjection({
+        roleOutcome,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, coordinates.sessionDirectory);
+}
+/**
+ * Settle a lawful typed terminal result from the admitted session.
+ * Throws when no lawful outcome is present (tests/callers that require success).
+ * Session-read and publication failures retain their typed identity.
+ */
+export async function settleJudgeTerminalResult(admitted, authority) {
+    const settled = await settleLawfulJudgeTerminalResult(admitted, authority);
+    if (settled === undefined) {
+        throw new Error("Judge Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/**
+ * Try to settle a lawful typed terminal result from the admitted session.
+ * Returns undefined only for genuine absence (no lawful verdict / missing path).
+ * Session malformation and publication exceptions propagate with typed identity.
+ */
+export async function trySettleJudgeTerminalResult(admitted, authority) {
+    return settleLawfulJudgeTerminalResult(admitted, authority);
+}
+async function settleLawfulCoderTerminalResult(admitted, authority, options = {}) {
+    const ledgerOutcome = await closedLedgerOutcome(admitted, "coder");
+    if (ledgerOutcome === undefined)
+        return undefined;
+    let roleOutcome = ledgerOutcome;
+    let output;
+    if (ledgerOutcome.kind === "accepted") {
+        output = validateAcceptedCoderDetails(ledgerOutcome.decisiveFacts);
+        roleOutcome = {
+            kind: "accepted",
+            role: "coder",
+            status: ledgerOutcome.status,
+            decisiveFacts: coderDecisiveFacts(output),
+        };
+    }
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+    const navigator = extractNavigatorFact(entries);
+    const artifacts = await publishCoderArtifacts(admitted, roleOutcome, coordinates, {
+        ...(output === undefined ? {} : { coderOutput: output }),
+        ...(options.methodProvenance === undefined
+            ? {}
+            : { methodProvenance: options.methodProvenance }),
+    });
+    return withOptionalGateProjection({
+        roleOutcome,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, coordinates.sessionDirectory);
+}
+/** Settle a lawful Coder Terminal from the admitted session (shared #106 success interface). */
+export async function settleCoderTerminalResult(admitted, authority, options = {}) {
+    const settled = await settleLawfulCoderTerminalResult(admitted, authority, options);
+    if (settled === undefined) {
+        throw new Error("Coder Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+function sessionMessageText(message) {
+    if (message === undefined)
+        return "";
+    if (typeof message.content === "string")
+        return message.content;
+    if (!Array.isArray(message.content))
+        return "";
+    const parts = [];
+    for (const part of message.content) {
+        if (typeof part === "object" &&
+            part !== null &&
+            !Array.isArray(part) &&
+            part.type === "text" &&
+            typeof part.text === "string") {
+            parts.push(part.text);
+        }
+    }
+    return parts.join("\n");
+}
+/**
+ * Observe optional Fixer diagnosing-bugs Skill expansions from the session.
+ * Availability is always package-bound; invocation is recorded only when observed.
+ */
+export function extractFixerMethodInvocations(entries, options) {
+    const observed = [];
+    for (const entry of entries) {
+        if (entry?.type !== "message")
+            continue;
+        const message = entry.message;
+        if (message?.role !== "user")
+            continue;
+        const text = sessionMessageText(message);
+        if (text.length === 0)
+            continue;
+        const hit = observePackagedMethodSkillInvocation(text, {
+            name: "diagnosing-bugs",
+            allowedLocations: options.allowedLocations,
+        });
+        if (hit !== undefined)
+            observed.push(hit);
+    }
+    return Object.freeze(observed);
+}
+/**
+ * Publish lawful Fixer success Artifacts on the shared #106 success interface.
+ * Evidence records package diagnosis provenance and optional observed invocation.
+ */
+export async function publishFixerArtifacts(admitted, roleOutcome, coordinates, options) {
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "fixer",
+        runId: admitted.runId,
+        phase: admitted.phase,
+        outcome: roleOutcome,
+        ...(options.fixerOutput === undefined
+            ? {}
+            : { receipt: options.fixerOutput }),
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        role: "fixer",
+        phase: admitted.phase,
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        packetPath: admitted.packetPath,
+        ...(admitted.prerequisitesPath === undefined
+            ? {}
+            : { prerequisitesPath: admitted.prerequisitesPath }),
+        prerequisites: admitted.prerequisites,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+        methodProvenance: options.methodProvenance,
+        // Optional diagnosis: availability is package-bound; invocation only when observed.
+        methodInvocationObserved: (options.methodInvocations ?? []).length > 0,
+        methodInvocations: options.methodInvocations ?? [],
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+async function settleLawfulFixerTerminalResult(admitted, authority, options) {
+    const ledgerOutcome = await closedLedgerOutcome(admitted, "fixer");
+    if (ledgerOutcome === undefined)
+        return undefined;
+    let roleOutcome = ledgerOutcome;
+    let output;
+    if (ledgerOutcome.kind === "accepted") {
+        output = validateFixerOutput(ledgerOutcome.decisiveFacts);
+        roleOutcome = {
+            kind: "accepted",
+            role: "fixer",
+            status: ledgerOutcome.status,
+            decisiveFacts: fixerDecisiveFacts(output),
+        };
+    }
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    const entries = await readLawfulSettlementEntries(sessionFile) ?? [];
+    const navigator = extractNavigatorFact(entries);
+    const methodInvocations = extractFixerMethodInvocations(entries, {
+        allowedLocations: [
+            options.methodSkillPath,
+            options.methodSkillConfiguredPath,
+        ],
+    });
+    const artifacts = await publishFixerArtifacts(admitted, roleOutcome, coordinates, {
+        ...(output === undefined ? {} : { fixerOutput: output }),
+        methodProvenance: options.methodProvenance,
+        methodInvocations,
+    });
+    return withOptionalGateProjection({
+        roleOutcome,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+/** Settle a lawful Fixer Terminal from the admitted session (shared #106 success interface). */
+export async function settleFixerTerminalResult(admitted, authority, options) {
+    const settled = await settleLawfulFixerTerminalResult(admitted, authority, options);
+    if (settled === undefined) {
+        throw new Error("Fixer Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+export async function publishCollectorArtifacts(admitted, roleOutcome, coordinates, options = {}) {
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "collector",
+        runId: admitted.runId,
+        outcome: roleOutcome,
+        ...(options.collectorReceipt === undefined
+            ? {}
+            : { receipt: options.collectorReceipt }),
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        role: "collector",
+        prNumber: admitted.prNumber,
+        repository: admitted.repository.canonical,
+        manifestDigest: admitted.manifestDigest,
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+async function settleLawfulCollectorTerminalResult(admitted, authority) {
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    const entries = await readLawfulSettlementEntries(sessionFile) ?? [];
+    const roleOutcome = await sealedLedgerOutcome(admitted);
+    if (roleOutcome?.role !== "collector") {
+        // Bounded to the current attempt so multi-attempt resume timeout/no-output
+        // is not masked by a prior wait-tool residual (#633).
+        const scanStart = currentAttemptStartIndex(entries);
+        for (let index = entries.length - 1; index >= scanStart; index -= 1) {
+            const message = entries[index]?.message;
+            if (message?.role !== "toolResult")
+                continue;
+            const residual = boundErroredToolCandidate(entries, index, message, COLLECTOR_WAIT_TOOL);
+            if (residual === undefined)
+                continue;
+            const candidate = residual.candidate;
+            const duration = isRecord(candidate) ? candidate.durationMs : undefined;
+            if (Number.isSafeInteger(duration) && duration >= 1 && duration <= 900_000) {
+                continue;
+            }
+            return {
+                roleOutcome: buildResidualIncompleteTerminalOutcome({
+                    role: "collector",
+                    candidate,
+                    diagnostic: residual.diagnostic,
+                }),
+                navigator: { disposition: "no-advice" },
+                artifacts: [],
+                runId: admitted.runId,
+            };
+        }
+        return undefined;
+    }
+    const receipt = validateAcceptedCollectorReceipt(roleOutcome.decisiveFacts);
+    assertCollectorReceiptMatchesAdmitted(receipt, admitted);
+    const accepted = {
+        kind: "accepted",
+        role: "collector",
+        status: roleOutcome.status,
+        decisiveFacts: collectorDecisiveFacts(receipt),
+    };
+    const navigator = extractNavigatorFact(entries);
+    const artifacts = await publishCollectorArtifacts(admitted, accepted, coordinates, { collectorReceipt: receipt });
+    return withOptionalGateProjection({
+        roleOutcome: accepted,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+/** Settle a lawful Collector Terminal from the admitted session. */
+export async function settleCollectorTerminalResult(admitted, authority) {
+    const settled = await settleLawfulCollectorTerminalResult(admitted, authority);
+    if (settled === undefined) {
+        throw new Error("Collector Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Collector Terminal; undefined only for genuine absence. */
+export async function trySettleCollectorTerminalResult(admitted, authority) {
+    return settleLawfulCollectorTerminalResult(admitted, authority);
+}
+export async function publishDoctorArtifacts(admitted, roleOutcome, coordinates, options = {}) {
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "doctor",
+        runId: admitted.runId,
+        outcome: roleOutcome,
+        ...(options.doctorOutput === undefined
+            ? {}
+            : { receipt: options.doctorOutput }),
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        role: "doctor",
+        issueNumber: admitted.issueNumber,
+        caseRunsPath: admitted.caseRunsPath,
+        caseIdentity: admitted.caseIdentity,
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+async function settleLawfulDoctorTerminalResult(admitted, authority) {
+    const sealed = await sealedLedgerOutcome(admitted);
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    const entries = await readLawfulSettlementEntries(sessionFile) ?? [];
+    if (sealed?.role !== "doctor") {
+        const escalation = await auditEscalationLedgerOutcome(admitted, "doctor");
+        if (escalation === undefined)
+            return undefined;
+        const artifacts = await publishDoctorArtifacts(admitted, escalation, coordinates);
+        return withOptionalGateProjection({
+            roleOutcome: escalation,
+            navigator: extractNavigatorFact(entries),
+            artifacts,
+            runId: admitted.runId,
+        }, sessionDirectory);
+    }
+    const output = validateRecordedDoctorOutput(sealed.decisiveFacts);
+    const roleOutcome = {
+        kind: "accepted",
+        role: "doctor",
+        status: sealed.status,
+        decisiveFacts: doctorDecisiveFacts(output),
+    };
+    // Bind completed receipt case identity to the admitted Issue evidence case.
+    if (String(output.status) === "completed") {
+        const completedCase = output.case;
+        if (completedCase.issueNumber !== admitted.caseIdentity.issueNumber ||
+            completedCase.runsPath !== admitted.caseIdentity.runsPath) {
+            const error = new Error("Doctor receipt case identity does not match admitted case identity");
+            error.name = "DoctorReceiptBindingError";
+            error.knownCause = "output";
+            throw error;
+        }
+    }
+    const navigator = extractNavigatorFact(entries);
+    const artifacts = await publishDoctorArtifacts(admitted, roleOutcome, coordinates, { doctorOutput: output });
+    return withOptionalGateProjection({
+        roleOutcome,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+/** Settle a lawful Doctor Terminal from the admitted session. */
+export async function settleDoctorTerminalResult(admitted, authority) {
+    const settled = await settleLawfulDoctorTerminalResult(admitted, authority);
+    if (settled === undefined) {
+        throw new Error("Doctor Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Doctor Terminal; undefined only for genuine absence. */
+export async function trySettleDoctorTerminalResult(admitted, authority) {
+    return settleLawfulDoctorTerminalResult(admitted, authority);
+}
+/** Latest top-level user message index; 0 when the session has none (initial attempt). */
+function currentAttemptStartIndex(entries) {
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (entry?.type === "message" && entry.message?.role === "user") {
+            return i;
+        }
+    }
+    return 0;
+}
+async function settleLawfulSeatAcceptedTerminalResult(admitted, authority, spec, scope) {
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    const entries = await readLawfulSettlementEntries(sessionFile) ?? [];
+    const roleOutcome = await closedLedgerOutcome(admitted, spec.role, scope);
+    if (roleOutcome?.kind === "audit_escalation") {
+        const navigator = extractNavigatorFact(entries);
+        return withOptionalGateProjection({
+            roleOutcome,
+            navigator,
+            artifacts: [],
+            runId: admitted.runId,
+        }, sessionDirectory);
+    }
+    if (roleOutcome?.role !== spec.role) {
+        // No usable release → existing non-zero failure channel with candidate (#475 / ADR 0055).
+        // One reverse pass: prefer errored residual; else latest accepted-once non-usable details.
+        // Bounded to the current attempt so multi-attempt resume timeout/no-output
+        // is not masked by a prior residual (#599 / #633).
+        const scanStart = currentAttemptStartIndex(entries);
+        let acceptedNonUsable;
+        for (let index = entries.length - 1; index >= scanStart; index -= 1) {
+            const message = entries[index]?.message;
+            if (message?.role !== "toolResult")
+                continue;
+            const residual = boundErroredToolCandidate(entries, index, message, spec.toolName);
+            if (residual !== undefined) {
+                return settleFailureTerminalResult(admitted, {
+                    cause: "output",
+                    diagnostic: residual.diagnostic,
+                    details: stampShapeUnreadableDetails(residual.candidate),
+                }, authority);
+            }
+            if (acceptedNonUsable === undefined &&
+                message.toolName === spec.toolName &&
+                isAcceptedPackagedRoleTerminalResult(message)) {
+                // Accepted once but not a lawful seat release — hold as fallback.
+                if (!spec.tryAcceptDetails(message.details)) {
+                    acceptedNonUsable = message.details;
+                }
+            }
+        }
+        if (acceptedNonUsable !== undefined) {
+            return settleFailureTerminalResult(admitted, {
+                cause: "output",
+                diagnostic: spec.nonUsableDiagnostic,
+                details: stampShapeUnreadableDetails(acceptedNonUsable),
+            }, authority);
+        }
+        return undefined;
+    }
+    if (!spec.tryAcceptDetails(roleOutcome.decisiveFacts)) {
+        return settleFailureTerminalResult(admitted, {
+            cause: "output",
+            diagnostic: spec.nonUsableDiagnostic,
+            details: stampShapeUnreadableDetails(roleOutcome.decisiveFacts),
+        }, authority);
+    }
+    const acceptedOutcome = spec.projectAccepted(roleOutcome);
+    const navigator = extractNavigatorFact(entries);
+    return withOptionalGateProjection({
+        roleOutcome: acceptedOutcome,
+        navigator,
+        artifacts: [],
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+function tryAcceptWithValidator(validate) {
+    return (details) => {
+        try {
+            validate(details);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+}
+async function settleLawfulNotaryTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "notary",
+        toolName: NOTARY_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "符宝郎回执无显式 pass/bounce/escalate",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedNotaryOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedNotaryOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "notary",
+                status: sealed.status,
+                decisiveFacts: notaryDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+/** Settle a lawful Notary Terminal from the admitted session. */
+export async function settleNotaryTerminalResult(admitted, authority, scope) {
+    const settled = await settleLawfulNotaryTerminalResult(admitted, authority, scope);
+    if (settled === undefined) {
+        throw new Error("Notary Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Notary Terminal; undefined only for genuine absence. */
+export async function trySettleNotaryTerminalResult(admitted, authority, scope) {
+    return settleLawfulNotaryTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulCountersignTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "countersign",
+        toolName: COUNTERSIGN_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "给事中回执无显式 署/封驳/上呈",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedCountersignOutput),
+        projectAccepted: (sealed) => {
+            const verdict = validateRecordedCountersignOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "countersign",
+                status: sealed.status,
+                decisiveFacts: countersignDecisiveFacts(verdict, sealed.status),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+/** Settle a lawful Countersign Terminal from the admitted session. */
+export async function settleCountersignTerminalResult(admitted, authority, scope) {
+    const settled = await settleLawfulCountersignTerminalResult(admitted, authority, scope);
+    if (settled === undefined) {
+        throw new Error("Countersign Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Countersign Terminal; undefined only for genuine absence. */
+export async function trySettleCountersignTerminalResult(admitted, authority, scope) {
+    return settleLawfulCountersignTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulGleanerLeftTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "gleaner-left",
+        toolName: GLEANER_LEFT_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "左拾遗回执无显式 completed",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedGleanerLeftOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedGleanerLeftOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "gleaner-left",
+                status: sealed.status,
+                decisiveFacts: gleanerLeftDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+/** Settle a lawful Gleaner-Left Terminal from the admitted session. */
+export async function settleGleanerLeftTerminalResult(admitted, authority, scope) {
+    const settled = await settleLawfulGleanerLeftTerminalResult(admitted, authority, scope);
+    if (settled === undefined) {
+        throw new Error("Gleaner-Left Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Gleaner-Left Terminal; undefined only for genuine absence. */
+export async function trySettleGleanerLeftTerminalResult(admitted, authority, scope) {
+    return settleLawfulGleanerLeftTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulDiaristTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "diarist",
+        toolName: DIARIST_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "起居郎回执无显式 completed",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedDiaristOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedDiaristOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "diarist",
+                status: sealed.status,
+                decisiveFacts: diaristDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+/** Try to settle a lawful Diarist Terminal; undefined only for genuine absence. */
+export async function trySettleDiaristTerminalResult(admitted, authority, scope) {
+    return settleLawfulDiaristTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulInspectorTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "inspector",
+        toolName: INSPECTOR_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "察院回执无显式 pass/bounce/escalate",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedInspectorOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedInspectorOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "inspector",
+                status: sealed.status,
+                decisiveFacts: inspectorDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+export async function trySettleInspectorTerminalResult(admitted, authority, scope) {
+    return settleLawfulInspectorTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulGatekeeperTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "gatekeeper",
+        toolName: GATEKEEPER_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "门下省决议无显式 dispatch/pass",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedGatekeeperOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedGatekeeperOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "gatekeeper",
+                status: output.status,
+                decisiveFacts: gatekeeperDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+/** Try to settle a lawful Gatekeeper Terminal; undefined only for genuine absence. */
+export async function trySettleGatekeeperTerminalResult(admitted, authority, scope) {
+    return settleLawfulGatekeeperTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulNavigatorTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "navigator",
+        toolName: NAVIGATOR_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "游奕使回执无显式路线建议",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedNavigatorOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedNavigatorOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "navigator",
+                status: "advice",
+                decisiveFacts: navigatorDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+/** Try to settle a lawful Navigator Terminal; undefined only for genuine absence. */
+export async function trySettleNavigatorTerminalResult(admitted, authority, scope) {
+    return settleLawfulNavigatorTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulAuditorTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "auditor",
+        toolName: AUDITOR_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "审刑院回执无显式 pass/revise/escalate",
+        // Only pass/revise/escalate are lawful releases. Unreadable mystery status
+        // fails closed with candidate retained for parent ComplianceCandidateUnreadableError.
+        tryAcceptDetails: (details) => projectLawfulAuditorOutput(details) !== undefined,
+        projectAccepted: (sealed) => {
+            const lawful = projectLawfulAuditorOutput(sealed.decisiveFacts);
+            if (lawful === undefined) {
+                throw new Error("auditor projectAccepted requires lawful pass/revise/escalate");
+            }
+            const accepted = {
+                kind: "accepted",
+                role: "auditor",
+                status: lawful.status,
+                decisiveFacts: auditorDecisiveFacts(lawful),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+export async function trySettleAuditorTerminalResult(admitted, authority, scope) {
+    return settleLawfulAuditorTerminalResult(admitted, authority, scope);
+}
+async function settleLawfulEvidenceChildTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "evidence-child",
+        toolName: EVIDENCE_CHILD_OUTPUT_TOOL_NAME,
+        nonUsableDiagnostic: "取证回执无报告正文",
+        tryAcceptDetails: tryAcceptWithValidator(validateRecordedEvidenceChildOutput),
+        projectAccepted: (sealed) => {
+            const output = validateRecordedEvidenceChildOutput(sealed.decisiveFacts);
+            const accepted = {
+                kind: "accepted",
+                role: "evidence-child",
+                status: "report",
+                decisiveFacts: evidenceChildDecisiveFacts(output),
+            };
+            return accepted;
+        },
+    }, scope);
+}
+export async function trySettleEvidenceChildTerminalResult(admitted, authority, scope) {
+    return settleLawfulEvidenceChildTerminalResult(admitted, authority, scope);
+}
+/** Try to settle a lawful Coder Terminal; undefined only for genuine absence. */
+export async function trySettleCoderTerminalResult(admitted, authority, options = {}) {
+    return settleLawfulCoderTerminalResult(admitted, authority, options);
+}
+/** Try to settle a lawful Fixer Terminal; undefined only for genuine absence. */
+export async function trySettleFixerTerminalResult(admitted, authority, options) {
+    return settleLawfulFixerTerminalResult(admitted, authority, options);
+}
+/**
+ * Observe forced Reviewer code-review Skill expansions from the session.
+ * Expansion evidence is package-path only; ambient home locations never count.
+ */
+export function extractReviewerMethodInvocations(entries, options) {
+    const observed = [];
+    for (const entry of entries) {
+        if (entry?.type !== "message")
+            continue;
+        const message = entry.message;
+        if (message?.role !== "user")
+            continue;
+        const text = sessionMessageText(message);
+        if (text.length === 0)
+            continue;
+        const hit = observePackagedMethodSkillInvocation(text, {
+            name: "code-review",
+            allowedLocations: options.allowedLocations,
+        });
+        if (hit !== undefined)
+            observed.push(hit);
+    }
+    return Object.freeze(observed);
+}
+/**
+ * Publish lawful Reviewer success Artifacts on the shared #106 success interface.
+ * Evidence records package code-review provenance and typed expansion
+ * observation without ambient home Skill paths.
+ */
+export async function publishReviewerArtifacts(admitted, roleOutcome, coordinates, options) {
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "reviewer",
+        runId: admitted.runId,
+        outcome: roleOutcome,
+        ...(options.reviewerReceipt === undefined
+            ? {}
+            : { receipt: options.reviewerReceipt }),
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        role: "reviewer",
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        baseRevision: admitted.baseRevision,
+        authorityRefs: [...admitted.authorityRefs],
+        ...(admitted.instructionEmpty
+            ? {}
+            : { callerProvenance: admitted.instruction }),
+        // Self-fetch Spec bytes + source annotation when primary path produced material (#343).
+        ...(options.reviewerReceipt?.specFetchedMaterial === undefined
+            ? {}
+            : { specFetchedMaterial: options.reviewerReceipt.specFetchedMaterial }),
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+        methodProvenance: options.methodProvenance,
+        // Forced package method: availability is package-bound; expansion only when observed.
+        methodInvocationObserved: (options.methodInvocations ?? []).length > 0,
+        methodInvocations: options.methodInvocations ?? [],
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+async function settleLawfulReviewerTerminalResult(admitted, authority, options) {
+    const sealed = await sealedLedgerOutcome(admitted);
+    if (sealed?.role !== "reviewer")
+        return undefined;
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    const entries = await readLawfulSettlementEntries(sessionFile) ?? [];
+    const receipt = validateRuntimeReviewerReceipt(sealed.decisiveFacts);
+    const roleOutcome = {
+        kind: "accepted",
+        role: "reviewer",
+        status: sealed.status,
+        decisiveFacts: reviewerDecisiveFacts(receipt),
+    };
+    const navigator = extractNavigatorFact(entries);
+    const methodInvocations = extractReviewerMethodInvocations(entries, {
+        allowedLocations: [
+            options.methodSkillPath,
+            options.methodSkillConfiguredPath,
+        ],
+    });
+    const artifacts = await publishReviewerArtifacts(admitted, roleOutcome, coordinates, {
+        reviewerReceipt: receipt,
+        methodProvenance: options.methodProvenance,
+        methodInvocations,
+    });
+    return withOptionalGateProjection({
+        roleOutcome,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+/** Settle a lawful Reviewer Terminal from the admitted session (shared #106 success interface). */
+export async function settleReviewerTerminalResult(admitted, authority, options) {
+    const settled = await settleLawfulReviewerTerminalResult(admitted, authority, options);
+    if (settled === undefined) {
+        throw new Error("Reviewer Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Reviewer Terminal; undefined only for genuine absence. */
+export async function trySettleReviewerTerminalResult(admitted, authority, options) {
+    return settleLawfulReviewerTerminalResult(admitted, authority, options);
+}
+function mergerDecisiveFacts(output) {
+    const candidate = output;
+    const facts = {};
+    const status = safelyRead(candidate, "status");
+    const attemptId = safelyRead(candidate, "attemptId");
+    if (status.readable && typeof status.value === "string")
+        facts.mergerStatus = status.value;
+    if (attemptId.readable && attemptId.value !== undefined)
+        facts.attemptId = attemptId.value;
+    const statusBase = status.readable && typeof status.value === "string"
+        ? (status.value)
+        : undefined;
+    const decisiveKey = statusBase === "completed" ? "mergeCommitId" : "diagnosis";
+    const decisive = safelyRead(candidate, decisiveKey);
+    if (decisive.readable && decisive.value !== undefined)
+        facts[decisiveKey] = decisive.value;
+    return facts;
+}
+/**
+ * Observe forced Merger resolving-merge-conflicts Skill expansions from the session.
+ * Expansion evidence is package-path only; ambient home locations never count.
+ */
+export function extractMergerMethodInvocations(entries, options) {
+    const observed = [];
+    for (const entry of entries) {
+        if (entry?.type !== "message")
+            continue;
+        const message = entry.message;
+        if (message?.role !== "user")
+            continue;
+        const text = sessionMessageText(message);
+        if (text.length === 0)
+            continue;
+        const hit = observePackagedMethodSkillInvocation(text, {
+            name: "resolving-merge-conflicts",
+            allowedLocations: options.allowedLocations,
+        });
+        if (hit !== undefined)
+            observed.push(hit);
+    }
+    return Object.freeze(observed);
+}
+/**
+ * Publish lawful Merger success Artifacts on the shared #106 success interface.
+ * Evidence records package method provenance, forced expansion observation, and
+ * adapter-derived mechanical envelope facts without ambient home Skill paths.
+ */
+export async function publishMergerArtifacts(admitted, roleOutcome, coordinates, options) {
+    await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+    const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
+    const reportPath = join(artifactsDir, "report.json");
+    const evidencePath = join(artifactsDir, "evidence.json");
+    await writeFile(reportPath, `${JSON.stringify({
+        role: "merger",
+        runId: admitted.runId,
+        outcome: roleOutcome,
+        ...(options.mergerOutput === undefined
+            ? {}
+            : { receipt: options.mergerOutput }),
+    }, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify({
+        runId: admitted.runId,
+        role: "merger",
+        sessionDirectory: coordinates.sessionDirectory,
+        sessionFile: coordinates.sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        mergerInputPath: admitted.mergerInputPath,
+        derived: admitted.derived,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+        methodProvenance: options.methodProvenance,
+        methodInvocationObserved: (options.methodInvocations ?? []).length > 0,
+        methodInvocations: options.methodInvocations ?? [],
+    }, null, 2)}\n`, "utf8");
+    return [
+        { kind: "report", path: reportPath },
+        { kind: "evidence", path: evidencePath },
+    ];
+}
+async function settleLawfulMergerTerminalResult(admitted, authority, options) {
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    const entries = await readLawfulSettlementEntries(sessionFile) ?? [];
+    const roleOutcome = await sealedLedgerOutcome(admitted);
+    if (roleOutcome?.role !== "merger") {
+        // Ledger owns 0041: a non-sole closed round is not residual-incomplete material.
+        const latestOutcome = await readLatestSubmissionOutcome(admitted.projectRoot, admitted.runId, sealedLedgerHome(admitted));
+        if (latestOutcome?.outcome === "correctable-rejection" && latestOutcome.code === "non-sole-round") {
+            return undefined;
+        }
+        // Residual incomplete: shape/identity fail after the sole-round barrier passed (ledger typed).
+        // Settlement does not re-judge calls.length.
+        for (let index = entries.length - 1; index >= 0; index -= 1) {
+            const message = entries[index]?.message;
+            if (message?.role !== "toolResult")
+                continue;
+            const residual = boundErroredToolCandidate(entries, index, message, MERGER_OUTPUT_TOOL_NAME);
+            if (residual === undefined)
+                continue;
+            const attemptId = isRecord(residual.candidate)
+                ? safelyRead(residual.candidate, "attemptId")
+                : { readable: true, value: undefined };
+            // Admitted-attempt identity binding only (ADR 0037) — not sole-final cardinality.
+            if (!attemptId.readable || attemptId.value !== admitted.runId)
+                continue;
+            try {
+                validateMergerOutput(residual.candidate, admitted.runId);
+            }
+            catch {
+                return {
+                    roleOutcome: buildResidualIncompleteTerminalOutcome({
+                        role: "merger",
+                        candidate: residual.candidate,
+                        diagnostic: residual.diagnostic,
+                    }),
+                    navigator: { disposition: "no-advice" },
+                    artifacts: [],
+                    runId: admitted.runId,
+                };
+            }
+        }
+        return undefined;
+    }
+    const output = validateMergerOutput(roleOutcome.decisiveFacts, admitted.runId);
+    const accepted = {
+        kind: "accepted",
+        role: "merger",
+        status: roleOutcome.status,
+        decisiveFacts: mergerDecisiveFacts(output),
+    };
+    const methodInvocations = extractMergerMethodInvocations(entries, {
+        allowedLocations: [
+            options.methodSkillPath,
+            options.methodSkillConfiguredPath,
+        ],
+    });
+    // Every invocation must expand the merge-only method before conflict work.
+    if (methodInvocations.length === 0)
+        return undefined;
+    const navigator = extractNavigatorFact(entries);
+    const artifacts = await publishMergerArtifacts(admitted, accepted, coordinates, {
+        mergerOutput: output,
+        methodProvenance: options.methodProvenance,
+        methodInvocations,
+    });
+    return withOptionalGateProjection({
+        roleOutcome: accepted,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+/** Settle a lawful Merger Terminal from the admitted session (shared #106 success interface). */
+export async function settleMergerTerminalResult(admitted, authority, options) {
+    const settled = await settleLawfulMergerTerminalResult(admitted, authority, options);
+    if (settled === undefined) {
+        throw new Error("Merger Role run completed without a lawful typed terminal result");
+    }
+    return settled;
+}
+/** Try to settle a lawful Merger Terminal; undefined only for genuine absence. */
+export async function trySettleMergerTerminalResult(admitted, authority, options) {
+    return settleLawfulMergerTerminalResult(admitted, authority, options);
+}
+function publicationAttemptFromError(path, error) {
+    if (error instanceof Error) {
+        const identity = {
+            name: error.name,
+        };
+        const code = error.code;
+        if (typeof code === "string" || typeof code === "number") {
+            identity.code = code;
+        }
+        return {
+            path,
+            diagnostic: error.message || error.name || "write failed",
+            identity,
+        };
+    }
+    return { path, diagnostic: String(error) };
+}
+/**
+ * Directories eligible for open-ended unique failure-artifact placement.
+ * Always includes the ledger runs/ parent of the run directory so an
+ * unwritable run tree cannot strand the original controlled failure.
+ */
+function uniqueFailureFallbackDirs(runDirectory, baseDir) {
+    const dirs = [];
+    for (const dir of [baseDir, runDirectory, dirname(runDirectory)]) {
+        if (!dirs.includes(dir))
+            dirs.push(dir);
+    }
+    return dirs;
+}
+/**
+ * Resolve a writable artifacts base directory. If `artifacts/` cannot be created
+ * (e.g. a file occupies that name), fall back to the run directory itself.
+ */
+async function resolveFailureArtifactsBase(runDirectory) {
+    const artifactsDir = join(runDirectory, "artifacts");
+    try {
+        await ensureRunArtifactsDir(runDirectory);
+        return { baseDir: artifactsDir };
+    }
+    catch (error) {
+        return {
+            baseDir: runDirectory,
+            attempt: publicationAttemptFromError(artifactsDir, error),
+        };
+    }
+}
+/**
+ * Write JSON across preferred paths, then unique open-ended fallbacks.
+ * Finite fixed names must not be able to exhaust durability and strand the
+ * original controlled failure outside settlement.
+ */
+async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbackDirs, stem, basePayload, priorIssues) {
+    const issues = [...priorIssues];
+    const candidates = [
+        ...preferredCandidates,
+        // One unique name per fallback dir — collisions on fixed names cannot exhaust this.
+        ...uniqueFallbackDirs.map((dir) => join(dir, `${stem}.${randomUUID()}.json`)),
+    ];
+    for (let i = 0; i < candidates.length; i += 1) {
+        const path = candidates[i];
+        const payload = issues.length === 0
+            ? basePayload
+            : { ...basePayload, publicationIssues: issues };
+        try {
+            await writeFile(path, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+            return { path, issues };
+        }
+        catch (error) {
+            issues.push(publicationAttemptFromError(path, error));
+        }
+    }
+    const last = issues.at(-1);
+    const error = new Error(last?.diagnostic ?? "unable to write durable failure artifact");
+    if (last?.identity?.name !== undefined && last.identity.name !== "") {
+        error.name = last.identity.name;
+    }
+    if (last?.identity?.code !== undefined) {
+        error.code = last.identity.code;
+    }
+    error.publicationAttempts = issues;
+    throw error;
+}
+export async function publishFailureArtifacts(admitted, failure, authority) {
+    const { sessionDirectory, sessionFile } = coordinatesFromAdmitted(authority, admitted);
+    const { baseDir, attempt: baseAttempt } = await resolveFailureArtifactsBase(admitted.runDirectory);
+    const priorIssues = baseAttempt === undefined ? [] : [baseAttempt];
+    // #419: each attempt's complete failure result joins the appended history
+    // before any fixed-name artifact view is rewritten. History failure must not
+    // strand the original controlled failure outside settlement — it rides
+    // publicationIssues instead of aborting durability.
+    try {
+        await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile }, {
+            kind: "failure",
+            role: admitted.role,
+            ...failure,
+        });
+    }
+    catch (error) {
+        priorIssues.push(publicationAttemptFromError(sessionFile, error));
+    }
+    // Prefer conventional names; unique fallback dirs keep colliding fixed paths
+    // from stranding the original failure outside settlement. Include the ledger
+    // runs/ parent so a locked run directory (EACCES) cannot exhaust durability.
+    const underArtifacts = baseDir === join(admitted.runDirectory, "artifacts");
+    const uniqueFallbackDirs = uniqueFailureFallbackDirs(admitted.runDirectory, baseDir);
+    const errorCandidates = underArtifacts
+        ? [
+            join(baseDir, "error.json"),
+            join(baseDir, "error.settlement.json"),
+            join(admitted.runDirectory, "error.settlement.json"),
+        ]
+        : [
+            join(baseDir, "error.settlement.json"),
+            join(baseDir, "error.json"),
+        ];
+    const evidenceCandidates = underArtifacts
+        ? [
+            join(baseDir, "evidence.json"),
+            join(baseDir, "evidence.settlement.json"),
+            join(admitted.runDirectory, "evidence.settlement.json"),
+        ]
+        : [
+            join(baseDir, "evidence.settlement.json"),
+            join(baseDir, "evidence.json"),
+        ];
+    const errorPayloadBase = {
+        kind: "error",
+        role: admitted.role,
+        runId: admitted.runId,
+        cause: failure.cause,
+        diagnostic: failure.diagnostic,
+        ...(failure.identity === undefined ? {} : { identity: failure.identity }),
+        ...(failure.details === undefined ? {} : { details: failure.details }),
+    };
+    const errorWrite = await writeFailureJsonRetainingCause(errorCandidates, uniqueFallbackDirs, "error", errorPayloadBase, priorIssues);
+    const evidencePayload = {
+        runId: admitted.runId,
+        sessionDirectory: sessionDirectory,
+        sessionFile: sessionFile,
+        admittedRequestPath: admitted.admittedRequestPath,
+        attachments: admitted.attachments.map((a) => ({
+            provenancePath: a.provenancePath,
+            frozenPath: a.frozenPath,
+            sha256: a.sha256,
+            byteLength: a.byteLength,
+        })),
+        failureCause: failure.cause,
+    };
+    const evidenceWrite = await writeFailureJsonRetainingCause(evidenceCandidates, uniqueFallbackDirs, "evidence", evidencePayload, 
+    // Evidence records the same publication collisions observed placing the error body.
+    errorWrite.issues);
+    return [
+        { kind: "error", path: errorWrite.path },
+        { kind: "evidence", path: evidenceWrite.path },
+    ];
+}
+/**
+ * Durably record a controlled failure (Error Artifact first), then return the
+ * Terminal aggregate. Presentation must happen only after this resolves.
+ */
+/** Redact exact run ID from any string leaves inside decisive facts (arrays/objects included). */
+function redactDecisiveFactValue(value, runId) {
+    if (typeof value === "string")
+        return redactExactRunId(value, runId);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactDecisiveFactValue(entry, runId));
+    }
+    if (typeof value === "object" && value !== null) {
+        const out = {};
+        for (const [key, child] of Object.entries(value)) {
+            out[key] = redactDecisiveFactValue(child, runId);
+        }
+        return out;
+    }
+    return value;
+}
+/** Redact exact run ID from decisive facts at the public Terminal boundary. */
+function redactDecisiveFactsForPublicTerminal(facts, runId) {
+    const out = {};
+    for (const [key, value] of Object.entries(facts)) {
+        out[key] = redactDecisiveFactValue(value, runId);
+    }
+    return out;
+}
+/** Redact exact run ID from navigator free-text fields (reason only; commands are registry-owned). */
+function redactNavigatorFactForPublicTerminal(navigator, runId) {
+    const advisoryDiagnostic = navigator.advisoryDiagnostic === undefined
+        ? {}
+        : { advisoryDiagnostic: redactExactRunId(navigator.advisoryDiagnostic, runId) };
+    if (navigator.disposition === "recommendation") {
+        return {
+            ...navigator,
+            ...advisoryDiagnostic,
+            reason: redactExactRunId(navigator.reason, runId),
+        };
+    }
+    if (navigator.disposition === "unavailable") {
+        return {
+            ...navigator,
+            ...advisoryDiagnostic,
+            reason: redactExactRunId(navigator.reason, runId),
+        };
+    }
+    return { ...navigator, ...advisoryDiagnostic };
+}
+/**
+ * Durably record a controlled failure (Error Artifact first), then return the
+ * Terminal aggregate. Presentation must happen only after this resolves.
+ */
+/**
+ * Shared controlled-failure Terminal settlement (#107 ownership).
+ * Role identity comes from the admitted run; no new failure classes are introduced here.
+ */
+export async function settleFailureTerminalResult(admitted, failure, authority, options = {}) {
+    const coordinates = coordinatesFromAdmitted(authority, admitted);
+    const { sessionDirectory, sessionFile } = coordinates;
+    // #288 is lawful only when the lifecycle owner persisted an exhausted,
+    // current-attempt fact. Transcript reconstruction must not turn arbitrary output
+    // failures (or bytes retained from a prior resume attempt) into exit zero.
+    if (failure.cause === "output") {
+        const entries = await readBoundSessionEntries(sessionFile).catch(() => undefined);
+        if (entries !== undefined) {
+            let attemptStart = 0;
+            for (let index = entries.length - 1; index >= 0; index -= 1) {
+                if (entries[index]?.type === "message" && entries[index]?.message?.role === "user") {
+                    attemptStart = index;
+                    break;
+                }
+            }
+            const lifecycleEntry = entries.slice(attemptStart).reverse().find((entry) => entry.customType === NO_RECEIPT_LIFECYCLE_ENTRY_TYPE || entry.message?.customType === NO_RECEIPT_LIFECYCLE_ENTRY_TYPE);
+            const raw = lifecycleEntry?.data ?? lifecycleEntry?.message?.details;
+            if (raw !== undefined) {
+                try {
+                    const facts = parseNoReceiptLifecycleFacts(raw);
+                    if (facts.runPointer === admitted.runDirectory && facts.attemptPointer === `current:${admitted.runDirectory}`) {
+                        const decisiveFacts = facts;
+                        // #478: no_receipt is still a public Terminal — project accepted gate facts.
+                        return withOptionalGateProjection({
+                            roleOutcome: { kind: "no_receipt", role: admitted.role, status: "no-accepted-receipt", ...facts, decisiveFacts },
+                            navigator: await extractNavigatorFactFromAdmittedSession(sessionFile),
+                            artifacts: [],
+                            runId: admitted.runId,
+                        }, sessionDirectory);
+                    }
+                }
+                catch { /* malformed lifecycle bytes remain the existing nonzero output failure */ }
+            }
+        }
+    }
+    // Exact-session attendance only — never infer no-advice from caller omission.
+    const navigator = await extractNavigatorFactFromAdmittedSession(sessionFile);
+    // Private durable artifacts retain the original diagnostic identity (including run ID).
+    const artifacts = await publishFailureArtifacts(admitted, failure, authority);
+    const decisiveFacts = {
+        cause: failure.cause,
+        diagnostic: failure.diagnostic,
+    };
+    if (failure.identity?.name !== undefined) {
+        decisiveFacts.errorName = failure.identity.name;
+    }
+    if (failure.identity?.code !== undefined) {
+        decisiveFacts.errorCode = failure.identity.code;
+    }
+    if (failure.details !== undefined) {
+        decisiveFacts.secondaryEvidence = failure.details;
+    }
+    // Resumable failures: durable artifacts still land under the run directory, but
+    // the public Terminal must not re-disclose the run ID via top-level runId,
+    // path components, or untrusted free text — only resume.command may carry it
+    // (AC2 / #108).
+    if (options.resume !== undefined) {
+        const publicDiagnostic = redactExactRunId(failure.diagnostic, admitted.runId);
+        const publicFacts = redactDecisiveFactsForPublicTerminal({ ...decisiveFacts, diagnostic: publicDiagnostic }, admitted.runId);
+        const roleOutcome = {
+            kind: "failure",
+            role: admitted.role,
+            cause: failure.cause,
+            diagnostic: publicDiagnostic,
+            decisiveFacts: publicFacts,
+        };
+        // #478: resume desensitization stays; gate is additive typed fact only.
+        return withOptionalGateProjection({
+            roleOutcome,
+            navigator: redactNavigatorFactForPublicTerminal(navigator, admitted.runId),
+            artifacts: [],
+            resume: options.resume,
+        }, sessionDirectory);
+    }
+    const roleOutcome = {
+        kind: "failure",
+        role: admitted.role,
+        cause: failure.cause,
+        diagnostic: failure.diagnostic,
+        decisiveFacts,
+    };
+    // #478: ordinary controlled failure still surfaces accepted gate facts.
+    return withOptionalGateProjection({
+        roleOutcome,
+        navigator,
+        artifacts,
+        runId: admitted.runId,
+    }, sessionDirectory);
+}
+/** Judge-named alias retained for #107 call sites. */
+export async function settleJudgeFailureTerminalResult(admitted, failure, authority, options = {}) {
+    return settleFailureTerminalResult(admitted, failure, authority, options);
+}
+/**
+ * Emit one complete failure Terminal on stdout and one concise stderr diagnostic.
+ * Artifacts are already durable on the TerminalResult.
+ */
+export function presentFailureTerminal(terminal, io) {
+    if (terminal.roleOutcome.kind !== "failure" && terminal.roleOutcome.kind !== "no_receipt") {
+        throw new TypeError("presentFailureTerminal requires a failure or no-receipt role outcome");
+    }
+    io.stdout(formatTerminalResult(terminal));
+    if (terminal.roleOutcome.kind === "failure") {
+        io.stderr(formatFailureStderrDiagnostic({
+            cause: terminal.roleOutcome.cause,
+            diagnostic: terminal.roleOutcome.diagnostic,
+        }));
+    }
+}
+function defaultNavigatorGraceSleep() {
+    let timer;
+    const sleep = ((ms) => new Promise((resolve) => {
+        timer = setTimeout(() => {
+            timer = undefined;
+            resolve();
+        }, ms);
+    }));
+    sleep.cancel = () => {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+    };
+    return sleep;
+}
+/**
+ * Race a promise against the post-role Navigator grace.
+ * On timeout, returns the timeout sentinel; the caller records unavailable and
+ * ignores or disposes late completion.
+ * When work settles first, the grace sleep is canceled synchronously so its
+ * timer/resource cannot keep the process alive after the race resolves.
+ */
+export function raceNavigatorGrace(work, graceMs = NAVIGATOR_POST_ROLE_GRACE_MS, sleep = defaultNavigatorGraceSleep()) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (action) => {
+            if (settled)
+                return;
+            settled = true;
+            sleep.cancel?.();
+            action();
+        };
+        void work.then((value) => finish(() => resolve({ status: "done", value })), (error) => finish(() => reject(error)));
+        void sleep(graceMs).then(() => {
+            finish(() => resolve({ status: "timeout" }));
+        });
+    });
+}