@akagilnc/pi-workflow-roles 0.1.3673 → 0.1.3685

package/dist/public-cli/main.js

@@ -15055,7 +15055,7 @@ function validateRecordedDiaristOutput(value) {
   } catch {
     throw new Error("Diarist output has no execution discriminator");
   }
-  if (status === "completed") {
+  if (status === "completed" || status === "escalate") {
     return value;
   }
   throw new Error("Diarist output has no execution discriminator");
@@ -15068,7 +15068,7 @@ var init_diarist_contracts = __esm({
     DIARIST_SOURCES_FLAG = {
       name: "ak-diarist-sources",
       definition: {
-        description: "Frozen per-ticket source catalog the diarist selects from",
+        description: "Frozen source catalog the diarist selects from (may be unbound until LLM asserts ticketNumber)",
         type: "string"
       }
     };
@@ -16687,6 +16687,13 @@ var init_run_ticket_number = __esm({
   }
 });
 
+// src/readable-gate-item.ts
+var init_readable_gate_item = __esm({
+  "src/readable-gate-item.ts"() {
+    "use strict";
+  }
+});
+
 // src/audit-escalation.ts
 function isAuditEscalationResult(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -16698,6 +16705,7 @@ var AUDIT_ESCALATION_KIND;
 var init_audit_escalation = __esm({
   "src/audit-escalation.ts"() {
     "use strict";
+    init_readable_gate_item();
     AUDIT_ESCALATION_KIND = "audit_escalation";
   }
 });
@@ -16706,6 +16714,7 @@ var init_audit_escalation = __esm({
 var init_submission_errors = __esm({
   "src/submission-errors.ts"() {
     "use strict";
+    init_readable_gate_item();
   }
 });
 
@@ -16762,7 +16771,7 @@ function validateAcceptedDetails(toolName, details) {
     [GATEKEEPER_OUTPUT_TOOL_NAME]: ["dispatch", "pass"],
     [NAVIGATOR_OUTPUT_TOOL_NAME]: ["advice"],
     [AUDITOR_OUTPUT_TOOL_NAME]: ["pass", "bounce", "escalate"],
-    [DIARIST_OUTPUT_TOOL_NAME]: ["completed"]
+    [DIARIST_OUTPUT_TOOL_NAME]: ["completed", "escalate"]
   };
   const collectorDiscriminator = toolName === COLLECTOR_OUTPUT_TOOL && Array.isArray(candidate?.groups);
   const baseDiscriminator = discriminator;
@@ -17816,27 +17825,6 @@ async function findLatestRunIdForSeatTicket(input) {
   }
   return best;
 }
-async function collectBookRunTicketNumbers(input) {
-  const ledgerHome = resolveActivationLedgerHome(input.home);
-  const runsDir = join11(
-    activationBookDirectory(ledgerHome, input.bookKey),
-    "runs"
-  );
-  let entries;
-  try {
-    entries = await readdir2(runsDir);
-  } catch (error) {
-    if (errorCodeOf2(error) === "ENOENT") return /* @__PURE__ */ new Set();
-    throw error;
-  }
-  const known = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
-    if (!entry.includes("@")) continue;
-    const ticketNumber = await readRunTicketNumber(join11(runsDir, entry));
-    if (ticketNumber !== void 0) known.add(ticketNumber);
-  }
-  return known;
-}
 function parsePersistedTicketIdentity(record4) {
   const correlationId = typeof record4.correlationId === "string" && record4.correlationId.trim() !== "" ? record4.correlationId : void 0;
   const ticketNumber = typeof record4.ticketNumber === "number" && Number.isSafeInteger(record4.ticketNumber) && record4.ticketNumber >= 1 ? record4.ticketNumber : void 0;
@@ -21911,493 +21899,84 @@ var init_method_skill = __esm({
   }
 });
 
-// src/ticket-provenance-contracts.ts
-function isRecord10(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function projectTicketProvenanceDiagnostic(value) {
-  if (!isRecord10(value)) return void 0;
-  if (value.recordClass !== TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC) {
-    return void 0;
-  }
-  if (typeof value.diagnosticKind !== "string" || !DIAGNOSTIC_KINDS.has(value.diagnosticKind)) {
-    return void 0;
-  }
-  if (typeof value.cause !== "string" || value.cause.length === 0) {
-    return void 0;
-  }
-  if (typeof value.recordedAt !== "string" || value.recordedAt.length === 0) {
-    return void 0;
-  }
-  return {
-    recordClass: TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC,
-    diagnosticKind: value.diagnosticKind,
-    cause: value.cause,
-    recordedAt: value.recordedAt,
-    ...typeof value.reason === "string" ? { reason: value.reason } : {}
-  };
-}
-function projectTicketProvenanceEntry(value) {
-  if (!isRecord10(value)) return void 0;
-  if (value.recordClass === TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC) {
-    return void 0;
-  }
-  if (!isRecord10(value.basis)) return void 0;
-  if (typeof value.basis.method !== "string" || !BASIS_METHODS.has(value.basis.method)) {
-    return void 0;
-  }
-  if (typeof value.sourceKind !== "string" || !SOURCE_KINDS.has(value.sourceKind)) {
-    return void 0;
-  }
-  if (!isRecord10(value.sourceRef)) return void 0;
-  if (typeof value.transcript !== "string" || value.transcript.length === 0) {
-    return void 0;
-  }
-  if (typeof value.timestamp !== "string" || value.timestamp.length === 0) {
-    return void 0;
-  }
-  const basis = {
-    method: value.basis.method,
-    ...Array.isArray(value.basis.anchors) ? {
-      anchors: value.basis.anchors.filter(
-        (item) => typeof item === "string"
-      )
-    } : {},
-    ...typeof value.basis.note === "string" ? { note: value.basis.note } : {}
-  };
-  const sourceRef = {
-    ...typeof value.sourceRef.sessionFile === "string" ? { sessionFile: value.sourceRef.sessionFile } : {},
-    ...typeof value.sourceRef.entryId === "string" || typeof value.sourceRef.entryId === "number" ? { entryId: value.sourceRef.entryId } : {},
-    ...typeof value.sourceRef.path === "string" ? { path: value.sourceRef.path } : {},
-    ...typeof value.sourceRef.url === "string" ? { url: value.sourceRef.url } : {}
-  };
-  return {
-    basis,
-    sourceKind: value.sourceKind,
-    sourceRef,
-    transcript: value.transcript,
-    timestamp: value.timestamp
-  };
+// src/auditor-dossier-tool.ts
+import { dirname as dirname8, join as join15, resolve as resolve8 } from "node:path";
+function gateSubmissionCandidatePath(runDirectory) {
+  return join15(runDirectory, "artifacts", GATE_SUBMISSION_CANDIDATE_FILE);
 }
-var TICKET_PROVENANCE_KIND, TICKET_PROVENANCE_HUMAN_VIEW, TICKET_PROVENANCE_OFFERED_WATERMARK, TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC, SOURCE_KINDS, BASIS_METHODS, DIAGNOSTIC_KINDS;
-var init_ticket_provenance_contracts = __esm({
-  "src/ticket-provenance-contracts.ts"() {
+var GATE_SUBMISSION_CANDIDATE_FILE;
+var init_auditor_dossier_tool = __esm({
+  "src/auditor-dossier-tool.ts"() {
     "use strict";
-    TICKET_PROVENANCE_KIND = "ticket-provenance";
-    TICKET_PROVENANCE_HUMAN_VIEW = "\u8D77\u5C45\u5F55.md";
-    TICKET_PROVENANCE_OFFERED_WATERMARK = "offered-identities.jsonl";
-    TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC = "diagnostic";
-    SOURCE_KINDS = /* @__PURE__ */ new Set([
-      "cc-session",
-      "issue-body-comment",
-      "adr-decision-key",
-      "ticket-decree-block"
-    ]);
-    BASIS_METHODS = /* @__PURE__ */ new Set(["llm-semantic"]);
-    DIAGNOSTIC_KINDS = /* @__PURE__ */ new Set([
-      "collector-failed",
-      "issue-source-failed",
-      "quote-verify-failed"
-    ]);
+    init_build();
+    GATE_SUBMISSION_CANDIDATE_FILE = "gate-submission-candidate.json";
   }
 });
 
-// src/ticket-provenance.ts
-import { createHash as createHash5 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join15 } from "node:path";
-function ticketProvenanceSubject(ticketNumber) {
-  if (!Number.isSafeInteger(ticketNumber) || ticketNumber < 1) {
-    throw new Error(`ticket-provenance subject requires a positive ticket number, got ${String(ticketNumber)}`);
+// src/compliance-transport.ts
+var nonblank2, decisionGateSchema, complianceDecisionSchema, AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE;
+var init_compliance_transport = __esm({
+  "src/compliance-transport.ts"() {
+    "use strict";
+    init_build();
+    init_auditor_dossier_tool();
+    nonblank2 = typebox_exports.String({ minLength: 1, pattern: "\\S" });
+    decisionGateSchema = typebox_exports.Object({ question: nonblank2, options: typebox_exports.Array(nonblank2, { minItems: 1 }) }, { additionalProperties: false });
+    complianceDecisionSchema = typebox_exports.Object({ status: typebox_exports.Unknown({ description: "pass | bounce | escalate \u2014 \u5F62\u72B6\u6307\u5F15\uFF0C\u975E schema \u95F8" }), violations: typebox_exports.Array(nonblank2, { description: "\u89C2\u5BDF\u5230\u7684\u5408\u89C4\u8FDD\u89C4" }), conflicts: typebox_exports.Array(nonblank2, { description: "\u672A\u51B3\u6743\u5A01\u6216\u6267\u884C\u51B2\u7A81" }), decisionGate: typebox_exports.Union([decisionGateSchema, typebox_exports.Null()], { description: "\u5347\u7EA7\u95EE\u9898\u4E0E\u53EF\u9009\u9009\u9879" }) }, { additionalProperties: true, required: [] });
+    AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE = "ak_auditor_parent_attempt_binding";
+    AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE = "ak_auditor_compliance_failure";
   }
-  return String(ticketNumber);
-}
-function ticketProvenanceEntryIdentity(input) {
-  const ref = input.sourceRef;
-  const refKey = [
-    ref.sessionFile ?? "",
-    ref.entryId === void 0 ? "" : String(ref.entryId),
-    ref.path ?? "",
-    ref.url ?? ""
-  ].join("
");
-  const material = [
-    String(input.ticketNumber),
-    input.sourceKind,
-    refKey,
-    input.transcript
-  ].join("\0");
-  return createHash5("sha256").update(material, "utf8").digest("hex");
-}
-function resolveTicketProvenanceVolume(ticketNumber, cwd, home) {
-  const path = resolveSitianRecordPath({
-    level: "event",
-    kind: TICKET_PROVENANCE_KIND,
-    subject: ticketProvenanceSubject(ticketNumber),
-    cwd,
-    ...home === void 0 ? {} : { home }
-  });
-  return {
-    recordFile: path.recordFile,
-    volumeDir: path.sessionDir,
-    humanViewFile: join15(path.sessionDir, TICKET_PROVENANCE_HUMAN_VIEW),
-    offeredWatermarkFile: join15(path.sessionDir, TICKET_PROVENANCE_OFFERED_WATERMARK)
-  };
+});
+
+// src/ledger-session-read.ts
+import { readFile as readFile11 } from "node:fs/promises";
+function isRecord10(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readOfferedIdentities(ticketNumber, cwd, home) {
-  const { offeredWatermarkFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
-  if (!existsSync6(offeredWatermarkFile)) return /* @__PURE__ */ new Set();
-  let text;
-  try {
-    text = readFileSync2(offeredWatermarkFile, "utf8");
-  } catch (error) {
-    throw new TicketProvenanceWatermarkError(
-      "unreadable",
-      `ticket-provenance offered watermark unreadable (${offeredWatermarkFile})`,
-      { cause: error }
-    );
-  }
-  const seen = /* @__PURE__ */ new Set();
+async function readLedgerSessionJsonl(path) {
+  const text = await readFile11(path, "utf8");
   const lines = text.split("\n");
+  const rows = [];
   for (let index = 0; index < lines.length; index += 1) {
-    const trimmed = lines[index].trim();
-    if (!trimmed) continue;
-    let parsed;
+    const line2 = lines[index];
+    if (!line2.trim()) continue;
+    let row;
     try {
-      parsed = JSON.parse(trimmed);
+      row = JSON.parse(line2);
     } catch (error) {
-      throw new TicketProvenanceWatermarkError(
-        "malformed-json",
-        `ticket-provenance offered watermark malformed JSON at line ${index + 1} (${offeredWatermarkFile})`,
-        { cause: error }
-      );
+      if (!(error instanceof SyntaxError)) throw error;
+      const completedByTerminator = index < lines.length - 1;
+      if (completedByTerminator) {
+        throw new LedgerSessionJsonlError(
+          `malformed JSONL record in ${path} at line ${index + 1}: ${error.message}`,
+          { path, line: index + 1, prefixRows: rows }
+        );
+      }
+      break;
     }
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof parsed.identity !== "string" || parsed.identity.length === 0) {
-      throw new TicketProvenanceWatermarkError(
-        "bad-shape",
-        `ticket-provenance offered watermark bad shape at line ${index + 1} (${offeredWatermarkFile})`
+    if (!isRecord10(row)) {
+      const kind = row === null ? "null" : Array.isArray(row) ? "array" : typeof row;
+      throw new LedgerSessionJsonlError(
+        `complete non-object JSONL record in ${path} at line ${index + 1}: expected object, got ${kind}`,
+        { path, line: index + 1, prefixRows: rows }
       );
     }
-    seen.add(parsed.identity);
-  }
-  return seen;
-}
-async function readTicketProvenance(ticketNumber, cwd, home) {
-  const { recordFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
-  const { records: records2 } = await readSitianRecords(recordFile);
-  const entries = [];
-  const diagnostics = [];
-  let skipped = 0;
-  for (const record4 of records2) {
-    if (record4.kind !== TICKET_PROVENANCE_KIND) {
-      skipped += 1;
-      continue;
-    }
-    const diagnostic = projectTicketProvenanceDiagnostic(record4.payload);
-    if (diagnostic !== void 0) {
-      diagnostics.push(diagnostic);
-      continue;
-    }
-    const entry = projectTicketProvenanceEntry(record4.payload);
-    if (entry === void 0) {
-      skipped += 1;
-      continue;
-    }
-    entries.push(entry);
+    rows.push(row);
   }
-  return { entries, diagnostics, records: records2, recordFile, skipped };
+  return rows;
 }
-function markdownFenceFor(text) {
-  let longest = 0;
-  const runs = text.match(/`+/g);
-  if (runs !== null) {
-    for (const run of runs) {
-      if (run.length > longest) longest = run.length;
-    }
+function extractSessionTimestampSpan(rows) {
+  let startedAt;
+  let endedAt;
+  for (const row of rows) {
+    if (typeof row.timestamp !== "string" || !row.timestamp) continue;
+    if (startedAt === void 0) startedAt = row.timestamp;
+    endedAt = row.timestamp;
   }
-  return "`".repeat(Math.max(3, longest + 1));
-}
-function renderTicketProvenanceMarkdown(input) {
-  const lines = [
-    `# \u8D77\u5C45\u5F55 \xB7 #${input.ticketNumber}`,
-    "",
-    `\u6761\u76EE\u6570\uFF1A${input.entries.length}`,
-    ""
-  ];
-  let index = 0;
-  for (const entry of input.entries) {
-    index += 1;
-    lines.push(`## ${index}. ${entry.sourceKind} \xB7 ${entry.timestamp}`);
-    lines.push("");
-    lines.push(`- basis.method: \`${entry.basis.method}\``);
-    if (entry.basis.anchors !== void 0 && entry.basis.anchors.length > 0) {
-      lines.push(`- anchors: ${entry.basis.anchors.map((a) => `\`${a}\``).join(", ")}`);
-    }
-    if (entry.basis.note !== void 0) {
-      lines.push(`- note: ${entry.basis.note}`);
-    }
-    const refParts = [];
-    if (entry.sourceRef.sessionFile !== void 0) {
-      refParts.push(`sessionFile=${entry.sourceRef.sessionFile}`);
-    }
-    if (entry.sourceRef.entryId !== void 0) {
-      refParts.push(`entryId=${String(entry.sourceRef.entryId)}`);
-    }
-    if (entry.sourceRef.path !== void 0) {
-      refParts.push(`path=${entry.sourceRef.path}`);
-    }
-    if (entry.sourceRef.url !== void 0) {
-      refParts.push(`url=${entry.sourceRef.url}`);
-    }
-    if (refParts.length > 0) {
-      lines.push(`- sourceRef: ${refParts.join(" \xB7 ")}`);
-    }
-    lines.push("");
-    const fence = markdownFenceFor(entry.transcript);
-    lines.push(fence);
-    lines.push(entry.transcript);
-    lines.push(fence);
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-function ensureTicketProvenanceVolume(ticketNumber, cwd, home) {
-  const volume = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
-  mkdirSync3(volume.volumeDir, { recursive: true });
-  appendFileSync2(volume.recordFile, "", "utf8");
-  return volume;
-}
-function appendTicketProvenanceDiagnostic(input) {
-  const subject = ticketProvenanceSubject(input.ticketNumber);
-  const identityParts = input.diagnostic.diagnosticKind === "quote-verify-failed" ? [
-    subject,
-    input.diagnostic.recordClass,
-    input.diagnostic.diagnosticKind,
-    input.diagnostic.cause,
-    input.diagnostic.reason ?? ""
-  ] : [
-    subject,
-    input.diagnostic.recordClass,
-    input.diagnostic.diagnosticKind,
-    input.diagnostic.recordedAt,
-    input.diagnostic.cause,
-    input.diagnostic.reason ?? ""
-  ];
-  const identity = createHash5("sha256").update(identityParts.join("\0"), "utf8").digest("hex");
-  return sitianReport({
-    level: "event",
-    kind: TICKET_PROVENANCE_KIND,
-    identity,
-    subject,
-    cwd: input.cwd,
-    ...input.home === void 0 ? {} : { home: input.home },
-    host: input.host ?? "diarist",
-    source: input.source ?? "diarist-diagnostic",
-    payload: input.diagnostic
-  });
-}
-function appendIssueSourceFailureDiagnostic(input) {
-  const recordedAt = input.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  return appendTicketProvenanceDiagnostic({
-    ticketNumber: input.ticketNumber,
-    cwd: input.cwd,
-    ...input.home === void 0 ? {} : { home: input.home },
-    source: "diarist-issue-source",
-    diagnostic: {
-      recordClass: TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC,
-      diagnosticKind: "issue-source-failed",
-      cause: input.cause,
-      recordedAt,
-      reason: input.reason
-    }
-  });
-}
-function writeTicketProvenanceHumanView(input) {
-  const volume = ensureTicketProvenanceVolume(input.ticketNumber, input.cwd, input.home);
-  const md = renderTicketProvenanceMarkdown({
-    ticketNumber: input.ticketNumber,
-    entries: input.entries
-  });
-  writeFileSync2(volume.humanViewFile, md, "utf8");
-  return volume.humanViewFile;
-}
-var TicketProvenanceWatermarkError;
-var init_ticket_provenance = __esm({
-  "src/ticket-provenance.ts"() {
-    "use strict";
-    init_sitian_facade();
-    init_ticket_provenance_contracts();
-    TicketProvenanceWatermarkError = class extends Error {
-      code = "ticket-provenance-watermark";
-      reason;
-      constructor(reason, message, options) {
-        super(message, options);
-        this.name = "TicketProvenanceWatermarkError";
-        this.reason = reason;
-      }
-    };
-  }
-});
-
-// src/public-cli/seat-ticket-binding.ts
-import { existsSync as existsSync7 } from "node:fs";
-function instructionTicketTokens(instruction) {
-  const tokens = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const match of instruction.matchAll(/#([1-9]\d*)/g)) {
-    const parsed = Number(match[1]);
-    if (!Number.isSafeInteger(parsed)) continue;
-    if (seen.has(parsed)) continue;
-    seen.add(parsed);
-    tokens.push(parsed);
-  }
-  return tokens;
-}
-async function resolveKnownTicketNumber(input) {
-  const tokens = instructionTicketTokens(input.instruction);
-  if (tokens.length === 0) return void 0;
-  const target = tokens[0];
-  const volume = resolveTicketProvenanceVolume(
-    target,
-    input.projectRoot,
-    input.home
-  );
-  if (existsSync7(volume.volumeDir)) return target;
-  const runTickets = await readBookRunTickets(input);
-  return runTickets.has(target) ? target : void 0;
-}
-async function resolveDiaristSummonsTicketNumber(input) {
-  const tokens = instructionTicketTokens(input.instruction);
-  return tokens[0];
-}
-async function readBookRunTickets(input) {
-  let bookKey;
-  try {
-    bookKey = input.bookKey ?? resolveBookKeyFromGit(input.projectRoot);
-  } catch (error) {
-    if (error instanceof ActivationGitRepositoryRequiredError) return /* @__PURE__ */ new Set();
-    throw error;
-  }
-  return await collectBookRunTicketNumbers({ home: input.home, bookKey });
-}
-async function bindReusedTicketNumber(admitted, ticketNumber) {
-  if (ticketNumber === void 0) return;
-  if (admitted.ticketNumber !== void 0) return;
-  await bindAdmittedTicketNumber(admitted, ticketNumber);
-}
-async function resolveSeatTicketBinding(admitted, env) {
-  if (admitted.ticketNumber !== void 0) return admitted.ticketNumber;
-  const ticketNumber = await resolveKnownTicketNumber({
-    instruction: admitted.instruction,
-    projectRoot: admitted.projectRoot,
-    home: env.home,
-    bookKey: admitted.bookKey
-  });
-  await bindReusedTicketNumber(admitted, ticketNumber);
-  return ticketNumber;
-}
-async function tryResumeSameTicketSeatRun(input) {
-  if (input.freshSummons === true) return void 0;
-  if (input.parentRunPath === void 0 && input.ticketNumber === void 0) {
-    return void 0;
-  }
-  const previousRunId = await findLatestRunIdForSeatTicket({
-    home: input.home,
-    bookKey: resolveBookKeyFromGit(input.projectRoot),
-    role: input.role,
-    ...input.parentRunPath === void 0 ? {} : { parentRunPath: input.parentRunPath },
-    ...input.ticketNumber === void 0 ? {} : { ticketNumber: input.ticketNumber }
-  });
-  if (previousRunId === void 0) return void 0;
-  return await input.resume(previousRunId, input.summons);
-}
-var init_seat_ticket_binding = __esm({
-  "src/public-cli/seat-ticket-binding.ts"() {
-    "use strict";
-    init_activation_ledger_git();
-    init_ticket_provenance();
-    init_invocation();
-    init_run_lifecycle();
-  }
-});
-
-// src/auditor-dossier-tool.ts
-import { dirname as dirname8, join as join16, resolve as resolve8 } from "node:path";
-function gateSubmissionCandidatePath(runDirectory) {
-  return join16(runDirectory, "artifacts", GATE_SUBMISSION_CANDIDATE_FILE);
-}
-var GATE_SUBMISSION_CANDIDATE_FILE;
-var init_auditor_dossier_tool = __esm({
-  "src/auditor-dossier-tool.ts"() {
-    "use strict";
-    init_build();
-    GATE_SUBMISSION_CANDIDATE_FILE = "gate-submission-candidate.json";
-  }
-});
-
-// src/compliance-transport.ts
-var nonblank2, decisionGateSchema, complianceDecisionSchema, AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE, AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE;
-var init_compliance_transport = __esm({
-  "src/compliance-transport.ts"() {
-    "use strict";
-    init_build();
-    init_auditor_dossier_tool();
-    nonblank2 = typebox_exports.String({ minLength: 1, pattern: "\\S" });
-    decisionGateSchema = typebox_exports.Object({ question: nonblank2, options: typebox_exports.Array(nonblank2, { minItems: 1 }) }, { additionalProperties: false });
-    complianceDecisionSchema = typebox_exports.Object({ status: typebox_exports.Unknown({ description: "pass | bounce | escalate \u2014 \u5F62\u72B6\u6307\u5F15\uFF0C\u975E schema \u95F8" }), violations: typebox_exports.Array(nonblank2, { description: "\u89C2\u5BDF\u5230\u7684\u5408\u89C4\u8FDD\u89C4" }), conflicts: typebox_exports.Array(nonblank2, { description: "\u672A\u51B3\u6743\u5A01\u6216\u6267\u884C\u51B2\u7A81" }), decisionGate: typebox_exports.Union([decisionGateSchema, typebox_exports.Null()], { description: "\u5347\u7EA7\u95EE\u9898\u4E0E\u53EF\u9009\u9009\u9879" }) }, { additionalProperties: true, required: [] });
-    AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE = "ak_auditor_parent_attempt_binding";
-    AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE = "ak_auditor_compliance_failure";
-  }
-});
-
-// src/ledger-session-read.ts
-import { readFile as readFile11 } from "node:fs/promises";
-function isRecord11(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function readLedgerSessionJsonl(path) {
-  const text = await readFile11(path, "utf8");
-  const lines = text.split("\n");
-  const rows = [];
-  for (let index = 0; index < lines.length; index += 1) {
-    const line2 = lines[index];
-    if (!line2.trim()) continue;
-    let row;
-    try {
-      row = JSON.parse(line2);
-    } catch (error) {
-      if (!(error instanceof SyntaxError)) throw error;
-      const completedByTerminator = index < lines.length - 1;
-      if (completedByTerminator) {
-        throw new LedgerSessionJsonlError(
-          `malformed JSONL record in ${path} at line ${index + 1}: ${error.message}`,
-          { path, line: index + 1, prefixRows: rows }
-        );
-      }
-      break;
-    }
-    if (!isRecord11(row)) {
-      const kind = row === null ? "null" : Array.isArray(row) ? "array" : typeof row;
-      throw new LedgerSessionJsonlError(
-        `complete non-object JSONL record in ${path} at line ${index + 1}: expected object, got ${kind}`,
-        { path, line: index + 1, prefixRows: rows }
-      );
-    }
-    rows.push(row);
-  }
-  return rows;
-}
-function extractSessionTimestampSpan(rows) {
-  let startedAt;
-  let endedAt;
-  for (const row of rows) {
-    if (typeof row.timestamp !== "string" || !row.timestamp) continue;
-    if (startedAt === void 0) startedAt = row.timestamp;
-    endedAt = row.timestamp;
-  }
-  return {
-    ...startedAt !== void 0 ? { startedAt } : {},
-    ...endedAt !== void 0 ? { endedAt } : {}
-  };
+  return {
+    ...startedAt !== void 0 ? { startedAt } : {},
+    ...endedAt !== void 0 ? { endedAt } : {}
+  };
 }
 function extractSessionModelSequence(rows) {
   const seen = /* @__PURE__ */ new Set();
@@ -22412,7 +21991,7 @@ function extractSessionModelSequence(rows) {
     if (row.type === "model_change" && typeof row.modelId === "string") {
       push(row.modelId);
     }
-    const message = isRecord11(row.message) ? row.message : void 0;
+    const message = isRecord10(row.message) ? row.message : void 0;
     if (message?.role === "assistant" && typeof message.model === "string") {
       push(message.model);
     }
@@ -22428,11 +22007,11 @@ function extractSessionToolIntervals(rows) {
   const openById = /* @__PURE__ */ new Map();
   for (const row of rows) {
     const rowTimestamp = typeof row.timestamp === "string" ? row.timestamp : void 0;
-    const message = isRecord11(row.message) ? row.message : void 0;
+    const message = isRecord10(row.message) ? row.message : void 0;
     if (message?.role === "assistant" && Array.isArray(message.content)) {
       const callTimestamp = typeof message.timestamp === "string" && message.timestamp ? message.timestamp : rowTimestamp;
       for (const part of message.content) {
-        if (!isRecord11(part) || part.type !== "toolCall") continue;
+        if (!isRecord10(part) || part.type !== "toolCall") continue;
         if (typeof part.id !== "string" || part.id.length === 0) {
           throw new Error("toolCall frame missing string id");
         }
@@ -22445,7 +22024,7 @@ function extractSessionToolIntervals(rows) {
         if (openById.has(part.id)) {
           throw new Error(`duplicate toolCall id ${part.id}`);
         }
-        const args = isRecord11(part.arguments) ? part.arguments : void 0;
+        const args = isRecord10(part.arguments) ? part.arguments : void 0;
         const command = part.name === "bash" && args !== void 0 && typeof args.command === "string" ? bashCommandFirstLine(args.command) : void 0;
         const interval = {
           toolCallId: part.id,
@@ -22530,8 +22109,8 @@ var init_ledger_session_read = __esm({
 
 // src/analyst-gate-cycles-read.ts
 import { readdir as readdir3 } from "node:fs/promises";
-import { join as join17 } from "node:path";
-function isRecord12(value) {
+import { join as join16 } from "node:path";
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isParentAttemptBindingRow(row) {
@@ -22562,7 +22141,7 @@ function isGateTerminatingToolName(toolName) {
 function acceptedGateReceiptIds(rows) {
   const accepted = /* @__PURE__ */ new Set();
   for (const row of rows) {
-    const message = isRecord12(row.message) ? row.message : void 0;
+    const message = isRecord11(row.message) ? row.message : void 0;
     if (message?.role !== "toolResult") continue;
     if (typeof message.toolCallId !== "string" || message.toolCallId.length === 0) continue;
     if (message.isError === false) accepted.add(message.toolCallId);
@@ -22601,7 +22180,7 @@ function nearestAttemptBindingBefore(rows, beforeIndex) {
   for (let i = beforeIndex - 1; i >= 0; i -= 1) {
     const row = rows[i];
     if (!isParentAttemptBindingRow(row)) continue;
-    if (!isRecord12(row.data) || !isRecord12(row.data.parent)) continue;
+    if (!isRecord11(row.data) || !isRecord11(row.data.parent)) continue;
     const id = row.data.parent.attemptEntryId;
     const sessionFile = row.data.parent.sessionFile;
     return {
@@ -22616,10 +22195,10 @@ function extractAllAcceptedGateToolCalls(rows) {
   const out = [];
   for (let rowIndex = 0; rowIndex < rows.length; rowIndex += 1) {
     const row = rows[rowIndex];
-    const message = isRecord12(row.message) ? row.message : void 0;
+    const message = isRecord11(row.message) ? row.message : void 0;
     if (message?.role !== "assistant" || !Array.isArray(message.content)) continue;
     for (const part of message.content) {
-      if (!isRecord12(part) || part.type !== "toolCall") continue;
+      if (!isRecord11(part) || part.type !== "toolCall") continue;
       if (typeof part.id !== "string" || part.id.length === 0) continue;
       if (typeof part.name !== "string" || part.name.length === 0) continue;
       if (!isGateTerminatingToolName(part.name)) continue;
@@ -22627,7 +22206,7 @@ function extractAllAcceptedGateToolCalls(rows) {
       const binding = nearestAttemptBindingBefore(rows, rowIndex);
       out.push({
         toolName: part.name,
-        args: isRecord12(part.arguments) ? part.arguments : void 0,
+        args: isRecord11(part.arguments) ? part.arguments : void 0,
         accepted: true,
         rowIndex,
         ...binding
@@ -22767,7 +22346,7 @@ async function resolveOfficerSessionFromPointerFile(pointerPath) {
       { cause: error }
     );
   }
-  if (!isRecord12(raw) || raw.kind !== "direct-officer-run-pointer" || raw.version !== 1) {
+  if (!isRecord11(raw) || raw.kind !== "direct-officer-run-pointer" || raw.version !== 1) {
     throw new Error(`direct officer run pointer has unknown shape in ${pointerPath}`);
   }
   const sessionFile = raw.sessionFile;
@@ -22791,7 +22370,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
       throw error;
     }
     for (const name of names) {
-      const path = join17(directory, name);
+      const path = join16(directory, name);
       const sessionPath = name.endsWith(".pointer.json") ? await resolveOfficerSessionFromPointerFile(path) : path;
       if (sessionPath === void 0) continue;
       const classified = await classifyAuditorVolume(sessionPath);
@@ -22841,6 +22420,7 @@ var init_gatekeeper_role = __esm({
     "use strict";
     init_auditor_dossier_tool();
     init_submission_errors();
+    init_readable_gate_item();
     init_inspector_contracts();
     init_gatekeeper_output();
     init_shape_unreadable_failure();
@@ -22851,21 +22431,21 @@ var init_gatekeeper_role = __esm({
 
 // src/run-terminal-artifacts.ts
 import { readdir as readdir4, readFile as readFile12 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname9, join as join18 } from "node:path";
+import { basename as basename6, dirname as dirname9, join as join17 } from "node:path";
 function isMissingPathError2(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
 function errorText2(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function isRecord13(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readUsableTerminalArtifactBody(body) {
   if (body === null) {
     return { ok: false, reason: "terminal artifact JSON value is null" };
   }
-  if (!isRecord13(body)) {
+  if (!isRecord12(body)) {
     return {
       ok: false,
       reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`
@@ -22926,7 +22506,7 @@ async function listUniqueErrorFallbackPaths(directories) {
     }
     for (const name of names.sort((a, b) => a.localeCompare(b))) {
       if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
-      found.push(join18(dir, name));
+      found.push(join17(dir, name));
     }
   }
   return found;
@@ -22942,14 +22522,14 @@ function presentUniqueFallbackBoundToRun(body, expectedRunId) {
   return typeof body.runId === "string" && body.runId === expectedRunId;
 }
 async function readRunTerminalArtifact(runDirectory) {
-  const artifactsDir = join18(runDirectory, "artifacts");
+  const artifactsDir = join17(runDirectory, "artifacts");
   for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    const path = join18(artifactsDir, file);
+    const path = join17(artifactsDir, file);
     const read3 = await readTerminalArtifactAtPath(path, file);
     if (read3 !== void 0) return read3;
   }
   for (const relative3 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-    const path = join18(runDirectory, relative3);
+    const path = join17(runDirectory, relative3);
     const read3 = await readTerminalArtifactAtPath(path, "error.json");
     if (read3 !== void 0) return read3;
   }
@@ -23088,14 +22668,14 @@ var init_submission_ledger = __esm({
 });
 
 // src/session-opening-materials.ts
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { dirname as dirname10, join as join19 } from "node:path";
+import { dirname as dirname10, join as join18 } from "node:path";
 import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 function resolvePackageRootDir(moduleUrl = import.meta.url) {
   let dir = dirname10(fileURLToPath(moduleUrl));
   for (let i = 0; i < 8; i += 1) {
-    if (existsSync8(join19(dir, "package.json")) && existsSync8(join19(dir, "souls"))) {
+    if (existsSync6(join18(dir, "package.json")) && existsSync6(join18(dir, "souls"))) {
       return dir;
     }
     const parent = dirname10(dir);
@@ -23421,12 +23001,12 @@ var init_reviewer_dispatch = __esm({
 
 // src/public-cli/reviewer-dispatch-rejection.ts
 import { readFile as readFile14, unlink as unlink3 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join19 } from "node:path";
 function isReviewerPreflightViolation(value) {
   return typeof value === "string" && REVIEWER_PREFLIGHT_VIOLATIONS.includes(value);
 }
 function reviewerDispatchRejectionPath(runDirectory) {
-  return join20(runDirectory, REVIEWER_DISPATCH_REJECTION_FILE);
+  return join19(runDirectory, REVIEWER_DISPATCH_REJECTION_FILE);
 }
 async function clearReviewerDispatchRejection(runDirectory) {
   try {
@@ -23487,7 +23067,7 @@ var init_collector_evidence = __esm({
 
 // src/collector-github.ts
 import { spawn as spawn2 } from "node:child_process";
-function isRecord14(value) {
+function isRecord13(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function requireString(value, label) {
@@ -23528,25 +23108,25 @@ function commentFailureCause(error) {
   };
 }
 function requireUserLogin(raw) {
-  if (!isRecord14(raw) || typeof raw["login"] !== "string") {
+  if (!isRecord13(raw) || typeof raw["login"] !== "string") {
     throw new Error("GitHub payload missing user.login");
   }
   return raw["login"];
 }
 function optionalUserLogin(raw) {
   if (raw === null) return null;
-  if (!isRecord14(raw) || typeof raw["login"] !== "string") {
+  if (!isRecord13(raw) || typeof raw["login"] !== "string") {
     throw new Error("GitHub payload missing user.login");
   }
   return raw["login"];
 }
 function machineIdentity(raw) {
   const user = raw["user"];
-  if (!isRecord14(user) || typeof user["type"] !== "string" || typeof user["id"] !== "number") {
+  if (!isRecord13(user) || typeof user["type"] !== "string" || typeof user["id"] !== "number") {
     return null;
   }
   const app = raw["performed_via_github_app"];
-  const appId = isRecord14(app) && typeof app["id"] === "number" ? app["id"] : void 0;
+  const appId = isRecord13(app) && typeof app["id"] === "number" ? app["id"] : void 0;
   return {
     userType: user["type"],
     userId: user["id"],
@@ -23554,9 +23134,9 @@ function machineIdentity(raw) {
   };
 }
 function normalizePullRequest(raw) {
-  if (!isRecord14(raw)) throw new Error("GitHub pull request payload must be an object");
+  if (!isRecord13(raw)) throw new Error("GitHub pull request payload must be an object");
   const head = raw["head"];
-  if (!isRecord14(head) || typeof head["sha"] !== "string" || head["sha"].length === 0) {
+  if (!isRecord13(head) || typeof head["sha"] !== "string" || head["sha"].length === 0) {
     throw new Error("GitHub pull request payload missing head.sha");
   }
   const number = requireNumber(raw["number"], "number");
@@ -23572,7 +23152,7 @@ function normalizePullRequest(raw) {
   };
 }
 function normalizePullRequestReaction(raw) {
-  if (!isRecord14(raw)) throw new Error("GitHub reaction payload must be an object");
+  if (!isRecord13(raw)) throw new Error("GitHub reaction payload must be an object");
   return {
     id: requireNumber(raw["id"], "reaction.id"),
     userLogin: optionalUserLogin(raw["user"]),
@@ -23583,7 +23163,7 @@ function normalizePullRequestReaction(raw) {
   };
 }
 function normalizeReview(raw) {
-  if (!isRecord14(raw)) throw new Error("GitHub review payload must be an object");
+  if (!isRecord13(raw)) throw new Error("GitHub review payload must be an object");
   return {
     id: requireNumber(raw["id"], "review.id"),
     ...typeof raw["node_id"] === "string" ? { nodeId: raw["node_id"] } : {},
@@ -23598,7 +23178,7 @@ function normalizeReview(raw) {
   };
 }
 function normalizeIssueComment(raw) {
-  if (!isRecord14(raw)) throw new Error("GitHub issue comment payload must be an object");
+  if (!isRecord13(raw)) throw new Error("GitHub issue comment payload must be an object");
   return {
     id: requireNumber(raw["id"], "comment.id"),
     userLogin: optionalUserLogin(raw["user"]),
@@ -23611,7 +23191,7 @@ function normalizeIssueComment(raw) {
   };
 }
 function normalizeReviewComment(raw) {
-  if (!isRecord14(raw)) throw new Error("GitHub review comment payload must be an object");
+  if (!isRecord13(raw)) throw new Error("GitHub review comment payload must be an object");
   return {
     id: requireNumber(raw["id"], "review_comment.id"),
     pullRequestReviewId: typeof raw["pull_request_review_id"] === "number" ? raw["pull_request_review_id"] : null,
@@ -23920,11 +23500,11 @@ function createGhCollectorGitHubTransport(runner = createGhApiRunner()) {
         if (input.signal?.aborted) {
           throw error;
         }
-        if (isRecord14(error) && error["ambiguousGhFailure"] === true) {
+        if (isRecord13(error) && error["ambiguousGhFailure"] === true) {
           const cause = commentFailureCause(error);
           return { kind: "ambiguous_loss", diagnostics: cause.message, cause };
         }
-        if (isRecord14(error) && error["name"] === "AbortError") {
+        if (isRecord13(error) && error["name"] === "AbortError") {
           throw error;
         }
         throw error;
@@ -24100,11 +23680,11 @@ var init_navigator_invocation_identity = __esm({
 });
 
 // src/receipt-delivery-policy.ts
-function isRecord15(value) {
+function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseNoReceiptLifecycleFacts(input) {
-  if (!isRecord15(input) || typeof input.terminalToolCalled !== "boolean" || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT || input.sessionCompletion !== "settled-without-accepted-receipt" || input.acceptedReceipt !== false || typeof input.runPointer !== "string" || input.runPointer.trim() === "" || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === "" || !Array.isArray(input.rejectedReceipts) || !input.rejectedReceipts.every((item) => isRecord15(item) && typeof item.reason === "string")) {
+  if (!isRecord14(input) || typeof input.terminalToolCalled !== "boolean" || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT || input.sessionCompletion !== "settled-without-accepted-receipt" || input.acceptedReceipt !== false || typeof input.runPointer !== "string" || input.runPointer.trim() === "" || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === "" || !Array.isArray(input.rejectedReceipts) || !input.rejectedReceipts.every((item) => isRecord14(item) && typeof item.reason === "string")) {
     throw new TypeError("malformed no-receipt lifecycle facts");
   }
   return {
@@ -24290,7 +23870,7 @@ var init_terminal = __esm({
 // src/public-cli/settlement.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { appendFile as appendFile2, readFile as readFile15, readdir as readdir5, writeFile as writeFile5 } from "node:fs/promises";
-import { dirname as dirname11, join as join21 } from "node:path";
+import { dirname as dirname11, join as join20 } from "node:path";
 function sealedLedgerHome(admitted) {
   return homeFromRunDirectory(admitted.runDirectory);
 }
@@ -24670,7 +24250,7 @@ async function readSitianRetainedAuditorProviderStop(sessionFile) {
     const { records: records2 } = await readSitianRecords(recordFile);
     for (let i = records2.length - 1; i >= 0; i -= 1) {
       const payload = records2[i]?.payload;
-      if (!isRecord16(payload) || !isRecord16(payload.response)) continue;
+      if (!isRecord15(payload) || !isRecord15(payload.response)) continue;
       if (typeof payload.type === "string") continue;
       const stop = sessionProviderStopFromAssistant(payload.response);
       if (stop !== void 0) return stop;
@@ -24691,7 +24271,7 @@ async function readSessionProviderStop(sessionFile) {
   }
 }
 async function readBoundEvidenceChildKnownFailure(sessionFile) {
-  const childDirectory = join21(dirname11(sessionFile), "evidence-children");
+  const childDirectory = join20(dirname11(sessionFile), "evidence-children");
   let names;
   try {
     names = await readdir5(childDirectory);
@@ -24702,12 +24282,12 @@ async function readBoundEvidenceChildKnownFailure(sessionFile) {
   for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
     let entries;
     try {
-      entries = await readBoundSessionEntries(join21(childDirectory, file));
+      entries = await readBoundSessionEntries(join20(childDirectory, file));
     } catch (error) {
       throw sessionReadFailure(error, "failed to read discovered evidence-child session");
     }
     const header = entries.find((entry) => entry.type === "session");
-    if (!isRecord16(header) || header.parentSession !== sessionFile) continue;
+    if (!isRecord15(header) || header.parentSession !== sessionFile) continue;
     const stop = extractSessionProviderStop(entries);
     if (stop === void 0) continue;
     const primary = knownFailureFromProviderStop(stop);
@@ -24739,12 +24319,12 @@ async function loadBoundAuditorVolumes(sessionFile) {
     return firstLine === RESUME_ENVELOPE;
   };
   const isResumeEnvelope = (msg) => {
-    if (!isRecord16(msg) || msg.role !== "user") return false;
+    if (!isRecord15(msg) || msg.role !== "user") return false;
     const text = typeof msg.text === "string" ? msg.text : typeof msg.content === "string" ? msg.content : void 0;
     if (isResumeEnvelopeBytes(text)) return true;
     const content = msg.content;
     if (Array.isArray(content)) {
-      return content.some((p) => isRecord16(p) && (isResumeEnvelopeBytes(p.text) || isResumeEnvelopeBytes(p.content)));
+      return content.some((p) => isRecord15(p) && (isResumeEnvelopeBytes(p.text) || isResumeEnvelopeBytes(p.content)));
     }
     return false;
   };
@@ -24756,7 +24336,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
     latestParentUserIndex = i;
     break;
   }
-  const childDirectories = [join21(dirname11(sessionFile), "auditor-roles")];
+  const childDirectories = [join20(dirname11(sessionFile), "auditor-roles")];
   const valid = [];
   let sawAnyDirectory = false;
   for (const childDirectory of childDirectories) {
@@ -24771,12 +24351,12 @@ async function loadBoundAuditorVolumes(sessionFile) {
     for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
       let entries;
       try {
-        entries = await readBoundSessionEntries(join21(childDirectory, file));
+        entries = await readBoundSessionEntries(join20(childDirectory, file));
       } catch (error) {
         throw sessionReadFailure(error, "failed to read discovered auditor session");
       }
       const header = entries.find((entry) => entry.type === "session");
-      if (!isRecord16(header)) continue;
+      if (!isRecord15(header)) continue;
       const bindingIndexes = [];
       for (let i = 0; i < entries.length; i += 1) {
         const entry = entries[i];
@@ -24790,7 +24370,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
         end: idx + 1 < bindingIndexes.length ? bindingIndexes[idx + 1] : entries.length
       })) : [{ entry: void 0, start: 0, end: entries.length }];
       for (const { entry: bindingEntry, start, end } of bindingPasses) {
-        const bindingParent = bindingEntry !== void 0 && isRecord16(bindingEntry.data) && isRecord16(bindingEntry.data.parent) ? bindingEntry.data.parent : void 0;
+        const bindingParent = bindingEntry !== void 0 && isRecord15(bindingEntry.data) && isRecord15(bindingEntry.data.parent) ? bindingEntry.data.parent : void 0;
         const attemptEntryId = typeof bindingParent?.attemptEntryId === "string" ? bindingParent.attemptEntryId : void 0;
         const attemptEntryIndex = attemptEntryId === void 0 ? -1 : parentEntries.findIndex((entry) => entry.id === attemptEntryId);
         const boundSessionFile = typeof bindingParent?.sessionFile === "string" ? bindingParent.sessionFile : typeof header.parentSession === "string" ? header.parentSession : void 0;
@@ -24817,11 +24397,11 @@ function complianceFailureFromAuditorVolumes(volumes) {
     if (stop === void 0) continue;
     for (let i = entries.length - 1; i >= 0; i -= 1) {
       const entry = entries[i];
-      if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord16(entry.data)) continue;
-      const parent = isRecord16(entry.data.parent) ? entry.data.parent : void 0;
-      const failure = isRecord16(entry.data.failure) ? entry.data.failure : void 0;
+      if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord15(entry.data)) continue;
+      const parent = isRecord15(entry.data.parent) ? entry.data.parent : void 0;
+      const failure = isRecord15(entry.data.failure) ? entry.data.failure : void 0;
       if (parent?.sessionId !== parentId || parent.sessionFile !== sessionFile || parent.attemptEntryId !== attemptEntryId || failure?.cause !== "provider" && failure?.cause !== "unrecognized") continue;
-      const identity = isRecord16(failure.identity) ? failure.identity : void 0;
+      const identity = isRecord15(failure.identity) ? failure.identity : void 0;
       return {
         cause: failure.cause === "provider" ? "provider" : "unrecognized",
         ...identity === void 0 ? {} : { identity: {
@@ -24829,7 +24409,7 @@ function complianceFailureFromAuditorVolumes(volumes) {
           ...typeof identity.code === "string" || typeof identity.code === "number" ? { code: identity.code } : {}
         } },
         ...typeof failure.diagnostic === "string" ? { diagnostic: failure.diagnostic } : {},
-        ...isRecord16(failure.details) ? { details: failure.details } : {}
+        ...isRecord15(failure.details) ? { details: failure.details } : {}
       };
     }
   }
@@ -24876,9 +24456,9 @@ function typedFailedTerminatingToolKnownFailure(entries) {
     if (classification.kind !== "infrastructure") continue;
     if (typeof message.toolCallId !== "string" || typeof message.toolName !== "string") continue;
     if (boundRoleToolCallForResult(attemptEntries, i, message, message.toolName) === void 0) continue;
-    const textPart = Array.isArray(message.content) ? message.content.find((part) => isRecord16(part) && part.type === "text" && typeof part.text === "string") : void 0;
-    const diagnostic = isRecord16(textPart) ? textPart.text : void 0;
-    const details = isRecord16(message.details) ? message.details : classification.fact;
+    const textPart = Array.isArray(message.content) ? message.content.find((part) => isRecord15(part) && part.type === "text" && typeof part.text === "string") : void 0;
+    const diagnostic = isRecord15(textPart) ? textPart.text : void 0;
+    const details = isRecord15(message.details) ? message.details : classification.fact;
     return {
       cause: "activation",
       identity: { name: message.toolName, code: message.toolCallId },
@@ -25036,7 +24616,7 @@ function controlledFailureInputFromResolution(resolution) {
     } : {}
   };
 }
-function isRecord16(value) {
+function isRecord15(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function safelyRead(object, key) {
@@ -25160,7 +24740,7 @@ function boundRoleToolCallForResult(entries, resultIndex, message, outputToolNam
     const candidateMessage = entries[index]?.message;
     if (candidateMessage?.role === "assistant" && Array.isArray(candidateMessage.content)) {
       for (const part of candidateMessage.content) {
-        if (!isRecord16(part) || part.type !== "toolCall" || part.id !== callId) {
+        if (!isRecord15(part) || part.type !== "toolCall" || part.id !== callId) {
           continue;
         }
         if (part.name !== outputToolName) return void 0;
@@ -25232,7 +24812,7 @@ function parseNavigatorAttendanceDetails(details) {
   const advisoryDiagnostic = typeof details.routePlaybookReadFailure === "string" ? { advisoryDiagnostic: details.routePlaybookReadFailure } : {};
   if (disposition === "recommendation") {
     const next = details.next;
-    if (!isRecord16(next) || typeof next.role !== "string") {
+    if (!isRecord15(next) || typeof next.role !== "string") {
       return {
         disposition: "unavailable",
         source: "unknown",
@@ -25240,7 +24820,7 @@ function parseNavigatorAttendanceDetails(details) {
       };
     }
     const reason = typeof details.reason === "string" ? details.reason : "";
-    const route = Array.isArray(details.route) ? details.route.filter(isRecord16).map((target) => ({
+    const route = Array.isArray(details.route) ? details.route.filter(isRecord15).map((target) => ({
       role: String(target.role),
       phase: navigatorPhaseValue(target.phase)
     })) : void 0;
@@ -25303,8 +24883,8 @@ function projectTerminalGateFact(rounds) {
   };
 }
 async function extractGateFactFromSessionDirectory(sessionDirectory, options = {}) {
-  const directories = [join21(sessionDirectory, "auditor-roles")];
-  const parentSessionFile = options.parentSessionFile ?? join21(sessionDirectory, "session.jsonl");
+  const directories = [join20(sessionDirectory, "auditor-roles")];
+  const parentSessionFile = options.parentSessionFile ?? join20(sessionDirectory, "session.jsonl");
   const rounds = await readAnalystGateCyclesFromAuditorRoles(directories, {
     parentSessionFile
   });
@@ -25312,7 +24892,7 @@ async function extractGateFactFromSessionDirectory(sessionDirectory, options = {
 }
 async function withOptionalGateProjection(base, sessionDirectory, gateContext = {}) {
   const secondaryEvidence = base.roleOutcome.kind === "failure" ? base.roleOutcome.decisiveFacts.secondaryEvidence : void 0;
-  if (isRecord16(secondaryEvidence) && secondaryEvidence.kind === "role_infrastructure_failure" && (secondaryEvidence.stage === "gatekeeper" || secondaryEvidence.stage === "inspector" || secondaryEvidence.stage === "notary")) return base;
+  if (isRecord15(secondaryEvidence) && secondaryEvidence.kind === "role_infrastructure_failure" && (secondaryEvidence.stage === "gatekeeper" || secondaryEvidence.stage === "inspector" || secondaryEvidence.stage === "notary")) return base;
   const gate = await extractGateFactFromSessionDirectory(sessionDirectory, gateContext);
   return gate === void 0 ? base : { ...base, gate };
 }
@@ -25352,7 +24932,7 @@ function extractNavigatorFact(entries) {
     const entry = entries[i];
     if (entry?.type === "custom_message" && entry.customType === "ak-navigator-attendance") {
       const details = entry.message?.details ?? entry.details;
-      if (!isRecord16(details)) {
+      if (!isRecord15(details)) {
         return {
           disposition: "unavailable",
           source: "unknown",
@@ -25402,8 +24982,8 @@ async function extractNavigatorFactFromAdmittedSession(sessionFile) {
 async function publishJudgeArtifacts(admitted, roleOutcome, coordinates) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -25447,8 +25027,8 @@ async function publishJudgeArtifacts(admitted, roleOutcome, coordinates) {
 async function publishCoderArtifacts(admitted, roleOutcome, coordinates, options = {}) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -25599,8 +25179,8 @@ function extractFixerMethodInvocations(entries, options) {
 async function publishFixerArtifacts(admitted, roleOutcome, coordinates, options) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -25690,8 +25270,8 @@ async function settleLawfulFixerTerminalResult(admitted, authority, options) {
 async function publishCollectorArtifacts(admitted, roleOutcome, coordinates, options = {}) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -25750,7 +25330,7 @@ async function settleLawfulCollectorTerminalResult(admitted, authority) {
       const residual = boundErroredToolCandidate(entries, index, message, COLLECTOR_WAIT_TOOL);
       if (residual === void 0) continue;
       const candidate = residual.candidate;
-      const duration = isRecord16(candidate) ? candidate.durationMs : void 0;
+      const duration = isRecord15(candidate) ? candidate.durationMs : void 0;
       if (Number.isSafeInteger(duration) && duration >= 1 && duration <= 9e5) {
         continue;
       }
@@ -25798,8 +25378,8 @@ async function trySettleCollectorTerminalResult(admitted, authority) {
 async function publishDoctorArtifacts(admitted, roleOutcome, coordinates, options = {}) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -25940,7 +25520,7 @@ async function settleLawfulSeatAcceptedTerminalResult(admitted, authority, spec,
         spec.toolName
       );
       if (residual !== void 0) {
-        const details = isRecord16(residual.candidate) ? residual.candidate : { candidate: residual.candidate };
+        const details = isRecord15(residual.candidate) ? residual.candidate : { candidate: residual.candidate };
         return settleFailureTerminalResult(admitted, {
           cause: "output",
           diagnostic: residual.diagnostic,
@@ -26059,8 +25639,8 @@ function extractReviewerMethodInvocations(entries, options) {
 async function publishReviewerArtifacts(admitted, roleOutcome, coordinates, options) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -26174,8 +25754,8 @@ function extractMergerMethodInvocations(entries, options) {
 async function publishMergerArtifacts(admitted, roleOutcome, coordinates, options) {
   await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
   const artifactsDir = await ensureRunArtifactsDir(admitted.runDirectory);
-  const reportPath = join21(artifactsDir, "report.json");
-  const evidencePath = join21(artifactsDir, "evidence.json");
+  const reportPath = join20(artifactsDir, "report.json");
+  const evidencePath = join20(artifactsDir, "evidence.json");
   await writeFile5(
     reportPath,
     `${JSON.stringify(
@@ -26242,7 +25822,7 @@ async function settleLawfulMergerTerminalResult(admitted, authority, options) {
       if (message?.role !== "toolResult") continue;
       const residual = boundErroredToolCandidate(entries, index, message, MERGER_OUTPUT_TOOL_NAME);
       if (residual === void 0) continue;
-      const attemptId = isRecord16(residual.candidate) ? safelyRead(residual.candidate, "attemptId") : { readable: true, value: void 0 };
+      const attemptId = isRecord15(residual.candidate) ? safelyRead(residual.candidate, "attemptId") : { readable: true, value: void 0 };
       if (!attemptId.readable || attemptId.value !== admitted.runId) continue;
       return {
         roleOutcome: buildResidualIncompleteTerminalOutcome({
@@ -26320,7 +25900,7 @@ function uniqueFailureFallbackDirs(runDirectory, baseDir) {
   return dirs;
 }
 async function resolveFailureArtifactsBase(runDirectory) {
-  const artifactsDir = join21(runDirectory, "artifacts");
+  const artifactsDir = join20(runDirectory, "artifacts");
   try {
     await ensureRunArtifactsDir(runDirectory);
     return { baseDir: artifactsDir };
@@ -26336,7 +25916,7 @@ async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbac
   const candidates = [
     ...preferredCandidates,
     // One unique name per fallback dir — collisions on fixed names cannot exhaust this.
-    ...uniqueFallbackDirs.map((dir) => join21(dir, `${stem}.${randomUUID3()}.json`))
+    ...uniqueFallbackDirs.map((dir) => join20(dir, `${stem}.${randomUUID3()}.json`))
   ];
   for (let i = 0; i < candidates.length; i += 1) {
     const path = candidates[i];
@@ -26381,26 +25961,26 @@ async function publishFailureArtifacts(admitted, failure, authority) {
   } catch (error) {
     priorIssues.push(publicationAttemptFromError(sessionFile, error));
   }
-  const underArtifacts = baseDir === join21(admitted.runDirectory, "artifacts");
+  const underArtifacts = baseDir === join20(admitted.runDirectory, "artifacts");
   const uniqueFallbackDirs = uniqueFailureFallbackDirs(
     admitted.runDirectory,
     baseDir
   );
   const errorCandidates = underArtifacts ? [
-    join21(baseDir, "error.json"),
-    join21(baseDir, "error.settlement.json"),
-    join21(admitted.runDirectory, "error.settlement.json")
+    join20(baseDir, "error.json"),
+    join20(baseDir, "error.settlement.json"),
+    join20(admitted.runDirectory, "error.settlement.json")
   ] : [
-    join21(baseDir, "error.settlement.json"),
-    join21(baseDir, "error.json")
+    join20(baseDir, "error.settlement.json"),
+    join20(baseDir, "error.json")
   ];
   const evidenceCandidates = underArtifacts ? [
-    join21(baseDir, "evidence.json"),
-    join21(baseDir, "evidence.settlement.json"),
-    join21(admitted.runDirectory, "evidence.settlement.json")
+    join20(baseDir, "evidence.json"),
+    join20(baseDir, "evidence.settlement.json"),
+    join20(admitted.runDirectory, "evidence.settlement.json")
   ] : [
-    join21(baseDir, "evidence.settlement.json"),
-    join21(baseDir, "evidence.json")
+    join20(baseDir, "evidence.settlement.json"),
+    join20(baseDir, "evidence.json")
   ];
   const errorPayloadBase = {
     kind: "error",
@@ -26666,9 +26246,336 @@ function projectRoleTurnRequest(admitted, roleDetails, options) {
     ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
   };
 }
-var init_turn_request = __esm({
-  "src/public-cli/turn-request.ts"() {
+var init_turn_request = __esm({
+  "src/public-cli/turn-request.ts"() {
+    "use strict";
+  }
+});
+
+// src/ticket-provenance-contracts.ts
+function isRecord16(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function projectTicketProvenanceDiagnostic(value) {
+  if (!isRecord16(value)) return void 0;
+  if (value.recordClass !== TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC) {
+    return void 0;
+  }
+  if (typeof value.diagnosticKind !== "string" || !DIAGNOSTIC_KINDS.has(value.diagnosticKind)) {
+    return void 0;
+  }
+  if (typeof value.cause !== "string" || value.cause.length === 0) {
+    return void 0;
+  }
+  if (typeof value.recordedAt !== "string" || value.recordedAt.length === 0) {
+    return void 0;
+  }
+  return {
+    recordClass: TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC,
+    diagnosticKind: value.diagnosticKind,
+    cause: value.cause,
+    recordedAt: value.recordedAt,
+    ...typeof value.reason === "string" ? { reason: value.reason } : {}
+  };
+}
+function projectTicketProvenanceEntry(value) {
+  if (!isRecord16(value)) return void 0;
+  if (value.recordClass === TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC) {
+    return void 0;
+  }
+  if (!isRecord16(value.basis)) return void 0;
+  if (typeof value.basis.method !== "string" || !BASIS_METHODS.has(value.basis.method)) {
+    return void 0;
+  }
+  if (typeof value.sourceKind !== "string" || !SOURCE_KINDS.has(value.sourceKind)) {
+    return void 0;
+  }
+  if (!isRecord16(value.sourceRef)) return void 0;
+  if (typeof value.transcript !== "string" || value.transcript.length === 0) {
+    return void 0;
+  }
+  if (typeof value.timestamp !== "string" || value.timestamp.length === 0) {
+    return void 0;
+  }
+  const basis = {
+    method: value.basis.method,
+    ...Array.isArray(value.basis.anchors) ? {
+      anchors: value.basis.anchors.filter(
+        (item) => typeof item === "string"
+      )
+    } : {},
+    ...typeof value.basis.note === "string" ? { note: value.basis.note } : {}
+  };
+  const sourceRef = {
+    ...typeof value.sourceRef.sessionFile === "string" ? { sessionFile: value.sourceRef.sessionFile } : {},
+    ...typeof value.sourceRef.entryId === "string" || typeof value.sourceRef.entryId === "number" ? { entryId: value.sourceRef.entryId } : {},
+    ...typeof value.sourceRef.path === "string" ? { path: value.sourceRef.path } : {},
+    ...typeof value.sourceRef.url === "string" ? { url: value.sourceRef.url } : {}
+  };
+  return {
+    basis,
+    sourceKind: value.sourceKind,
+    sourceRef,
+    transcript: value.transcript,
+    timestamp: value.timestamp
+  };
+}
+var TICKET_PROVENANCE_KIND, TICKET_PROVENANCE_HUMAN_VIEW, TICKET_PROVENANCE_OFFERED_WATERMARK, TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC, SOURCE_KINDS, BASIS_METHODS, DIAGNOSTIC_KINDS;
+var init_ticket_provenance_contracts = __esm({
+  "src/ticket-provenance-contracts.ts"() {
+    "use strict";
+    TICKET_PROVENANCE_KIND = "ticket-provenance";
+    TICKET_PROVENANCE_HUMAN_VIEW = "\u8D77\u5C45\u5F55.md";
+    TICKET_PROVENANCE_OFFERED_WATERMARK = "offered-identities.jsonl";
+    TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC = "diagnostic";
+    SOURCE_KINDS = /* @__PURE__ */ new Set([
+      "cc-session",
+      "issue-body-comment",
+      "adr-decision-key",
+      "ticket-decree-block"
+    ]);
+    BASIS_METHODS = /* @__PURE__ */ new Set(["llm-semantic"]);
+    DIAGNOSTIC_KINDS = /* @__PURE__ */ new Set([
+      "collector-failed",
+      "issue-source-failed",
+      "quote-verify-failed"
+    ]);
+  }
+});
+
+// src/ticket-provenance.ts
+import { createHash as createHash5 } from "node:crypto";
+import { appendFileSync as appendFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join21 } from "node:path";
+function ticketProvenanceSubject(ticketNumber) {
+  if (!Number.isSafeInteger(ticketNumber) || ticketNumber < 1) {
+    throw new Error(`ticket-provenance subject requires a positive ticket number, got ${String(ticketNumber)}`);
+  }
+  return String(ticketNumber);
+}
+function ticketProvenanceEntryIdentity(input) {
+  const ref = input.sourceRef;
+  const refKey = [
+    ref.sessionFile ?? "",
+    ref.entryId === void 0 ? "" : String(ref.entryId),
+    ref.path ?? "",
+    ref.url ?? ""
+  ].join("
");
+  const material = [
+    String(input.ticketNumber),
+    input.sourceKind,
+    refKey,
+    input.transcript
+  ].join("\0");
+  return createHash5("sha256").update(material, "utf8").digest("hex");
+}
+function resolveTicketProvenanceVolume(ticketNumber, cwd, home) {
+  const path = resolveSitianRecordPath({
+    level: "event",
+    kind: TICKET_PROVENANCE_KIND,
+    subject: ticketProvenanceSubject(ticketNumber),
+    cwd,
+    ...home === void 0 ? {} : { home }
+  });
+  return {
+    recordFile: path.recordFile,
+    volumeDir: path.sessionDir,
+    humanViewFile: join21(path.sessionDir, TICKET_PROVENANCE_HUMAN_VIEW),
+    offeredWatermarkFile: join21(path.sessionDir, TICKET_PROVENANCE_OFFERED_WATERMARK)
+  };
+}
+function readOfferedIdentities(ticketNumber, cwd, home) {
+  const { offeredWatermarkFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
+  if (!existsSync7(offeredWatermarkFile)) return /* @__PURE__ */ new Set();
+  let text;
+  try {
+    text = readFileSync2(offeredWatermarkFile, "utf8");
+  } catch (error) {
+    throw new TicketProvenanceWatermarkError(
+      "unreadable",
+      `ticket-provenance offered watermark unreadable (${offeredWatermarkFile})`,
+      { cause: error }
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const lines = text.split("\n");
+  for (let index = 0; index < lines.length; index += 1) {
+    const trimmed = lines[index].trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch (error) {
+      throw new TicketProvenanceWatermarkError(
+        "malformed-json",
+        `ticket-provenance offered watermark malformed JSON at line ${index + 1} (${offeredWatermarkFile})`,
+        { cause: error }
+      );
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || typeof parsed.identity !== "string" || parsed.identity.length === 0) {
+      throw new TicketProvenanceWatermarkError(
+        "bad-shape",
+        `ticket-provenance offered watermark bad shape at line ${index + 1} (${offeredWatermarkFile})`
+      );
+    }
+    seen.add(parsed.identity);
+  }
+  return seen;
+}
+async function readTicketProvenance(ticketNumber, cwd, home) {
+  const { recordFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
+  const { records: records2 } = await readSitianRecords(recordFile);
+  const entries = [];
+  const diagnostics = [];
+  let skipped = 0;
+  for (const record4 of records2) {
+    if (record4.kind !== TICKET_PROVENANCE_KIND) {
+      skipped += 1;
+      continue;
+    }
+    const diagnostic = projectTicketProvenanceDiagnostic(record4.payload);
+    if (diagnostic !== void 0) {
+      diagnostics.push(diagnostic);
+      continue;
+    }
+    const entry = projectTicketProvenanceEntry(record4.payload);
+    if (entry === void 0) {
+      skipped += 1;
+      continue;
+    }
+    entries.push(entry);
+  }
+  return { entries, diagnostics, records: records2, recordFile, skipped };
+}
+function markdownFenceFor(text) {
+  let longest = 0;
+  const runs = text.match(/`+/g);
+  if (runs !== null) {
+    for (const run of runs) {
+      if (run.length > longest) longest = run.length;
+    }
+  }
+  return "`".repeat(Math.max(3, longest + 1));
+}
+function renderTicketProvenanceMarkdown(input) {
+  const lines = [
+    `# \u8D77\u5C45\u5F55 \xB7 #${input.ticketNumber}`,
+    "",
+    `\u6761\u76EE\u6570\uFF1A${input.entries.length}`,
+    ""
+  ];
+  let index = 0;
+  for (const entry of input.entries) {
+    index += 1;
+    lines.push(`## ${index}. ${entry.sourceKind} \xB7 ${entry.timestamp}`);
+    lines.push("");
+    lines.push(`- basis.method: \`${entry.basis.method}\``);
+    if (entry.basis.anchors !== void 0 && entry.basis.anchors.length > 0) {
+      lines.push(`- anchors: ${entry.basis.anchors.map((a) => `\`${a}\``).join(", ")}`);
+    }
+    if (entry.basis.note !== void 0) {
+      lines.push(`- note: ${entry.basis.note}`);
+    }
+    const refParts = [];
+    if (entry.sourceRef.sessionFile !== void 0) {
+      refParts.push(`sessionFile=${entry.sourceRef.sessionFile}`);
+    }
+    if (entry.sourceRef.entryId !== void 0) {
+      refParts.push(`entryId=${String(entry.sourceRef.entryId)}`);
+    }
+    if (entry.sourceRef.path !== void 0) {
+      refParts.push(`path=${entry.sourceRef.path}`);
+    }
+    if (entry.sourceRef.url !== void 0) {
+      refParts.push(`url=${entry.sourceRef.url}`);
+    }
+    if (refParts.length > 0) {
+      lines.push(`- sourceRef: ${refParts.join(" \xB7 ")}`);
+    }
+    lines.push("");
+    const fence = markdownFenceFor(entry.transcript);
+    lines.push(fence);
+    lines.push(entry.transcript);
+    lines.push(fence);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function ensureTicketProvenanceVolume(ticketNumber, cwd, home) {
+  const volume = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
+  mkdirSync3(volume.volumeDir, { recursive: true });
+  appendFileSync2(volume.recordFile, "", "utf8");
+  return volume;
+}
+function appendTicketProvenanceDiagnostic(input) {
+  const subject = ticketProvenanceSubject(input.ticketNumber);
+  const identityParts = input.diagnostic.diagnosticKind === "quote-verify-failed" ? [
+    subject,
+    input.diagnostic.recordClass,
+    input.diagnostic.diagnosticKind,
+    input.diagnostic.cause,
+    input.diagnostic.reason ?? ""
+  ] : [
+    subject,
+    input.diagnostic.recordClass,
+    input.diagnostic.diagnosticKind,
+    input.diagnostic.recordedAt,
+    input.diagnostic.cause,
+    input.diagnostic.reason ?? ""
+  ];
+  const identity = createHash5("sha256").update(identityParts.join("\0"), "utf8").digest("hex");
+  return sitianReport({
+    level: "event",
+    kind: TICKET_PROVENANCE_KIND,
+    identity,
+    subject,
+    cwd: input.cwd,
+    ...input.home === void 0 ? {} : { home: input.home },
+    host: input.host ?? "diarist",
+    source: input.source ?? "diarist-diagnostic",
+    payload: input.diagnostic
+  });
+}
+function appendIssueSourceFailureDiagnostic(input) {
+  const recordedAt = input.recordedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  return appendTicketProvenanceDiagnostic({
+    ticketNumber: input.ticketNumber,
+    cwd: input.cwd,
+    ...input.home === void 0 ? {} : { home: input.home },
+    source: "diarist-issue-source",
+    diagnostic: {
+      recordClass: TICKET_PROVENANCE_RECORD_CLASS_DIAGNOSTIC,
+      diagnosticKind: "issue-source-failed",
+      cause: input.cause,
+      recordedAt,
+      reason: input.reason
+    }
+  });
+}
+function writeTicketProvenanceHumanView(input) {
+  const volume = ensureTicketProvenanceVolume(input.ticketNumber, input.cwd, input.home);
+  const md = renderTicketProvenanceMarkdown({
+    ticketNumber: input.ticketNumber,
+    entries: input.entries
+  });
+  writeFileSync2(volume.humanViewFile, md, "utf8");
+  return volume.humanViewFile;
+}
+var TicketProvenanceWatermarkError;
+var init_ticket_provenance = __esm({
+  "src/ticket-provenance.ts"() {
     "use strict";
+    init_sitian_facade();
+    init_ticket_provenance_contracts();
+    TicketProvenanceWatermarkError = class extends Error {
+      code = "ticket-provenance-watermark";
+      reason;
+      constructor(reason, message, options) {
+        super(message, options);
+        this.name = "TicketProvenanceWatermarkError";
+        this.reason = reason;
+      }
+    };
   }
 });
 
@@ -27854,12 +27761,7 @@ async function runPublicCoder(argv, env, io, parseCoderArgv2) {
         })
       }
     }),
-    adapters: {
-      ...coderAdapters(methodProvenance),
-      beforeDispatch: async (admittedSeat) => {
-        await resolveSeatTicketBinding(admittedSeat, env);
-      }
-    },
+    adapters: coderAdapters(methodProvenance),
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
   });
 }
@@ -27919,7 +27821,6 @@ var init_coder_run = __esm({
     init_method_skill();
     init_cli_errors();
     init_invocation();
-    init_seat_ticket_binding();
     init_run_lifecycle();
     init_settlement();
     init_turn_request();
@@ -27927,6 +27828,30 @@ var init_coder_run = __esm({
   }
 });
 
+// src/public-cli/seat-ticket-binding.ts
+async function tryResumeSameTicketSeatRun(input) {
+  if (input.freshSummons === true) return void 0;
+  if (input.parentRunPath === void 0 && input.ticketNumber === void 0) {
+    return void 0;
+  }
+  const previousRunId = await findLatestRunIdForSeatTicket({
+    home: input.home,
+    bookKey: resolveBookKeyFromGit(input.projectRoot),
+    role: input.role,
+    ...input.parentRunPath === void 0 ? {} : { parentRunPath: input.parentRunPath },
+    ...input.ticketNumber === void 0 ? {} : { ticketNumber: input.ticketNumber }
+  });
+  if (previousRunId === void 0) return void 0;
+  return await input.resume(previousRunId, input.summons);
+}
+var init_seat_ticket_binding = __esm({
+  "src/public-cli/seat-ticket-binding.ts"() {
+    "use strict";
+    init_activation_ledger_git();
+    init_run_lifecycle();
+  }
+});
+
 // src/public-cli/instruction-seat-run.ts
 function buildInstructionSeatTurnRequest(admitted, options) {
   return projectRoleTurnRequest(
@@ -28048,7 +27973,6 @@ async function runPublicInstructionSeat(argv, env, io, role, parseArgv2) {
   let auditorSubject;
   let auditorSourceRun;
   let auditorSourceTicket;
-  let reusedTicketNumber;
   const projectRoot = parsed.project ?? env.cwd;
   if (role === "auditor") {
     if (parsed.subject !== "judge" && parsed.subject !== "doctor") {
@@ -28083,12 +28007,6 @@ async function runPublicInstructionSeat(argv, env, io, role, parseArgv2) {
       );
       return { exitCode: 2 };
     }
-  } else {
-    reusedTicketNumber = await resolveKnownTicketNumber({
-      instruction: parsed.instruction,
-      projectRoot,
-      home: env.home
-    });
   }
   const summons = {
     instruction: parsed.instruction,
@@ -28114,21 +28032,6 @@ async function runPublicInstructionSeat(argv, env, io, role, parseArgv2) {
       })
     });
     if (resumed !== void 0) return resumed;
-  } else if (reusedTicketNumber !== void 0) {
-    const resumed = await tryResumeSameTicketSeatRun({
-      home: env.home,
-      projectRoot,
-      role,
-      ticketNumber: reusedTicketNumber,
-      freshSummons: env.freshSummons,
-      summons,
-      resume: (runId, materials) => runPublicInstructionSeatResume(
-        { runId, ...materials === void 0 ? {} : { summons: materials } },
-        env,
-        io
-      )
-    });
-    if (resumed !== void 0) return resumed;
   }
   let admitted;
   try {
@@ -28186,8 +28089,6 @@ async function runPublicInstructionSeat(argv, env, io, role, parseArgv2) {
           beforeDispatch: async (admittedSeat) => {
             if (auditorSourceTicket !== void 0) {
               await bindAdmittedTicketNumber(admittedSeat, auditorSourceTicket);
-            } else {
-              await bindReusedTicketNumber(admittedSeat, reusedTicketNumber);
             }
           }
         }),
@@ -28320,7 +28221,7 @@ var init_collector_run = __esm({
 
 // src/diarist-mechanical.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync as realpathSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync as realpathSync3, statSync as statSync2 } from "node:fs";
 import { basename as basename7, join as join25, resolve as resolve10 } from "node:path";
 import { homedir } from "node:os";
 function extractCornerQuotes(text, minLength = DEFAULT_QUOTE_MIN) {
@@ -28402,7 +28303,7 @@ function isNotificationRow(type, text) {
 }
 function readCcSessionBlocks(options) {
   const root = options.projectsRoot ?? join25(homedir(), ".claude", "projects");
-  if (!existsSync9(root)) return [];
+  if (!existsSync8(root)) return [];
   const blocks = [];
   const dirs = /* @__PURE__ */ new Set();
   for (const cwd of options.cwds) {
@@ -28411,10 +28312,10 @@ function readCcSessionBlocks(options) {
   for (const cwd of options.cwds) {
     if (cwd.includes("projects")) continue;
     const direct = join25(root, cwd);
-    if (existsSync9(direct)) dirs.add(direct);
+    if (existsSync8(direct)) dirs.add(direct);
   }
   for (const dir of dirs) {
-    if (!existsSync9(dir)) continue;
+    if (!existsSync8(dir)) continue;
     let dirStat;
     try {
       dirStat = statSync2(dir);
@@ -28539,7 +28440,7 @@ function readAdrDecisionKeyBlocks(input) {
   const adrRootAbs = resolve10(cwdAbs, DIARIST_ADR_ROOT_REL);
   let adrRootReal;
   try {
-    adrRootReal = existsSync9(adrRootAbs) ? realpathSync3(adrRootAbs) : resolve10(realpathSync3(cwdAbs), DIARIST_ADR_ROOT_REL);
+    adrRootReal = existsSync8(adrRootAbs) ? realpathSync3(adrRootAbs) : resolve10(realpathSync3(cwdAbs), DIARIST_ADR_ROOT_REL);
   } catch (error) {
     throw new DiaristSourceReadError(
       "adr-unreadable",
@@ -28565,7 +28466,7 @@ function readAdrDecisionKeyBlocks(input) {
         `diarist referenced ADR escapes docs/adr (${rel})`
       );
     }
-    if (!existsSync9(abs)) {
+    if (!existsSync8(abs)) {
       throw new DiaristSourceReadError(
         "adr-missing",
         abs,
@@ -28797,22 +28698,28 @@ function loadSourceBlocks(input) {
   return blocks;
 }
 async function prepareDiaristSourceCatalog(input) {
-  ensureTicketProvenanceVolume(input.ticketNumber, input.cwd, input.home);
-  const volume = await readTicketProvenance(input.ticketNumber, input.cwd, input.home);
-  writeTicketProvenanceHumanView({
-    ticketNumber: input.ticketNumber,
-    cwd: input.cwd,
-    ...input.home === void 0 ? {} : { home: input.home },
-    entries: volume.entries
-  });
+  const known = input.ticketNumber;
+  if (known !== void 0) {
+    ensureTicketProvenanceVolume(known, input.cwd, input.home);
+    const volume = await readTicketProvenance(known, input.cwd, input.home);
+    writeTicketProvenanceHumanView({
+      ticketNumber: known,
+      cwd: input.cwd,
+      ...input.home === void 0 ? {} : { home: input.home },
+      entries: volume.entries
+    });
+  }
   const rawBlocks = loadSourceBlocks(input);
   const safeguarded = mechanicalSafeguardPipeline(rawBlocks);
-  const seen = await loadSeenEntryIdentities(input.ticketNumber, input.cwd, input.home);
+  const seen = known === void 0 ? /* @__PURE__ */ new Set() : await loadSeenEntryIdentities(known, input.cwd, input.home);
   const fresh = safeguarded.filter(
-    (block) => !seen.has(blockEntryIdentity(input.ticketNumber, block))
+    (block) => known === void 0 || !seen.has(blockEntryIdentity(known, block))
   );
   return {
-    ticketNumber: input.ticketNumber,
+    ...known === void 0 ? {} : { ticketNumber: known },
+    instruction: input.instruction,
+    runDirectory: input.runDirectory,
+    projectRoot: input.projectRoot,
     cwd: input.cwd,
     ...input.home === void 0 ? {} : { home: input.home },
     candidates: fresh.map((block, candidateIndex) => ({ ...block, candidateIndex }))
@@ -28850,7 +28757,7 @@ __export(diarist_run_exports, {
   runPublicDiarist: () => runPublicDiarist,
   runPublicDiaristResume: () => runPublicDiaristResume
 });
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync9 } from "node:fs";
 import { writeFile as writeFile7 } from "node:fs/promises";
 import { join as join26 } from "node:path";
 function withDiaristCatalogPath(prompt, sourcesPath) {
@@ -28877,22 +28784,24 @@ function buildDiaristTurnRequest(admitted, options, sourcesPath) {
   );
 }
 async function freezeDiaristSourceCatalog(admitted, env) {
-  if (admitted.ticketNumber === void 0) return void 0;
   const path = join26(admitted.runDirectory, DIARIST_SOURCE_CATALOG_FILE);
-  if (existsSync10(path)) {
+  if (existsSync9(path)) {
     const identity = await readRoleRunIdentity(admitted.runDirectory);
     if (identity !== void 0 && identity.state !== "terminal") return path;
   }
-  const issueFace = await loadDiaristIssueFace({
+  const issueFace = admitted.ticketNumber === void 0 ? void 0 : await loadDiaristIssueFace({
     ticketNumber: admitted.ticketNumber,
     projectRoot: admitted.projectRoot,
     home: env.home
   });
   const catalog = await prepareDiaristSourceCatalog({
-    ticketNumber: admitted.ticketNumber,
+    ...admitted.ticketNumber === void 0 ? {} : { ticketNumber: admitted.ticketNumber },
+    instruction: admitted.instruction,
+    runDirectory: admitted.runDirectory,
+    projectRoot: admitted.projectRoot,
     cwd: admitted.projectRoot,
     home: env.home,
-    issueFace,
+    ...issueFace === void 0 ? {} : { issueFace },
     sessionCwds: [admitted.projectRoot, env.cwd]
   });
   await writeFile7(path, serializeDiaristSourceCatalog(catalog), "utf8");
@@ -28917,12 +28826,8 @@ async function runPublicDiarist(argv, env, io, parseDiaristArgv2) {
     throw error;
   }
   const projectRoot = parsed.project ?? env.cwd;
-  const reusedTicketNumber = await resolveDiaristSummonsTicketNumber({
-    instruction: parsed.instruction,
-    projectRoot,
-    home: env.home
-  });
-  if (reusedTicketNumber !== void 0) {
+  const handoffTicket = env.boundTicketNumber;
+  if (typeof handoffTicket === "number" && Number.isSafeInteger(handoffTicket) && handoffTicket >= 1) {
     const summons = {
       instruction: parsed.instruction,
       instructionEmpty: parsed.instruction.trim() === "",
@@ -28932,7 +28837,7 @@ async function runPublicDiarist(argv, env, io, parseDiaristArgv2) {
       home: env.home,
       projectRoot,
       role: "diarist",
-      ticketNumber: reusedTicketNumber,
+      ticketNumber: handoffTicket,
       freshSummons: env.freshSummons,
       summons,
       resume: (runId, materials) => runPublicDiaristResume(
@@ -28964,6 +28869,9 @@ async function runPublicDiarist(argv, env, io, parseDiaristArgv2) {
     throw error;
   }
   await markRunAdmitted(admitted, env.principalAuthority);
+  if (typeof handoffTicket === "number" && Number.isSafeInteger(handoffTicket) && handoffTicket >= 1) {
+    await bindAdmittedTicketNumber(admitted, handoffTicket);
+  }
   const turnProjection = {
     packageRoot: env.packageRoot,
     home: env.home,
@@ -28991,7 +28899,6 @@ async function runPublicDiarist(argv, env, io, parseDiaristArgv2) {
     request: turnRequest,
     adapters: diaristAdapters({
       beforeDispatch: async (admittedSeat) => {
-        await bindReusedTicketNumber(admittedSeat, reusedTicketNumber);
         const sourcesPath = await freezeDiaristSourceCatalog(admittedSeat, env);
         Object.assign(
           turnRequest,
@@ -29000,6 +28907,21 @@ async function runPublicDiarist(argv, env, io, parseDiaristArgv2) {
       }
     }),
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
+  }).then(async (result2) => {
+    if (admitted.ticketNumber === void 0 && result2.admitted !== void 0) {
+      const roleOutcome = result2.terminal?.roleOutcome;
+      if (roleOutcome !== void 0 && roleOutcome.kind === "accepted" && roleOutcome.status !== "escalate") {
+        const facts = roleOutcome.decisiveFacts;
+        const raw = typeof facts.ticketNumber === "number" ? facts.ticketNumber : typeof facts.sitian?.ticketNumber === "number" ? facts.sitian.ticketNumber : void 0;
+        if (typeof raw === "number" && Number.isSafeInteger(raw) && raw >= 1) {
+          admitted.ticketNumber = raw;
+          if (result2.admitted.ticketNumber === void 0) {
+            result2.admitted.ticketNumber = raw;
+          }
+        }
+      }
+    }
+    return result2;
   });
 }
 async function runPublicDiaristResume(request, env, io) {
@@ -29037,9 +28959,9 @@ var init_diarist_run = __esm({
     init_engine_material();
     init_cli_errors();
     init_invocation();
-    init_seat_ticket_binding();
     init_post_admission();
     init_run_lifecycle();
+    init_seat_ticket_binding();
     init_settlement();
     init_turn_request();
     DIARIST_SOURCE_CATALOG_FILE = "diarist-sources.json";
@@ -29060,12 +28982,7 @@ function buildCountersignTurnRequest(admitted, options) {
     options
   );
 }
-async function runCountersignCourtDiaristStation(admitted, env, io) {
-  if (admitted.ticketNumber === void 0) return;
-  if (env.runCourtDiaristStation !== void 0) {
-    await env.runCourtDiaristStation(admitted);
-    return;
-  }
+async function invokeCourtDiarist(input, env, io) {
   const quietIo = {
     stdout() {
     },
@@ -29075,11 +28992,7 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
   };
   const { runPublicDiarist: runPublicDiarist2 } = await Promise.resolve().then(() => (init_diarist_run(), diarist_run_exports));
   const result2 = await runPublicDiarist2(
-    [
-      "--project",
-      admitted.projectRoot,
-      `\u6574\u7406 #${admitted.ticketNumber} \u7684\u672C\u6848\u4F9D\u636E\u3002`
-    ],
+    ["--project", input.projectRoot, input.instruction],
     {
       home: env.home,
       agentDir: env.agentDir,
@@ -29094,17 +29007,60 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
       ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
       ...env.credentials === void 0 ? {} : { credentials: env.credentials },
       ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId },
-      ...env.signal === void 0 ? {} : { signal: env.signal }
+      ...env.signal === void 0 ? {} : { signal: env.signal },
+      // Typed handoff only — never derived from summons prose.
+      ...input.boundTicketNumber === void 0 ? {} : { boundTicketNumber: input.boundTicketNumber }
     },
     quietIo,
     parseDiaristArgv
   );
+  const roleOutcome = result2.terminal?.roleOutcome;
+  if (roleOutcome !== void 0 && roleOutcome.kind !== "failure") {
+    if (roleOutcome.status === "escalate") {
+      const reason = typeof roleOutcome.decisiveFacts.reason === "string" ? roleOutcome.decisiveFacts.reason : "diarist escalated without reason";
+      return { identity: { kind: "escalate", reason } };
+    }
+  }
   if (result2.exitCode !== 0) {
-    const detail = result2.terminal?.roleOutcome.kind === "failure" ? ` (roleOutcome=failure)` : "";
+    const diagnostic = roleOutcome?.kind === "failure" ? roleOutcome.diagnostic : `exit ${result2.exitCode}`;
+    return {
+      identity: { kind: "unbound" },
+      failedWithoutEscalate: {
+        diagnostic: `court diarist station failed for ${input.failureLabel}: ${diagnostic}`
+      }
+    };
+  }
+  const asserted = result2.admitted?.ticketNumber;
+  if (typeof asserted === "number" && Number.isSafeInteger(asserted) && asserted >= 1) {
+    return { identity: { kind: "ticket", ticketNumber: asserted } };
+  }
+  return { identity: { kind: "unbound" } };
+}
+async function runCountersignCourtDiaristStation(admitted, env, io) {
+  if (env.runCourtDiaristStation !== void 0) {
+    await env.runCourtDiaristStation(admitted);
+    return;
+  }
+  if (admitted.ticketNumber === void 0) return;
+  const outcome = await invokeCourtDiarist(
+    {
+      instruction: `\u6574\u7406 #${admitted.ticketNumber} \u7684\u672C\u6848\u4F9D\u636E\u3002`,
+      projectRoot: admitted.projectRoot,
+      failureLabel: `ticket #${admitted.ticketNumber}`,
+      // Refresh holds a typed key — hand it off so freeze loads issue face.
+      boundTicketNumber: admitted.ticketNumber
+    },
+    env,
+    io
+  );
+  if (outcome.identity.kind === "escalate") {
     throw new Error(
-      `court diarist station failed for ticket #${admitted.ticketNumber}: exit ${result2.exitCode}${detail}`
+      `court diarist station escalated (cannot identify court target): ${outcome.identity.reason}`
     );
   }
+  if (outcome.failedWithoutEscalate !== void 0) {
+    throw new Error(outcome.failedWithoutEscalate.diagnostic);
+  }
 }
 async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
   let parsed;
@@ -29117,33 +29073,6 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
     }
     throw error;
   }
-  const projectRoot = parsed.project ?? env.cwd;
-  const reusedTicketNumber = await resolveKnownTicketNumber({
-    instruction: parsed.instruction,
-    projectRoot,
-    home: env.home
-  });
-  if (reusedTicketNumber !== void 0) {
-    const summons = {
-      instruction: parsed.instruction,
-      instructionEmpty: parsed.instruction.trim() === "",
-      attachmentPaths: parsed.attachmentPaths
-    };
-    const resumed = await tryResumeSameTicketSeatRun({
-      home: env.home,
-      projectRoot,
-      role: "countersign",
-      ticketNumber: reusedTicketNumber,
-      freshSummons: env.freshSummons,
-      summons,
-      resume: (runId, materials) => runPublicCountersignResume(
-        { runId, ...materials === void 0 ? {} : { summons: materials } },
-        env,
-        io
-      )
-    });
-    if (resumed !== void 0) return resumed;
-  }
   let admitted;
   try {
     admitted = await admitCountersignInvocation({
@@ -29165,6 +29094,80 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
     throw error;
   }
   await markRunAdmitted(admitted, env.principalAuthority);
+  let typedTicket;
+  let identityDiaristRan = false;
+  if (env.runCourtDiaristStation === void 0) {
+    const outcome = await invokeCourtDiarist(
+      {
+        instruction: parsed.instruction,
+        projectRoot: admitted.projectRoot,
+        failureLabel: "unbound summons"
+      },
+      env,
+      io
+    );
+    identityDiaristRan = true;
+    if (outcome.identity.kind === "escalate") {
+      return await presentControlledFailure2(
+        admitted,
+        {
+          timedOut: false,
+          code: null,
+          stderr: "",
+          thrown: new Error(
+            `court diarist station escalated (cannot identify court target): ${outcome.identity.reason}`
+          )
+        },
+        countersignAdapters(),
+        env.principalAuthority,
+        io
+      );
+    }
+    if (outcome.failedWithoutEscalate !== void 0) {
+      return await presentControlledFailure2(
+        admitted,
+        {
+          timedOut: false,
+          code: null,
+          stderr: "",
+          thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
+        },
+        countersignAdapters(),
+        env.principalAuthority,
+        io
+      );
+    }
+    if (outcome.identity.kind === "ticket") {
+      typedTicket = outcome.identity.ticketNumber;
+      const summons = {
+        instruction: parsed.instruction,
+        instructionEmpty: parsed.instruction.trim() === "",
+        attachmentPaths: parsed.attachmentPaths
+      };
+      const resumed = await tryResumeSameTicketSeatRun({
+        home: env.home,
+        projectRoot: admitted.projectRoot,
+        role: "countersign",
+        ticketNumber: typedTicket,
+        freshSummons: env.freshSummons,
+        summons,
+        resume: async (runId, materials) => {
+          await markRunTerminal(admitted.runDirectory);
+          return await runPublicCountersignResume(
+            {
+              runId,
+              ...materials === void 0 ? {} : { summons: materials }
+            },
+            env,
+            io
+          );
+        }
+      });
+      if (resumed !== void 0) {
+        return resumed;
+      }
+    }
+  }
   const turnProjection = {
     packageRoot: env.packageRoot,
     home: env.home,
@@ -29192,12 +29195,16 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
     request: turnRequest,
     adapters: countersignAdapters({
       beforeDispatch: async (admittedSeat) => {
-        await bindReusedTicketNumber(admittedSeat, reusedTicketNumber);
+        if (!identityDiaristRan) {
+          await runCountersignCourtDiaristStation(admittedSeat, env, io);
+        } else if (typedTicket !== void 0) {
+          await bindAdmittedTicketNumber(admittedSeat, typedTicket);
+          await runCountersignCourtDiaristStation(admittedSeat, env, io);
+        }
         Object.assign(
           turnRequest,
           buildCountersignTurnRequest(admittedSeat, turnProjection)
         );
-        await runCountersignCourtDiaristStation(admittedSeat, env, io);
       }
     }),
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
@@ -29250,9 +29257,9 @@ var init_countersign_run = __esm({
     init_engine_material();
     init_cli_errors();
     init_invocation();
-    init_seat_ticket_binding();
     init_post_admission();
     init_run_lifecycle();
+    init_seat_ticket_binding();
     init_settlement();
     init_turn_request();
   }
@@ -29570,12 +29577,7 @@ async function runPublicFixer(argv, env, io, parseFixerArgv2) {
         })
       }
     }),
-    adapters: {
-      ...fixerAdapters(env.packageRoot, methodMaterial),
-      beforeDispatch: async (admittedSeat) => {
-        await resolveSeatTicketBinding(admittedSeat, env);
-      }
-    },
+    adapters: fixerAdapters(env.packageRoot, methodMaterial),
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
   });
 }
@@ -29628,7 +29630,6 @@ var init_fixer_run = __esm({
     init_method_skill();
     init_cli_errors();
     init_invocation();
-    init_seat_ticket_binding();
     init_run_lifecycle();
     init_settlement();
     init_turn_request();
@@ -29637,7 +29638,7 @@ var init_fixer_run = __esm({
 });
 
 // src/public-cli/notary-run.ts
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 function buildNotaryTurnRequest(admitted, options) {
   return projectRoleTurnRequest(
     admitted,
@@ -29786,7 +29787,7 @@ async function runPublicNotaryResume(request, env, io) {
         env
       );
       const candidatePath = gateSubmissionCandidatePath(admitted.sourceRunPath);
-      const prompt = existsSync11(candidatePath) ? appendResumeMaterialReread(projection.continuation.prompt, candidatePath) : projection.continuation.prompt;
+      const prompt = existsSync10(candidatePath) ? appendResumeMaterialReread(projection.continuation.prompt, candidatePath) : projection.continuation.prompt;
       return buildNotaryTurnRequest(admitted, {
         ...projection,
         continuation: { kind: "resume", prompt }
@@ -29836,11 +29837,6 @@ async function runPublicInspector(argv, env, io, parseInspectorArgv2) {
     throw error;
   }
   const projectRoot = parsed.project ?? env.cwd;
-  const reusedTicketNumber = await resolveKnownTicketNumber({
-    instruction: parsed.instruction,
-    projectRoot,
-    home: env.home
-  });
   const parentRunPath = parentRunPathFromGatePointerInstruction(parsed.instruction);
   if (parentRunPath !== void 0) {
     const summons = {
@@ -29906,11 +29902,7 @@ async function runPublicInspector(argv, env, io, parseInspectorArgv2) {
     env,
     io,
     request: turnRequest,
-    adapters: inspectorAdapters({
-      beforeDispatch: async (admittedSeat) => {
-        await bindReusedTicketNumber(admittedSeat, reusedTicketNumber);
-      }
-    }),
+    adapters: inspectorAdapters(),
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
   });
 }
@@ -30042,12 +30034,7 @@ async function runPublicJudge(argv, env, io, parseJudgeArgv2) {
         })
       }
     }),
-    adapters: {
-      ...judgeAdapters(),
-      beforeDispatch: async (admittedSeat) => {
-        await resolveSeatTicketBinding(admittedSeat, env);
-      }
-    },
+    adapters: judgeAdapters(),
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
   });
 }
@@ -30071,7 +30058,6 @@ var init_judge_run = __esm({
     init_engine_material();
     init_cli_errors();
     init_invocation();
-    init_seat_ticket_binding();
     init_run_lifecycle();
     init_settlement();
     init_turn_request();
@@ -33761,7 +33747,7 @@ var init_cli = __esm({
 });
 
 // src/public-cli/main.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { dirname as dirname16, join as join33 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
@@ -33852,7 +33838,7 @@ function linkPackage(packageRoot2, name, targetDir) {
 var here = dirname16(fileURLToPath2(import.meta.url));
 function resolvePackageRoot(binDir) {
   const canonical = join33(binDir, "..", "..");
-  if (existsSync12(join33(canonical, "package.json"))) {
+  if (existsSync11(join33(canonical, "package.json"))) {
     return canonical;
   }
   return binDir;