@akagilnc/pi-workflow-roles 0.1.3902 → 0.1.3932

package/dist/public-cli/post-admission.js

@@ -12,6 +12,7 @@ import { buildResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run
 import { CliUsageError } from "./cli-errors.js";
 import { buildInstructionTransportPrompt, freezeAttachmentsIntoRun, } from "./invocation.js";
 import { pathContainedIn } from "../activation-ledger-topology.js";
+import { resolveHostAwareSessionAvailability } from "../session-identity.js";
 import { projectCaseDossierPointerSection } from "./case-dossier-delivery.js";
 /** Append one system section to a continuation prompt, keeping its kind. */
 function appendContinuationSection(continuation, section) {
@@ -22,12 +23,72 @@ function appendContinuationSection(continuation, section) {
 }
 import { projectHostTransitionPriorNative } from "../host-transition-prior-native.js";
 import { missingCredentialPreDispatchFailure, postRunMissingCredentialFailure, } from "./public-run-credentials.js";
-import { acquireRunWriterLease, clearCurrentCourt, clearTypedProviderHttpObservation, markRunResumable, markRunRunning, markRunTerminal, readCurrentCourt, recordCurrentCourt, renderResumeCommand, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
+import { acquireRunWriterLease, clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
 import { homeFromRunDirectory } from "../activation-ledger-topology.js";
 import { readSealedSubmission } from "../submission-ledger.js";
+import { clearReviewerDispatchRejection } from "./reviewer-dispatch-rejection.js";
 import { classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, sealedAcceptanceRedispatchDisposition, } from "./settlement.js";
 import {} from "./terminal.js";
-import { runWithAutoResumeLoop } from "./auto-resume.js";
+import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
+/**
+ * Nested station-child role already finished its own call-local loop.
+ * Parent records that failure once and must not auto-resume into a re-summon
+ * (#840 父子不层叠). Other beforeDispatch failures keep the shared #416 budget.
+ */
+export class StationChildExhaustedError extends Error {
+    name = "StationChildExhaustedError";
+}
+function withOnceSuccessfulBeforeDispatch(adapters) {
+    const hook = adapters.beforeDispatch;
+    if (hook === undefined)
+        return adapters;
+    let succeeded = false;
+    return {
+        ...adapters,
+        beforeDispatch: async (admitted) => {
+            if (succeeded)
+                return;
+            await hook(admitted);
+            succeeded = true;
+        },
+    };
+}
+/**
+ * Session custom-entry type for a best-effort post-dispatch cleanup
+ * diagnostic (#840 r9 判词 class 1). Every auto-resume attempt dispatches
+ * with dummyIo (src/public-cli/auto-resume.ts), so an io.stderr-only
+ * diagnostic never reaches a real caller — the dossier is the durable
+ * channel that does (失败诚实宪法 真因必须落痕).
+ */
+export const POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE = "ak_post_admission_cleanup_diagnostic";
+/**
+ * Best-effort post-dispatch diagnostic that must still leave a real trace
+ * even though the attempt's own io may be dummyIo (#840 r9 判词 class 1).
+ * Single authoritative durable channel — a dossier custom entry via
+ * sessionAppender — not a standing duplicate. Only when that one write
+ * itself fails does this fall back to a plain run-artifacts file (reusing
+ * auto-resume.ts's existing dispatch-error retention helper — no new
+ * mechanism), so an unhealthy session never leaves this diagnostic with
+ * zero durable trace (#840 bounce class 2); a healthy session never gets a
+ * redundant second copy (#840 bounce class 1: 同一业务规则只保留一个权威实现).
+ */
+async function recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic, io) {
+    io.stderr(formatCliDiagnostic(diagnostic));
+    const payload = { diagnostic, recordedAt: new Date().toISOString() };
+    try {
+        await env.sessionAppender(env.principalAuthority, admitted.principal, POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE, payload);
+        return;
+    }
+    catch (appendError) {
+        try {
+            const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
+            await writeFile(join(artifactsDir, `post-admission-diagnostic-${randomUUID()}.json`), `${JSON.stringify({ version: 1, ...payload }, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+        }
+        catch (artifactError) {
+            io.stderr(formatCliDiagnostic(`post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`));
+        }
+    }
+}
 /** Previous main-session host recorded on invocation.json, if any. */
 async function readInvocationHost(runDirectory) {
     try {
@@ -64,7 +125,7 @@ export async function resolveResumeMethodMaterialAdapters(input) {
         return { kind: "terminal", ...terminal };
     }
 }
-export async function presentControlledFailure(admitted, failureInput, adapters, authority, io) {
+export async function presentControlledFailure(admitted, failureInput, adapters, authority, io, persistRunState = true) {
     const hasThrown = Object.hasOwn(failureInput, "thrown");
     const resumeObservation = await resolveControlledFailureResumeObservation({
         runDirectory: admitted.runDirectory,
@@ -115,11 +176,8 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
         const sessionPrincipalAvailable = await authority.isAvailable(admitted.principal);
         resumable = sessionPrincipalAvailable && typedHttp429 !== undefined;
     }
-    if (resumable && typedHttp429 !== undefined) {
-        await markRunResumable(admitted.runDirectory, typedHttp429);
-    }
-    else {
-        await markRunTerminal(admitted.runDirectory);
+    if (persistRunState) {
+        await persistReturnedRunState(admitted, authority);
     }
     const terminal = await settleFailureTerminalResult(admitted, failure, authority, resumable
         ? { resume: { command: renderResumeCommand(admitted.runId) } }
@@ -131,13 +189,37 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
         terminal,
     };
 }
+/**
+ * presentControlledFailure, called only where the host turn has already
+ * genuinely started (#840 r9 判词 class 1 boundary). If presentControlledFailure
+ * itself fails, this never fabricates a replacement terminal (ADR 0080
+ * single-settlement-disposition — presentControlledFailure /
+ * settleFailureTerminalResult stays the one authority); it re-throws a
+ * TurnDispatchedFailure so runWithAutoResumeLoop still learns the turn
+ * started and selects a resume payload on the next attempt, while settling
+ * the true cause through its own existing dispatch-exception machinery once
+ * the retry budget is exhausted.
+ */
+async function settleAfterTurnStarted(admitted, failureInput, adapters, authority, io, persistRunState) {
+    try {
+        return (await presentControlledFailure(admitted, failureInput, adapters, authority, io, persistRunState));
+    }
+    catch (error) {
+        throw new TurnDispatchedFailure(error);
+    }
+}
 export async function dispatchPostAdmissionTurn(input) {
     const { admitted, env, io, request, lease, adapters, effectiveEngine } = input;
+    const persistRunState = input.persistRunState !== false;
+    const deferredPersist = persistRunState ? {} : { needsPersist: true };
     const shouldPresent = adapters.shouldPresentSettled ?? ((terminal) => isLawfulTypedTerminalOutcome(terminal.roleOutcome));
     try {
         const missingCredential = missingCredentialPreDispatchFailure(env.model, env.credentials);
         if (missingCredential !== undefined) {
-            return (await presentControlledFailure(admitted, missingCredential, adapters, env.principalAuthority, io));
+            return {
+                ...(await presentControlledFailure(admitted, missingCredential, adapters, env.principalAuthority, io, persistRunState)),
+                ...deferredPersist,
+            };
         }
         // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
         // Single authority projectHostTransitionPriorNative classifies the prior native volume.
@@ -161,28 +243,45 @@ export async function dispatchPostAdmissionTurn(input) {
         }
         catch (error) {
             // prior-native IO is on the public one-shot path — controlled failure, not bare throw.
-            return (await presentControlledFailure(admitted, {
-                timedOut: false,
-                code: null,
-                stderr: "",
-                thrown: error,
-            }, adapters, env.principalAuthority, io));
+            return {
+                ...(await presentControlledFailure(admitted, {
+                    timedOut: false,
+                    code: null,
+                    stderr: "",
+                    thrown: error,
+                }, adapters, env.principalAuthority, io, persistRunState)),
+                ...deferredPersist,
+            };
         }
-        await markRunRunning(admitted.runDirectory, env.model, effectiveEngine, env.host);
         await clearTypedProviderHttpObservation(admitted.runDirectory);
-        // beforeDispatch (seat-owned pre-turn work) runs after running is marked —
-        // its failures must settle the run, not leave it permanently running.
+        // Per-attempt hygiene: stale Reviewer rejection pages must not ride into
+        // auto-resume. ENOENT-safe for every seat.
+        await clearReviewerDispatchRejection(admitted.runDirectory);
+        // The authoritative host write (markRunRunning) is delayed to just before
+        // executeTurn — not merely past beforeDispatch (#840 r9 判词 class 2). Any
+        // pre-turn retry (beforeDispatch, dossier projection, continuation
+        // assembly) must still see the prior invocation host on its next attempt;
+        // committing env.host earlier would make readInvocationHost read back the
+        // new host on the retry and silently drop hostTransition.
+        // Failures settle the run (presentControlledFailure); they must not leave it
+        // permanently running. Call-local auto-resume retries this hook until it
+        // succeeds; only an exhausted nested station child skips the parent loop
+        // (#840 父子不层叠).
         if (adapters.beforeDispatch !== undefined) {
             try {
                 await adapters.beforeDispatch(admitted);
             }
             catch (error) {
-                return (await presentControlledFailure(admitted, {
+                const settled = (await presentControlledFailure(admitted, {
                     timedOut: false,
                     code: null,
                     stderr: "",
                     thrown: error,
-                }, adapters, env.principalAuthority, io));
+                }, adapters, env.principalAuthority, io, persistRunState));
+                if (error instanceof StationChildExhaustedError) {
+                    return { ...settled, skipAutoResume: true, ...deferredPersist };
+                }
+                return { ...settled, ...deferredPersist };
             }
         }
         // Turn request is assembled after beforeDispatch so this turn sees whatever it
@@ -192,6 +291,9 @@ export async function dispatchPostAdmissionTurn(input) {
         // alike. System refs append their own neutral section; caller frozen
         // attachments and the seat's own prompt bytes are never rewritten.
         let turnRequest = env.signal === undefined ? request : { ...request, signal: env.signal };
+        if (env.stationChild !== undefined) {
+            turnRequest = { ...turnRequest, stationChild: env.stationChild };
+        }
         if (hostTransition !== undefined) {
             turnRequest = { ...turnRequest, hostTransition };
         }
@@ -206,23 +308,47 @@ export async function dispatchPostAdmissionTurn(input) {
                 continuation: appendContinuationSection(turnRequest.continuation, dossierSection),
             };
         }
+        // Authoritative host write happens here, at the real dispatch boundary —
+        // immediately before the turn actually starts, after every retryable
+        // pre-turn step above has succeeded on this attempt (#840 r9 判词 class 2).
+        await markRunRunning(admitted.runDirectory, env.model, effectiveEngine, env.host);
         let result;
         try {
             result = await env.roleTurnHost.executeTurn(turnRequest);
         }
         catch (error) {
-            return (await presentControlledFailure(admitted, {
+            const settled = await settleAfterTurnStarted(admitted, {
                 timedOut: false,
                 code: null,
                 stderr: "",
                 thrown: error,
-            }, adapters, env.principalAuthority, io));
+            }, adapters, env.principalAuthority, io, persistRunState);
+            return { ...settled, turnDispatched: true, ...deferredPersist };
         }
+        // Everything below runs after the host turn genuinely started (#840 r9
+        // 判词 class 1 boundary — 覆盖 executeTurn 已启动后至返回带 turnDispatched
+        // 结果前的全部异常). Each fallible step routes any failure through the
+        // single existing settlement authority (presentControlledFailure /
+        // settleFailureTerminalResult) rather than a second one (ADR 0080
+        // single-settlement-disposition) — never by fabricating a terminal here.
+        // A cleanup step that runs only after a real settlement (clearCurrentCourt)
+        // is protected by logging and keeping that already-obtained result, never
+        // by discarding it (#840 已交劳动只整理终局不重做). A failure inside the
+        // settlement authority itself (presentControlledFailure's own reads) goes
+        // through settleAfterTurnStarted: still no fabricated terminal, but the
+        // re-thrown TurnDispatchedFailure still tells runWithAutoResumeLoop the
+        // turn genuinely started, so the next retry sends a resume payload — the
+        // true cause settles through the loop's own existing dispatch-exception
+        // machinery once the retry budget is exhausted.
         try {
             await writeFile(join(admitted.runDirectory, "stderr.log"), result.stderr, "utf8");
         }
-        catch {
-            // continue to lawful / controlled-failure settlement
+        catch (error) {
+            // Best-effort: the turn's own stderr capture is secondary to lawful /
+            // controlled-failure settlement below, but the failure itself must
+            // still leave a real trace (失败诚实宪法 真因必须落痕) — durably, since
+            // every auto-resume attempt's io is dummyIo (#840 r9 判词 class 1).
+            await recordBestEffortPostDispatchDiagnostic(admitted, env, `stderr.log write failed (best-effort continue): ${describeErrorIdentity(error)}`, io);
         }
         let settled;
         // Same-ticket re-summons carry courtAttemptId — settle only that attempt so a
@@ -230,55 +356,111 @@ export async function dispatchPostAdmissionTurn(input) {
         const courtScope = request.courtAttemptId === undefined || request.courtAttemptId.length === 0
             ? undefined
             : { courtAttemptId: request.courtAttemptId };
+        // Single complete boundary (#840 r9 判词 class 1): trySettle, its
+        // shouldPresent gate, and the accepted-settlement cleanup all settle
+        // through this one catch. shouldPresent used to sit outside every
+        // TurnDispatchedFailure wrap, so a throw from it looked like an ordinary
+        // pre-turn throw to the caller (turnStartedBeforeThrow stayed false) and
+        // replayed the initial payload even though the host turn had already
+        // genuinely run.
+        let settledOutcome;
         try {
             settled = await adapters.trySettle(admitted, env.principalAuthority, courtScope);
+            if (settled !== undefined && shouldPresent(settled)) {
+                // This court sealed — drop open-court pointer (bare resume no longer continues it).
+                if (settled.roleOutcome.kind === "accepted" &&
+                    request.courtAttemptId !== undefined &&
+                    request.courtAttemptId.length > 0) {
+                    try {
+                        await clearCurrentCourt(admitted.runDirectory, request.courtAttemptId);
+                    }
+                    catch (error) {
+                        // Settlement already sealed accepted — a cleanup failure here must
+                        // not erase that fact or make the caller replay this court's
+                        // summons over already-delivered work (#840 已交劳动只整理终局不重做).
+                        // A later bare resume self-heals: buildRequestAfterLease finds the
+                        // open court already sealed and clears it then (documented
+                        // continue-under-failure contract, not a swallow — 失败诚实宪法 真因
+                        // 必须落痕) — durably, since every auto-resume attempt's io here is
+                        // dummyIo (#840 r9 判词 class 1).
+                        await recordBestEffortPostDispatchDiagnostic(admitted, env, `current-court cleanup failed after accepted settlement (best-effort continue, self-heals on next resume): ${describeErrorIdentity(error)}`, io);
+                    }
+                }
+                settledOutcome = {
+                    exitCode: exitCodeForTerminalOutcome(settled.roleOutcome),
+                    admitted,
+                    terminal: settled,
+                    turnDispatched: true,
+                };
+            }
         }
         catch (error) {
-            // Settle throw is a real failure fact — never swallow into undefined.
-            return (await presentControlledFailure(admitted, {
+            // Settle (or its shouldPresent gate) throw is a real failure fact —
+            // never swallow into undefined.
+            const settledFailure = await settleAfterTurnStarted(admitted, {
                 timedOut: false,
                 code: result.code,
                 stderr: result.stderr,
                 thrown: error,
-            }, adapters, env.principalAuthority, io));
-        }
-        if (settled !== undefined && shouldPresent(settled)) {
-            // This court sealed — drop open-court pointer (bare resume no longer continues it).
-            if (settled.roleOutcome.kind === "accepted" &&
-                request.courtAttemptId !== undefined &&
-                request.courtAttemptId.length > 0) {
-                await clearCurrentCourt(admitted.runDirectory, request.courtAttemptId);
-            }
-            await markRunTerminal(admitted.runDirectory);
-            io.stdout(formatTerminalResult(settled));
-            return {
-                exitCode: exitCodeForTerminalOutcome(settled.roleOutcome),
-                admitted,
-                terminal: settled,
+            }, adapters, env.principalAuthority, io, persistRunState);
+            return { ...settledFailure, turnDispatched: true, ...deferredPersist };
+        }
+        if (settledOutcome !== undefined) {
+            // Lawful persist + present is the caller's stop seam (auto-resume loop /
+            // manual resume), not this retried host-turn function.
+            return { ...settledOutcome, ...deferredPersist };
+        }
+        // Any exception while resolving the failure facts below — including the
+        // session-file decode itself — still happened after the host turn
+        // genuinely started (#840 r9 判词 class 1). Fold it into the same single
+        // controlled-failure settlement instead of losing turnDispatched to an
+        // uncaught throw.
+        let failureInput;
+        try {
+            const sessionFile = admitted.principal !== undefined
+                ? env.principalAuthority.decode(admitted.principal).sessionFile
+                : "";
+            const runnerKnownFailure = adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
+                ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
+                : result.knownFailure;
+            const credentialFailure = postRunMissingCredentialFailure(result, env.model, env.credentials);
+            const resolution = await resolveAuditedRunnerFailureResolution({
+                runner: runnerKnownFailure,
+                sessionFile,
+                credential: credentialFailure,
+                runDirectory: admitted.runDirectory,
+            });
+            failureInput = {
+                timedOut: result.timedOut,
+                code: result.code,
+                stderr: result.stderr,
+                ...controlledFailureInputFromResolution(resolution),
             };
         }
-        const sessionFile = admitted.principal !== undefined
-            ? env.principalAuthority.decode(admitted.principal).sessionFile
-            : "";
-        const runnerKnownFailure = adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
-            ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
-            : result.knownFailure;
-        const credentialFailure = postRunMissingCredentialFailure(result, env.model, env.credentials);
-        const resolution = await resolveAuditedRunnerFailureResolution({
-            runner: runnerKnownFailure,
-            sessionFile,
-            credential: credentialFailure,
-            runDirectory: admitted.runDirectory,
-        });
-        return (await presentControlledFailure(admitted, {
-            timedOut: result.timedOut,
-            code: result.code,
-            stderr: result.stderr,
-            ...controlledFailureInputFromResolution(resolution),
-        }, adapters, env.principalAuthority, io));
+        catch (error) {
+            failureInput = {
+                timedOut: false,
+                code: result.code,
+                stderr: result.stderr,
+                thrown: error,
+            };
+        }
+        const failed = await settleAfterTurnStarted(admitted, failureInput, adapters, env.principalAuthority, io, persistRunState);
+        return { ...failed, turnDispatched: true, ...deferredPersist };
     }
     finally {
-        await lease.release();
+        try {
+            await lease.release();
+        }
+        catch (error) {
+            // lease.release() is documented best-effort and never rejects in the
+            // production acquireRunWriterLease implementation (createWriterLease
+            // reports cleanup failures via callback, never throws) — this guard is
+            // structural only: an uncaught throw from a finally block silently
+            // replaces whatever the try already returned, including a properly
+            // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
+            io.stderr(formatCliDiagnostic(`writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`));
+        }
     }
 }
 /**
@@ -351,8 +533,27 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
             prompt,
         },
         ...(request.message === undefined ? {} : { courtAttemptId: randomUUID() }),
+        ...(env.stationChild === undefined ? {} : { stationChild: env.stationChild }),
     };
 }
+/**
+ * Hold the writer lease through after-lease build, then hand off to dispatch.
+ * Builder (or any throw before dispatch) must release here — dispatch's finally
+ * only runs after this handoff (manual resume and station-child auto-resume).
+ */
+async function dispatchAfterWriterLease(input) {
+    let handedOffToDispatch = false;
+    try {
+        const request = await input.build();
+        handedOffToDispatch = true;
+        return await input.dispatch(request);
+    }
+    finally {
+        if (!handedOffToDispatch) {
+            await input.lease.release();
+        }
+    }
+}
 function isAlreadyFrozenSummonsAttachment(runDirectory, attachmentPath) {
     const absolute = isAbsolute(attachmentPath)
         ? attachmentPath
@@ -387,7 +588,8 @@ export async function prepareSummonsResumeMaterials(runDirectory, summons) {
  * Shared manual-resume orchestration for seats whose continuation is the
  * package resume envelope (#599 / #633): load once → structural rejection →
  * optional seat afterAdmittedLoad (method material / controlled failure) →
- * seat turn projection → runPostAdmissionManualResume. Seat-owned loader
+ * seat turn projection → station-child auto-resume or public manual resume.
+ * Seat-owned loader
  * validation, turn builder, and adapters stay on the seat.
  *
  * Court open/recovery transaction (#637): under the existing writer lease,
@@ -421,8 +623,146 @@ export async function runPostAdmissionSeatResume(input) {
         }
         adapters = prepared.adapters;
     }
-    // Court recovery / open under lease, then always dispatch (resume is pass-through).
+    const buildRequestAfterLease = async () => {
+        let openCourtAttemptId;
+        // Build uses the admitted judged under this lease (rehydrated when open
+        // court materials ride). Settlement identity stays on the outer admitted.
+        let admittedForBuild = loaded.admitted;
+        // Bare resume: read + seal-judge + bound clear only under the held lease.
+        if (request.summons === undefined) {
+            const openCourt = await readCurrentCourt(admittedForBuild.runDirectory);
+            if (openCourt !== undefined) {
+                const sealedForOpen = await readSealedSubmission(admittedForBuild.projectRoot, admittedForBuild.runId, {
+                    home: homeFromRunDirectory(admittedForBuild.runDirectory),
+                    attemptId: openCourt.courtAttemptId,
+                });
+                if (sealedForOpen === undefined) {
+                    // Continue open court: same summons materials + existing courtAttemptId.
+                    // Caller message (if any) stays on the request — projection keeps it.
+                    openCourtAttemptId = openCourt.courtAttemptId;
+                    request = {
+                        runId: request.runId,
+                        ...(request.message === undefined
+                            ? {}
+                            : { message: request.message }),
+                        ...(openCourt.summons === undefined
+                            ? {}
+                            : { summons: openCourt.summons }),
+                    };
+                    if (openCourt.summons !== undefined) {
+                        const reloaded = await input.load(request);
+                        admittedForBuild = reloaded.admitted;
+                    }
+                }
+                else {
+                    // Open court already sealed — clear only the court id just judged.
+                    await clearCurrentCourt(admittedForBuild.runDirectory, openCourt.courtAttemptId);
+                }
+            }
+        }
+        // Freeze external paths once; rewrite summons to the frozen identity so
+        // currentCourt + later bare resume reuse the accepted snapshot.
+        if (request.summons !== undefined) {
+            const prepared = await prepareSummonsResumeMaterials(admittedForBuild.runDirectory, request.summons);
+            if (prepared !== undefined &&
+                (request.summons.attachmentPaths?.length ?? 0) > 0) {
+                request = {
+                    ...request,
+                    summons: {
+                        ...request.summons,
+                        attachmentPaths: prepared.attachments.map((attachment) => attachment.frozenPath),
+                    },
+                };
+            }
+        }
+        let turnRequest = await input.buildTurnRequest(admittedForBuild, request);
+        // Open court continue, or new court for summons / message re-review
+        // (clause 0 新庭可再交卷; #833). Bare resume without open court omits id.
+        if (openCourtAttemptId !== undefined ||
+            request.summons !== undefined ||
+            request.message !== undefined) {
+            const courtAttemptId = openCourtAttemptId ??
+                (turnRequest.courtAttemptId !== undefined &&
+                    turnRequest.courtAttemptId.length > 0
+                    ? turnRequest.courtAttemptId
+                    : randomUUID());
+            turnRequest = { ...turnRequest, courtAttemptId };
+            if (openCourtAttemptId === undefined) {
+                const court = {
+                    courtAttemptId,
+                    ...(request.summons === undefined
+                        ? {}
+                        : { summons: request.summons }),
+                };
+                await recordCurrentCourt(admittedForBuild.runDirectory, court);
+            }
+        }
+        return turnRequest;
+    };
+    // Court recovery / open under lease, then dispatch.
+    // Station-child same-ticket/same-parent resume is call-local auto-resume
+    // (#840 / #416). Public `ak-role resume` stays one-shot (ADR 0080).
     try {
+        if (input.env.stationChild === true) {
+            let firstTurn;
+            const stationAdapters = withOnceSuccessfulBeforeDispatch(adapters);
+            return await runWithAutoResumeLoop({
+                admitted: loaded.admitted,
+                principalAuthority: input.env.principalAuthority,
+                isPrincipalAvailable: resolveHostAwareSessionAvailability(input.env.host, input.env.principalAuthority),
+                io: input.io,
+                sessionAppender: input.env.sessionAppender,
+                autoResumeLimit: input.env.autoResumeLimit,
+                buildInitialPayload: () => ({ resumeTurn: false }),
+                buildResumePayload: () => ({ resumeTurn: true }),
+                // Same as public manual resume: prior-court sealed acceptance is not a
+                // redispatch brake (#833). New-court station-child turns still auto-resume.
+                dispatch: async (payload, lease, _isFirst, attemptIo) => dispatchAfterWriterLease({
+                    lease,
+                    build: async () => {
+                        // #840 r8 判词 class 2: this call-local retry must keep this
+                        // court's frozen summons / 交卷 body / attachments verbatim
+                        // (same object as firstTurn) and project only the minimal
+                        // host-needed resume trigger — never the manual-resume engine
+                        // handbook (buildResumeContinuationPrompt), which would replace
+                        // a 审核循环 same-ticket continuation with a bare outsourcing
+                        // 「重新读」 envelope (#755 contract, resumeTurnRequestProjectionOptions
+                        // above). RESUME_TRANSPORT_ENVELOPE is the same package-owned,
+                        // non-semantic trigger that projection already uses for a
+                        // same-ticket summons carrying no instruction/attachments.
+                        if (payload.resumeTurn && firstTurn !== undefined) {
+                            return {
+                                ...firstTurn,
+                                continuation: {
+                                    kind: "resume",
+                                    prompt: RESUME_TRANSPORT_ENVELOPE,
+                                },
+                            };
+                        }
+                        const turnRequest = await buildRequestAfterLease();
+                        firstTurn = turnRequest;
+                        return turnRequest;
+                    },
+                    dispatch: (turnRequest) => dispatchPostAdmissionTurn({
+                        admitted: loaded.admitted,
+                        env: {
+                            ...input.env,
+                            ...(loaded.admitted.correlationId === undefined
+                                ? {}
+                                : { correlationId: loaded.admitted.correlationId }),
+                        },
+                        io: attemptIo,
+                        request: turnRequest,
+                        lease,
+                        adapters: stationAdapters,
+                        persistRunState: false,
+                        ...(input.effectiveEngine === undefined
+                            ? {}
+                            : { effectiveEngine: input.effectiveEngine }),
+                    }),
+                }),
+            });
+        }
         return await runPostAdmissionManualResume({
             admitted: loaded.admitted,
             env: input.env,
@@ -431,82 +771,7 @@ export async function runPostAdmissionSeatResume(input) {
             ...(input.effectiveEngine === undefined
                 ? {}
                 : { effectiveEngine: input.effectiveEngine }),
-            buildRequestAfterLease: async () => {
-                let openCourtAttemptId;
-                // Build uses the admitted judged under this lease (rehydrated when open
-                // court materials ride). Settlement identity stays on the outer admitted.
-                let admittedForBuild = loaded.admitted;
-                // Bare resume: read + seal-judge + bound clear only under the held lease.
-                if (request.summons === undefined) {
-                    const openCourt = await readCurrentCourt(admittedForBuild.runDirectory);
-                    if (openCourt !== undefined) {
-                        const sealedForOpen = await readSealedSubmission(admittedForBuild.projectRoot, admittedForBuild.runId, {
-                            home: homeFromRunDirectory(admittedForBuild.runDirectory),
-                            attemptId: openCourt.courtAttemptId,
-                        });
-                        if (sealedForOpen === undefined) {
-                            // Continue open court: same summons materials + existing courtAttemptId.
-                            // Caller message (if any) stays on the request — projection keeps it.
-                            openCourtAttemptId = openCourt.courtAttemptId;
-                            request = {
-                                runId: request.runId,
-                                ...(request.message === undefined
-                                    ? {}
-                                    : { message: request.message }),
-                                ...(openCourt.summons === undefined
-                                    ? {}
-                                    : { summons: openCourt.summons }),
-                            };
-                            if (openCourt.summons !== undefined) {
-                                const reloaded = await input.load(request);
-                                admittedForBuild = reloaded.admitted;
-                            }
-                        }
-                        else {
-                            // Open court already sealed — clear only the court id just judged.
-                            await clearCurrentCourt(admittedForBuild.runDirectory, openCourt.courtAttemptId);
-                        }
-                    }
-                }
-                // Freeze external paths once; rewrite summons to the frozen identity so
-                // currentCourt + later bare resume reuse the accepted snapshot.
-                if (request.summons !== undefined) {
-                    const prepared = await prepareSummonsResumeMaterials(admittedForBuild.runDirectory, request.summons);
-                    if (prepared !== undefined &&
-                        (request.summons.attachmentPaths?.length ?? 0) > 0) {
-                        request = {
-                            ...request,
-                            summons: {
-                                ...request.summons,
-                                attachmentPaths: prepared.attachments.map((attachment) => attachment.frozenPath),
-                            },
-                        };
-                    }
-                }
-                let turnRequest = await input.buildTurnRequest(admittedForBuild, request);
-                // Open court continue, or new court for summons / message re-review
-                // (clause 0 新庭可再交卷; #833). Bare resume without open court omits id.
-                if (openCourtAttemptId !== undefined ||
-                    request.summons !== undefined ||
-                    request.message !== undefined) {
-                    const courtAttemptId = openCourtAttemptId ??
-                        (turnRequest.courtAttemptId !== undefined &&
-                            turnRequest.courtAttemptId.length > 0
-                            ? turnRequest.courtAttemptId
-                            : randomUUID());
-                    turnRequest = { ...turnRequest, courtAttemptId };
-                    if (openCourtAttemptId === undefined) {
-                        const court = {
-                            courtAttemptId,
-                            ...(request.summons === undefined
-                                ? {}
-                                : { summons: request.summons }),
-                        };
-                        await recordCurrentCourt(admittedForBuild.runDirectory, court);
-                    }
-                }
-                return turnRequest;
-            },
+            buildRequestAfterLease,
         });
     }
     catch (error) {
@@ -520,31 +785,30 @@ export async function runPostAdmissionSeatResume(input) {
     }
 }
 /**
- * Shared post-admission one-shot path: writer lease, then turn dispatch.
+ * Shared post-admission one-shot path: folds into runPostAdmissionResumable (#840 / #416).
+ * All callable roles share the single auto-resume loop.
  * Initial facades own the durable admitted mark (markRunAdmitted) before
  * entering; manual resume never re-admits.
  */
 export async function runPostAdmissionOneShot(input) {
-    const { admitted, env, io, request, adapters, effectiveEngine } = input;
-    let lease;
-    try {
-        lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic) => io.stderr(diagnostic));
-    }
-    catch (error) {
-        if (error instanceof RunWriterLeaseHeldError) {
-            presentStructuralRejection(error, io);
-            return { exitCode: 2, admitted };
-        }
-        throw error;
-    }
-    return await dispatchPostAdmissionTurn({
-        admitted,
-        env,
-        io,
-        request,
-        lease,
-        adapters,
-        ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
+    const engine = input.effectiveEngine ?? input.env.engine;
+    return await runPostAdmissionResumable({
+        admitted: input.admitted,
+        env: input.env,
+        io: input.io,
+        buildInitialRequest: () => input.request,
+        buildResumeRequest: () => ({
+            ...input.request,
+            continuation: {
+                kind: "resume",
+                prompt: buildResumeContinuationPrompt({
+                    packageRoot: input.env.packageRoot,
+                    ...(engine === undefined ? {} : { engine }),
+                }),
+            },
+        }),
+        adapters: input.adapters,
+        ...(input.effectiveEngine === undefined ? {} : { effectiveEngine: input.effectiveEngine }),
     });
 }
 /**
@@ -552,10 +816,12 @@ export async function runPostAdmissionOneShot(input) {
  * Initial facades own the durable admitted mark before entering.
  */
 export async function runPostAdmissionResumable(input) {
-    const { admitted, env, io, buildInitialRequest, buildResumeRequest, adapters, effectiveEngine } = input;
+    const { admitted, env, io, buildInitialRequest, buildResumeRequest, effectiveEngine } = input;
+    const adapters = withOnceSuccessfulBeforeDispatch(input.adapters);
     return runWithAutoResumeLoop({
         admitted,
         principalAuthority: env.principalAuthority,
+        isPrincipalAvailable: resolveHostAwareSessionAvailability(env.host, env.principalAuthority),
         io,
         sessionAppender: env.sessionAppender,
         autoResumeLimit: env.autoResumeLimit,
@@ -572,6 +838,7 @@ export async function runPostAdmissionResumable(input) {
             request,
             lease,
             adapters,
+            persistRunState: false,
             // #600: every attempt (initial + auto-resume) writes seat engine when present.
             ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
         }),
@@ -581,6 +848,7 @@ export async function runPostAdmissionResumable(input) {
  * Manual resume: lease + dispatch. Pass-through to the host — no sealed-accepted
  * short-circuit (#833 / #416). Court open (summons / message / open court) is
  * built under lease when using buildRequestAfterLease; sole-final stays per-attempt.
+ * After-lease build shares dispatchAfterWriterLease with station-child auto-resume.
  */
 export async function runPostAdmissionManualResume(input) {
     const { admitted, env, io, adapters, effectiveEngine, buildRequestAfterLease, } = input;
@@ -614,19 +882,18 @@ export async function runPostAdmissionManualResume(input) {
         }
         throw error;
     }
-    // Court open/recovery under held lease until dispatch owns release (finally
-    // below). Builder and any throw on this seam must release here — dispatch's
-    // finally only runs after handoff.
-    let handedOffToDispatch = false;
-    try {
-        if (request === undefined) {
-            if (buildRequestAfterLease === undefined) {
-                throw new Error("runPostAdmissionManualResume requires request or buildRequestAfterLease");
+    const result = await dispatchAfterWriterLease({
+        lease,
+        build: async () => {
+            if (request === undefined) {
+                if (buildRequestAfterLease === undefined) {
+                    throw new Error("runPostAdmissionManualResume requires request or buildRequestAfterLease");
+                }
+                request = await buildRequestAfterLease();
             }
-            request = await buildRequestAfterLease();
-        }
-        handedOffToDispatch = true;
-        const result = await dispatchPostAdmissionTurn({
+            return request;
+        },
+        dispatch: (turnRequest) => dispatchPostAdmissionTurn({
             admitted,
             env: {
                 ...env,
@@ -636,24 +903,24 @@ export async function runPostAdmissionManualResume(input) {
                     : { correlationId: admitted.correlationId }),
             },
             io,
-            request,
+            request: turnRequest,
             lease,
             adapters,
             ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
-        });
-        if (result.terminal !== undefined) {
-            result.terminal.autoResumeCount = 0;
-        }
-        return {
-            ...result,
-            ...(staleWriterLeaseReclaimed === true
-                ? { staleWriterLeaseReclaimed: true }
-                : {}),
-        };
+        }),
+    });
+    if (result.terminal !== undefined &&
+        isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)) {
+        await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
+        io.stdout(formatTerminalResult(result.terminal));
     }
-    finally {
-        if (!handedOffToDispatch) {
-            await lease.release();
-        }
+    if (result.terminal !== undefined) {
+        result.terminal.autoResumeCount = 0;
     }
+    return {
+        ...result,
+        ...(staleWriterLeaseReclaimed === true
+            ? { staleWriterLeaseReclaimed: true }
+            : {}),
+    };
 }