@akagilnc/pi-workflow-roles 0.1.3932 → 0.1.3975

package/dist/public-cli/notary-run.js

@@ -55,7 +55,7 @@ export async function runPublicNotary(argv, env, io, parseNotaryArgv) {
     // #753/#786: gate re-ask and verbatim submission body share summons.instruction
     // (reask wins when both present; no parallel stack).
     {
-        const resumeInstruction = env.reviewReask ?? env.gateReviewInstruction;
+        const resumeInstruction = env.reviewReask;
         const summons = {
             sourceRunPath: source.runDirectory,
             sourceRun: source,
@@ -74,13 +74,6 @@ export async function runPublicNotary(argv, env, io, parseNotaryArgv) {
         });
         if (resumed !== undefined)
             return resumed;
-        // Reask without a prior same-parent run cannot deliver the plain-language ask
-        // on a fresh mint without inventing a second prompt path — fail loud (#753).
-        // gateReviewInstruction (verbatim body) alone is resume-only; fresh mint ignores it.
-        if (env.reviewReask !== undefined) {
-            presentStructuralRejection(new CliUsageError("notary review reask requires a prior same-parent run to resume"), io);
-            return { exitCode: 2 };
-        }
     }
     let admitted;
     try {

package/dist/public-cli/post-admission.js

@@ -8,12 +8,20 @@
 import { randomUUID } from "node:crypto";
 import { readFile, writeFile } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
-import { buildResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
+import { buildResumeContinuationPrompt, GATE_DOSSIER_POINTER_PREFIX, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
 import { CliUsageError } from "./cli-errors.js";
 import { buildInstructionTransportPrompt, freezeAttachmentsIntoRun, } from "./invocation.js";
 import { pathContainedIn } from "../activation-ledger-topology.js";
 import { resolveHostAwareSessionAvailability } from "../session-identity.js";
 import { projectCaseDossierPointerSection } from "./case-dossier-delivery.js";
+/** Original error bytes, never relabeled — a secondary fact riding beside a classified cause. */
+function describeCaughtError(error) {
+    if (error instanceof Error) {
+        const code = error.code;
+        return { name: error.name, message: error.message, ...(code === undefined ? {} : { code }) };
+    }
+    return { message: String(error) };
+}
 /** Append one system section to a continuation prompt, keeping its kind. */
 function appendContinuationSection(continuation, section) {
     const prompt = `${continuation.prompt}\n\n${section}`;
@@ -25,9 +33,8 @@ import { projectHostTransitionPriorNative } from "../host-transition-prior-nativ
 import { missingCredentialPreDispatchFailure, postRunMissingCredentialFailure, } from "./public-run-credentials.js";
 import { acquireRunWriterLease, clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
 import { homeFromRunDirectory } from "../activation-ledger-topology.js";
-import { readSealedSubmission } from "../submission-ledger.js";
 import { clearReviewerDispatchRejection } from "./reviewer-dispatch-rejection.js";
-import { classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, sealedAcceptanceRedispatchDisposition, } from "./settlement.js";
+import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, } from "./settlement.js";
 import {} from "./terminal.js";
 import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
 /**
@@ -176,12 +183,12 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
         const sessionPrincipalAvailable = await authority.isAvailable(admitted.principal);
         resumable = sessionPrincipalAvailable && typedHttp429 !== undefined;
     }
-    if (persistRunState) {
+    if (persistRunState && !failureInput.skipRunStateWrite) {
         await persistReturnedRunState(admitted, authority);
     }
-    const terminal = await settleFailureTerminalResult(admitted, failure, authority, resumable
+    const terminal = await attachRecordedSubmissions(admitted, await settleFailureTerminalResult(admitted, failure, authority, resumable
         ? { resume: { command: renderResumeCommand(admitted.runId) } }
-        : {});
+        : {}));
     presentFailureTerminal(terminal, io);
     return {
         exitCode: exitCodeForTerminalOutcome(terminal.roleOutcome),
@@ -208,6 +215,35 @@ async function settleAfterTurnStarted(admitted, failureInput, adapters, authorit
         throw new TurnDispatchedFailure(error);
     }
 }
+/**
+ * Persist run-state for a result dispatchPostAdmissionTurn deferred
+ * (needsPersist — station-child / resumable auto-resume loop, #416/#840):
+ * that write must land outside the loop's own retried-dispatch try, but its
+ * failure still settles through the single existing controlled-failure
+ * authority (settleAfterTurnStarted / presentControlledFailure, ADR 0080
+ * single-settlement-disposition) — never a second hand-rolled
+ * classify/artifact/Terminal (#836 r12 class 3), and never lawful/non-lawful
+ * settling differently (#836 r13 class 2: a caller's io here may be a no-op,
+ * so a stderr-only trace is never seen and the failure is otherwise
+ * swallowed — 失败诚实宪法 真因必须落痕). Both cases settle through
+ * settleAfterTurnStarted, which attaches the run's already-recorded ledger
+ * submissions to the new failure terminal and returns skipAutoResume so the
+ * caller presents it once and stops — never re-entering auto-resume.
+ */
+async function settleDeferredPersist(admitted, authority, adapters, io, result) {
+    if (result.needsPersist !== true || result.terminal === undefined)
+        return result;
+    const { needsPersist: _needsPersist, ...settledResult } = result;
+    const lawful = isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
+    try {
+        await persistReturnedRunState(admitted, authority, lawful ? { lawful: true } : undefined);
+        return settledResult;
+    }
+    catch (error) {
+        const failed = await settleAfterTurnStarted(admitted, { timedOut: false, code: null, stderr: "", thrown: error, skipRunStateWrite: true }, adapters, authority, io, true);
+        return { ...failed, turnDispatched: true, skipAutoResume: true };
+    }
+}
 export async function dispatchPostAdmissionTurn(input) {
     const { admitted, env, io, request, lease, adapters, effectiveEngine } = input;
     const persistRunState = input.persistRunState !== false;
@@ -325,6 +361,18 @@ export async function dispatchPostAdmissionTurn(input) {
             }, adapters, env.principalAuthority, io, persistRunState);
             return { ...settled, turnDispatched: true, ...deferredPersist };
         }
+        // `result.stderr` stays live in memory for the real classification below
+        // regardless of whether this durable mirror write succeeds. A write
+        // failure here (unwritable run directory, stderr.log occupied as a
+        // directory, ...) is a real infrastructure problem and must never be
+        // dropped silently (catch-and-continue with no trace is a defect) — but
+        // it also must never become THE controlling failure and wash out a
+        // primary child signal that already arrived on `result`, or an
+        // already-sealed accepted payload (#836: a secondary failure must not
+        // overwrite an already-known cause or an already-recorded leg). It rides
+        // beside whatever the real classification below determines, and only
+        // becomes the reported failure itself when nothing else is wrong.
+        //
         // Everything below runs after the host turn genuinely started (#840 r9
         // 判词 class 1 boundary — 覆盖 executeTurn 已启动后至返回带 turnDispatched
         // 结果前的全部异常). Each fallible step routes any failure through the
@@ -340,33 +388,108 @@ export async function dispatchPostAdmissionTurn(input) {
         // turn genuinely started, so the next retry sends a resume payload — the
         // true cause settles through the loop's own existing dispatch-exception
         // machinery once the retry budget is exhausted.
+        let stderrLogWriteFailure;
         try {
             await writeFile(join(admitted.runDirectory, "stderr.log"), result.stderr, "utf8");
         }
         catch (error) {
+            stderrLogWriteFailure = error;
             // Best-effort: the turn's own stderr capture is secondary to lawful /
             // controlled-failure settlement below, but the failure itself must
             // still leave a real trace (失败诚实宪法 真因必须落痕) — durably, since
-            // every auto-resume attempt's io is dummyIo (#840 r9 判词 class 1).
+            // every auto-resume attempt's io is dummyIo (#840 r9 判词 class 1). It
+            // still rides beside the classification below and, if nothing else is
+            // wrong, becomes the reported failure itself (#836).
             await recordBestEffortPostDispatchDiagnostic(admitted, env, `stderr.log write failed (best-effort continue): ${describeErrorIdentity(error)}`, io);
         }
-        let settled;
-        // Same-ticket re-summons carry courtAttemptId — settle only that attempt so a
-        // prior sealed pass cannot wash this turn's missing/escalated/failed result.
         const courtScope = request.courtAttemptId === undefined || request.courtAttemptId.length === 0
             ? undefined
             : { courtAttemptId: request.courtAttemptId };
-        // Single complete boundary (#840 r9 判词 class 1): trySettle, its
-        // shouldPresent gate, and the accepted-settlement cleanup all settle
-        // through this one catch. shouldPresent used to sit outside every
-        // TurnDispatchedFailure wrap, so a throw from it looked like an ordinary
-        // pre-turn throw to the caller (turnStartedBeforeThrow stayed false) and
-        // replayed the initial payload even though the host turn had already
-        // genuinely run.
+        // Single complete boundary (#840 r9 判词 class 1): resolving the
+        // host/runner failure facts, trySettle, its shouldPresent gate, and the
+        // accepted-settlement cleanup all settle through this one catch — a
+        // throw from any of them (including the session-file decode itself)
+        // still routes through settleAfterTurnStarted's TurnDispatchedFailure
+        // instead of losing turnDispatched to an uncaught throw. The facts are
+        // resolved before trySettle (#836) so an already-accepted settlement is
+        // never presented over a real current host/runner failure signal or a
+        // real stderr.log durable-write failure — both stay a real failure with
+        // the recorded payload riding beside it, not replacing it.
+        let settled;
         let settledOutcome;
+        let hostSignalFailed = false;
+        let resolution;
         try {
+            const sessionFile = admitted.principal !== undefined
+                ? env.principalAuthority.decode(admitted.principal).sessionFile
+                : "";
+            const runnerKnownFailure = adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
+                ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
+                : result.knownFailure;
+            const credentialFailure = postRunMissingCredentialFailure(result, env.model, env.credentials);
+            resolution = await resolveAuditedRunnerFailureResolution({
+                runner: runnerKnownFailure,
+                sessionFile,
+                credential: credentialFailure,
+                runDirectory: admitted.runDirectory,
+            });
+            // A direct, current signal from the host/runner itself (timeout / host
+            // knownFailure / runner knownFailure / missing credential) is a real
+            // problem regardless of what else already settled — a settled accepted
+            // outcome must not paper over it (it rides beside the recorded payload
+            // via `submissions`, never replacing the payload). The audited
+            // resolution's own typed session read (malformed JSONL, provider-stop,
+            // an illegal/unsealed accepted status, a stale/superseded typed-HTTP
+            // observation, ...) makes a run with no sealed acceptance a true
+            // failure too — it must not be discarded into a lawful no_receipt just
+            // because the raw runner signal alone looked clean. But it must not
+            // retroactively invalidate an acceptance that already sealed this turn
+            // — a resolved 429 observed earlier in the same session is exactly
+            // that.
+            const directHostFailureSignal = result.timedOut
+                || result.knownFailure !== undefined
+                || runnerKnownFailure !== undefined
+                || credentialFailure !== undefined;
+            hostSignalFailed =
+                directHostFailureSignal
+                    || (result.code !== null && result.code !== 0)
+                    || resolution.knownFailure !== undefined;
             settled = await adapters.trySettle(admitted, env.principalAuthority, courtScope);
-            if (settled !== undefined && shouldPresent(settled)) {
+            if (settled !== undefined) {
+                settled = await attachRecordedSubmissions(admitted, settled, courtScope);
+            }
+            // #836 r12 class 2: an accepted/audit_escalation settlement can be
+            // entirely a prior attempt's stale payload (courtAttempt is a
+            // recording tag, not a visibility gate — attachRecordedSubmissions
+            // above still surfaces that historical payload honestly either way).
+            // Consume the ledger's own subject.attemptId (submission-ledger.ts)
+            // only to learn whether *this* attempt itself produced a fresh seal —
+            // never to filter what presents.
+            const settledIsFreshThisAttempt = settled === undefined
+                || (settled.roleOutcome.kind !== "accepted" && settled.roleOutcome.kind !== "audit_escalation")
+                ? true
+                : await attemptProducedFreshSubmission(admitted, courtScope);
+            // A lawful settled outcome already reached this turn takes precedence
+            // over a later bare exit-code / session-inspection signal (trailing
+            // nonzero exit, late stderr noise, a stale already-superseded
+            // typed-HTTP observation, ...) — but never over a direct current
+            // host/runner failure signal, nor over a real stderr.log durable-write
+            // failure (confirmed infrastructure trouble, not weak/bare evidence),
+            // both of which stay a real failure with the recorded payload riding
+            // beside it, not replacing it (#836: never kill an already-recorded
+            // leg, but never wash a real failure away either). Note: the narrower
+            // directHostFailureSignal gates acceptance here; the broader
+            // hostSignalFailed (adds bare exit code / resolution.knownFailure)
+            // only gates the no-settlement fallback below — except when the
+            // settlement itself is entirely stale (no fresh seal this attempt),
+            // where a bare nonzero exit / resolution failure must not be outranked
+            // by someone else's earlier success (#836 r12 class 2).
+            const staleAcceptanceOutranksRealFailure = !settledIsFreshThisAttempt && hostSignalFailed;
+            if (settled !== undefined
+                && shouldPresent(settled)
+                && !directHostFailureSignal
+                && !staleAcceptanceOutranksRealFailure
+                && stderrLogWriteFailure === undefined) {
                 // This court sealed — drop open-court pointer (bare resume no longer continues it).
                 if (settled.roleOutcome.kind === "accepted" &&
                     request.courtAttemptId !== undefined &&
@@ -395,8 +518,8 @@ export async function dispatchPostAdmissionTurn(input) {
             }
         }
         catch (error) {
-            // Settle (or its shouldPresent gate) throw is a real failure fact —
-            // never swallow into undefined.
+            // Settle (or its shouldPresent gate, or the failure-fact resolution
+            // above) throw is a real failure fact — never swallow into undefined.
             const settledFailure = await settleAfterTurnStarted(admitted, {
                 timedOut: false,
                 code: result.code,
@@ -406,47 +529,102 @@ export async function dispatchPostAdmissionTurn(input) {
             return { ...settledFailure, turnDispatched: true, ...deferredPersist };
         }
         if (settledOutcome !== undefined) {
+            if (persistRunState) {
+                try {
+                    await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
+                }
+                catch (error) {
+                    // #836: `settledOutcome.terminal` already carries recorded
+                    // submissions (attachRecordedSubmissions above). A real run-state
+                    // persistence failure here must surface loudly through the same
+                    // controlled-failure seam every other dispatch-time failure in
+                    // this function uses (ADR 0080: one settlement disposition owner)
+                    // — not escape uncaught to auto-resume's dispatch-retry path,
+                    // whose exhausted-budget terminal carries no recorded submissions
+                    // at all. skipRunStateWrite: the write that just threw is the same
+                    // write presentControlledFailure would otherwise retry — don't
+                    // call a known-failing operation twice.
+                    const failed = await settleAfterTurnStarted(admitted, {
+                        timedOut: false,
+                        code: null,
+                        stderr: "",
+                        thrown: error,
+                        skipRunStateWrite: true,
+                    }, adapters, env.principalAuthority, io, persistRunState);
+                    return { ...failed, turnDispatched: true, ...deferredPersist };
+                }
+            }
             // Lawful persist + present is the caller's stop seam (auto-resume loop /
             // manual resume), not this retried host-turn function.
             return { ...settledOutcome, ...deferredPersist };
         }
-        // Any exception while resolving the failure facts below — including the
-        // session-file decode itself — still happened after the host turn
-        // genuinely started (#840 r9 判词 class 1). Fold it into the same single
-        // controlled-failure settlement instead of losing turnDispatched to an
-        // uncaught throw.
-        let failureInput;
-        try {
-            const sessionFile = admitted.principal !== undefined
-                ? env.principalAuthority.decode(admitted.principal).sessionFile
-                : "";
-            const runnerKnownFailure = adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
-                ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
-                : result.knownFailure;
-            const credentialFailure = postRunMissingCredentialFailure(result, env.model, env.credentials);
-            const resolution = await resolveAuditedRunnerFailureResolution({
-                runner: runnerKnownFailure,
-                sessionFile,
-                credential: credentialFailure,
-                runDirectory: admitted.runDirectory,
-            });
-            failureInput = {
+        // Host/runner true failure coexists with already-recorded payloads — never wash as accepted.
+        if (hostSignalFailed) {
+            const resolutionInput = controlledFailureInputFromResolution(resolution);
+            const stderrLogWriteDetails = stderrLogWriteFailure === undefined
+                ? undefined
+                : { stderrLogWriteFailure: describeCaughtError(stderrLogWriteFailure) };
+            const failed = await settleAfterTurnStarted(admitted, {
                 timedOut: result.timedOut,
                 code: result.code,
                 stderr: result.stderr,
-                ...controlledFailureInputFromResolution(resolution),
-            };
+                ...resolutionInput,
+                // Secondary fact only — never the cause. Rides on whichever channel
+                // classification actually reads (knownFailure.details owns it when
+                // a knownFailure exists; the top-level knownDetails otherwise).
+                ...(stderrLogWriteDetails === undefined
+                    ? {}
+                    : resolutionInput.knownFailure !== undefined
+                        ? {
+                            knownFailure: {
+                                ...resolutionInput.knownFailure,
+                                details: { ...(resolutionInput.knownFailure.details ?? {}), ...stderrLogWriteDetails },
+                            },
+                        }
+                        : { knownDetails: stderrLogWriteDetails }),
+            }, adapters, env.principalAuthority, io, persistRunState);
+            return { ...failed, turnDispatched: true, ...deferredPersist };
         }
-        catch (error) {
-            failureInput = {
+        // Nothing else was wrong, but the durable stderr mirror itself failed to
+        // write — that is the real (infrastructure) problem in this case, not a
+        // lawful absence of a receipt. Honest and loud, not silently no_receipt.
+        if (stderrLogWriteFailure !== undefined) {
+            const failed = await settleAfterTurnStarted(admitted, {
                 timedOut: false,
                 code: result.code,
                 stderr: result.stderr,
-                thrown: error,
-            };
+                thrown: stderrLogWriteFailure,
+            }, adapters, env.principalAuthority, io, persistRunState);
+            return { ...failed, turnDispatched: true, ...deferredPersist };
         }
-        const failed = await settleAfterTurnStarted(admitted, failureInput, adapters, env.principalAuthority, io, persistRunState);
-        return { ...failed, turnDispatched: true, ...deferredPersist };
+        const noReceipt = await attachRecordedSubmissions(admitted, await settleHostEndedNoReceipt(admitted, env.principalAuthority), courtScope);
+        if (persistRunState) {
+            try {
+                await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
+            }
+            catch (error) {
+                // #836: same run-state persistence hazard as the settled/accepted
+                // branch above — route through the shared controlled-failure seam so
+                // the real failure surfaces loudly instead of escaping uncaught to
+                // auto-resume's dispatch-retry path with no recorded submissions.
+                // skipRunStateWrite: don't retry the write that just threw.
+                const failed = await settleAfterTurnStarted(admitted, {
+                    timedOut: false,
+                    code: null,
+                    stderr: "",
+                    thrown: error,
+                    skipRunStateWrite: true,
+                }, adapters, env.principalAuthority, io, persistRunState);
+                return { ...failed, turnDispatched: true, ...deferredPersist };
+            }
+        }
+        return {
+            exitCode: exitCodeForTerminalOutcome(noReceipt.roleOutcome),
+            admitted,
+            terminal: noReceipt,
+            turnDispatched: true,
+            ...deferredPersist,
+        };
     }
     finally {
         try {
@@ -478,20 +656,32 @@ export async function dispatchPostAdmissionTurn(input) {
  * first when request.summons carries instruction or attachment paths.
  */
 export function resumeTurnRequestProjectionOptions(admitted, request, env, summonsPrepared) {
+    const officerSourcePath = request.summons?.sourceRunPath;
+    const withReread = (body) => {
+        if (officerSourcePath === undefined
+            || (admitted.role !== "notary"
+                && admitted.role !== "inspector"
+                && admitted.role !== "auditor")) {
+            return body;
+        }
+        if (body.startsWith("请重读"))
+            return body;
+        return `请重读\n${body}`;
+    };
     let prompt;
     if (request.message !== undefined) {
         if (summonsPrepared !== undefined) {
             // #755: same-ticket review / open-court — caller words + optional paths.
             // Attachments are not a gate: message-only summons must stay plain too.
-            prompt = buildInstructionTransportPrompt({
+            prompt = withReread(buildInstructionTransportPrompt({
                 instruction: request.message,
                 instructionEmpty: false,
                 attachments: summonsPrepared.attachments,
-            });
+            }));
         }
         else if (request.summons !== undefined) {
             // #755: same-ticket summons without prepared materials — caller words only.
-            prompt = request.message;
+            prompt = withReread(request.message);
         }
         else {
             // Bare manual resume — outsourcing engine axis keeps handbook (#600/#736).
@@ -504,12 +694,26 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
     }
     else if (summonsPrepared !== undefined) {
         // #755: same-ticket review summons — instruction/attachments only.
-        prompt = buildInstructionTransportPrompt(summonsPrepared);
+        prompt = withReread(buildInstructionTransportPrompt(summonsPrepared));
     }
     else if (request.summons !== undefined) {
         // #755: same-ticket summons with no instruction/attachments (e.g. notary
-        // source-run pointer) — plain resume envelope, no handbook / 重新读.
-        prompt = RESUME_TRANSPORT_ENVELOPE;
+        // source-run pointer). #836: officer resume opening adds「请重读」+ path pointer.
+        const path = request.summons.sourceRunPath;
+        if (path !== undefined &&
+            (admitted.role === "notary" ||
+                admitted.role === "inspector" ||
+                admitted.role === "auditor")) {
+            prompt = `请重读\n${GATE_DOSSIER_POINTER_PREFIX}${path}`;
+        }
+        else if (admitted.role === "notary" ||
+            admitted.role === "inspector" ||
+            admitted.role === "auditor") {
+            prompt = "请重读";
+        }
+        else {
+            prompt = "";
+        }
     }
     else {
         // Bare manual resume — outsourcing engine axis keeps handbook (#600/#736).
@@ -628,35 +832,23 @@ export async function runPostAdmissionSeatResume(input) {
         // Build uses the admitted judged under this lease (rehydrated when open
         // court materials ride). Settlement identity stays on the outer admitted.
         let admittedForBuild = loaded.admitted;
-        // Bare resume: read + seal-judge + bound clear only under the held lease.
+        // Bare resume: open-court pointer is the continue signal (not ledger seal).
         if (request.summons === undefined) {
             const openCourt = await readCurrentCourt(admittedForBuild.runDirectory);
             if (openCourt !== undefined) {
-                const sealedForOpen = await readSealedSubmission(admittedForBuild.projectRoot, admittedForBuild.runId, {
-                    home: homeFromRunDirectory(admittedForBuild.runDirectory),
-                    attemptId: openCourt.courtAttemptId,
-                });
-                if (sealedForOpen === undefined) {
-                    // Continue open court: same summons materials + existing courtAttemptId.
-                    // Caller message (if any) stays on the request — projection keeps it.
-                    openCourtAttemptId = openCourt.courtAttemptId;
-                    request = {
-                        runId: request.runId,
-                        ...(request.message === undefined
-                            ? {}
-                            : { message: request.message }),
-                        ...(openCourt.summons === undefined
-                            ? {}
-                            : { summons: openCourt.summons }),
-                    };
-                    if (openCourt.summons !== undefined) {
-                        const reloaded = await input.load(request);
-                        admittedForBuild = reloaded.admitted;
-                    }
-                }
-                else {
-                    // Open court already sealed — clear only the court id just judged.
-                    await clearCurrentCourt(admittedForBuild.runDirectory, openCourt.courtAttemptId);
+                openCourtAttemptId = openCourt.courtAttemptId;
+                request = {
+                    runId: request.runId,
+                    ...(request.message === undefined
+                        ? {}
+                        : { message: request.message }),
+                    ...(openCourt.summons === undefined
+                        ? {}
+                        : { summons: openCourt.summons }),
+                };
+                if (openCourt.summons !== undefined) {
+                    const reloaded = await input.load(request);
+                    admittedForBuild = reloaded.admitted;
                 }
             }
         }
@@ -743,23 +935,26 @@ export async function runPostAdmissionSeatResume(input) {
                         firstTurn = turnRequest;
                         return turnRequest;
                     },
-                    dispatch: (turnRequest) => dispatchPostAdmissionTurn({
-                        admitted: loaded.admitted,
-                        env: {
-                            ...input.env,
-                            ...(loaded.admitted.correlationId === undefined
+                    dispatch: async (turnRequest) => {
+                        const result = await dispatchPostAdmissionTurn({
+                            admitted: loaded.admitted,
+                            env: {
+                                ...input.env,
+                                ...(loaded.admitted.correlationId === undefined
+                                    ? {}
+                                    : { correlationId: loaded.admitted.correlationId }),
+                            },
+                            io: attemptIo,
+                            request: turnRequest,
+                            lease,
+                            adapters: stationAdapters,
+                            persistRunState: false,
+                            ...(input.effectiveEngine === undefined
                                 ? {}
-                                : { correlationId: loaded.admitted.correlationId }),
-                        },
-                        io: attemptIo,
-                        request: turnRequest,
-                        lease,
-                        adapters: stationAdapters,
-                        persistRunState: false,
-                        ...(input.effectiveEngine === undefined
-                            ? {}
-                            : { effectiveEngine: input.effectiveEngine }),
-                    }),
+                                : { effectiveEngine: input.effectiveEngine }),
+                        });
+                        return settleDeferredPersist(loaded.admitted, input.env.principalAuthority, stationAdapters, attemptIo, result);
+                    },
                 }),
             });
         }
@@ -827,21 +1022,23 @@ export async function runPostAdmissionResumable(input) {
         autoResumeLimit: env.autoResumeLimit,
         buildInitialPayload: buildInitialRequest,
         buildResumePayload: buildResumeRequest,
-        sealedAcceptanceDisposition: () => sealedAcceptanceRedispatchDisposition(admitted),
-        dispatch: (request, lease, _isFirst, attemptIo) => dispatchPostAdmissionTurn({
-            admitted,
-            env: {
-                ...env,
-                ...(admitted.correlationId === undefined ? {} : { correlationId: admitted.correlationId }),
-            },
-            io: attemptIo,
-            request,
-            lease,
-            adapters,
-            persistRunState: false,
-            // #600: every attempt (initial + auto-resume) writes seat engine when present.
-            ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
-        }),
+        dispatch: async (request, lease, _isFirst, attemptIo) => {
+            const result = await dispatchPostAdmissionTurn({
+                admitted,
+                env: {
+                    ...env,
+                    ...(admitted.correlationId === undefined ? {} : { correlationId: admitted.correlationId }),
+                },
+                io: attemptIo,
+                request,
+                lease,
+                adapters,
+                persistRunState: false,
+                // #600: every attempt (initial + auto-resume) writes seat engine when present.
+                ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
+            });
+            return settleDeferredPersist(admitted, env.principalAuthority, adapters, attemptIo, result);
+        },
     });
 }
 /**
@@ -911,7 +1108,11 @@ export async function runPostAdmissionManualResume(input) {
     });
     if (result.terminal !== undefined &&
         isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)) {
-        await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
+        // dispatchPostAdmissionTurn already persisted this lawful outcome inline
+        // (persistRunState defaults true here — no station-child/loop deferral)
+        // through its own settleAfterTurnStarted-backed branches; a lawful result
+        // only ever reaches this point once that persist has already succeeded
+        // (#836 r12 class 3 dedup — one persist owner, not a second here).
         io.stdout(formatTerminalResult(result.terminal));
     }
     if (result.terminal !== undefined) {