@akagilnc/pi-workflow-roles 0.1.4021 → 0.1.4062

package/src/role-envelope.ts

@@ -172,6 +172,8 @@ export async function prepareRoleEnvelope(options: {
     cwd: request.cwd,
     mode: "print",
     model: request.model === undefined ? undefined : { provider: request.model.provider },
+    runDirectory: request.runDirectory,
+    ...(request.courtAttemptId === undefined ? {} : { courtAttemptId: request.courtAttemptId }),
     sessionManager: {
       getLeafEntry: () => sessionEntries.at(-1) as ReturnType<HostContext["sessionManager"]["getLeafEntry"]>,
       getLeafId: () => runId,
@@ -239,6 +241,7 @@ export async function prepareRoleEnvelope(options: {
           bindSubmissionNonPass: options.hostActions.bindSubmissionNonPass,
         },
         toolCallId: options.toolCallId,
+        ...(options.submission === undefined ? {} : { submission: options.submission }),
       });
     },
     on(...registration: HostEventRegistration) {
@@ -527,22 +530,8 @@ export async function prepareRoleEnvelope(options: {
   const relay = fileURLToPath(new URL("./mcp-relay.mjs", import.meta.url));
   await listen(server, options.socketPath);
   let disposed = false;
-  // Tools execute in this process (relay is protocol-only). Mirror Pi's child-env
-  // AK_ROLE_RUN_DIR / AK_ROLE_COURT_ATTEMPT injection onto the parent so ledger
-  // identity sees the same signals. Engine axis is request-scoped via RoleHost
-  // flag — never process.env (#818 P1). Run-dir may wait
-  // until prepare succeeds. Dispose restores including unset.
-  let priorAkRoleRunDir: string | undefined;
-  let priorAkRoleCourtAttempt: string | undefined;
-  let runDirInjected = false;
-  const restoreAkRoleRunEnv = (): void => {
-    if (!runDirInjected) return;
-    runDirInjected = false;
-    if (priorAkRoleRunDir === undefined) delete process.env.AK_ROLE_RUN_DIR;
-    else process.env.AK_ROLE_RUN_DIR = priorAkRoleRunDir;
-    if (priorAkRoleCourtAttempt === undefined) delete process.env.AK_ROLE_COURT_ATTEMPT;
-    else process.env.AK_ROLE_COURT_ATTEMPT = priorAkRoleCourtAttempt;
-  };
+  // Per-turn run/court identity lives on HostContext (request-scoped). Engine
+  // axis is already a RoleHost flag — never process.env (#818 P1 / #879).
   const dispose = async (): Promise<void> => {
     if (disposed) return;
     disposed = true;
@@ -552,11 +541,6 @@ export async function prepareRoleEnvelope(options: {
     } catch (error) {
       cleanupFailures.push(error);
     }
-    try {
-      restoreAkRoleRunEnv();
-    } catch (error) {
-      cleanupFailures.push(error);
-    }
     try {
       const closeAll = (server as unknown as { closeAllConnections?: () => void }).closeAllConnections;
       if (typeof closeAll === "function") closeAll.call(server);
@@ -640,6 +624,8 @@ export async function prepareRoleEnvelope(options: {
     }
     // Method notes only here — role before_agent_start injects soul once.
     // Preloading session materials duplicated soul under the role tag (#632).
+    // #879: case-dossier owner reads runDirectory from this turn's HostContext.
+
     const methodPrompt = (await Promise.all(request.methods.map(({ path }) => readFile(path, "utf8")))).join("\n\n");
     const promptResults = await emit("before_agent_start", {
       prompt,
@@ -652,8 +638,8 @@ export async function prepareRoleEnvelope(options: {
       return [value.systemPrompt];
     });
     const systemPromptBody = systemPromptParts.length > 0 ? systemPromptParts.join("\n\n") : methodPrompt;
-    // Typed reading materials from agent-start handlers (machine face; independent of prompt bytes).
-    // Folded into the provider-visible systemPrompt by the adapter at the send boundary.
+    // Typed reading materials from agent-start handlers (incl. single shared
+    // case-dossier owner). Folded into provider-visible systemPrompt at send.
     const readingMaterials: unknown[] = [];
     for (const value of promptResults) {
       if (typeof value !== "object" || value === null) continue;
@@ -662,13 +648,6 @@ export async function prepareRoleEnvelope(options: {
       if (material !== undefined) readingMaterials.push(material);
     }
 
-    priorAkRoleRunDir = process.env.AK_ROLE_RUN_DIR;
-    priorAkRoleCourtAttempt = process.env.AK_ROLE_COURT_ATTEMPT;
-    process.env.AK_ROLE_RUN_DIR = request.runDirectory;
-    if (request.courtAttemptId === undefined) delete process.env.AK_ROLE_COURT_ATTEMPT;
-    else process.env.AK_ROLE_COURT_ATTEMPT = request.courtAttemptId;
-    runDirInjected = true;
-
     const terminating = tools.get(terminatingToolName);
     if (terminating === undefined) {
       throw new Error(`terminating tool not registered after activation: ${terminatingToolName}`);

package/src/role-runtime-dependencies.ts

@@ -26,6 +26,7 @@ export function createRoleRuntimeDependencies(packageRoot: string): RoleRuntimeD
   const doctorAuditor = createPiDoctorAuditor();
   const navigatorSessionFactory = createNativeNavigatorSessionFactory();
   return {
+    packageRoot,
     loadJudgeSoul: () => loadMainRoleSessionMaterials("judge"),
     loadFixerSoul: () => loadMainRoleSessionMaterials("fixer"),
     loadFixPacket: (path) => readFile(path, "utf8"),

package/src/role-runtime.ts

@@ -2,6 +2,8 @@ import { readFileSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import {
   ExplicitInternalActivationError,
+  isOfficerReviewSeat,
+  runDirectoryFromHostContext,
   type HostContext,
   type HostToolResult,
   type RoleEnvelopeHost,
@@ -36,7 +38,13 @@ import {
   writeToolExecutionObservationRecord,
   type ToolExecutionObservationWriter,
 } from "./tool-execution-observation.ts";
-import { ENGINE_DETOUR_TOOL_NAME } from "./engine-detour.ts";
+import {
+  ENGINE_DETOUR_TOOL_NAME,
+  ENGINE_MODEL_FLAG_NAME,
+  resolveEngineModel,
+  resolveEngineName,
+} from "./engine-detour.ts";
+import { engineSessionMaterialFromOptions } from "./package-resources/engine-material.ts";
 import { registerEngineDetourTool } from "./engine-detour-tool.ts";
 import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.ts";
 import type { AnyCanonicalSkillBinding } from "./canonical-skill-binding.ts";
@@ -71,7 +79,7 @@ import {
   INSPECTOR_TOOL_SPEC,
   type InspectorRuntimeDependencies,
 } from "./inspector-role.ts";
-import { INSPECTOR_ACCEPTED_TEXT } from "./inspector-contracts.ts";
+import { INSPECTOR_ACCEPTED_TEXT, INSPECTOR_SOURCE_RUN_FLAG } from "./inspector-contracts.ts";
 import {
   DIARIST_TOOL_SPEC,
   type DiaristRuntimeDependencies,
@@ -566,6 +574,8 @@ type NavigatorAttendanceDependency = Omit<NavigatorAttendance, "knownRoutePlaybo
   Partial<Pick<NavigatorAttendance, "knownRoutePlaybookReadFailure">>;
 
 export type RoleRuntimeDependencies = {
+  /** Package root for packaged engine-note resolution (#879). */
+  packageRoot?: string;
   loadJudgeSoul(): Promise<string>;
   loadFixerSoul?(): Promise<string>;
   loadFixPacket?(path: string): Promise<string>;
@@ -898,14 +908,14 @@ function readDiaristTicketAssertion(
 }
 
 /** Run coordinates + optional pre-bound ticket from durable pages (#779). */
-function readDiaristRunCoordinates(): {
+function readDiaristRunCoordinates(ctx: HostContext): {
   readonly runDirectory: string;
   readonly projectRoot: string;
   readonly home: string;
   readonly boundTicketNumber?: number;
 } {
-  const runDirectory = process.env.AK_ROLE_RUN_DIR;
-  if (typeof runDirectory !== "string" || runDirectory.trim() === "") {
+  const runDirectory = runDirectoryFromHostContext(ctx);
+  if (runDirectory === undefined) {
     throw new Error("diarist accept requires AK_ROLE_RUN_DIR");
   }
   const admittedPath = join(runDirectory, "admitted-request.json");
@@ -948,13 +958,13 @@ export function createDiaristRoleRuntime(
       tool: DIARIST_TOOL_SPEC,
       acceptedText: DIARIST_ACCEPTED_TEXT,
       soulTag: "diarist",
-      beforeAccept: async ({ parameters }) => {
+      beforeAccept: async ({ parameters, ctx }) => {
         const submitted =
           parameters !== null && typeof parameters === "object" && !Array.isArray(parameters)
             ? (parameters as Record<string, unknown>)
             : undefined;
         const assertion = readDiaristTicketAssertion(submitted);
-        const coords = readDiaristRunCoordinates();
+        const coords = readDiaristRunCoordinates(ctx);
         // #836 7.3: pre-bound ticket is material for the LLM, not an override.
         const ticketNumber = assertion.kind === "ticket" ? assertion.ticketNumber : undefined;
         if (ticketNumber !== undefined) {
@@ -1020,6 +1030,8 @@ export function createCountersignRoleRuntime(
             ...(signal === undefined ? {} : { signal }),
             hostActions,
             toolCallId,
+            // #879: this-turn typed payload — identity-bound at submit site.
+            submission: parameters,
           });
         }
       : undefined;
@@ -1057,6 +1069,10 @@ export function createRoleRuntimeExtension(
     for (const flag of NOTARY_TRANSPORT_FLAGS) {
       roleHost.registerFlag(flag.name, flag.definition);
     }
+    roleHost.registerFlag(
+      INSPECTOR_SOURCE_RUN_FLAG.name,
+      INSPECTOR_SOURCE_RUN_FLAG.definition,
+    );
     for (const flag of GLEANER_LEFT_TRANSPORT_FLAGS) {
       roleHost.registerFlag(flag.name, flag.definition);
     }
@@ -1066,6 +1082,13 @@ export function createRoleRuntimeExtension(
     }
     // Station-child identity (#840): omit navigator attendance. One flag.
     roleHost.registerFlag(STATION_CHILD_FLAG.name, STATION_CHILD_FLAG.definition);
+    // Register model only. Pi never sets ak-engine — resolveEngineName must
+    // fall through to child-process env. An empty default would block that.
+    roleHost.registerFlag(ENGINE_MODEL_FLAG_NAME, {
+      description: "本次劳务引擎模型",
+      type: "string",
+      default: "",
+    });
 
     let admitted = false;
     let selectedRole: string | undefined;
@@ -1163,6 +1186,7 @@ export function createRoleRuntimeExtension(
       settleNavigatorProjection,
     );
     roleHost.on("input", (event) => {
+      const text = event.text;
       const role = roleHost.getFlag(ROLE_FLAG.name);
       if (role !== undefined && !admitted) return { action: "handled" as const };
       // Reviewer: recover original request; Pi argv may already carry native form.
@@ -1175,14 +1199,19 @@ export function createRoleRuntimeExtension(
         reviewerOriginalRequest =
           roleHost.capabilities?.skillOriginalRequest?.(
             activeReviewerParent.skillBinding.name,
-            event.text,
-          ) ?? event.text;
-        return { action: "continue" as const };
+            text,
+          ) ?? text;
+        return text === event.text
+          ? { action: "continue" as const }
+          : { action: "transform" as const, text };
       }
-      return { action: "continue" as const };
+      return text === event.text
+        ? { action: "continue" as const }
+        : { action: "transform" as const, text };
     });
     roleHost.on("before_agent_start", async (event, ctx) => {
       const role = roleHost.getFlag(ROLE_FLAG.name);
+      const prompt = event.prompt;
       if (role === undefined) return;
       if (!admitted || selectedRole !== role) {
         failInfrastructure(new ActivationBarrierError(role), ctx);
@@ -1207,7 +1236,7 @@ export function createRoleRuntimeExtension(
           // output payload (#836 targets the latter): the human's own raw
           // prompt bytes, copied verbatim into Navigator's work context when
           // nothing else has supplied a subject yet.
-          const subject = event.prompt.trim();
+          const subject = prompt.trim();
           if (subject !== "") {
             const root = subjectPath(ctx.sessionManager.getSessionDir(), ctx.cwd);
             const subjectProvenance = "user_prompt" satisfies NavigatorSubjectProvenance;
@@ -1231,7 +1260,7 @@ export function createRoleRuntimeExtension(
         if (!reviewerExpansionCaptured) {
           if (reviewerOriginalRequest !== undefined) {
             activeReviewerParent.skillBinding.captureExpansion(
-              roleHost.capabilities?.skillExpansion(event.prompt),
+              roleHost.capabilities?.skillExpansion(prompt),
               reviewerOriginalRequest,
             );
           }
@@ -1255,6 +1284,54 @@ export function createRoleRuntimeExtension(
         };
       }
     });
+    // #879: engine coordinates ride readingMaterial only when station-child
+    // officer dialogue replaced the ordinary transport prompt (no double fold).
+    roleHost.on("before_agent_start", () => {
+      const role = selectedRole ?? roleHost.getFlag(ROLE_FLAG.name);
+      if (typeof role !== "string" || !isOfficerReviewSeat(role)) return;
+      if (roleHost.getFlag(STATION_CHILD_FLAG.name) !== true) return;
+      const engine = resolveEngineName((name) => roleHost.getFlag(name));
+      if (engine === undefined || dependencies.packageRoot === undefined) return;
+      const engineModel = resolveEngineModel((name) => roleHost.getFlag(name));
+      const material = engineSessionMaterialFromOptions({
+        engine,
+        ...(engineModel === undefined ? {} : { engineModel }),
+        packageRoot: dependencies.packageRoot,
+      });
+      if (material === undefined) return;
+      return {
+        readingMaterial: {
+          kind: "engine-session-material" as const,
+          name: material.name,
+          ...(material.model === undefined ? {} : { model: material.model }),
+          ...(material.materialPath === undefined ? {} : { materialPath: material.materialPath }),
+        },
+      };
+    });
+    roleHost.on("before_agent_start", () => {
+      const path = roleHost.getFlag(INSPECTOR_SOURCE_RUN_FLAG.name);
+      if (typeof path !== "string" || path.trim() === "") return;
+      return {
+        readingMaterial: {
+          kind: "inspector-parent-binding" as const,
+          sourceRunPath: path,
+        },
+      };
+    });
+    // #879: single shared owner of station-child 0081 case-dossier → readingMaterial fold.
+    // post-admission freezes under run/attachments/case-dossier/; this handler alone
+    // projects it onto the existing agent-start materials face (Pi + envelope collect).
+    // Role modules must not re-read the freeze (ADR 0018 lifecycle; no duplicate fold).
+    roleHost.on("before_agent_start", async (_event, ctx) => {
+      const runDir = runDirectoryFromHostContext(ctx);
+      if (runDir === undefined) return;
+      const { loadCaseDossierReadingMaterial } = await import(
+        "./public-cli/case-dossier-delivery.ts"
+      );
+      const caseDossier = await loadCaseDossierReadingMaterial(runDir);
+      if (caseDossier === undefined) return;
+      return { readingMaterial: caseDossier };
+    });
     roleHost.on("tool_result", async (event) => {
       const role = selectedRole;
       if (role === undefined) return;
@@ -1341,7 +1418,7 @@ export function createRoleRuntimeExtension(
           display: false,
         }, { triggerTurn: true, deliverAs: "followUp" });
       } else if (receiptDelivery.nextAction() === "no-receipt" && !noReceiptRecorded) {
-        const runPointer = process.env.AK_ROLE_RUN_DIR;
+        const runPointer = runDirectoryFromHostContext(ctx);
         if (runPointer !== undefined) {
           noReceiptRecorded = true;
           const facts = receiptDelivery.facts({ runPointer, attemptPointer: `current:${runPointer}` });
@@ -1750,8 +1827,8 @@ export function createRoleRuntimeExtension(
       provider: string,
       ctx: HostContext,
     ): Promise<void> => {
-      const runDir = process.env.AK_ROLE_RUN_DIR;
-      if (typeof runDir !== "string" || runDir.trim() === "") return;
+      const runDir = runDirectoryFromHostContext(ctx);
+      if (runDir === undefined) return;
       try {
         await recordTypedProviderHttpStatus(runDir, { httpStatus: status, provider });
       } catch (error) {
@@ -1785,10 +1862,9 @@ export function createRoleRuntimeExtension(
         const underlying = priorFetch;
         globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
           const response = await underlying(input, init);
-          const runDir = process.env.AK_ROLE_RUN_DIR;
+          const runDir = runDirectoryFromHostContext(ctx);
           if (
-            typeof runDir === "string"
-            && runDir.trim() !== ""
+            runDir !== undefined
             && typeof response?.status === "number"
             && (response.status < 200 || response.status >= 300)
           ) {

package/src/submission-ledger.ts

@@ -2,7 +2,13 @@ import {
   resolveActivationLedgerHome,
   tryHomeFromAkRolesPath,
 } from "./activation-ledger-topology.ts";
-import type { HostContext, HostToolResult, RoleHost } from "./host-contracts.ts";
+import {
+  courtAttemptIdFromHostContext,
+  runDirectoryFromHostContext,
+  type HostContext,
+  type HostToolResult,
+  type RoleHost,
+} from "./host-contracts.ts";
 import { isAuditEscalationProjection } from "./audit-escalation.ts";
 
 
@@ -24,6 +30,8 @@ export type SubmissionLedgerEvent =
       readonly toolCallId: string;
       readonly toolName: string;
       readonly sequence: number;
+      /** Seat identity — machine fact beside the payload (ADR 0042 / #881). */
+      readonly role?: TerminalRoleName;
       /** LLM tool-call params at call time (#836 原话). */
       readonly params?: unknown;
     }
@@ -55,8 +63,8 @@ export type SubmissionLedgerEvent =
  * otherwise session header id. Never a shared "unbound" bucket.
  */
 function runIdentity(context: HostContext): string {
-  const directory = process.env.AK_ROLE_RUN_DIR;
-  if (typeof directory === "string" && directory.length > 0) {
+  const directory = runDirectoryFromHostContext(context);
+  if (directory !== undefined) {
     const fromDir = runIdFromRunDirectory(directory);
     if (fromDir !== undefined) return fromDir;
   }
@@ -72,16 +80,26 @@ function runIdentity(context: HostContext): string {
 export const COURT_ATTEMPT_ENV = "AK_ROLE_COURT_ATTEMPT" as const;
 
 function attemptIdentity(context: HostContext, runId: string): string {
-  const courtAttempt = process.env[COURT_ATTEMPT_ENV];
-  if (typeof courtAttempt === "string" && courtAttempt.length > 0) return courtAttempt;
+  const courtAttempt = courtAttemptIdFromHostContext(context);
+  if (courtAttempt !== undefined) return courtAttempt;
   return context.sessionManager.getHeader?.()?.id ?? context.sessionManager.getLeafId?.() ?? `${runId}:initial`;
 }
 
 /** One recorded role submission as stored — original payload plus host identity. */
 export type RecordedSubmissionRow = {
-  readonly role: TerminalRoleName;
-  readonly kind: "accepted" | "audit-escalation";
+  /**
+   * Seat identity when known. Historical correctable/infrastructure rows may omit it;
+   * payloads still project (#881). Terminal acceptance kind still requires a role match.
+   */
+  readonly role?: TerminalRoleName;
+  /**
+   * Recording class on the ledger. Terminal acceptance kind still only follows
+   * `accepted` / `audit-escalation`; every class carries the original payload (#881).
+   */
+  readonly kind: "accepted" | "audit-escalation" | "correctable-rejection" | "infrastructure" | "candidate";
   readonly accepted: unknown;
+  /** Present when the ledger row names the tool call — used to dedupe candidate+outcome. */
+  readonly toolCallId?: string;
 };
 
 /** Closed-submission callback: original payload, no status/facts projection (#836). */
@@ -191,44 +209,192 @@ function recordedRole(payload: { role?: unknown; projection?: { role?: unknown }
   return undefined;
 }
 
+/** Prefer a more complete row for the same tool call without inventing a sole winner across calls. */
+function rowRank(kind: RecordedSubmissionRow["kind"]): number {
+  switch (kind) {
+    case "accepted":
+      return 4;
+    case "audit-escalation":
+      return 3;
+    case "correctable-rejection":
+    case "infrastructure":
+      return 2;
+    case "candidate":
+      return 1;
+  }
+}
+
 /**
- * All recorded role submissions in ledger order (#836 multi-submit).
+ * Same-call identity for reader pairing only (#881 / #836).
+ * attemptId is already on the record (subject/payload); bare toolCallId alone
+ * collapses distinct court attempts that reused a host call id.
+ */
+function submissionCallKey(attemptId: string | undefined, toolCallId: string): string {
+  return `${attemptId ?? ""}\0${toolCallId}`;
+}
+
+function rowFromPayload(
+  kind: RecordedSubmissionRow["kind"],
+  payload: {
+    role?: unknown;
+    projection?: { role?: unknown };
+    accepted?: unknown;
+    params?: unknown;
+    toolCallId?: unknown;
+  },
+  accepted: unknown,
+  roleFallback?: TerminalRoleName,
+): RecordedSubmissionRow {
+  const role = recordedRole(payload) ?? roleFallback;
+  return {
+    ...(role === undefined ? {} : { role }),
+    kind,
+    accepted,
+    ...(typeof payload.toolCallId === "string" && payload.toolCallId.length > 0
+      ? { toolCallId: payload.toolCallId }
+      : {}),
+  };
+}
+
+/**
+ * All recorded role submissions in ledger order (#836 multi-submit / #881).
+ * Projects every original payload — sealed, audit-escalation, correctable-rejection,
+ * infrastructure, and bare candidate — without outcome-class filtering.
+ * Same call (candidate + outcome both carrying params) appears once — keyed by
+ * recorded attemptId + toolCallId so distinct court attempts stay distinct (#881).
  * `accepted` is the original payload; never rebuilt from a status/facts envelope.
  */
-export async function readRecordedSubmissionRows(
-  cwd: string,
-  runId: string,
-  homeOrScope?: string | SubmissionLedgerReadScope,
-): Promise<readonly RecordedSubmissionRow[]> {
-  const scope = resolveReadScope(homeOrScope);
-  const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope.home);
-  const scoped = recordsForAttempt(owned, scope.attemptId);
+function mapOwnedToSubmissionRows(
+  owned: readonly { kind?: unknown; subject?: unknown; payload?: unknown }[],
+): readonly RecordedSubmissionRow[] {
+  const scoped = owned;
   const out: RecordedSubmissionRow[] = [];
+  const indexByCall = new Map<string, number>();
+  // Recover seat identity for historical non-sealed rows that omitted role (#881).
+  const roleByCall = new Map<string, TerminalRoleName>();
+  for (const record of scoped) {
+    const payload = record.payload as {
+      toolCallId?: unknown;
+      role?: unknown;
+      projection?: { role?: unknown };
+    } | undefined;
+    if (typeof payload?.toolCallId !== "string" || payload.toolCallId.length === 0) continue;
+    const role = recordedRole(payload);
+    if (role !== undefined) {
+      roleByCall.set(submissionCallKey(recordAttemptId(record), payload.toolCallId), role);
+    }
+  }
+
+  const take = (row: RecordedSubmissionRow, callKey: string | undefined): void => {
+    const toolCallId = row.toolCallId;
+    if (toolCallId !== undefined && callKey !== undefined) {
+      const existingIndex = indexByCall.get(callKey);
+      if (existingIndex !== undefined) {
+        const existing = out[existingIndex]!;
+        if (rowRank(row.kind) >= rowRank(existing.kind)) {
+          out[existingIndex] = {
+            ...row,
+            toolCallId,
+            // Keep a previously recovered role when the upgraded row still omits it.
+            ...(row.role === undefined && existing.role !== undefined ? { role: existing.role } : {}),
+          };
+        } else if (existing.role === undefined && row.role !== undefined) {
+          out[existingIndex] = { ...existing, role: row.role };
+        }
+        return;
+      }
+      indexByCall.set(callKey, out.length);
+    }
+    out.push(row);
+  };
+
   for (const record of scoped) {
+    const attemptId = recordAttemptId(record);
+    if (record.kind === "candidate") {
+      const payload = record.payload as Partial<Extract<SubmissionLedgerEvent, { type: "candidate" }>> & {
+        projection?: { role?: unknown };
+      } | undefined;
+      if (payload?.type !== "candidate" || payload.params === undefined) continue;
+      const callKey =
+        typeof payload.toolCallId === "string"
+          ? submissionCallKey(attemptId, payload.toolCallId)
+          : undefined;
+      const fallback = callKey !== undefined ? roleByCall.get(callKey) : undefined;
+      take(rowFromPayload("candidate", payload, payload.params, fallback), callKey);
+      continue;
+    }
     if (record.kind === "sealed") {
       const payload = record.payload as Partial<Extract<SubmissionLedgerEvent, { type: "sealed" }>> & {
         projection?: { role?: unknown };
       } | undefined;
       if (payload?.type !== "sealed" || payload.accepted === undefined) continue;
-      const role = recordedRole(payload);
-      if (role === undefined) continue;
-      out.push({ role, kind: "accepted", accepted: payload.accepted });
+      const callKey =
+        typeof payload.toolCallId === "string"
+          ? submissionCallKey(attemptId, payload.toolCallId)
+          : undefined;
+      const fallback = callKey !== undefined ? roleByCall.get(callKey) : undefined;
+      take(rowFromPayload("accepted", payload, payload.accepted, fallback), callKey);
       continue;
     }
     if (record.kind !== "outcome") continue;
     const payload = record.payload as Partial<Extract<SubmissionLedgerEvent, { type: "outcome" }>> & {
       projection?: { role?: unknown };
     } | undefined;
-    if (payload?.type !== "outcome" || payload.outcome !== "audit-escalation" || payload.accepted === undefined) {
-      continue;
-    }
-    const role = recordedRole(payload);
-    if (role === undefined) continue;
-    out.push({ role, kind: "audit-escalation", accepted: payload.accepted });
+    if (payload?.type !== "outcome" || payload.accepted === undefined) continue;
+    const outcome = payload.outcome;
+    const kind: RecordedSubmissionRow["kind"] |
+      undefined =
+      outcome === "audit-escalation"
+        ? "audit-escalation"
+        : outcome === "correctable-rejection"
+          ? "correctable-rejection"
+          : outcome === "infrastructure"
+            ? "infrastructure"
+            : undefined;
+    if (kind === undefined) continue;
+    const callKey =
+      typeof payload.toolCallId === "string"
+        ? submissionCallKey(attemptId, payload.toolCallId)
+        : undefined;
+    const fallback = callKey !== undefined ? roleByCall.get(callKey) : undefined;
+    take(rowFromPayload(kind, payload, payload.accepted, fallback), callKey);
   }
   return out;
 }
 
+/**
+ * All recorded role submissions in ledger order (#836 multi-submit).
+ * `accepted` is the original payload; never rebuilt from a status/facts envelope.
+ * Presentation stays run-scoped: attemptId on the read scope is a recording tag,
+ * not a visibility gate (#836).
+ */
+export async function readRecordedSubmissionRows(
+  cwd: string,
+  runId: string,
+  homeOrScope?: string | SubmissionLedgerReadScope,
+): Promise<readonly RecordedSubmissionRow[]> {
+  const scope = resolveReadScope(homeOrScope);
+  const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope.home);
+  const scoped = recordsForAttempt(owned, scope.attemptId);
+  return mapOwnedToSubmissionRows(scoped);
+}
+
+/**
+ * Settlement-only this-court rows (#879 return path).
+ * Filters by attemptId for court-scoped roleOutcome; does not replace the
+ * run-scoped presentation API above (#836 visibility gate stays pass-through).
+ */
+export async function readAttemptScopedSubmissionRows(
+  cwd: string,
+  runId: string,
+  attemptId: string,
+  home?: string,
+): Promise<readonly RecordedSubmissionRow[]> {
+  if (attemptId.length === 0) return [];
+  const { owned } = await readOwnedSubmissionRecords(cwd, runId, home);
+  return mapOwnedToSubmissionRows(owned.filter((record) => recordAttemptId(record) === attemptId));
+}
+
 /**
  * All raw role payloads in ledger order (#836 multi-submit).
  * Returns `accepted` bytes as stored — unknown, never re-wrapped.
@@ -241,7 +407,7 @@ export async function readRecordedSubmissions(
   return (await readRecordedSubmissionRows(cwd, runId, homeOrScope)).map((row) => row.accepted);
 }
 
-/** True when the run has at least one recorded accepted or audit-escalation payload. */
+/** True when the run has at least one recorded original payload (any outcome class). */
 export async function hasRecordedSubmission(
   cwd: string,
   runId: string,
@@ -364,6 +530,7 @@ export function createSubmissionLedgerHost(
             toolCallId,
             toolName: tool.name,
             sequence: ++state.sequence,
+            role,
             params,
           });
           let result: HostToolResult<unknown>;
@@ -389,6 +556,7 @@ export function createSubmissionLedgerHost(
                 outcome: "correctable-rejection",
                 code: "typed-bounce",
                 diagnostic: error instanceof Error ? error.message : String(error),
+                role,
                 accepted: params,
               });
               throw error;
@@ -399,6 +567,7 @@ export function createSubmissionLedgerHost(
                 toolCallId,
                 outcome: "infrastructure",
                 diagnostic: error instanceof Error ? error.message : String(error),
+                role,
                 accepted: params,
               });
               throw error;