@akagilnc/pi-workflow-roles 0.1.4021 → 0.1.4062

package/dist/public-role-summons.js

@@ -159,6 +159,8 @@ async function summonPublicRole(options) {
     ...options.signal === void 0 ? {} : { signal: options.signal },
     // #753: reask rides the existing notary same-ticket resume summons.instruction.
     ...options.reviewReask === void 0 ? {} : { reviewReask: options.reviewReask },
+    // #879: verbatim submission body on officer dialogue content channel.
+    ...options.gateReviewInstruction === void 0 ? {} : { gateReviewInstruction: options.gateReviewInstruction },
     ...options.boundTicketNumber === void 0 ? {} : { boundTicketNumber: options.boundTicketNumber },
     // createRunId is the only remaining env overlay — host is seat-selected above.
     ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId }
@@ -266,6 +268,11 @@ async function summonGateOfficer(options) {
     const { homeFromRunDirectory } = await import("./activation-ledger-topology.js");
     home = homeFromRunDirectory(options.sourceRunDirectory);
   }
+  let gateReviewInstruction;
+  if (options.reask === void 0 && options.submission !== void 0) {
+    const { readableGateItem } = await import("./readable-gate-item.js");
+    gateReviewInstruction = readableGateItem(options.submission);
+  }
   const common = {
     cwd: options.cwd,
     ...home === void 0 ? {} : { home },
@@ -273,6 +280,7 @@ async function summonGateOfficer(options) {
     ...options.io === void 0 ? {} : { io: options.io },
     ...options.signal === void 0 ? {} : { signal: options.signal },
     ...options.reask === void 0 ? {} : { reviewReask: options.reask },
+    ...gateReviewInstruction === void 0 ? {} : { gateReviewInstruction },
     ...options.roleTurnHost === void 0 ? {} : { roleTurnHost: options.roleTurnHost },
     ...options.hostAdapters === void 0 ? {} : { hostAdapters: options.hostAdapters },
     ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId }

package/dist/submission-ledger.js

@@ -1,4 +1,5 @@
 import { resolveActivationLedgerHome, tryHomeFromAkRolesPath, } from "./activation-ledger-topology.js";
+import { courtAttemptIdFromHostContext, runDirectoryFromHostContext, } from "./host-contracts.js";
 import { isAuditEscalationProjection } from "./audit-escalation.js";
 import { runIdFromRunDirectory } from "./run-terminal-artifacts.js";
 import { readSitianRecords, resolveSitianRecordPathInLedger, sitianReport } from "./sitian-facade.js";
@@ -10,8 +11,8 @@ import { failOnInfrastructureFailureDeclaration } from "./package-contracts/term
  * otherwise session header id. Never a shared "unbound" bucket.
  */
 function runIdentity(context) {
-    const directory = process.env.AK_ROLE_RUN_DIR;
-    if (typeof directory === "string" && directory.length > 0) {
+    const directory = runDirectoryFromHostContext(context);
+    if (directory !== undefined) {
         const fromDir = runIdFromRunDirectory(directory);
         if (fromDir !== undefined)
             return fromDir;
@@ -27,8 +28,8 @@ function runIdentity(context) {
  */
 export const COURT_ATTEMPT_ENV = "AK_ROLE_COURT_ATTEMPT";
 function attemptIdentity(context, runId) {
-    const courtAttempt = process.env[COURT_ATTEMPT_ENV];
-    if (typeof courtAttempt === "string" && courtAttempt.length > 0)
+    const courtAttempt = courtAttemptIdFromHostContext(context);
+    if (courtAttempt !== undefined)
         return courtAttempt;
     return context.sessionManager.getHeader?.()?.id ?? context.sessionManager.getLeafId?.() ?? `${runId}:initial`;
 }
@@ -110,39 +111,155 @@ function recordedRole(payload) {
         return payload.projection.role;
     return undefined;
 }
+/** Prefer a more complete row for the same tool call without inventing a sole winner across calls. */
+function rowRank(kind) {
+    switch (kind) {
+        case "accepted":
+            return 4;
+        case "audit-escalation":
+            return 3;
+        case "correctable-rejection":
+        case "infrastructure":
+            return 2;
+        case "candidate":
+            return 1;
+    }
+}
 /**
- * All recorded role submissions in ledger order (#836 multi-submit).
+ * Same-call identity for reader pairing only (#881 / #836).
+ * attemptId is already on the record (subject/payload); bare toolCallId alone
+ * collapses distinct court attempts that reused a host call id.
+ */
+function submissionCallKey(attemptId, toolCallId) {
+    return `${attemptId ?? ""}\0${toolCallId}`;
+}
+function rowFromPayload(kind, payload, accepted, roleFallback) {
+    const role = recordedRole(payload) ?? roleFallback;
+    return {
+        ...(role === undefined ? {} : { role }),
+        kind,
+        accepted,
+        ...(typeof payload.toolCallId === "string" && payload.toolCallId.length > 0
+            ? { toolCallId: payload.toolCallId }
+            : {}),
+    };
+}
+/**
+ * All recorded role submissions in ledger order (#836 multi-submit / #881).
+ * Projects every original payload — sealed, audit-escalation, correctable-rejection,
+ * infrastructure, and bare candidate — without outcome-class filtering.
+ * Same call (candidate + outcome both carrying params) appears once — keyed by
+ * recorded attemptId + toolCallId so distinct court attempts stay distinct (#881).
  * `accepted` is the original payload; never rebuilt from a status/facts envelope.
  */
-export async function readRecordedSubmissionRows(cwd, runId, homeOrScope) {
-    const scope = resolveReadScope(homeOrScope);
-    const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope.home);
-    const scoped = recordsForAttempt(owned, scope.attemptId);
+function mapOwnedToSubmissionRows(owned) {
+    const scoped = owned;
     const out = [];
+    const indexByCall = new Map();
+    // Recover seat identity for historical non-sealed rows that omitted role (#881).
+    const roleByCall = new Map();
+    for (const record of scoped) {
+        const payload = record.payload;
+        if (typeof payload?.toolCallId !== "string" || payload.toolCallId.length === 0)
+            continue;
+        const role = recordedRole(payload);
+        if (role !== undefined) {
+            roleByCall.set(submissionCallKey(recordAttemptId(record), payload.toolCallId), role);
+        }
+    }
+    const take = (row, callKey) => {
+        const toolCallId = row.toolCallId;
+        if (toolCallId !== undefined && callKey !== undefined) {
+            const existingIndex = indexByCall.get(callKey);
+            if (existingIndex !== undefined) {
+                const existing = out[existingIndex];
+                if (rowRank(row.kind) >= rowRank(existing.kind)) {
+                    out[existingIndex] = {
+                        ...row,
+                        toolCallId,
+                        // Keep a previously recovered role when the upgraded row still omits it.
+                        ...(row.role === undefined && existing.role !== undefined ? { role: existing.role } : {}),
+                    };
+                }
+                else if (existing.role === undefined && row.role !== undefined) {
+                    out[existingIndex] = { ...existing, role: row.role };
+                }
+                return;
+            }
+            indexByCall.set(callKey, out.length);
+        }
+        out.push(row);
+    };
     for (const record of scoped) {
+        const attemptId = recordAttemptId(record);
+        if (record.kind === "candidate") {
+            const payload = record.payload;
+            if (payload?.type !== "candidate" || payload.params === undefined)
+                continue;
+            const callKey = typeof payload.toolCallId === "string"
+                ? submissionCallKey(attemptId, payload.toolCallId)
+                : undefined;
+            const fallback = callKey !== undefined ? roleByCall.get(callKey) : undefined;
+            take(rowFromPayload("candidate", payload, payload.params, fallback), callKey);
+            continue;
+        }
         if (record.kind === "sealed") {
             const payload = record.payload;
             if (payload?.type !== "sealed" || payload.accepted === undefined)
                 continue;
-            const role = recordedRole(payload);
-            if (role === undefined)
-                continue;
-            out.push({ role, kind: "accepted", accepted: payload.accepted });
+            const callKey = typeof payload.toolCallId === "string"
+                ? submissionCallKey(attemptId, payload.toolCallId)
+                : undefined;
+            const fallback = callKey !== undefined ? roleByCall.get(callKey) : undefined;
+            take(rowFromPayload("accepted", payload, payload.accepted, fallback), callKey);
             continue;
         }
         if (record.kind !== "outcome")
             continue;
         const payload = record.payload;
-        if (payload?.type !== "outcome" || payload.outcome !== "audit-escalation" || payload.accepted === undefined) {
+        if (payload?.type !== "outcome" || payload.accepted === undefined)
             continue;
-        }
-        const role = recordedRole(payload);
-        if (role === undefined)
+        const outcome = payload.outcome;
+        const kind = outcome === "audit-escalation"
+            ? "audit-escalation"
+            : outcome === "correctable-rejection"
+                ? "correctable-rejection"
+                : outcome === "infrastructure"
+                    ? "infrastructure"
+                    : undefined;
+        if (kind === undefined)
             continue;
-        out.push({ role, kind: "audit-escalation", accepted: payload.accepted });
+        const callKey = typeof payload.toolCallId === "string"
+            ? submissionCallKey(attemptId, payload.toolCallId)
+            : undefined;
+        const fallback = callKey !== undefined ? roleByCall.get(callKey) : undefined;
+        take(rowFromPayload(kind, payload, payload.accepted, fallback), callKey);
     }
     return out;
 }
+/**
+ * All recorded role submissions in ledger order (#836 multi-submit).
+ * `accepted` is the original payload; never rebuilt from a status/facts envelope.
+ * Presentation stays run-scoped: attemptId on the read scope is a recording tag,
+ * not a visibility gate (#836).
+ */
+export async function readRecordedSubmissionRows(cwd, runId, homeOrScope) {
+    const scope = resolveReadScope(homeOrScope);
+    const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope.home);
+    const scoped = recordsForAttempt(owned, scope.attemptId);
+    return mapOwnedToSubmissionRows(scoped);
+}
+/**
+ * Settlement-only this-court rows (#879 return path).
+ * Filters by attemptId for court-scoped roleOutcome; does not replace the
+ * run-scoped presentation API above (#836 visibility gate stays pass-through).
+ */
+export async function readAttemptScopedSubmissionRows(cwd, runId, attemptId, home) {
+    if (attemptId.length === 0)
+        return [];
+    const { owned } = await readOwnedSubmissionRecords(cwd, runId, home);
+    return mapOwnedToSubmissionRows(owned.filter((record) => recordAttemptId(record) === attemptId));
+}
 /**
  * All raw role payloads in ledger order (#836 multi-submit).
  * Returns `accepted` bytes as stored — unknown, never re-wrapped.
@@ -150,7 +267,7 @@ export async function readRecordedSubmissionRows(cwd, runId, homeOrScope) {
 export async function readRecordedSubmissions(cwd, runId, homeOrScope) {
     return (await readRecordedSubmissionRows(cwd, runId, homeOrScope)).map((row) => row.accepted);
 }
-/** True when the run has at least one recorded accepted or audit-escalation payload. */
+/** True when the run has at least one recorded original payload (any outcome class). */
 export async function hasRecordedSubmission(cwd, runId, homeOrScope) {
     return (await readRecordedSubmissionRows(cwd, runId, homeOrScope)).length > 0;
 }
@@ -254,6 +371,7 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                         toolCallId,
                         toolName: tool.name,
                         sequence: ++state.sequence,
+                        role,
                         params,
                     });
                     let result;
@@ -274,6 +392,7 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                                 outcome: "correctable-rejection",
                                 code: "typed-bounce",
                                 diagnostic: error instanceof Error ? error.message : String(error),
+                                role,
                                 accepted: params,
                             });
                             throw error;
@@ -285,6 +404,7 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                                 toolCallId,
                                 outcome: "infrastructure",
                                 diagnostic: error instanceof Error ? error.message : String(error),
+                                role,
                                 accepted: params,
                             });
                             throw error;

package/dist/user-dialogue-stdin.js

@@ -0,0 +1,33 @@
+/**
+ * Typed user-dialogue stdin transport (#879 / #471).
+ * Pi's piped-stdin reader trims the wrapper; the body field keeps original bytes.
+ * No size cap and no path/pointer substitute — the whole dialogue rides the envelope.
+ */
+export const USER_DIALOGUE_STDIN_KIND = "ak-user-dialogue";
+export function encodeUserDialogueStdin(body) {
+    return JSON.stringify({ kind: USER_DIALOGUE_STDIN_KIND, body });
+}
+function isUserDialogueEnvelope(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return record.kind === USER_DIALOGUE_STDIN_KIND && typeof record.body === "string";
+}
+/**
+ * Host read: recover original dialogue after a trim-capable pipe.
+ * Non-envelope text (interactive Pi, officer JSON, headless raw body) is unchanged.
+ */
+export function readUserDialogueStdin(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed.startsWith("{"))
+        return raw;
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (isUserDialogueEnvelope(parsed))
+            return parsed.body;
+    }
+    catch {
+        // Not our envelope — leave caller bytes intact.
+    }
+    return raw;
+}

package/extensions/role-runtime.ts

@@ -111,6 +111,7 @@ export default function roleRuntime(pi: ExtensionAPI): void {
   registerNavigatorModelCommand(pi);
   const navigatorSessionFactory = createNativeNavigatorSessionFactory();
   createPiRoleRuntimeExtension({
+    packageRoot,
     loadJudgeSoul: () => loadMainRoleSessionMaterials("judge"),
     loadFixerSoul: () => loadMainRoleSessionMaterials("fixer"),
     loadFixPacket: (path) => readFile(path, "utf8"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4021",
+  "version": "0.1.4062",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/resources/836-deleted-machine-instruction-inventory.md

@@ -1,6 +1,6 @@
 # #836 删 5：从代码迁出的机器指令句清单
 
-供陛下过目。不改 soul。确需对角色说的话归入本包资源（ADR 0073）。指针句（附件路径、卷宗指针、「请重读」）保留为中立机器文本，不在本表。
+供陛下过目。不改 soul。确需对角色说的话归入本包资源（ADR 0073）。指针句（附件路径、卷宗指针）保留为中立机器文本／绑定材料，不在本表。「请重读」开场已由 #879 废止，不再保留。
 
 | 原位点 | 原句（代码自写） | 处置 |
 |---|---|---|

package/src/doctor-auditor.ts

@@ -26,7 +26,7 @@ export type DoctorAuditOptions = {
  */
 export function createPiDoctorAuditor(): (options: DoctorAuditOptions) => Promise<ComplianceDecision> {
   return async (options) => {
-    const dossier = resolveAuditDossier();
+    const dossier = resolveAuditDossier(options.context);
     requireAuditMaterials(dossier);
     const subjects = readDoctorAuditSubjects(options.context);
     requireAuditMaterials(subjects);

package/src/dossier-resolution.ts

@@ -1,10 +1,13 @@
 /**
  * Unique dossier-resolution seam for 审刑院 (#233).
- * Machine pointers only: cwd + AK_ROLE_RUN_DIR. No latest-run / mtime / global scan.
+ * Machine pointers only: cwd + per-turn HostContext (Pi child env fallback).
+ * No latest-run / mtime / global scan.
  */
 import { existsSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { runDirectoryFromHostContext, type HostContext } from "./host-contracts.ts";
+
 export const AUDIT_RUN_DIR_ENV = "AK_ROLE_RUN_DIR" as const;
 export const DOCTOR_CANDIDATE_ENTRY_TYPE = "ak_doctor_audit_candidate" as const;
 
@@ -33,18 +36,33 @@ export type SubjectIncomplete = {
 };
 export type SubjectResolution = SubjectOk | SubjectIncomplete;
 
+function isHostContext(value: object): value is HostContext {
+  return "sessionManager" in value;
+}
+
+function dossierPointerFrom(source?: HostContext | NodeJS.ProcessEnv): string | undefined {
+  if (source !== undefined && isHostContext(source)) {
+    return runDirectoryFromHostContext(source);
+  }
+  const env = source ?? process.env;
+  const raw = env[AUDIT_RUN_DIR_ENV];
+  return typeof raw === "string" && raw.trim() !== "" ? raw : undefined;
+}
+
 /**
- * Resolve the per-run dossier pointer injected by the public CLI.
+ * Resolve the per-run dossier pointer.
  *
+ * ACP/headless: typed HostContext.runDirectory.
+ * Pi child: HostContext projected from env, or env fallback when no context.
  * Absent pointer = bare Pi internal seam (ADR 0052): audit proceeds; the model
- * self-locates the dossier from its own fall-volume position per soul. Public CLI
- * always injects the pointer — only then does the machine validate the path.
- * Concurrent runs stay isolated because a present pointer is per-process.
+ * self-locates the dossier from its own fall-volume position per soul.
  */
-export function resolveAuditDossier(env: NodeJS.ProcessEnv = process.env): DossierResolution {
-  const raw = env[AUDIT_RUN_DIR_ENV];
+export function resolveAuditDossier(
+  source?: HostContext | NodeJS.ProcessEnv,
+): DossierResolution {
+  const raw = dossierPointerFrom(source);
   // Bare Pi activation seam: no machine gate when the pointer was never injected.
-  if (typeof raw !== "string" || raw.trim() === "") {
+  if (raw === undefined) {
     return { status: "ok" };
   }
   const runDirectory = resolve(raw);

package/src/external-host-turn-loop.ts

@@ -9,6 +9,7 @@ import type {
   RoleTurnRequest,
   RoleTurnResult,
 } from "./host-contracts.ts";
+import { isOfficerReviewSeat } from "./host-contracts.ts";
 
 export const EXTERNAL_ROLE_TURN_ROUND_LIMIT = 8 as const;
 
@@ -54,8 +55,16 @@ export function mergeRoleTurnAbortSignals(
   return AbortSignal.any([prepared, request]);
 }
 
+/**
+ * Host-transition prior-native paths are machine handoff material (#617 DK-4).
+ * #879: station-child officer dialogue must not receive those paths spliced into
+ * the review prompt — officers already hold --source-run / binding pointers.
+ */
 export function promptWithPriorNativePaths(basePrompt: string, request: RoleTurnRequest): string {
   if (request.continuation.kind !== "resume") return basePrompt;
+  if (request.stationChild === true && isOfficerReviewSeat(request.activation.role)) {
+    return basePrompt;
+  }
   const paths = request.hostTransition?.priorNativePaths;
   if (paths === undefined || paths.length === 0) return basePrompt;
   return `${basePrompt}\n${paths.join("\n")}`;

package/src/gatekeeper-pass-envelope.ts

@@ -74,6 +74,11 @@ export async function requireGatekeeperPass(options: {
   readonly signal?: AbortSignal;
   readonly hostActions: GatekeeperPassHostActions;
   readonly toolCallId: string;
+  /**
+   * In-flight parent typed payload for this gate turn (#879). Relayed verbatim
+   * as officer dialogue content; binding pointer stays the parent run directory.
+   */
+  readonly submission?: unknown;
   /** Lowest seam: same as runGatekeeper options.summonOfficer — offline tracers only. */
   readonly summonOfficer?: GateOfficerSummon;
 }): Promise<void> {
@@ -85,6 +90,7 @@ export async function requireGatekeeperPass(options: {
       subject: options.subject,
       ...(options.signal === undefined ? {} : { signal: options.signal }),
       ...(options.summonOfficer === undefined ? {} : { summonOfficer: options.summonOfficer }),
+      ...(options.submission === undefined ? {} : { submission: options.submission }),
       ...(reask === undefined ? {} : { reask }),
     });
     const gatekeeper = projected.result;

package/src/gatekeeper-role.ts

@@ -86,18 +86,30 @@ export type GateOfficerSummon = (
    * conclusion (#753 / #756). Hosted as same-ticket resume instruction.
    */
   reask?: string,
+  /**
+   * In-flight parent 交卷 body (tool-call arguments). Production default relays
+   * it verbatim on the officer dialogue content channel (#786 / #879).
+   * Identity-bound at the submit site — never recovered as latest toolCall.
+   */
+  submission?: unknown,
 ) => Promise<PublicSummonResult>;
 
 export type RunGatekeeperOptions = {
   readonly context: ExtensionContext | HostContext;
   readonly subject: GatekeeperSubject;
   readonly signal?: AbortSignal;
-  /** Run directory of the parent role (pointer-only summons, ADR 0079). */
+  /** Run directory of the parent role (binding pointer, ADR 0079 / #879). */
   readonly runDirectory?: string;
   /**
    * Plain-language re-ask for this summon (resume speaker after non-three-state).
    */
   readonly reask?: string;
+  /**
+   * In-flight parent typed payload for this gate turn. Relayed verbatim as
+   * officer dialogue content (#879). Call site passes the current tool args —
+   * code must not scan session latest/mtime to recover it.
+   */
+  readonly submission?: unknown;
   /**
    * Test seam for public-role summons. Production calls the shared public
    * activation path (#675); inject only in offline tracers.
@@ -198,15 +210,26 @@ function projectOfficerDecision(
 }
 
 /**
- * Project a public-role terminal onto the gate queue surface.
- * Host failure stays failure; recorded officer payloads ride beside it (#836 A.3).
- * Multiple recorded payloads are all kept — code does not pick last-wins.
+ * This-court officer payloads for the parent return path (#879).
+ * Only settlement-scoped roleOutcome.payloads (courtAttempt seal) carry this-court
+ * identity. Never guess from undivided submissions — sole row included — history
+ * stays on terminal.submissions (#836 presentation).
  */
-function officerPayloads(terminal: TerminalResult | undefined): readonly unknown[] {
+function thisCourtOfficerPayloads(terminal: TerminalResult | undefined): readonly unknown[] {
   const outcome = terminal?.roleOutcome;
   if (outcome !== undefined && (outcome.kind === "accepted" || outcome.kind === "audit_escalation")) {
-    return outcome.payloads ?? terminal?.submissions ?? [];
+    if (outcome.payloads !== undefined && outcome.payloads.length > 0) return outcome.payloads;
+  }
+  if (outcome?.kind === "failure" && outcome.payloads !== undefined && outcome.payloads.length > 0) {
+    return outcome.payloads;
   }
+  // No sole-row identity guess: undivided submissions are not this-court (#879).
+  return [];
+}
+
+/** Failure/transport channel may still surface every recorded payload beside the failure (#836 A.3). */
+function officerFailurePayloads(terminal: TerminalResult | undefined): readonly unknown[] {
+  const outcome = terminal?.roleOutcome;
   if (outcome?.kind === "failure") return outcome.payloads ?? terminal?.submissions ?? [];
   return terminal?.submissions ?? [];
 }
@@ -219,19 +242,9 @@ function projectOfficerPayloads(
   if (payloads.length === 0) {
     return projectOfficerDecision(officer, undefined, fallbackStatus);
   }
-  // Present every recorded payload; queue only the latest conclusion so a reask
-  // can converge (#836 呈现 ≠ 排队).
-  const queued = projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
-  if (payloads.length === 1) return queued;
-  if (
-    queued.status === "pass"
-    || queued.status === "bounce"
-    || queued.status === "escalate"
-    || queued.status === "needs_reask"
-  ) {
-    return { ...queued, receipt: payloads };
-  }
-  return queued;
+  // This-court multi-submit: queue the latest seal of THIS court only (#836 呈现≠排队).
+  // Single this-court seal is the common path. Never fold history into an array receipt.
+  return projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
 }
 
 function projectOfficerTerminal(
@@ -240,16 +253,17 @@ function projectOfficerTerminal(
 ): GatekeeperResult {
   const terminal: TerminalResult | undefined = summoned.terminal;
   const outcome = terminal?.roleOutcome;
-  const recorded = officerPayloads(terminal);
+  const thisCourt = thisCourtOfficerPayloads(terminal);
   if (outcome === undefined) {
     const detail = summoned.stderr ?? "";
+    const failurePayloads = officerFailurePayloads(terminal);
     return {
       status: "transport_failure",
       stage: officer,
       reason: detail.length > 0
         ? `${gateSeatLabel(officer)} public summon exit ${summoned.exitCode}: ${detail}`
         : `${gateSeatLabel(officer)} public summon produced no terminal (exit ${summoned.exitCode})`,
-      submission: recorded.length > 0 ? recorded : summoned,
+      submission: failurePayloads.length > 0 ? failurePayloads : summoned,
     };
   }
   if (outcome.kind === "no_receipt") {
@@ -263,30 +277,33 @@ function projectOfficerTerminal(
     };
   }
   if (outcome.kind === "failure") {
+    const failurePayloads = officerFailurePayloads(terminal);
     return {
       status: "transport_failure",
       stage: officer,
       reason: outcome.diagnostic,
-      submission: recorded.length > 0 ? recorded : outcome.decisiveFacts,
+      submission: failurePayloads.length > 0 ? failurePayloads : outcome.decisiveFacts,
     };
   }
   if (outcome.kind === "audit_escalation") {
     return {
       status: "escalate",
       officer,
-      receipt: recorded.length === 1 ? recorded[0] : recorded,
+      // This-court receipt only (#879) — historical rows remain on terminal.submissions.
+      receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
     };
   }
   if (outcome.kind === "accepted") {
     // outcome.status is the fixture/compat leaf: production settlement leaves
     // it undefined once payloads are recorded, so this only matters when a
     // caller still supplies status without any recorded payload (#836 hang).
-    return projectOfficerPayloads(officer, recorded, outcome.status);
+    return projectOfficerPayloads(officer, thisCourt, outcome.status);
   }
   return {
     status: "needs_reask",
     officer,
-    receipt: recorded.length > 0 ? recorded : retainedReceipt(outcome),
+    // This-court receipt only (#879).
+    receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
   };
 }
 
@@ -324,13 +341,13 @@ export async function projectGatekeeperRun(
       },
     };
   }
-  // #836: officers receive the whole parent run directory pointer and find the
-  // submission themselves — code no longer picks latest toolCall leaf (A7.1–A7.3).
+  // #879: binding pointer = parent run directory; dialogue content = this-turn
+  // typed payload passed explicitly (never latest-toolCall recovery, A7.1–A7.3).
   let summoned: PublicSummonResult;
   try {
     const summon =
       options.summonOfficer
-      ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask) => {
+      ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask, nextSubmission) => {
         const { summonGateOfficer } = await import("./public-role-summons.ts");
         return summonGateOfficer({
           officer: nextOfficer,
@@ -338,6 +355,7 @@ export async function projectGatekeeperRun(
           cwd: options.context.cwd ?? process.cwd(),
           ...(officerSignal === undefined ? {} : { signal: officerSignal }),
           ...(reask === undefined ? {} : { reask }),
+          ...(nextSubmission === undefined ? {} : { submission: nextSubmission }),
           ...(options.home === undefined ? {} : { home: options.home }),
           ...(options.packageRoot === undefined ? {} : { packageRoot: options.packageRoot }),
           ...(options.roleTurnHost === undefined ? {} : { roleTurnHost: options.roleTurnHost }),
@@ -349,6 +367,7 @@ export async function projectGatekeeperRun(
       runDirectory,
       options.signal,
       options.reask,
+      options.submission,
     );
   } catch (error) {
     return {