@akagilnc/pi-workflow-roles 0.1.4035 → 0.1.4193

package/dist/archivist-record-entry.js

@@ -1,18 +1,35 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  readSync,
+  realpathSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
 import { dirname, resolve, join } from "node:path";
+import { StringDecoder } from "node:string_decoder";
 import { SessionManager } from "@earendil-works/pi-coding-agent";
-import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
 import {
   ActivationLedgerError,
-  activationBookDirectory,
   ensureRealDirectoryTree,
+  errnoCode,
   errorText,
   pathContainedIn,
   physicallyContainedIn,
   resolveActivationLedgerHomeForPath
 } from "./activation-ledger-topology.js";
-import { subjectKeyedRecordDirectory } from "./archivist-record-topology.js";
-import { subjectKeyedRecordDirectory as subjectKeyedRecordDirectory2 } from "./archivist-record-topology.js";
+import {
+  NAVIGATOR_RECORD_KIND,
+  resolveNavigatorWorkSubjectPlacement
+} from "./archivist-record-topology.js";
+import {
+  NAVIGATOR_RECORD_KIND as NAVIGATOR_RECORD_KIND2,
+  resolveNavigatorWorkSubjectPlacement as resolveNavigatorWorkSubjectPlacement2
+} from "./archivist-record-topology.js";
 const CURRENT_SESSION_LEDGER = "current-session.json";
 function readCurrentSession(sessionDir) {
   const ledger = join(sessionDir, CURRENT_SESSION_LEDGER);
@@ -41,6 +58,151 @@ function writeCurrentSession(sessionDir, sessionFile) {
     );
   }
 }
+function isCurrentSessionClaimRace(error) {
+  if (!(error instanceof ActivationLedgerError)) return errnoCode(error) === "EEXIST";
+  return errnoCode(error.cause) === "EEXIST";
+}
+function currentSessionLedgerPath(sessionDir) {
+  return join(sessionDir, CURRENT_SESSION_LEDGER);
+}
+const SESSION_HEADER_CHUNK_BYTES = 4096;
+const MAX_SESSION_HEADER_SCAN_BYTES = 1024 * 1024;
+function readBoundedSessionHeader(filePath) {
+  const fd = openSync(filePath, "r");
+  try {
+    const buffer = Buffer.allocUnsafe(SESSION_HEADER_CHUNK_BYTES);
+    const decoder = new StringDecoder("utf8");
+    let pending = "";
+    let scanned = 0;
+    const consume = (chunk) => {
+      pending += chunk;
+      let lineStart = 0;
+      let newlineIndex = pending.indexOf("\n", lineStart);
+      while (newlineIndex !== -1) {
+        const line = pending.slice(lineStart, newlineIndex);
+        lineStart = newlineIndex + 1;
+        newlineIndex = pending.indexOf("\n", lineStart);
+        if (line.trim() === "") continue;
+        pending = pending.slice(lineStart);
+        const header = parseSessionHeaderLine(line);
+        return header === void 0 ? { kind: "rejected" } : { kind: "accepted", header };
+      }
+      pending = pending.slice(lineStart);
+      return { kind: "incomplete" };
+    };
+    const finishPending = (tail) => {
+      const result = consume(tail);
+      if (result.kind === "accepted") return result.header;
+      if (result.kind === "rejected") return void 0;
+      if (pending.trim() === "") return void 0;
+      const header = parseSessionHeaderLine(pending);
+      pending = "";
+      return header;
+    };
+    while (scanned < MAX_SESSION_HEADER_SCAN_BYTES) {
+      const toRead = Math.min(buffer.length, MAX_SESSION_HEADER_SCAN_BYTES - scanned);
+      const bytesRead = readSync(fd, buffer, 0, toRead, null);
+      if (bytesRead === 0) {
+        return finishPending(decoder.end());
+      }
+      scanned += bytesRead;
+      const found = consume(decoder.write(buffer.subarray(0, bytesRead)));
+      if (found.kind === "accepted") return found.header;
+      if (found.kind === "rejected") return void 0;
+    }
+    const probe = Buffer.allocUnsafe(1);
+    if (readSync(fd, probe, 0, 1, null) === 0) {
+      return finishPending(decoder.end());
+    }
+    return void 0;
+  } finally {
+    closeSync(fd);
+  }
+}
+function parseSessionHeaderLine(line) {
+  if (line.trim() === "") return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || parsed.type !== "session" || typeof parsed.id !== "string" || parsed.id.length === 0) {
+    return void 0;
+  }
+  const cwd = parsed.cwd;
+  return {
+    type: "session",
+    id: parsed.id,
+    ...typeof cwd === "string" ? { cwd } : {}
+  };
+}
+function mostRecentNavigatorSessionFile(sessionDir, cwd) {
+  const absoluteSessionDir = resolve(sessionDir);
+  const absoluteCwd = resolve(cwd);
+  let names;
+  try {
+    names = readdirSync(absoluteSessionDir);
+  } catch (error) {
+    throw new ActivationLedgerError(
+      `archivist navigator nest is not readable (${sessionDir}): ${errorText(error)}`,
+      { cause: error }
+    );
+  }
+  const matched = [];
+  for (const name of names) {
+    if (!name.endsWith(".jsonl")) continue;
+    const filePath = join(absoluteSessionDir, name);
+    let st;
+    try {
+      st = statSync(filePath);
+    } catch (error) {
+      throw new ActivationLedgerError(
+        `archivist navigator session file is not stat-able (${filePath}): ${errorText(error)}`,
+        { cause: error }
+      );
+    }
+    if (!st.isFile()) continue;
+    let header;
+    try {
+      header = readBoundedSessionHeader(filePath);
+    } catch (error) {
+      throw new ActivationLedgerError(
+        `archivist navigator session header is not readable (${filePath}): ${errorText(error)}`,
+        { cause: error }
+      );
+    }
+    if (header === void 0) continue;
+    if (typeof header.cwd !== "string" || header.cwd.length === 0) continue;
+    if (resolve(header.cwd) !== absoluteCwd) continue;
+    matched.push({ path: filePath, mtimeMs: st.mtimeMs });
+  }
+  if (matched.length === 0) return void 0;
+  matched.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return matched[0].path;
+}
+function resolveNavigatorNestContinuation(sessionDir, cwd) {
+  const ledgerPath = currentSessionLedgerPath(sessionDir);
+  if (existsSync(ledgerPath)) {
+    const recentFile = readCurrentSession(sessionDir);
+    assertRecentFinalFileUnderSessionDir(sessionDir, recentFile);
+    return recentFile;
+  }
+  const adopted = mostRecentNavigatorSessionFile(sessionDir, cwd);
+  if (adopted === void 0) return void 0;
+  assertRecentFinalFileUnderSessionDir(sessionDir, adopted);
+  try {
+    writeCurrentSession(sessionDir, adopted);
+    return adopted;
+  } catch (error) {
+    if (isCurrentSessionClaimRace(error)) {
+      const recentFile = readCurrentSession(sessionDir);
+      assertRecentFinalFileUnderSessionDir(sessionDir, recentFile);
+      return recentFile;
+    }
+    throw error;
+  }
+}
 const WORKER_SUBMISSION_GATE_KIND = "worker-submission-gate";
 function assertRecentFinalFileUnderSessionDir(sessionDir, recentFile) {
   const absoluteSessionDir = resolve(sessionDir);
@@ -77,34 +239,55 @@ function assertRecentFinalFileUnderSessionDir(sessionDir, recentFile) {
 function createRecordSessionOpen(options) {
   const cwd = options.cwd;
   const parentFile = options.parent?.getSessionFile();
-  const ledgerHome = resolveActivationLedgerHomeForPath(parentFile);
   let sessionDir;
   let parentSession;
-  if (options.subject !== void 0) {
-    sessionDir = subjectKeyedRecordDirectory({
+  let mayResumeSameNest;
+  let ledgerHome;
+  if (options.kind === NAVIGATOR_RECORD_KIND && options.subject !== void 0) {
+    const placement = resolveNavigatorWorkSubjectPlacement({
       cwd,
-      kind: options.kind,
       subject: options.subject,
-      ...parentFile === void 0 || parentFile.length === 0 ? {} : { parentSessionFile: parentFile }
+      ...parentFile === void 0 || parentFile.length === 0 ? {} : { parentSessionFile: parentFile },
+      ...options.home === void 0 ? {} : { home: options.home }
     });
+    sessionDir = placement.sessionDir;
+    ledgerHome = placement.ledgerHome;
     parentSession = parentFile && parentFile.length > 0 ? parentFile : void 0;
+    mayResumeSameNest = true;
   } else if (parentFile === void 0 || parentFile.length === 0) {
-    return { session: SessionManager.inMemory(cwd), resumed: false };
+    if (options.subject === void 0) {
+      return { session: SessionManager.inMemory(cwd), resumed: false };
+    }
+    throw new Error("Durable record ownership requires a parent session inside the ledger home");
   } else {
+    ledgerHome = resolveActivationLedgerHomeForPath(parentFile);
     const parentResolved = resolve(parentFile);
-    sessionDir = physicallyContainedIn(ledgerHome, parentResolved) ? join(dirname(parentResolved), options.kind) : join(activationBookDirectory(ledgerHome, resolveBookKeyFromGit(cwd)), options.kind);
+    if (!physicallyContainedIn(ledgerHome, parentResolved)) {
+      throw new Error("Durable record ownership requires a parent session inside the ledger home");
+    }
+    sessionDir = join(dirname(parentResolved), options.kind);
     parentSession = parentFile;
+    mayResumeSameNest = options.kind === WORKER_SUBMISSION_GATE_KIND;
   }
   const nestAlreadyExists = existsSync(sessionDir);
   ensureRealDirectoryTree(ledgerHome, sessionDir);
-  const mayResumeSameNest = options.subject !== void 0 || options.kind === WORKER_SUBMISSION_GATE_KIND;
   if (mayResumeSameNest && nestAlreadyExists) {
-    const recentFile = readCurrentSession(sessionDir);
-    assertRecentFinalFileUnderSessionDir(sessionDir, recentFile);
-    return {
-      session: SessionManager.open(recentFile, sessionDir, cwd),
-      resumed: true
-    };
+    if (options.kind === NAVIGATOR_RECORD_KIND) {
+      const recentFile = resolveNavigatorNestContinuation(sessionDir, cwd);
+      if (recentFile !== void 0) {
+        return {
+          session: SessionManager.open(recentFile, sessionDir, cwd),
+          resumed: true
+        };
+      }
+    } else {
+      const recentFile = readCurrentSession(sessionDir);
+      assertRecentFinalFileUnderSessionDir(sessionDir, recentFile);
+      return {
+        session: SessionManager.open(recentFile, sessionDir, cwd),
+        resumed: true
+      };
+    }
   }
   const session = SessionManager.create(
     cwd,
@@ -151,9 +334,10 @@ function bookDirectOfficerRunPointer(options) {
 }
 export {
   DIRECT_OFFICER_RUN_POINTER_KIND,
+  NAVIGATOR_RECORD_KIND2 as NAVIGATOR_RECORD_KIND,
   WORKER_SUBMISSION_GATE_KIND,
   bookDirectOfficerRunPointer,
   createRecordSession,
   createRecordSessionOpen,
-  subjectKeyedRecordDirectory2 as subjectKeyedRecordDirectory
+  resolveNavigatorWorkSubjectPlacement2 as resolveNavigatorWorkSubjectPlacement
 };

package/dist/archivist-record-topology.js

@@ -1,20 +1,40 @@
+/**
+ * Pure archivist record placement topology (ADR 0048 / 0065 / dossier-topology).
+ * No SessionManager / pi-coding-agent — cold public-bin and ledger discovery
+ * may import this without pulling open-session runtime into the graph.
+ *
+ * Navigator work-subject is the sole book-top subject partition (#852):
+ * books/<book>/navigator/<work-subject-digest>/. Callers must not re-hash
+ * subject or re-join book/navigator/digest themselves.
+ */
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
-import {
-  activationBookDirectory,
-  resolveActivationLedgerHome,
-  resolveActivationLedgerHomeForPath
-} from "./activation-ledger-topology.js";
-function subjectKeyedRecordDirectory(input) {
-  const ledgerHome = input.parentSessionFile !== void 0 && input.parentSessionFile.length > 0 ? resolveActivationLedgerHomeForPath(input.parentSessionFile) : resolveActivationLedgerHome(input.home);
-  const digest = createHash("sha256").update(input.subject).digest("hex").slice(0, 32);
-  return join(
-    activationBookDirectory(ledgerHome, resolveBookKeyFromGit(input.cwd)),
-    input.kind,
-    digest
-  );
+import { activationBookDirectory, resolveActivationLedgerHome, tryHomeFromAkRolesPath, } from "./activation-ledger-topology.js";
+/** Book-top partition for cross-ticket navigator route-memory (dossier-topology). */
+export const NAVIGATOR_RECORD_KIND = "navigator";
+/**
+ * Sole navigator work-subject placement under the ledger book.
+ * Returns ledgerHome and nest once so createRecordSessionOpen does not re-branch
+ * parent/home. Work-subject key shape is sha256(subject) hex truncated to 32
+ * (#852 out of scope — shape unchanged).
+ *
+ * parentSessionFile contributes home only when tryHomeFromAkRolesPath succeeds;
+ * otherwise the explicit home (from HostContext.runDirectory) is kept. Never
+ * invents a second home via passwd/env fallback from a foreign parent path.
+ */
+export function resolveNavigatorWorkSubjectPlacement(input) {
+    let ledgerHome;
+    if (input.parentSessionFile !== undefined && input.parentSessionFile.length > 0) {
+        const fromParent = tryHomeFromAkRolesPath(input.parentSessionFile);
+        if (fromParent !== undefined && fromParent.length > 0) {
+            ledgerHome = resolveActivationLedgerHome(fromParent);
+        }
+    }
+    ledgerHome ??= resolveActivationLedgerHome(input.home);
+    const digest = createHash("sha256").update(input.subject).digest("hex").slice(0, 32);
+    return {
+        ledgerHome,
+        sessionDir: join(activationBookDirectory(ledgerHome, resolveBookKeyFromGit(input.cwd)), NAVIGATOR_RECORD_KIND, digest),
+    };
 }
-export {
-  subjectKeyedRecordDirectory
-};

package/dist/auditor-dossier-tool.js

@@ -1,4 +1,5 @@
 import { dirname, join, resolve } from "node:path";
+import { roleRunArtifactsDirectory } from "./role-run-placement.js";
 import { Type } from "typebox";
 const AUDITOR_DOSSIER_TOOL_NAME = "ak_get_run_dossier";
 function auditorRunDirectory(context) {
@@ -25,7 +26,7 @@ function createAuditorDossierTool(runDirectory) {
         admittedRequest: join(runDirectory, "admitted-request.json"),
         parentSessionCandidate: join(runDirectory, "session", "session.jsonl"),
         attachments: join(runDirectory, "attachments"),
-        artifacts: join(runDirectory, "artifacts")
+        artifacts: roleRunArtifactsDirectory(runDirectory)
       };
       return {
         content: [{ type: "text", text: JSON.stringify(details) }],

package/dist/diarist-contracts.js

@@ -7,8 +7,104 @@
  * #779: no frozen candidate catalog; LLM finds sources and submits whole blocks.
  * Mechanical layer does not judge LLM output (no quote/ticket/relevance verify).
  */
+import { isSafePositiveTicketNumber, requireSafePositiveTicketNumber, } from "./run-ticket-number.js";
 export const DIARIST_OUTPUT_TOOL_NAME = "ak_diarist_output";
 export const DIARIST_ACCEPTED_TEXT = "起居郎回执已接受";
+/**
+ * Sole shape projection for a typed co-review ticket set (#871).
+ * Positive safe integers, first-seen order, duplicates dropped. Not content judgment.
+ * Returns null when `raw` is not an array (callers classify absent vs durable damage).
+ * Returns a possibly empty list when `raw` is an array (unlawful members skipped).
+ * When `principalTicket` is set, that ticket is guaranteed as a member (prepended if missing).
+ */
+export function projectCourtTicketNumbers(raw, options) {
+    if (!Array.isArray(raw))
+        return null;
+    const out = [];
+    const seen = new Set();
+    for (const item of raw) {
+        if (!isSafePositiveTicketNumber(item))
+            continue;
+        if (seen.has(item))
+            continue;
+        seen.add(item);
+        out.push(item);
+    }
+    const principal = options?.principalTicket;
+    if (principal === undefined)
+        return out;
+    requireSafePositiveTicketNumber(principal, "projectCourtTicketNumbers principalTicket");
+    if (seen.has(principal))
+        return out;
+    return [principal, ...out];
+}
+/**
+ * Durable-field interpreter for #871 co-review sets.
+ * Absent key (old-format run) is not damage. Present but empty / non-array /
+ * partially unlawful / missing principal is damage — callers must fail closed,
+ * never wash into main-only.
+ */
+export function interpretDurableCourtTicketNumbers(record, options) {
+    if (!Object.hasOwn(record, "courtTicketNumbers")) {
+        return { kind: "absent" };
+    }
+    const raw = record.courtTicketNumbers;
+    if (!Array.isArray(raw)) {
+        return {
+            kind: "damage",
+            reason: "courtTicketNumbers is present but not an array",
+        };
+    }
+    if (raw.length === 0) {
+        return {
+            kind: "damage",
+            reason: "courtTicketNumbers is present but empty",
+        };
+    }
+    for (let i = 0; i < raw.length; i += 1) {
+        const item = raw[i];
+        if (!isSafePositiveTicketNumber(item)) {
+            return {
+                kind: "damage",
+                reason: `courtTicketNumbers[${i}] is not a safe positive integer`,
+            };
+        }
+    }
+    // Members are all lawful numbers; sole projection owns dedupe/order.
+    const tickets = projectCourtTicketNumbers(raw);
+    if (tickets === null || tickets.length === 0) {
+        return {
+            kind: "damage",
+            reason: "courtTicketNumbers projected empty after lawful members",
+        };
+    }
+    const principal = options?.principalTicket;
+    if (principal !== undefined) {
+        if (!isSafePositiveTicketNumber(principal)) {
+            return {
+                kind: "damage",
+                reason: "courtTicketNumbers principal ticket is not a safe positive integer",
+            };
+        }
+        if (!tickets.includes(principal)) {
+            return {
+                kind: "damage",
+                reason: `courtTicketNumbers is missing principal ticket #${principal}`,
+            };
+        }
+    }
+    return { kind: "ok", tickets: Object.freeze([...tickets]) };
+}
+/** True when two durable #871 sets are byte-identical sequences. */
+export function sameCourtTicketNumbers(left, right) {
+    if (left.length !== right.length)
+        return false;
+    for (let i = 0; i < left.length; i += 1) {
+        if (left[i] !== right[i])
+            return false;
+    }
+    return true;
+}
 export function validateRecordedDiaristOutput(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new Error("Diarist output has no execution discriminator");

package/dist/doctor-auditor.js

@@ -8,7 +8,7 @@ export const DOCTOR_AUDIT_TOOL_NAME = "ak_doctor_audit_decision";
  */
 export function createPiDoctorAuditor() {
     return async (options) => {
-        const dossier = resolveAuditDossier();
+        const dossier = resolveAuditDossier(options.context);
         requireAuditMaterials(dossier);
         const subjects = readDoctorAuditSubjects(options.context);
         requireAuditMaterials(subjects);

package/dist/doctor-evidence.js

@@ -108,9 +108,10 @@ function deriveSession(content, id) {
 /** Read Pi's retained session directory as the sole raw material for one case. */
 export async function loadDoctorCase(runsPath) {
     const root = await realpath(runsPath);
-    const match = root.split(sep).join("/").match(/\/\.ak-roles\/books\/[^/]+\/issues\/([1-9]\d*)\/runs$/);
+    // Canonical <book>/<ticket>/runs; legacy issues/<n>/runs remains read-only compatible.
+    const match = root.split(sep).join("/").match(/\/\.ak-roles\/books\/[^/]+\/(?:issues\/)?([1-9]\d*)\/runs$/);
     if (!match)
-        throw new Error("Doctor case must be an .ak-roles/books/<book>/issues/<n>/runs directory");
+        throw new Error("Doctor case must be an .ak-roles/books/<book>/<n>/runs directory");
     const evidence = [], sessions = [], statuses = [], commits = [];
     const turns = { count: 0, sources: [] }, calls = { count: 0, sources: [] }, tokens = { count: 0, sources: [] };
     for (const path of await discoverCaseFiles(root)) {

package/dist/dossier-resolution.js

@@ -1,23 +1,36 @@
 /**
  * Unique dossier-resolution seam for 审刑院 (#233).
- * Machine pointers only: cwd + AK_ROLE_RUN_DIR. No latest-run / mtime / global scan.
+ * Machine pointers only: cwd + per-turn HostContext (Pi child env fallback).
+ * No latest-run / mtime / global scan.
  */
 import { existsSync, statSync } from "node:fs";
 import { resolve } from "node:path";
+import { runDirectoryFromHostContext } from "./host-contracts.js";
 export const AUDIT_RUN_DIR_ENV = "AK_ROLE_RUN_DIR";
 export const DOCTOR_CANDIDATE_ENTRY_TYPE = "ak_doctor_audit_candidate";
+function isHostContext(value) {
+    return "sessionManager" in value;
+}
+function dossierPointerFrom(source) {
+    if (source !== undefined && isHostContext(source)) {
+        return runDirectoryFromHostContext(source);
+    }
+    const env = source ?? process.env;
+    const raw = env[AUDIT_RUN_DIR_ENV];
+    return typeof raw === "string" && raw.trim() !== "" ? raw : undefined;
+}
 /**
- * Resolve the per-run dossier pointer injected by the public CLI.
+ * Resolve the per-run dossier pointer.
  *
+ * ACP/headless: typed HostContext.runDirectory.
+ * Pi child: HostContext projected from env, or env fallback when no context.
  * Absent pointer = bare Pi internal seam (ADR 0052): audit proceeds; the model
- * self-locates the dossier from its own fall-volume position per soul. Public CLI
- * always injects the pointer — only then does the machine validate the path.
- * Concurrent runs stay isolated because a present pointer is per-process.
+ * self-locates the dossier from its own fall-volume position per soul.
  */
-export function resolveAuditDossier(env = process.env) {
-    const raw = env[AUDIT_RUN_DIR_ENV];
+export function resolveAuditDossier(source) {
+    const raw = dossierPointerFrom(source);
     // Bare Pi activation seam: no machine gate when the pointer was never injected.
-    if (typeof raw !== "string" || raw.trim() === "") {
+    if (raw === undefined) {
         return { status: "ok" };
     }
     const runDirectory = resolve(raw);

package/dist/gatekeeper-role.js

@@ -84,15 +84,26 @@ function projectOfficerDecision(officer, decision, fallbackStatus) {
     return { status: "needs_reask", officer, receipt };
 }
 /**
- * Project a public-role terminal onto the gate queue surface.
- * Host failure stays failure; recorded officer payloads ride beside it (#836 A.3).
- * Multiple recorded payloads are all kept — code does not pick last-wins.
+ * This-court officer payloads for the parent return path (#879).
+ * Only settlement-scoped roleOutcome.payloads (courtAttempt seal) carry this-court
+ * identity. Never guess from undivided submissions — sole row included — history
+ * stays on terminal.submissions (#836 presentation).
  */
-function officerPayloads(terminal) {
+function thisCourtOfficerPayloads(terminal) {
     const outcome = terminal?.roleOutcome;
     if (outcome !== undefined && (outcome.kind === "accepted" || outcome.kind === "audit_escalation")) {
-        return outcome.payloads ?? terminal?.submissions ?? [];
+        if (outcome.payloads !== undefined && outcome.payloads.length > 0)
+            return outcome.payloads;
+    }
+    if (outcome?.kind === "failure" && outcome.payloads !== undefined && outcome.payloads.length > 0) {
+        return outcome.payloads;
     }
+    // No sole-row identity guess: undivided submissions are not this-court (#879).
+    return [];
+}
+/** Failure/transport channel may still surface every recorded payload beside the failure (#836 A.3). */
+function officerFailurePayloads(terminal) {
+    const outcome = terminal?.roleOutcome;
     if (outcome?.kind === "failure")
         return outcome.payloads ?? terminal?.submissions ?? [];
     return terminal?.submissions ?? [];
@@ -101,32 +112,24 @@ function projectOfficerPayloads(officer, payloads, fallbackStatus) {
     if (payloads.length === 0) {
         return projectOfficerDecision(officer, undefined, fallbackStatus);
     }
-    // Present every recorded payload; queue only the latest conclusion so a reask
-    // can converge (#836 呈现 ≠ 排队).
-    const queued = projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
-    if (payloads.length === 1)
-        return queued;
-    if (queued.status === "pass"
-        || queued.status === "bounce"
-        || queued.status === "escalate"
-        || queued.status === "needs_reask") {
-        return { ...queued, receipt: payloads };
-    }
-    return queued;
+    // This-court multi-submit: queue the latest seal of THIS court only (#836 呈现≠排队).
+    // Single this-court seal is the common path. Never fold history into an array receipt.
+    return projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
 }
 function projectOfficerTerminal(officer, summoned) {
     const terminal = summoned.terminal;
     const outcome = terminal?.roleOutcome;
-    const recorded = officerPayloads(terminal);
+    const thisCourt = thisCourtOfficerPayloads(terminal);
     if (outcome === undefined) {
         const detail = summoned.stderr ?? "";
+        const failurePayloads = officerFailurePayloads(terminal);
         return {
             status: "transport_failure",
             stage: officer,
             reason: detail.length > 0
                 ? `${gateSeatLabel(officer)} public summon exit ${summoned.exitCode}: ${detail}`
                 : `${gateSeatLabel(officer)} public summon produced no terminal (exit ${summoned.exitCode})`,
-            submission: recorded.length > 0 ? recorded : summoned,
+            submission: failurePayloads.length > 0 ? failurePayloads : summoned,
         };
     }
     if (outcome.kind === "no_receipt") {
@@ -140,30 +143,33 @@ function projectOfficerTerminal(officer, summoned) {
         };
     }
     if (outcome.kind === "failure") {
+        const failurePayloads = officerFailurePayloads(terminal);
         return {
             status: "transport_failure",
             stage: officer,
             reason: outcome.diagnostic,
-            submission: recorded.length > 0 ? recorded : outcome.decisiveFacts,
+            submission: failurePayloads.length > 0 ? failurePayloads : outcome.decisiveFacts,
         };
     }
     if (outcome.kind === "audit_escalation") {
         return {
             status: "escalate",
             officer,
-            receipt: recorded.length === 1 ? recorded[0] : recorded,
+            // This-court receipt only (#879) — historical rows remain on terminal.submissions.
+            receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
         };
     }
     if (outcome.kind === "accepted") {
         // outcome.status is the fixture/compat leaf: production settlement leaves
         // it undefined once payloads are recorded, so this only matters when a
         // caller still supplies status without any recorded payload (#836 hang).
-        return projectOfficerPayloads(officer, recorded, outcome.status);
+        return projectOfficerPayloads(officer, thisCourt, outcome.status);
     }
     return {
         status: "needs_reask",
         officer,
-        receipt: recorded.length > 0 ? recorded : retainedReceipt(outcome),
+        // This-court receipt only (#879).
+        receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
     };
 }
 /**
@@ -188,12 +194,12 @@ export async function projectGatekeeperRun(options) {
             },
         };
     }
-    // #836: officers receive the whole parent run directory pointer and find the
-    // submission themselves — code no longer picks latest toolCall leaf (A7.1–A7.3).
+    // #879: binding pointer = parent run directory; dialogue content = this-turn
+    // typed payload passed explicitly (never latest-toolCall recovery, A7.1–A7.3).
     let summoned;
     try {
         const summon = options.summonOfficer
-            ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask) => {
+            ?? (async (nextOfficer, sourceRunDirectory, officerSignal, reask, nextSubmission) => {
                 const { summonGateOfficer } = await import("./public-role-summons.js");
                 return summonGateOfficer({
                     officer: nextOfficer,
@@ -201,13 +207,14 @@ export async function projectGatekeeperRun(options) {
                     cwd: options.context.cwd ?? process.cwd(),
                     ...(officerSignal === undefined ? {} : { signal: officerSignal }),
                     ...(reask === undefined ? {} : { reask }),
+                    ...(nextSubmission === undefined ? {} : { submission: nextSubmission }),
                     ...(options.home === undefined ? {} : { home: options.home }),
                     ...(options.packageRoot === undefined ? {} : { packageRoot: options.packageRoot }),
                     ...(options.roleTurnHost === undefined ? {} : { roleTurnHost: options.roleTurnHost }),
                     ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
                 });
             });
-        summoned = await summon(officer, runDirectory, options.signal, options.reask);
+        summoned = await summon(officer, runDirectory, options.signal, options.reask, options.submission);
     }
     catch (error) {
         return {