@akagilnc/pi-workflow-roles 0.1.4321 → 0.1.4387

package/dist/public-cli/option-definitions.js

@@ -355,6 +355,10 @@ const DIARIST_OPTIONS = [
     bindOwner("diarist", SHARED_PROJECT_SEMANTICS),
     bindOwner("diarist", SHARED_ATTACH_SEMANTICS),
 ];
+const SECRETARIAT_OPTIONS = [
+    bindOwner("secretariat", SHARED_PROJECT_SEMANTICS),
+    bindOwner("secretariat", SHARED_ATTACH_SEMANTICS),
+];
 const CODER_OPTIONS = [
     {
         id: "phase",
@@ -721,6 +725,7 @@ export const PUBLIC_OPTION_TABLE = {
     navigator: NAVIGATOR_OPTIONS,
     auditor: AUDITOR_OPTIONS,
     diarist: DIARIST_OPTIONS,
+    secretariat: SECRETARIAT_OPTIONS,
     analyst: ANALYST_OPTIONS,
 };
 /** Role/deterministic owners that appear on PUBLIC_ROLE_ARGV. */
@@ -740,6 +745,7 @@ export const PUBLIC_ROLE_OPTION_OWNERS = [
     "navigator",
     "auditor",
     "diarist",
+    "secretariat",
     "analyst",
 ];
 export function optionsForOwner(owner) {
@@ -1051,6 +1057,14 @@ const ROLE_COMMAND_HELP = {
             'ak-role diarist --attach ./design.md "补录本轮设计修订。"',
         ],
     },
+    secretariat: {
+        command: "secretariat",
+        summary: "Secretariat (中书省): rewrite ticket per 票面法 and drive countersign to converged or escalate.",
+        usage: ["ak-role secretariat [options] [instruction]"],
+        examples: [
+            'ak-role secretariat "整理 #924 票面并送庭。"',
+        ],
+    },
     notary: {
         command: "notary",
         summary: "Direct Notary document check (quote fidelity + ticket alignment); zero prompt/attachment.",

package/dist/public-cli/post-admission.js

@@ -10,12 +10,13 @@ import { writeFile } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
 import { buildResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
 import { CliUsageError } from "./cli-errors.js";
-import { buildInstructionTransportPrompt, freezeAttachmentsIntoRun, } from "./invocation.js";
+import { bindAdmittedTicketNumber, buildInstructionTransportPrompt, freezeAttachmentsIntoRun, } from "./invocation.js";
+import { readRecordedSubmissionRows } from "../submission-ledger.js";
 import { pathContainedIn } from "../activation-ledger-topology.js";
 import { pickEngineAxis } from "../package-resources/engine-material.js";
 import { resolveHostAwareSessionAvailability } from "../session-identity.js";
 import { isOfficerReviewSeat } from "../host-contracts.js";
-import { deliverCaseDossierAsAttachment, projectCaseDossierPointerSection, } from "./case-dossier-delivery.js";
+import { deliverCaseDossierAsAttachment } from "./case-dossier-delivery.js";
 /** Original error bytes, never relabeled — a secondary fact riding beside a classified cause. */
 function describeCaughtError(error) {
     if (error instanceof Error) {
@@ -24,13 +25,6 @@ function describeCaughtError(error) {
     }
     return { message: String(error) };
 }
-/** Append one system section to a continuation prompt, keeping its kind. */
-function appendContinuationSection(continuation, section) {
-    const prompt = `${continuation.prompt}\n\n${section}`;
-    return continuation.kind === "initial"
-        ? { kind: "initial", prompt }
-        : { kind: "resume", prompt };
-}
 /**
  * Nested gate summons (station child) on an officer seat: dialogue content is
  * peer words only (#879). ADR 0081 case dossier still hangs via the existing
@@ -262,11 +256,32 @@ export async function dispatchPostAdmissionTurn(input) {
      */
     let afterDispatchApplied = false;
     const finishAfterTurn = async (result) => {
-        if (adapters.afterDispatch === undefined || afterDispatchApplied)
+        if (afterDispatchApplied)
             return result;
         afterDispatchApplied = true;
         try {
-            await adapters.afterDispatch(admitted, lease);
+            // #858: an unbound seat may assert its ticket on the existing receipt.
+            // Read the original accepted payload; do not rewrite it, infer from prose,
+            // or reject missing/malformed declarations. An existing binding wins.
+            if (admitted.ticketNumber === undefined) {
+                const rows = await readRecordedSubmissionRows(admitted.projectRoot, admitted.runId, { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join(admitted.runDirectory, "session", "session.jsonl") });
+                const asserted = rows
+                    .filter((row) => row.kind === "accepted" && row.role === admitted.role)
+                    .map((row) => row.accepted)
+                    .find((payload) => {
+                    if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+                        return false;
+                    const value = payload.ticketNumber;
+                    return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+                });
+                const ticketNumber = asserted === undefined
+                    ? undefined
+                    : asserted.ticketNumber;
+                if (ticketNumber !== undefined)
+                    await bindAdmittedTicketNumber(admitted, ticketNumber);
+            }
+            if (adapters.afterDispatch !== undefined)
+                await adapters.afterDispatch(admitted, lease);
             return result;
         }
         catch (error) {
@@ -362,10 +377,11 @@ export async function dispatchPostAdmissionTurn(input) {
         }
         // Turn request is assembled after beforeDispatch so this turn sees whatever it
         // settled — the seat's ticket bind re-projection and any court diarist station
-        // writes (#742). Case dossier delivery (ADR 0081 / #709) rides here once for
-        // every public entry. #879: station-child officer dialogue keeps peer body
-        // intact — 起居录 hangs via existing attachments freeze (not prompt wrap,
-        // not RoleTurnRequest.materials). Other entries keep the neutral prompt section.
+        // writes (#742). Case dossier delivery (ADR 0081 / #709 / #858) rides here once
+        // for every public entry on the existing attachments → readingMaterial face
+        // (station-child and ordinary share one seam). Dialogue continuation stays
+        // caller/peer opaque — never splice system path sections into user dialogue.
+        // No package-resume parallel face or typed resume identity.
         let turnRequest = env.signal === undefined ? request : { ...request, signal: env.signal };
         if (env.stationChild !== undefined) {
             turnRequest = { ...turnRequest, stationChild: env.stationChild };
@@ -378,32 +394,16 @@ export async function dispatchPostAdmissionTurn(input) {
         if (typeof liveHost === "string" && liveHost.trim() !== "") {
             turnRequest = { ...turnRequest, host: liveHost.trim() };
         }
-        if (isStationChildOfficerDialogue(admitted.role, env)) {
-            // 0081 non-body face: freeze pointer section under run/attachments/.
-            // Peer dialogue continuation.prompt stays parent payload only — the seat
-            // consumes the freeze via loadCaseDossierReadingMaterial → existing
-            // agent-start readingMaterial / systemPrompt.materials fold (not prompt splice,
-            // not RoleTurnRequest.materials).
-            await deliverCaseDossierAsAttachment({
-                ticketNumber: admitted.ticketNumber,
-                projectRoot: admitted.projectRoot,
-                home: env.home,
-                runDirectory: admitted.runDirectory,
-            });
-        }
-        else {
-            const dossierSection = await projectCaseDossierPointerSection({
-                ticketNumber: admitted.ticketNumber,
-                projectRoot: admitted.projectRoot,
-                home: env.home,
-            });
-            if (dossierSection !== undefined) {
-                turnRequest = {
-                    ...turnRequest,
-                    continuation: appendContinuationSection(turnRequest.continuation, dossierSection),
-                };
-            }
-        }
+        // 0081 non-dialogue face: freeze pointer section under run/attachments/.
+        // Seat consumes via loadCaseDossierReadingMaterial → existing agent-start
+        // readingMaterial / systemPrompt.materials fold. Caller instruction, empty
+        // request, and resume --message stay verbatim.
+        await deliverCaseDossierAsAttachment({
+            ticketNumber: admitted.ticketNumber,
+            projectRoot: admitted.projectRoot,
+            home: env.home,
+            runDirectory: admitted.runDirectory,
+        });
         // Authoritative host write happens here, at the real dispatch boundary —
         // immediately before the turn actually starts, after every retryable
         // pre-turn step above has succeeded on this attempt (#840 r9 判词 class 2).
@@ -784,9 +784,9 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
         ...(env.model === undefined ? {} : { model: env.model }),
         ...pickEngineAxis(env),
         ...(env.timeoutMs === undefined ? {} : { timeoutMs: env.timeoutMs }),
-        ...(admitted.correlationId === undefined && env.correlationId === undefined
+        ...(env.correlationId === undefined && admitted.correlationId === undefined
             ? {}
-            : { correlationId: admitted.correlationId ?? env.correlationId }),
+            : { correlationId: env.correlationId ?? admitted.correlationId }),
         continuation: {
             kind: "resume",
             prompt,
@@ -999,12 +999,7 @@ export async function runPostAdmissionSeatResume(input) {
                     dispatch: async (turnRequest) => {
                         const result = await dispatchPostAdmissionTurn({
                             admitted: loaded.admitted,
-                            env: {
-                                ...input.env,
-                                ...(loaded.admitted.correlationId === undefined
-                                    ? {}
-                                    : { correlationId: loaded.admitted.correlationId }),
-                            },
+                            env: input.env,
                             io: attemptIo,
                             request: turnRequest,
                             lease,

package/dist/public-cli/run-lifecycle.js

@@ -169,7 +169,8 @@ async function readRoleRunStateDisk(runDirectory) {
         record.role !== "gatekeeper" &&
         record.role !== "navigator" &&
         record.role !== "auditor" &&
-        record.role !== "diarist") {
+        record.role !== "diarist" &&
+        record.role !== "secretariat") {
         return undefined;
     }
     if (record.state !== "admitted" &&
@@ -1411,6 +1412,17 @@ export async function loadResumableDiaristRun(home, runId, authority) {
     };
     return seatLoadedResult(loaded, admitted);
 }
+export async function loadResumableSecretariatRun(home, runId, authority) {
+    const loaded = await loadResumableRunRecord(home, runId, authority);
+    if (loaded.run.role !== "secretariat") {
+        throw new CliUsageError(`role run ${runId} belongs to ${loaded.run.role}, not secretariat`);
+    }
+    const admitted = {
+        role: "secretariat",
+        ...resumedBaseAdmitted(loaded),
+    };
+    return seatLoadedResult(loaded, admitted);
+}
 /**
  * Load a resumable Merger run for resume. Derived envelope + internal input path
  * are restored from the admitted request (#114).

package/dist/public-cli/settlement.js

@@ -33,6 +33,7 @@ import { NOTARY_OUTPUT_TOOL_NAME, } from "../notary-contracts.js";
 import { COUNTERSIGN_OUTPUT_TOOL_NAME, } from "../countersign-contracts.js";
 import { GLEANER_LEFT_OUTPUT_TOOL_NAME, } from "../gleaner-left-contracts.js";
 import { DIARIST_OUTPUT_TOOL_NAME, } from "../diarist-contracts.js";
+import { SECRETARIAT_OUTPUT_TOOL_NAME, } from "../secretariat-contracts.js";
 import { INSPECTOR_OUTPUT_TOOL_NAME, } from "../inspector-contracts.js";
 import { GATEKEEPER_OUTPUT_TOOL_NAME, } from "../package-contracts/gatekeeper-output.js";
 import { NAVIGATOR_OUTPUT_TOOL_NAME, } from "../package-contracts/navigator-output.js";
@@ -672,44 +673,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
     const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
     if (parentId === undefined)
         return undefined;
-    const isResumeEnvelopeBytes = (value) => {
-        if (typeof value !== "string")
-            return false;
-        if (value.length === 0)
-            return true;
-        const nl = value.indexOf("\n");
-        const firstLine = nl === -1 ? value : value.slice(0, nl);
-        const body = firstLine === "" && nl !== -1 ? value.slice(nl + 1) : value;
-        return body.startsWith("本次配置的劳务引擎及其手册：") || body.startsWith("- engine:");
-    };
-    const isResumeEnvelope = (msg) => {
-        if (!isRecord(msg) || msg.role !== "user")
-            return false;
-        const text = typeof msg.text === "string" ? msg.text : typeof msg.content === "string" ? msg.content : undefined;
-        if (isResumeEnvelopeBytes(text))
-            return true;
-        const content = msg.content;
-        if (Array.isArray(content)) {
-            return content.some((p) => isRecord(p) && (isResumeEnvelopeBytes(p.text) || isResumeEnvelopeBytes(p.content)));
-        }
-        return false;
-    };
-    let latestParentUserIndex = -1;
-    for (let i = parentEntries.length - 1; i >= 0; i -= 1) {
-        const entry = parentEntries[i];
-        if (entry?.type !== "message" || entry.message?.role !== "user")
-            continue;
-        if (isResumeEnvelope(entry.message))
-            continue;
-        latestParentUserIndex = i;
-        break;
-    }
     const childDirectories = [join(dirname(sessionFile), "auditor-roles")];
-    // Auto-resume seam (owner A): stale check must ignore resume envelope and
-    // prioritize retention. Previous `attemptEntryIndex < latest` discarded the
-    // first attempt's child after resume advanced latest, losing retentionFailure
-    // when retry had no compliance entry. Fix: ignore envelope for staleness and
-    // prefer any valid compliance failure before falling back to primary.
     const valid = [];
     let sawAnyDirectory = false;
     for (const childDirectory of childDirectories) {
@@ -759,9 +723,6 @@ async function loadBoundAuditorVolumes(sessionFile) {
                 const attemptEntryId = typeof bindingParent?.attemptEntryId === "string"
                     ? bindingParent.attemptEntryId
                     : undefined;
-                const attemptEntryIndex = attemptEntryId === undefined
-                    ? -1
-                    : parentEntries.findIndex((entry) => entry.id === attemptEntryId);
                 const boundSessionFile = typeof bindingParent?.sessionFile === "string"
                     ? bindingParent.sessionFile
                     : typeof header.parentSession === "string"
@@ -769,10 +730,8 @@ async function loadBoundAuditorVolumes(sessionFile) {
                         : undefined;
                 if (boundSessionFile !== sessionFile)
                     continue;
-                if (bindingParent !== undefined &&
-                    (bindingParent.sessionId !== parentId || attemptEntryIndex < latestParentUserIndex)) {
+                if (bindingParent !== undefined && bindingParent.sessionId !== parentId)
                     continue;
-                }
                 if (bindingParent === undefined && header.parentSession !== sessionFile)
                     continue;
                 valid.push({
@@ -781,8 +740,8 @@ async function loadBoundAuditorVolumes(sessionFile) {
                     sessionFile,
                     ...(attemptEntryId === undefined ? {} : { attemptEntryId }),
                 });
-                // Keep every qualifying interval in the current parent-user range.
-                // A single first-match break drops later same-user summons failures (#636).
+                // Keep every interval bound to this parent. Auditor payload is relayed as
+                // recorded; code does not expire it from later user-message shape (#858).
             }
         }
     }
@@ -843,14 +802,6 @@ function providerStopFallbackFromAuditorVolumes(volumes) {
     }
     return undefined;
 }
-/** Recover a provider stop from the auditor child bound to the current parent attempt. */
-export async function readBoundAuditorKnownFailure(sessionFile) {
-    const volumes = await loadBoundAuditorVolumes(sessionFile);
-    if (volumes === undefined)
-        return undefined;
-    return complianceFailureFromAuditorVolumes(volumes)
-        ?? providerStopFallbackFromAuditorVolumes(volumes);
-}
 /** Strong auditor tier only — retained compliance-failure entries, no provider-stop fallback. */
 async function readBoundAuditorComplianceFailure(sessionFile) {
     const volumes = await loadBoundAuditorVolumes(sessionFile);
@@ -2361,6 +2312,16 @@ async function settleLawfulDiaristTerminalResult(admitted, authority, scope) {
 export async function trySettleDiaristTerminalResult(admitted, authority, scope) {
     return settleLawfulDiaristTerminalResult(admitted, authority, scope);
 }
+async function settleLawfulSecretariatTerminalResult(admitted, authority, scope) {
+    return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+        role: "secretariat",
+        toolName: SECRETARIAT_OUTPUT_TOOL_NAME,
+    }, scope);
+}
+/** Try to settle a lawful Secretariat Terminal; undefined only for genuine absence. */
+export async function trySettleSecretariatTerminalResult(admitted, authority, scope) {
+    return settleLawfulSecretariatTerminalResult(admitted, authority, scope);
+}
 async function settleLawfulInspectorTerminalResult(admitted, authority, scope) {
     return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
         role: "inspector",

package/dist/public-role-summons.js

@@ -169,11 +169,15 @@ async function summonPublicRole(options) {
         env: {
           ...built.env,
           stationChild: true,
+          // Forward composition-root adapters so nested court stations (e.g.
+          // countersign → diarist) select the same faux/production table (#924).
+          ...options.hostAdapters === void 0 ? {} : { hostAdapters: options.hostAdapters },
           ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit },
           ...options.signal === void 0 ? {} : { signal: options.signal },
           ...options.reviewReask === void 0 ? {} : { reviewReask: options.reviewReask },
           ...options.gateReviewInstruction === void 0 ? {} : { gateReviewInstruction: options.gateReviewInstruction },
           ...options.boundTicketNumber === void 0 ? {} : { boundTicketNumber: options.boundTicketNumber },
+          ...options.correlationId === void 0 || options.correlationId.trim() === "" ? {} : { correlationId: options.correlationId },
           ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId }
         }
       };
@@ -276,6 +280,16 @@ async function summonPublicRole(options) {
       result = stepped.ok;
       break;
     }
+    case "countersign": {
+      const [{ runPublicCountersign }, { parseCountersignArgv }] = await Promise.all([
+        import("./public-cli/countersign-run.js"),
+        import("./public-cli/invocation.js")
+      ]);
+      const stepped = await runPrepared(parseCountersignArgv, (env, once) => runPublicCountersign(options.argv, env, io, once));
+      if ("fail" in stepped) return stepped.fail;
+      result = stepped.ok;
+      break;
+    }
   }
   const stderr = captured?.stderrText();
   const runDirectory = result.admitted?.runDirectory;

package/dist/secretariat-contracts.js

@@ -0,0 +1,8 @@
+const SECRETARIAT_OUTPUT_TOOL_NAME = "ak_secretariat_output";
+const SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME = "ak_secretariat_summon_countersign";
+const SECRETARIAT_ACCEPTED_TEXT = "\u4E2D\u4E66\u7701\u56DE\u6267\u5DF2\u63A5\u53D7";
+export {
+  SECRETARIAT_ACCEPTED_TEXT,
+  SECRETARIAT_OUTPUT_TOOL_NAME,
+  SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME
+};

package/dist/sitian-appender.js

@@ -152,25 +152,41 @@ function resolveSitianVolumeCategory(kind) {
   }
   return kind;
 }
+const SITIAN_RECORDS_LEAF = "records.jsonl";
+function ticketProvenanceUnderBookPaths(ledgerHome, bookKey, ticketId) {
+  const sessionDir = join(activationBookDirectory(ledgerHome, bookKey), ticketId);
+  return { sessionDir, recordFile: join(sessionDir, SITIAN_RECORDS_LEAF) };
+}
 function resolveSitianRecordPathInLedger(input, ledgerHome) {
   const category = resolveSitianVolumeCategory(input.kind);
   const ticketNumber = category === "ticket-provenance" ? typeof input.subject === "string" && /^[1-9][0-9]*$/.test(input.subject) ? input.subject : typeof input.subject === "object" && typeof input.subject.ticketNumber === "number" && Number.isSafeInteger(input.subject.ticketNumber) && input.subject.ticketNumber > 0 ? String(input.subject.ticketNumber) : void 0 : void 0;
   let sessionDir;
+  let recordFile;
   if (ticketNumber !== void 0) {
-    const bookDir = activationBookDirectory(
+    const paths = ticketProvenanceUnderBookPaths(
       ledgerHome,
-      resolveBookKeyFromGit(input.cwd ?? process.cwd())
+      resolveBookKeyFromGit(input.cwd ?? process.cwd()),
+      ticketNumber
     );
-    sessionDir = join(bookDir, ticketNumber);
+    sessionDir = paths.sessionDir;
+    recordFile = paths.recordFile;
   } else {
     if (input.sessionParent === void 0 || input.sessionParent.length === 0 || !physicallyContainedIn(ledgerHome, input.sessionParent)) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
     sessionDir = join(dirname(input.sessionParent), category);
+    recordFile = join(sessionDir, SITIAN_RECORDS_LEAF);
   }
-  const recordFile = join(sessionDir, "records.jsonl");
   return { sessionDir, recordFile, ledgerHome };
 }
+function projectTicketRecordsPathShape() {
+  const { recordFile } = ticketProvenanceUnderBookPaths(
+    join("~", ".ak-roles"),
+    "<\u7C3F>",
+    "<\u7968\u53F7>"
+  );
+  return recordFile.replace(/\\/g, "/");
+}
 function resolveSitianRecordPath(input) {
   const ledgerHome = input.home !== void 0 && input.home.length > 0 ? resolveActivationLedgerHome(input.home) : resolveActivationLedgerHomeForPath(input.sessionParent);
   return resolveSitianRecordPathInLedger(input, ledgerHome);
@@ -210,6 +226,7 @@ function appendSitianRecord(input) {
 export {
   S4_SUBMISSION_LEDGER_KINDS,
   appendSitianRecord,
+  projectTicketRecordsPathShape,
   resolveSitianRecordPath,
   resolveSitianRecordPathInLedger,
   resolveSitianVolumeCategory

package/extensions/role-runtime.ts

@@ -130,6 +130,7 @@ export default function roleRuntime(pi: ExtensionAPI): void {
     loadCountersignSoul: () => loadMainRoleSessionMaterials("countersign"),
     loadGleanerLeftSoul: () => loadMainRoleSessionMaterials("gleaner-left"),
     loadDiaristSoul: () => loadMainRoleSessionMaterials("diarist"),
+    loadSecretariatSoul: () => loadMainRoleSessionMaterials("secretariat"),
     loadInspectorSoul: () => loadMainRoleSessionMaterials("inspector"),
     loadGatekeeperSoul: () => loadGatekeeperSessionMaterials("gatekeeper"),
     loadNavigatorSoul: () => loadMainRoleSessionMaterials("navigator"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4321",
+  "version": "0.1.4387",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/scripts/build-package.mjs

@@ -33,6 +33,7 @@ const entries = [
   "canonical-json",
   "compliance-transport",
   "countersign-contracts",
+  "secretariat-contracts",
   "doctor-contracts",
   "engine-detour",
   "engine-detour-tool",

package/souls/secretariat.md

@@ -0,0 +1,26 @@
+中书省 Soul
+你是中书省，出令省。调用者给你票，你交出可送庭的票面：送庭，封驳则改，改则再送，直到署或上呈。
+立法与材料
+
+* 第一法源：全局宪法、本仓宪法、本票起居录。
+* 第二法源：适用 ADR，按票面触及的席位、接缝、术语自行查全，草稿引没引都算，逐条列决定；CONTEXT.md。
+* 审查对象：派单文，票面、父票与相关票。
+* 输出参考：《票面法》《质量法》、给事中与符宝郎 Soul。票面最终要过他们的审。
+* 第二法源合法性：第二法源是否合法，违背第一法源，又没有陛下原话的；直接封驳，拿不准的，上呈，不准署
+
+合法性检查
+
+* 审查派单文、票面、父票与相关票。逐项对第一、第二法源：不得违法源，不得拿局部原话替整段意思，不得以第二法源反压第一法源。违法则封驳；拿不准且关系裁量的，上呈。
+
+审票
+
+* 该有的都有，不该有的都没有。法源要求的决定、边界、行为、验收均须落到票面，或明确由谁承接；无依据的设计、推演、夹带、越权内容不得写进票面。每一句只能是原话、可见行为、可跑验收或法源路径。
+* 票面写下来的事，必须就是陛下要办的那件事。原话读整段，结合起居录、上下文与相关票判断真实意图；不得断章取义，也不得因“有一句话能对应”就视为正确。逐项检查目标、偏差、结果、边界与验收是否写对、有没有写偏、漏掉或扩大。能改则改票重送，不能自行裁定则上呈。
+
+每次重交整张票重审，不沿用上庭结论。
+判词
+事实与处方分开对宪：裁决落法度与事实；施工设计与实现细节过早堆上票面即为失职。
+
+* 署（converged）——自检无误，可以送下一个衙门；
+* 封驳（continue）——存在必须退回重议的问题；写明缺什么、属哪一步；
+* 上呈（escalate）——无法正常署/封驳时。上呈求助

package/souls/ticket-law.md

@@ -0,0 +1,9 @@
+# 票面法
+
+票面面向执行，只交代：当前应然、当前偏差与证据、获授权的结果、覆盖各项主张的可观察验收；标题与次序不作契约。
+
+历史只在证明现行法、冲突或根因不可缺时保留，不写考古追责。
+
+重大决定须追至本票起居录或现行法源；不得把票面、prompt、驳回语或实现现状升格为授权。相关 ADR 写明路径。
+
+事实与处方分开：票面钉行为结果，不提前钉未裁定的实现。类级问题按性质圈界，位置与数量只作证据，不作白名单。

package/src/collector-tool-schemas.ts

@@ -1,6 +1,6 @@
 import { Type, type Static } from "typebox";
 import { openToolObject } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 
 // #836 r16 class 3: execute() reads no params for this tool
 // (src/collector-role.ts:431-459) — a closed root only rejects the role for
@@ -124,7 +124,7 @@ export const collectorOutputBaseSchema = openToolObject(
 );
 
 /** Runtime owns the observed evidence; the model submits findings and signals sole-final submission. */
-export const collectorOutputArgsSchema = withInfrastructureFailureDeclaration(
+export const collectorOutputArgsSchema = withTerminatingOutputDeclarations(
   collectorOutputBaseSchema,
 );
 

package/src/countersign-role.ts

@@ -1,7 +1,7 @@
 import type { Static } from "typebox";
 import { Type } from "typebox";
 
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import {
   COUNTERSIGN_OUTPUT_TOOL_NAME,
   validateRecordedCountersignOutput,
@@ -22,7 +22,7 @@ export type { CountersignVerdict };
 // classifies the recorded value and reasks the countersign itself when it
 // isn't one of the three states — code, not the transport, does that work.
 /** 给事中票庭审读五问的交卷形状（ADR 0074）；形状指引，非 schema 闸。 */
-export const countersignVerdictSchema = withInfrastructureFailureDeclaration(
+export const countersignVerdictSchema = withTerminatingOutputDeclarations(
   Type.Object(
     {
       countersignStatus: Type.Unknown({ description: "converged | continue | escalate。非三态时请重读后重交，勿改标。" }),

package/src/diarist-role.ts

@@ -2,7 +2,7 @@ import type { Static } from "typebox";
 import { Type } from "typebox";
 
 import { openToolObject } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import {
   DIARIST_OUTPUT_TOOL_NAME,
   validateRecordedDiaristOutput,
@@ -20,7 +20,7 @@ export { validateRecordedDiaristOutput };
  * 起居郎交卷形状；形状指引，非 schema 闸。
  * #901：交边界（sessions）+ 可选坏行补写（amendments）；正文由机械投影。
  */
-export const diaristOutputSchema = withInfrastructureFailureDeclaration(
+export const diaristOutputSchema = withTerminatingOutputDeclarations(
   openToolObject(
     Type.Object({
       status: Type.Unknown({

package/src/doctor-contracts.ts

@@ -1,7 +1,7 @@
 import { Type } from "typebox";
 import { canonicalJson } from "./canonical-json.ts";
 import { openToolObjectFromUnion } from "./open-tool-schema.ts";
-import { withInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 
 export const DOCTOR_EVIDENCE_TOOL_NAME = "ak_doctor_evidence";
 export const DOCTOR_OUTPUT_TOOL_NAME = "ak_doctor_output";
@@ -87,7 +87,7 @@ const doctorSubmissionVariants = Type.Union([
     missingEvidence: Type.Array(Type.Object({ need: nonblank, targetKeys: evidenceIds }, { additionalProperties: true }), { description: "如实证词所需而尚缺的证据" }),
   }, { additionalProperties: false, description: "证据不足以支撑如实案证词" }),
 ]);
-export const doctorSubmissionSchema = withInfrastructureFailureDeclaration(
+export const doctorSubmissionSchema = withTerminatingOutputDeclarations(
   openToolObjectFromUnion(doctorSubmissionVariants),
 );
 // #836 r16 class 3: action tool — code reads evidenceId to look up the Map entry

package/src/engine-detour-tool.ts

@@ -5,7 +5,6 @@
  * Engine process failures stop through the host infrastructure-failure seam.
  * Caller AbortSignal cancellation propagates unchanged.
  */
-import { basename } from "node:path";
 import { Type, type Static } from "typebox";
 import type { HostContext, HostToolDefinition, HostToolResult, RoleHost } from "./host-contracts.ts";
 
@@ -21,14 +20,9 @@ import {
   engineDetourStdoutByteLength,
   reportEngineDetourCall,
 } from "./engine-detour-usage.ts";
+import { runIdFromRunDirectory } from "./run-terminal-artifacts.ts";
+
 
-/** runDirectory leaf is `<runId>@<role>`; subject is optional. */
-function basenameRunId(runDirectory: string): string | undefined {
-  const leaf = basename(runDirectory);
-  const at = leaf.indexOf("@");
-  if (at <= 0) return undefined;
-  return leaf.slice(0, at);
-}
 
 // #836 r16 class 3: argv required/minItems/element-minLength stay — execute()
 // must obtain the first item as the executable and spawn it (below; #82-98).
@@ -131,7 +125,7 @@ export function createEngineDetourToolDefinition(input: {
       const runDirectory = typeof ctx.runDirectory === "string" && ctx.runDirectory.length > 0
         ? ctx.runDirectory
         : undefined;
-      const runId = runDirectory === undefined ? undefined : basenameRunId(runDirectory);
+      const runId = runDirectory === undefined ? undefined : runIdFromRunDirectory(runDirectory);
       // Public-invocation scope + selected host from Host envelope only — never
       // courtAttemptId, never sidecar file, never pre-spawn invocation.json I/O.
       const invocationScopeId =