@akagilnc/pi-workflow-roles 0.1.4444 → 0.1.4503

package/dist/public-cli/main.js

@@ -15308,13 +15308,10 @@ function assertRegisteredHostName(host) {
   }
   throw new Error(`unregistered host: ${host}`);
 }
-var PRIVATE_COMPAT_ENV, DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
+var DEFAULT_ROLE_TURN_HOST, HOST_DESCRIPTIONS, HEADLESS_HOST_DESCRIPTIONS;
 var init_host_descriptions = __esm({
   "src/host-descriptions.ts"() {
     "use strict";
-    PRIVATE_COMPAT_ENV = Object.fromEntries(
-      ["CLAUDE", "CURSOR", "CODEX"].flatMap((vendor) => ["SKILLS", "RULES", "AGENTS", "MCPS", "HOOKS", "SESSIONS"].map((kind) => [`GROK_${vendor}_${kind}_ENABLED`, "false"]))
-    );
     DEFAULT_ROLE_TURN_HOST = "pi";
     HOST_DESCRIPTIONS = Object.freeze({
       /** Operator home `~/.grok`, native session/load resume, `agent [--model X] stdio`. */
@@ -15327,12 +15324,7 @@ var init_host_descriptions = __esm({
         }),
         modelPassing: "argv",
         boundResume: "session/load",
-        sessionBindingFile: "grok-acp-session.json",
-        childEnv: Object.freeze({
-          ...PRIVATE_COMPAT_ENV,
-          GROK_MEMORY: "0",
-          GROK_SUBAGENTS: "0"
-        })
+        sessionBindingFile: "grok-acp-session.json"
       }),
       /**
        * Operator home `~/.hermes`, native session/load resume, `acp` subcommand.
@@ -15351,7 +15343,6 @@ var init_host_descriptions = __esm({
         modelPassing: "set_model",
         boundResume: "session/load",
         sessionBindingFile: "hermes-acp-session.json",
-        childEnv: Object.freeze({}),
         seatProfileSoul: Object.freeze({
           flag: "-p",
           namePrefix: "ak-",
@@ -15372,12 +15363,7 @@ var init_host_descriptions = __esm({
           // Intermediate assistant/tool/system events require verbose with stream-json.
           "--verbose",
           "--permission-mode",
-          "bypassPermissions",
-          // Empty sources: no user/project/local operator surface (envelope owns materials).
-          "--setting-sources",
-          "",
-          // With adapter-supplied --mcp-config only (AK relay); drops operator + claude.ai MCP.
-          "--strict-mcp-config"
+          "bypassPermissions"
         ]),
         promptFlag: "-p",
         modelFlag: "--model",
@@ -20689,10 +20675,12 @@ __export(invocation_exports, {
   deriveMergerEnvelopeFromActiveMerge: () => deriveMergerEnvelopeFromActiveMerge,
   ensureRunArtifactsDir: () => ensureRunArtifactsDir,
   freezeAttachmentsIntoRun: () => freezeAttachmentsIntoRun,
+  freezePreparedAttachmentsIntoRun: () => freezePreparedAttachmentsIntoRun,
   homeFromRunDirectory: () => homeFromRunDirectory,
   isReviewerLens: () => isReviewerLens,
   issueAdmissionPlacement: () => issueAdmissionPlacement,
   loadAdmittedJudgeRequest: () => loadAdmittedJudgeRequest,
+  materializeCountersignInvocation: () => materializeCountersignInvocation,
   observeLaunchedRolePackageIdentity: () => observeLaunchedRolePackageIdentity,
   parseAnalystArgv: () => parseAnalystArgv,
   parseAnalystCohortIssueToken: () => parseAnalystCohortIssueToken,
@@ -20716,6 +20704,7 @@ __export(invocation_exports, {
   parseReviewerArgv: () => parseReviewerArgv,
   parseSecretariatArgv: () => parseSecretariatArgv,
   persistAdmittedSourceRunPath: () => persistAdmittedSourceRunPath,
+  recordAdmittedCorrelation: () => recordAdmittedCorrelation,
   recordEffectiveInvocationModel: () => recordEffectiveInvocationModel,
   recordLaunchedPiIdentity: () => recordLaunchedPiIdentity,
   recordLaunchedRolePackageIdentity: () => recordLaunchedRolePackageIdentity,
@@ -20724,17 +20713,21 @@ __export(invocation_exports, {
   requireReviewerBaseRevision: () => requireReviewerBaseRevision,
   requireReviewerLens: () => requireReviewerLens,
   resolveDoctorCaseRunsPath: () => resolveDoctorCaseRunsPath,
-  resolveGitHubRemoteRepository: () => resolveGitHubRemoteRepository
+  resolveGitHubRemoteRepository: () => resolveGitHubRemoteRepository,
+  withPreparedAttachments: () => withPreparedAttachments
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
 import {
   lstat as lstat4,
+  mkdtemp,
   readFile as readFile11,
   realpath as realpath4,
   rename,
+  rm,
   writeFile as writeFile5
 } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute7, join as join15, resolve as resolve7, sep as sep4 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
@@ -20745,7 +20738,7 @@ function issueAdmissionPlacement(authority, request) {
     runId: request.runId,
     role: request.role
   });
-  ensureRoleRunPlacement(ledgerHome, placement);
+  if (request.materialize !== false) ensureRoleRunPlacement(ledgerHome, placement);
   return {
     principal: authority.seal(placement),
     ...placement,
@@ -20870,6 +20863,31 @@ async function bindAdmittedTicketNumber(admitted, ticketNumber) {
   await bindTicketNumberOnRunDirectory(admitted.runDirectory, ticketNumber);
   admitted.ticketNumber = ticketNumber;
 }
+async function recordAdmittedCorrelation(admitted, correlationId) {
+  const current = JSON.parse(
+    await readFile11(admitted.admittedRequestPath, "utf8")
+  );
+  const prior = [
+    ...Array.isArray(current.correlationIds) ? current.correlationIds.filter(
+      (value) => typeof value === "string" && value.trim() !== ""
+    ) : [],
+    ...typeof current.correlationId === "string" && current.correlationId.trim() !== "" ? [current.correlationId] : []
+  ];
+  const correlationIds = [.../* @__PURE__ */ new Set([...prior, correlationId])];
+  await writeFile5(
+    admitted.admittedRequestPath,
+    `${JSON.stringify({ ...current, correlationId, correlationIds }, null, 2)}
+`,
+    "utf8"
+  );
+  await mergeInvocationIdentityPage(admitted.runDirectory, {
+    correlationId,
+    correlationIds
+  });
+  const mutable = admitted;
+  mutable.correlationId = correlationId;
+  mutable.correlationIds = correlationIds;
+}
 async function bindCourtTicketNumbersOnAdmitted(admitted, courtTicketNumbers) {
   if (admitted.ticketNumber === void 0) {
     throw new Error(
@@ -21260,7 +21278,7 @@ function parseFixerArgv(args) {
     ...project === void 0 ? {} : { project }
   };
 }
-async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
+async function readRegularFileAttachment(sourcePath) {
   const absolute = isAbsolute7(sourcePath) ? sourcePath : resolve7(sourcePath);
   let st;
   try {
@@ -21276,18 +21294,72 @@ async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
       `attachment must be a regular file (not a directory or symlink): ${sourcePath}`
     );
   }
-  const bytes = await readFile11(absolute);
-  const name = `${String(index).padStart(2, "0")}-${basename6(absolute)}`;
-  const frozenPath = join15(destinationDir, name);
+  try {
+    return { absolute, bytes: await readFile11(absolute) };
+  } catch (error) {
+    throw new CliUsageError(
+      `attachment is not a readable regular file: ${sourcePath}`,
+      { cause: error }
+    );
+  }
+}
+async function removePreparedAttachmentDirectory(stagingDirectory) {
+  await rm(stagingDirectory, { recursive: true, force: true });
+}
+async function withPreparedAttachments(attachmentPaths, use) {
+  if (attachmentPaths.length === 0) return await use([]);
+  const stagingDirectory = await mkdtemp(join15(tmpdir(), "ak-role-attachments-"));
+  const prepared = [];
+  let result2;
+  try {
+    for (let index = 0; index < attachmentPaths.length; index += 1) {
+      const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
+      const snapshotPath = join15(stagingDirectory, String(index).padStart(6, "0"));
+      await writeFile5(snapshotPath, bytes);
+      prepared.push({ absolute, snapshotPath });
+    }
+    result2 = await use(prepared);
+  } catch (primary) {
+    try {
+      await removePreparedAttachmentDirectory(stagingDirectory);
+    } catch (cleanup) {
+      throw new AggregateError(
+        [primary, cleanup],
+        "attachment snapshot operation failed and cleanup also failed",
+        { cause: primary }
+      );
+    }
+    throw primary;
+  }
+  await removePreparedAttachmentDirectory(stagingDirectory);
+  return result2;
+}
+async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
+  const frozenPath = join15(
+    destinationDir,
+    `${String(index).padStart(2, "0")}-${basename6(provenancePath)}`
+  );
   await writeFile5(frozenPath, bytes);
   return {
-    attachment: {
-      provenancePath: absolute,
-      frozenPath,
-      byteLength: bytes.byteLength,
-      sha256: sha256Hex(bytes),
-      mediaKind: "regular-file"
-    },
+    provenancePath,
+    frozenPath,
+    byteLength: bytes.byteLength,
+    sha256: sha256Hex(bytes),
+    mediaKind: "regular-file"
+  };
+}
+async function freezePreparedAttachment(prepared, destinationDir, index) {
+  return freezeAttachmentBytes(
+    prepared.absolute,
+    await readFile11(prepared.snapshotPath),
+    destinationDir,
+    index
+  );
+}
+async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
+  const { absolute, bytes } = await readRegularFileAttachment(sourcePath);
+  return {
+    attachment: await freezeAttachmentBytes(absolute, bytes, destinationDir, index),
     body: bytes
   };
 }
@@ -21310,6 +21382,17 @@ async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKe
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
+async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
+  if (prepared.length === 0) return [];
+  const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
+  const attachmentsDirectory = summonsKey === void 0 ? join15(runDirectory, "attachments") : join15(runDirectory, "attachments", summonsKey);
+  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+  const attachments = [];
+  for (let index = 0; index < prepared.length; index += 1) {
+    attachments.push(await freezePreparedAttachment(prepared[index], attachmentsDirectory, index));
+  }
+  return attachments;
+}
 function ticketAdmissionFields(ticketNumber) {
   if (ticketNumber === void 0) return {};
   return {
@@ -21449,9 +21532,10 @@ async function admitCountersignInvocation(options) {
     runId,
     role: "countersign",
     subject: { unbound: true },
-    home: options.home
+    home: options.home,
+    materialize: options.deferPersistence !== true
   });
-  const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
+  const attachments = options.deferPersistence === true ? [] : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
   const instruction = options.instruction;
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -21473,11 +21557,13 @@ async function admitCountersignInvocation(options) {
     }))
   };
   const admittedRequestPath = join15(runDirectory, "admitted-request.json");
-  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-    sessionDirectory,
-    sessionFile
-  });
-  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+  if (options.deferPersistence !== true) {
+    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+      sessionDirectory,
+      sessionFile
+    });
+    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+  }
   return {
     role: "countersign",
     runId,
@@ -21492,6 +21578,29 @@ async function admitCountersignInvocation(options) {
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
 }
+async function materializeCountersignInvocation(admitted, options) {
+  const placement = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: admitted.projectRoot,
+    runId: admitted.runId,
+    role: "countersign",
+    subject: { unbound: true },
+    home: options.home
+  });
+  const attachments = await freezePreparedAttachmentsIntoRun(
+    options.preparedAttachments,
+    admitted.runDirectory
+  );
+  admitted.attachments = attachments;
+  await writeAdmittedRequestPersistence(admitted.admittedRequestPath, admitted, {
+    sessionDirectory: placement.sessionDirectory,
+    sessionFile: placement.sessionFile
+  });
+  await writeRoleInvocationLedger(
+    { ...admitted, sessionDirectory: placement.sessionDirectory, sessionFile: placement.sessionFile },
+    admitted.role,
+    options.model
+  );
+}
 function buildCountersignTransportPrompt(admitted, engineMaterial) {
   return buildInstructionTransportPrompt(admitted, engineMaterial);
 }
@@ -24252,9 +24361,7 @@ async function readPackageMaterial(relativePath) {
 }
 async function joinPackageMaterials(relativePaths) {
   const chunks = [];
-  for (const relativePath of relativePaths) {
-    chunks.push(await readPackageMaterial(relativePath));
-  }
+  for (const relativePath of relativePaths) chunks.push(await readPackageMaterial(relativePath));
   return chunks.join("\n\n");
 }
 var packageRootUrl, MAIN_ROLE_SESSION_MATERIALS, GATEKEEPER_SESSION_MATERIALS;
@@ -24285,6 +24392,8 @@ __export(auditor_soul_exports, {
   AUDITOR_SESSION_MATERIALS: () => AUDITOR_SESSION_MATERIALS,
   AUDITOR_SOUL_ROLES: () => AUDITOR_SOUL_ROLES,
   isAuditorSoulRole: () => isAuditorSoulRole,
+  loadAuditorReferenceMaterials: () => loadAuditorReferenceMaterials,
+  loadAuditorReferenceMaterialsFromSubjectInput: () => loadAuditorReferenceMaterialsFromSubjectInput,
   loadAuditorSoul: () => loadAuditorSoul,
   loadAuditorSoulFromSubjectInput: () => loadAuditorSoulFromSubjectInput,
   resolveAuditorSubject: () => resolveAuditorSubject
@@ -24311,11 +24420,18 @@ async function loadAuditorSoul(role) {
   if (soul.trim().length === 0) {
     throw new Error(`The ${role} auditor Soul is blank`);
   }
-  return joinPackageMaterials(materials);
+  return soul;
+}
+function loadAuditorReferenceMaterials(role) {
+  const soulPath = auditorSoulRelativePath(role);
+  return joinPackageMaterials(AUDITOR_SESSION_MATERIALS[role].filter((path) => path !== soulPath));
 }
 async function loadAuditorSoulFromSubjectInput(raw) {
   return loadAuditorSoul(resolveAuditorSubject(raw));
 }
+function loadAuditorReferenceMaterialsFromSubjectInput(raw) {
+  return loadAuditorReferenceMaterials(resolveAuditorSubject(raw));
+}
 var AUDITOR_SOUL_ROLES, AK_ROLE_AUDITOR_SUBJECT_ENV, AK_ROLE_AUDITOR_SOURCE_RUN_ENV, AUDITOR_SESSION_MATERIALS;
 var init_auditor_soul = __esm({
   "src/auditor-soul.ts"() {
@@ -27552,8 +27668,8 @@ var init_ticket_provenance = __esm({
 });
 
 // src/public-cli/case-dossier-delivery.ts
-import { mkdtemp, readFile as readFile18, rm, writeFile as writeFile8 } from "node:fs/promises";
-import { tmpdir } from "node:os";
+import { mkdtemp as mkdtemp2, readFile as readFile18, rm as rm2, writeFile as writeFile8 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
 import { join as join26 } from "node:path";
 async function projectCaseDossierPointerSection(input) {
   if (input.ticketNumber === void 0) {
@@ -27581,7 +27697,7 @@ async function deliverCaseDossierAsAttachment(input) {
     projectRoot: input.projectRoot,
     home: input.home
   });
-  const stagingDir = await mkdtemp(join26(tmpdir(), "ak-case-dossier-"));
+  const stagingDir = await mkdtemp2(join26(tmpdir2(), "ak-case-dossier-"));
   try {
     const stagingPath = join26(stagingDir, CASE_DOSSIER_ATTACH_FILE);
     await writeFile8(stagingPath, `${section}
@@ -27592,7 +27708,7 @@ async function deliverCaseDossierAsAttachment(input) {
       CASE_DOSSIER_ATTACH_KEY
     );
   } finally {
-    await rm(stagingDir, { recursive: true, force: true });
+    await rm2(stagingDir, { recursive: true, force: true });
   }
 }
 var CASE_DOSSIER_SECTION_HEADING, UNBOUND_DOSSIER_PATH_HEADING, CASE_DOSSIER_ATTACH_KEY, CASE_DOSSIER_ATTACH_FILE;
@@ -30170,6 +30286,9 @@ function diaristAdapters(env) {
     shouldPresentSettled: () => true,
     // Resume interrupted state: board ticket already on pages, run still under unbound/.
     beforeDispatch: async (admitted, lease) => {
+      if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
+        await recordAdmittedCorrelation(admitted, env.correlationId);
+      }
       await bindAndRelocateDiaristIfBoardBound(admitted, env.principalAuthority, lease);
     },
     // First post-turn assert: accept hook wrote board pages; relocate before lease release.
@@ -30721,7 +30840,8 @@ function courtDiaristEscalated(roleOutcome) {
   if (roleOutcome.kind === "audit_escalation") return true;
   if (roleOutcome.kind !== "accepted") return false;
   return (roleOutcome.payloads ?? []).some((payload) => {
-    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return false;
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+      return false;
     const record4 = payload;
     return record4.status === "escalate" || record4.countersignStatus === "escalate";
   });
@@ -30774,7 +30894,10 @@ async function invokeCourtDiarist(input, env, io) {
   }
   const asserted = result2.admitted?.ticketNumber;
   if (isSafePositiveTicketNumber(asserted)) {
-    const courtTicketNumbers = courtTicketNumbersFromOutcome(roleOutcome, asserted);
+    const courtTicketNumbers = courtTicketNumbersFromOutcome(
+      roleOutcome,
+      asserted
+    );
     return {
       identity: {
         kind: "ticket",
@@ -30823,7 +30946,9 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
       );
     }
     if (outcome.failedWithoutEscalate !== void 0) {
-      throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+      throw new StationChildExhaustedError(
+        outcome.failedWithoutEscalate.diagnostic
+      );
     }
   }
 }
@@ -30849,7 +30974,8 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
       ...parsed.project === void 0 ? {} : { project: parsed.project },
       ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
       ...env.model === void 0 ? {} : { model: env.model },
-      ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId }
+      ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId },
+      deferPersistence: true
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -30858,160 +30984,216 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
     }
     throw error;
   }
-  await markRunAdmitted(admitted, env.principalAuthority);
-  let typedTicket;
-  let typedCourtTicketNumbers;
-  let identityDiaristRan = false;
-  if (env.runCourtDiaristStation === void 0) {
-    const outcome = await invokeCourtDiarist(
-      {
-        instruction: parsed.instruction,
-        projectRoot: admitted.projectRoot,
-        failureLabel: "unbound summons",
-        correlationId: admitted.runId
-      },
-      env,
-      io
-    );
-    identityDiaristRan = true;
-    if (outcome.identity.kind === "escalate") {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: new Error(
-            "court diarist station escalated (cannot identify court target)"
-          )
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-    if (outcome.failedWithoutEscalate !== void 0) {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-    if (outcome.identity.kind === "ticket") {
-      const assertedTicket = outcome.identity.ticketNumber;
-      typedTicket = assertedTicket;
-      typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
-      const summons = {
-        instruction: parsed.instruction,
-        instructionEmpty: parsed.instruction.trim() === "",
-        attachmentPaths: parsed.attachmentPaths
-      };
-      const resumed = await tryResumeSameTicketSeatRun({
-        home: env.home,
-        projectRoot: admitted.projectRoot,
-        role: "countersign",
-        ticketNumber: typedTicket,
-        freshSummons: env.freshSummons,
-        summons,
-        resume: async (runId, materials) => {
-          await bindAdmittedTicketNumber(admitted, assertedTicket);
-          await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-          await markRunTerminal(admitted.runDirectory);
-          return await runPublicCountersignResume(
-            {
-              runId,
-              ...materials === void 0 ? {} : { summons: materials }
-            },
-            {
-              ...env,
-              ...typedCourtTicketNumbers === void 0 ? {} : { pendingCourtTicketNumbers: typedCourtTicketNumbers }
-            },
-            io
-          );
+  try {
+    return await withPreparedAttachments(
+      parsed.attachmentPaths,
+      async (preparedAttachments) => {
+        const materializeAdmission = async () => {
+          await materializeCountersignInvocation(admitted, {
+            home: env.home,
+            principalAuthority: env.principalAuthority,
+            preparedAttachments,
+            ...env.model === void 0 ? {} : { model: env.model }
+          });
+        };
+        let typedTicket;
+        let typedCourtTicketNumbers;
+        let identityDiaristRan = false;
+        if (env.runCourtDiaristStation === void 0) {
+          let outcome;
+          try {
+            outcome = await invokeCourtDiarist(
+              {
+                instruction: parsed.instruction,
+                projectRoot: admitted.projectRoot,
+                failureLabel: "unbound summons"
+              },
+              env,
+              io
+            );
+          } catch (error) {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              { timedOut: false, code: null, stderr: "", thrown: error },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          identityDiaristRan = true;
+          if (outcome.identity.kind === "escalate") {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(
+                  "court diarist station escalated (cannot identify court target)"
+                )
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          if (outcome.failedWithoutEscalate !== void 0) {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          if (outcome.identity.kind === "ticket") {
+            const assertedTicket = outcome.identity.ticketNumber;
+            typedTicket = assertedTicket;
+            typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+            const summons = {
+              instruction: parsed.instruction,
+              instructionEmpty: parsed.instruction.trim() === ""
+            };
+            const resumed = await tryResumeSameTicketSeatRun({
+              home: env.home,
+              projectRoot: admitted.projectRoot,
+              role: "countersign",
+              ticketNumber: typedTicket,
+              freshSummons: env.freshSummons,
+              summons,
+              resume: async (runId, materials) => {
+                const retained = await loadResumableCountersignRun(
+                  env.home,
+                  runId,
+                  env.principalAuthority
+                );
+                if (retained.admitted === void 0) {
+                  throw new Error(
+                    `retained countersign run disappeared before resume: ${runId}`
+                  );
+                }
+                const frozenPaths = (await freezePreparedAttachmentsIntoRun(
+                  preparedAttachments,
+                  retained.admitted.runDirectory,
+                  `s-${Date.now().toString(36)}`
+                )).map((attachment) => attachment.frozenPath);
+                const preparedMaterials = {
+                  ...materials ?? {},
+                  ...frozenPaths.length === 0 ? {} : { attachmentPaths: frozenPaths }
+                };
+                return await runPublicCountersignResume(
+                  {
+                    runId,
+                    summons: preparedMaterials
+                  },
+                  {
+                    ...env,
+                    ...typedCourtTicketNumbers === void 0 ? {} : { pendingCourtTicketNumbers: typedCourtTicketNumbers }
+                  },
+                  io
+                );
+              }
+            });
+            if (resumed !== void 0) {
+              return resumed;
+            }
+          }
         }
-      });
-      if (resumed !== void 0) {
-        return resumed;
-      }
-    }
-  }
-  if (identityDiaristRan && typedTicket !== void 0) {
-    try {
-      await bindAdmittedTicketNumber(admitted, typedTicket);
-      await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-      await bindCourtTicketNumbersOnAdmitted(
-        admitted,
-        typedCourtTicketNumbers ?? [typedTicket]
-      );
-    } catch (error) {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: error
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-  }
-  const turnProjection = {
-    packageRoot: env.packageRoot,
-    home: env.home,
-    agentDir: env.agentDir,
-    ...env.model === void 0 ? {} : { model: env.model },
-    ...pickEngineAxis(env),
-    ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
-    ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
-    continuation: {
-      kind: "initial",
-      prompt: buildCountersignTransportPrompt(
-        admitted,
-        engineSessionMaterialFromOptions({
-          ...pickEngineAxis(env),
-          packageRoot: env.packageRoot
-        })
-      )
-    }
-  };
-  const turnRequest = buildCountersignTurnRequest(admitted, turnProjection);
-  const result2 = await runPostAdmissionOneShot({
-    admitted,
-    env,
-    io,
-    request: turnRequest,
-    adapters: countersignAdapters({
-      beforeDispatch: async (admittedSeat, lease) => {
-        if (!identityDiaristRan) {
-          await runCountersignCourtDiaristStation(admittedSeat, env, io);
-        } else if (typedTicket !== void 0) {
-          await runCountersignCourtDiaristStation(admittedSeat, env, io);
+        await materializeAdmission();
+        await markRunAdmitted(admitted, env.principalAuthority);
+        if (identityDiaristRan && typedTicket !== void 0) {
+          try {
+            await bindAdmittedTicketNumber(admitted, typedTicket);
+            await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+            await bindCourtTicketNumbersOnAdmitted(
+              admitted,
+              typedCourtTicketNumbers ?? [typedTicket]
+            );
+          } catch (error) {
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: error
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
         }
-        await relocateAdmittedRunToTicket(
-          admittedSeat,
-          env.principalAuthority,
-          lease
-        );
-        Object.assign(
-          turnRequest,
-          buildCountersignTurnRequest(admittedSeat, turnProjection)
+        const turnProjection = {
+          packageRoot: env.packageRoot,
+          home: env.home,
+          agentDir: env.agentDir,
+          ...env.model === void 0 ? {} : { model: env.model },
+          ...pickEngineAxis(env),
+          ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
+          ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
+          continuation: {
+            kind: "initial",
+            prompt: buildCountersignTransportPrompt(
+              admitted,
+              engineSessionMaterialFromOptions({
+                ...pickEngineAxis(env),
+                packageRoot: env.packageRoot
+              })
+            )
+          }
+        };
+        const turnRequest = buildCountersignTurnRequest(
+          admitted,
+          turnProjection
         );
+        const result2 = await runPostAdmissionOneShot({
+          admitted,
+          env,
+          io,
+          request: turnRequest,
+          adapters: countersignAdapters({
+            beforeDispatch: async (admittedSeat, lease) => {
+              if (!identityDiaristRan) {
+                await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              } else if (typedTicket !== void 0) {
+                await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              }
+              await relocateAdmittedRunToTicket(
+                admittedSeat,
+                env.principalAuthority,
+                lease
+              );
+              Object.assign(
+                turnRequest,
+                buildCountersignTurnRequest(admittedSeat, turnProjection)
+              );
+            }
+          }),
+          ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
+        });
+        await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+        return result2;
       }
-    }),
-    ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
-  });
-  await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-  return result2;
+    );
+  } catch (error) {
+    if (error instanceof CliUsageError) {
+      presentStructuralRejection(error, io);
+      return { exitCode: 2 };
+    }
+    throw error;
+  }
 }
 function countersignAdapters(options) {
   return {
@@ -31049,7 +31231,9 @@ async function runPublicCountersignResume(request, env, io) {
     adapters: countersignAdapters({
       beforeDispatch: async (admitted) => {
         if (admitted.courtTicketNumbersDamage !== void 0) {
-          throw new StationChildExhaustedError(admitted.courtTicketNumbersDamage);
+          throw new StationChildExhaustedError(
+            admitted.courtTicketNumbersDamage
+          );
         }
         if (env.pendingCourtTicketNumbers !== void 0) {
           await bindCourtTicketNumbersOnAdmitted(
@@ -31923,7 +32107,7 @@ var init_analyst_book_key = __esm({
 
 // src/atomic-write.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { rename as rename3, rm as rm2, writeFile as writeFile10 } from "node:fs/promises";
+import { rename as rename3, rm as rm3, writeFile as writeFile10 } from "node:fs/promises";
 import { dirname as dirname16, join as join31 } from "node:path";
 async function writeFileAtomically(destination, contents) {
   const parent = dirname16(destination);
@@ -31932,7 +32116,7 @@ async function writeFileAtomically(destination, contents) {
     await writeFile10(temporary, contents);
     await rename3(temporary, destination);
   } catch (error) {
-    await rm2(temporary, { force: true }).catch(() => void 0);
+    await rm3(temporary, { force: true }).catch(() => void 0);
     throw error;
   }
 }