@akagilnc/pi-workflow-roles 0.1.4489 → 0.1.4508

package/dist/acp-host/production-host.js

@@ -7666,10 +7666,12 @@ __export(invocation_exports, {
   deriveMergerEnvelopeFromActiveMerge: () => deriveMergerEnvelopeFromActiveMerge,
   ensureRunArtifactsDir: () => ensureRunArtifactsDir,
   freezeAttachmentsIntoRun: () => freezeAttachmentsIntoRun,
+  freezePreparedAttachmentsIntoRun: () => freezePreparedAttachmentsIntoRun,
   homeFromRunDirectory: () => homeFromRunDirectory,
   isReviewerLens: () => isReviewerLens,
   issueAdmissionPlacement: () => issueAdmissionPlacement,
   loadAdmittedJudgeRequest: () => loadAdmittedJudgeRequest,
+  materializeCountersignInvocation: () => materializeCountersignInvocation,
   observeLaunchedRolePackageIdentity: () => observeLaunchedRolePackageIdentity,
   parseAnalystArgv: () => parseAnalystArgv,
   parseAnalystCohortIssueToken: () => parseAnalystCohortIssueToken,
@@ -7693,6 +7695,7 @@ __export(invocation_exports, {
   parseReviewerArgv: () => parseReviewerArgv,
   parseSecretariatArgv: () => parseSecretariatArgv,
   persistAdmittedSourceRunPath: () => persistAdmittedSourceRunPath,
+  recordAdmittedCorrelation: () => recordAdmittedCorrelation,
   recordEffectiveInvocationModel: () => recordEffectiveInvocationModel,
   recordLaunchedPiIdentity: () => recordLaunchedPiIdentity,
   recordLaunchedRolePackageIdentity: () => recordLaunchedRolePackageIdentity,
@@ -7701,17 +7704,21 @@ __export(invocation_exports, {
   requireReviewerBaseRevision: () => requireReviewerBaseRevision,
   requireReviewerLens: () => requireReviewerLens,
   resolveDoctorCaseRunsPath: () => resolveDoctorCaseRunsPath,
-  resolveGitHubRemoteRepository: () => resolveGitHubRemoteRepository
+  resolveGitHubRemoteRepository: () => resolveGitHubRemoteRepository,
+  withPreparedAttachments: () => withPreparedAttachments
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
 import {
   lstat as lstat4,
+  mkdtemp as mkdtemp2,
   readFile as readFile10,
   realpath as realpath4,
   rename,
+  rm as rm2,
   writeFile as writeFile5
 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
 import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute7, join as join17, resolve as resolve9, sep as sep4 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
@@ -7722,7 +7729,7 @@ function issueAdmissionPlacement(authority, request) {
     runId: request.runId,
     role: request.role
   });
-  ensureRoleRunPlacement(ledgerHome, placement);
+  if (request.materialize !== false) ensureRoleRunPlacement(ledgerHome, placement);
   return {
     principal: authority.seal(placement),
     ...placement,
@@ -7847,6 +7854,31 @@ async function bindAdmittedTicketNumber(admitted, ticketNumber) {
   await bindTicketNumberOnRunDirectory(admitted.runDirectory, ticketNumber);
   admitted.ticketNumber = ticketNumber;
 }
+async function recordAdmittedCorrelation(admitted, correlationId) {
+  const current = JSON.parse(
+    await readFile10(admitted.admittedRequestPath, "utf8")
+  );
+  const prior = [
+    ...Array.isArray(current.correlationIds) ? current.correlationIds.filter(
+      (value) => typeof value === "string" && value.trim() !== ""
+    ) : [],
+    ...typeof current.correlationId === "string" && current.correlationId.trim() !== "" ? [current.correlationId] : []
+  ];
+  const correlationIds = [.../* @__PURE__ */ new Set([...prior, correlationId])];
+  await writeFile5(
+    admitted.admittedRequestPath,
+    `${JSON.stringify({ ...current, correlationId, correlationIds }, null, 2)}
+`,
+    "utf8"
+  );
+  await mergeInvocationIdentityPage(admitted.runDirectory, {
+    correlationId,
+    correlationIds
+  });
+  const mutable = admitted;
+  mutable.correlationId = correlationId;
+  mutable.correlationIds = correlationIds;
+}
 async function bindCourtTicketNumbersOnAdmitted(admitted, courtTicketNumbers) {
   if (admitted.ticketNumber === void 0) {
     throw new Error(
@@ -8237,7 +8269,7 @@ function parseFixerArgv(args) {
     ...project === void 0 ? {} : { project }
   };
 }
-async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
+async function readRegularFileAttachment(sourcePath) {
   const absolute = isAbsolute7(sourcePath) ? sourcePath : resolve9(sourcePath);
   let st;
   try {
@@ -8253,18 +8285,72 @@ async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
       `attachment must be a regular file (not a directory or symlink): ${sourcePath}`
     );
   }
-  const bytes = await readFile10(absolute);
-  const name = `${String(index).padStart(2, "0")}-${basename6(absolute)}`;
-  const frozenPath = join17(destinationDir, name);
+  try {
+    return { absolute, bytes: await readFile10(absolute) };
+  } catch (error) {
+    throw new CliUsageError(
+      `attachment is not a readable regular file: ${sourcePath}`,
+      { cause: error }
+    );
+  }
+}
+async function removePreparedAttachmentDirectory(stagingDirectory) {
+  await rm2(stagingDirectory, { recursive: true, force: true });
+}
+async function withPreparedAttachments(attachmentPaths, use) {
+  if (attachmentPaths.length === 0) return await use([]);
+  const stagingDirectory = await mkdtemp2(join17(tmpdir2(), "ak-role-attachments-"));
+  const prepared = [];
+  let result;
+  try {
+    for (let index = 0; index < attachmentPaths.length; index += 1) {
+      const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
+      const snapshotPath = join17(stagingDirectory, String(index).padStart(6, "0"));
+      await writeFile5(snapshotPath, bytes);
+      prepared.push({ absolute, snapshotPath });
+    }
+    result = await use(prepared);
+  } catch (primary) {
+    try {
+      await removePreparedAttachmentDirectory(stagingDirectory);
+    } catch (cleanup) {
+      throw new AggregateError(
+        [primary, cleanup],
+        "attachment snapshot operation failed and cleanup also failed",
+        { cause: primary }
+      );
+    }
+    throw primary;
+  }
+  await removePreparedAttachmentDirectory(stagingDirectory);
+  return result;
+}
+async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
+  const frozenPath = join17(
+    destinationDir,
+    `${String(index).padStart(2, "0")}-${basename6(provenancePath)}`
+  );
   await writeFile5(frozenPath, bytes);
   return {
-    attachment: {
-      provenancePath: absolute,
-      frozenPath,
-      byteLength: bytes.byteLength,
-      sha256: sha256Hex(bytes),
-      mediaKind: "regular-file"
-    },
+    provenancePath,
+    frozenPath,
+    byteLength: bytes.byteLength,
+    sha256: sha256Hex(bytes),
+    mediaKind: "regular-file"
+  };
+}
+async function freezePreparedAttachment(prepared, destinationDir, index) {
+  return freezeAttachmentBytes(
+    prepared.absolute,
+    await readFile10(prepared.snapshotPath),
+    destinationDir,
+    index
+  );
+}
+async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
+  const { absolute, bytes } = await readRegularFileAttachment(sourcePath);
+  return {
+    attachment: await freezeAttachmentBytes(absolute, bytes, destinationDir, index),
     body: bytes
   };
 }
@@ -8287,6 +8373,17 @@ async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKe
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
+async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
+  if (prepared.length === 0) return [];
+  const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
+  const attachmentsDirectory = summonsKey === void 0 ? join17(runDirectory, "attachments") : join17(runDirectory, "attachments", summonsKey);
+  ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+  const attachments = [];
+  for (let index = 0; index < prepared.length; index += 1) {
+    attachments.push(await freezePreparedAttachment(prepared[index], attachmentsDirectory, index));
+  }
+  return attachments;
+}
 function ticketAdmissionFields(ticketNumber) {
   if (ticketNumber === void 0) return {};
   return {
@@ -8426,9 +8523,10 @@ async function admitCountersignInvocation(options) {
     runId,
     role: "countersign",
     subject: { unbound: true },
-    home: options.home
+    home: options.home,
+    materialize: options.deferPersistence !== true
   });
-  const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
+  const attachments = options.deferPersistence === true ? [] : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
   const instruction = options.instruction;
   const instructionEmpty = instruction.trim() === "";
   const admitted = {
@@ -8450,11 +8548,13 @@ async function admitCountersignInvocation(options) {
     }))
   };
   const admittedRequestPath = join17(runDirectory, "admitted-request.json");
-  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-    sessionDirectory,
-    sessionFile
-  });
-  await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+  if (options.deferPersistence !== true) {
+    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+      sessionDirectory,
+      sessionFile
+    });
+    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+  }
   return {
     role: "countersign",
     runId,
@@ -8469,6 +8569,29 @@ async function admitCountersignInvocation(options) {
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
 }
+async function materializeCountersignInvocation(admitted, options) {
+  const placement = issueAdmissionPlacement(options.principalAuthority, {
+    cwd: admitted.projectRoot,
+    runId: admitted.runId,
+    role: "countersign",
+    subject: { unbound: true },
+    home: options.home
+  });
+  const attachments = await freezePreparedAttachmentsIntoRun(
+    options.preparedAttachments,
+    admitted.runDirectory
+  );
+  admitted.attachments = attachments;
+  await writeAdmittedRequestPersistence(admitted.admittedRequestPath, admitted, {
+    sessionDirectory: placement.sessionDirectory,
+    sessionFile: placement.sessionFile
+  });
+  await writeRoleInvocationLedger(
+    { ...admitted, sessionDirectory: placement.sessionDirectory, sessionFile: placement.sessionFile },
+    admitted.role,
+    options.model
+  );
+}
 function buildCountersignTransportPrompt(admitted, engineMaterial) {
   return buildInstructionTransportPrompt(admitted, engineMaterial);
 }
@@ -17466,8 +17589,8 @@ __export(case_dossier_delivery_exports, {
   loadCaseDossierReadingMaterial: () => loadCaseDossierReadingMaterial,
   projectCaseDossierPointerSection: () => projectCaseDossierPointerSection
 });
-import { mkdtemp as mkdtemp2, readFile as readFile18, rm as rm2, writeFile as writeFile9 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
+import { mkdtemp as mkdtemp3, readFile as readFile18, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
 import { join as join31 } from "node:path";
 async function projectCaseDossierPointerSection(input) {
   if (input.ticketNumber === void 0) {
@@ -17495,7 +17618,7 @@ async function deliverCaseDossierAsAttachment(input) {
     projectRoot: input.projectRoot,
     home: input.home
   });
-  const stagingDir = await mkdtemp2(join31(tmpdir2(), "ak-case-dossier-"));
+  const stagingDir = await mkdtemp3(join31(tmpdir3(), "ak-case-dossier-"));
   try {
     const stagingPath = join31(stagingDir, CASE_DOSSIER_ATTACH_FILE);
     await writeFile9(stagingPath, `${section}
@@ -17506,7 +17629,7 @@ async function deliverCaseDossierAsAttachment(input) {
       CASE_DOSSIER_ATTACH_KEY
     );
   } finally {
-    await rm2(stagingDir, { recursive: true, force: true });
+    await rm3(stagingDir, { recursive: true, force: true });
   }
 }
 async function loadCaseDossierReadingMaterial(runDirectory) {
@@ -19808,6 +19931,9 @@ function diaristAdapters(env) {
     shouldPresentSettled: () => true,
     // Resume interrupted state: board ticket already on pages, run still under unbound/.
     beforeDispatch: async (admitted, lease) => {
+      if (env.correlationId !== void 0 && env.correlationId.trim() !== "") {
+        await recordAdmittedCorrelation(admitted, env.correlationId);
+      }
       await bindAndRelocateDiaristIfBoardBound(admitted, env.principalAuthority, lease);
     },
     // First post-turn assert: accept hook wrote board pages; relocate before lease release.
@@ -19992,7 +20118,8 @@ function courtDiaristEscalated(roleOutcome) {
   if (roleOutcome.kind === "audit_escalation") return true;
   if (roleOutcome.kind !== "accepted") return false;
   return (roleOutcome.payloads ?? []).some((payload) => {
-    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return false;
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+      return false;
     const record4 = payload;
     return record4.status === "escalate" || record4.countersignStatus === "escalate";
   });
@@ -20045,7 +20172,10 @@ async function invokeCourtDiarist(input, env, io) {
   }
   const asserted = result.admitted?.ticketNumber;
   if (isSafePositiveTicketNumber(asserted)) {
-    const courtTicketNumbers = courtTicketNumbersFromOutcome(roleOutcome, asserted);
+    const courtTicketNumbers = courtTicketNumbersFromOutcome(
+      roleOutcome,
+      asserted
+    );
     return {
       identity: {
         kind: "ticket",
@@ -20094,7 +20224,9 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
       );
     }
     if (outcome.failedWithoutEscalate !== void 0) {
-      throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+      throw new StationChildExhaustedError(
+        outcome.failedWithoutEscalate.diagnostic
+      );
     }
   }
 }
@@ -20120,7 +20252,8 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
       ...parsed.project === void 0 ? {} : { project: parsed.project },
       ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
       ...env.model === void 0 ? {} : { model: env.model },
-      ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId }
+      ...env.correlationId === void 0 ? {} : { correlationId: env.correlationId },
+      deferPersistence: true
     });
   } catch (error) {
     if (error instanceof CliUsageError) {
@@ -20129,160 +20262,216 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
     }
     throw error;
   }
-  await markRunAdmitted(admitted, env.principalAuthority);
-  let typedTicket;
-  let typedCourtTicketNumbers;
-  let identityDiaristRan = false;
-  if (env.runCourtDiaristStation === void 0) {
-    const outcome = await invokeCourtDiarist(
-      {
-        instruction: parsed.instruction,
-        projectRoot: admitted.projectRoot,
-        failureLabel: "unbound summons",
-        correlationId: admitted.runId
-      },
-      env,
-      io
-    );
-    identityDiaristRan = true;
-    if (outcome.identity.kind === "escalate") {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: new Error(
-            "court diarist station escalated (cannot identify court target)"
-          )
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-    if (outcome.failedWithoutEscalate !== void 0) {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-    if (outcome.identity.kind === "ticket") {
-      const assertedTicket = outcome.identity.ticketNumber;
-      typedTicket = assertedTicket;
-      typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
-      const summons = {
-        instruction: parsed.instruction,
-        instructionEmpty: parsed.instruction.trim() === "",
-        attachmentPaths: parsed.attachmentPaths
-      };
-      const resumed = await tryResumeSameTicketSeatRun({
-        home: env.home,
-        projectRoot: admitted.projectRoot,
-        role: "countersign",
-        ticketNumber: typedTicket,
-        freshSummons: env.freshSummons,
-        summons,
-        resume: async (runId, materials) => {
-          await bindAdmittedTicketNumber(admitted, assertedTicket);
-          await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-          await markRunTerminal(admitted.runDirectory);
-          return await runPublicCountersignResume(
-            {
-              runId,
-              ...materials === void 0 ? {} : { summons: materials }
-            },
-            {
-              ...env,
-              ...typedCourtTicketNumbers === void 0 ? {} : { pendingCourtTicketNumbers: typedCourtTicketNumbers }
-            },
-            io
-          );
+  try {
+    return await withPreparedAttachments(
+      parsed.attachmentPaths,
+      async (preparedAttachments) => {
+        const materializeAdmission = async () => {
+          await materializeCountersignInvocation(admitted, {
+            home: env.home,
+            principalAuthority: env.principalAuthority,
+            preparedAttachments,
+            ...env.model === void 0 ? {} : { model: env.model }
+          });
+        };
+        let typedTicket;
+        let typedCourtTicketNumbers;
+        let identityDiaristRan = false;
+        if (env.runCourtDiaristStation === void 0) {
+          let outcome;
+          try {
+            outcome = await invokeCourtDiarist(
+              {
+                instruction: parsed.instruction,
+                projectRoot: admitted.projectRoot,
+                failureLabel: "unbound summons"
+              },
+              env,
+              io
+            );
+          } catch (error) {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              { timedOut: false, code: null, stderr: "", thrown: error },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          identityDiaristRan = true;
+          if (outcome.identity.kind === "escalate") {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(
+                  "court diarist station escalated (cannot identify court target)"
+                )
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          if (outcome.failedWithoutEscalate !== void 0) {
+            await materializeAdmission();
+            await markRunAdmitted(admitted, env.principalAuthority);
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
+          if (outcome.identity.kind === "ticket") {
+            const assertedTicket = outcome.identity.ticketNumber;
+            typedTicket = assertedTicket;
+            typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+            const summons = {
+              instruction: parsed.instruction,
+              instructionEmpty: parsed.instruction.trim() === ""
+            };
+            const resumed = await tryResumeSameTicketSeatRun({
+              home: env.home,
+              projectRoot: admitted.projectRoot,
+              role: "countersign",
+              ticketNumber: typedTicket,
+              freshSummons: env.freshSummons,
+              summons,
+              resume: async (runId, materials) => {
+                const retained = await loadResumableCountersignRun(
+                  env.home,
+                  runId,
+                  env.principalAuthority
+                );
+                if (retained.admitted === void 0) {
+                  throw new Error(
+                    `retained countersign run disappeared before resume: ${runId}`
+                  );
+                }
+                const frozenPaths = (await freezePreparedAttachmentsIntoRun(
+                  preparedAttachments,
+                  retained.admitted.runDirectory,
+                  `s-${Date.now().toString(36)}`
+                )).map((attachment) => attachment.frozenPath);
+                const preparedMaterials = {
+                  ...materials ?? {},
+                  ...frozenPaths.length === 0 ? {} : { attachmentPaths: frozenPaths }
+                };
+                return await runPublicCountersignResume(
+                  {
+                    runId,
+                    summons: preparedMaterials
+                  },
+                  {
+                    ...env,
+                    ...typedCourtTicketNumbers === void 0 ? {} : { pendingCourtTicketNumbers: typedCourtTicketNumbers }
+                  },
+                  io
+                );
+              }
+            });
+            if (resumed !== void 0) {
+              return resumed;
+            }
+          }
         }
-      });
-      if (resumed !== void 0) {
-        return resumed;
-      }
-    }
-  }
-  if (identityDiaristRan && typedTicket !== void 0) {
-    try {
-      await bindAdmittedTicketNumber(admitted, typedTicket);
-      await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-      await bindCourtTicketNumbersOnAdmitted(
-        admitted,
-        typedCourtTicketNumbers ?? [typedTicket]
-      );
-    } catch (error) {
-      return await presentControlledFailure2(
-        admitted,
-        {
-          timedOut: false,
-          code: null,
-          stderr: "",
-          thrown: error
-        },
-        countersignAdapters(),
-        env.principalAuthority,
-        io
-      );
-    }
-  }
-  const turnProjection = {
-    packageRoot: env.packageRoot,
-    home: env.home,
-    agentDir: env.agentDir,
-    ...env.model === void 0 ? {} : { model: env.model },
-    ...pickEngineAxis(env),
-    ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
-    ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
-    continuation: {
-      kind: "initial",
-      prompt: buildCountersignTransportPrompt(
-        admitted,
-        engineSessionMaterialFromOptions({
-          ...pickEngineAxis(env),
-          packageRoot: env.packageRoot
-        })
-      )
-    }
-  };
-  const turnRequest = buildCountersignTurnRequest(admitted, turnProjection);
-  const result = await runPostAdmissionOneShot({
-    admitted,
-    env,
-    io,
-    request: turnRequest,
-    adapters: countersignAdapters({
-      beforeDispatch: async (admittedSeat, lease) => {
-        if (!identityDiaristRan) {
-          await runCountersignCourtDiaristStation(admittedSeat, env, io);
-        } else if (typedTicket !== void 0) {
-          await runCountersignCourtDiaristStation(admittedSeat, env, io);
+        await materializeAdmission();
+        await markRunAdmitted(admitted, env.principalAuthority);
+        if (identityDiaristRan && typedTicket !== void 0) {
+          try {
+            await bindAdmittedTicketNumber(admitted, typedTicket);
+            await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+            await bindCourtTicketNumbersOnAdmitted(
+              admitted,
+              typedCourtTicketNumbers ?? [typedTicket]
+            );
+          } catch (error) {
+            return await presentControlledFailure2(
+              admitted,
+              {
+                timedOut: false,
+                code: null,
+                stderr: "",
+                thrown: error
+              },
+              countersignAdapters(),
+              env.principalAuthority,
+              io
+            );
+          }
         }
-        await relocateAdmittedRunToTicket(
-          admittedSeat,
-          env.principalAuthority,
-          lease
-        );
-        Object.assign(
-          turnRequest,
-          buildCountersignTurnRequest(admittedSeat, turnProjection)
+        const turnProjection = {
+          packageRoot: env.packageRoot,
+          home: env.home,
+          agentDir: env.agentDir,
+          ...env.model === void 0 ? {} : { model: env.model },
+          ...pickEngineAxis(env),
+          ...env.timeoutMs === void 0 ? {} : { timeoutMs: env.timeoutMs },
+          ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
+          continuation: {
+            kind: "initial",
+            prompt: buildCountersignTransportPrompt(
+              admitted,
+              engineSessionMaterialFromOptions({
+                ...pickEngineAxis(env),
+                packageRoot: env.packageRoot
+              })
+            )
+          }
+        };
+        const turnRequest = buildCountersignTurnRequest(
+          admitted,
+          turnProjection
         );
+        const result = await runPostAdmissionOneShot({
+          admitted,
+          env,
+          io,
+          request: turnRequest,
+          adapters: countersignAdapters({
+            beforeDispatch: async (admittedSeat, lease) => {
+              if (!identityDiaristRan) {
+                await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              } else if (typedTicket !== void 0) {
+                await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              }
+              await relocateAdmittedRunToTicket(
+                admittedSeat,
+                env.principalAuthority,
+                lease
+              );
+              Object.assign(
+                turnRequest,
+                buildCountersignTurnRequest(admittedSeat, turnProjection)
+              );
+            }
+          }),
+          ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
+        });
+        await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+        return result;
       }
-    }),
-    ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
-  });
-  await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-  return result;
+    );
+  } catch (error) {
+    if (error instanceof CliUsageError) {
+      presentStructuralRejection(error, io);
+      return { exitCode: 2 };
+    }
+    throw error;
+  }
 }
 function countersignAdapters(options) {
   return {
@@ -20320,7 +20509,9 @@ async function runPublicCountersignResume(request, env, io) {
     adapters: countersignAdapters({
       beforeDispatch: async (admitted) => {
         if (admitted.courtTicketNumbersDamage !== void 0) {
-          throw new StationChildExhaustedError(admitted.courtTicketNumbersDamage);
+          throw new StationChildExhaustedError(
+            admitted.courtTicketNumbersDamage
+          );
         }
         if (env.pendingCourtTicketNumbers !== void 0) {
           await bindCourtTicketNumbersOnAdmitted(
@@ -21417,7 +21608,7 @@ import { join as join38, sep as sep5 } from "node:path";
 
 // src/atomic-write.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { rename as rename3, rm as rm3, writeFile as writeFile11 } from "node:fs/promises";
+import { rename as rename3, rm as rm4, writeFile as writeFile11 } from "node:fs/promises";
 import { dirname as dirname20, join as join37 } from "node:path";
 async function writeFileAtomically(destination, contents) {
   const parent = dirname20(destination);
@@ -21426,7 +21617,7 @@ async function writeFileAtomically(destination, contents) {
     await writeFile11(temporary, contents);
     await rename3(temporary, destination);
   } catch (error) {
-    await rm3(temporary, { force: true }).catch(() => void 0);
+    await rm4(temporary, { force: true }).catch(() => void 0);
     throw error;
   }
 }