@akagilnc/pi-workflow-roles 0.1.4620 → 0.1.4641

package/dist/headless-host/production-host.js

@@ -417,7 +417,7 @@ function normalizeReviewComment(raw) {
 function createGhApiRunner(options = {}) {
   const spawnImpl = options.spawnImpl ?? spawn;
   return async (args, runOptions = {}) => {
-    return await new Promise((resolve22, reject) => {
+    return await new Promise((resolve21, reject) => {
       const signal = runOptions.signal;
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("aborted"));
@@ -490,11 +490,11 @@ function createGhApiRunner(options = {}) {
               const value = line2.slice(idx + 1).trim();
               headers[name] = value;
             }
-            resolve22({ status, headers, bodyText });
+            resolve21({ status, headers, bodyText });
             return;
           }
           if (code === 0) {
-            resolve22({ status: 200, headers: {}, bodyText: stdout });
+            resolve21({ status: 200, headers: {}, bodyText: stdout });
             return;
           }
           const failure2 = new Error(
@@ -691,7 +691,6 @@ var activation_ledger_topology_exports = {};
 __export(activation_ledger_topology_exports, {
   ActivationLedgerError: () => ActivationLedgerError,
   activationBookDirectory: () => activationBookDirectory,
-  activationWaitingLedgerPath: () => activationWaitingLedgerPath,
   assertLedgerFileInsideHome: () => assertLedgerFileInsideHome,
   ensureRealDirectoryTree: () => ensureRealDirectoryTree,
   errnoCode: () => errnoCode,
@@ -754,9 +753,6 @@ function resolveActivationLedgerHomeForPath(path) {
 function activationBookDirectory(ledgerHome, bookKey) {
   return join(ledgerHome, "books", bookKey);
 }
-function activationWaitingLedgerPath(ledgerHome, bookKey) {
-  return join(activationBookDirectory(ledgerHome, bookKey), "waiting.jsonl");
-}
 function pathContainedIn(root, candidate) {
   const rel = relative(root, candidate);
   return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
@@ -968,6 +964,15 @@ var init_activation_ledger_topology = __esm({
 });
 
 // src/run-ticket-number.ts
+var run_ticket_number_exports = {};
+__export(run_ticket_number_exports, {
+  MIGRATION_TICKET_DERIVATION_PAGE: () => MIGRATION_TICKET_DERIVATION_PAGE,
+  isSafePositiveTicketNumber: () => isSafePositiveTicketNumber,
+  readBoardTicketNumber: () => readBoardTicketNumber,
+  readMigrationDerivedTicketNumber: () => readMigrationDerivedTicketNumber,
+  readRunTicketNumber: () => readRunTicketNumber,
+  requireSafePositiveTicketNumber: () => requireSafePositiveTicketNumber
+});
 import { readFile as readFile3 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 function isEnoent(error) {
@@ -1007,9 +1012,22 @@ async function readBoardPageTicketNumber(runDirectory, page) {
 async function readBoardTicketNumber(runDirectory) {
   return await readBoardPageTicketNumber(runDirectory, "admitted-request.json") ?? await readBoardPageTicketNumber(runDirectory, "invocation.json");
 }
+async function readMigrationDerivedTicketNumber(runDirectory) {
+  const record4 = await readJsonObject(
+    join2(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE)
+  );
+  if (record4 === void 0) return void 0;
+  if (record4.derivation !== "worktree-path-basename") return void 0;
+  return ticketFromRecord(record4);
+}
+async function readRunTicketNumber(runDirectory) {
+  return await readBoardTicketNumber(runDirectory) ?? await readMigrationDerivedTicketNumber(runDirectory);
+}
+var MIGRATION_TICKET_DERIVATION_PAGE;
 var init_run_ticket_number = __esm({
   "src/run-ticket-number.ts"() {
     "use strict";
+    MIGRATION_TICKET_DERIVATION_PAGE = "migration-ticket-derivation.json";
   }
 });
 
@@ -1392,15 +1410,165 @@ var init_gatekeeper_output = __esm({
   }
 });
 
+// src/run-terminal-artifacts.ts
+var run_terminal_artifacts_exports = {};
+__export(run_terminal_artifacts_exports, {
+  RUN_TERMINAL_ARTIFACT_FILES: () => RUN_TERMINAL_ARTIFACT_FILES,
+  RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS: () => RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS,
+  isUniqueErrorFallbackName: () => isUniqueErrorFallbackName,
+  readRunTerminalArtifact: () => readRunTerminalArtifact,
+  runIdFromRunDirectory: () => runIdFromRunDirectory
+});
+import { readdir as readdir2, readFile as readFile4 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname4, join as join5 } from "node:path";
+function isMissingPathError2(error) {
+  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+function errorText2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readUsableTerminalArtifactBody(body) {
+  if (body === null) {
+    return { ok: false, reason: "terminal artifact JSON value is null" };
+  }
+  if (!isRecord2(body)) {
+    return {
+      ok: false,
+      reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`
+    };
+  }
+  if (typeof body.role !== "string" || body.role.trim() === "") {
+    return {
+      ok: false,
+      reason: "terminal artifact missing nonblank producer-owned role field"
+    };
+  }
+  return { ok: true, body };
+}
+async function readTerminalArtifactAtPath(path, file) {
+  let raw;
+  try {
+    raw = await readFile4(path, "utf8");
+  } catch (error) {
+    if (isMissingPathError2(error)) return void 0;
+    return {
+      status: "unreadable",
+      file,
+      path,
+      reason: errorText2(error)
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return {
+      status: "unreadable",
+      file,
+      path,
+      reason: error instanceof Error ? error.message : `terminal artifact JSON parse failed: ${String(error)}`
+    };
+  }
+  const usable = readUsableTerminalArtifactBody(parsed);
+  if (!usable.ok) {
+    return {
+      status: "unreadable",
+      file,
+      path,
+      reason: usable.reason
+    };
+  }
+  return { status: "present", file, path, body: usable.body };
+}
+async function listUniqueErrorFallbackPaths(directories) {
+  const found = [];
+  for (const dir of directories) {
+    let names;
+    try {
+      names = await readdir2(dir);
+    } catch (error) {
+      if (isMissingPathError2(error)) continue;
+      throw error;
+    }
+    for (const name of names.sort((a, b) => a.localeCompare(b))) {
+      if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
+      found.push(join5(dir, name));
+    }
+  }
+  return found;
+}
+function runIdFromRunDirectory(runDirectory) {
+  const name = basename2(runDirectory);
+  const at = name.lastIndexOf("@");
+  if (at <= 0 || at === name.length - 1) return void 0;
+  return name.slice(0, at);
+}
+function presentUniqueFallbackBoundToRun(body, expectedRunId) {
+  if (expectedRunId === void 0) return false;
+  return typeof body.runId === "string" && body.runId === expectedRunId;
+}
+async function readRunTerminalArtifact(runDirectory) {
+  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
+  for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
+    const path = join5(artifactsDir, file);
+    const read = await readTerminalArtifactAtPath(path, file);
+    if (read !== void 0) return read;
+  }
+  for (const relative4 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
+    const path = join5(runDirectory, relative4);
+    const read = await readTerminalArtifactAtPath(path, "error.json");
+    if (read !== void 0) return read;
+  }
+  for (const path of await listUniqueErrorFallbackPaths([artifactsDir, runDirectory])) {
+    const read = await readTerminalArtifactAtPath(path, "error.json");
+    if (read !== void 0) return read;
+  }
+  const expectedRunId = runIdFromRunDirectory(runDirectory);
+  for (const path of await listUniqueErrorFallbackPaths([dirname4(runDirectory)])) {
+    const read = await readTerminalArtifactAtPath(path, "error.json");
+    if (read === void 0) continue;
+    if (read.status === "present") {
+      if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId)) continue;
+      return read;
+    }
+  }
+  return { status: "absent" };
+}
+function isUniqueErrorFallbackName(name) {
+  return UNIQUE_ERROR_FALLBACK_NAME.test(basename2(name));
+}
+var RUN_TERMINAL_ARTIFACT_FILES, RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS, UNIQUE_ERROR_FALLBACK_NAME;
+var init_run_terminal_artifacts = __esm({
+  "src/run-terminal-artifacts.ts"() {
+    "use strict";
+    init_role_run_placement();
+    RUN_TERMINAL_ARTIFACT_FILES = [
+      "report.json",
+      "error.json",
+      "audit-incomplete.json"
+    ];
+    RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS = [
+      "artifacts/error.settlement.json",
+      "error.settlement.json"
+    ];
+    UNIQUE_ERROR_FALLBACK_NAME = /^error\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json$/i;
+  }
+});
+
 // src/gatekeeper-role.ts
 function gateSeatLabel(stage) {
   if (stage === "inspector") return "\u53F0\u9662";
   if (stage === "auditor") return "\u5BA1\u5211\u9662";
+  if (stage === "countersign") return "\u7ED9\u4E8B\u4E2D";
   return "\u7B26\u5B9D\u90CE";
 }
 function gateOfficerForSubject(subject) {
   if (subject.kind === "worker_completion") return "inspector";
   if (subject.kind === "judge_compliance") return "auditor";
+  if (subject.kind === "secretariat_verdict") return "countersign";
   return "notary";
 }
 function failureReason(error) {
@@ -1414,9 +1582,26 @@ function readRecord(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
   return value;
 }
+function gateStatusFromCountersign(status) {
+  if (status === "converged") return "pass";
+  if (status === "continue") return "bounce";
+  if (status === "escalate") return "escalate";
+  return void 0;
+}
 function projectOfficerDecision(officer, decision, fallbackStatus) {
   const receipt = retainedReceipt(decision);
   const record4 = readRecord(decision);
+  if (officer === "countersign") {
+    const countersignStatus = record4 !== void 0 && typeof record4.countersignStatus === "string" ? record4.countersignStatus : void 0;
+    const status2 = typeof countersignStatus === "string" ? gateStatusFromCountersign(countersignStatus) : void 0;
+    if (status2 === "pass") {
+      return { status: "pass", officer, receipt };
+    }
+    if (status2 === "bounce" || status2 === "escalate") {
+      return { status: status2, officer, receipt };
+    }
+    return { status: "needs_reask", officer, receipt };
+  }
   const status = (record4 !== void 0 && typeof record4.status === "string" ? record4.status : void 0) ?? fallbackStatus;
   if (status === "pass") {
     return { status: "pass", officer, receipt };
@@ -1447,6 +1632,26 @@ function projectOfficerPayloads(officer, payloads, fallbackStatus) {
   }
   return projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
 }
+function officerRunIdFromSummoned(summoned) {
+  if (typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== "") {
+    const fromDir = runIdFromRunDirectory(summoned.runDirectory);
+    if (fromDir !== void 0) return fromDir;
+  }
+  const terminal = summoned.terminal;
+  if (terminal !== void 0 && typeof terminal.runId === "string" && terminal.runId.trim() !== "") {
+    return terminal.runId;
+  }
+  return void 0;
+}
+function withOfficerRunId(result, summoned) {
+  if (result.status !== "pass" && result.status !== "bounce" && result.status !== "escalate" && result.status !== "needs_reask") {
+    return result;
+  }
+  if (typeof result.runId === "string" && result.runId.trim() !== "") return result;
+  const runId = officerRunIdFromSummoned(summoned);
+  if (runId === void 0) return result;
+  return { ...result, runId };
+}
 function projectOfficerTerminal(officer, summoned) {
   const terminal = summoned.terminal;
   const outcome = terminal?.roleOutcome;
@@ -1479,22 +1684,34 @@ function projectOfficerTerminal(officer, summoned) {
     };
   }
   if (outcome.kind === "audit_escalation") {
-    return {
-      status: "escalate",
-      officer,
-      // This-court receipt only (#879) — historical rows remain on terminal.submissions.
-      receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome)
-    };
+    return withOfficerRunId(
+      {
+        status: "escalate",
+        officer,
+        // This-court receipt only (#879) — historical rows remain on terminal.submissions.
+        receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome)
+      },
+      summoned
+    );
   }
   if (outcome.kind === "accepted") {
-    return projectOfficerPayloads(officer, thisCourt, outcome.status);
+    return withOfficerRunId(
+      projectOfficerPayloads(officer, thisCourt, outcome.status),
+      summoned
+    );
   }
-  return {
-    status: "needs_reask",
-    officer,
-    // This-court receipt only (#879).
-    receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome)
-  };
+  return withOfficerRunId(
+    {
+      status: "needs_reask",
+      officer,
+      // This-court receipt only (#879).
+      receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome)
+    },
+    summoned
+  );
+}
+function officerConclusionReask(officer) {
+  return officer === "countersign" ? COUNTERSIGN_CONCLUSION_REASK : OFFICER_CONCLUSION_REASK;
 }
 async function projectGatekeeperRun(options) {
   const officer = gateOfficerForSubject(options.subject);
@@ -1530,7 +1747,7 @@ async function projectGatekeeperRun(options) {
     summoned
   };
 }
-var GATEKEEPER_TOOL_SPEC, OFFICER_CONCLUSION_REASK;
+var GATEKEEPER_TOOL_SPEC, OFFICER_CONCLUSION_REASK, COUNTERSIGN_CONCLUSION_REASK;
 var init_gatekeeper_role = __esm({
   "src/gatekeeper-role.ts"() {
     "use strict";
@@ -1538,6 +1755,7 @@ var init_gatekeeper_role = __esm({
     init_submission_errors();
     init_inspector_contracts();
     init_gatekeeper_output();
+    init_run_terminal_artifacts();
     init_submission_errors();
     GATEKEEPER_TOOL_SPEC = {
       name: GATEKEEPER_OUTPUT_TOOL_NAME,
@@ -1547,6 +1765,7 @@ var init_gatekeeper_role = __esm({
       parameters: gatekeeperOutputSchema
     };
     OFFICER_CONCLUSION_REASK = "\u4E0A\u6B21\u4EA4\u5377\u7684\u7ED3\u8BBA\u4E0D\u662F pass\u3001bounce\u3001escalate \u4E09\u6001\u4E4B\u4E00\u3002\u8BF7\u91CD\u65B0\u8F93\u51FA\uFF0C\u7ED3\u8BBA\u5B57\u6BB5\u5199\u660E\u5176\u4E00\uFF1B\u6253\u56DE\u6216\u4E0A\u5448\u7684\u8BDD\u5C31\u662F\u7ED9\u5BF9\u65B9\u770B\u7684\u539F\u6587\u3002";
+    COUNTERSIGN_CONCLUSION_REASK = "\u4E0A\u6B21\u4EA4\u5377\u7684 countersignStatus \u4E0D\u662F converged\u3001continue\u3001escalate \u4E09\u6001\u4E4B\u4E00\u3002\u8BF7\u91CD\u65B0\u8F93\u51FA\uFF0CcountersignStatus \u5199\u660E\u5176\u4E00\uFF1B\u5C01\u9A73\u6216\u4E0A\u5448\u7684\u8BDD\u5C31\u662F\u7ED9\u5BF9\u65B9\u770B\u7684\u539F\u6587\u3002";
   }
 });
 
@@ -1557,12 +1776,12 @@ __export(session_assistant_usage_exports, {
   sessionFileFromPublicSummon: () => sessionFileFromPublicSummon,
   usageFromPublicSummon: () => usageFromPublicSummon
 });
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 async function readAssistantUsageFromSessionFile(sessionFile) {
-  const { readFile: readFile23 } = await import("node:fs/promises");
+  const { readFile: readFile24 } = await import("node:fs/promises");
   let text;
   try {
-    text = await readFile23(sessionFile, "utf8");
+    text = await readFile24(sessionFile, "utf8");
   } catch (error) {
     if (error?.code === "ENOENT") return void 0;
     throw error;
@@ -1627,7 +1846,7 @@ async function readAssistantUsageFromSessionFile(sessionFile) {
 }
 function sessionFileFromPublicSummon(summoned) {
   if (typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== "") {
-    return join5(summoned.runDirectory, "session", "session.jsonl");
+    return join6(summoned.runDirectory, "session", "session.jsonl");
   }
   const fromArtifacts = summoned.terminal?.artifacts?.map((a) => a.path).find((p) => typeof p === "string" && p.endsWith("session.jsonl"));
   if (fromArtifacts !== void 0) return fromArtifacts;
@@ -1636,7 +1855,7 @@ function sessionFileFromPublicSummon(summoned) {
   const facts = outcome.decisiveFacts;
   const pointer = facts?.runPointer;
   if (typeof pointer === "string" && pointer.trim() !== "") {
-    return join5(pointer, "session", "session.jsonl");
+    return join6(pointer, "session", "session.jsonl");
   }
   return void 0;
 }
@@ -1653,7 +1872,7 @@ var init_session_assistant_usage = __esm({
 
 // src/package-resources/engine-material.ts
 import { existsSync, readdirSync } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 function pickEngineAxis(source) {
   return {
     ...source.engine === void 0 ? {} : { engine: source.engine },
@@ -1674,11 +1893,11 @@ function isEngineNameSyntax(name) {
   return true;
 }
 function resolveEngineMaterialDirectory(packageRoot) {
-  return join6(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
+  return join7(packageRoot, ENGINE_MATERIAL_RELATIVE_ROOT);
 }
 function resolveEngineMaterialPath(packageRoot, name) {
   const legal = assertLegalEngineName(name);
-  return join6(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
+  return join7(resolveEngineMaterialDirectory(packageRoot), `${legal}.md`);
 }
 function assertLegalEngineName(name) {
   if (!isEngineNameSyntax(name)) {
@@ -1731,7 +1950,7 @@ var init_engine_material = __esm({
 
 // src/activation-ledger-git.ts
 import { execFileSync } from "node:child_process";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
+import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute2, resolve as resolve4 } from "node:path";
 function envWithoutGitDiscovery(base = process.env) {
   const env = { ...base, LC_ALL: "C" };
   for (const key of GIT_DISCOVERY_ENV_KEYS) {
@@ -1776,8 +1995,8 @@ function resolveBookKeyFromGit(cwd) {
     throw new Error("git rev-parse --git-common-dir returned an empty path");
   }
   const absoluteCommon = isAbsolute2(commonDir) ? commonDir : resolve4(cwd, commonDir);
-  const hostDirectory = basename2(absoluteCommon) === ".git" ? dirname4(absoluteCommon) : absoluteCommon;
-  const bookKey = basename2(hostDirectory);
+  const hostDirectory = basename3(absoluteCommon) === ".git" ? dirname5(absoluteCommon) : absoluteCommon;
+  const bookKey = basename3(hostDirectory);
   if (bookKey.length === 0 || bookKey === "." || bookKey === "/") {
     throw new Error(`Unable to derive activation book key from git common dir: ${absoluteCommon}`);
   }
@@ -1817,7 +2036,7 @@ __export(durable_principal_exports, {
   piDurablePrincipalAuthority: () => piDurablePrincipalAuthority
 });
 import { lstat } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { join as join8 } from "node:path";
 function encode(coordinates) {
   return coordinates;
 }
@@ -1867,7 +2086,7 @@ var init_durable_principal = __esm({
         }
         return {
           sessionDirectory: record4.sessionDirectory,
-          sessionFile: typeof record4.sessionFile === "string" && record4.sessionFile.trim() !== "" ? record4.sessionFile : join7(record4.sessionDirectory, "session.jsonl")
+          sessionFile: typeof record4.sessionFile === "string" && record4.sessionFile.trim() !== "" ? record4.sessionFile : join8(record4.sessionDirectory, "session.jsonl")
         };
       },
       async isAvailable(principal) {
@@ -1919,7 +2138,7 @@ var init_host_contracts = __esm({
 import { spawn as spawn2 } from "node:child_process";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function normalizeEngineName(engine) {
   if (engine === void 0) return void 0;
   const trimmed = engine.trim();
@@ -1964,7 +2183,7 @@ async function spawnEngineDetourOnce(input) {
   }
   const command = input.argv[0];
   const args = input.argv.slice(1);
-  return await new Promise((resolve22, reject) => {
+  return await new Promise((resolve21, reject) => {
     let settled = false;
     const signal = input.signal;
     const child = spawn2(command, args, {
@@ -1994,7 +2213,7 @@ async function spawnEngineDetourOnce(input) {
       if (signal !== void 0) {
         signal.removeEventListener("abort", onAbort);
       }
-      resolve22(result);
+      resolve21(result);
     };
     const onAbort = () => {
       fail4(signal !== void 0 ? abortReasonError(signal) : new Error("aborted"));
@@ -2020,8 +2239,8 @@ async function runEngineDetourOnce(input) {
   if (input.stagedPrompt === void 0) {
     return spawnEngineDetourOnce(input);
   }
-  const stagingDir = await mkdtemp(join8(tmpdir(), "ak-engine-detour-"));
-  const stagedPath = join8(stagingDir, "prompt.txt");
+  const stagingDir = await mkdtemp(join9(tmpdir(), "ak-engine-detour-"));
+  const stagedPath = join9(stagingDir, "prompt.txt");
   let result;
   let runError;
   try {
@@ -2657,7 +2876,7 @@ var init_auditor_output = __esm({
 });
 
 // src/ticket-provenance-contracts.ts
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function positiveInteger(value) {
@@ -2680,7 +2899,7 @@ function projectSpeaker(value) {
   return value === "owner" || value === "runner" ? value : void 0;
 }
 function projectBound(value) {
-  if (!isRecord2(value)) return void 0;
+  if (!isRecord3(value)) return void 0;
   const id = typeof value.id === "string" && value.id !== "" ? value.id : void 0;
   const line2 = positiveInteger(value.line);
   if (id === void 0 && line2 === void 0) return void 0;
@@ -2691,13 +2910,13 @@ function projectTicketProvenanceSessions(value) {
   if (value.length === 0) return [];
   const sessions = [];
   for (const raw of value) {
-    if (!isRecord2(raw)) return void 0;
+    if (!isRecord3(raw)) return void 0;
     const path = raw.path;
     if (typeof path !== "string" || path.trim() === "") return void 0;
     if (!Array.isArray(raw.ranges) || raw.ranges.length === 0) return void 0;
     const ranges = [];
     for (const rawRange of raw.ranges) {
-      if (!isRecord2(rawRange)) return void 0;
+      if (!isRecord3(rawRange)) return void 0;
       const from = projectBound(rawRange.from);
       const to = projectBound(rawRange.to);
       if (from === void 0 || to === void 0) return void 0;
@@ -2708,7 +2927,7 @@ function projectTicketProvenanceSessions(value) {
   return sessions;
 }
 function projectTicketProvenanceHeader(value) {
-  if (!isRecord2(value)) return void 0;
+  if (!isRecord3(value)) return void 0;
   const ticket = positiveInteger(value.ticket);
   if (ticket === void 0) return void 0;
   if (typeof value.repo !== "string") return void 0;
@@ -2726,7 +2945,7 @@ function projectTicketProvenanceHeader(value) {
   };
 }
 function projectTicketProvenanceLine(value) {
-  if (!isRecord2(value)) return void 0;
+  if (!isRecord3(value)) return void 0;
   const speaker = projectSpeaker(value.speaker);
   const s = nonNegativeInteger(value.s);
   if (speaker === void 0 || s === void 0) return void 0;
@@ -2842,13 +3061,23 @@ var init_diarist_contracts = __esm({
 });
 
 // src/secretariat-contracts.ts
-var SECRETARIAT_OUTPUT_TOOL_NAME, SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME, SECRETARIAT_ACCEPTED_TEXT;
+var secretariat_contracts_exports = {};
+__export(secretariat_contracts_exports, {
+  SECRETARIAT_ACCEPTED_TEXT: () => SECRETARIAT_ACCEPTED_TEXT,
+  SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY: () => SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY,
+  SECRETARIAT_GATE_OFFICER_ENTRY_TYPE: () => SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
+  SECRETARIAT_OUTPUT_TOOL_NAME: () => SECRETARIAT_OUTPUT_TOOL_NAME,
+  SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME: () => SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME
+});
+var SECRETARIAT_OUTPUT_TOOL_NAME, SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME, SECRETARIAT_ACCEPTED_TEXT, SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY;
 var init_secretariat_contracts = __esm({
   "src/secretariat-contracts.ts"() {
     "use strict";
     SECRETARIAT_OUTPUT_TOOL_NAME = "ak_secretariat_output";
     SECRETARIAT_SUMMON_COUNTERSIGN_TOOL_NAME = "ak_secretariat_summon_countersign";
     SECRETARIAT_ACCEPTED_TEXT = "\u4E2D\u4E66\u7701\u56DE\u6267\u5DF2\u63A5\u53D7";
+    SECRETARIAT_GATE_OFFICER_ENTRY_TYPE = "ak-secretariat-gate-officer";
+    SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY = "countersignTerminal";
   }
 });
 
@@ -3195,8 +3424,8 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
-function isRecord3(value) {
+import { dirname as dirname6, join as join10 } from "node:path";
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorCodeOf(error) {
@@ -3224,7 +3453,7 @@ function findIdentityPointer(recordFile, identity, kind, level) {
     if (!trimmed) continue;
     try {
       const parsed = JSON.parse(trimmed);
-      if (isRecord3(parsed) && parsed.identity === identity) {
+      if (isRecord4(parsed) && parsed.identity === identity) {
         return { identity, recordFile, kind, level };
       }
     } catch {
@@ -3323,8 +3552,8 @@ function resolveSitianVolumeCategory(kind) {
   return kind;
 }
 function ticketProvenanceUnderBookPaths(ledgerHome, bookKey, ticketId) {
-  const sessionDir = join9(activationBookDirectory(ledgerHome, bookKey), ticketId);
-  return { sessionDir, recordFile: join9(sessionDir, SITIAN_RECORDS_LEAF) };
+  const sessionDir = join10(activationBookDirectory(ledgerHome, bookKey), ticketId);
+  return { sessionDir, recordFile: join10(sessionDir, SITIAN_RECORDS_LEAF) };
 }
 function resolveSitianRecordPathInLedger(input, ledgerHome) {
   const category = resolveSitianVolumeCategory(input.kind);
@@ -3343,14 +3572,14 @@ function resolveSitianRecordPathInLedger(input, ledgerHome) {
     if (input.sessionParent === void 0 || input.sessionParent.length === 0 || !physicallyContainedIn(ledgerHome, input.sessionParent)) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = join9(dirname5(input.sessionParent), category);
-    recordFile = join9(sessionDir, SITIAN_RECORDS_LEAF);
+    sessionDir = join10(dirname6(input.sessionParent), category);
+    recordFile = join10(sessionDir, SITIAN_RECORDS_LEAF);
   }
   return { sessionDir, recordFile, ledgerHome };
 }
 function projectTicketRecordsPathShape() {
   const { recordFile } = ticketProvenanceUnderBookPaths(
-    join9("~", ".ak-roles"),
+    join10("~", ".ak-roles"),
     "<\u7C3F>",
     "<\u7968\u53F7>"
   );
@@ -3412,15 +3641,15 @@ var init_sitian_appender = __esm({
 
 // src/sitian-reader.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { readFile as readFile4 } from "node:fs/promises";
-function isRecord4(value) {
+import { readFile as readFile5 } from "node:fs/promises";
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function readSitianRecords(recordFile) {
   if (!existsSync3(recordFile)) {
     return { records: [], diagnostics: [] };
   }
-  const text = await readFile4(recordFile, "utf8");
+  const text = await readFile5(recordFile, "utf8");
   const lines = text.split("\n");
   const records = [];
   const diagnostics = [];
@@ -3429,7 +3658,7 @@ async function readSitianRecords(recordFile) {
     if (!line2.trim()) continue;
     try {
       const parsed = JSON.parse(line2);
-      if (isRecord4(parsed)) {
+      if (isRecord5(parsed)) {
         records.push(parsed);
       } else {
         const typeDesc = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
@@ -3485,13 +3714,13 @@ __export(role_turn_host_exports, {
 });
 import { execFile, spawn as spawn3 } from "node:child_process";
 import { constants } from "node:fs";
-import { access, appendFile, readFile as readFile5, realpath as realpath2 } from "node:fs/promises";
-import { basename as basename3, delimiter, dirname as dirname6, isAbsolute as isAbsolute3, join as join10, resolve as resolve5 } from "node:path";
+import { access, appendFile, readFile as readFile6, realpath as realpath2 } from "node:fs/promises";
+import { basename as basename4, delimiter, dirname as dirname7, isAbsolute as isAbsolute3, join as join11, resolve as resolve5 } from "node:path";
 import { platform } from "node:process";
 import { promisify } from "node:util";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function resolveInternalRoleEntrypoint(packageRoot) {
-  return join10(packageRoot, INTERNAL_ROLE_ENTRYPOINT_RELATIVE);
+  return join11(packageRoot, INTERNAL_ROLE_ENTRYPOINT_RELATIVE);
 }
 function buildExplicitInternalActivationArgs(selectedRoleEntry, extraArgs = []) {
   return ["--no-extensions", "-e", selectedRoleEntry, ...extraArgs];
@@ -3527,7 +3756,7 @@ function buildMethodArgs(methods) {
 function applyPiNativeSkillInvocation(methods, prompt) {
   const skills = methods.filter((method) => method.kind === "skill");
   if (skills.length !== 1) return prompt;
-  const name = basename3(dirname6(skills[0].path));
+  const name = basename4(dirname7(skills[0].path));
   if (name.length === 0) return prompt;
   const token = `/skill:${name}`;
   const trimmed = prompt.trimStart();
@@ -3746,9 +3975,6 @@ ${paths.join("\n")}`
       if (typeof process.env.AK_ROLE_AUDITOR_SUBJECT === "string" && process.env.AK_ROLE_AUDITOR_SUBJECT.trim() !== "") {
         env.AK_ROLE_AUDITOR_SUBJECT = process.env.AK_ROLE_AUDITOR_SUBJECT;
       }
-      if (request.correlationId !== void 0 && request.correlationId.trim() !== "") {
-        env.AK_CORRELATION_ID = request.correlationId;
-      }
       if (config.recordLaunchedRolePackageIdentity !== void 0 && config.observeLaunchedRolePackageIdentity !== void 0) {
         await config.recordLaunchedRolePackageIdentity(
           request.runDirectory,
@@ -3768,7 +3994,7 @@ ${paths.join("\n")}`
 }
 async function appendPiSessionCustomEntry(authority, principal, customType, data) {
   const { sessionFile } = authority.decode(principal);
-  const text = await readFile5(sessionFile, "utf8");
+  const text = await readFile6(sessionFile, "utf8");
   let parentId = null;
   for (const line2 of text.trim().split("\n").filter(Boolean)) {
     const entry = JSON.parse(line2);
@@ -3921,8 +4147,8 @@ var init_host_descriptions = __esm({
 
 // src/role-run-relocation.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { readdir as readdir2, readFile as readFile6, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join11, sep as sep2 } from "node:path";
+import { readdir as readdir3, readFile as readFile7, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join12, sep as sep2 } from "node:path";
 function isEnoent2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
@@ -4011,7 +4237,7 @@ function rewriteSummonsMaterials(value, rewrites) {
 }
 async function rewriteJsonObjectFile(path, fields, rewrites) {
   if (!existsSync4(path)) return;
-  const page = JSON.parse(await readFile6(path, "utf8"));
+  const page = JSON.parse(await readFile7(path, "utf8"));
   if (!isPlainObject(page)) return;
   rewriteRunDirectoryPathFieldsAgainstRewrites(page, fields, rewrites);
   await writeFile2(path, `${JSON.stringify(page, null, 2)}
@@ -4019,7 +4245,7 @@ async function rewriteJsonObjectFile(path, fields, rewrites) {
 }
 async function rewriteOfficerPointerFile(path, rewrites) {
   if (!existsSync4(path)) return;
-  const page = JSON.parse(await readFile6(path, "utf8"));
+  const page = JSON.parse(await readFile7(path, "utf8"));
   if (!isPlainObject(page)) return;
   if (page.kind !== "direct-officer-run-pointer") return;
   rewriteRunDirectoryPathFieldsAgainstRewrites(
@@ -4032,7 +4258,7 @@ async function rewriteOfficerPointerFile(path, rewrites) {
 }
 async function rewriteSitianRecordsJsonl(path, rewrites) {
   if (!existsSync4(path)) return;
-  const raw = await readFile6(path, "utf8");
+  const raw = await readFile7(path, "utf8");
   if (raw.length === 0) return;
   const endsWithNewline = raw.endsWith("\n");
   const lines = raw.split("\n");
@@ -4083,7 +4309,7 @@ async function rewriteSitianRecordsJsonl(path, rewrites) {
 }
 async function rewriteSessionTranscriptBindings(path, rewrites) {
   if (!existsSync4(path)) return;
-  const raw = await readFile6(path, "utf8");
+  const raw = await readFile7(path, "utf8");
   if (raw.length === 0) return;
   const endsWithNewline = raw.endsWith("\n");
   const lines = raw.split("\n");
@@ -4142,17 +4368,17 @@ async function rewriteSessionTranscriptBindings(path, rewrites) {
   );
 }
 async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
-  const sessionRoot = join11(pagesDirectory, "session");
+  const sessionRoot = join12(pagesDirectory, "session");
   async function walk(directory) {
     let entries;
     try {
-      entries = await readdir2(directory, { withFileTypes: true });
+      entries = await readdir3(directory, { withFileTypes: true });
     } catch (error) {
       if (isEnoent2(error)) return;
       throw error;
     }
     for (const entry of entries) {
-      const path = join11(directory, entry.name);
+      const path = join12(directory, entry.name);
       if (entry.isDirectory()) {
         await walk(path);
         continue;
@@ -4174,9 +4400,9 @@ async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
 async function rewriteRoleRunDurablePages(input) {
   const { pagesDirectory } = input;
   const rewrites = collectRewrites(input);
-  const admittedPath = join11(pagesDirectory, "admitted-request.json");
+  const admittedPath = join12(pagesDirectory, "admitted-request.json");
   if (existsSync4(admittedPath)) {
-    const page = JSON.parse(await readFile6(admittedPath, "utf8"));
+    const page = JSON.parse(await readFile7(admittedPath, "utf8"));
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page,
       ADMITTED_PAGE_FIELDS,
@@ -4204,9 +4430,9 @@ async function rewriteRoleRunDurablePages(input) {
     await writeFile2(admittedPath, `${JSON.stringify(page, null, 2)}
 `, "utf8");
   }
-  const invocationPath = join11(pagesDirectory, "invocation.json");
+  const invocationPath = join12(pagesDirectory, "invocation.json");
   if (existsSync4(invocationPath)) {
-    const page = JSON.parse(await readFile6(invocationPath, "utf8"));
+    const page = JSON.parse(await readFile7(invocationPath, "utf8"));
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page,
       INVOCATION_PAGE_FIELDS,
@@ -4219,9 +4445,9 @@ async function rewriteRoleRunDurablePages(input) {
       "utf8"
     );
   }
-  const statePath = join11(pagesDirectory, "run-state.json");
+  const statePath = join12(pagesDirectory, "run-state.json");
   if (existsSync4(statePath)) {
-    const page = JSON.parse(await readFile6(statePath, "utf8"));
+    const page = JSON.parse(await readFile7(statePath, "utf8"));
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page,
       RUN_STATE_PAGE_FIELDS,
@@ -4409,15 +4635,15 @@ var init_terminating_tools = __esm({
 });
 
 // src/doctor-evidence.ts
-import { readdir as readdir3, readFile as readFile7, realpath as realpath3, stat } from "node:fs/promises";
-import { dirname as dirname7, relative as relative2, resolve as resolve6, sep as sep3 } from "node:path";
+import { readdir as readdir4, readFile as readFile8, realpath as realpath3, stat } from "node:fs/promises";
+import { dirname as dirname8, relative as relative2, resolve as resolve6, sep as sep3 } from "node:path";
 function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function discoverCaseFiles(root) {
   const found = [];
   async function walk(dir, depth) {
-    for (const item of await readdir3(dir, { withFileTypes: true })) {
+    for (const item of await readdir4(dir, { withFileTypes: true })) {
       const path = resolve6(dir, item.name);
       if (item.isDirectory()) {
         await walk(path, depth + 1);
@@ -4437,7 +4663,7 @@ function accumulate(metric, value, source) {
 function timestamp(row) {
   return typeof row.timestamp === "string" && Number.isFinite(Date.parse(row.timestamp)) ? row.timestamp : void 0;
 }
-function isMissingPathError2(error) {
+function isMissingPathError3(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
 async function stableRunsIdentity(root) {
@@ -4447,9 +4673,9 @@ async function stableRunsIdentity(root) {
       const git3 = await stat(resolve6(cursor, ".git"));
       if (git3.isDirectory() || git3.isFile()) return relative2(cursor, root).split(sep3).join("/");
     } catch (error) {
-      if (!isMissingPathError2(error)) throw error;
+      if (!isMissingPathError3(error)) throw error;
     }
-    const parent = dirname7(cursor);
+    const parent = dirname8(cursor);
     if (parent === cursor) return root;
     cursor = parent;
   }
@@ -4525,7 +4751,7 @@ async function loadDoctorCase(runsPath) {
   const turns = { count: 0, sources: [] }, calls = { count: 0, sources: [] }, tokens = { count: 0, sources: [] };
   for (const path of await discoverCaseFiles(root)) {
     const id = relative2(root, path).split(sep3).join("/");
-    const bytes = await readFile7(path);
+    const bytes = await readFile8(path);
     const content = bytes.toString("utf8");
     const kind = id.endsWith(".jsonl") ? "session" : "stderr";
     evidence.push({ id, kind, byteLength: bytes.byteLength, contentLength: content.length, sha256: sha256Hex(bytes), content });
@@ -4538,7 +4764,7 @@ async function loadDoctorCase(runsPath) {
     accumulate(calls, result.calls, id);
     accumulate(tokens, result.tokens, id);
   }
-  const runDirs = (await readdir3(root, { withFileTypes: true })).filter((item) => item.isDirectory()).map((item) => item.name).sort();
+  const runDirs = (await readdir4(root, { withFileTypes: true })).filter((item) => item.isDirectory()).map((item) => item.name).sort();
   const legs = evidence.filter((entry) => entry.kind === "session").map((entry) => entry.id);
   const retryDirs = runDirs.filter((name) => /(?:^|[-_])retry(?:[-_]|$)/i.test(name));
   const rawBytes = evidence.filter((entry) => entry.kind === "session").reduce((sum, entry) => sum + entry.byteLength, 0);
@@ -4765,7 +4991,7 @@ var init_git_object_id = __esm({
 
 // src/merger-git-state.ts
 import { execFile as execFile2 } from "node:child_process";
-import { access as access2, readFile as readFile8 } from "node:fs/promises";
+import { access as access2, readFile as readFile9 } from "node:fs/promises";
 import { constants as fsConstants } from "node:fs";
 import { isAbsolute as isAbsolute4, resolve as resolve7 } from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -4835,7 +5061,7 @@ function createProductionMergerGitState(repositoryRoot = process.cwd()) {
       const mergeHeadPath = isAbsolute4(mergeHeadReported) ? mergeHeadReported : resolve7(repositoryRoot, mergeHeadReported);
       let sourceObjectId = "";
       if (await pathExists(mergeHeadPath)) {
-        const raw = exactUtf8(await readFile8(mergeHeadPath), "Git MERGE_HEAD");
+        const raw = exactUtf8(await readFile9(mergeHeadPath), "Git MERGE_HEAD");
         const mergeHeads = raw.trim().split(/\r?\n/).map((row) => row.trim()).filter(Boolean);
         if (mergeHeads.length === 0) throw new Error("Git MERGE_HEAD is empty");
         if (mergeHeads.length !== 1) throw new Error("Assigned repository does not have one ordinary in-progress merge");
@@ -4887,10 +5113,10 @@ var init_uuidv7 = __esm({
 });
 
 // src/typed-provider-http.ts
-import { readFile as readFile9, unlink, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readFile as readFile10, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 function typedProviderHttpPath(runDirectory) {
-  return join12(runDirectory, TYPED_HTTP_FILE);
+  return join13(runDirectory, TYPED_HTTP_FILE);
 }
 async function clearTypedProviderHttpObservation(runDirectory) {
   try {
@@ -4921,7 +5147,7 @@ async function recordTypedProviderHttpStatus(runDirectory, observation) {
 async function readLatestTypedProviderHttpObservation(runDirectory) {
   let text;
   try {
-    text = await readFile9(typedProviderHttpPath(runDirectory), "utf8");
+    text = await readFile10(typedProviderHttpPath(runDirectory), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return void 0;
@@ -5000,8 +5226,8 @@ __export(run_lifecycle_exports, {
   selectResumeContinuationPrompt: () => selectResumeContinuationPrompt,
   writeRoleRunState: () => writeRoleRunState
 });
-import { chmod, lstat as lstat2, open, readdir as readdir4, readFile as readFile10, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename4, join as join13 } from "node:path";
+import { chmod, lstat as lstat2, open, readdir as readdir5, readFile as readFile11, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename5, join as join14 } from "node:path";
 function selectResumeContinuationPrompt(message, engineMaterial) {
   const lines = message !== void 0 ? [message] : [];
   return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
@@ -5040,7 +5266,7 @@ function renderResumeCommand(runId) {
 async function writeRoleRunState(runDirectory, record4) {
   const payload = { ...record4, runDirectory };
   await writeFile4(
-    join13(runDirectory, RUN_STATE_FILE),
+    join14(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -5090,7 +5316,7 @@ function parseCurrentCourtState(raw) {
 async function readRoleRunStateDisk(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile10(join13(runDirectory, RUN_STATE_FILE), "utf8"));
+    raw = JSON.parse(await readFile11(join14(runDirectory, RUN_STATE_FILE), "utf8"));
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return void 0;
     throw error;
@@ -5158,7 +5384,7 @@ async function writeRoleRunStateDisk(runDirectory, disk) {
     ...disk.currentCourt === void 0 ? {} : { currentCourt: disk.currentCourt }
   };
   await writeFile4(
-    join13(runDirectory, RUN_STATE_FILE),
+    join14(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -5330,7 +5556,7 @@ function isProcessAlive(pid) {
 async function autopsyWriterLock(lockPath) {
   let content;
   try {
-    content = await readFile10(lockPath, "utf8");
+    content = await readFile11(lockPath, "utf8");
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return { verdict: "absent" };
     return { verdict: "unknown", reason: "unreadable", readFailure: error };
@@ -5389,7 +5615,7 @@ async function createWriterLease(lockPath, runDirectory, reportCleanupFailure) {
     },
     relocate(nextRunDirectory) {
       currentRunDirectory = nextRunDirectory;
-      currentLockPath = join13(nextRunDirectory, WRITER_LOCK_FILE);
+      currentLockPath = join14(nextRunDirectory, WRITER_LOCK_FILE);
     },
     async release() {
       if (released) return;
@@ -5428,10 +5654,10 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
   };
   const reportReadFailure = (error) => {
     reportDiagnostic(
-      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join13(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
+      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join14(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
     );
   };
-  const lockPath = join13(runDirectory, WRITER_LOCK_FILE);
+  const lockPath = join14(runDirectory, WRITER_LOCK_FILE);
   let lastAutopsy = { verdict: "absent" };
   let lastReclaimFailure;
   for (let reclaimsLeft = WRITER_LEASE_RECLAIM_ROUNDS; ; reclaimsLeft -= 1) {
@@ -5486,10 +5712,10 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
 async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
   if (runId.trim() === "") return void 0;
   const ledgerHome = resolveActivationLedgerHome(home);
-  const booksRoot = join13(ledgerHome, "books");
+  const booksRoot = join14(ledgerHome, "books");
   let bookKeys;
   try {
-    bookKeys = await readdir4(booksRoot);
+    bookKeys = await readdir5(booksRoot);
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return void 0;
     throw error;
@@ -5506,7 +5732,7 @@ async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
       throw error;
     }
     for (const runDirectory of runDirectories) {
-      const entry = basename4(runDirectory);
+      const entry = basename5(runDirectory);
       if (onlyRole === void 0 && (entry === `${runId}@judge` || entry.startsWith(`${runId}@`)) || entry === `${runId}@${onlyRole}`) {
         matches.push(runDirectory);
       }
@@ -5527,7 +5753,7 @@ async function readRunParentPath(runDirectory) {
   let raw;
   try {
     raw = JSON.parse(
-      await readFile10(join13(runDirectory, "admitted-request.json"), "utf8")
+      await readFile11(join14(runDirectory, "admitted-request.json"), "utf8")
     );
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return void 0;
@@ -5548,7 +5774,7 @@ async function readRunParentPath(runDirectory) {
 async function runHasFormedSessionPrincipal(runDirectory) {
   const disk = await readRoleRunStateDisk(runDirectory);
   if (disk === void 0) return false;
-  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join13(disk.principalWire.sessionDirectory, "session.jsonl");
+  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join14(disk.principalWire.sessionDirectory, "session.jsonl");
   try {
     const stat2 = await lstat2(sessionFile);
     return stat2.isFile() && !stat2.isSymbolicLink();
@@ -5573,7 +5799,7 @@ async function findLatestRunIdForSeatTicket(input) {
   const suffix = `@${input.role}`;
   let best;
   for (const runDirectory of runDirectories) {
-    const entry = basename4(runDirectory);
+    const entry = basename5(runDirectory);
     if (!entry.endsWith(suffix)) continue;
     const runId = entry.slice(0, entry.length - suffix.length);
     if (runId.length === 0) continue;
@@ -5696,7 +5922,7 @@ async function loadResumableRunRecord(home, runId, authority) {
   let sourceRun;
   try {
     const raw = JSON.parse(
-      await readFile10(run.admittedRequestPath, "utf8")
+      await readFile11(run.admittedRequestPath, "utf8")
     );
     if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
       const record4 = raw;
@@ -5814,7 +6040,7 @@ async function loadResumableRunRecord(home, runId, authority) {
   let model;
   try {
     const invocationRaw = JSON.parse(
-      await readFile10(join13(run.runDirectory, "invocation.json"), "utf8")
+      await readFile11(join14(run.runDirectory, "invocation.json"), "utf8")
     );
     if (invocationRaw !== null && typeof invocationRaw === "object" && !Array.isArray(invocationRaw)) {
       const rec = invocationRaw;
@@ -6283,7 +6509,7 @@ __export(notary_source_run_exports, {
   loadNotarySourceRunLocator: () => loadNotarySourceRunLocator,
   resolveNotarySourceRunLocator: () => resolveNotarySourceRunLocator
 });
-import { dirname as dirname8, isAbsolute as isAbsolute6, join as join14, resolve as resolve8, basename as basename5 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute6, join as join15, resolve as resolve8, basename as basename6 } from "node:path";
 import { lstat as lstat3, realpath as realpath4 } from "node:fs/promises";
 function parseRunDirectoryName(name) {
   const match = RUN_DIR_NAME.exec(name);
@@ -6314,10 +6540,10 @@ async function requireRunDirectory(candidate, display) {
       `notary --source-run must be a run directory: ${display}`
     );
   }
-  const identity = parseRunDirectoryName(basename5(real));
+  const identity = parseRunDirectoryName(basename6(real));
   if (identity === void 0) {
     throw new NotarySourceRunError(
-      `notary --source-run must be named <runId>@<role>: ${basename5(real)}`
+      `notary --source-run must be named <runId>@<role>: ${basename6(real)}`
     );
   }
   return real;
@@ -6329,20 +6555,20 @@ async function resolveNotarySourceRunLocator(options) {
   }
   const ledgerHome = resolveActivationLedgerHome(options.home);
   const bookKey = resolveBookKeyFromGit(options.projectRoot);
-  const bookRunsRoot = join14(activationBookDirectory(ledgerHome, bookKey), "runs");
+  const bookRunsRoot = join15(activationBookDirectory(ledgerHome, bookKey), "runs");
   let candidate;
   const bare = parseRunDirectoryName(raw);
   if (bare !== void 0 && !raw.includes("/") && !raw.includes("\\")) {
-    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join14(bookRunsRoot, `${bare.runId}@${bare.role}`);
+    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join15(bookRunsRoot, `${bare.runId}@${bare.role}`);
   } else {
     candidate = isAbsolute6(raw) ? raw : resolve8(options.projectRoot, raw);
   }
   const real = await requireRunDirectory(candidate, raw);
-  const identity = parseRunDirectoryName(basename5(real));
+  const identity = parseRunDirectoryName(basename6(real));
   const bookIdentity = physicalPathIdentity(activationBookDirectory(ledgerHome, bookKey));
-  const parentIdentity = physicalPathIdentity(dirname8(real));
-  const subjectBookIdentity = physicalPathIdentity(dirname8(dirname8(dirname8(real))));
-  if (parentIdentity !== physicalPathIdentity(bookRunsRoot) && !(basename5(dirname8(real)) === "runs" && subjectBookIdentity === bookIdentity)) {
+  const parentIdentity = physicalPathIdentity(dirname9(real));
+  const subjectBookIdentity = physicalPathIdentity(dirname9(dirname9(dirname9(real))));
+  if (parentIdentity !== physicalPathIdentity(bookRunsRoot) && !(basename6(dirname9(real)) === "runs" && subjectBookIdentity === bookIdentity)) {
     throw new NotarySourceRunError(
       "notary --source-run must resolve to a retained run under the project machine-ledger book"
     );
@@ -6376,7 +6602,7 @@ async function resolveNotarySourceRunLocator(options) {
 }
 async function loadNotarySourceRunLocator(path) {
   const real = await requireRunDirectory(path, path);
-  const identity = parseRunDirectoryName(basename5(real));
+  const identity = parseRunDirectoryName(basename6(real));
   const runState = await readRoleRunIdentity(real);
   if (runState === void 0) {
     throw new NotarySourceRunError(
@@ -7525,14 +7751,14 @@ import { existsSync as existsSync5 } from "node:fs";
 import {
   lstat as lstat4,
   mkdtemp as mkdtemp2,
-  readFile as readFile11,
+  readFile as readFile12,
   realpath as realpath5,
   rename,
   rm as rm2,
   writeFile as writeFile5
 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute7, join as join15, resolve as resolve9, sep as sep4 } from "node:path";
+import { basename as basename7, dirname as dirname10, isAbsolute as isAbsolute7, join as join16, resolve as resolve9, sep as sep4 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
   const bookKey = resolveBookKeyFromGit(request.cwd);
@@ -7586,15 +7812,15 @@ async function writeRoleInvocationLedger(source, role, effectiveModel) {
     ...effectiveModelLedgerFields(effectiveModel)
   };
   await writeFile5(
-    join15(source.runDirectory, "invocation.json"),
+    join16(source.runDirectory, "invocation.json"),
     `${JSON.stringify(identity, null, 2)}
 `,
     "utf8"
   );
 }
 async function recordEffectiveInvocationModel(runDirectory, model, engine, host, engineModel) {
-  const ledgerPath = join15(runDirectory, "invocation.json");
-  const current = JSON.parse(await readFile11(ledgerPath, "utf8"));
+  const ledgerPath = join16(runDirectory, "invocation.json");
+  const current = JSON.parse(await readFile12(ledgerPath, "utf8"));
   const next = { ...current };
   if (model !== void 0) {
     next.provider = model.provider;
@@ -7626,8 +7852,8 @@ async function recordEffectiveInvocationModel(runDirectory, model, engine, host,
   );
 }
 async function mergeInvocationIdentityPage(runDirectory, fields) {
-  const ledgerPath = join15(runDirectory, "invocation.json");
-  const current = JSON.parse(await readFile11(ledgerPath, "utf8"));
+  const ledgerPath = join16(runDirectory, "invocation.json");
+  const current = JSON.parse(await readFile12(ledgerPath, "utf8"));
   await writeFile5(
     ledgerPath,
     `${JSON.stringify({
@@ -7643,7 +7869,7 @@ async function persistAdmittedSourceRunPath(admitted, sourceRunPath) {
     throw new Error("persistAdmittedSourceRunPath requires a non-empty sourceRunPath");
   }
   const admittedPath = admitted.admittedRequestPath;
-  const current = JSON.parse(await readFile11(admittedPath, "utf8"));
+  const current = JSON.parse(await readFile12(admittedPath, "utf8"));
   if (typeof current.sourceRunPath === "string") {
     if (current.sourceRunPath === sourceRunPath) return;
     throw new Error(
@@ -7669,7 +7895,7 @@ async function bindAdmittedTicketNumber(admitted, ticketNumber) {
 }
 async function recordAdmittedCorrelation(admitted, correlationId) {
   const current = JSON.parse(
-    await readFile11(admitted.admittedRequestPath, "utf8")
+    await readFile12(admitted.admittedRequestPath, "utf8")
   );
   const prior = [
     ...Array.isArray(current.correlationIds) ? current.correlationIds.filter(
@@ -7717,7 +7943,7 @@ async function bindCourtTicketNumbersOnAdmitted(admitted, courtTicketNumbers) {
   }
   const frozen = Object.freeze([...projected]);
   const admittedPath = admitted.admittedRequestPath;
-  const current = JSON.parse(await readFile11(admittedPath, "utf8"));
+  const current = JSON.parse(await readFile12(admittedPath, "utf8"));
   await writeFile5(
     admittedPath,
     `${JSON.stringify({ ...current, courtTicketNumbers: frozen }, null, 2)}
@@ -7739,7 +7965,7 @@ async function relocateAdmittedRunToTicket(admitted, authority, heldLease) {
     runId: admitted.runId,
     role: admitted.role
   });
-  ensureRoleRunDirectory(ledgerHome, dirname9(target.runDirectory));
+  ensureRoleRunDirectory(ledgerHome, dirname10(target.runDirectory));
   await rename(oldRunDirectory, target.runDirectory);
   heldLease?.relocate(target.runDirectory);
   const admittedRecord = admitted;
@@ -7777,9 +8003,9 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
     ticketNumber,
     "bindTicketNumberOnRunDirectory"
   );
-  const admittedPath = join15(runDirectory, "admitted-request.json");
-  const invocationPath = join15(runDirectory, "invocation.json");
-  const admitted = JSON.parse(await readFile11(admittedPath, "utf8"));
+  const admittedPath = join16(runDirectory, "admitted-request.json");
+  const invocationPath = join16(runDirectory, "invocation.json");
+  const admitted = JSON.parse(await readFile12(admittedPath, "utf8"));
   const existing = admitted.ticketNumber;
   if (typeof existing === "number") {
     if (existing === ticketNumber) return;
@@ -7789,7 +8015,7 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
   }
   if (existsSync5(invocationPath)) {
     const invocation = JSON.parse(
-      await readFile11(invocationPath, "utf8")
+      await readFile12(invocationPath, "utf8")
     );
     if (typeof invocation.ticketNumber === "number" && invocation.ticketNumber !== ticketNumber) {
       throw new Error(
@@ -7814,7 +8040,7 @@ async function recordLaunchedPiIdentity(runDirectory, identity) {
 async function observeLaunchedRolePackageIdentity(packageRoot, selectedRoleEntry) {
   const rolePackageRoot = packageRoot;
   const raw = JSON.parse(
-    await readFile11(join15(rolePackageRoot, "package.json"), "utf8")
+    await readFile12(join16(rolePackageRoot, "package.json"), "utf8")
   );
   if (typeof raw.version !== "string" || raw.version.trim() === "") {
     throw new Error(
@@ -8099,7 +8325,7 @@ async function readRegularFileAttachment(sourcePath) {
     );
   }
   try {
-    return { absolute, bytes: await readFile11(absolute) };
+    return { absolute, bytes: await readFile12(absolute) };
   } catch (error) {
     throw new CliUsageError(
       `attachment is not a readable regular file: ${sourcePath}`,
@@ -8112,13 +8338,13 @@ async function removePreparedAttachmentDirectory(stagingDirectory) {
 }
 async function withPreparedAttachments(attachmentPaths, use) {
   if (attachmentPaths.length === 0) return await use([]);
-  const stagingDirectory = await mkdtemp2(join15(tmpdir2(), "ak-role-attachments-"));
+  const stagingDirectory = await mkdtemp2(join16(tmpdir2(), "ak-role-attachments-"));
   const prepared = [];
   let result;
   try {
     for (let index = 0; index < attachmentPaths.length; index += 1) {
       const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
-      const snapshotPath = join15(stagingDirectory, String(index).padStart(6, "0"));
+      const snapshotPath = join16(stagingDirectory, String(index).padStart(6, "0"));
       await writeFile5(snapshotPath, bytes);
       prepared.push({ absolute, snapshotPath });
     }
@@ -8139,9 +8365,9 @@ async function withPreparedAttachments(attachmentPaths, use) {
   return result;
 }
 async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
-  const frozenPath = join15(
+  const frozenPath = join16(
     destinationDir,
-    `${String(index).padStart(2, "0")}-${basename6(provenancePath)}`
+    `${String(index).padStart(2, "0")}-${basename7(provenancePath)}`
   );
   await writeFile5(frozenPath, bytes);
   return {
@@ -8155,7 +8381,7 @@ async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, inde
 async function freezePreparedAttachment(prepared, destinationDir, index) {
   return freezeAttachmentBytes(
     prepared.absolute,
-    await readFile11(prepared.snapshotPath),
+    await readFile12(prepared.snapshotPath),
     destinationDir,
     index
   );
@@ -8182,14 +8408,14 @@ async function freezeAttachments(attachmentPaths, attachmentsDirectory) {
 async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKey = `s-${Date.now().toString(36)}`) {
   if (attachmentPaths.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = join15(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = join16(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
 async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
   if (prepared.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = summonsKey === void 0 ? join15(runDirectory, "attachments") : join15(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = summonsKey === void 0 ? join16(runDirectory, "attachments") : join16(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   const attachments = [];
   for (let index = 0; index < prepared.length; index += 1) {
@@ -8251,7 +8477,7 @@ async function admitStandardMaterialInvocation(role, options) {
     })),
     ...ticketFields
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -8360,7 +8586,7 @@ async function admitCountersignInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   if (options.deferPersistence !== true) {
     await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
       sessionDirectory,
@@ -8411,7 +8637,7 @@ function buildCountersignTransportPrompt(admitted, engineMaterial) {
 async function loadAdmittedJudgeRequest(runDirectory) {
   try {
     const raw = JSON.parse(
-      await readFile11(join15(runDirectory, "admitted-request.json"), "utf8")
+      await readFile12(join16(runDirectory, "admitted-request.json"), "utf8")
     );
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
     const record4 = raw;
@@ -8466,7 +8692,7 @@ async function admitCoderInvocation(options) {
     home: options.home
   });
   const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-  const taskPath = join15(runDirectory, "task.md");
+  const taskPath = join16(runDirectory, "task.md");
   await writeFile5(taskPath, instruction, "utf8");
   const admitted = {
     role: "coder",
@@ -8487,7 +8713,7 @@ async function admitCoderInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -8537,7 +8763,7 @@ async function admitFixerInvocation(options) {
   if (options.prerequisitesPath !== void 0) {
     const absolutePrereq = isAbsolute7(options.prerequisitesPath) ? options.prerequisitesPath : resolve9(options.prerequisitesPath);
     try {
-      prerequisitesSource = await readFile11(absolutePrereq, "utf8");
+      prerequisitesSource = await readFile12(absolutePrereq, "utf8");
     } catch (error) {
       throw new CliUsageError(
         `fixer prerequisites path is unreadable: ${options.prerequisitesPath}`,
@@ -8573,7 +8799,7 @@ async function admitFixerInvocation(options) {
   const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
   let prerequisitesPath;
   if (prerequisitesSource !== void 0) {
-    prerequisitesPath = join15(runDirectory, "prerequisites.json");
+    prerequisitesPath = join16(runDirectory, "prerequisites.json");
     await writeFile5(
       prerequisitesPath,
       `${JSON.stringify(prerequisites, null, 2)}
@@ -8581,7 +8807,7 @@ async function admitFixerInvocation(options) {
       "utf8"
     );
   }
-  const packetPath = join15(runDirectory, "fix-packet.md");
+  const packetPath = join16(runDirectory, "fix-packet.md");
   await writeFile5(packetPath, instruction, "utf8");
   const admitted = {
     role: "fixer",
@@ -8607,7 +8833,7 @@ async function admitFixerInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -8827,7 +9053,7 @@ async function admitCollectorInvocation(options) {
   const prNumber = target.kind === "bound" ? target.prNumber : void 0;
   let requestManifestPath;
   if (manifestCanonicalJson !== void 0) {
-    requestManifestPath = join15(runDirectory, "request-manifest.json");
+    requestManifestPath = join16(runDirectory, "request-manifest.json");
     await writeFile5(requestManifestPath, manifestCanonicalJson, "utf8");
   }
   const admitted = {
@@ -8853,7 +9079,7 @@ async function admitCollectorInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -8951,7 +9177,7 @@ function parseDoctorArgv(args) {
 }
 async function resolveDoctorCaseRunsPath(options) {
   const ledgerHome = resolveActivationLedgerHome(options.home);
-  const defaultRuns = join15(
+  const defaultRuns = join16(
     activationBookDirectory(ledgerHome, options.bookKey),
     String(options.issueNumber),
     "runs"
@@ -9082,7 +9308,7 @@ async function admitDoctorInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -9214,7 +9440,7 @@ async function admitNotaryInvocation(options) {
     ...ticketFields,
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -9317,7 +9543,7 @@ async function admitGleanerLeftInvocation(options) {
     attachments: [],
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -9456,7 +9682,7 @@ async function admitReviewerInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -9608,7 +9834,7 @@ async function admitMergerInvocation(options) {
     resolutionScope: [...derived.resolutionScope],
     authorizedChecks: []
   });
-  const mergerInputPath = join15(runDirectory, "merger-input.json");
+  const mergerInputPath = join16(runDirectory, "merger-input.json");
   await writeFile5(
     mergerInputPath,
     `${JSON.stringify(mergerInput, null, 2)}
@@ -9639,7 +9865,7 @@ async function admitMergerInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -9923,15 +10149,15 @@ var init_invocation = __esm({
 
 // src/public-cli/load-production-acp-host.ts
 import { existsSync as existsSync6 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { pathToFileURL } from "node:url";
 async function loadProductionAcpHostFactory(packageRoot, host) {
   const description = lookupHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered host: ${host}`);
   }
-  const built = join16(packageRoot, "dist/acp-host/production-host.js");
-  const source = join16(packageRoot, "src/acp-host/production-host.ts");
+  const built = join17(packageRoot, "dist/acp-host/production-host.js");
+  const source = join17(packageRoot, "src/acp-host/production-host.ts");
   const target = existsSync6(built) ? built : source;
   const href = pathToFileURL(target).href;
   const mod = await import(href);
@@ -9947,15 +10173,15 @@ var init_load_production_acp_host = __esm({
 
 // src/public-cli/load-production-headless-host.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 async function loadProductionHeadlessHostFactory(packageRoot, host) {
   const description = lookupHeadlessHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered headless host: ${host}`);
   }
-  const built = join17(packageRoot, "dist/headless-host/production-host.js");
-  const source = join17(packageRoot, "src/headless-host/production-host.ts");
+  const built = join18(packageRoot, "dist/headless-host/production-host.js");
+  const source = join18(packageRoot, "src/headless-host/production-host.ts");
   const target = existsSync7(built) ? built : source;
   const href = pathToFileURL2(target).href;
   const mod = await import(href);
@@ -10204,8 +10430,8 @@ __export(config_exports, {
   setPersistentSeatHost: () => setPersistentSeatHost,
   validatePublicCliConfigAxes: () => validatePublicCliConfigAxes
 });
-import { mkdir, readFile as readFile12, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname10, join as join18 } from "node:path";
+import { mkdir, readFile as readFile13, writeFile as writeFile6 } from "node:fs/promises";
+import { dirname as dirname11, join as join19 } from "node:path";
 function isGateOfficerSeat(value) {
   return GATE_OFFICER_SEATS.includes(value);
 }
@@ -10213,12 +10439,12 @@ function publicCliConfigPath(home) {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
   }
-  return join18(home, ".ak-roles", "public-cli.json");
+  return join19(home, ".ak-roles", "public-cli.json");
 }
 async function loadPublicCliConfig(home) {
   const path = publicCliConfigPath(home);
   try {
-    const raw = await readFile12(path, "utf8");
+    const raw = await readFile13(path, "utf8");
     return parsePublicCliConfig(JSON.parse(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -10229,7 +10455,7 @@ async function loadPublicCliConfig(home) {
 }
 async function savePublicCliConfig(config, home) {
   const path = publicCliConfigPath(home);
-  await mkdir(dirname10(path), { recursive: true });
+  await mkdir(dirname11(path), { recursive: true });
   const normalized = parsePublicCliConfig(config);
   await writeFile6(
     path,
@@ -10676,7 +10902,7 @@ function credentialProvidersFromAuthData(data) {
 }
 async function loadCredentialProviders(agentDir) {
   try {
-    const raw = await readFile12(join18(agentDir, "auth.json"), "utf8");
+    const raw = await readFile13(join19(agentDir, "auth.json"), "utf8");
     return credentialProvidersFromAuthData(JSON.parse(raw));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
@@ -10715,15 +10941,15 @@ __export(host_providers_exports, {
   renderHostProvidersTable: () => renderHostProvidersTable
 });
 import { readFileSync as readFileSync2 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 function hostProvidersPath(home) {
   if (typeof home !== "string" || home.trim() === "") {
     throw new Error("home must be explicitly provided");
   }
-  return join19(home, ".ak-roles", "host-providers.json");
+  return join20(home, ".ak-roles", "host-providers.json");
 }
 function hermesProviderModelsCachePath(home) {
-  return join19(home, ".hermes", "provider_models_cache.json");
+  return join20(home, ".hermes", "provider_models_cache.json");
 }
 function parseHostProvidersTable(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -10878,12 +11104,12 @@ var init_host_providers = __esm({
 });
 
 // src/ledger-session-read.ts
-import { readFile as readFile13 } from "node:fs/promises";
-function isRecord5(value) {
+import { readFile as readFile14 } from "node:fs/promises";
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function readLedgerSessionJsonlLines(path) {
-  const text = await readFile13(path, "utf8");
+  const text = await readFile14(path, "utf8");
   const lines = text.split("\n");
   const out = [];
   for (let index = 0; index < lines.length; index += 1) {
@@ -10904,7 +11130,7 @@ async function readLedgerSessionJsonlLines(path) {
       });
       continue;
     }
-    if (!isRecord5(row)) {
+    if (!isRecord6(row)) {
       const kind = row === null ? "null" : Array.isArray(row) ? "array" : typeof row;
       out.push({
         line: lineNumber,
@@ -10981,9 +11207,9 @@ var init_ledger_session_read = __esm({
 });
 
 // src/analyst-gate-cycles-read.ts
-import { readdir as readdir5 } from "node:fs/promises";
-import { join as join20 } from "node:path";
-function isRecord6(value) {
+import { readdir as readdir6 } from "node:fs/promises";
+import { join as join21 } from "node:path";
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isParentAttemptBindingRow(row) {
@@ -11013,7 +11239,7 @@ function isGateTerminatingToolName(toolName) {
 function acceptedGateReceiptIds(rows) {
   const accepted = /* @__PURE__ */ new Set();
   for (const row of rows) {
-    const message = isRecord6(row.message) ? row.message : void 0;
+    const message = isRecord7(row.message) ? row.message : void 0;
     if (message?.role !== "toolResult") continue;
     if (typeof message.toolCallId !== "string" || message.toolCallId.length === 0) continue;
     if (message.isError === false) accepted.add(message.toolCallId);
@@ -11048,7 +11274,7 @@ function nearestAttemptBindingBefore(rows, beforeIndex) {
   for (let i = beforeIndex - 1; i >= 0; i -= 1) {
     const row = rows[i];
     if (!isParentAttemptBindingRow(row)) continue;
-    if (!isRecord6(row.data) || !isRecord6(row.data.parent)) continue;
+    if (!isRecord7(row.data) || !isRecord7(row.data.parent)) continue;
     const id = row.data.parent.attemptEntryId;
     const sessionFile = row.data.parent.sessionFile;
     return {
@@ -11063,10 +11289,10 @@ function extractAllAcceptedGateToolCalls(rows) {
   const out = [];
   for (let rowIndex = 0; rowIndex < rows.length; rowIndex += 1) {
     const row = rows[rowIndex];
-    const message = isRecord6(row.message) ? row.message : void 0;
+    const message = isRecord7(row.message) ? row.message : void 0;
     if (message?.role !== "assistant" || !Array.isArray(message.content)) continue;
     for (const part of message.content) {
-      if (!isRecord6(part) || part.type !== "toolCall") continue;
+      if (!isRecord7(part) || part.type !== "toolCall") continue;
       if (typeof part.id !== "string" || part.id.length === 0) continue;
       if (typeof part.name !== "string" || part.name.length === 0) continue;
       if (!isGateTerminatingToolName(part.name)) continue;
@@ -11074,7 +11300,7 @@ function extractAllAcceptedGateToolCalls(rows) {
       const binding = nearestAttemptBindingBefore(rows, rowIndex);
       out.push({
         toolName: part.name,
-        args: isRecord6(part.arguments) ? part.arguments : void 0,
+        args: isRecord7(part.arguments) ? part.arguments : void 0,
         accepted: true,
         rowIndex,
         ...binding
@@ -11197,17 +11423,17 @@ function pairGateRounds(volumes) {
   return rounds.sort((a, b) => a.officerStartedAt.localeCompare(b.officerStartedAt)).map((round, index) => ({ ...round, roundIndex: index + 1 }));
 }
 async function resolveOfficerSessionFromPointerFile(pointerPath) {
-  const { readFile: readFile23 } = await import("node:fs/promises");
+  const { readFile: readFile24 } = await import("node:fs/promises");
   let raw;
   try {
-    raw = JSON.parse(await readFile23(pointerPath, "utf8"));
+    raw = JSON.parse(await readFile24(pointerPath, "utf8"));
   } catch (error) {
     throw new Error(
       `direct officer run pointer unreadable in ${pointerPath}: ${error instanceof Error ? error.message : String(error)}`,
       { cause: error }
     );
   }
-  if (!isRecord6(raw) || raw.kind !== "direct-officer-run-pointer" || raw.version !== 1) {
+  if (!isRecord7(raw) || raw.kind !== "direct-officer-run-pointer" || raw.version !== 1) {
     throw new Error(`direct officer run pointer has unknown shape in ${pointerPath}`);
   }
   const sessionFile = raw.sessionFile;
@@ -11223,7 +11449,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
   for (const directory of directories) {
     let names;
     try {
-      const entries = await readdir5(directory, { withFileTypes: true });
+      const entries = await readdir6(directory, { withFileTypes: true });
       names = entries.filter(
         (e) => e.isFile() && (e.name.endsWith(".jsonl") || e.name.endsWith(".pointer.json"))
       ).map((e) => e.name).sort();
@@ -11232,7 +11458,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
       throw error;
     }
     for (const name of names) {
-      const path = join20(directory, name);
+      const path = join21(directory, name);
       const fromPointer = name.endsWith(".pointer.json");
       const sessionPath = fromPointer ? await resolveOfficerSessionFromPointerFile(path) : path;
       if (sessionPath === void 0) continue;
@@ -11274,6 +11500,15 @@ var init_analyst_gate_cycles_read = __esm({
 });
 
 // src/audit-escalation.ts
+var audit_escalation_exports = {};
+__export(audit_escalation_exports, {
+  AUDIT_ESCALATION_KIND: () => AUDIT_ESCALATION_KIND,
+  buildAuditEscalationResult: () => buildAuditEscalationResult,
+  disposeComplianceDecision: () => disposeComplianceDecision,
+  isAuditEscalationProjection: () => isAuditEscalationProjection,
+  isAuditEscalationResult: () => isAuditEscalationResult,
+  projectAuditEscalation: () => projectAuditEscalation
+});
 function buildAuditEscalationResult(decision, deliveredOutput) {
   const auditOwned = {
     kind: AUDIT_ESCALATION_KIND
@@ -11370,21 +11605,6 @@ var init_audit_escalation = __esm({
   }
 });
 
-// src/run-terminal-artifacts.ts
-import { basename as basename7, dirname as dirname11, join as join21 } from "node:path";
-function runIdFromRunDirectory(runDirectory) {
-  const name = basename7(runDirectory);
-  const at = name.lastIndexOf("@");
-  if (at <= 0 || at === name.length - 1) return void 0;
-  return name.slice(0, at);
-}
-var init_run_terminal_artifacts = __esm({
-  "src/run-terminal-artifacts.ts"() {
-    "use strict";
-    init_role_run_placement();
-  }
-});
-
 // src/submission-ledger.ts
 import { join as join22 } from "node:path";
 function runIdentity(context) {
@@ -11808,7 +12028,7 @@ var init_submission_ledger = __esm({
 
 // src/session-opening-materials.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import { dirname as dirname12, join as join23 } from "node:path";
 import { fileURLToPath, pathToFileURL as pathToFileURL3 } from "node:url";
 function resolvePackageRootDir(moduleUrl = import.meta.url) {
@@ -11824,7 +12044,7 @@ function resolvePackageRootDir(moduleUrl = import.meta.url) {
   return fileURLToPath(new URL("..", moduleUrl));
 }
 async function readPackageMaterial(relativePath) {
-  return readFile14(fileURLToPath(new URL(relativePath, packageRootUrl)), "utf8");
+  return readFile15(fileURLToPath(new URL(relativePath, packageRootUrl)), "utf8");
 }
 async function joinPackageMaterials(relativePaths) {
   const chunks = [];
@@ -12018,12 +12238,12 @@ function createSystemCollectorClock() {
   return {
     wallNow: () => /* @__PURE__ */ new Date(),
     monoNow: () => Number(process.hrtime.bigint() - start) / 1e6,
-    sleep: (ms, signal) => new Promise((resolve22, reject) => {
+    sleep: (ms, signal) => new Promise((resolve21, reject) => {
       if (signal?.aborted) {
         reject(signal.reason ?? new Error("aborted"));
         return;
       }
-      const timer = setTimeout(resolve22, ms);
+      const timer = setTimeout(resolve21, ms);
       const onAbort = () => {
         clearTimeout(timer);
         reject(signal?.reason ?? new Error("aborted"));
@@ -13225,11 +13445,11 @@ function reportEngineDetourCall(input) {
     recordPointer: pointer
   };
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function callFactFromSitianPayload(payload, pointer) {
-  if (!isRecord7(payload)) return void 0;
+  if (!isRecord8(payload)) return void 0;
   if (payload.tool !== ENGINE_DETOUR_TOOL_NAME) return void 0;
   if (typeof payload.toolCallId !== "string" || payload.toolCallId.length === 0) {
     return void 0;
@@ -13246,11 +13466,11 @@ function callFactFromSitianPayload(payload, pointer) {
   };
 }
 function invocationScopeIdOfRecord(record4) {
-  if (isRecord7(record4.subject)) {
+  if (isRecord8(record4.subject)) {
     const fromSubject = record4.subject.invocationScopeId;
     if (typeof fromSubject === "string" && fromSubject.length > 0) return fromSubject;
   }
-  if (isRecord7(record4.payload)) {
+  if (isRecord8(record4.payload)) {
     const fromPayload = record4.payload.invocationScopeId;
     if (typeof fromPayload === "string" && fromPayload.length > 0) return fromPayload;
   }
@@ -13310,7 +13530,7 @@ function readInvocationRecord(runDirectory) {
     const raw = JSON.parse(
       readFileSync3(join24(runDirectory, "invocation.json"), "utf8")
     );
-    return isRecord7(raw) ? raw : void 0;
+    return isRecord8(raw) ? raw : void 0;
   } catch (error) {
     if (error?.code === "ENOENT") return void 0;
     throw error;
@@ -13328,7 +13548,7 @@ function readInvocationSelectedHost(runDirectory) {
 }
 function withEngineDetourToolUsageFact(outcome, usage) {
   if (usage === void 0) return outcome;
-  const prior = isRecord7(outcome.decisiveFacts) ? outcome.decisiveFacts : {};
+  const prior = isRecord8(outcome.decisiveFacts) ? outcome.decisiveFacts : {};
   return {
     ...outcome,
     decisiveFacts: {
@@ -13398,13 +13618,13 @@ function resolveAuditDossier(source) {
   }
   return { status: "ok", runDirectory };
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readDoctorAuditSubjects(context) {
   const entries = context.sessionManager.getEntries?.() ?? [];
   for (const entry of entries) {
-    if (isRecord8(entry) && entry.type === "custom" && entry.customType === DOCTOR_CANDIDATE_ENTRY_TYPE) {
+    if (isRecord9(entry) && entry.type === "custom" && entry.customType === DOCTOR_CANDIDATE_ENTRY_TYPE) {
       return { status: "ok" };
     }
   }
@@ -13438,7 +13658,7 @@ var init_dossier_resolution = __esm({
 
 // src/package-resources/method-skill.ts
 import { createHash as createHash6 } from "node:crypto";
-import { readFile as readFile15, realpath as realpath6 } from "node:fs/promises";
+import { readFile as readFile16, realpath as realpath6 } from "node:fs/promises";
 import { join as join25 } from "node:path";
 function gitBlobOid(bytes) {
   const body = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : Buffer.from(bytes);
@@ -13461,11 +13681,11 @@ function resolvePackagedMethodSkillRoot(packageRoot, name) {
 function resolvePackagedMethodSkillPath(packageRoot, name) {
   return join25(resolvePackagedMethodSkillRoot(packageRoot, name), "SKILL.md");
 }
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseProvenance(raw, expectedName) {
-  if (!isRecord9(raw)) {
+  if (!isRecord10(raw)) {
     throw new Error(`Packaged method provenance must be an object for ${expectedName}`);
   }
   if (raw.name !== expectedName) {
@@ -13479,7 +13699,7 @@ function parseProvenance(raw, expectedName) {
   if (typeof raw.packageAdaptation !== "string" || raw.packageAdaptation.trim() === "") {
     throw new Error(`Packaged method provenance packageAdaptation must be nonblank`);
   }
-  if (!isRecord9(raw.upstream)) {
+  if (!isRecord10(raw.upstream)) {
     throw new Error(`Packaged method provenance upstream must be an object`);
   }
   const upstream = raw.upstream;
@@ -13506,12 +13726,12 @@ function parseProvenance(raw, expectedName) {
       `Packaged method provenance upstream must include nonblank tag or version`
     );
   }
-  if (!isRecord9(raw.files)) {
+  if (!isRecord10(raw.files)) {
     throw new Error(`Packaged method provenance files must be an object`);
   }
   const files = {};
   for (const [rel, entry] of Object.entries(raw.files)) {
-    if (!isRecord9(entry)) {
+    if (!isRecord10(entry)) {
       throw new Error(`Packaged method provenance file entry must be an object: ${rel}`);
     }
     if (typeof entry.sha256 !== "string" || !SHA256_RE.test(entry.sha256)) {
@@ -13557,7 +13777,7 @@ async function loadPackagedMethodSkillMaterial(packageRoot, name) {
   const provenancePath = join25(rootDirectory, "provenance.json");
   let provenanceRaw;
   try {
-    provenanceRaw = await readFile15(provenancePath, "utf8");
+    provenanceRaw = await readFile16(provenancePath, "utf8");
   } catch (error) {
     throw new PackagedMethodSkillUnavailableError(name, provenancePath, error);
   }
@@ -13574,7 +13794,7 @@ async function loadPackagedMethodSkillMaterial(packageRoot, name) {
     const absolute = join25(rootDirectory, rel);
     let bytes;
     try {
-      bytes = await readFile15(absolute);
+      bytes = await readFile16(absolute);
     } catch (error) {
       throw new PackagedMethodSkillUnavailableError(name, absolute, error);
     }
@@ -13590,7 +13810,7 @@ async function loadPackagedMethodSkillMaterial(packageRoot, name) {
   let raw;
   try {
     skillPath = await realpath6(skillPathConfigured);
-    raw = await readFile15(skillPath, "utf8");
+    raw = await readFile16(skillPath, "utf8");
   } catch (error) {
     throw new PackagedMethodSkillUnavailableError(name, skillPathConfigured, error);
   }
@@ -13882,11 +14102,11 @@ var init_navigator_invocation_identity = __esm({
 });
 
 // src/receipt-delivery-policy.ts
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseNoReceiptLifecycleFacts(input) {
-  if (!isRecord10(input) || typeof input.terminalToolCalled !== "boolean" || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT || input.sessionCompletion !== "settled-without-accepted-receipt" || input.acceptedReceipt !== false || typeof input.runPointer !== "string" || input.runPointer.trim() === "" || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === "" || !Array.isArray(input.rejectedReceipts) || !input.rejectedReceipts.every((item) => isRecord10(item) && typeof item.reason === "string")) {
+  if (!isRecord11(input) || typeof input.terminalToolCalled !== "boolean" || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT || input.sessionCompletion !== "settled-without-accepted-receipt" || input.acceptedReceipt !== false || typeof input.runPointer !== "string" || input.runPointer.trim() === "" || typeof input.attemptPointer !== "string" || input.attemptPointer.trim() === "" || !Array.isArray(input.rejectedReceipts) || !input.rejectedReceipts.every((item) => isRecord11(item) && typeof item.reason === "string")) {
     throw new TypeError("malformed no-receipt lifecycle facts");
   }
   return {
@@ -14145,7 +14365,7 @@ __export(settlement_exports, {
   withSubmissions: () => withSubmissions
 });
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { appendFile as appendFile2, readFile as readFile16, readdir as readdir6, writeFile as writeFile7 } from "node:fs/promises";
+import { appendFile as appendFile2, readFile as readFile17, readdir as readdir7, writeFile as writeFile7 } from "node:fs/promises";
 import { dirname as dirname14, join as join26 } from "node:path";
 function sealedLedgerHome(admitted) {
   return homeFromRunDirectory(admitted.runDirectory);
@@ -14289,10 +14509,10 @@ function presentControlledFailure(failure2, io) {
 }
 async function inspectJudgeSession(sessionFile) {
   try {
-    await readFile16(sessionFile, "utf8");
+    await readFile17(sessionFile, "utf8");
     return { state: "present" };
   } catch (error) {
-    if (isMissingPathError3(error)) return { state: "missing" };
+    if (isMissingPathError4(error)) return { state: "missing" };
     return {
       state: "unreadable",
       diagnostic: error instanceof Error ? error.message || error.name : String(error)
@@ -14492,7 +14712,7 @@ function explicitInternalKnownFailureClassificationInput(failure2) {
     ...failure2.details === void 0 ? {} : { knownDetails: failure2.details }
   };
 }
-function isMissingPathError3(error) {
+function isMissingPathError4(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 function sessionReadFailure(error, fallbackMessage) {
@@ -14521,7 +14741,7 @@ function sessionReadFailure(error, fallbackMessage) {
   return failed;
 }
 async function readBoundSessionEntries(sessionFile) {
-  const text = await readFile16(sessionFile, "utf8");
+  const text = await readFile17(sessionFile, "utf8");
   const entries = [];
   for (const line2 of text.trim().split("\n").filter(Boolean)) {
     try {
@@ -14587,7 +14807,7 @@ async function readSitianRetainedAuditorProviderStop(sessionFile) {
     const { records } = await readSitianRecords(recordFile);
     for (let i = records.length - 1; i >= 0; i -= 1) {
       const payload = records[i]?.payload;
-      if (!isRecord11(payload) || !isRecord11(payload.response)) continue;
+      if (!isRecord12(payload) || !isRecord12(payload.response)) continue;
       if (typeof payload.type === "string") continue;
       const stop = sessionProviderStopFromAssistant(payload.response);
       if (stop !== void 0) return stop;
@@ -14612,7 +14832,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
   try {
     parentEntries = await readBoundSessionEntries(sessionFile);
   } catch (error) {
-    if (isMissingPathError3(error)) return void 0;
+    if (isMissingPathError4(error)) return void 0;
     throw sessionReadFailure(error, "failed to read parent session for auditor binding");
   }
   const parentId = parentEntries.find((entry) => entry.type === "session")?.id;
@@ -14623,10 +14843,10 @@ async function loadBoundAuditorVolumes(sessionFile) {
   for (const childDirectory of childDirectories) {
     let names;
     try {
-      names = await readdir6(childDirectory);
+      names = await readdir7(childDirectory);
       sawAnyDirectory = true;
     } catch (error) {
-      if (isMissingPathError3(error)) continue;
+      if (isMissingPathError4(error)) continue;
       throw sessionReadFailure(error, "failed to read bound auditor session directory");
     }
     for (const file of names.filter((name) => name.endsWith(".jsonl")).sort().reverse()) {
@@ -14637,7 +14857,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
         throw sessionReadFailure(error, "failed to read discovered auditor session");
       }
       const header = entries.find((entry) => entry.type === "session");
-      if (!isRecord11(header)) continue;
+      if (!isRecord12(header)) continue;
       const bindingIndexes = [];
       for (let i = 0; i < entries.length; i += 1) {
         const entry = entries[i];
@@ -14651,7 +14871,7 @@ async function loadBoundAuditorVolumes(sessionFile) {
         end: idx + 1 < bindingIndexes.length ? bindingIndexes[idx + 1] : entries.length
       })) : [{ entry: void 0, start: 0, end: entries.length }];
       for (const { entry: bindingEntry, start, end } of bindingPasses) {
-        const bindingParent = bindingEntry !== void 0 && isRecord11(bindingEntry.data) && isRecord11(bindingEntry.data.parent) ? bindingEntry.data.parent : void 0;
+        const bindingParent = bindingEntry !== void 0 && isRecord12(bindingEntry.data) && isRecord12(bindingEntry.data.parent) ? bindingEntry.data.parent : void 0;
         const attemptEntryId = typeof bindingParent?.attemptEntryId === "string" ? bindingParent.attemptEntryId : void 0;
         const boundSessionFile = typeof bindingParent?.sessionFile === "string" ? bindingParent.sessionFile : typeof header.parentSession === "string" ? header.parentSession : void 0;
         if (boundSessionFile !== sessionFile) continue;
@@ -14675,12 +14895,12 @@ function complianceFailureFromAuditorVolumes(volumes) {
     if (stop === void 0) continue;
     for (let i = entries.length - 1; i >= 0; i -= 1) {
       const entry = entries[i];
-      if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord11(entry.data)) continue;
-      const parent = isRecord11(entry.data.parent) ? entry.data.parent : void 0;
-      const failure2 = isRecord11(entry.data.failure) ? entry.data.failure : void 0;
+      if (entry?.type !== "custom" || entry.customType !== AUDITOR_COMPLIANCE_FAILURE_ENTRY_TYPE || !isRecord12(entry.data)) continue;
+      const parent = isRecord12(entry.data.parent) ? entry.data.parent : void 0;
+      const failure2 = isRecord12(entry.data.failure) ? entry.data.failure : void 0;
       if (parent?.sessionId !== parentId || parent.sessionFile !== sessionFile || parent.attemptEntryId !== attemptEntryId) continue;
       if (failure2 === void 0) continue;
-      const identity = isRecord11(failure2.identity) ? failure2.identity : void 0;
+      const identity = isRecord12(failure2.identity) ? failure2.identity : void 0;
       const typedCause = failure2.cause === "provider" || failure2.cause === "activation" || failure2.cause === "session" || failure2.cause === "output" || failure2.cause === "timeout" ? failure2.cause : void 0;
       return {
         ...typedCause === void 0 ? {} : { cause: typedCause },
@@ -14689,7 +14909,7 @@ function complianceFailureFromAuditorVolumes(volumes) {
           ...typeof identity.code === "string" || typeof identity.code === "number" ? { code: identity.code } : {}
         } },
         ...typeof failure2.diagnostic === "string" ? { diagnostic: failure2.diagnostic } : {},
-        ...isRecord11(failure2.details) ? { details: failure2.details } : {}
+        ...isRecord12(failure2.details) ? { details: failure2.details } : {}
       };
     }
   }
@@ -14736,9 +14956,9 @@ function typedFailedTerminatingToolKnownFailure(entries) {
     if (classification.kind !== "infrastructure") continue;
     if (typeof message.toolCallId !== "string" || typeof message.toolName !== "string") continue;
     if (boundRoleToolCallForResult(attemptEntries, i, message, message.toolName) === void 0) continue;
-    const textPart = Array.isArray(message.content) ? message.content.find((part) => isRecord11(part) && part.type === "text" && typeof part.text === "string") : void 0;
-    const diagnostic = isRecord11(textPart) ? textPart.text : void 0;
-    const details = isRecord11(message.details) ? message.details : classification.fact;
+    const textPart = Array.isArray(message.content) ? message.content.find((part) => isRecord12(part) && part.type === "text" && typeof part.text === "string") : void 0;
+    const diagnostic = isRecord12(textPart) ? textPart.text : void 0;
+    const details = isRecord12(message.details) ? message.details : classification.fact;
     return {
       cause: "activation",
       identity: { name: message.toolName, code: message.toolCallId },
@@ -14774,7 +14994,7 @@ async function resolveAuditedRunnerFailureResolution(input) {
     );
     if (terminatingFailure !== void 0) return resolutionOf(terminatingFailure);
   } catch (error) {
-    if (!isMissingPathError3(error)) {
+    if (!isMissingPathError4(error)) {
       const failure2 = sessionReadFailure(error, "failed to recover typed terminating-tool failure");
       return resolutionOf({
         cause: "session",
@@ -14875,7 +15095,7 @@ function controlledFailureInputFromResolution(resolution) {
     } : {}
   };
 }
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function toolResultText(message) {
@@ -14900,7 +15120,7 @@ function extractCollectorTargetBindRejection(entries) {
     const diagnostic = toolResultText(message);
     if (diagnostic.length === 0) return void 0;
     const details = message.details;
-    const code = isRecord11(details) && typeof details.code === "string" && details.code.trim() !== "" ? details.code : void 0;
+    const code = isRecord12(details) && typeof details.code === "string" && details.code.trim() !== "" ? details.code : void 0;
     return code === void 0 ? { diagnostic } : { diagnostic, code };
   }
   return void 0;
@@ -14982,7 +15202,7 @@ function boundRoleToolCallForResult(entries, resultIndex, message, outputToolNam
     const candidateMessage = entries[index]?.message;
     if (candidateMessage?.role === "assistant" && Array.isArray(candidateMessage.content)) {
       for (const part of candidateMessage.content) {
-        if (!isRecord11(part) || part.type !== "toolCall" || part.id !== callId) {
+        if (!isRecord12(part) || part.type !== "toolCall" || part.id !== callId) {
           continue;
         }
         if (part.name !== outputToolName) return void 0;
@@ -15053,7 +15273,7 @@ function parseNavigatorAttendanceDetails(details) {
     if (typeof details.prose === "string" && details.prose.trim() !== "") {
       prose = details.prose;
     } else {
-      const next = isRecord11(details.next) && typeof details.next.role === "string" ? details.next.role : void 0;
+      const next = isRecord12(details.next) && typeof details.next.role === "string" ? details.next.role : void 0;
       const reason = typeof details.reason === "string" && details.reason.trim() !== "" ? details.reason : void 0;
       const command = typeof details.command === "string" && details.command.trim() !== "" ? details.command : void 0;
       if (reason !== void 0 && next !== void 0) {
@@ -15162,7 +15382,7 @@ function detourGateContext(admitted, scope) {
 }
 async function withOptionalGateProjection(base, sessionDirectory, gateContext = {}) {
   const secondaryEvidence = base.roleOutcome.kind === "failure" ? base.roleOutcome.decisiveFacts.secondaryEvidence : void 0;
-  const skipGate = isRecord11(secondaryEvidence) && secondaryEvidence.kind === "role_infrastructure_failure" && (secondaryEvidence.stage === "gatekeeper" || secondaryEvidence.stage === "inspector" || secondaryEvidence.stage === "notary");
+  const skipGate = isRecord12(secondaryEvidence) && secondaryEvidence.kind === "role_infrastructure_failure" && (secondaryEvidence.stage === "gatekeeper" || secondaryEvidence.stage === "inspector" || secondaryEvidence.stage === "notary");
   let next = base;
   if (!skipGate) {
     const gate = await extractGateFactFromSessionDirectory(sessionDirectory, gateContext);
@@ -15206,7 +15426,7 @@ function extractNavigatorFact(entries) {
     const entry = entries[i];
     if (entry?.type === "custom_message" && entry.customType === "ak-navigator-attendance") {
       const details = entry.message?.details ?? entry.details;
-      if (!isRecord11(details)) {
+      if (!isRecord12(details)) {
         return {
           disposition: "unavailable",
           source: "unknown",
@@ -15239,7 +15459,7 @@ async function extractNavigatorFactFromAdmittedSession(sessionFile) {
     const entries = await readBoundSessionEntries(sessionFile);
     return extractNavigatorFact(entries);
   } catch (error) {
-    if (isMissingPathError3(error)) {
+    if (isMissingPathError4(error)) {
       return {
         disposition: "unavailable",
         source: "unknown",
@@ -15352,7 +15572,7 @@ async function readLawfulSettlementEntries(sessionFile) {
   try {
     return await readBoundSessionEntries(sessionFile);
   } catch (error) {
-    if (isMissingPathError3(error)) return void 0;
+    if (isMissingPathError4(error)) return void 0;
     throw error instanceof Error && error.knownCause === "session" ? error : sessionReadFailure(error, "session unreadable");
   }
 }
@@ -15616,7 +15836,7 @@ async function settleLawfulCollectorTerminalResult(admitted, authority, scope) {
       const residual = boundErroredToolCandidate(entries, index, message, COLLECTOR_WAIT_TOOL);
       if (residual === void 0) continue;
       const candidate = residual.candidate;
-      const details = isRecord11(candidate) ? candidate : { candidate };
+      const details = isRecord12(candidate) ? candidate : { candidate };
       const failed = await settleFailureTerminalResult(
         admitted,
         {
@@ -15671,7 +15891,7 @@ function extractDoctorCandidateCostFact(entries) {
     const entry = entries[i];
     if (entry?.type === "custom" && entry.customType === DOCTOR_CANDIDATE_ENTRY_TYPE) {
       const data = entry.data;
-      return isRecord11(data) ? data.cost : void 0;
+      return isRecord12(data) ? data.cost : void 0;
     }
   }
   return void 0;
@@ -15682,7 +15902,7 @@ function extractDoctorCandidateAuditNoReceiptFact(entries) {
     const entry = entries[i];
     if (entry?.type === "custom" && entry.customType === DOCTOR_CANDIDATE_ENTRY_TYPE) {
       const data = entry.data;
-      return isRecord11(data) ? data.auditNoReceipt : void 0;
+      return isRecord12(data) ? data.auditNoReceipt : void 0;
     }
   }
   return void 0;
@@ -15847,7 +16067,7 @@ async function settleLawfulSeatAcceptedTerminalResult(admitted, authority, spec,
     );
   }
   if (residual !== void 0) {
-    const details = isRecord11(residual.candidate) ? residual.candidate : { candidate: residual.candidate };
+    const details = isRecord12(residual.candidate) ? residual.candidate : { candidate: residual.candidate };
     const failed = await settleFailureTerminalResult(
       admitted,
       {
@@ -15925,11 +16145,75 @@ async function settleLawfulDiaristTerminalResult(admitted, authority, scope) {
 async function trySettleDiaristTerminalResult(admitted, authority, scope) {
   return settleLawfulDiaristTerminalResult(admitted, authority, scope);
 }
+function countersignTerminalFromEntries(entries) {
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index];
+    if (entry?.type !== "custom") continue;
+    if (entry.customType !== SECRETARIAT_GATE_OFFICER_ENTRY_TYPE) continue;
+    const data = entry.data !== null && typeof entry.data === "object" && !Array.isArray(entry.data) ? entry.data : void 0;
+    if (data?.officer !== "countersign") continue;
+    if (data.receipt === void 0) continue;
+    const runId = typeof data.runId === "string" && data.runId.trim() !== "" ? data.runId : void 0;
+    return {
+      receipt: data.receipt,
+      ...runId === void 0 ? {} : { runId }
+    };
+  }
+  return void 0;
+}
+function withCountersignTerminalFact(roleOutcome, officer) {
+  const prior = roleOutcome.decisiveFacts !== void 0 && isRecord12(roleOutcome.decisiveFacts) ? roleOutcome.decisiveFacts : {};
+  return {
+    ...roleOutcome,
+    decisiveFacts: {
+      ...prior,
+      [SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY]: officer
+    }
+  };
+}
+function acceptedSecretariatDefinesOfficerProjection(roleOutcome) {
+  const payloads = roleOutcome.payloads ?? [];
+  for (let index = payloads.length - 1; index >= 0; index -= 1) {
+    const payload = payloads[index];
+    if (!isRecord12(payload)) continue;
+    const status = payload.secretariatStatus;
+    if (typeof status !== "string") continue;
+    return status === "converged";
+  }
+  return false;
+}
 async function settleLawfulSecretariatTerminalResult(admitted, authority, scope) {
-  return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+  const settled = await settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
     role: "secretariat",
     toolName: SECRETARIAT_OUTPUT_TOOL_NAME
   }, scope);
+  if (settled === void 0) return void 0;
+  const coordinates = coordinatesFromAdmitted(authority, admitted);
+  const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+  const officer = countersignTerminalFromEntries(entries);
+  if (officer === void 0) return settled;
+  if (settled.roleOutcome.kind === "audit_escalation") {
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(
+        {
+          ...settled.roleOutcome,
+          payloads: [officer.receipt]
+        },
+        officer
+      )
+    };
+  }
+  if (settled.roleOutcome.kind === "accepted") {
+    if (!acceptedSecretariatDefinesOfficerProjection(settled.roleOutcome)) {
+      return settled;
+    }
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(settled.roleOutcome, officer)
+    };
+  }
+  return settled;
 }
 async function trySettleSecretariatTerminalResult(admitted, authority, scope) {
   return settleLawfulSecretariatTerminalResult(admitted, authority, scope);
@@ -16171,7 +16455,7 @@ async function settleLawfulMergerTerminalResult(admitted, authority, options, sc
       const residual = boundErroredToolCandidate(entries, index, message, MERGER_OUTPUT_TOOL_NAME);
       if (residual === void 0) continue;
       const candidate = residual.candidate;
-      const details = isRecord11(candidate) ? candidate : { candidate };
+      const details = isRecord12(candidate) ? candidate : { candidate };
       const failed = await settleFailureTerminalResult(
         admitted,
         {
@@ -16500,10 +16784,10 @@ function presentFailureTerminal(terminal, io) {
 }
 function defaultNavigatorGraceSleep() {
   let timer;
-  const sleep = ((ms) => new Promise((resolve22) => {
+  const sleep = ((ms) => new Promise((resolve21) => {
     timer = setTimeout(() => {
       timer = void 0;
-      resolve22();
+      resolve21();
     }, ms);
   }));
   sleep.cancel = () => {
@@ -16515,7 +16799,7 @@ function defaultNavigatorGraceSleep() {
   return sleep;
 }
 function raceNavigatorGrace(work, graceMs = NAVIGATOR_POST_ROLE_GRACE_MS, sleep = defaultNavigatorGraceSleep()) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve21, reject) => {
     let settled = false;
     const finish = (action) => {
       if (settled) return;
@@ -16524,11 +16808,11 @@ function raceNavigatorGrace(work, graceMs = NAVIGATOR_POST_ROLE_GRACE_MS, sleep
       action();
     };
     void work.then(
-      (value) => finish(() => resolve22({ status: "done", value })),
+      (value) => finish(() => resolve21({ status: "done", value })),
       (error) => finish(() => reject(error))
     );
     void sleep(graceMs).then(() => {
-      finish(() => resolve22({ status: "timeout" }));
+      finish(() => resolve21({ status: "timeout" }));
     });
   });
 }
@@ -16620,7 +16904,7 @@ var init_seat_ticket_binding = __esm({
 });
 
 // src/session-identity.ts
-import { mkdir as mkdir3, readFile as readFile17, rename as rename2, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile18, rename as rename2, writeFile as writeFile8 } from "node:fs/promises";
 import { dirname as dirname15, join as join27 } from "node:path";
 function createSessionIdentityAuthority(authority, sessionBindingFile) {
   const bindingPath = (principal) => join27(authority.decode(principal).sessionDirectory, sessionBindingFile);
@@ -16630,7 +16914,7 @@ function createSessionIdentityAuthority(authority, sessionBindingFile) {
     },
     async load(principal) {
       try {
-        const value = JSON.parse(await readFile17(bindingPath(principal), "utf8"));
+        const value = JSON.parse(await readFile18(bindingPath(principal), "utf8"));
         if (typeof value !== "object" || value === null || typeof value.sessionId !== "string") {
           throw new Error("durable session binding is invalid");
         }
@@ -16669,7 +16953,7 @@ var init_session_identity = __esm({
 });
 
 // src/session-dialogue.ts
-function isRecord12(value) {
+function isRecord13(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function nativeEventId(row) {
@@ -16679,7 +16963,7 @@ function nativeEventId(row) {
   }
   for (const nestKey of ["message", "payload"]) {
     const nested = row[nestKey];
-    if (!isRecord12(nested)) continue;
+    if (!isRecord13(nested)) continue;
     for (const key of ["uuid", "id"]) {
       const value = nested[key];
       if (typeof value === "string" && value !== "") return value;
@@ -16692,19 +16976,19 @@ function textParts(content) {
   if (!Array.isArray(content)) return [];
   const out = [];
   for (const part of content) {
-    if (!isRecord12(part) || !SPEAKER_TEXT_PART_TYPES.has(String(part.type))) continue;
+    if (!isRecord13(part) || !SPEAKER_TEXT_PART_TYPES.has(String(part.type))) continue;
     const text = part.text;
     if (typeof text === "string" && text !== "") out.push(text);
   }
   return out;
 }
 function responseItemMessage(row) {
-  if (row.type !== "response_item" || !isRecord12(row.payload)) return void 0;
+  if (row.type !== "response_item" || !isRecord13(row.payload)) return void 0;
   if (row.payload.type !== "message") return void 0;
   return row.payload;
 }
 function messageBody(row) {
-  if (isRecord12(row.message)) return row.message;
+  if (isRecord13(row.message)) return row.message;
   return responseItemMessage(row);
 }
 function speakerOf(message) {
@@ -16714,7 +16998,7 @@ function speakerOf(message) {
 }
 function codexContentItemKinds(message) {
   const pass = message.internal_chat_message_metadata_passthrough;
-  if (!isRecord12(pass) || !Array.isArray(pass.content_item_kinds)) return void 0;
+  if (!isRecord13(pass) || !Array.isArray(pass.content_item_kinds)) return void 0;
   const kinds = [];
   for (const kind of pass.content_item_kinds) {
     if (typeof kind === "string" && kind !== "") kinds.push(kind);
@@ -16743,7 +17027,7 @@ function isFixedNonOwnerEnqueueShape(content) {
   return hasFixedOpenTagPrefix(content, TASK_NOTIFICATION_OPEN_TAG);
 }
 function materializationOriginKind(row) {
-  if (!isRecord12(row.origin)) return void 0;
+  if (!isRecord13(row.origin)) return void 0;
   const kind = row.origin.kind;
   return typeof kind === "string" && kind !== "" ? kind : void 0;
 }
@@ -16791,7 +17075,7 @@ var init_session_dialogue = __esm({
 
 // src/ticket-provenance.ts
 import { createHash as createHash7 } from "node:crypto";
-import { readFile as readFile18 } from "node:fs/promises";
+import { readFile as readFile19 } from "node:fs/promises";
 import { basename as basename8, dirname as dirname16, join as join28, resolve as resolve12 } from "node:path";
 function dialogueSessionSourceRoots(home) {
   const machineHome = typeof home === "string" && home.trim() !== "" ? home : packageMachineHome();
@@ -16887,7 +17171,7 @@ async function readTicketProvenance(ticketNumber, cwd, home) {
   const { recordFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
   let text;
   try {
-    text = await readFile18(recordFile, "utf8");
+    text = await readFile19(recordFile, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       return {
@@ -17367,7 +17651,7 @@ __export(case_dossier_delivery_exports, {
   loadCaseDossierReadingMaterial: () => loadCaseDossierReadingMaterial,
   projectCaseDossierPointerSection: () => projectCaseDossierPointerSection
 });
-import { mkdtemp as mkdtemp3, readFile as readFile19, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
+import { mkdtemp as mkdtemp3, readFile as readFile20, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join29 } from "node:path";
 async function projectCaseDossierPointerSection(input) {
@@ -17419,7 +17703,7 @@ async function loadCaseDossierReadingMaterial(runDirectory) {
   );
   let section;
   try {
-    section = await readFile19(frozenPath, "utf8");
+    section = await readFile20(frozenPath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -17442,7 +17726,7 @@ var init_case_dossier_delivery = __esm({
 });
 
 // src/host-transition-prior-native.ts
-import { access as access3, readdir as readdir7 } from "node:fs/promises";
+import { access as access3, readdir as readdir8 } from "node:fs/promises";
 import { dirname as dirname17, join as join30 } from "node:path";
 function isEnoent3(error) {
   return typeof error === "object" && error !== null && error.code === "ENOENT";
@@ -17460,7 +17744,7 @@ async function listSitianRecordPaths(sessionParent) {
   const sessionRoot = dirname17(sessionParent);
   let entries;
   try {
-    entries = await readdir7(sessionRoot, { withFileTypes: true });
+    entries = await readdir8(sessionRoot, { withFileTypes: true });
   } catch (error) {
     if (isEnoent3(error)) return [];
     throw error;
@@ -17534,6 +17818,24 @@ var init_public_run_credentials = __esm({
   }
 });
 
+// src/public-cli/process-cancel.ts
+function processCancelSignalName(signal) {
+  if (signal === void 0 || signal.aborted !== true) return void 0;
+  const reason = signal.reason;
+  if (reason === "SIGTERM" || reason === "SIGINT" || reason === "SIGHUP") {
+    return reason;
+  }
+  return void 0;
+}
+function processCancelDiagnostic(signalName) {
+  return `ak-role terminated by ${signalName}`;
+}
+var init_process_cancel = __esm({
+  "src/public-cli/process-cancel.ts"() {
+    "use strict";
+  }
+});
+
 // src/public-cli/auto-resume.ts
 import { constants as fsConstants2 } from "node:fs";
 import { randomUUID as randomUUID5 } from "node:crypto";
@@ -17585,7 +17887,7 @@ async function ensureRealArtifactsDirectory(runDirectory) {
       throw new Error("run artifact retention: artifacts path is not a real directory");
     }
   } catch (error) {
-    if (!isMissingPathError4(error)) throw error;
+    if (!isMissingPathError5(error)) throw error;
     await mkdir4(artifactsDir, { recursive: true });
     const created = await lstat6(artifactsDir);
     if (created.isSymbolicLink() || !created.isDirectory()) {
@@ -17617,7 +17919,7 @@ function serializeThrownValue(value, depth = 0, seen = /* @__PURE__ */ new WeakS
   }
   return value;
 }
-function isMissingPathError4(error) {
+function isMissingPathError5(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 function transferNestedValue(value, depth, seen) {
@@ -17836,6 +18138,10 @@ async function runWithAutoResumeLoop(options) {
         if (terminal !== void 0) presentTerminal(terminal, options.io);
         return result;
       }
+      if (processCancelSignalName(options.signal) !== void 0) {
+        if (terminal !== void 0) presentTerminal(terminal, options.io);
+        return result;
+      }
     }
     if (result !== void 0) {
       const terminal = result.terminal;
@@ -17869,6 +18175,28 @@ async function runWithAutoResumeLoop(options) {
           terminal
         };
       }
+      const cancelName = processCancelSignalName(options.signal);
+      if (cancelName !== void 0) {
+        const terminal = await attachDispatchExceptionTerminal(
+          options.admitted,
+          dispatchExceptionFailureTerminal({
+            role: options.admitted.role,
+            runId: options.admitted.runId,
+            causeError: lastThrownError,
+            errorFiles: retainedErrorFiles,
+            autoResumeAttempts,
+            endReason: `ak-role terminated by ${cancelName}`,
+            everyAttemptThrew
+          }),
+          options.io
+        );
+        await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
+        presentTerminal(terminal, options.io);
+        return {
+          exitCode: 1,
+          terminal
+        };
+      }
       if (!await isPrincipalAvailable(options.admitted.principal)) {
         const terminal = await attachDispatchExceptionTerminal(
           options.admitted,
@@ -17905,6 +18233,7 @@ var init_auto_resume = __esm({
     init_role_run_placement();
     init_run_lifecycle();
     init_config();
+    init_process_cancel();
     init_terminal();
     init_settlement();
     dummyIo = { stdout: () => {
@@ -17937,6 +18266,36 @@ function describeCaughtError(error) {
 function isStationChildOfficerDialogue(role, env) {
   return env.stationChild === true && isOfficerReviewSeat(role);
 }
+function withProcessCancelSkipAutoResume(result, signal) {
+  if (processCancelSignalName(signal) === void 0) {
+    return result;
+  }
+  return { ...result, skipAutoResume: true };
+}
+async function settleProcessCancelAfterTurn(input) {
+  const failed = await settleAfterTurnStarted(
+    input.admitted,
+    withEngineDetourInvocationScope(
+      {
+        timedOut: input.result.timedOut,
+        code: input.result.code,
+        stderr: input.result.stderr,
+        knownDiagnostic: processCancelDiagnostic(input.cancelName)
+      },
+      input.invocationScopeId
+    ),
+    input.adapters,
+    input.env.principalAuthority,
+    input.io,
+    input.persistRunState
+  );
+  return {
+    ...failed,
+    turnDispatched: true,
+    skipAutoResume: true,
+    ...input.deferredPersist
+  };
+}
 function withOnceSuccessfulBeforeDispatch(adapters) {
   const hook = adapters.beforeDispatch;
   if (hook === void 0) return adapters;
@@ -18097,6 +18456,31 @@ async function dispatchPostAdmissionTurn(input) {
   const finishAfterTurn = async (result) => {
     if (afterDispatchApplied) return result;
     afterDispatchApplied = true;
+    const cancelBeforeFinish = processCancelSignalName(env.signal);
+    if (cancelBeforeFinish !== void 0 && result.terminal !== void 0 && isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)) {
+      result = {
+        ...await settleAfterTurnStarted(
+          admitted,
+          withEngineDetourInvocationScope(
+            {
+              timedOut: false,
+              code: null,
+              stderr: "",
+              knownDiagnostic: processCancelDiagnostic(cancelBeforeFinish),
+              skipRunStateWrite: true
+            },
+            request.invocationScopeId
+          ),
+          adapters,
+          env.principalAuthority,
+          io,
+          persistRunState
+        ),
+        turnDispatched: true,
+        skipAutoResume: true,
+        ...deferredPersist
+      };
+    }
     try {
       if (admitted.ticketNumber === void 0) {
         const rows = await readRecordedSubmissionRows(
@@ -18243,20 +18627,26 @@ async function dispatchPostAdmissionTurn(input) {
     try {
       result = await env.roleTurnHost.executeTurn(turnRequest);
     } catch (error) {
+      const processCancelName = processCancelSignalName(env.signal);
       const settled2 = await settleAfterTurnStarted(
         admitted,
         withEngineDetourInvocationScope({
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: error
+          thrown: processCancelName === void 0 ? error : new Error(processCancelDiagnostic(processCancelName), { cause: error })
         }, request.invocationScopeId),
         adapters,
         env.principalAuthority,
         io,
         persistRunState
       );
-      return await finishAfterTurn({ ...settled2, turnDispatched: true, ...deferredPersist });
+      return await finishAfterTurn(
+        withProcessCancelSkipAutoResume(
+          { ...settled2, turnDispatched: true, ...deferredPersist },
+          env.signal
+        )
+      );
     }
     let stderrLogWriteFailure;
     try {
@@ -18296,7 +18686,8 @@ async function dispatchPostAdmissionTurn(input) {
         credential: credentialFailure,
         runDirectory: admitted.runDirectory
       });
-      const directHostFailureSignal = result.timedOut || result.knownFailure !== void 0 || runnerKnownFailure !== void 0 || credentialFailure !== void 0;
+      const processCancelName = processCancelSignalName(env.signal);
+      const directHostFailureSignal = result.timedOut || result.knownFailure !== void 0 || runnerKnownFailure !== void 0 || credentialFailure !== void 0 || processCancelName !== void 0;
       hostSignalFailed = directHostFailureSignal || result.code !== null && result.code !== 0 || resolution.knownFailure !== void 0;
       settled = await adapters.trySettle(admitted, env.principalAuthority, courtScope);
       if (settled !== void 0) {
@@ -18304,7 +18695,8 @@ async function dispatchPostAdmissionTurn(input) {
       }
       const settledIsFreshThisAttempt = settled === void 0 || settled.roleOutcome.kind !== "accepted" && settled.roleOutcome.kind !== "audit_escalation" ? true : await attemptProducedFreshSubmission(admitted, courtScope);
       const staleAcceptanceOutranksRealFailure = !settledIsFreshThisAttempt && hostSignalFailed;
-      if (settled !== void 0 && shouldPresent(settled) && !directHostFailureSignal && !staleAcceptanceOutranksRealFailure && stderrLogWriteFailure === void 0) {
+      const cancelAfterSettle = processCancelSignalName(env.signal);
+      if (settled !== void 0 && shouldPresent(settled) && !directHostFailureSignal && !staleAcceptanceOutranksRealFailure && stderrLogWriteFailure === void 0 && cancelAfterSettle === void 0) {
         if (settled.roleOutcome.kind === "accepted" && request.courtAttemptId !== void 0 && request.courtAttemptId.length > 0) {
           try {
             await clearCurrentCourt(admitted.runDirectory, request.courtAttemptId);
@@ -18341,6 +18733,22 @@ async function dispatchPostAdmissionTurn(input) {
       return await finishAfterTurn({ ...settledFailure, turnDispatched: true, ...deferredPersist });
     }
     if (settledOutcome !== void 0) {
+      const lateCancel = processCancelSignalName(env.signal);
+      if (lateCancel !== void 0) {
+        return await finishAfterTurn(
+          await settleProcessCancelAfterTurn({
+            admitted,
+            cancelName: lateCancel,
+            result,
+            adapters,
+            env,
+            io,
+            persistRunState,
+            deferredPersist,
+            invocationScopeId: request.invocationScopeId
+          })
+        );
+      }
       if (persistRunState) {
         try {
           await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -18359,13 +18767,19 @@ async function dispatchPostAdmissionTurn(input) {
             io,
             persistRunState
           );
-          return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
+          return await finishAfterTurn(
+            withProcessCancelSkipAutoResume(
+              { ...failed, turnDispatched: true, ...deferredPersist },
+              env.signal
+            )
+          );
         }
       }
       return await finishAfterTurn({ ...settledOutcome, ...deferredPersist });
     }
     if (hostSignalFailed) {
       const resolutionInput = controlledFailureInputFromResolution(resolution);
+      const processCancelName = processCancelSignalName(env.signal);
       const stderrLogWriteDetails = stderrLogWriteFailure === void 0 ? void 0 : { stderrLogWriteFailure: describeCaughtError(stderrLogWriteFailure) };
       const failed = await settleAfterTurnStarted(
         admitted,
@@ -18374,6 +18788,7 @@ async function dispatchPostAdmissionTurn(input) {
           code: result.code,
           stderr: result.stderr,
           ...resolutionInput,
+          ...processCancelName === void 0 ? {} : { knownDiagnostic: processCancelDiagnostic(processCancelName) },
           // Secondary fact only — never the cause. Rides on whichever channel
           // classification actually reads (knownFailure.details owns it when
           // a knownFailure exists; the top-level knownDetails otherwise).
@@ -18389,7 +18804,12 @@ async function dispatchPostAdmissionTurn(input) {
         io,
         persistRunState
       );
-      return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
+      return await finishAfterTurn(
+        withProcessCancelSkipAutoResume(
+          { ...failed, turnDispatched: true, ...deferredPersist },
+          env.signal
+        )
+      );
     }
     if (stderrLogWriteFailure !== void 0) {
       const failed = await settleAfterTurnStarted(
@@ -18412,6 +18832,22 @@ async function dispatchPostAdmissionTurn(input) {
       await settleHostEndedNoReceipt(admitted, env.principalAuthority, courtScope),
       courtScope
     );
+    const noReceiptCancel = processCancelSignalName(env.signal);
+    if (noReceiptCancel !== void 0) {
+      return await finishAfterTurn(
+        await settleProcessCancelAfterTurn({
+          admitted,
+          cancelName: noReceiptCancel,
+          result,
+          adapters,
+          env,
+          io,
+          persistRunState,
+          deferredPersist,
+          invocationScopeId: request.invocationScopeId
+        })
+      );
+    }
     if (persistRunState) {
       try {
         await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
@@ -18430,7 +18866,12 @@ async function dispatchPostAdmissionTurn(input) {
           io,
           persistRunState
         );
-        return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
+        return await finishAfterTurn(
+          withProcessCancelSkipAutoResume(
+            { ...failed, turnDispatched: true, ...deferredPersist },
+            env.signal
+          )
+        );
       }
     }
     return await finishAfterTurn({
@@ -18626,6 +19067,7 @@ async function runPostAdmissionSeatResume(input) {
         io: input.io,
         sessionAppender: env.sessionAppender,
         autoResumeLimit: env.autoResumeLimit,
+        ...env.signal === void 0 ? {} : { signal: env.signal },
         buildInitialPayload: () => ({ resumeTurn: false }),
         buildResumePayload: () => ({ resumeTurn: true }),
         // Same as public manual resume: prior-court sealed acceptance is not a
@@ -18729,6 +19171,7 @@ async function runPostAdmissionResumable(input) {
     io,
     sessionAppender: env.sessionAppender,
     autoResumeLimit: env.autoResumeLimit,
+    ...env.signal === void 0 ? {} : { signal: env.signal },
     buildInitialPayload: buildScopedInitial,
     buildResumePayload: buildScopedResume,
     dispatch: async (request, lease, _isFirst, attemptIo) => {
@@ -18837,6 +19280,7 @@ var init_post_admission = __esm({
     init_host_transition_prior_native();
     init_public_run_credentials();
     init_run_lifecycle();
+    init_process_cancel();
     init_activation_ledger_topology();
     init_settlement();
     init_terminal();
@@ -20097,7 +20541,9 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
               {
                 instruction: parsed.instruction,
                 projectRoot: admitted.projectRoot,
-                failureLabel: "unbound summons"
+                failureLabel: "unbound summons",
+                // #969: parent durable ticket is the resume/bind key (ADR 0079).
+                ...env.boundTicketNumber === void 0 ? {} : { boundTicketNumber: env.boundTicketNumber }
               },
               env,
               io
@@ -20149,12 +20595,16 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
             );
           }
           if (outcome.identity.kind === "ticket") {
-            const assertedTicket = outcome.identity.ticketNumber;
-            typedTicket = assertedTicket;
+            typedTicket = isSafePositiveTicketNumber(env.boundTicketNumber) ? env.boundTicketNumber : outcome.identity.ticketNumber;
             typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+          } else if (isSafePositiveTicketNumber(env.boundTicketNumber)) {
+            typedTicket = env.boundTicketNumber;
+          }
+          if (typedTicket !== void 0) {
+            const resumeInstruction = env.reviewReask ?? env.gateReviewInstruction ?? parsed.instruction;
             const summons = {
-              instruction: parsed.instruction,
-              instructionEmpty: parsed.instruction.trim() === ""
+              instruction: resumeInstruction,
+              instructionEmpty: resumeInstruction.trim() === ""
             };
             const resumed = await tryResumeSameTicketSeatRun({
               home: env.home,
@@ -20236,7 +20686,9 @@ async function runPublicCountersign(argv, env, io, parseCountersignArgv2) {
           ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
           continuation: {
             kind: "initial",
-            prompt: buildCountersignTransportPrompt(
+            // #969/#879: gate path first mint carries parent payload as dialogue content;
+            // ordinary public entry keeps package transport prompt.
+            prompt: env.reviewReask ?? env.gateReviewInstruction ?? buildCountersignTransportPrompt(
               admitted,
               engineSessionMaterialFromOptions({
                 ...pickEngineAxis(env),
@@ -21378,6 +21830,25 @@ async function summonGateOfficer(options) {
       ...common
     });
   }
+  if (options.officer === "countersign") {
+    const { runIdFromRunDirectory: runIdFromRunDirectory2 } = await Promise.resolve().then(() => (init_run_terminal_artifacts(), run_terminal_artifacts_exports));
+    const correlationId = runIdFromRunDirectory2(options.sourceRunDirectory);
+    if (correlationId === void 0 || correlationId.trim() === "") {
+      throw new Error(
+        `countersign gate summon requires parent runId from sourceRunDirectory: ${options.sourceRunDirectory}`
+      );
+    }
+    const { readBoardTicketNumber: readBoardTicketNumber2 } = await Promise.resolve().then(() => (init_run_ticket_number(), run_ticket_number_exports));
+    const parentTicket = await readBoardTicketNumber2(options.sourceRunDirectory);
+    const instruction = options.reask ?? gateReviewInstruction ?? "";
+    return summonPublicRole({
+      role: "countersign",
+      argv: ["--project", options.cwd, "--", instruction],
+      ...common,
+      correlationId,
+      ...parentTicket === void 0 ? {} : { boundTicketNumber: parentTicket }
+    });
+  }
   return summonPublicRole({
     role: "inspector",
     argv: [`\u5377\u5B97\u6307\u9488\uFF1A${options.sourceRunDirectory}`],
@@ -21931,7 +22402,7 @@ var init_archivist_record_entry = __esm({
 import { randomUUID as randomUUID11 } from "node:crypto";
 
 // src/role-runtime-dependencies.ts
-import { readFile as readFile22 } from "node:fs/promises";
+import { readFile as readFile23 } from "node:fs/promises";
 import { join as join40 } from "node:path";
 
 // src/canonical-skill-binding.ts
@@ -22953,7 +23424,7 @@ ${helpContext}
 // src/navigator-work-context.ts
 init_doctor_evidence();
 init_host_contracts();
-import { readFile as readFile20 } from "node:fs/promises";
+import { readFile as readFile21 } from "node:fs/promises";
 import { resolve as resolve17 } from "node:path";
 init_notary_source_run();
 init_packaged_role_registry();
@@ -22966,7 +23437,7 @@ function navigatorInputReference(getFlag, role) {
 }
 async function loadNavigatorWorkContext(options) {
   const reference = navigatorInputReference(options.getFlag, options.role);
-  const input = reference === void 0 || options.role === "doctor" || options.role === "notary" ? void 0 : await readFile20(reference, "utf8");
+  const input = reference === void 0 || options.role === "doctor" || options.role === "notary" ? void 0 : await readFile21(reference, "utf8");
   const subjectRoot = subjectPath(reference ?? options.context.sessionManager.getSessionDir(), options.context.cwd);
   let subjectKey = reference === void 0 ? subjectRoot : navigatorSubjectKeyForInput(subjectRoot, reference, options.context.cwd);
   let subject = input ?? `work subject: ${subjectKey}`;
@@ -23023,7 +23494,7 @@ async function loadNavigatorWorkContext(options) {
   let authorityMaterial;
   for (const path of authorityFiles) {
     try {
-      const content = await readFile20(path, "utf8");
+      const content = await readFile21(path, "utf8");
       if (content.trim() !== "") {
         authorityMaterial = content;
         break;
@@ -23082,7 +23553,7 @@ init_sitian_facade();
 init_submission_ledger();
 init_collector_ledger();
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { readFileSync as readFileSync6, writeSync as writeSync4 } from "node:fs";
+import { readFileSync as readFileSync6, writeSync as writeSync3 } from "node:fs";
 import { join as join39 } from "node:path";
 import { Value as Value4 } from "typebox/value";
 
@@ -23124,16 +23595,7 @@ function namedActivationCause(error) {
 init_activation_ledger_topology();
 
 // src/activation-ledger.ts
-init_activation_ledger_topology();
 init_activation_ledger_git();
-import {
-  constants as constants2,
-  closeSync as closeSync2,
-  fstatSync,
-  openSync as openSync2,
-  writeSync
-} from "node:fs";
-import { dirname as dirname21, isAbsolute as isAbsolute10, resolve as resolve19 } from "node:path";
 
 // src/activation-ledger-session.ts
 init_activation_ledger_topology();
@@ -23237,129 +23699,11 @@ function durableSessionPointer(sessionManager) {
 
 // src/activation-ledger.ts
 init_activation_ledger_topology();
-var ACTIVATION_LEDGER_APPEND_OPEN_FLAGS = constants2.O_APPEND | constants2.O_CREAT | constants2.O_WRONLY | constants2.O_NOFOLLOW;
-var ACCEPTED_ACTIVATION_EVENT = "accepted-activation";
-var ACCEPTED_ACTIVATION_FACT_KEYS = Object.freeze([
-  "event",
-  "role",
-  "observedAt",
-  "bookKey",
-  "session",
-  "correlation"
-]);
-function correlationIdentityFromEnv(env = process.env) {
-  const raw = env.AK_CORRELATION_ID;
-  if (typeof raw === "string" && raw.trim().length > 0) {
-    return { kind: "caller", id: raw };
-  }
-  return { kind: "absent" };
-}
-function projectAcceptedActivationFact(input) {
-  const closed = {
-    event: ACCEPTED_ACTIVATION_EVENT,
-    role: input.role,
-    observedAt: input.observedAt,
-    bookKey: input.bookKey,
-    session: { kind: "session-file", path: input.session.path },
-    correlation: input.correlation.kind === "caller" ? { kind: "caller", id: input.correlation.id } : { kind: "absent" }
-  };
-  return Object.fromEntries(
-    ACCEPTED_ACTIVATION_FACT_KEYS.map((key) => [key, closed[key]])
-  );
-}
-function buildAcceptedActivationFact(input) {
-  return projectAcceptedActivationFact(input);
-}
-function serializeAcceptedActivationFact(fact) {
-  return `${JSON.stringify(projectAcceptedActivationFact(fact))}
-`;
-}
-function appendActivationLedgerLine(ledgerPath, line2, options) {
-  if (!isAbsolute10(options.ledgerHome)) {
-    throw new ActivationLedgerError(
-      `activation ledger home must be absolute: ${options.ledgerHome}`
-    );
-  }
-  const resolvedLedger = resolve19(ledgerPath);
-  const resolvedHome = resolve19(options.ledgerHome);
-  const parent = dirname21(resolvedLedger);
-  ensureRealDirectoryTree(resolvedHome, parent);
-  assertLedgerFileInsideHome(resolvedLedger, resolvedHome);
-  if (typeof constants2.O_NOFOLLOW !== "number") {
-    throw new ActivationLedgerError(
-      "activation ledger append requires O_NOFOLLOW open-flag support (anti-symlink TOCTOU protection must not be silently dropped); refusing to append"
-    );
-  }
-  const bytes = Buffer.isBuffer(line2) ? line2 : Buffer.from(line2);
-  let ledgerFd;
-  let primaryFailure;
-  try {
-    try {
-      ledgerFd = openSync2(resolvedLedger, ACTIVATION_LEDGER_APPEND_OPEN_FLAGS, 420);
-    } catch (error) {
-      throw new ActivationLedgerError(
-        `activation ledger failed to open ledger file (${resolvedLedger}): ${errorText(error)}`,
-        { cause: error }
-      );
-    }
-    let opened;
-    try {
-      opened = fstatSync(ledgerFd);
-    } catch (error) {
-      throw new ActivationLedgerError(
-        `activation ledger failed to fstat ledger file (${resolvedLedger}): ${errorText(error)}`,
-        { cause: error }
-      );
-    }
-    if (!opened.isFile()) {
-      throw new ActivationLedgerError(
-        `activation ledger is not a regular file: ${resolvedLedger}`
-      );
-    }
-    const written = writeSync(ledgerFd, bytes, 0, bytes.length, null);
-    if (written !== bytes.length) {
-      throw new ActivationLedgerError(
-        `activation ledger short write: wrote ${written} of ${bytes.length} bytes to ${resolvedLedger}`
-      );
-    }
-  } catch (error) {
-    primaryFailure = error;
-  }
-  if (ledgerFd !== void 0) {
-    try {
-      closeSync2(ledgerFd);
-    } catch (closeFailure) {
-      if (primaryFailure !== void 0) {
-        throw new AggregateError(
-          [primaryFailure, closeFailure],
-          "activation ledger operation and close failed",
-          { cause: primaryFailure }
-        );
-      }
-      throw closeFailure;
-    }
-  }
-  if (primaryFailure !== void 0) throw primaryFailure;
-}
-function appendAcceptedActivationFact(ledgerPath, fact, options) {
-  appendActivationLedgerLine(
-    ledgerPath,
-    Buffer.from(serializeAcceptedActivationFact(fact), "utf8"),
-    { ledgerHome: options.ledgerHome }
-  );
-}
-function appendAcceptedActivationToBook(options) {
-  appendAcceptedActivationFact(
-    activationWaitingLedgerPath(options.ledgerHome, options.fact.bookKey),
-    options.fact,
-    { ledgerHome: options.ledgerHome }
-  );
-}
 
 // src/stderr-jsonl.ts
-import { writeSync as writeSync2 } from "node:fs";
+import { writeSync } from "node:fs";
 var STDERR_JSONL_WRITE_RETRY_LIMIT = 100;
-function writeStderrJsonlRecord(record4, write = writeSync2) {
+function writeStderrJsonlRecord(record4, write = writeSync) {
   const bytes = Buffer.from(`${JSON.stringify(record4)}
 `);
   let offset = 0;
@@ -23379,7 +23723,7 @@ function writeStderrJsonlRecord(record4, write = writeSync2) {
 }
 
 // src/tool-execution-observation.ts
-import { writeSync as writeSync3 } from "node:fs";
+import { writeSync as writeSync2 } from "node:fs";
 import { Type as Type15 } from "typebox";
 import { Value as Value3 } from "typebox/value";
 var TOOL_EXECUTION_UPDATE_THROTTLE_MS = 3e4;
@@ -23410,7 +23754,7 @@ function validateToolExecutionObservationRecord(record4) {
   }
   return record4;
 }
-function writeToolExecutionObservationRecord(record4, write = writeSync3) {
+function writeToolExecutionObservationRecord(record4, write = writeSync2) {
   writeStderrJsonlRecord(validateToolExecutionObservationRecord(record4), write);
 }
 function isProducingToolUpdate(partialResult) {
@@ -23641,15 +23985,15 @@ init_collector_evidence();
 init_collector_github();
 
 // src/collector-handbook.ts
-import { readFile as readFile21 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 import { join as join38, sep as sep6 } from "node:path";
 
 // src/atomic-write.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { rename as rename3, rm as rm5, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname22, join as join37 } from "node:path";
+import { dirname as dirname21, join as join37 } from "node:path";
 async function writeFileAtomically(destination, contents) {
-  const parent = dirname22(destination);
+  const parent = dirname21(destination);
   const temporary = join37(parent, `.atomic-write-${randomUUID7()}.tmp`);
   try {
     await writeFile11(temporary, contents);
@@ -23804,7 +24148,7 @@ function createCollectorHandbookStore(input) {
     ensureRealDirectoryTree(input.ledgerHome, parentDir2);
     assertLedgerFileInsideHome(path, input.ledgerHome);
     try {
-      const body = await readFile21(path, "utf8");
+      const body = await readFile22(path, "utf8");
       assertHandbookBudget(body, "\u6B63\u6587");
       return body;
     } catch (error) {
@@ -25155,7 +25499,7 @@ init_submission_errors();
 init_submission_errors();
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync12, lstatSync as lstatSync3, readdirSync as readdirSync3, readFileSync as readFileSync5, rmdirSync, rmSync } from "node:fs";
-import { resolve as resolve20 } from "node:path";
+import { resolve as resolve19 } from "node:path";
 var WORKER_SUBMISSION_GATE_RECORD_KIND = WORKER_SUBMISSION_GATE_KIND;
 var WORKER_COMMIT_BASELINE_ENTRY_TYPE = "commit-baseline";
 var WORKER_COMMIT_REMINDER_BOUNCE_ENTRY_TYPE = "commit-reminder-bounce";
@@ -25204,7 +25548,7 @@ function escapeGitConfigValueRegex(value) {
 function unsetOwnedHooksPath(file) {
   const owned = [];
   for (const value of tryGetAll(file, "core.hooksPath")) {
-    if (!ownedHook(resolve20(value, HOOK_FILE))) continue;
+    if (!ownedHook(resolve19(value, HOOK_FILE))) continue;
     try {
       gitFile(file, [
         "--unset-all",
@@ -25219,15 +25563,15 @@ function unsetOwnedHooksPath(file) {
   return owned;
 }
 function rmOwnedDir(dir) {
-  const hookPath = resolve20(dir, HOOK_FILE);
+  const hookPath = resolve19(dir, HOOK_FILE);
   if (!ownedHook(hookPath)) return;
   rmSync(hookPath, { force: true });
   if (existsSync12(dir) && readdirSync3(dir).length === 0) rmdirSync(dir);
 }
 function linkedGitDirs(commonDir) {
-  const root = resolve20(commonDir, "worktrees");
+  const root = resolve19(commonDir, "worktrees");
   if (!existsSync12(root)) return [];
-  return readdirSync3(root).map((name) => resolve20(root, name)).filter((dir) => lstatSync3(dir).isDirectory());
+  return readdirSync3(root).map((name) => resolve19(root, name)).filter((dir) => lstatSync3(dir).isDirectory());
 }
 function uninstallPackageWorkerHooks(cwd) {
   let inside;
@@ -25241,17 +25585,17 @@ function uninstallPackageWorkerHooks(cwd) {
   const clear = (configFile) => {
     for (const hooks of unsetOwnedHooksPath(configFile)) rmOwnedDir(hooks);
   };
-  clear(resolve20(commonDir, "config"));
-  clear(resolve20(commonDir, "config.worktree"));
-  rmOwnedDir(resolve20(commonDir, HOOKS_DIR));
-  const legacy = resolve20(commonDir, "hooks", HOOK_FILE);
+  clear(resolve19(commonDir, "config"));
+  clear(resolve19(commonDir, "config.worktree"));
+  rmOwnedDir(resolve19(commonDir, HOOKS_DIR));
+  const legacy = resolve19(commonDir, "hooks", HOOK_FILE);
   if (ownedHook(legacy)) rmSync(legacy, { force: true });
   for (const gitDir of linkedGitDirs(commonDir)) {
-    clear(resolve20(gitDir, "config.worktree"));
-    rmOwnedDir(resolve20(gitDir, HOOKS_DIR));
+    clear(resolve19(gitDir, "config.worktree"));
+    rmOwnedDir(resolve19(gitDir, HOOKS_DIR));
   }
 }
-function isRecord13(value) {
+function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function unfinishedReasonPresent(details) {
@@ -25267,7 +25611,7 @@ function readGateState(session) {
     if (entry.type !== "custom") continue;
     if (entry.customType === WORKER_COMMIT_BASELINE_ENTRY_TYPE) {
       const data = entry.data;
-      if (isRecord13(data) && (data.head === null || typeof data.head === "string")) {
+      if (isRecord14(data) && (data.head === null || typeof data.head === "string")) {
         baseline = data.head;
       }
     } else if (entry.customType === WORKER_COMMIT_REMINDER_BOUNCE_ENTRY_TYPE) {
@@ -25818,7 +26162,6 @@ ${JSON.stringify(admitted)}
 // src/role-runtime.ts
 init_navigator_invocation_identity();
 init_gatekeeper_role();
-init_gatekeeper_role();
 init_submission_errors();
 init_doctor_contracts();
 init_doctor_evidence();
@@ -26001,7 +26344,7 @@ async function executeActivationStage(role, stage, infrastructure) {
     throw activationError;
   }
 }
-function writeActivationTraceRecord(record4, write = writeSync4) {
+function writeActivationTraceRecord(record4, write = writeSync3) {
   writeStderrJsonlRecord(record4, write);
 }
 var ActivationBarrierError = class extends Error {
@@ -26301,15 +26644,80 @@ ${error.message}`
 }
 var COUNTERSIGN_QUEUE_STATUSES = /* @__PURE__ */ new Set(["converged", "continue", "escalate"]);
 var COUNTERSIGN_STATUS_REASK = "countersignStatus \u4E0D\u662F converged\u3001continue\u3001escalate \u4E09\u6001\u4E4B\u4E00\u3002\u8BF7\u91CD\u65B0\u4EA4\u5377\uFF0Cstatus \u5199\u660E\u5176\u4E00\u3002";
-function createSecretariatRoleRuntime(roleHost, dependencies) {
+var SECRETARIAT_SUBMISSION_GATE_HOSTS = /* @__PURE__ */ new Set(["codex", "claude", "grok-build"]);
+var SECRETARIAT_QUEUE_STATUSES = /* @__PURE__ */ new Set(["converged", "escalate"]);
+var SECRETARIAT_STATUS_REASK = "secretariatStatus \u4E0D\u662F converged\u3001escalate \u4E4B\u4E00\u3002\u8BF7\u91CD\u65B0\u4EA4\u5377\uFF0Cstatus \u5199\u660E\u5176\u4E00\u3002";
+function createSecretariatRoleRuntime(roleHost, dependencies, hostActions) {
   let parentInstruction = "";
+  const beforeAccept = hostActions !== void 0 && roleHost.requireGatekeeperPass !== void 0 ? async ({ toolCallId, parameters, signal, ctx }) => {
+    const host = typeof ctx.host === "string" && ctx.host.trim() !== "" ? ctx.host.trim() : void 0;
+    if (host === void 0 || !SECRETARIAT_SUBMISSION_GATE_HOSTS.has(host)) {
+      return void 0;
+    }
+    const record4 = parameters !== null && typeof parameters === "object" && !Array.isArray(parameters) ? parameters : void 0;
+    const status = record4 !== void 0 && typeof record4.secretariatStatus === "string" ? record4.secretariatStatus : void 0;
+    if (status === void 0 || !SECRETARIAT_QUEUE_STATUSES.has(status)) {
+      throw new ParentQueueReaskError(SECRETARIAT_STATUS_REASK);
+    }
+    if (status === "escalate") {
+      return void 0;
+    }
+    try {
+      const pass = await roleHost.requireGatekeeperPass({
+        context: ctx,
+        subject: { kind: "secretariat_verdict" },
+        ...signal === void 0 ? {} : { signal },
+        hostActions,
+        toolCallId,
+        // #879: this-turn typed payload — identity-bound at submit site.
+        submission: parameters
+      });
+      if (pass !== void 0 && pass !== null && typeof pass === "object" && "receipt" in pass) {
+        const {
+          SECRETARIAT_GATE_OFFICER_ENTRY_TYPE: SECRETARIAT_GATE_OFFICER_ENTRY_TYPE2
+        } = await Promise.resolve().then(() => (init_secretariat_contracts(), secretariat_contracts_exports));
+        const runId = typeof pass.runId === "string" && pass.runId.trim() !== "" ? pass.runId : void 0;
+        ctx.sessionManager.appendCustomEntry?.(SECRETARIAT_GATE_OFFICER_ENTRY_TYPE2, {
+          officer: "countersign",
+          receipt: pass.receipt,
+          ...runId === void 0 ? {} : { runId }
+        });
+      }
+      return void 0;
+    } catch (error) {
+      if (error instanceof GatekeeperDecisionError && error.result.status === "escalate") {
+        const receipt = error.result.receipt;
+        const receiptRecord = receipt !== null && typeof receipt === "object" && !Array.isArray(receipt) ? receipt : void 0;
+        const runId = typeof error.result.runId === "string" && error.result.runId.trim() !== "" ? error.result.runId : void 0;
+        const {
+          SECRETARIAT_GATE_OFFICER_ENTRY_TYPE: SECRETARIAT_GATE_OFFICER_ENTRY_TYPE2
+        } = await Promise.resolve().then(() => (init_secretariat_contracts(), secretariat_contracts_exports));
+        ctx.sessionManager.appendCustomEntry?.(SECRETARIAT_GATE_OFFICER_ENTRY_TYPE2, {
+          officer: "countersign",
+          receipt,
+          ...runId === void 0 ? {} : { runId }
+        });
+        const { buildAuditEscalationResult: buildAuditEscalationResult2 } = await Promise.resolve().then(() => (init_audit_escalation(), audit_escalation_exports));
+        return buildAuditEscalationResult2(
+          {
+            status: "escalate",
+            officer: "countersign",
+            ...receiptRecord !== void 0 && Object.prototype.hasOwnProperty.call(receiptRecord, "decisionGate") ? { decisionGate: receiptRecord.decisionGate } : {}
+          },
+          receipt
+        );
+      }
+      throw error;
+    }
+  } : void 0;
   const base = createFiledOfficerRuntime(
     roleHost,
     {
       role: "secretariat",
       tool: SECRETARIAT_OUTPUT_TOOL_SPEC,
       acceptedText: SECRETARIAT_ACCEPTED_TEXT,
-      soulTag: "secretariat"
+      soulTag: "secretariat",
+      ...beforeAccept === void 0 ? {} : { beforeAccept }
     },
     dependencies
   );
@@ -26991,8 +27399,9 @@ function createRoleRuntimeExtension(dependencies) {
         if (!dependencies.loadSecretariatSoul) throw new Error("Secretariat runtime dependencies are not configured");
         return dependencies.loadSecretariatSoul();
       },
-      ...dependencies.packageRoot === void 0 ? {} : { packageRoot: dependencies.packageRoot }
-    });
+      ...dependencies.packageRoot === void 0 ? {} : { packageRoot: dependencies.packageRoot },
+      ...dependencies.hostAdapters === void 0 ? {} : { hostAdapters: dependencies.hostAdapters }
+    }, hostActions);
     const merger = createMergerRoleRuntime(roleHost, {
       async loadSoul() {
         if (!dependencies.loadMergerSoul) throw new Error("Merger runtime dependencies are not configured");
@@ -27233,11 +27642,8 @@ function createRoleRuntimeExtension(dependencies) {
         }
       };
       try {
-        const bookKey = resolveBookKeyFromGit(ctx.cwd);
-        const correlation = correlationIdentityFromEnv();
-        const sessionFile = ctx.sessionManager.getSessionFile?.() || ctx.sessionManager.getSessionDir?.();
-        const ledgerHome = resolveActivationLedgerHomeForPath(sessionFile);
-        const session = durableSessionPointer(ctx.sessionManager);
+        resolveBookKeyFromGit(ctx.cwd);
+        durableSessionPointer(ctx.sessionManager);
         const isStationChild = roleHost.getFlag(STATION_CHILD_FLAG.name) === true;
         if (dependencies.createNavigatorAttendance !== void 0 && entry.role !== "navigator" && !isStationChild) {
           navigatorSessionParent = ctx.sessionManager.getSessionFile();
@@ -27324,16 +27730,6 @@ function createRoleRuntimeExtension(dependencies) {
           if (entry.role === "coder") coder.armSubmissionGate(ctx.cwd, ctx.sessionManager);
           else fixer.armSubmissionGate(ctx.cwd, ctx.sessionManager);
         }
-        appendAcceptedActivationToBook({
-          ledgerHome,
-          fact: buildAcceptedActivationFact({
-            role: entry.role,
-            observedAt: clock(),
-            bookKey,
-            session,
-            correlation
-          })
-        });
         admitted = true;
       } catch (error) {
         failInfrastructure(error, ctx);
@@ -27358,12 +27754,12 @@ function createRoleRuntimeDependencies(packageRoot) {
     loadRoleReferenceMaterials: loadPackagedRoleReferenceMaterials,
     loadJudgeSoul: () => loadMainRoleSessionMaterials("judge"),
     loadFixerSoul: () => loadMainRoleSessionMaterials("fixer"),
-    loadFixPacket: (path) => readFile22(path, "utf8"),
+    loadFixPacket: (path) => readFile23(path, "utf8"),
     loadCoderSoul: () => loadMainRoleSessionMaterials("coder"),
-    loadCoderTask: (path) => readFile22(path, "utf8"),
+    loadCoderTask: (path) => readFile23(path, "utf8"),
     loadReviewerSoul: () => loadMainRoleSessionMaterials("reviewer"),
     loadCollectorSoul: () => loadMainRoleSessionMaterials("collector"),
-    loadCollectorHandbookSeed: () => readFile22(collectorHandbookSeedPath, "utf8"),
+    loadCollectorHandbookSeed: () => readFile23(collectorHandbookSeedPath, "utf8"),
     createCollectorTransport: () => createGhCollectorGitHubTransport(),
     loadDoctorSoul: () => loadMainRoleSessionMaterials("doctor"),
     loadDoctorCase,
@@ -27378,7 +27774,7 @@ function createRoleRuntimeDependencies(packageRoot) {
     loadSecretariatSoul: () => loadMainRoleSessionMaterials("secretariat"),
     loadNotarySourceRun: loadNotarySourceRunLocator,
     loadMergerSoul: () => loadMainRoleSessionMaterials("merger"),
-    loadMergerInput: async (path) => JSON.parse(await readFile22(path, "utf8")),
+    loadMergerInput: async (path) => JSON.parse(await readFile23(path, "utf8")),
     async loadCanonicalSkillBinding(name) {
       if (name === "tdd") {
         return loadPackagedCanonicalSkillBinding(packageRoot, "tdd");
@@ -27404,7 +27800,7 @@ function createRoleRuntimeDependencies(packageRoot) {
       authority: options.authority,
       invocationId: options.invocationId,
       loadSoul: () => loadMainRoleSessionMaterials("navigator"),
-      loadRoutePlaybook: () => readFile22(navigatorRoutePlaybookPath, "utf8"),
+      loadRoutePlaybook: () => readFile23(navigatorRoutePlaybookPath, "utf8"),
       loadRoleHelp: async (role) => formatNavigatorRoleHelp(role),
       createSession: navigatorSessionFactory,
       ...options.contextError === void 0 ? {} : { contextError: options.contextError },
@@ -27418,7 +27814,7 @@ init_engine_detour();
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { appendFile as appendFile3, mkdir as mkdir7, writeFile as writeFile12 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { dirname as dirname24, join as join42 } from "node:path";
+import { dirname as dirname23, join as join42 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/gatekeeper-pass-envelope.ts
@@ -27438,6 +27834,7 @@ function createDefaultGateOfficerSummon(options) {
       ...options.home === void 0 ? {} : { home: options.home },
       ...options.packageRoot === void 0 ? {} : { packageRoot: options.packageRoot },
       ...options.roleTurnHost === void 0 ? {} : { roleTurnHost: options.roleTurnHost },
+      ...options.hostAdapters === void 0 ? {} : { hostAdapters: options.hostAdapters },
       ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId }
     });
   };
@@ -27486,9 +27883,15 @@ async function requireGatekeeperPass(options) {
         options.hostActions.failInfrastructure(error, options.context, options.toolCallId);
       }
     }
-    if (gatekeeper.status === "pass") return;
+    if (gatekeeper.status === "pass") {
+      return {
+        officer: projected.officer,
+        receipt: gatekeeper.receipt,
+        ...typeof gatekeeper.runId === "string" && gatekeeper.runId.trim() !== "" ? { runId: gatekeeper.runId } : {}
+      };
+    }
     if (gatekeeper.status === "needs_reask") {
-      reask = OFFICER_CONCLUSION_REASK;
+      reask = officerConclusionReask(projected.officer);
       continue;
     }
     if (gatekeeper.status === "transport_failure") {
@@ -27498,6 +27901,9 @@ async function requireGatekeeperPass(options) {
       });
       options.hostActions.failInfrastructure(failure2, options.context, options.toolCallId);
     }
+    if (gatekeeper.status === "escalate" && options.subject.kind === "secretariat_verdict") {
+      throw new GatekeeperDecisionError(gatekeeper);
+    }
     options.hostActions.bindSubmissionNonPass(options.toolCallId, gatekeeper);
     throw new GatekeeperDecisionError(gatekeeper);
   }
@@ -27505,14 +27911,14 @@ async function requireGatekeeperPass(options) {
 
 // src/host-native-method.ts
 import { lstat as lstat7, mkdir as mkdir6, readlink, realpath as realpath8, symlink } from "node:fs/promises";
-import { basename as basename10, dirname as dirname23, join as join41 } from "node:path";
+import { basename as basename10, dirname as dirname22, join as join41 } from "node:path";
 var HOST_METHOD_PLUGIN_NAME = "ak-methods";
 var packagedMethodsDir = (root) => join41(root, "resources", "methods");
 var packagedMethodPluginDir = (root) => join41(root, "dist", "method-host-plugin");
 function hostMethodSkills(methods) {
   return Object.freeze(methods.flatMap((method) => {
     if (method.kind !== "skill") return [];
-    const name = basename10(dirname23(method.path));
+    const name = basename10(dirname22(method.path));
     return name ? [Object.freeze({ name })] : [];
   }));
 }
@@ -27549,7 +27955,7 @@ async function installWorkspaceMethodSkills(cwd, packageRoot) {
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await mkdir6(dirname23(link), { recursive: true });
+  await mkdir6(dirname22(link), { recursive: true });
   try {
     await symlink(target, link);
   } catch (error) {
@@ -27566,11 +27972,11 @@ init_role_activation_flags();
 init_submission_correctable_error();
 init_navigator_invocation_identity();
 async function listen(server, path) {
-  await new Promise((resolve22, reject) => {
+  await new Promise((resolve21, reject) => {
     server.once("error", reject);
     server.listen(path, () => {
       server.off("error", reject);
-      resolve22();
+      resolve21();
     });
   });
 }
@@ -27606,7 +28012,7 @@ async function prepareRoleEnvelope(options) {
   const runId = request.runDirectory.split("/").filter(Boolean).at(-1) ?? randomUUID9();
   await mkdir7(request.runDirectory, { recursive: true });
   let sessionFile = options.sessionFile ?? join42(request.runDirectory, "session", "session.jsonl");
-  await mkdir7(dirname24(sessionFile), { recursive: true });
+  await mkdir7(dirname23(sessionFile), { recursive: true });
   if (request.continuation.kind !== "resume") {
     try {
       await writeFile12(
@@ -27656,7 +28062,7 @@ async function prepareRoleEnvelope(options) {
       getLeafEntry: () => sessionEntries.at(-1),
       getLeafId: () => runId,
       getEntries: () => sessionEntries,
-      getSessionDir: () => dirname24(sessionFile),
+      getSessionDir: () => dirname23(sessionFile),
       getSessionFile: () => sessionFile,
       getHeader: () => ({ type: "session", id: runId }),
       setSessionFile(path) {
@@ -27720,17 +28126,26 @@ async function prepareRoleEnvelope(options) {
     getActiveTools() {
       return [...preferredTools];
     },
-    async requireGatekeeperPass(options2) {
-      await requireGatekeeperPass({
-        context: options2.context,
-        subject: options2.subject,
-        ...options2.signal === void 0 ? {} : { signal: options2.signal },
+    async requireGatekeeperPass(gateOptions) {
+      const packageRoot = typeof options.dependencies.packageRoot === "string" ? options.dependencies.packageRoot : void 0;
+      return requireGatekeeperPass({
+        context: gateOptions.context,
+        subject: gateOptions.subject,
+        ...gateOptions.signal === void 0 ? {} : { signal: gateOptions.signal },
         hostActions: {
-          failInfrastructure: (error, _context, toolCallId) => options2.hostActions.failInfrastructure(error, options2.context, toolCallId),
-          bindSubmissionNonPass: options2.hostActions.bindSubmissionNonPass
+          failInfrastructure: (error, _context, toolCallId) => gateOptions.hostActions.failInfrastructure(error, gateOptions.context, toolCallId),
+          bindSubmissionNonPass: gateOptions.hostActions.bindSubmissionNonPass
         },
-        toolCallId: options2.toolCallId,
-        ...options2.submission === void 0 ? {} : { submission: options2.submission }
+        toolCallId: gateOptions.toolCallId,
+        ...gateOptions.submission === void 0 ? {} : { submission: gateOptions.submission },
+        // #969: package root + home reach nested 给事中/符宝郎 summons.
+        // hostAdapters (when set on deps) forward nested seat selection — production unset.
+        summonOfficer: createDefaultGateOfficerSummon({
+          cwd: gateOptions.context.cwd ?? request.cwd,
+          home: request.home,
+          ...packageRoot === void 0 ? {} : { packageRoot },
+          ...options.dependencies.hostAdapters === void 0 ? {} : { hostAdapters: options.dependencies.hostAdapters }
+        })
       });
     },
     on(...registration) {
@@ -28003,8 +28418,8 @@ async function prepareRoleEnvelope(options) {
     try {
       const closeAll = server.closeAllConnections;
       if (typeof closeAll === "function") closeAll.call(server);
-      await new Promise((resolve22, reject) => {
-        server.close((error) => error ? reject(error) : resolve22());
+      await new Promise((resolve21, reject) => {
+        server.close((error) => error ? reject(error) : resolve21());
       });
     } catch (error) {
       cleanupFailures.push(error);
@@ -28410,7 +28825,7 @@ import { spawn as spawn4, spawnSync } from "node:child_process";
 import { randomUUID as randomUUID10 } from "node:crypto";
 import { existsSync as existsSync13 } from "node:fs";
 import { writeFile as writeFile13 } from "node:fs/promises";
-import { dirname as dirname25, isAbsolute as isAbsolute11, join as join44, resolve as resolve21 } from "node:path";
+import { dirname as dirname24, isAbsolute as isAbsolute10, join as join44, resolve as resolve20 } from "node:path";
 
 // src/external-host-turn-loop.ts
 init_host_contracts();
@@ -28631,7 +29046,7 @@ function cwdIsGitWorkTree(cwd) {
   let dir = cwd;
   for (; ; ) {
     if (existsSync13(join44(dir, ".git"))) return true;
-    const parent = dirname25(dir);
+    const parent = dirname24(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -28659,10 +29074,10 @@ function resolveGitCommonDir(cwd) {
   if (raw === "") {
     throw new Error("git rev-parse --git-common-dir returned empty stdout");
   }
-  return isAbsolute11(raw) ? raw : resolve21(cwd, raw);
+  return isAbsolute10(raw) ? raw : resolve20(cwd, raw);
 }
 function spawnHeadlessTurn(options) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve21, reject) => {
     if (options.signal?.aborted) {
       reject(hostAbortedError("headless host aborted"));
       return;
@@ -28737,7 +29152,7 @@ function spawnHeadlessTurn(options) {
         reject(stdinDeliveryError);
         return;
       }
-      resolve22({ code, stdout: resultStdout, stderr, timedOut });
+      resolve21({ code, stdout: resultStdout, stderr, timedOut });
     };
     const onAbort = () => {
       child.kill("SIGTERM");