@akagilnc/pi-workflow-roles 0.1.4631 → 0.1.4641

package/dist/public-cli/main.js

@@ -374,6 +374,15 @@ var init_activation_ledger_topology = __esm({
 });
 
 // src/run-ticket-number.ts
+var run_ticket_number_exports = {};
+__export(run_ticket_number_exports, {
+  MIGRATION_TICKET_DERIVATION_PAGE: () => MIGRATION_TICKET_DERIVATION_PAGE,
+  isSafePositiveTicketNumber: () => isSafePositiveTicketNumber,
+  readBoardTicketNumber: () => readBoardTicketNumber,
+  readMigrationDerivedTicketNumber: () => readMigrationDerivedTicketNumber,
+  readRunTicketNumber: () => readRunTicketNumber,
+  requireSafePositiveTicketNumber: () => requireSafePositiveTicketNumber
+});
 import { readFile } from "node:fs/promises";
 import { join as join3 } from "node:path";
 function isEnoent(error) {
@@ -14940,11 +14949,13 @@ var init_diarist_contracts = __esm({
 });
 
 // src/secretariat-contracts.ts
-var SECRETARIAT_OUTPUT_TOOL_NAME;
+var SECRETARIAT_OUTPUT_TOOL_NAME, SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY;
 var init_secretariat_contracts = __esm({
   "src/secretariat-contracts.ts"() {
     "use strict";
     SECRETARIAT_OUTPUT_TOOL_NAME = "ak_secretariat_output";
+    SECRETARIAT_GATE_OFFICER_ENTRY_TYPE = "ak-secretariat-gate-officer";
+    SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY = "countersignTerminal";
   }
 });
 
@@ -16901,6 +16912,154 @@ var init_submission_errors = __esm({
   }
 });
 
+// src/run-terminal-artifacts.ts
+var run_terminal_artifacts_exports = {};
+__export(run_terminal_artifacts_exports, {
+  RUN_TERMINAL_ARTIFACT_FILES: () => RUN_TERMINAL_ARTIFACT_FILES,
+  RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS: () => RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS,
+  isUniqueErrorFallbackName: () => isUniqueErrorFallbackName,
+  readRunTerminalArtifact: () => readRunTerminalArtifact,
+  runIdFromRunDirectory: () => runIdFromRunDirectory
+});
+import { readdir as readdir2, readFile as readFile5 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname7, join as join11 } from "node:path";
+function isMissingPathError2(error) {
+  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+function errorText2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readUsableTerminalArtifactBody(body) {
+  if (body === null) {
+    return { ok: false, reason: "terminal artifact JSON value is null" };
+  }
+  if (!isRecord3(body)) {
+    return {
+      ok: false,
+      reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`
+    };
+  }
+  if (typeof body.role !== "string" || body.role.trim() === "") {
+    return {
+      ok: false,
+      reason: "terminal artifact missing nonblank producer-owned role field"
+    };
+  }
+  return { ok: true, body };
+}
+async function readTerminalArtifactAtPath(path, file) {
+  let raw;
+  try {
+    raw = await readFile5(path, "utf8");
+  } catch (error) {
+    if (isMissingPathError2(error)) return void 0;
+    return {
+      status: "unreadable",
+      file,
+      path,
+      reason: errorText2(error)
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return {
+      status: "unreadable",
+      file,
+      path,
+      reason: error instanceof Error ? error.message : `terminal artifact JSON parse failed: ${String(error)}`
+    };
+  }
+  const usable = readUsableTerminalArtifactBody(parsed);
+  if (!usable.ok) {
+    return {
+      status: "unreadable",
+      file,
+      path,
+      reason: usable.reason
+    };
+  }
+  return { status: "present", file, path, body: usable.body };
+}
+async function listUniqueErrorFallbackPaths(directories) {
+  const found = [];
+  for (const dir of directories) {
+    let names;
+    try {
+      names = await readdir2(dir);
+    } catch (error) {
+      if (isMissingPathError2(error)) continue;
+      throw error;
+    }
+    for (const name of names.sort((a, b) => a.localeCompare(b))) {
+      if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
+      found.push(join11(dir, name));
+    }
+  }
+  return found;
+}
+function runIdFromRunDirectory(runDirectory) {
+  const name = basename4(runDirectory);
+  const at = name.lastIndexOf("@");
+  if (at <= 0 || at === name.length - 1) return void 0;
+  return name.slice(0, at);
+}
+function presentUniqueFallbackBoundToRun(body, expectedRunId) {
+  if (expectedRunId === void 0) return false;
+  return typeof body.runId === "string" && body.runId === expectedRunId;
+}
+async function readRunTerminalArtifact(runDirectory) {
+  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
+  for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
+    const path = join11(artifactsDir, file);
+    const read = await readTerminalArtifactAtPath(path, file);
+    if (read !== void 0) return read;
+  }
+  for (const relative4 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
+    const path = join11(runDirectory, relative4);
+    const read = await readTerminalArtifactAtPath(path, "error.json");
+    if (read !== void 0) return read;
+  }
+  for (const path of await listUniqueErrorFallbackPaths([artifactsDir, runDirectory])) {
+    const read = await readTerminalArtifactAtPath(path, "error.json");
+    if (read !== void 0) return read;
+  }
+  const expectedRunId = runIdFromRunDirectory(runDirectory);
+  for (const path of await listUniqueErrorFallbackPaths([dirname7(runDirectory)])) {
+    const read = await readTerminalArtifactAtPath(path, "error.json");
+    if (read === void 0) continue;
+    if (read.status === "present") {
+      if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId)) continue;
+      return read;
+    }
+  }
+  return { status: "absent" };
+}
+function isUniqueErrorFallbackName(name) {
+  return UNIQUE_ERROR_FALLBACK_NAME.test(basename4(name));
+}
+var RUN_TERMINAL_ARTIFACT_FILES, RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS, UNIQUE_ERROR_FALLBACK_NAME;
+var init_run_terminal_artifacts = __esm({
+  "src/run-terminal-artifacts.ts"() {
+    "use strict";
+    init_role_run_placement();
+    RUN_TERMINAL_ARTIFACT_FILES = [
+      "report.json",
+      "error.json",
+      "audit-incomplete.json"
+    ];
+    RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS = [
+      "artifacts/error.settlement.json",
+      "error.settlement.json"
+    ];
+    UNIQUE_ERROR_FALLBACK_NAME = /^error\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json$/i;
+  }
+});
+
 // src/gatekeeper-role.ts
 var init_gatekeeper_role = __esm({
   "src/gatekeeper-role.ts"() {
@@ -16909,6 +17068,7 @@ var init_gatekeeper_role = __esm({
     init_submission_errors();
     init_inspector_contracts();
     init_gatekeeper_output();
+    init_run_terminal_artifacts();
     init_submission_errors();
   }
 });
@@ -16927,8 +17087,8 @@ var init_compliance_transport = __esm({
 
 // src/role-run-relocation.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { readdir as readdir2, readFile as readFile5, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join11, sep as sep2 } from "node:path";
+import { readdir as readdir3, readFile as readFile6, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join12, sep as sep2 } from "node:path";
 function isEnoent2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
@@ -17017,7 +17177,7 @@ function rewriteSummonsMaterials(value, rewrites) {
 }
 async function rewriteJsonObjectFile(path, fields, rewrites) {
   if (!existsSync5(path)) return;
-  const page = JSON.parse(await readFile5(path, "utf8"));
+  const page = JSON.parse(await readFile6(path, "utf8"));
   if (!isPlainObject(page)) return;
   rewriteRunDirectoryPathFieldsAgainstRewrites(page, fields, rewrites);
   await writeFile2(path, `${JSON.stringify(page, null, 2)}
@@ -17025,7 +17185,7 @@ async function rewriteJsonObjectFile(path, fields, rewrites) {
 }
 async function rewriteOfficerPointerFile(path, rewrites) {
   if (!existsSync5(path)) return;
-  const page = JSON.parse(await readFile5(path, "utf8"));
+  const page = JSON.parse(await readFile6(path, "utf8"));
   if (!isPlainObject(page)) return;
   if (page.kind !== "direct-officer-run-pointer") return;
   rewriteRunDirectoryPathFieldsAgainstRewrites(
@@ -17038,7 +17198,7 @@ async function rewriteOfficerPointerFile(path, rewrites) {
 }
 async function rewriteSitianRecordsJsonl(path, rewrites) {
   if (!existsSync5(path)) return;
-  const raw = await readFile5(path, "utf8");
+  const raw = await readFile6(path, "utf8");
   if (raw.length === 0) return;
   const endsWithNewline = raw.endsWith("\n");
   const lines = raw.split("\n");
@@ -17089,7 +17249,7 @@ async function rewriteSitianRecordsJsonl(path, rewrites) {
 }
 async function rewriteSessionTranscriptBindings(path, rewrites) {
   if (!existsSync5(path)) return;
-  const raw = await readFile5(path, "utf8");
+  const raw = await readFile6(path, "utf8");
   if (raw.length === 0) return;
   const endsWithNewline = raw.endsWith("\n");
   const lines = raw.split("\n");
@@ -17148,17 +17308,17 @@ async function rewriteSessionTranscriptBindings(path, rewrites) {
   );
 }
 async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
-  const sessionRoot = join11(pagesDirectory, "session");
+  const sessionRoot = join12(pagesDirectory, "session");
   async function walk(directory) {
     let entries;
     try {
-      entries = await readdir2(directory, { withFileTypes: true });
+      entries = await readdir3(directory, { withFileTypes: true });
     } catch (error) {
       if (isEnoent2(error)) return;
       throw error;
     }
     for (const entry of entries) {
-      const path = join11(directory, entry.name);
+      const path = join12(directory, entry.name);
       if (entry.isDirectory()) {
         await walk(path);
         continue;
@@ -17180,9 +17340,9 @@ async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
 async function rewriteRoleRunDurablePages(input) {
   const { pagesDirectory } = input;
   const rewrites = collectRewrites(input);
-  const admittedPath = join11(pagesDirectory, "admitted-request.json");
+  const admittedPath = join12(pagesDirectory, "admitted-request.json");
   if (existsSync5(admittedPath)) {
-    const page = JSON.parse(await readFile5(admittedPath, "utf8"));
+    const page = JSON.parse(await readFile6(admittedPath, "utf8"));
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page,
       ADMITTED_PAGE_FIELDS,
@@ -17210,9 +17370,9 @@ async function rewriteRoleRunDurablePages(input) {
     await writeFile2(admittedPath, `${JSON.stringify(page, null, 2)}
 `, "utf8");
   }
-  const invocationPath = join11(pagesDirectory, "invocation.json");
+  const invocationPath = join12(pagesDirectory, "invocation.json");
   if (existsSync5(invocationPath)) {
-    const page = JSON.parse(await readFile5(invocationPath, "utf8"));
+    const page = JSON.parse(await readFile6(invocationPath, "utf8"));
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page,
       INVOCATION_PAGE_FIELDS,
@@ -17225,9 +17385,9 @@ async function rewriteRoleRunDurablePages(input) {
       "utf8"
     );
   }
-  const statePath = join11(pagesDirectory, "run-state.json");
+  const statePath = join12(pagesDirectory, "run-state.json");
   if (existsSync5(statePath)) {
-    const page = JSON.parse(await readFile5(statePath, "utf8"));
+    const page = JSON.parse(await readFile6(statePath, "utf8"));
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page,
       RUN_STATE_PAGE_FIELDS,
@@ -17391,15 +17551,15 @@ var init_terminating_tools = __esm({
 });
 
 // src/doctor-evidence.ts
-import { readdir as readdir3, readFile as readFile6, realpath as realpath2, stat } from "node:fs/promises";
-import { dirname as dirname7, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
+import { readdir as readdir4, readFile as readFile7, realpath as realpath2, stat } from "node:fs/promises";
+import { dirname as dirname8, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
 function record2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function discoverCaseFiles(root) {
   const found = [];
   async function walk(dir, depth) {
-    for (const item of await readdir3(dir, { withFileTypes: true })) {
+    for (const item of await readdir4(dir, { withFileTypes: true })) {
       const path = resolve4(dir, item.name);
       if (item.isDirectory()) {
         await walk(path, depth + 1);
@@ -17419,7 +17579,7 @@ function accumulate(metric, value, source) {
 function timestamp(row) {
   return typeof row.timestamp === "string" && Number.isFinite(Date.parse(row.timestamp)) ? row.timestamp : void 0;
 }
-function isMissingPathError2(error) {
+function isMissingPathError3(error) {
   return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
 async function stableRunsIdentity(root) {
@@ -17429,9 +17589,9 @@ async function stableRunsIdentity(root) {
       const git2 = await stat(resolve4(cursor, ".git"));
       if (git2.isDirectory() || git2.isFile()) return relative2(cursor, root).split(sep3).join("/");
     } catch (error) {
-      if (!isMissingPathError2(error)) throw error;
+      if (!isMissingPathError3(error)) throw error;
     }
-    const parent = dirname7(cursor);
+    const parent = dirname8(cursor);
     if (parent === cursor) return root;
     cursor = parent;
   }
@@ -17507,7 +17667,7 @@ async function loadDoctorCase(runsPath) {
   const turns = { count: 0, sources: [] }, calls = { count: 0, sources: [] }, tokens = { count: 0, sources: [] };
   for (const path of await discoverCaseFiles(root)) {
     const id = relative2(root, path).split(sep3).join("/");
-    const bytes = await readFile6(path);
+    const bytes = await readFile7(path);
     const content = bytes.toString("utf8");
     const kind = id.endsWith(".jsonl") ? "session" : "stderr";
     evidence.push({ id, kind, byteLength: bytes.byteLength, contentLength: content.length, sha256: sha256Hex(bytes), content });
@@ -17520,7 +17680,7 @@ async function loadDoctorCase(runsPath) {
     accumulate(calls, result.calls, id);
     accumulate(tokens, result.tokens, id);
   }
-  const runDirs = (await readdir3(root, { withFileTypes: true })).filter((item) => item.isDirectory()).map((item) => item.name).sort();
+  const runDirs = (await readdir4(root, { withFileTypes: true })).filter((item) => item.isDirectory()).map((item) => item.name).sort();
   const legs = evidence.filter((entry) => entry.kind === "session").map((entry) => entry.id);
   const retryDirs = runDirs.filter((name) => /(?:^|[-_])retry(?:[-_]|$)/i.test(name));
   const rawBytes = evidence.filter((entry) => entry.kind === "session").reduce((sum, entry) => sum + entry.byteLength, 0);
@@ -17537,7 +17697,7 @@ var init_doctor_evidence = __esm({
 
 // src/collector-config.ts
 import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 function fail3(message, cause) {
   throw new Error(message, cause === void 0 ? void 0 : { cause });
 }
@@ -17580,7 +17740,7 @@ function emptyCollectorManifest() {
 async function loadCollectorManifest(path) {
   let bytes;
   try {
-    bytes = await readFile7(path);
+    bytes = await readFile8(path);
   } catch (error) {
     fail3(`Collector request manifest is unreadable at ${path}`, error);
   }
@@ -17615,7 +17775,7 @@ var init_collector_config = __esm({
 
 // src/collector-github.ts
 import { spawn as spawn2 } from "node:child_process";
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJson(text, label) {
@@ -17631,7 +17791,7 @@ function parsePullRequestNumberList(raw, label) {
   }
   const numbers = [];
   for (const item of raw) {
-    if (!isRecord3(item)) {
+    if (!isRecord4(item)) {
       throw new Error(`GitHub ${label} payload contains a non-object pull request entry`);
     }
     try {
@@ -17971,7 +18131,7 @@ var init_git_object_id = __esm({
 
 // src/merger-git-state.ts
 import { execFile as execFile2 } from "node:child_process";
-import { access as access2, readFile as readFile8 } from "node:fs/promises";
+import { access as access2, readFile as readFile9 } from "node:fs/promises";
 import { constants as fsConstants } from "node:fs";
 import { isAbsolute as isAbsolute4, resolve as resolve5 } from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -18041,7 +18201,7 @@ function createProductionMergerGitState(repositoryRoot = process.cwd()) {
       const mergeHeadPath = isAbsolute4(mergeHeadReported) ? mergeHeadReported : resolve5(repositoryRoot, mergeHeadReported);
       let sourceObjectId = "";
       if (await pathExists(mergeHeadPath)) {
-        const raw = exactUtf8(await readFile8(mergeHeadPath), "Git MERGE_HEAD");
+        const raw = exactUtf8(await readFile9(mergeHeadPath), "Git MERGE_HEAD");
         const mergeHeads = raw.trim().split(/\r?\n/).map((row) => row.trim()).filter(Boolean);
         if (mergeHeads.length === 0) throw new Error("Git MERGE_HEAD is empty");
         if (mergeHeads.length !== 1) throw new Error("Assigned repository does not have one ordinary in-progress merge");
@@ -18093,10 +18253,10 @@ var init_uuidv7 = __esm({
 });
 
 // src/typed-provider-http.ts
-import { readFile as readFile9, unlink, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { readFile as readFile10, unlink, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 function typedProviderHttpPath(runDirectory) {
-  return join12(runDirectory, TYPED_HTTP_FILE);
+  return join13(runDirectory, TYPED_HTTP_FILE);
 }
 async function clearTypedProviderHttpObservation(runDirectory) {
   try {
@@ -18111,7 +18271,7 @@ async function clearTypedProviderHttpObservation(runDirectory) {
 async function readLatestTypedProviderHttpObservation(runDirectory) {
   let text;
   try {
-    text = await readFile9(typedProviderHttpPath(runDirectory), "utf8");
+    text = await readFile10(typedProviderHttpPath(runDirectory), "utf8");
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return void 0;
@@ -18140,8 +18300,8 @@ var init_typed_provider_http = __esm({
 });
 
 // src/public-cli/run-lifecycle.ts
-import { chmod, lstat as lstat2, open, readdir as readdir4, readFile as readFile10, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename4, join as join13 } from "node:path";
+import { chmod, lstat as lstat2, open, readdir as readdir5, readFile as readFile11, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename5, join as join14 } from "node:path";
 function selectResumeContinuationPrompt(message, engineMaterial) {
   const lines = message !== void 0 ? [message] : [];
   return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
@@ -18180,7 +18340,7 @@ function renderResumeCommand(runId) {
 async function writeRoleRunState(runDirectory, record4) {
   const payload = { ...record4, runDirectory };
   await writeFile4(
-    join13(runDirectory, RUN_STATE_FILE),
+    join14(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -18230,7 +18390,7 @@ function parseCurrentCourtState(raw) {
 async function readRoleRunStateDisk(runDirectory) {
   let raw;
   try {
-    raw = JSON.parse(await readFile10(join13(runDirectory, RUN_STATE_FILE), "utf8"));
+    raw = JSON.parse(await readFile11(join14(runDirectory, RUN_STATE_FILE), "utf8"));
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return void 0;
     throw error;
@@ -18298,7 +18458,7 @@ async function writeRoleRunStateDisk(runDirectory, disk) {
     ...disk.currentCourt === void 0 ? {} : { currentCourt: disk.currentCourt }
   };
   await writeFile4(
-    join13(runDirectory, RUN_STATE_FILE),
+    join14(runDirectory, RUN_STATE_FILE),
     `${JSON.stringify(payload, null, 2)}
 `,
     "utf8"
@@ -18465,7 +18625,7 @@ function isProcessAlive(pid) {
 async function autopsyWriterLock(lockPath) {
   let content;
   try {
-    content = await readFile10(lockPath, "utf8");
+    content = await readFile11(lockPath, "utf8");
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return { verdict: "absent" };
     return { verdict: "unknown", reason: "unreadable", readFailure: error };
@@ -18524,7 +18684,7 @@ async function createWriterLease(lockPath, runDirectory, reportCleanupFailure) {
     },
     relocate(nextRunDirectory) {
       currentRunDirectory = nextRunDirectory;
-      currentLockPath = join13(nextRunDirectory, WRITER_LOCK_FILE);
+      currentLockPath = join14(nextRunDirectory, WRITER_LOCK_FILE);
     },
     async release() {
       if (released) return;
@@ -18563,10 +18723,10 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
   };
   const reportReadFailure = (error) => {
     reportDiagnostic(
-      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join13(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
+      `writer lease lock read failed (holder liveness unverifiable; lock left in place) at ${join14(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`
     );
   };
-  const lockPath = join13(runDirectory, WRITER_LOCK_FILE);
+  const lockPath = join14(runDirectory, WRITER_LOCK_FILE);
   let lastAutopsy = { verdict: "absent" };
   let lastReclaimFailure;
   for (let reclaimsLeft = WRITER_LEASE_RECLAIM_ROUNDS; ; reclaimsLeft -= 1) {
@@ -18621,10 +18781,10 @@ async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
 async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
   if (runId.trim() === "") return void 0;
   const ledgerHome = resolveActivationLedgerHome(home);
-  const booksRoot = join13(ledgerHome, "books");
+  const booksRoot = join14(ledgerHome, "books");
   let bookKeys;
   try {
-    bookKeys = await readdir4(booksRoot);
+    bookKeys = await readdir5(booksRoot);
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return void 0;
     throw error;
@@ -18641,7 +18801,7 @@ async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
       throw error;
     }
     for (const runDirectory of runDirectories) {
-      const entry = basename4(runDirectory);
+      const entry = basename5(runDirectory);
       if (onlyRole === void 0 && (entry === `${runId}@judge` || entry.startsWith(`${runId}@`)) || entry === `${runId}@${onlyRole}`) {
         matches.push(runDirectory);
       }
@@ -18662,7 +18822,7 @@ async function readRunParentPath(runDirectory) {
   let raw;
   try {
     raw = JSON.parse(
-      await readFile10(join13(runDirectory, "admitted-request.json"), "utf8")
+      await readFile11(join14(runDirectory, "admitted-request.json"), "utf8")
     );
   } catch (error) {
     if (errorCodeOf2(error) === "ENOENT") return void 0;
@@ -18683,7 +18843,7 @@ async function readRunParentPath(runDirectory) {
 async function runHasFormedSessionPrincipal(runDirectory) {
   const disk = await readRoleRunStateDisk(runDirectory);
   if (disk === void 0) return false;
-  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join13(disk.principalWire.sessionDirectory, "session.jsonl");
+  const sessionFile = typeof disk.principalWire.sessionFile === "string" && disk.principalWire.sessionFile.trim() !== "" ? disk.principalWire.sessionFile : join14(disk.principalWire.sessionDirectory, "session.jsonl");
   try {
     const stat2 = await lstat2(sessionFile);
     return stat2.isFile() && !stat2.isSymbolicLink();
@@ -18708,7 +18868,7 @@ async function findLatestRunIdForSeatTicket(input) {
   const suffix = `@${input.role}`;
   let best;
   for (const runDirectory of runDirectories) {
-    const entry = basename4(runDirectory);
+    const entry = basename5(runDirectory);
     if (!entry.endsWith(suffix)) continue;
     const runId = entry.slice(0, entry.length - suffix.length);
     if (runId.length === 0) continue;
@@ -18831,7 +18991,7 @@ async function loadResumableRunRecord(home, runId, authority) {
   let sourceRun;
   try {
     const raw = JSON.parse(
-      await readFile10(run.admittedRequestPath, "utf8")
+      await readFile11(run.admittedRequestPath, "utf8")
     );
     if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
       const record4 = raw;
@@ -18949,7 +19109,7 @@ async function loadResumableRunRecord(home, runId, authority) {
   let model;
   try {
     const invocationRaw = JSON.parse(
-      await readFile10(join13(run.runDirectory, "invocation.json"), "utf8")
+      await readFile11(join14(run.runDirectory, "invocation.json"), "utf8")
     );
     if (invocationRaw !== null && typeof invocationRaw === "object" && !Array.isArray(invocationRaw)) {
       const rec = invocationRaw;
@@ -19418,7 +19578,7 @@ __export(notary_source_run_exports, {
   loadNotarySourceRunLocator: () => loadNotarySourceRunLocator,
   resolveNotarySourceRunLocator: () => resolveNotarySourceRunLocator
 });
-import { dirname as dirname8, isAbsolute as isAbsolute6, join as join14, resolve as resolve6, basename as basename5 } from "node:path";
+import { dirname as dirname9, isAbsolute as isAbsolute6, join as join15, resolve as resolve6, basename as basename6 } from "node:path";
 import { lstat as lstat3, realpath as realpath3 } from "node:fs/promises";
 function parseRunDirectoryName(name) {
   const match = RUN_DIR_NAME.exec(name);
@@ -19449,10 +19609,10 @@ async function requireRunDirectory(candidate, display) {
       `notary --source-run must be a run directory: ${display}`
     );
   }
-  const identity = parseRunDirectoryName(basename5(real));
+  const identity = parseRunDirectoryName(basename6(real));
   if (identity === void 0) {
     throw new NotarySourceRunError(
-      `notary --source-run must be named <runId>@<role>: ${basename5(real)}`
+      `notary --source-run must be named <runId>@<role>: ${basename6(real)}`
     );
   }
   return real;
@@ -19464,20 +19624,20 @@ async function resolveNotarySourceRunLocator(options) {
   }
   const ledgerHome = resolveActivationLedgerHome(options.home);
   const bookKey = resolveBookKeyFromGit(options.projectRoot);
-  const bookRunsRoot = join14(activationBookDirectory(ledgerHome, bookKey), "runs");
+  const bookRunsRoot = join15(activationBookDirectory(ledgerHome, bookKey), "runs");
   let candidate;
   const bare = parseRunDirectoryName(raw);
   if (bare !== void 0 && !raw.includes("/") && !raw.includes("\\")) {
-    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join14(bookRunsRoot, `${bare.runId}@${bare.role}`);
+    candidate = await findRunDirectoryById(options.home, bare.runId, bookKey, bare.role) ?? join15(bookRunsRoot, `${bare.runId}@${bare.role}`);
   } else {
     candidate = isAbsolute6(raw) ? raw : resolve6(options.projectRoot, raw);
   }
   const real = await requireRunDirectory(candidate, raw);
-  const identity = parseRunDirectoryName(basename5(real));
+  const identity = parseRunDirectoryName(basename6(real));
   const bookIdentity = physicalPathIdentity(activationBookDirectory(ledgerHome, bookKey));
-  const parentIdentity = physicalPathIdentity(dirname8(real));
-  const subjectBookIdentity = physicalPathIdentity(dirname8(dirname8(dirname8(real))));
-  if (parentIdentity !== physicalPathIdentity(bookRunsRoot) && !(basename5(dirname8(real)) === "runs" && subjectBookIdentity === bookIdentity)) {
+  const parentIdentity = physicalPathIdentity(dirname9(real));
+  const subjectBookIdentity = physicalPathIdentity(dirname9(dirname9(dirname9(real))));
+  if (parentIdentity !== physicalPathIdentity(bookRunsRoot) && !(basename6(dirname9(real)) === "runs" && subjectBookIdentity === bookIdentity)) {
     throw new NotarySourceRunError(
       "notary --source-run must resolve to a retained run under the project machine-ledger book"
     );
@@ -19511,7 +19671,7 @@ async function resolveNotarySourceRunLocator(options) {
 }
 async function loadNotarySourceRunLocator(path) {
   const real = await requireRunDirectory(path, path);
-  const identity = parseRunDirectoryName(basename5(real));
+  const identity = parseRunDirectoryName(basename6(real));
   const runState = await readRoleRunIdentity(real);
   if (runState === void 0) {
     throw new NotarySourceRunError(
@@ -20720,14 +20880,14 @@ import { existsSync as existsSync6 } from "node:fs";
 import {
   lstat as lstat4,
   mkdtemp,
-  readFile as readFile11,
+  readFile as readFile12,
   realpath as realpath4,
   rename,
   rm,
   writeFile as writeFile5
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { basename as basename6, dirname as dirname9, isAbsolute as isAbsolute7, join as join15, resolve as resolve7, sep as sep4 } from "node:path";
+import { basename as basename7, dirname as dirname10, isAbsolute as isAbsolute7, join as join16, resolve as resolve7, sep as sep4 } from "node:path";
 function issueAdmissionPlacement(authority, request) {
   const ledgerHome = resolveActivationLedgerHome(request.home);
   const bookKey = resolveBookKeyFromGit(request.cwd);
@@ -20781,15 +20941,15 @@ async function writeRoleInvocationLedger(source, role, effectiveModel) {
     ...effectiveModelLedgerFields(effectiveModel)
   };
   await writeFile5(
-    join15(source.runDirectory, "invocation.json"),
+    join16(source.runDirectory, "invocation.json"),
     `${JSON.stringify(identity, null, 2)}
 `,
     "utf8"
   );
 }
 async function recordEffectiveInvocationModel(runDirectory, model, engine, host, engineModel) {
-  const ledgerPath = join15(runDirectory, "invocation.json");
-  const current = JSON.parse(await readFile11(ledgerPath, "utf8"));
+  const ledgerPath = join16(runDirectory, "invocation.json");
+  const current = JSON.parse(await readFile12(ledgerPath, "utf8"));
   const next = { ...current };
   if (model !== void 0) {
     next.provider = model.provider;
@@ -20821,8 +20981,8 @@ async function recordEffectiveInvocationModel(runDirectory, model, engine, host,
   );
 }
 async function mergeInvocationIdentityPage(runDirectory, fields) {
-  const ledgerPath = join15(runDirectory, "invocation.json");
-  const current = JSON.parse(await readFile11(ledgerPath, "utf8"));
+  const ledgerPath = join16(runDirectory, "invocation.json");
+  const current = JSON.parse(await readFile12(ledgerPath, "utf8"));
   await writeFile5(
     ledgerPath,
     `${JSON.stringify({
@@ -20838,7 +20998,7 @@ async function persistAdmittedSourceRunPath(admitted, sourceRunPath) {
     throw new Error("persistAdmittedSourceRunPath requires a non-empty sourceRunPath");
   }
   const admittedPath = admitted.admittedRequestPath;
-  const current = JSON.parse(await readFile11(admittedPath, "utf8"));
+  const current = JSON.parse(await readFile12(admittedPath, "utf8"));
   if (typeof current.sourceRunPath === "string") {
     if (current.sourceRunPath === sourceRunPath) return;
     throw new Error(
@@ -20864,7 +21024,7 @@ async function bindAdmittedTicketNumber(admitted, ticketNumber) {
 }
 async function recordAdmittedCorrelation(admitted, correlationId) {
   const current = JSON.parse(
-    await readFile11(admitted.admittedRequestPath, "utf8")
+    await readFile12(admitted.admittedRequestPath, "utf8")
   );
   const prior = [
     ...Array.isArray(current.correlationIds) ? current.correlationIds.filter(
@@ -20912,7 +21072,7 @@ async function bindCourtTicketNumbersOnAdmitted(admitted, courtTicketNumbers) {
   }
   const frozen = Object.freeze([...projected]);
   const admittedPath = admitted.admittedRequestPath;
-  const current = JSON.parse(await readFile11(admittedPath, "utf8"));
+  const current = JSON.parse(await readFile12(admittedPath, "utf8"));
   await writeFile5(
     admittedPath,
     `${JSON.stringify({ ...current, courtTicketNumbers: frozen }, null, 2)}
@@ -20934,7 +21094,7 @@ async function relocateAdmittedRunToTicket(admitted, authority, heldLease) {
     runId: admitted.runId,
     role: admitted.role
   });
-  ensureRoleRunDirectory(ledgerHome, dirname9(target.runDirectory));
+  ensureRoleRunDirectory(ledgerHome, dirname10(target.runDirectory));
   await rename(oldRunDirectory, target.runDirectory);
   heldLease?.relocate(target.runDirectory);
   const admittedRecord = admitted;
@@ -20972,9 +21132,9 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
     ticketNumber,
     "bindTicketNumberOnRunDirectory"
   );
-  const admittedPath = join15(runDirectory, "admitted-request.json");
-  const invocationPath = join15(runDirectory, "invocation.json");
-  const admitted = JSON.parse(await readFile11(admittedPath, "utf8"));
+  const admittedPath = join16(runDirectory, "admitted-request.json");
+  const invocationPath = join16(runDirectory, "invocation.json");
+  const admitted = JSON.parse(await readFile12(admittedPath, "utf8"));
   const existing = admitted.ticketNumber;
   if (typeof existing === "number") {
     if (existing === ticketNumber) return;
@@ -20984,7 +21144,7 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
   }
   if (existsSync6(invocationPath)) {
     const invocation = JSON.parse(
-      await readFile11(invocationPath, "utf8")
+      await readFile12(invocationPath, "utf8")
     );
     if (typeof invocation.ticketNumber === "number" && invocation.ticketNumber !== ticketNumber) {
       throw new Error(
@@ -21009,7 +21169,7 @@ async function recordLaunchedPiIdentity(runDirectory, identity) {
 async function observeLaunchedRolePackageIdentity(packageRoot2, selectedRoleEntry) {
   const rolePackageRoot = packageRoot2;
   const raw = JSON.parse(
-    await readFile11(join15(rolePackageRoot, "package.json"), "utf8")
+    await readFile12(join16(rolePackageRoot, "package.json"), "utf8")
   );
   if (typeof raw.version !== "string" || raw.version.trim() === "") {
     throw new Error(
@@ -21294,7 +21454,7 @@ async function readRegularFileAttachment(sourcePath) {
     );
   }
   try {
-    return { absolute, bytes: await readFile11(absolute) };
+    return { absolute, bytes: await readFile12(absolute) };
   } catch (error) {
     throw new CliUsageError(
       `attachment is not a readable regular file: ${sourcePath}`,
@@ -21307,13 +21467,13 @@ async function removePreparedAttachmentDirectory(stagingDirectory) {
 }
 async function withPreparedAttachments(attachmentPaths, use) {
   if (attachmentPaths.length === 0) return await use([]);
-  const stagingDirectory = await mkdtemp(join15(tmpdir(), "ak-role-attachments-"));
+  const stagingDirectory = await mkdtemp(join16(tmpdir(), "ak-role-attachments-"));
   const prepared = [];
   let result;
   try {
     for (let index = 0; index < attachmentPaths.length; index += 1) {
       const { absolute, bytes } = await readRegularFileAttachment(attachmentPaths[index]);
-      const snapshotPath = join15(stagingDirectory, String(index).padStart(6, "0"));
+      const snapshotPath = join16(stagingDirectory, String(index).padStart(6, "0"));
       await writeFile5(snapshotPath, bytes);
       prepared.push({ absolute, snapshotPath });
     }
@@ -21334,9 +21494,9 @@ async function withPreparedAttachments(attachmentPaths, use) {
   return result;
 }
 async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, index) {
-  const frozenPath = join15(
+  const frozenPath = join16(
     destinationDir,
-    `${String(index).padStart(2, "0")}-${basename6(provenancePath)}`
+    `${String(index).padStart(2, "0")}-${basename7(provenancePath)}`
   );
   await writeFile5(frozenPath, bytes);
   return {
@@ -21350,7 +21510,7 @@ async function freezeAttachmentBytes(provenancePath, bytes, destinationDir, inde
 async function freezePreparedAttachment(prepared, destinationDir, index) {
   return freezeAttachmentBytes(
     prepared.absolute,
-    await readFile11(prepared.snapshotPath),
+    await readFile12(prepared.snapshotPath),
     destinationDir,
     index
   );
@@ -21377,14 +21537,14 @@ async function freezeAttachments(attachmentPaths, attachmentsDirectory) {
 async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, summonsKey = `s-${Date.now().toString(36)}`) {
   if (attachmentPaths.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = join15(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = join16(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   return freezeAttachments(attachmentPaths, attachmentsDirectory);
 }
 async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
   if (prepared.length === 0) return [];
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
-  const attachmentsDirectory = summonsKey === void 0 ? join15(runDirectory, "attachments") : join15(runDirectory, "attachments", summonsKey);
+  const attachmentsDirectory = summonsKey === void 0 ? join16(runDirectory, "attachments") : join16(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
   const attachments = [];
   for (let index = 0; index < prepared.length; index += 1) {
@@ -21446,7 +21606,7 @@ async function admitStandardMaterialInvocation(role, options) {
     })),
     ...ticketFields
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -21555,7 +21715,7 @@ async function admitCountersignInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   if (options.deferPersistence !== true) {
     await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
       sessionDirectory,
@@ -21606,7 +21766,7 @@ function buildCountersignTransportPrompt(admitted, engineMaterial) {
 async function loadAdmittedJudgeRequest(runDirectory) {
   try {
     const raw = JSON.parse(
-      await readFile11(join15(runDirectory, "admitted-request.json"), "utf8")
+      await readFile12(join16(runDirectory, "admitted-request.json"), "utf8")
     );
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
     const record4 = raw;
@@ -21661,7 +21821,7 @@ async function admitCoderInvocation(options) {
     home: options.home
   });
   const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-  const taskPath = join15(runDirectory, "task.md");
+  const taskPath = join16(runDirectory, "task.md");
   await writeFile5(taskPath, instruction, "utf8");
   const admitted = {
     role: "coder",
@@ -21682,7 +21842,7 @@ async function admitCoderInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -21732,7 +21892,7 @@ async function admitFixerInvocation(options) {
   if (options.prerequisitesPath !== void 0) {
     const absolutePrereq = isAbsolute7(options.prerequisitesPath) ? options.prerequisitesPath : resolve7(options.prerequisitesPath);
     try {
-      prerequisitesSource = await readFile11(absolutePrereq, "utf8");
+      prerequisitesSource = await readFile12(absolutePrereq, "utf8");
     } catch (error) {
       throw new CliUsageError(
         `fixer prerequisites path is unreadable: ${options.prerequisitesPath}`,
@@ -21768,7 +21928,7 @@ async function admitFixerInvocation(options) {
   const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
   let prerequisitesPath;
   if (prerequisitesSource !== void 0) {
-    prerequisitesPath = join15(runDirectory, "prerequisites.json");
+    prerequisitesPath = join16(runDirectory, "prerequisites.json");
     await writeFile5(
       prerequisitesPath,
       `${JSON.stringify(prerequisites, null, 2)}
@@ -21776,7 +21936,7 @@ async function admitFixerInvocation(options) {
       "utf8"
     );
   }
-  const packetPath = join15(runDirectory, "fix-packet.md");
+  const packetPath = join16(runDirectory, "fix-packet.md");
   await writeFile5(packetPath, instruction, "utf8");
   const admitted = {
     role: "fixer",
@@ -21802,7 +21962,7 @@ async function admitFixerInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -22022,7 +22182,7 @@ async function admitCollectorInvocation(options) {
   const prNumber = target.kind === "bound" ? target.prNumber : void 0;
   let requestManifestPath;
   if (manifestCanonicalJson !== void 0) {
-    requestManifestPath = join15(runDirectory, "request-manifest.json");
+    requestManifestPath = join16(runDirectory, "request-manifest.json");
     await writeFile5(requestManifestPath, manifestCanonicalJson, "utf8");
   }
   const admitted = {
@@ -22048,7 +22208,7 @@ async function admitCollectorInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -22146,7 +22306,7 @@ function parseDoctorArgv(args) {
 }
 async function resolveDoctorCaseRunsPath(options) {
   const ledgerHome = resolveActivationLedgerHome(options.home);
-  const defaultRuns = join15(
+  const defaultRuns = join16(
     activationBookDirectory(ledgerHome, options.bookKey),
     String(options.issueNumber),
     "runs"
@@ -22277,7 +22437,7 @@ async function admitDoctorInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -22409,7 +22569,7 @@ async function admitNotaryInvocation(options) {
     ...ticketFields,
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -22512,7 +22672,7 @@ async function admitGleanerLeftInvocation(options) {
     attachments: [],
     ...options.correlationId === void 0 ? {} : { correlationId: options.correlationId }
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -22651,7 +22811,7 @@ async function admitReviewerInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -22803,7 +22963,7 @@ async function admitMergerInvocation(options) {
     resolutionScope: [...derived.resolutionScope],
     authorizedChecks: []
   });
-  const mergerInputPath = join15(runDirectory, "merger-input.json");
+  const mergerInputPath = join16(runDirectory, "merger-input.json");
   await writeFile5(
     mergerInputPath,
     `${JSON.stringify(mergerInput, null, 2)}
@@ -22834,7 +22994,7 @@ async function admitMergerInvocation(options) {
       mediaKind: a.mediaKind
     }))
   };
-  const admittedRequestPath = join15(runDirectory, "admitted-request.json");
+  const admittedRequestPath = join16(runDirectory, "admitted-request.json");
   await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
     sessionDirectory,
     sessionFile
@@ -23118,15 +23278,15 @@ var init_invocation = __esm({
 
 // src/public-cli/load-production-acp-host.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { pathToFileURL } from "node:url";
 async function loadProductionAcpHostFactory(packageRoot2, host) {
   const description = lookupHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered host: ${host}`);
   }
-  const built = join16(packageRoot2, "dist/acp-host/production-host.js");
-  const source = join16(packageRoot2, "src/acp-host/production-host.ts");
+  const built = join17(packageRoot2, "dist/acp-host/production-host.js");
+  const source = join17(packageRoot2, "src/acp-host/production-host.ts");
   const target = existsSync7(built) ? built : source;
   const href = pathToFileURL(target).href;
   const mod = await import(href);
@@ -23142,15 +23302,15 @@ var init_load_production_acp_host = __esm({
 
 // src/public-cli/load-production-headless-host.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 async function loadProductionHeadlessHostFactory(packageRoot2, host) {
   const description = lookupHeadlessHostDescription(host);
   if (description === void 0) {
     throw new Error(`unregistered headless host: ${host}`);
   }
-  const built = join17(packageRoot2, "dist/headless-host/production-host.js");
-  const source = join17(packageRoot2, "src/headless-host/production-host.ts");
+  const built = join18(packageRoot2, "dist/headless-host/production-host.js");
+  const source = join18(packageRoot2, "src/headless-host/production-host.ts");
   const target = existsSync8(built) ? built : source;
   const href = pathToFileURL2(target).href;
   const mod = await import(href);
@@ -23277,8 +23437,8 @@ var init_role_turn_host_resolution = __esm({
 
 // src/package-resources/method-skill.ts
 import { createHash as createHash4 } from "node:crypto";
-import { readFile as readFile12, realpath as realpath5 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { readFile as readFile13, realpath as realpath5 } from "node:fs/promises";
+import { join as join19 } from "node:path";
 function gitBlobOid(bytes) {
   const body = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : Buffer.from(bytes);
   const header = Buffer.from(`blob ${body.byteLength}\0`, "utf8");
@@ -23295,16 +23455,16 @@ function packagedMethodSkillRelativeDirectory(name) {
   return `${METHOD_SKILL_RELATIVE_ROOT}/${name}`;
 }
 function resolvePackagedMethodSkillRoot(packageRoot2, name) {
-  return join18(packageRoot2, packagedMethodSkillRelativeDirectory(name));
+  return join19(packageRoot2, packagedMethodSkillRelativeDirectory(name));
 }
 function resolvePackagedMethodSkillPath(packageRoot2, name) {
-  return join18(resolvePackagedMethodSkillRoot(packageRoot2, name), "SKILL.md");
+  return join19(resolvePackagedMethodSkillRoot(packageRoot2, name), "SKILL.md");
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseProvenance(raw, expectedName) {
-  if (!isRecord4(raw)) {
+  if (!isRecord5(raw)) {
     throw new Error(`Packaged method provenance must be an object for ${expectedName}`);
   }
   if (raw.name !== expectedName) {
@@ -23318,7 +23478,7 @@ function parseProvenance(raw, expectedName) {
   if (typeof raw.packageAdaptation !== "string" || raw.packageAdaptation.trim() === "") {
     throw new Error(`Packaged method provenance packageAdaptation must be nonblank`);
   }
-  if (!isRecord4(raw.upstream)) {
+  if (!isRecord5(raw.upstream)) {
     throw new Error(`Packaged method provenance upstream must be an object`);
   }
   const upstream = raw.upstream;
@@ -23345,12 +23505,12 @@ function parseProvenance(raw, expectedName) {
       `Packaged method provenance upstream must include nonblank tag or version`
     );
   }
-  if (!isRecord4(raw.files)) {
+  if (!isRecord5(raw.files)) {
     throw new Error(`Packaged method provenance files must be an object`);
   }
   const files = {};
   for (const [rel, entry] of Object.entries(raw.files)) {
-    if (!isRecord4(entry)) {
+    if (!isRecord5(entry)) {
       throw new Error(`Packaged method provenance file entry must be an object: ${rel}`);
     }
     if (typeof entry.sha256 !== "string" || !SHA256_RE.test(entry.sha256)) {
@@ -23392,11 +23552,11 @@ function parseProvenance(raw, expectedName) {
 }
 async function loadPackagedMethodSkillMaterial(packageRoot2, name) {
   const rootDirectory = resolvePackagedMethodSkillRoot(packageRoot2, name);
-  const skillPathConfigured = join18(rootDirectory, "SKILL.md");
-  const provenancePath = join18(rootDirectory, "provenance.json");
+  const skillPathConfigured = join19(rootDirectory, "SKILL.md");
+  const provenancePath = join19(rootDirectory, "provenance.json");
   let provenanceRaw;
   try {
-    provenanceRaw = await readFile12(provenancePath, "utf8");
+    provenanceRaw = await readFile13(provenancePath, "utf8");
   } catch (error) {
     throw new PackagedMethodSkillUnavailableError(name, provenancePath, error);
   }
@@ -23410,10 +23570,10 @@ async function loadPackagedMethodSkillMaterial(packageRoot2, name) {
   }
   const provenance = parseProvenance(provenanceJson, name);
   for (const [rel, expected] of Object.entries(provenance.files)) {
-    const absolute = join18(rootDirectory, rel);
+    const absolute = join19(rootDirectory, rel);
     let bytes;
     try {
-      bytes = await readFile12(absolute);
+      bytes = await readFile13(absolute);
     } catch (error) {
       throw new PackagedMethodSkillUnavailableError(name, absolute, error);
     }
@@ -23429,7 +23589,7 @@ async function loadPackagedMethodSkillMaterial(packageRoot2, name) {
   let raw;
   try {
     skillPath = await realpath5(skillPathConfigured);
-    raw = await readFile12(skillPath, "utf8");
+    raw = await readFile13(skillPath, "utf8");
   } catch (error) {
     throw new PackagedMethodSkillUnavailableError(name, skillPathConfigured, error);
   }
@@ -23513,12 +23673,12 @@ var init_method_skill = __esm({
 });
 
 // src/ledger-session-read.ts
-import { readFile as readFile13 } from "node:fs/promises";
-function isRecord5(value) {
+import { readFile as readFile14 } from "node:fs/promises";
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function readLedgerSessionJsonlLines(path) {
-  const text = await readFile13(path, "utf8");
+  const text = await readFile14(path, "utf8");
   const lines = text.split("\n");
   const out = [];
   for (let index = 0; index < lines.length; index += 1) {
@@ -23539,7 +23699,7 @@ async function readLedgerSessionJsonlLines(path) {
       });
       continue;
     }
-    if (!isRecord5(row)) {
+    if (!isRecord6(row)) {
       const kind = row === null ? "null" : Array.isArray(row) ? "array" : typeof row;
       out.push({
         line: lineNumber,
@@ -23592,7 +23752,7 @@ function extractSessionModelSequence(rows) {
     if (row.type === "model_change" && typeof row.modelId === "string") {
       push(row.modelId);
     }
-    const message = isRecord5(row.message) ? row.message : void 0;
+    const message = isRecord6(row.message) ? row.message : void 0;
     if (message?.role === "assistant" && typeof message.model === "string") {
       push(message.model);
     }
@@ -23608,11 +23768,11 @@ function extractSessionToolIntervals(rows) {
   const openById = /* @__PURE__ */ new Map();
   for (const row of rows) {
     const rowTimestamp = typeof row.timestamp === "string" ? row.timestamp : void 0;
-    const message = isRecord5(row.message) ? row.message : void 0;
+    const message = isRecord6(row.message) ? row.message : void 0;
     if (message?.role === "assistant" && Array.isArray(message.content)) {
       const callTimestamp = typeof message.timestamp === "string" && message.timestamp ? message.timestamp : rowTimestamp;
       for (const part of message.content) {
-        if (!isRecord5(part) || part.type !== "toolCall") continue;
+        if (!isRecord6(part) || part.type !== "toolCall") continue;
         if (typeof part.id !== "string" || part.id.length === 0) {
           throw new Error("toolCall frame missing string id");
         }
@@ -23625,7 +23785,7 @@ function extractSessionToolIntervals(rows) {
         if (openById.has(part.id)) {
           throw new Error(`duplicate toolCall id ${part.id}`);
         }
-        const args = isRecord5(part.arguments) ? part.arguments : void 0;
+        const args = isRecord6(part.arguments) ? part.arguments : void 0;
         const command = part.name === "bash" && args !== void 0 && typeof args.command === "string" ? bashCommandFirstLine(args.command) : void 0;
         const interval = {
           toolCallId: part.id,
@@ -23709,9 +23869,9 @@ var init_ledger_session_read = __esm({
 });
 
 // src/analyst-gate-cycles-read.ts
-import { readdir as readdir5 } from "node:fs/promises";
-import { join as join19 } from "node:path";
-function isRecord6(value) {
+import { readdir as readdir6 } from "node:fs/promises";
+import { join as join20 } from "node:path";
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isParentAttemptBindingRow(row) {
@@ -23741,7 +23901,7 @@ function isGateTerminatingToolName(toolName) {
 function acceptedGateReceiptIds(rows) {
   const accepted = /* @__PURE__ */ new Set();
   for (const row of rows) {
-    const message = isRecord6(row.message) ? row.message : void 0;
+    const message = isRecord7(row.message) ? row.message : void 0;
     if (message?.role !== "toolResult") continue;
     if (typeof message.toolCallId !== "string" || message.toolCallId.length === 0) continue;
     if (message.isError === false) accepted.add(message.toolCallId);
@@ -23776,7 +23936,7 @@ function nearestAttemptBindingBefore(rows, beforeIndex) {
   for (let i = beforeIndex - 1; i >= 0; i -= 1) {
     const row = rows[i];
     if (!isParentAttemptBindingRow(row)) continue;
-    if (!isRecord6(row.data) || !isRecord6(row.data.parent)) continue;
+    if (!isRecord7(row.data) || !isRecord7(row.data.parent)) continue;
     const id = row.data.parent.attemptEntryId;
     const sessionFile = row.data.parent.sessionFile;
     return {
@@ -23791,10 +23951,10 @@ function extractAllAcceptedGateToolCalls(rows) {
   const out = [];
   for (let rowIndex = 0; rowIndex < rows.length; rowIndex += 1) {
     const row = rows[rowIndex];
-    const message = isRecord6(row.message) ? row.message : void 0;
+    const message = isRecord7(row.message) ? row.message : void 0;
     if (message?.role !== "assistant" || !Array.isArray(message.content)) continue;
     for (const part of message.content) {
-      if (!isRecord6(part) || part.type !== "toolCall") continue;
+      if (!isRecord7(part) || part.type !== "toolCall") continue;
       if (typeof part.id !== "string" || part.id.length === 0) continue;
       if (typeof part.name !== "string" || part.name.length === 0) continue;
       if (!isGateTerminatingToolName(part.name)) continue;
@@ -23802,7 +23962,7 @@ function extractAllAcceptedGateToolCalls(rows) {
       const binding = nearestAttemptBindingBefore(rows, rowIndex);
       out.push({
         toolName: part.name,
-        args: isRecord6(part.arguments) ? part.arguments : void 0,
+        args: isRecord7(part.arguments) ? part.arguments : void 0,
         accepted: true,
         rowIndex,
         ...binding
@@ -23935,7 +24095,7 @@ async function resolveOfficerSessionFromPointerFile(pointerPath) {
       { cause: error }
     );
   }
-  if (!isRecord6(raw) || raw.kind !== "direct-officer-run-pointer" || raw.version !== 1) {
+  if (!isRecord7(raw) || raw.kind !== "direct-officer-run-pointer" || raw.version !== 1) {
     throw new Error(`direct officer run pointer has unknown shape in ${pointerPath}`);
   }
   const sessionFile = raw.sessionFile;
@@ -23951,7 +24111,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
   for (const directory of directories) {
     let names;
     try {
-      const entries = await readdir5(directory, { withFileTypes: true });
+      const entries = await readdir6(directory, { withFileTypes: true });
       names = entries.filter(
         (e) => e.isFile() && (e.name.endsWith(".jsonl") || e.name.endsWith(".pointer.json"))
       ).map((e) => e.name).sort();
@@ -23960,7 +24120,7 @@ async function readAnalystGateCyclesFromAuditorRoles(auditorRolesDirectory, opti
       throw error;
     }
     for (const name of names) {
-      const path = join19(directory, name);
+      const path = join20(directory, name);
       const fromPointer = name.endsWith(".pointer.json");
       const sessionPath = fromPointer ? await resolveOfficerSessionFromPointerFile(path) : path;
       if (sessionPath === void 0) continue;
@@ -24010,143 +24170,6 @@ var init_audit_escalation = __esm({
   }
 });
 
-// src/run-terminal-artifacts.ts
-import { readdir as readdir6, readFile as readFile14 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname10, join as join20 } from "node:path";
-function isMissingPathError3(error) {
-  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
-}
-function errorText2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function isRecord7(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readUsableTerminalArtifactBody(body) {
-  if (body === null) {
-    return { ok: false, reason: "terminal artifact JSON value is null" };
-  }
-  if (!isRecord7(body)) {
-    return {
-      ok: false,
-      reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`
-    };
-  }
-  if (typeof body.role !== "string" || body.role.trim() === "") {
-    return {
-      ok: false,
-      reason: "terminal artifact missing nonblank producer-owned role field"
-    };
-  }
-  return { ok: true, body };
-}
-async function readTerminalArtifactAtPath(path, file) {
-  let raw;
-  try {
-    raw = await readFile14(path, "utf8");
-  } catch (error) {
-    if (isMissingPathError3(error)) return void 0;
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason: errorText2(error)
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason: error instanceof Error ? error.message : `terminal artifact JSON parse failed: ${String(error)}`
-    };
-  }
-  const usable = readUsableTerminalArtifactBody(parsed);
-  if (!usable.ok) {
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason: usable.reason
-    };
-  }
-  return { status: "present", file, path, body: usable.body };
-}
-async function listUniqueErrorFallbackPaths(directories) {
-  const found = [];
-  for (const dir of directories) {
-    let names;
-    try {
-      names = await readdir6(dir);
-    } catch (error) {
-      if (isMissingPathError3(error)) continue;
-      throw error;
-    }
-    for (const name of names.sort((a, b) => a.localeCompare(b))) {
-      if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
-      found.push(join20(dir, name));
-    }
-  }
-  return found;
-}
-function runIdFromRunDirectory(runDirectory) {
-  const name = basename7(runDirectory);
-  const at = name.lastIndexOf("@");
-  if (at <= 0 || at === name.length - 1) return void 0;
-  return name.slice(0, at);
-}
-function presentUniqueFallbackBoundToRun(body, expectedRunId) {
-  if (expectedRunId === void 0) return false;
-  return typeof body.runId === "string" && body.runId === expectedRunId;
-}
-async function readRunTerminalArtifact(runDirectory) {
-  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-  for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    const path = join20(artifactsDir, file);
-    const read = await readTerminalArtifactAtPath(path, file);
-    if (read !== void 0) return read;
-  }
-  for (const relative4 of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-    const path = join20(runDirectory, relative4);
-    const read = await readTerminalArtifactAtPath(path, "error.json");
-    if (read !== void 0) return read;
-  }
-  for (const path of await listUniqueErrorFallbackPaths([artifactsDir, runDirectory])) {
-    const read = await readTerminalArtifactAtPath(path, "error.json");
-    if (read !== void 0) return read;
-  }
-  const expectedRunId = runIdFromRunDirectory(runDirectory);
-  for (const path of await listUniqueErrorFallbackPaths([dirname10(runDirectory)])) {
-    const read = await readTerminalArtifactAtPath(path, "error.json");
-    if (read === void 0) continue;
-    if (read.status === "present") {
-      if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId)) continue;
-      return read;
-    }
-  }
-  return { status: "absent" };
-}
-var RUN_TERMINAL_ARTIFACT_FILES, RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS, UNIQUE_ERROR_FALLBACK_NAME;
-var init_run_terminal_artifacts = __esm({
-  "src/run-terminal-artifacts.ts"() {
-    "use strict";
-    init_role_run_placement();
-    RUN_TERMINAL_ARTIFACT_FILES = [
-      "report.json",
-      "error.json",
-      "audit-incomplete.json"
-    ];
-    RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS = [
-      "artifacts/error.settlement.json",
-      "error.settlement.json"
-    ];
-    UNIQUE_ERROR_FALLBACK_NAME = /^error\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.json$/i;
-  }
-});
-
 // src/submission-ledger.ts
 import { join as join21 } from "node:path";
 async function submissionRecordFile(cwd, runId, scope) {
@@ -26836,11 +26859,75 @@ async function settleLawfulDiaristTerminalResult(admitted, authority, scope) {
 async function trySettleDiaristTerminalResult(admitted, authority, scope) {
   return settleLawfulDiaristTerminalResult(admitted, authority, scope);
 }
+function countersignTerminalFromEntries(entries) {
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    const entry = entries[index];
+    if (entry?.type !== "custom") continue;
+    if (entry.customType !== SECRETARIAT_GATE_OFFICER_ENTRY_TYPE) continue;
+    const data = entry.data !== null && typeof entry.data === "object" && !Array.isArray(entry.data) ? entry.data : void 0;
+    if (data?.officer !== "countersign") continue;
+    if (data.receipt === void 0) continue;
+    const runId = typeof data.runId === "string" && data.runId.trim() !== "" ? data.runId : void 0;
+    return {
+      receipt: data.receipt,
+      ...runId === void 0 ? {} : { runId }
+    };
+  }
+  return void 0;
+}
+function withCountersignTerminalFact(roleOutcome, officer) {
+  const prior = roleOutcome.decisiveFacts !== void 0 && isRecord10(roleOutcome.decisiveFacts) ? roleOutcome.decisiveFacts : {};
+  return {
+    ...roleOutcome,
+    decisiveFacts: {
+      ...prior,
+      [SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY]: officer
+    }
+  };
+}
+function acceptedSecretariatDefinesOfficerProjection(roleOutcome) {
+  const payloads = roleOutcome.payloads ?? [];
+  for (let index = payloads.length - 1; index >= 0; index -= 1) {
+    const payload = payloads[index];
+    if (!isRecord10(payload)) continue;
+    const status = payload.secretariatStatus;
+    if (typeof status !== "string") continue;
+    return status === "converged";
+  }
+  return false;
+}
 async function settleLawfulSecretariatTerminalResult(admitted, authority, scope) {
-  return settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
+  const settled = await settleLawfulSeatAcceptedTerminalResult(admitted, authority, {
     role: "secretariat",
     toolName: SECRETARIAT_OUTPUT_TOOL_NAME
   }, scope);
+  if (settled === void 0) return void 0;
+  const coordinates = coordinatesFromAdmitted(authority, admitted);
+  const entries = await readLawfulSettlementEntries(coordinates.sessionFile) ?? [];
+  const officer = countersignTerminalFromEntries(entries);
+  if (officer === void 0) return settled;
+  if (settled.roleOutcome.kind === "audit_escalation") {
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(
+        {
+          ...settled.roleOutcome,
+          payloads: [officer.receipt]
+        },
+        officer
+      )
+    };
+  }
+  if (settled.roleOutcome.kind === "accepted") {
+    if (!acceptedSecretariatDefinesOfficerProjection(settled.roleOutcome)) {
+      return settled;
+    }
+    return {
+      ...settled,
+      roleOutcome: withCountersignTerminalFact(settled.roleOutcome, officer)
+    };
+  }
+  return settled;
 }
 async function trySettleSecretariatTerminalResult(admitted, authority, scope) {
   return settleLawfulSecretariatTerminalResult(admitted, authority, scope);
@@ -31614,6 +31701,25 @@ async function summonGateOfficer(options) {
       ...common
     });
   }
+  if (options.officer === "countersign") {
+    const { runIdFromRunDirectory: runIdFromRunDirectory2 } = await Promise.resolve().then(() => (init_run_terminal_artifacts(), run_terminal_artifacts_exports));
+    const correlationId = runIdFromRunDirectory2(options.sourceRunDirectory);
+    if (correlationId === void 0 || correlationId.trim() === "") {
+      throw new Error(
+        `countersign gate summon requires parent runId from sourceRunDirectory: ${options.sourceRunDirectory}`
+      );
+    }
+    const { readBoardTicketNumber: readBoardTicketNumber2 } = await Promise.resolve().then(() => (init_run_ticket_number(), run_ticket_number_exports));
+    const parentTicket = await readBoardTicketNumber2(options.sourceRunDirectory);
+    const instruction = options.reask ?? gateReviewInstruction ?? "";
+    return summonPublicRole({
+      role: "countersign",
+      argv: ["--project", options.cwd, "--", instruction],
+      ...common,
+      correlationId,
+      ...parentTicket === void 0 ? {} : { boundTicketNumber: parentTicket }
+    });
+  }
   return summonPublicRole({
     role: "inspector",
     argv: [`\u5377\u5B97\u6307\u9488\uFF1A${options.sourceRunDirectory}`],
@@ -31847,7 +31953,9 @@ async function runPublicCountersign(argv2, env, io, parseCountersignArgv2) {
               {
                 instruction: parsed.instruction,
                 projectRoot: admitted.projectRoot,
-                failureLabel: "unbound summons"
+                failureLabel: "unbound summons",
+                // #969: parent durable ticket is the resume/bind key (ADR 0079).
+                ...env.boundTicketNumber === void 0 ? {} : { boundTicketNumber: env.boundTicketNumber }
               },
               env,
               io
@@ -31899,12 +32007,16 @@ async function runPublicCountersign(argv2, env, io, parseCountersignArgv2) {
             );
           }
           if (outcome.identity.kind === "ticket") {
-            const assertedTicket = outcome.identity.ticketNumber;
-            typedTicket = assertedTicket;
+            typedTicket = isSafePositiveTicketNumber(env.boundTicketNumber) ? env.boundTicketNumber : outcome.identity.ticketNumber;
             typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
+          } else if (isSafePositiveTicketNumber(env.boundTicketNumber)) {
+            typedTicket = env.boundTicketNumber;
+          }
+          if (typedTicket !== void 0) {
+            const resumeInstruction = env.reviewReask ?? env.gateReviewInstruction ?? parsed.instruction;
             const summons = {
-              instruction: parsed.instruction,
-              instructionEmpty: parsed.instruction.trim() === ""
+              instruction: resumeInstruction,
+              instructionEmpty: resumeInstruction.trim() === ""
             };
             const resumed = await tryResumeSameTicketSeatRun({
               home: env.home,
@@ -31986,7 +32098,9 @@ async function runPublicCountersign(argv2, env, io, parseCountersignArgv2) {
           ...env.correlationId === void 0 || env.correlationId.trim() === "" ? {} : { correlationId: env.correlationId },
           continuation: {
             kind: "initial",
-            prompt: buildCountersignTransportPrompt(
+            // #969/#879: gate path first mint carries parent payload as dialogue content;
+            // ordinary public entry keeps package transport prompt.
+            prompt: env.reviewReask ?? env.gateReviewInstruction ?? buildCountersignTransportPrompt(
               admitted,
               engineSessionMaterialFromOptions({
                 ...pickEngineAxis(env),