@akagilnc/pi-workflow-roles 0.1.4673 → 0.1.4695

package/dist/public-cli/terminal.js

@@ -17,7 +17,11 @@ export function exitCodeForTerminalOutcome(outcome) {
  * auto-resumes occurred during this single LLM call; it is not persisted to
  * run-state.json and does not participate in limit decisions.
  */
-/** Original payloads on a terminal — role result for accepted/audit; coexist on failure. */
+/**
+ * Current-result payloads on a terminal — accepted/audit role result, or a
+ * rare intentional failure face. Run history is TerminalResult.submissions
+ * (#836 / #953), not this helper.
+ */
 export function roleResultPayloads(outcome) {
     if (outcome.kind === "accepted" || outcome.kind === "audit_escalation")
         return outcome.payloads ?? [];
@@ -25,6 +29,18 @@ export function roleResultPayloads(outcome) {
         return outcome.payloads ?? [];
     return [];
 }
+/**
+ * Prefer non-empty current-result payloads; an empty array must not shadow
+ * top-level submissions (#953 / #836). Callers that need failure history must
+ * read TerminalResult.submissions directly — do not coalesce into failure.payloads.
+ */
+export function coalesceSubmissionRows(payloads, submissions) {
+    if (payloads !== undefined && payloads.length > 0)
+        return payloads;
+    if (submissions !== undefined && submissions.length > 0)
+        return submissions;
+    return payloads ?? submissions ?? [];
+}
 /**
  * Build an advice navigator fact (#959). Prose is presented as submitted;
  * code does not parse route/next or judge usability.
@@ -109,15 +125,26 @@ export function formatTerminalResult(result) {
     }
     // Role-result block: original payloads, newest first for humans (#961).
     // Typed payloads/submissions stay ledger order; only this presentation reverses.
-    const payloads = result.roleOutcome.kind === "accepted" || result.roleOutcome.kind === "audit_escalation"
-        ? result.roleOutcome.payloads ?? result.submissions ?? []
-        : result.roleOutcome.kind === "failure"
-            ? result.roleOutcome.payloads ?? result.submissions ?? []
+    // #953: failure history is the top-level submissions carrier (#836) — present
+    // as recorded-submission, never as this-turn submission/receipt.
+    if (result.roleOutcome.kind === "failure") {
+        const recorded = result.submissions ?? [];
+        for (let i = recorded.length - 1; i >= 0; i -= 1) {
+            const payload = recorded[i];
+            const rendered = typeof payload === "string" ? payload : JSON.stringify(payload);
+            lines.push(`recorded-submission\t${encodeTerminalField(rendered)}`);
+        }
+    }
+    else {
+        const payloads = result.roleOutcome.kind === "accepted" ||
+            result.roleOutcome.kind === "audit_escalation"
+            ? coalesceSubmissionRows(result.roleOutcome.payloads, result.submissions)
             : result.submissions ?? [];
-    for (let i = payloads.length - 1; i >= 0; i -= 1) {
-        const payload = payloads[i];
-        const rendered = typeof payload === "string" ? payload : JSON.stringify(payload);
-        lines.push(`submission\t${encodeTerminalField(rendered)}`);
+        for (let i = payloads.length - 1; i >= 0; i -= 1) {
+            const payload = payloads[i];
+            const rendered = typeof payload === "string" ? payload : JSON.stringify(payload);
+            lines.push(`submission\t${encodeTerminalField(rendered)}`);
+        }
     }
     return `${lines.join("\n")}\n`;
 }

package/dist/run-terminal-artifacts.js

@@ -137,6 +137,7 @@ export function runIdFromRunDirectory(runDirectory) {
  * Shared parent-directory unique fallback may be adopted only when the
  * publisher-owned body.runId equals this run directory's runId. Same-run
  * artifactsDir / runDirectory candidates keep path ownership and skip this.
+ * expectedRunId undefined (unparseable run dir) → never bound.
  */
 function presentUniqueFallbackBoundToRun(body, expectedRunId) {
     if (expectedRunId === undefined)
@@ -144,49 +145,87 @@ function presentUniqueFallbackBoundToRun(body, expectedRunId) {
     return typeof body.runId === "string" && body.runId === expectedRunId;
 }
 /**
- * Read the first present typed terminal artifact for a run directory.
- * Order:
+ * Sole authority for seam-owned unique error.<uuid>.json candidates.
+ * Used by both clearOpposite (settlement) and readRunTerminalArtifact — do not
+ * re-enumerate the same-run / parent unique set elsewhere.
+ * Ownership:
+ * - same-run dirs (artifacts/, runDir): path ownership — all unique names
+ * - parent runs/: only body.runId-bound faces; unparseable runId or unreadable body → none
+ */
+export async function listSeamOwnedUniqueErrorFacePaths(runDirectory) {
+    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
+    const owned = await listUniqueErrorFallbackPaths([
+        artifactsDir,
+        runDirectory,
+    ]);
+    const expectedRunId = runIdFromRunDirectory(runDirectory);
+    for (const path of await listUniqueErrorFallbackPaths([dirname(runDirectory)])) {
+        const read = await readTerminalArtifactAtPath(path, "error.json");
+        if (read === undefined || read.status !== "present")
+            continue;
+        if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId))
+            continue;
+        owned.push(path);
+    }
+    return owned;
+}
+/**
+ * Publish contract (#953): only failure publish continues after clearOpposite
+ * failure, so a multi-class residue (residual report/audit beside a new error
+ * face) means the current settlement is failure. Prefer failure-class faces
+ * over success/audit — never filesystem mtime (copy/restore/utimes can lie).
+ */
+function failureClassRank(file) {
+    return file === "error.json" ? 1 : 0;
+}
+/**
+ * Read the current typed terminal artifact for a run directory.
+ *
+ * Candidate set (publisher-owned faces only):
  * 1) conventional artifacts/{report,error,audit-incomplete}.json
  * 2) publisher fixed failure fallbacks (error.settlement.json faces)
- * 3) publisher unique error.<uuid>.json fallbacks under same-run dirs
- * 4) shared parent-directory unique fallbacks bound by body.runId
+ * 3) seam-owned unique error.<uuid>.json via listSeamOwnedUniqueErrorFacePaths
+ *    (same-run path ownership + parent body.runId binding — shared with clear)
  *
- * Absence of every known durable face is a valid no-receipt state (not unreadable).
- * A present file that cannot be parsed as a usable typed JSON object is unreadable.
+ * Invariant: when more than one present face remains (e.g. clearOpposite failed
+ * during failure publish and a fallback was settled beside a residual report),
+ * adopt failure-class over success/audit by the publish contract — not mtime.
+ * Same-class ties keep candidate enumeration order (conventional before
+ * fallbacks before unique).
+ *
+ * Unreadable faces never outrank a present face. Parent unique unreadable
+ * files never enter the shared enumerator (cannot prove run identity).
+ * Absence of every known durable face is a valid no-receipt state.
  */
 export async function readRunTerminalArtifact(runDirectory) {
     const artifactsDir = roleRunArtifactsDirectory(runDirectory);
+    const present = [];
+    const unreadable = [];
+    const consider = (read) => {
+        if (read === undefined || read.status === "absent")
+            return;
+        if (read.status === "present") {
+            present.push(read);
+            return;
+        }
+        unreadable.push(read);
+    };
     for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-        const path = join(artifactsDir, file);
-        const read = await readTerminalArtifactAtPath(path, file);
-        if (read !== undefined)
-            return read;
+        consider(await readTerminalArtifactAtPath(join(artifactsDir, file), file));
     }
-    // Publisher settled a durable failure outside the conventional error.json name.
     for (const relative of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-        const path = join(runDirectory, relative);
-        const read = await readTerminalArtifactAtPath(path, "error.json");
-        if (read !== undefined)
-            return read;
+        consider(await readTerminalArtifactAtPath(join(runDirectory, relative), "error.json"));
     }
-    // Same-run unique faces: path ownership is the run itself — no cross-run risk.
-    for (const path of await listUniqueErrorFallbackPaths([artifactsDir, runDirectory])) {
-        const read = await readTerminalArtifactAtPath(path, "error.json");
-        if (read !== undefined)
-            return read;
+    // Unique same-run + parent-bound faces: one enumerator shared with clear.
+    for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
+        consider(await readTerminalArtifactAtPath(path, "error.json"));
     }
-    // Shared parent (runs/) unique faces: require publisher runId binding.
-    const expectedRunId = runIdFromRunDirectory(runDirectory);
-    for (const path of await listUniqueErrorFallbackPaths([dirname(runDirectory)])) {
-        const read = await readTerminalArtifactAtPath(path, "error.json");
-        if (read === undefined)
-            continue;
-        if (read.status === "present") {
-            if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId))
-                continue;
-            return read;
-        }
-        // Unreadable parent unique file cannot prove run identity — do not adopt.
+    if (present.length > 0) {
+        present.sort((a, b) => failureClassRank(b.file) - failureClassRank(a.file));
+        return present[0];
+    }
+    if (unreadable.length > 0) {
+        return unreadable[0];
     }
     return { status: "absent" };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4673",
+  "version": "0.1.4695",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/compliance-transport.ts

@@ -5,6 +5,7 @@ import type { HostContext } from "./host-contracts.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 import type { PublicSummonResult } from "./public-role-summons.ts";
 import { OFFICER_CONCLUSION_REASK } from "./gatekeeper-role.ts";
+import { coalesceSubmissionRows } from "./public-cli/terminal.ts";
 
 export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt"; usage?: Usage };
 /**
@@ -149,7 +150,9 @@ async function projectAuditorTerminal(summoned: PublicSummonResult): Promise<Com
     };
   }
   if (outcome.kind === "failure") {
-    const rows = outcome.payloads ?? summoned.terminal?.submissions ?? [];
+    // #953: history stays on the historical carrier; do not read failure.payloads
+    // as if they were the current failure result (#836 A.3 beside-channel).
+    const rows = summoned.terminal?.submissions ?? [];
     return {
       status: "transport_failure",
       diagnostic: outcome.diagnostic,
@@ -159,7 +162,10 @@ async function projectAuditorTerminal(summoned: PublicSummonResult): Promise<Com
     };
   }
   if (outcome.kind === "accepted") {
-    const rows = outcome.payloads ?? summoned.terminal?.submissions ?? [];
+    const rows = coalesceSubmissionRows(
+      outcome.payloads,
+      summoned.terminal?.submissions,
+    );
     if (rows.length === 0) {
       return readComplianceCandidate({}, usage);
     }

package/src/gatekeeper-role.ts

@@ -260,20 +260,20 @@ function projectOfficerDecision(
  */
 function thisCourtOfficerPayloads(terminal: TerminalResult | undefined): readonly unknown[] {
   const outcome = terminal?.roleOutcome;
+  // This-court identity only from accepted/audit_escalation settlement payloads
+  // (#879). Failure history is not this-court (#953) — it rides submissions.
   if (outcome !== undefined && (outcome.kind === "accepted" || outcome.kind === "audit_escalation")) {
     if (outcome.payloads !== undefined && outcome.payloads.length > 0) return outcome.payloads;
   }
-  if (outcome?.kind === "failure" && outcome.payloads !== undefined && outcome.payloads.length > 0) {
-    return outcome.payloads;
-  }
   // No sole-row identity guess: undivided submissions are not this-court (#879).
   return [];
 }
 
-/** Failure/transport channel may still surface every recorded payload beside the failure (#836 A.3). */
+/**
+ * Failure/transport channel surfaces recorded history beside the failure
+ * (#836 A.3) via the historical carrier only (#953 — not failure.payloads).
+ */
 function officerFailurePayloads(terminal: TerminalResult | undefined): readonly unknown[] {
-  const outcome = terminal?.roleOutcome;
-  if (outcome?.kind === "failure") return outcome.payloads ?? terminal?.submissions ?? [];
   return terminal?.submissions ?? [];
 }
 

package/src/public-cli/countersign-run.ts

@@ -31,6 +31,7 @@ import {
 } from "../package-resources/engine-material.ts";
 import { CliUsageError } from "./cli-errors.ts";
 import { projectCourtTicketNumbers } from "../diarist-contracts.ts";
+import { readableGateItem } from "../readable-gate-item.ts";
 import { isSafePositiveTicketNumber } from "../run-ticket-number.ts";
 import {
   admitCountersignInvocation,
@@ -139,13 +140,74 @@ export type CourtDiaristIdentity =
       readonly courtTicketNumbers?: readonly number[];
     }
   | { readonly kind: "unbound" }
-  | { readonly kind: "escalate" };
+  | {
+      readonly kind: "escalate";
+      /** Honest diagnostic from diarist escalate payload (#953) — never invent 认不出. */
+      readonly diagnostic: string;
+    };
 
 export type CourtDiaristInvocationResult = {
   readonly identity: CourtDiaristIdentity;
   readonly failedWithoutEscalate?: { readonly diagnostic: string };
 };
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isEscalatePayload(payload: unknown): boolean {
+  if (!isRecord(payload)) return false;
+  return (
+    payload.status === "escalate" || payload.countersignStatus === "escalate"
+  );
+}
+
+/**
+ * Rows a parent may read from a nested diarist terminal (#836 / #953).
+ * Accepted/audit use role result payloads; failure history is submissions only.
+ */
+function courtDiaristPayloadRows(
+  roleOutcome: TerminalRoleOutcome | undefined,
+  submissions: readonly unknown[] | undefined,
+): readonly unknown[] {
+  if (roleOutcome === undefined) return submissions ?? [];
+  if (roleOutcome.kind === "accepted" || roleOutcome.kind === "audit_escalation") {
+    return roleOutcome.payloads ?? [];
+  }
+  if (roleOutcome.kind === "failure") return submissions ?? [];
+  return [];
+}
+
+/**
+ * Parent diagnostic for court-diarist escalate (#953 / 失败诚实 / 传话).
+ * Relays diarist escalate payload(s) via readableGateItem — never invents
+ * "cannot identify court target" when a payload already carries other facts
+ * (e.g. ticketNumber present with a different reason).
+ *
+ * Multiple escalate payloads remain reachable after the run (ADR 0003/0041;
+ * no courtAttempt sole-filter on diarist). Same law as secretariat parent face:
+ * every escalate receipt as-is, last = currentConclusion.
+ */
+function courtDiaristEscalateDiagnostic(
+  roleOutcome: TerminalRoleOutcome | undefined,
+  submissions?: readonly unknown[],
+): string {
+  const payloads = courtDiaristPayloadRows(roleOutcome, submissions);
+  const escalatePayloads: unknown[] = [];
+  for (const payload of payloads) {
+    if (isEscalatePayload(payload)) escalatePayloads.push(payload);
+  }
+  if (escalatePayloads.length === 0) return "court diarist station escalated";
+  // Single escalate: prior carrier (payload body only) — no shape churn.
+  if (escalatePayloads.length === 1) {
+    return `court diarist station escalated: ${readableGateItem(escalatePayloads[0])}`;
+  }
+  return `court diarist station escalated: ${readableGateItem({
+    receipts: escalatePayloads,
+    currentConclusion: escalatePayloads[escalatePayloads.length - 1],
+  })}`;
+}
+
 /** Env slice shared by court diarist identity summons (countersign / secretariat). */
 export type CourtDiaristSummonEnv = Pick<
   CountersignRunEnv,
@@ -171,14 +233,10 @@ export type CourtDiaristSummonEnv = Pick<
 function courtTicketNumbersFromOutcome(
   roleOutcome: TerminalRoleOutcome | undefined,
   principalTicket: number,
+  submissions?: readonly unknown[],
 ): readonly number[] | undefined {
   if (roleOutcome === undefined) return undefined;
-  const payloads =
-    roleOutcome.kind === "accepted" ||
-    roleOutcome.kind === "audit_escalation" ||
-    roleOutcome.kind === "failure"
-      ? (roleOutcome.payloads ?? [])
-      : [];
+  const payloads = courtDiaristPayloadRows(roleOutcome, submissions);
   let latest: readonly number[] | undefined;
   for (const payload of payloads) {
     if (
@@ -216,18 +274,7 @@ function courtDiaristEscalated(
   if (roleOutcome === undefined) return false;
   if (roleOutcome.kind === "audit_escalation") return true;
   if (roleOutcome.kind !== "accepted") return false;
-  return (roleOutcome.payloads ?? []).some((payload) => {
-    if (
-      typeof payload !== "object" ||
-      payload === null ||
-      Array.isArray(payload)
-    )
-      return false;
-    const record = payload as Record<string, unknown>;
-    return (
-      record.status === "escalate" || record.countersignStatus === "escalate"
-    );
-  });
+  return (roleOutcome.payloads ?? []).some(isEscalatePayload);
 }
 
 /**
@@ -292,11 +339,15 @@ export async function invokeCourtDiarist(
   });
 
   const roleOutcome = result.terminal?.roleOutcome;
+  const submissions = result.terminal?.submissions;
   // Escalate routing is a boolean over the preserved sequence (#881). Reasons and
   // payload bodies stay on roleOutcome — never rewritten into a sole identity reason.
   if (courtDiaristEscalated(roleOutcome)) {
     return {
-      identity: { kind: "escalate" },
+      identity: {
+        kind: "escalate",
+        diagnostic: courtDiaristEscalateDiagnostic(roleOutcome, submissions),
+      },
     };
   }
 
@@ -319,6 +370,7 @@ export async function invokeCourtDiarist(
     const courtTicketNumbers = courtTicketNumbersFromOutcome(
       roleOutcome,
       asserted,
+      submissions,
     );
     return {
       identity: {
@@ -390,9 +442,7 @@ export async function runCountersignCourtDiaristStation(
     );
 
     if (outcome.identity.kind === "escalate") {
-      throw new StationChildExhaustedError(
-        "court diarist station escalated (cannot identify court target)",
-      );
+      throw new StationChildExhaustedError(outcome.identity.diagnostic);
     }
     if (outcome.failedWithoutEscalate !== undefined) {
       throw new StationChildExhaustedError(
@@ -509,6 +559,7 @@ export async function runPublicCountersign(
 
           if (outcome.identity.kind === "escalate") {
             // 御批: 识别不了就上抛 — materialize and settle this countersign run.
+            // Diagnostic relays diarist escalate payload facts (#953).
             await materializeAdmission();
             await markRunAdmitted(admitted, env.principalAuthority);
             return await presentControlledFailure(
@@ -517,9 +568,7 @@ export async function runPublicCountersign(
                 timedOut: false,
                 code: null,
                 stderr: "",
-                thrown: new Error(
-                  "court diarist station escalated (cannot identify court target)",
-                ),
+                thrown: new Error(outcome.identity.diagnostic),
               },
               countersignAdapters(),
               env.principalAuthority,

package/src/public-cli/secretariat-run.ts

@@ -139,15 +139,14 @@ export async function runPublicSecretariat(
   );
 
   if (outcome.identity.kind === "escalate") {
+    // Diagnostic relays diarist escalate payload facts (#953) — never invent 认不出.
     return await presentControlledFailure(
       admitted,
       {
         timedOut: false,
         code: null,
         stderr: "",
-        thrown: new Error(
-          "court diarist station escalated (cannot identify court target)",
-        ),
+        thrown: new Error(outcome.identity.diagnostic),
       },
       secretariatAdapters(),
       env.principalAuthority,