@akagilnc/pi-workflow-roles 0.1.4782 → 0.1.4802

package/dist/public-cli/post-admission.js

@@ -8,7 +8,7 @@
 import { randomUUID } from "node:crypto";
 import { writeFile } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
-import { buildAutoResumeContinuationPrompt, buildResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
+import { buildAutoResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
 import { CliUsageError } from "./cli-errors.js";
 import { bindAdmittedTicketNumber, buildInstructionTransportPrompt, freezeAttachmentsIntoRun, relocateAdmittedRunToTicket, } from "./invocation.js";
 import { readRecordedSubmissionRows } from "../submission-ledger.js";
@@ -655,12 +655,9 @@ export async function dispatchPostAdmissionTurn(input) {
                         // Settlement already sealed accepted — a cleanup failure here must
                         // not erase that fact or make the caller replay this court's
                         // summons over already-delivered work (#840 已交劳动只整理终局不重做).
-                        // A later bare resume self-heals: buildRequestAfterLease finds the
-                        // open court already sealed and clears it then (documented
-                        // continue-under-failure contract, not a swallow — 失败诚实宪法 真因
-                        // 必须落痕) — durably, since every auto-resume attempt's io here is
-                        // dummyIo (#840 r9 判词 class 1).
-                        await recordBestEffortPostDispatchDiagnostic(admitted, env, `current-court cleanup failed after accepted settlement (best-effort continue, self-heals on next resume): ${describeErrorIdentity(error)}`, io);
+                        // Preserve the cleanup failure as a post-dispatch diagnostic; the
+                        // accepted settlement remains authoritative (#840 r9 判词 class 1).
+                        await recordBestEffortPostDispatchDiagnostic(admitted, env, `current-court cleanup failed after accepted settlement (best-effort continue): ${describeErrorIdentity(error)}`, io);
                     }
                 }
                 settledOutcome = {
@@ -809,8 +806,7 @@ export async function dispatchPostAdmissionTurn(input) {
 /**
  * Shared resume continuation projection (#471 / #600 / #633 / #637 / #755 / #879):
  * seat-table model/engine/timeout axes, restored correlation, and either
- * - manual resume (no same-ticket summons): package envelope / optional caller
- *   message, with engine-axis handbook via buildResumeContinuationPrompt, or
+ * - manual resume (no same-ticket summons): caller message bytes, or
  * - same-ticket summons (审核循环续话): caller/peer words + optional frozen
  *   attachment paths only — no「请重读」、no code-authored content substitute,
  *   no engine handbook packaging (#750/#755/#879).
@@ -843,12 +839,7 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
             prompt = request.message;
         }
         else {
-            // Bare manual resume — outsourcing engine axis keeps handbook (#600/#736).
-            prompt = buildResumeContinuationPrompt({
-                packageRoot: env.packageRoot,
-                ...pickEngineAxis(env),
-                message: request.message,
-            });
+            prompt = request.message;
         }
     }
     else if (summonsPrepared !== undefined) {
@@ -864,11 +855,7 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
         prompt = "";
     }
     else {
-        // Bare manual resume — outsourcing engine axis keeps handbook (#600/#736).
-        prompt = buildResumeContinuationPrompt({
-            packageRoot: env.packageRoot,
-            ...pickEngineAxis(env),
-        });
+        prompt = "";
     }
     return {
         packageRoot: env.packageRoot,
@@ -889,9 +876,10 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
     };
 }
 /**
- * Hold the writer lease through after-lease build, then hand off to dispatch.
- * Builder (or any throw before dispatch) must release here — dispatch's finally
- * only runs after this handoff (manual resume and station-child auto-resume).
+ * Build the turn request, then hand off to dispatch. When a writer lease is
+ * held, release it if build throws before handoff — dispatch's finally only
+ * runs after this handoff (manual resume and station-child auto-resume).
+ * #987: lease is optional; auto-resume no longer pre-acquires before host CLI.
  */
 async function dispatchAfterWriterLease(input) {
     let handedOffToDispatch = false;
@@ -901,7 +889,7 @@ async function dispatchAfterWriterLease(input) {
         return await input.dispatch(request);
     }
     finally {
-        if (!handedOffToDispatch) {
+        if (!handedOffToDispatch && input.lease !== undefined) {
             await input.lease.release();
         }
     }
@@ -916,7 +904,7 @@ function isAlreadyFrozenSummonsAttachment(runDirectory, attachmentPath) {
  * Freeze same-ticket summons attachments into the retained run directory (#637).
  * No-op materials (no paths / instruction-only) skip the freeze.
  * Paths already under this run's attachments/ are the accepted freeze identity —
- * reuse them; do not re-freeze from external originals on bare resume.
+ * reuse them for the same internal re-summons flow.
  * Manual resume never calls this — old attachment semantics stay intact.
  */
 export async function prepareSummonsResumeMaterials(runDirectory, summons) {
@@ -937,23 +925,22 @@ export async function prepareSummonsResumeMaterials(runDirectory, summons) {
     return { instruction, instructionEmpty, attachments };
 }
 /**
- * Shared manual-resume orchestration for seats whose continuation is the
- * package resume envelope (#599 / #633): load once → structural rejection →
+ * Shared manual-resume orchestration for seats (#599 / #633):
+ * load once → structural rejection →
  * optional seat afterAdmittedLoad (method material / controlled failure) →
  * seat turn projection → station-child auto-resume or public manual resume.
  * Seat-owned loader
  * validation, turn builder, and adapters stay on the seat.
  *
- * Court open/recovery transaction (#637): under the existing writer lease,
- * read currentCourt, judge seal, clear (bound to the judged court id), freeze,
- * and record. No pre-lease clear or stale court-snapshot consumption.
+ * Court handling (#637): public manual resume reads only the open court's
+ * settlement identity; internal re-summons may freeze and record its materials.
  */
 export async function runPostAdmissionSeatResume(input) {
     let request = input.request;
     // Load once for runDirectory / structural rejection / afterAdmittedLoad.
     // Court identity for public manual resume is judged in the turn builder
     // (#987: no package writer-lease gate before host CLI resume). Station-child
-    // auto-resume still acquires the shared lease in runWithAutoResumeLoop.
+    // auto-resume shares that rule via runWithAutoResumeLoop (no pre-acquire).
     let loaded;
     try {
         loaded = await input.load(request);
@@ -982,32 +969,17 @@ export async function runPostAdmissionSeatResume(input) {
     let preparedCleanup;
     const buildRequestAfterLease = async () => {
         let openCourtAttemptId;
-        // Build uses the admitted for this resume (rehydrated when open court
-        // materials ride). Settlement identity stays on the outer admitted.
-        // Name kept for station-child callers that still build under lease.
-        let admittedForBuild = loaded.admitted;
-        // Bare resume: open-court pointer is the continue signal (not ledger seal).
+        // Settlement identity stays on the outer admitted.
+        const admittedForBuild = loaded.admitted;
+        // Bare resume keeps the open court's settlement identity, but public resume
+        // never re-delivers the prior summons or its attachments (#987).
         if (request.summons === undefined) {
             const openCourt = await readCurrentCourt(admittedForBuild.runDirectory);
             if (openCourt !== undefined) {
                 openCourtAttemptId = openCourt.courtAttemptId;
-                request = {
-                    runId: request.runId,
-                    ...(request.message === undefined
-                        ? {}
-                        : { message: request.message }),
-                    ...(openCourt.summons === undefined
-                        ? {}
-                        : { summons: openCourt.summons }),
-                };
-                if (openCourt.summons !== undefined) {
-                    const reloaded = await input.load(request);
-                    admittedForBuild = reloaded.admitted;
-                }
             }
         }
-        // Freeze external paths once; rewrite summons to the frozen identity so
-        // currentCourt + later bare resume reuse the accepted snapshot.
+        // Internal re-summons freezes external paths once and records that identity.
         if (request.summons !== undefined) {
             const prepared = await prepareSummonsResumeMaterials(admittedForBuild.runDirectory, request.summons);
             if (prepared !== undefined &&
@@ -1045,10 +1017,10 @@ export async function runPostAdmissionSeatResume(input) {
         }
         return turnRequest;
     };
-    // Court recovery / open, then dispatch. Public manual resume does not take a
-    // package writer lease before the host CLI (#987 / ADR 0080 one-shot).
-    // Station-child same-ticket/same-parent resume is call-local auto-resume
-    // (#840 / #416) and still acquires the shared lease in its loop.
+    // Court recovery / open, then dispatch. Public manual resume and station-child
+    // auto-resume both pass through to the host CLI without a package writer-lease
+    // pre-gate (#987 / ADR 0080). Station-child same-ticket/same-parent resume is
+    // still call-local auto-resume (#840 / #416).
     // afterAdmittedPrepare runs inside this try so mint failure and cleanup share one finally.
     try {
         if (input.afterAdmittedPrepare !== undefined) {
@@ -1079,14 +1051,13 @@ export async function runPostAdmissionSeatResume(input) {
                 // Same as public manual resume: prior-court sealed acceptance is not a
                 // redispatch brake (#833). New-court station-child turns still auto-resume.
                 dispatch: async (payload, lease, _isFirst, attemptIo) => dispatchAfterWriterLease({
-                    lease,
+                    ...(lease === undefined ? {} : { lease }),
                     build: async () => {
                         // #840 r8 判词 class 2: this call-local retry must keep this
                         // court's frozen summons / 交卷 body / attachments verbatim
                         // (same object as firstTurn) and project only the minimal
-                        // host-needed resume trigger — never the manual-resume engine
-                        // handbook (buildResumeContinuationPrompt), which would replace
-                        // a 审核循环 same-ticket continuation with a bare outsourcing
+                        // host-needed resume trigger — never engine handbook material,
+                        // which would replace a 审核循环 same-ticket continuation with a bare outsourcing
                         // 「重新读」 envelope (#755 contract, resumeTurnRequestProjectionOptions
                         // above). RESUME_TRANSPORT_ENVELOPE is the same package-owned,
                         // non-semantic trigger that projection already uses for a
@@ -1110,7 +1081,7 @@ export async function runPostAdmissionSeatResume(input) {
                             env,
                             io: attemptIo,
                             request: turnRequest,
-                            lease,
+                            ...(lease === undefined ? {} : { lease }),
                             adapters: stationAdapters,
                             persistRunState: false,
                             ...(input.effectiveEngine === undefined
@@ -1134,8 +1105,7 @@ export async function runPostAdmissionSeatResume(input) {
         });
     }
     catch (error) {
-        // Open-court rehydrate load under lease may still surface seat structural
-        // rejection (e.g. notary rejects caller message) — same exit face as pre-lease.
+        // Seat preparation may still surface structural rejection.
         if (error instanceof CliUsageError) {
             presentStructuralRejection(error, input.io);
             return { exitCode: 2 };
@@ -1209,7 +1179,7 @@ export async function runPostAdmissionResumable(input) {
                 },
                 io: attemptIo,
                 request,
-                lease,
+                ...(lease === undefined ? {} : { lease }),
                 adapters,
                 persistRunState: false,
                 // #600: every attempt (initial + auto-resume) writes seat engine when present.
@@ -1223,8 +1193,8 @@ export async function runPostAdmissionResumable(input) {
  * Manual resume: pass-through to the host CLI resume — no package writer-lease
  * pre-gate (#987), no sealed-accepted short-circuit (#833 / #416). Court open
  * (summons / message / open court) is built when using buildRequestAfterLease;
- * sole-final stays per-attempt. Station-child auto-resume keeps shared lease
- * acquire in runWithAutoResumeLoop + dispatchAfterWriterLease.
+ * sole-final stays per-attempt. Station-child auto-resume shares the same
+ * no-pre-gate rule via runWithAutoResumeLoop + dispatchAfterWriterLease.
  */
 export async function runPostAdmissionManualResume(input) {
     const { admitted, env, io, adapters, effectiveEngine, buildRequestAfterLease, } = input;

package/dist/public-cli/reviewer-run.js

@@ -301,7 +301,7 @@ export async function runPublicReviewerResume(request, env, io) {
                 ...(sandbox.executionCwd === undefined ? {} : { cwd: sandbox.executionCwd }),
                 continuation: {
                     kind: "resume",
-                    prompt: reviewerResumePrompt(activeEnv, effective.message),
+                    prompt: effective.message ?? "",
                 },
             });
         },

package/dist/public-cli/run-lifecycle.js

@@ -9,7 +9,7 @@ import { chmod, lstat, open, readdir, readFile, unlink, writeFile } from "node:f
 import { basename, isAbsolute, join } from "node:path";
 import { activationBookDirectory, resolveActivationLedgerHome, } from "../activation-ledger-topology.js";
 import { listBookRunDirectories } from "../role-run-placement.js";
-import { isSafePositiveTicketNumber, readBoardTicketNumber, } from "../run-ticket-number.js";
+import { isSafePositiveTicketNumber } from "../run-ticket-number.js";
 import { CliUsageError } from "./cli-errors.js";
 import { readLatestTypedProviderHttpObservation, } from "../typed-provider-http.js";
 export { clearTypedProviderHttpObservation, recordTypedProviderHttpStatus, readLatestTypedProviderHttpObservation, } from "../typed-provider-http.js";
@@ -31,44 +31,20 @@ export const AUTO_RESUME_LIMIT = 2;
  * Package-owned non-empty Chinese neutral resume transport (#959 / ADR 0073).
  * Used by:
  *   - auto-resume (all seats via buildAutoResumeContinuationPrompt) — required so
- *     hosts that reject empty stdin (codex) still receive a prompt;
- *   - reviewer seat manual resume (reviewerResumePrompt) — same non-empty need on
- *     that seat's own manual entry.
- * Generic bare `ak-role resume` stays empty-capable via selectResumeContinuationPrompt
- * / buildResumeContinuationPrompt — ADR 0080 keeps auto and generic-manual entries separate.
+ *     hosts that reject empty stdin (codex) still receive a prompt.
+ * Public manual resume forwards only the caller's bytes (#987).
  */
 export const RESUME_TRANSPORT_ENVELOPE = "继续。";
-/**
- * Manual resume continuation selector (#471 / #600 / #736 / ADR 0080).
- * Message present → those bytes; absent → engine pointers only (may be empty).
- * Caller message (including blank) still wins verbatim when supplied.
- * Auto-resume must use buildAutoResumeContinuationPrompt — do not fold the
- * non-empty Chinese envelope into this shared manual selector (#959).
- */
-export function selectResumeContinuationPrompt(message, engineMaterial) {
-    const lines = message !== undefined ? [message] : [];
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
-/**
- * Manual resume continuation with engine material from the seat env (#600).
- * Bare manual resume stays empty-prompt-capable; auto-resume is a separate entry.
- */
-export function buildResumeContinuationPrompt(options) {
-    return selectResumeContinuationPrompt(options.message, engineSessionMaterialFromOptions({
-        packageRoot: options.packageRoot,
-        ...pickEngineAxis(options),
-    }));
-}
 /**
  * Auto-resume continuation only (#959 / ADR 0080).
  * Always non-empty: Chinese neutral envelope plus optional engine pointers.
  * Never call this from manual `ak-role resume`.
  */
 export function buildAutoResumeContinuationPrompt(options) {
-    return selectResumeContinuationPrompt(RESUME_TRANSPORT_ENVELOPE, engineSessionMaterialFromOptions({
+    return appendEngineSessionMaterial([RESUME_TRANSPORT_ENVELOPE], engineSessionMaterialFromOptions({
         packageRoot: options.packageRoot,
         ...pickEngineAxis(options),
-    }));
+    })).join("\n");
 }
 const RUN_STATE_FILE = "run-state.json";
 const WRITER_LOCK_FILE = "writer.lock";
@@ -398,8 +374,7 @@ export async function markRunTerminal(runDirectory) {
     if (current === undefined) {
         throw new Error("cannot mark terminal: run state missing");
     }
-    // Preserve open currentCourt: terminal after a failed/incomplete court must still
-    // let bare resume continue that court (#637).
+    // Preserve the open court's settlement identity after a failed/incomplete turn (#637).
     await writeRoleRunStateDisk(runDirectory, {
         runId: current.runId,
         role: current.role,
@@ -843,13 +818,14 @@ async function runHasFormedSessionPrincipal(runDirectory) {
 /**
  * Locate the latest retained run for one seat under a book (#637 / #747).
  * Same walk surface as findRunDirectoryById (listBookRunDirectories). Match by
- * parent run path (officer seats, #747) or by ticket number (countersign /
- * diarist principal). runId is UUIDv7 — lexicographic max is latest among runs
- * that formed a session principal. No parallel index.
+ * parent run path (officer / gate seats, #747 / #987). runId is UUIDv7 —
+ * lexicographic max is latest among runs that formed a session principal. No
+ * parallel index. Public ticket-number selection of a prior run was deleted
+ * (#987 Result 7); callers use explicit `ak-role resume <runId>`.
  * Only a truly missing book directory means no history; damage/permission errors propagate.
  */
 export async function findLatestRunIdForSeatTicket(input) {
-    if (input.ticketNumber === undefined && input.parentRunPath === undefined) {
+    if (input.parentRunPath.trim() === "") {
         return undefined;
     }
     const ledgerHome = resolveActivationLedgerHome(input.home);
@@ -872,17 +848,9 @@ export async function findLatestRunIdForSeatTicket(input) {
         const runId = entry.slice(0, entry.length - suffix.length);
         if (runId.length === 0)
             continue;
-        if (input.parentRunPath !== undefined) {
-            const parentPath = await readRunParentPath(runDirectory);
-            if (parentPath !== input.parentRunPath)
-                continue;
-        }
-        else if (input.ticketNumber !== undefined) {
-            // Same-ticket resume is board identity only — never migration-derived.
-            const ticketNumber = await readBoardTicketNumber(runDirectory);
-            if (ticketNumber !== input.ticketNumber)
-                continue;
-        }
+        const parentPath = await readRunParentPath(runDirectory);
+        if (parentPath !== input.parentRunPath)
+            continue;
         // Durable fact: never resume-select a provisional that never formed principal.
         if (!(await runHasFormedSessionPrincipal(runDirectory)))
             continue;

package/dist/public-cli/seat-ticket-binding.js

@@ -1,43 +1,29 @@
 /**
- * Shared ticket identity seam for public court seats (#635 / #637 / #709 / #747 / #771).
+ * Shared same-parent resume seam for gate / officer seats (#635 / #637 / #747 / #987).
  *
- * ADR 0075（起居郎 LLM 自行认票）: the diarist LLM recognizes the
- * court target; recognized ticket → provenance, truly unbound → no provenance,
- * or escalate when it cannot recognize one. Code does not re-judge the ticket
- * (锚定宪法; owner 2026-09-08: 代码不准做判断). Other seats reuse a typed
- * identity already handed over (起居郎 assertion / source-run / already-bound
- * resume) — they do not re-recognize from instruction. No CLI --ticket, no
- * attachment frontmatter. #747: officer same-parent resume also lives here.
- *
- * This module owns same-ticket / same-parent resume only.
+ * Lookup key is parent run path only (#747 / #987 Result 7). Public seats no
+ * longer select a prior run by ticket number — callers use explicit
+ * `ak-role resume <runId>`. Officer and gate countersign same-parent re-summons
+ * keep this seam. Lookup/resume failures propagate (失败诚实) — never wash into
+ * a fresh mint. Returns undefined when the caller declared an explicit fresh
+ * summons (`ak-role new`) or when no prior run exists; both mint new.
+ * freshSummons is required so no seat can drift back into its own skip branch.
  */
 import { resolveBookKeyFromGit } from "../activation-ledger-git.js";
 import { findLatestRunIdForSeatTicket, } from "./run-lifecycle.js";
 /**
- * Sole same-seat → resume decision (#637 / #724 / #747).
- * Officer seats (notary/inspector/auditor) look up by parent run path; countersign
- * / diarist keep ticket-number principal. When found, runs resume with this
- * summons' materials. Lookup/resume failures propagate (失败诚实) — never wash
- * into a fresh mint. Returns undefined when the caller declared an explicit
- * fresh summons (`ak-role new`) or when no prior run exists; both mint new.
- * freshSummons is required so no seat can drift back into its own skip branch.
+ * Sole same-seat → resume decision by parent run path (#637 / #724 / #747 / #987).
  */
 export async function tryResumeSameTicketSeatRun(input) {
     if (input.freshSummons === true)
         return undefined;
-    if (input.parentRunPath === undefined && input.ticketNumber === undefined) {
+    if (input.parentRunPath.trim() === "")
         return undefined;
-    }
     const previousRunId = await findLatestRunIdForSeatTicket({
         home: input.home,
         bookKey: resolveBookKeyFromGit(input.projectRoot),
         role: input.role,
-        ...(input.parentRunPath === undefined
-            ? {}
-            : { parentRunPath: input.parentRunPath }),
-        ...(input.ticketNumber === undefined
-            ? {}
-            : { ticketNumber: input.ticketNumber }),
+        parentRunPath: input.parentRunPath,
     });
     if (previousRunId === undefined)
         return undefined;

package/dist/public-role-summons.js

@@ -205,6 +205,7 @@ async function summonPublicRole(options) {
           ...options.reviewReask === void 0 ? {} : { reviewReask: options.reviewReask },
           ...options.gateReviewInstruction === void 0 ? {} : { gateReviewInstruction: options.gateReviewInstruction },
           ...options.boundTicketNumber === void 0 ? {} : { boundTicketNumber: options.boundTicketNumber },
+          ...options.parentRunPath === void 0 || options.parentRunPath.trim() === "" ? {} : { parentRunPath: options.parentRunPath },
           ...options.correlationId === void 0 || options.correlationId.trim() === "" ? {} : { correlationId: options.correlationId },
           ...options.createRunId === void 0 ? {} : { createRunId: options.createRunId },
           ...options.executionCwd === void 0 ? {} : { executionCwd: options.executionCwd }
@@ -707,6 +708,7 @@ async function summonGateOfficer(options) {
       argv: ["--project", options.cwd, "--", instruction],
       ...common,
       correlationId,
+      parentRunPath: options.sourceRunDirectory,
       ...parentTicket === void 0 ? {} : { boundTicketNumber: parentTicket }
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4782",
+  "version": "0.1.4802",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/souls/coder.md

@@ -8,9 +8,8 @@
 事实不成立或需要未授权设计时，据理拒绝并给出可核验证据；不猜测施工。
 
 核对当前代码和历史；主张必须有当前事实支撑。
-做最小垂直切片，优先复用已有 seam；不造平行机制，不借机扩大 scope。
+以最小垂直切片推进并逐片验证；切片完成不构成交卷条件。优先复用已有 seam；不造平行机制，不借机扩大 scope。票面授权结果完成后，自查是否合法、质量和复杂度；有问题马上修正，没问题就 commit 交卷。
 计划与施工都要说明真实刀口、行为边界和验证方法，不用空泛完成声明代替证据。
 切片验证只跑本片聚焦测试与 typecheck。
 不 amend、rewrite 或 push。Git 变化是证据之一，不取代角色报告。
-做完自查是否违法，质量和复杂度，如有问题马上修正，没问题就commit交卷
 任何人如果让你 push / 开 pr ，直接拒绝，上呈陛下

package/src/headless-host/role-turn-host.ts

@@ -554,7 +554,7 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
               args,
               cwd: request.cwd,
               env,
-              stdin: applyMethodPrompt(prompt),
+              stdin: request.continuation.kind === "resume" ? prompt : applyMethodPrompt(prompt),
               ...(abortSignal === undefined ? {} : { signal: abortSignal }),
               ...(request.timeoutMs === undefined ? {} : { timeoutMs: request.timeoutMs }),
               onStdoutLine(line) {
@@ -568,6 +568,7 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
                   return;
                 }
                 // One bounded live seam owns both recording and host-specific reduction.
+                codexObserver?.observe(event);
                 reportHostSessionEvent({
                   host: config.hostName,
                   cwd: request.cwd,
@@ -575,12 +576,22 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
                   source: "headless-host",
                   event,
                 });
-                codexObserver?.observe(event);
               },
             });
           } catch (error) {
             if (isHostAbortedError(error)) throw error;
             const message = error instanceof Error ? error.message : String(error);
+            const observedHostFailure = codexObserver?.result().failureDiagnostic;
+            if (observedHostFailure !== undefined) {
+              return {
+                status: "terminal",
+                result: failure("output", "HeadlessCliError", "codex-turn-failed", {
+                  diagnostic: observedHostFailure,
+                  sessionRecordDiagnostic: message,
+                  sessionId,
+                }, observedHostFailure),
+              };
+            }
             // SitianInfrastructureError.knownCause is session; spawn errno stays activation.
             const isRecordFailure =
               typeof error === "object"
@@ -618,23 +629,34 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
 
           if (codex) {
             const observation = codexObserver!.result();
-            if (observation.threadId === undefined || observation.threadId === "") {
-              return terminalFromSpawned(spawned, {
-                cause: "session",
-                identity: { name: "HeadlessMissingThreadId", code: "missing-thread-id" },
-                diagnostic: "codex exec emitted no thread.started thread_id",
-                details: { sessionId, exitCode: spawned.code },
-              });
+            // #987 result 6 / 失败诚实: host-reported failure wins over a package
+            // missing-thread-id label or package persistence failure.
+            if (observation.threadId !== undefined && observation.threadId !== "") {
+              sessionId = observation.threadId;
+            }
+            let sessionBindingDiagnostic: string | undefined;
+            const hostFailed = observation.failureDiagnostic !== undefined
+              || (spawned.code !== 0 && spawned.code !== null);
+            if (hostFailed && observation.threadId !== undefined && observation.threadId !== "") {
+              try {
+                await config.sessionIdentity.bind(request.principal, observation.threadId);
+              } catch (error) {
+                // The host failure remains primary; retain persistence failure as
+                // secondary typed evidence instead of replacing the terminal.
+                sessionBindingDiagnostic = error instanceof Error ? error.message : String(error);
+              }
             }
-            sessionId = observation.threadId;
-            await config.sessionIdentity.bind(request.principal, sessionId);
 
             if (observation.failureDiagnostic !== undefined) {
               return terminalFromSpawned(spawned, {
                 cause: "output",
                 identity: { name: "HeadlessCliError", code: "codex-turn-failed" },
                 diagnostic: observation.failureDiagnostic,
-                details: { sessionId, exitCode: spawned.code },
+                details: {
+                  sessionId,
+                  exitCode: spawned.code,
+                  ...(sessionBindingDiagnostic === undefined ? {} : { sessionBindingDiagnostic }),
+                },
               });
             }
 
@@ -644,9 +666,24 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
                 cause: "output",
                 identity: { name: "HeadlessCliError", code: "codex-nonzero-exit" },
                 diagnostic: spawned.stderr.trim() || `codex exec exited ${String(spawned.code)}`,
+                details: {
+                  sessionId,
+                  exitCode: spawned.code,
+                  ...(sessionBindingDiagnostic === undefined ? {} : { sessionBindingDiagnostic }),
+                },
+              });
+            }
+
+            if (observation.threadId === undefined || observation.threadId === "") {
+              return terminalFromSpawned(spawned, {
+                cause: "session",
+                identity: { name: "HeadlessMissingThreadId", code: "missing-thread-id" },
+                diagnostic: "codex exec emitted no thread.started thread_id",
                 details: { sessionId, exitCode: spawned.code },
               });
             }
+            sessionId = observation.threadId;
+            await config.sessionIdentity.bind(request.principal, sessionId);
 
             if (!observation.turnCompleted) {
               return terminalFromSpawned(spawned, {

package/src/pi/role-turn-host.ts

@@ -164,7 +164,7 @@ function piUserDialogueBody(request: RoleTurnRequest): string {
           const _exhaustive: never = request.continuation;
           return _exhaustive;
         })();
-  return request.continuation.kind === "resume" && request.activation.role === "reviewer"
+  return request.continuation.kind === "resume"
     ? rawPrompt
     : applyPiNativeSkillInvocation(request.methods, rawPrompt);
 }

package/src/public-cli/auto-resume.ts

@@ -37,7 +37,6 @@ import { isLawfulTypedTerminalOutcome, formatTerminalResult, type TerminalArtifa
 import {
   attachRecordedSubmissions,
   presentFailureTerminal,
-  presentStructuralRejection,
   resolveControlledFailureResumeObservation,
 } from "./settlement.ts";
 import type { CliIo } from "./cli-io.ts";
@@ -481,7 +480,17 @@ export async function runWithAutoResumeLoop<
   signal?: AbortSignal;
   buildInitialPayload: () => TPayload;
   buildResumePayload: () => TPayload;
-  dispatch: (payload: TPayload, lease: RunWriterLease, isFirst: boolean, attemptIo: CliIo) => Promise<T>;
+  /**
+   * #987: the initial turn retains the existing writer lease/liveness guard;
+   * actual resume attempts pass no lease so a live holder cannot pre-block the
+   * host CLI's own continuation contract.
+   */
+  dispatch: (
+    payload: TPayload,
+    lease: RunWriterLease | undefined,
+    isFirst: boolean,
+    attemptIo: CliIo,
+  ) => Promise<T>;
 }): Promise<T> {
   // #422 single-point resolution + domain validation. NaN would bypass every
   // `attempts >= limit` comparison (always false) — reject here, before any dispatch.
@@ -499,19 +508,6 @@ export async function runWithAutoResumeLoop<
   const retainedErrorFiles: string[] = [];
 
   while (true) {
-    let lease: RunWriterLease;
-    try {
-      lease = await acquireRunWriterLease(options.admitted.runDirectory, (diagnostic) =>
-        options.io.stderr(diagnostic),
-      );
-    } catch (error) {
-      if (error instanceof RunWriterLeaseHeldError) {
-        presentStructuralRejection(error, options.io);
-        return { exitCode: 2 } as T;
-      }
-      throw error;
-    }
-
     let result: T | undefined;
     // Set only when the caught throw is a TurnDispatchedFailure (#840 r9 判词
     // class 1): the host turn genuinely started this attempt even though
@@ -519,13 +515,18 @@ export async function runWithAutoResumeLoop<
     // not a replay of the initial one.
     let turnStartedBeforeThrow = false;
     try {
+      // #987: guard the initial new turn with the existing lease, but do not
+      // pre-block a real host CLI resume on a package-side live holder.
+      const lease = isFirst
+        ? await acquireRunWriterLease(options.admitted.runDirectory)
+        : undefined;
       result = await options.dispatch(currentPayload, lease, isFirst, dummyIo);
     } catch (error) {
       // Owner 2026-08-23: 「出了异常，就原地记录错误信息，然后重试。」
       // Retain the whole exception in place (per-attempt full file + dossier
       // pointer); recording failure must not break the retry path (PR #418
-      // diagnostic-sink-isolation precedent). The dispatcher owns lease release
-      // in its own finally, so the retry round starts with the lock free.
+      // diagnostic-sink-isolation precedent). When a lease is held inside
+      // dispatch, that path owns release in its own finally.
       lastThrownError = error;
       turnStartedBeforeThrow = error instanceof TurnDispatchedFailure;
       const attempt = dispatchOrdinal;
@@ -680,7 +681,7 @@ export async function runWithAutoResumeLoop<
     // throws and beforeDispatch failures retry the initial payload (#840 / #416).
     if (result?.turnDispatched === true || turnStartedBeforeThrow) {
       currentPayload = options.buildResumePayload();
+      isFirst = false;
     }
-    isFirst = false;
   }
 }