@akagilnc/pi-workflow-roles 0.1.4800 → 0.1.4870

package/dist/public-cli/invocation.js

@@ -10,6 +10,7 @@ import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { activationBookDirectory, ensureRealDirectoryTree, homeFromRunDirectory, pathContainedIn, resolveActivationLedgerHome, } from "../activation-ledger-topology.js";
 import { resolveBookKeyFromGit } from "../activation-ledger-git.js";
 import { ensureRoleRunDirectory, ensureRoleRunPlacement, roleRunArtifactsDirectory, roleRunPlacement, } from "../role-run-placement.js";
+import { packagedAdmittedSubject, packagedArgvResult, packagedBareToken, packagedBaseIsRevision, packagedEmitsAuthorityRefs, packagedPublicInstructionSubject, packagedRoleMetadata, packagedStoresSourceRunRaw, packagedSubjectChoices, } from "../packaged-role-registry.js";
 import { isSafePositiveTicketNumber, readBoardTicketNumber, requireSafePositiveTicketNumber, } from "../run-ticket-number.js";
 import { rewriteRunDirectoryPathFields, rewriteRunDirectoryPathValue, } from "../role-run-relocation.js";
 import { loadDoctorCase, } from "../doctor-evidence.js";
@@ -337,63 +338,202 @@ export function parsePositiveTicketNumber(raw, flag) {
     }
     return value;
 }
-/** 共享解析体：同形 owner 的 argv → instruction/attachments/project。 */
-function parseInstructionArgv(args, owner) {
-    const attachmentPaths = [];
-    let project;
-    let subject;
-    let sourceRun;
-    const positional = [];
+/**
+ * One token scan for public argv.
+ * Callers assign values; `--` still ends flag parsing.
+ * Analyst keeps its own assignment. Public seats assign in `parsePublicSeatArgv`.
+ */
+function scanPublicArgv(args, options, handlers) {
     const tokens = [...args];
-    const definitions = roleOptions(owner);
-    const options = createTypedOptionConsumer(definitions);
     while (tokens.length > 0) {
         if (tokens[0] === "--") {
             tokens.shift();
-            positional.push(...tokens);
-            break;
+            handlers.onDoubleDash(tokens);
+            return;
         }
         const taken = options.takeDashed(tokens);
         if (taken !== undefined) {
-            if (taken.def.id === "attach") {
-                attachmentPaths.push(requireOptionPath(taken.def.canonical, taken.value));
-                continue;
+            handlers.onDashed(taken);
+            continue;
+        }
+        handlers.onBare(tokens.shift());
+    }
+}
+function appendBareInstruction(owner, token, positional) {
+    if (token.startsWith("-") && token !== "-") {
+        throw new CliUsageError(`unknown ${owner} option: ${token}`);
+    }
+    positional.push(token);
+}
+function isMergerInternalPacketFace(token) {
+    return (token === "--targetObjectId" || token.startsWith("--targetObjectId=")
+        || token === "--sourceObjectId" || token.startsWith("--sourceObjectId=")
+        || token === "--expectedConflictPaths" || token.startsWith("--expectedConflictPaths=")
+        || token === "--resolutionScope" || token.startsWith("--resolutionScope="));
+}
+/** One assignment for every public-seat option id. Owner only selects the table. */
+function assignPublicSeatOption(owner, taken, fields) {
+    const value = taken.value;
+    switch (taken.def.id) {
+        case "attach":
+            fields.attachmentPaths.push(requireOptionPath(taken.def.canonical, value));
+            return;
+        case "project":
+            fields.project = requireOptionPath(taken.def.canonical, value);
+            return;
+        case "subject": {
+            const raw = typeof value === "string" ? value.trim() : "";
+            const subject = packagedAdmittedSubject(owner, raw);
+            if (subject === undefined) {
+                const allowed = packagedSubjectChoices(owner)?.join("|") ?? "";
+                throw new CliUsageError(`${owner} --subject must be ${allowed}, got ${value ?? "(missing)"}`);
+            }
+            fields.subject = subject;
+            return;
+        }
+        case "source-run": {
+            const text = typeof value === "string" ? value : "";
+            if (text.trim() === "") {
+                throw new CliUsageError(`${owner} --source-run requires a run locator`);
             }
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
+            fields.sourceRun = packagedStoresSourceRunRaw(owner) ? text : text.trim();
+            return;
+        }
+        case "base":
+            fields.baseRevision = packagedBaseIsRevision(owner)
+                ? requireReviewerBaseRevision(value)
+                : requireOptionPath(taken.def.canonical, value);
+            return;
+        case "lens":
+            fields.lens = requireReviewerLens(value);
+            return;
+        case "authority-ref":
+            fields.authorityRefs.push(requireAuthorityRef(value));
+            return;
+        case "prerequisites":
+            fields.prerequisitesPath = requireOptionPath(taken.def.canonical, value);
+            return;
+        case "pr":
+            fields.prNumber = parsePositivePrOption(value);
+            return;
+        case "repo":
+            fields.repo = parseRepoOption(value);
+            return;
+        case "request-manifest":
+            fields.requestManifestPath = requireOptionPath(taken.def.canonical, value);
+            return;
+        case "wait-ms": {
+            if (value === undefined || !/^[1-9]\d*$/.test(value.trim())) {
+                throw new CliUsageError("--wait-ms requires a positive safe-integer millisecond value");
             }
-            if (taken.def.id === "subject") {
-                const raw = typeof taken.value === "string" ? taken.value.trim() : "";
-                if (raw !== "judge" && raw !== "doctor") {
-                    throw new CliUsageError(`auditor --subject must be judge|doctor, got ${taken.value ?? "(missing)"}`);
-                }
-                subject = raw;
-                continue;
+            const parsed = Number(value.trim());
+            if (!Number.isSafeInteger(parsed) || parsed < 1) {
+                throw new CliUsageError("--wait-ms requires a positive safe-integer millisecond value");
             }
-            if (taken.def.id === "source-run") {
-                const raw = typeof taken.value === "string" ? taken.value.trim() : "";
-                if (raw === "") {
-                    throw new CliUsageError("auditor --source-run requires a run locator");
-                }
-                sourceRun = raw;
-                continue;
+            fields.waitWindowMs = parsed;
+            return;
+        }
+        case "issue": {
+            if (value === undefined || value.trim() === "") {
+                throw new CliUsageError("doctor --issue requires a positive integer");
             }
-            throw new CliUsageError(`unknown ${owner} option: ${taken.def.canonical}`);
+            fields.issueNumber = parseDoctorIssueNumber(value);
+            return;
         }
-        const token = tokens.shift();
+        case "runs": {
+            if (value === undefined || value.trim() === "") {
+                throw new CliUsageError("doctor --runs requires a path");
+            }
+            fields.runs = value;
+            return;
+        }
+        default:
+            throw new CliUsageError(`unknown ${owner} option: ${taken.def.canonical}`);
+    }
+}
+function rejectSeatBareToken(owner, token) {
+    const bare = packagedBareToken(owner);
+    if (bare === "burden" && isRejectedPublicSpelling(owner, token)) {
+        throw new CliUsageError("judge does not accept a public burden selector; Judge infers its own burden");
+    }
+    if (bare === "packet"
+        && (isRejectedPublicSpelling(owner, token) || isMergerInternalPacketFace(token))) {
+        throw new CliUsageError("merger does not accept public packet fields; the adapter reads Git merge materials");
+    }
+    if (bare === "instruction") {
         if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown ${owner} option: ${token}`);
+            throw new CliUsageError(`unknown notary option: ${token}`);
+        }
+        throw new CliUsageError("notary rejects caller prompt/instruction; only --source-run locator is admitted");
+    }
+}
+/**
+ * Sole public-seat argv parse. Seat rows differ by the option table and by
+ * which result keys that table produces. Analyst does not enter here.
+ */
+export function parsePublicSeatArgv(owner, args) {
+    if (packagedBareToken(owner) === "burden") {
+        const dd = args.indexOf("--");
+        const preDd = dd === -1 ? args : args.slice(0, dd);
+        for (const token of preDd) {
+            if (isRejectedPublicSpelling(owner, token)) {
+                throw new CliUsageError("judge does not accept a public burden selector; Judge infers its own burden");
+            }
         }
-        positional.push(token);
     }
+    const fields = {
+        attachmentPaths: [],
+        positional: [],
+        authorityRefs: [],
+    };
+    const options = createTypedOptionConsumer(roleOptions(owner));
+    scanPublicArgv(args, options, {
+        onDashed(taken) {
+            assignPublicSeatOption(owner, taken, fields);
+        },
+        onBare(token) {
+            rejectSeatBareToken(owner, token);
+            appendBareInstruction(owner, token, fields.positional);
+        },
+        onDoubleDash(rest) {
+            if (packagedBareToken(owner) === "instruction" && rest.length > 0) {
+                throw new CliUsageError("notary rejects caller prompt/instruction; only --source-run locator is admitted");
+            }
+            fields.positional.push(...rest);
+        },
+    });
+    const phaseDef = optionsForOwner(owner).find((def) => def.id === "phase" && def.form === "positional");
+    const phase = phaseDef === undefined
+        ? undefined
+        : options.consumeLeadingPhase(fields.positional);
     options.assertRequired();
+    const project = fields.project === undefined ? {} : { project: fields.project };
+    if (packagedArgvResult(owner) === "source-run") {
+        const sourceRun = fields.sourceRun;
+        if (sourceRun === undefined || sourceRun.trim() === "") {
+            throw new CliUsageError(`${owner} --source-run requires a run locator`);
+        }
+        return { sourceRun, ...project };
+    }
+    const instruction = fields.positional.join(" ");
+    const material = packagedArgvResult(owner) === "instruction"
+        ? { instruction, ...project }
+        : { instruction, attachmentPaths: fields.attachmentPaths, ...project };
     return {
-        instruction: positional.join(" "),
-        attachmentPaths,
-        ...(project === undefined ? {} : { project }),
-        ...(subject === undefined ? {} : { subject }),
-        ...(sourceRun === undefined ? {} : { sourceRun }),
+        ...material,
+        ...(phase === undefined ? {} : { phase }),
+        ...(fields.prerequisitesPath === undefined ? {} : { prerequisitesPath: fields.prerequisitesPath }),
+        ...(fields.prNumber === undefined ? {} : { prNumber: fields.prNumber }),
+        ...(fields.repo === undefined ? {} : { repo: fields.repo }),
+        ...(fields.requestManifestPath === undefined ? {} : { requestManifestPath: fields.requestManifestPath }),
+        ...(fields.waitWindowMs === undefined ? {} : { waitWindowMs: fields.waitWindowMs }),
+        ...(fields.issueNumber === undefined ? {} : { issueNumber: fields.issueNumber }),
+        ...(fields.runs === undefined ? {} : { runs: fields.runs }),
+        ...(fields.sourceRun === undefined ? {} : { sourceRun: fields.sourceRun }),
+        ...(fields.baseRevision === undefined ? {} : { baseRevision: fields.baseRevision }),
+        ...(fields.lens === undefined ? {} : { lens: fields.lens }),
+        ...(packagedEmitsAuthorityRefs(owner) ? { authorityRefs: fields.authorityRefs } : {}),
+        ...(fields.subject === undefined ? {} : { subject: fields.subject }),
     };
 }
 /** Reject missing/blank path values so empty overrides cannot silently degrade. */
@@ -477,139 +617,6 @@ export function requireAuthorityRef(value) {
         optionLike: "--authority-ref requires a durable reference, not inline Spec prose",
     });
 }
-/**
- * Parse Judge-specific argv after the `judge` token.
- * Spellings from PUBLIC_OPTION_TABLE.judge; rejects burden family (#342).
- */
-export function parseJudgeArgv(args) {
-    // Judge owns burden inference — rejected spellings checked per-token.
-    // `--` ends flag parsing: everything after is opaque instruction.
-    const dd = args.indexOf("--");
-    const preDd = dd === -1 ? args : args.slice(0, dd);
-    for (const token of preDd) {
-        if (isRejectedPublicSpelling("judge", token)) {
-            throw new CliUsageError("judge does not accept a public burden selector; Judge infers its own burden");
-        }
-    }
-    return parseInstructionArgv(args, "judge");
-}
-export function parseCountersignArgv(args) {
-    return parseInstructionArgv(args, "countersign");
-}
-export function parseInspectorArgv(args) {
-    return parseInstructionArgv(args, "inspector");
-}
-export function parseGatekeeperArgv(args) {
-    return parseInstructionArgv(args, "gatekeeper");
-}
-export function parseNavigatorArgv(args) {
-    return parseInstructionArgv(args, "navigator");
-}
-export function parseAuditorArgv(args) {
-    return parseInstructionArgv(args, "auditor");
-}
-export function parseDiaristArgv(args) {
-    return parseInstructionArgv(args, "diarist");
-}
-export function parseSecretariatArgv(args) {
-    return parseInstructionArgv(args, "secretariat");
-}
-/**
- * Parse Coder-specific argv after the `coder` token.
- * Phase defaults to apply; spellings from PUBLIC_OPTION_TABLE.coder (#342).
- */
-export function parseCoderArgv(args) {
-    const attachmentPaths = [];
-    let project;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("coder");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "attach") {
-                attachmentPaths.push(requireOptionPath(taken.def.canonical, taken.value));
-                continue;
-            }
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            throw new CliUsageError(`unknown coder option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown coder option: ${token}`);
-        }
-        positional.push(token);
-    }
-    // Phase aliases + default come solely from the typed coder phase row (#342).
-    const phase = options.consumeLeadingPhase(positional);
-    options.assertRequired();
-    return {
-        phase,
-        instruction: positional.join(" "),
-        attachmentPaths,
-        ...(project === undefined ? {} : { project }),
-    };
-}
-/**
- * Parse Fixer-specific argv after the `fixer` token.
- * Phase defaults to apply; spellings from PUBLIC_OPTION_TABLE.fixer (#342).
- */
-export function parseFixerArgv(args) {
-    const attachmentPaths = [];
-    let project;
-    let prerequisitesPath;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("fixer");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "attach") {
-                attachmentPaths.push(requireOptionPath(taken.def.canonical, taken.value));
-                continue;
-            }
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            if (taken.def.id === "prerequisites") {
-                prerequisitesPath = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            throw new CliUsageError(`unknown fixer option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown fixer option: ${token}`);
-        }
-        positional.push(token);
-    }
-    // Phase aliases + default come solely from the typed fixer phase row (#342).
-    const phase = options.consumeLeadingPhase(positional);
-    options.assertRequired();
-    return {
-        phase,
-        instruction: positional.join(" "),
-        attachmentPaths,
-        ...(prerequisitesPath === undefined ? {} : { prerequisitesPath }),
-        ...(project === undefined ? {} : { project }),
-    };
-}
 async function readRegularFileAttachment(sourcePath) {
     const absolute = isAbsolute(sourcePath) ? sourcePath : resolve(sourcePath);
     let st;
@@ -729,121 +736,573 @@ function ticketAdmissionFields(ticketNumber) {
         ticketNumber: requireSafePositiveTicketNumber(ticketNumber, "assertedTicketNumber"),
     };
 }
+/** Project an already-typed summons ticket into admit options. Absent stays absent. */
+export function summonedTicketFields(ticketNumber) {
+    if (ticketNumber === undefined)
+        return {};
+    return { assertedTicketNumber: ticketNumber };
+}
 /**
- * Shared instruction-seat admission for Judge and Inspector: project check,
- * principal/placement issue, attachment freeze, admitted-request and invocation
- * ledger write. CorrelationId is projected only when supplied (Inspector).
- * Ticket binding is post-admission via shared seat LLM path (#635).
+ * Fields every public admit call shares, including the summons ticket.
+ * Seat runners spread this once; they do not restate ticket placement.
  */
-async function admitStandardMaterialInvocation(role, options) {
-    // Empty project override must not reach resolve("") → cwd (silent default).
+export function admissionCallerOptions(env) {
+    return {
+        home: env.home,
+        principalAuthority: env.principalAuthority,
+        cwd: env.cwd,
+        ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+        ...(env.model === undefined ? {} : { model: env.model }),
+        ...(env.correlationId === undefined || env.correlationId.trim() === ""
+            ? {}
+            : { correlationId: env.correlationId }),
+        ...summonedTicketFields(env.boundTicketNumber),
+    };
+}
+export async function admitPublicRole(role, parsed, env, override) {
+    const record = packagedRoleMetadata(role);
+    if (record === undefined) {
+        throw new CliUsageError(`unknown role: ${role}`);
+    }
+    const shared = {
+        ...admissionCallerOptions(env),
+        ...(override?.assertedTicketNumber === undefined
+            ? {}
+            : { assertedTicketNumber: override.assertedTicketNumber }),
+    };
+    const instruction = parsed.instruction ?? "";
+    const attachmentPaths = parsed.attachmentPaths ?? [];
+    const project = parsed.project === undefined ? {} : { project: parsed.project };
+    switch (record.admission) {
+        case "instruction":
+            return admitStandardMaterialInvocation(role, {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+            });
+        case "court-materials":
+            return admitStandardMaterialInvocation("countersign", {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+                ...(override?.deferPersistence === undefined
+                    ? {}
+                    : { deferPersistence: override.deferPersistence }),
+            });
+        case "worker-task": {
+            if (instruction.trim() === "") {
+                throw new CliUsageError("coder requires a nonblank task instruction");
+            }
+            const phase = parsed.phase ?? "apply";
+            if (!record.phases.some((item) => item === phase)) {
+                throw new CliUsageError("coder phase must be plan or apply");
+            }
+            return admitStandardMaterialInvocation("coder", {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+                placedFields: async (placed) => {
+                    const taskPath = join(placed.runDirectory, "task.md");
+                    await writeFile(taskPath, instruction, "utf8");
+                    return { phase, taskPath };
+                },
+            });
+        }
+        case "worker-packet": {
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            if (instruction.trim() === "") {
+                throw new CliUsageError("fixer requires a nonblank repair instruction");
+            }
+            const phase = parsed.phase ?? "apply";
+            if (!record.phases.some((item) => item === phase)) {
+                throw new CliUsageError("fixer phase must be plan or apply");
+            }
+            let prerequisites = Object.freeze([]);
+            let prerequisitesSource;
+            if (parsed.prerequisitesPath !== undefined) {
+                const absolutePrereq = isAbsolute(parsed.prerequisitesPath)
+                    ? parsed.prerequisitesPath
+                    : resolve(parsed.prerequisitesPath);
+                try {
+                    prerequisitesSource = await readFile(absolutePrereq, "utf8");
+                }
+                catch (error) {
+                    throw new CliUsageError(`fixer prerequisites path is unreadable: ${parsed.prerequisitesPath}`, { cause: error });
+                }
+                try {
+                    prerequisites = parseFixerPrerequisites(prerequisitesSource);
+                }
+                catch (error) {
+                    if (error instanceof FixerPacketValidationError) {
+                        throw new CliUsageError(error.message, { cause: error });
+                    }
+                    throw error;
+                }
+            }
+            return admitStandardMaterialInvocation("fixer", {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+                placedFields: async (placed) => {
+                    let prerequisitesPath;
+                    if (prerequisitesSource !== undefined) {
+                        prerequisitesPath = join(placed.runDirectory, "prerequisites.json");
+                        await writeFile(prerequisitesPath, `${JSON.stringify(prerequisites, null, 2)}\n`, "utf8");
+                    }
+                    const packetPath = join(placed.runDirectory, "fix-packet.md");
+                    await writeFile(packetPath, instruction, "utf8");
+                    return {
+                        phase,
+                        packetPath,
+                        prerequisites,
+                        ...(prerequisitesPath === undefined ? {} : { prerequisitesPath }),
+                    };
+                },
+            });
+        }
+        case "collect-target": {
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            let explicitPrNumber;
+            if (parsed.prNumber !== undefined) {
+                try {
+                    explicitPrNumber = parseCollectorPrNumber(parsed.prNumber);
+                }
+                catch (error) {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    throw new CliUsageError(detail, { cause: error });
+                }
+            }
+            const projectRoot = resolve(parsed.project ?? shared.cwd);
+            let repository;
+            if (parsed.repo !== undefined) {
+                try {
+                    repository = parseCollectorRepository(parsed.repo);
+                }
+                catch (error) {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    throw new CliUsageError(detail, { cause: error });
+                }
+            }
+            else {
+                repository = resolveGitHubRemoteRepository(projectRoot);
+            }
+            let manifest = emptyCollectorManifest();
+            let manifestCanonicalJson;
+            if (parsed.requestManifestPath !== undefined) {
+                try {
+                    manifest = await loadCollectorManifest(parsed.requestManifestPath);
+                    manifestCanonicalJson = manifest.canonicalJson;
+                }
+                catch (error) {
+                    throw new CliUsageError(error instanceof Error ? error.message : String(error), { cause: error });
+                }
+            }
+            const manifestDigest = manifest.digest;
+            const admittedCollector = await admitStandardMaterialInvocation("collector", {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+                placedFields: async (placed) => {
+                    // Task materials are frozen before target resolution (#676 A).
+                    const target = await resolveCollectorTarget({
+                        projectRoot,
+                        repository,
+                        ...(explicitPrNumber === undefined ? {} : { explicitPrNumber }),
+                    });
+                    const prNumber = target.kind === "bound" ? target.prNumber : undefined;
+                    let requestManifestPath;
+                    if (manifestCanonicalJson !== undefined) {
+                        requestManifestPath = join(placed.runDirectory, "request-manifest.json");
+                        await writeFile(requestManifestPath, manifestCanonicalJson, "utf8");
+                    }
+                    return {
+                        ...(prNumber === undefined ? {} : { prNumber }),
+                        repository: repository.canonical,
+                        repositoryDisplay: repository.display,
+                        ...(requestManifestPath === undefined ? {} : { requestManifestPath }),
+                        ...(parsed.waitWindowMs === undefined ? {} : { waitWindowMs: parsed.waitWindowMs }),
+                        manifestDigest,
+                    };
+                },
+            });
+            return { ...admittedCollector, repository };
+        }
+        case "case-identity": {
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            const issueNumber = parsed.issueNumber ?? Number.NaN;
+            if (!Number.isInteger(issueNumber) ||
+                issueNumber < 1 ||
+                !DOCTOR_ISSUE_NUMBER_PATTERN.test(String(issueNumber))) {
+                throw new CliUsageError(`doctor --issue must be a positive integer, got ${issueNumber}`);
+            }
+            let frozenAttachments = [];
+            const admittedDoctor = await admitStandardMaterialInvocation("doctor", {
+                ...shared,
+                instruction,
+                attachmentPaths: [],
+                freezeAttachments: false,
+                ...project,
+                placedFields: async (placed) => {
+                    let caseRunsPath;
+                    try {
+                        caseRunsPath = await resolveDoctorCaseRunsPath({
+                            home: shared.home,
+                            projectRoot: placed.projectRoot,
+                            bookKey: placed.bookKey,
+                            issueNumber,
+                            ...(parsed.runs === undefined ? {} : { runs: parsed.runs }),
+                        });
+                    }
+                    catch (error) {
+                        if (error instanceof CliUsageError)
+                            throw error;
+                        const detail = error instanceof Error ? error.message : String(error);
+                        throw new CliUsageError(detail, { cause: error });
+                    }
+                    if (parsed.runs === undefined) {
+                        ensureRealDirectoryTree(placed.ledgerHome, caseRunsPath);
+                    }
+                    let caseIdentity;
+                    try {
+                        const patient = await loadDoctorCase(caseRunsPath);
+                        if (patient.identity.issueNumber !== issueNumber) {
+                            throw new CliUsageError(`doctor case issue ${patient.identity.issueNumber} does not match --issue ${issueNumber}`);
+                        }
+                        caseIdentity = patient.identity;
+                        caseRunsPath = await realpath(caseRunsPath);
+                    }
+                    catch (error) {
+                        if (error instanceof CliUsageError)
+                            throw error;
+                        const detail = error instanceof Error ? error.message : String(error);
+                        throw new CliUsageError(`doctor case could not be constructed from retained evidence: ${detail}`, { cause: error });
+                    }
+                    frozenAttachments = await freezeAttachments(attachmentPaths, placed.attachmentsDirectory);
+                    return {
+                        issueNumber,
+                        caseRunsPath,
+                        caseIdentity,
+                        attachments: persistedAttachmentRefs(frozenAttachments),
+                    };
+                },
+            });
+            return { ...admittedDoctor, attachments: frozenAttachments };
+        }
+        case "source-locator": {
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            const projectRoot = resolve(parsed.project ?? shared.cwd);
+            let sourceRun;
+            try {
+                sourceRun = await resolveNotarySourceRunLocator({
+                    projectRoot,
+                    sourceRun: parsed.sourceRun ?? "",
+                    home: shared.home,
+                });
+            }
+            catch (error) {
+                if (error instanceof NotarySourceRunError) {
+                    throw new CliUsageError(error.message, { cause: error });
+                }
+                throw error;
+            }
+            // Board ticket on the source run wins; otherwise the summons ticket. Code does not infer one.
+            const inheritedTicketNumber = await readBoardTicketNumber(sourceRun.runDirectory);
+            const knownTicketNumber = inheritedTicketNumber ?? shared.assertedTicketNumber;
+            return admitStandardMaterialInvocation("notary", {
+                ...shared,
+                ...(knownTicketNumber === undefined
+                    ? {}
+                    : { assertedTicketNumber: knownTicketNumber }),
+                instruction: "",
+                attachmentPaths: [],
+                ...project,
+                freezeAttachments: false,
+                admittedFields: {
+                    sourceRunPath: sourceRun.runDirectory,
+                    sourceRun,
+                },
+            });
+        }
+        case "gleaner": {
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            const baseRevision = parsed.baseRevision ?? "";
+            if (baseRevision.trim() === "") {
+                throw new CliUsageError("--base requires a nonempty revision");
+            }
+            return admitStandardMaterialInvocation("gleaner-left", {
+                ...shared,
+                instruction,
+                attachmentPaths: [],
+                ...project,
+                freezeAttachments: false,
+                admittedFields: { baseRevision },
+            });
+        }
+        case "review-basis": {
+            const lens = requireReviewerLens(parsed.lens);
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            const baseRevision = requireReviewerBaseRevision(parsed.baseRevision);
+            const rawRefs = parsed.authorityRefs ?? [];
+            if (rawRefs.length === 0) {
+                throw new CliUsageError("reviewer requires --authority-ref <ref>");
+            }
+            const authorityRefs = Object.freeze(rawRefs.map((ref) => requireAuthorityRef(ref)));
+            const admittedReviewer = await admitStandardMaterialInvocation("reviewer", {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+                admittedFields: {
+                    baseRevision,
+                    lens,
+                    authorityRefs: [...authorityRefs],
+                },
+            });
+            return { ...admittedReviewer, authorityRefs };
+        }
+        case "merge-envelope": {
+            if (parsed.project !== undefined) {
+                requireOptionPath("--project", parsed.project);
+            }
+            if (instruction.trim() === "") {
+                throw new CliUsageError("merger requires a nonblank task instruction");
+            }
+            const projectRoot = resolve(parsed.project ?? shared.cwd);
+            const derived = await deriveMergerEnvelopeFromActiveMerge(projectRoot, createProductionMergerGitState(projectRoot));
+            return admitStandardMaterialInvocation("merger", {
+                ...shared,
+                instruction,
+                attachmentPaths,
+                ...project,
+                placedFields: async (placed) => {
+                    const targetLabel = derived.targetObjectId === "" ? "(none observed)" : derived.targetObjectId;
+                    const sourceLabel = derived.sourceObjectId === "" ? "(none observed)" : derived.sourceObjectId;
+                    const mergerInput = validateMergerInput({
+                        attemptId: placed.runId,
+                        targetObjectId: derived.targetObjectId,
+                        sourceObjectId: derived.sourceObjectId,
+                        materials: {
+                            task: mergerMaterialFromUtf8(instruction),
+                            authority: mergerMaterialFromUtf8(instruction),
+                            targetIntent: mergerMaterialFromUtf8(`Investigate primary sources for target parent ${targetLabel}. Do not invent intent.`),
+                            sourceIntent: mergerMaterialFromUtf8(`Investigate primary sources for source parent ${sourceLabel}. Do not invent intent.`),
+                        },
+                        expectedConflictPaths: [...derived.expectedConflictPaths],
+                        resolutionScope: [...derived.resolutionScope],
+                        authorizedChecks: [],
+                    });
+                    const mergerInputPath = join(placed.runDirectory, "merger-input.json");
+                    await writeFile(mergerInputPath, `${JSON.stringify(mergerInput, null, 2)}\n`, "utf8");
+                    return {
+                        mergerInputPath,
+                        derived: {
+                            targetObjectId: derived.targetObjectId,
+                            sourceObjectId: derived.sourceObjectId,
+                            expectedConflictPaths: [...derived.expectedConflictPaths],
+                            resolutionScope: [...derived.resolutionScope],
+                        },
+                    };
+                },
+            });
+        }
+    }
+}
+/** One placement subject: a typed ticket already on the summons, otherwise unbound. */
+function admissionSubject(ticketNumber) {
+    const fields = ticketAdmissionFields(ticketNumber);
+    if (fields.ticketNumber === undefined)
+        return { unbound: true };
+    return { ticketNumber: fields.ticketNumber };
+}
+/**
+ * One admission placement (#505): typed ticket already on the summons, otherwise unbound.
+ * Every public seat persists through this function. Seat-only fields are supplied by the caller.
+ */
+async function placeRoleAdmission(options) {
     if (options.project !== undefined) {
         requireOptionPath("--project", options.project);
     }
     const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    // Validate asserted ticket before placement so 0/NaN never become subjects.
+    const runId = options.runId ?? (options.createRunId ?? uuidv7)();
     const ticketFields = ticketAdmissionFields(options.assertedTicketNumber);
     const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
         cwd: projectRoot,
         runId,
+        role: options.role,
+        subject: admissionSubject(options.assertedTicketNumber),
+        home: options.home,
+        ...(options.materialize === undefined ? {} : { materialize: options.materialize }),
+    });
+    const attachments = options.freezeAttachments === false
+        ? []
+        : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
+    return {
+        runId,
+        bookKey,
+        projectRoot,
+        runDirectory,
+        principal,
+        sessionDirectory,
+        sessionFile,
+        attachments,
+        attachmentsDirectory,
+        ledgerHome,
+        ticketFields,
+    };
+}
+function persistedAttachmentRefs(attachments) {
+    return attachments.map((attachment) => ({
+        provenancePath: attachment.provenancePath,
+        frozenPath: attachment.frozenPath,
+        byteLength: attachment.byteLength,
+        sha256: attachment.sha256,
+        mediaKind: attachment.mediaKind,
+    }));
+}
+async function persistPlacedAdmission(admitted, placed, model) {
+    const admittedRequestPath = join(placed.runDirectory, "admitted-request.json");
+    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+        sessionDirectory: placed.sessionDirectory,
+        sessionFile: placed.sessionFile,
+    });
+    await writeRoleInvocationLedger({
+        ...admitted,
+        sessionDirectory: placed.sessionDirectory,
+        sessionFile: placed.sessionFile,
+    }, admitted.role, model);
+    return admittedRequestPath;
+}
+/**
+ * Shared admission: project check, placement, attachment freeze,
+ * admitted-request and invocation ledger write.
+ * Countersign passes deferPersistence so same-ticket lookup can reserve coordinates
+ * before materializeCountersignInvocation writes the page.
+ * Seats whose extra facts are known before placement pass them as admittedFields.
+ * Seats whose extra facts depend on the placed run pass placedFields
+ * (coder writes task.md; fixer writes fix-packet.md; collector writes request-manifest.json;
+ * doctor resolves the case, then freezes attachments; merger writes merger-input.json).
+ */
+async function admitStandardMaterialInvocation(role, options) {
+    const defer = options.deferPersistence === true;
+    const skipFreeze = defer || options.freezeAttachments === false;
+    const placed = await placeRoleAdmission({
         role,
-        subject: ticketFields.ticketNumber === undefined
-            ? { unbound: true }
-            : { ticketNumber: ticketFields.ticketNumber },
         home: options.home,
+        principalAuthority: options.principalAuthority,
+        cwd: options.cwd,
+        attachmentPaths: options.attachmentPaths,
+        ...(skipFreeze ? { freezeAttachments: false } : {}),
+        ...(defer ? { materialize: false } : {}),
+        ...(options.project === undefined ? {} : { project: options.project }),
+        ...(options.createRunId === undefined ? {} : { createRunId: options.createRunId }),
+        ...(options.assertedTicketNumber === undefined
+            ? {}
+            : { assertedTicketNumber: options.assertedTicketNumber }),
     });
-    const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
     const correlationFields = options.correlationId === undefined
         ? {}
         : { correlationId: options.correlationId };
     const instruction = options.instruction;
     const instructionEmpty = instruction.trim() === "";
+    const placedExtra = options.placedFields === undefined ? undefined : await options.placedFields(placed);
+    const admittedFields = {
+        ...(options.admittedFields ?? {}),
+        ...(placedExtra ?? {}),
+    };
     const admitted = {
         role,
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
+        runId: placed.runId,
+        bookKey: placed.bookKey,
+        projectRoot: placed.projectRoot,
+        runDirectory: placed.runDirectory,
+        principal: placed.principal,
         ...correlationFields,
         instruction,
         instructionEmpty,
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-        ...ticketFields,
+        ...admittedFields,
+        attachments: persistedAttachmentRefs(placed.attachments),
+        ...placed.ticketFields,
     };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+    const admittedRequestPath = defer
+        ? join(placed.runDirectory, "admitted-request.json")
+        : await persistPlacedAdmission(admitted, placed, options.model);
     return {
         role,
-        runId,
-        bookKey,
-        projectRoot,
+        runId: placed.runId,
+        bookKey: placed.bookKey,
+        projectRoot: placed.projectRoot,
         instruction,
         instructionEmpty,
-        attachments,
-        runDirectory,
-        principal,
+        attachments: placed.attachments,
+        runDirectory: placed.runDirectory,
+        principal: placed.principal,
         admittedRequestPath,
         ...correlationFields,
-        ...ticketFields,
+        ...placed.ticketFields,
+        ...admittedFields,
     };
 }
-/**
- * Atomically admit a Judge Role run: freeze Attachments, persist the request,
- * and reserve session placement under the #78 ledger book.
- */
-export async function admitJudgeInvocation(options) {
-    return admitStandardMaterialInvocation("judge", options);
-}
-/**
- * Admit a direct Inspector (台院) run: freeze attachments, persist the request,
- * and reserve session placement. Same instruction-seat face as Judge (#568).
- */
-export async function admitInspectorInvocation(options) {
-    return admitStandardMaterialInvocation("inspector", options);
-}
-/**
- * Admit a direct Gatekeeper (门下省) run (#639): freeze attachments, persist
- * the request, reserve session placement — same instruction-seat face.
- */
-export async function admitGatekeeperInvocation(options) {
-    return admitStandardMaterialInvocation("gatekeeper", options);
-}
-/**
- * Admit a direct Navigator (游奕使) run (#639): freeze attachments, persist
- * the request, reserve session placement — same instruction-seat face.
- */
-export async function admitNavigatorInvocation(options) {
-    return admitStandardMaterialInvocation("navigator", options);
-}
-/** Admit a public 审刑院 run (#675). */
-export async function admitAuditorInvocation(options) {
-    return admitStandardMaterialInvocation("auditor", options);
+function admittedTransportPromptKind(admitted) {
+    if (admitted.role === undefined)
+        return "instruction";
+    const record = packagedRoleMetadata(admitted.role);
+    if (record !== undefined && "transportPrompt" in record)
+        return record.transportPrompt;
+    return "instruction";
 }
 /**
- * Admit a direct Diarist (起居郎) run (#708): freeze attachments, persist the
- * request, reserve session placement — same instruction-seat face.
+ * One initial prompt transport. The registry `transportPrompt` leaf selects
+ * a fixed kickoff, a bound baseline, or frozen skill args. Absent means the
+ * caller instruction plus frozen attachment paths.
  */
-export async function admitDiaristInvocation(options) {
-    return admitStandardMaterialInvocation("diarist", options);
-}
-/** Admit a public Secretariat (中书省) run (#924). */
-export async function admitSecretariatInvocation(options) {
-    return admitStandardMaterialInvocation("secretariat", options);
-}
-/** Shared prompt transport for instruction-seat roles (judge/countersign/inspector). */
 export function buildInstructionTransportPrompt(admitted, engineMaterial) {
+    const kind = admittedTransportPromptKind(admitted);
+    if (kind === "fixed-kickoff") {
+        return appendEngineSessionMaterial([NOTARY_FIXED_KICKOFF], engineMaterial).join("\n");
+    }
+    if (kind === "baseline") {
+        if (admitted.baseRevision === undefined) {
+            throw new Error("baseline transport prompt is missing the bound revision");
+        }
+        const lines = [`左拾遗案已受理。比较基线：${admitted.baseRevision}`];
+        if (!admitted.instructionEmpty) {
+            lines.push("", admitted.instruction);
+        }
+        return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
+    }
+    if (kind === "skill-args") {
+        if (admitted.baseRevision === undefined
+            || admitted.lens === undefined
+            || admitted.authorityRefs === undefined) {
+            throw new Error("skill-args transport prompt is missing frozen skill args");
+        }
+        const lines = [buildReviewerSkillArgProjection({
+                baseRevision: admitted.baseRevision,
+                lens: admitted.lens,
+                authorityRefs: admitted.authorityRefs,
+            })];
+        if (!admitted.instructionEmpty && admitted.instruction.trim() !== "") {
+            lines.push("", admitted.instruction);
+        }
+        return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
+    }
     const lines = [admitted.instructionEmpty ? "" : admitted.instruction];
     if (admitted.attachments.length > 0) {
         lines.push("");
@@ -854,91 +1313,26 @@ export function buildInstructionTransportPrompt(admitted, engineMaterial) {
     }
     return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
 }
-/** Build the Pi prompt transport for an admitted Judge request. */
-export function buildJudgeTransportPrompt(admitted, engineMaterial) {
-    return buildInstructionTransportPrompt(admitted, engineMaterial);
-}
-export function buildSecretariatTransportPrompt(admitted, engineMaterial) {
-    return buildInstructionTransportPrompt(admitted, engineMaterial);
-}
-export function buildInspectorTransportPrompt(admitted, engineMaterial) {
-    return buildInstructionTransportPrompt(admitted, engineMaterial);
-}
-/**
- * Admit a Countersign run immediately, or reserve its coordinates for deferred
- * materialization after identity lookup (#572 / ADR 0074 / #863).
- */
-export async function admitCountersignInvocation(options) {
-    // Same shared freeze/coordinate body as judge but role: "countersign" so
-    // the ledger and session coordinates use the correct role from the start.
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
+/** Persist a deferred Countersign admission after same-ticket lookup found no retained run. */
+export async function materializeCountersignInvocation(admitted, options) {
+    const placed = await placeRoleAdmission({
         role: "countersign",
-        subject: { unbound: true },
         home: options.home,
-        materialize: options.deferPersistence !== true,
+        principalAuthority: options.principalAuthority,
+        cwd: admitted.projectRoot,
+        attachmentPaths: [],
+        freezeAttachments: false,
+        runId: admitted.runId,
+        ...(options.ticketNumber === undefined ? {} : { assertedTicketNumber: options.ticketNumber }),
     });
-    const attachments = options.deferPersistence === true
-        ? []
-        : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-    // Ticket binding is LLM-only post-admission (#635); admission stays unbound.
-    const instruction = options.instruction;
-    const instructionEmpty = instruction.trim() === "";
-    const admitted = {
-        role: "countersign",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        ...(options.correlationId === undefined ? {} : { correlationId: options.correlationId }),
-        instruction,
-        instructionEmpty,
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    if (options.deferPersistence !== true) {
-        await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-            sessionDirectory,
-            sessionFile,
-        });
-        await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
+    const placement = placed;
+    admitted.runDirectory = placement.runDirectory;
+    admitted.admittedRequestPath = join(placement.runDirectory, "admitted-request.json");
+    admitted.principal = placement.principal;
+    const ticketFields = ticketAdmissionFields(options.ticketNumber);
+    if (ticketFields.ticketNumber !== undefined) {
+        admitted.ticketNumber = ticketFields.ticketNumber;
     }
-    return {
-        role: "countersign",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        ...(options.correlationId === undefined ? {} : { correlationId: options.correlationId }),
-    };
-}
-/** Persist a deferred Countersign admission after same-ticket lookup found no retained run. */
-export async function materializeCountersignInvocation(admitted, options) {
-    const placement = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: admitted.projectRoot,
-        runId: admitted.runId,
-        role: "countersign",
-        subject: { unbound: true },
-        home: options.home,
-    });
     const attachments = await freezePreparedAttachmentsIntoRun(options.preparedAttachments, admitted.runDirectory);
     admitted.attachments = attachments;
     await writeAdmittedRequestPersistence(admitted.admittedRequestPath, admitted, {
@@ -947,10 +1341,6 @@ export async function materializeCountersignInvocation(admitted, options) {
     });
     await writeRoleInvocationLedger({ ...admitted, sessionDirectory: placement.sessionDirectory, sessionFile: placement.sessionFile }, admitted.role, options.model);
 }
-/** Build the Pi prompt transport for an admitted Countersign request. */
-export function buildCountersignTransportPrompt(admitted, engineMaterial) {
-    return buildInstructionTransportPrompt(admitted, engineMaterial);
-}
 /** Load admitted-request.json written at admission (Navigator work-context seam). */
 export async function loadAdmittedJudgeRequest(runDirectory) {
     try {
@@ -958,7 +1348,7 @@ export async function loadAdmittedJudgeRequest(runDirectory) {
         if (raw === null || typeof raw !== "object" || Array.isArray(raw))
             return undefined;
         const record = raw;
-        if (record.role !== "judge")
+        if (!packagedPublicInstructionSubject(record.role))
             return undefined;
         if (typeof record.instruction !== "string")
             return undefined;
@@ -980,209 +1370,6 @@ export async function ensureRunArtifactsDir(runDirectory) {
     const directory = roleRunArtifactsDirectory(runDirectory);
     return ensureRoleRunDirectory(resolveActivationLedgerHome(homeFromRunDirectory(runDirectory)), directory);
 }
-/**
- * Admit a Coder Role run on the common Invocation request.
- * Nonblank task remains authoritative: blank instruction is a structural reject.
- * Phase (default apply / explicit plan) is frozen into the admitted request.
- */
-export async function admitCoderInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    const instruction = options.instruction;
-    if (instruction.trim() === "") {
-        throw new CliUsageError("coder requires a nonblank task instruction");
-    }
-    if (options.phase !== "plan" && options.phase !== "apply") {
-        throw new CliUsageError("coder phase must be plan or apply");
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "coder",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-    const taskPath = join(runDirectory, "task.md");
-    await writeFile(taskPath, instruction, "utf8");
-    const admitted = {
-        role: "coder",
-        phase: options.phase,
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty: false,
-        taskPath,
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "coder",
-        phase: options.phase,
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty: false,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        taskPath,
-    };
-}
-/**
- * Build the Pi prompt transport for an admitted Coder request.
- * Task bytes already live at taskPath for --ak-coder-task; the prompt carries
- * the same instruction plus frozen Attachment paths.
- */
-export function buildCoderTransportPrompt(admitted, engineMaterial) {
-    const lines = [admitted.instruction];
-    if (admitted.attachments.length > 0) {
-        lines.push("");
-        lines.push("已受理附件（冻结快照路径）：");
-        for (const attachment of admitted.attachments) {
-            lines.push(`- ${attachment.frozenPath}`);
-        }
-    }
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
-/**
- * Admit a Fixer Role run on the common Invocation request plus optional prerequisites.
- * Nonblank instruction remains authoritative. Phase defaults to apply at parse time.
- * Prerequisite grammar is structural; unmet/insufficient prerequisites stay Fixer judgments.
- */
-export async function admitFixerInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    const instruction = options.instruction;
-    if (instruction.trim() === "") {
-        throw new CliUsageError("fixer requires a nonblank repair instruction");
-    }
-    if (options.phase !== "plan" && options.phase !== "apply") {
-        throw new CliUsageError("fixer phase must be plan or apply");
-    }
-    // Validate/read prerequisites before freezing request materials.
-    let prerequisites = Object.freeze([]);
-    let prerequisitesSource;
-    if (options.prerequisitesPath !== undefined) {
-        const absolutePrereq = isAbsolute(options.prerequisitesPath)
-            ? options.prerequisitesPath
-            : resolve(options.prerequisitesPath);
-        try {
-            prerequisitesSource = await readFile(absolutePrereq, "utf8");
-        }
-        catch (error) {
-            throw new CliUsageError(`fixer prerequisites path is unreadable: ${options.prerequisitesPath}`, { cause: error });
-        }
-        try {
-            prerequisites = parseFixerPrerequisites(prerequisitesSource);
-        }
-        catch (error) {
-            if (error instanceof FixerPacketValidationError) {
-                throw new CliUsageError(error.message, { cause: error });
-            }
-            throw error;
-        }
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "fixer",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-    let prerequisitesPath;
-    if (prerequisitesSource !== undefined) {
-        prerequisitesPath = join(runDirectory, "prerequisites.json");
-        await writeFile(prerequisitesPath, `${JSON.stringify(prerequisites, null, 2)}\n`, "utf8");
-    }
-    const packetPath = join(runDirectory, "fix-packet.md");
-    await writeFile(packetPath, instruction, "utf8");
-    const admitted = {
-        role: "fixer",
-        phase: options.phase,
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty: false,
-        packetPath,
-        ...(prerequisitesPath === undefined ? {} : { prerequisitesPath }),
-        prerequisites: prerequisites.map((entry) => ({
-            id: entry.id,
-            requirement: entry.requirement,
-        })),
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "fixer",
-        phase: options.phase,
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty: false,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        packetPath,
-        ...(prerequisitesPath === undefined ? {} : { prerequisitesPath }),
-        prerequisites,
-    };
-}
-/**
- * Build the Pi prompt transport for an admitted Fixer request.
- * Instruction bytes live at packetPath; prerequisites at optional path.
- * Diagnosis method is available via package --skill, not forced into this prompt.
- */
-export function buildFixerTransportPrompt(admitted, engineMaterial) {
-    const lines = [admitted.instruction];
-    if (admitted.attachments.length > 0) {
-        lines.push("");
-        lines.push("已受理附件（冻结快照路径）：");
-        for (const attachment of admitted.attachments) {
-            lines.push(`- ${attachment.frozenPath}`);
-        }
-    }
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
 function parsePositivePrOption(raw) {
     if (raw === undefined || raw.trim() === "")
         throw new CliUsageError("--pr requires a positive pull request number");
@@ -1198,78 +1385,6 @@ function parseRepoOption(raw) {
         throw new CliUsageError("--repo requires owner/repo");
     return raw;
 }
-export function parseCollectorArgv(args) {
-    // Spellings from PUBLIC_OPTION_TABLE.collector (#342).
-    const attachmentPaths = [];
-    let project;
-    let repo;
-    let prNumber;
-    let requestManifestPath;
-    let waitWindowMs;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("collector");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "attach") {
-                attachmentPaths.push(requireOptionPath(taken.def.canonical, taken.value));
-                continue;
-            }
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            if (taken.def.id === "pr") {
-                prNumber = parsePositivePrOption(taken.value);
-                continue;
-            }
-            if (taken.def.id === "repo") {
-                repo = parseRepoOption(taken.value);
-                continue;
-            }
-            if (taken.def.id === "request-manifest") {
-                requestManifestPath = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            if (taken.def.id === "wait-ms") {
-                if (taken.value === undefined || !/^[1-9]\d*$/.test(taken.value.trim())) {
-                    throw new CliUsageError("--wait-ms requires a positive safe-integer millisecond value");
-                }
-                const parsed = Number(taken.value.trim());
-                if (!Number.isSafeInteger(parsed) || parsed < 1) {
-                    throw new CliUsageError("--wait-ms requires a positive safe-integer millisecond value");
-                }
-                waitWindowMs = parsed;
-                continue;
-            }
-            throw new CliUsageError(`unknown collector option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown collector option: ${token}`);
-        }
-        positional.push(token);
-    }
-    // Unconditional required from typed table via shared consumer (#342).
-    // #676 D1: --pr is optional; ambiguous targets reject at admission, not by guessing.
-    options.assertRequired();
-    return {
-        ...(prNumber === undefined ? {} : { prNumber }),
-        instruction: positional.join(" "),
-        attachmentPaths,
-        ...(project === undefined ? {} : { project }),
-        ...(repo === undefined ? {} : { repo }),
-        ...(requestManifestPath === undefined ? {} : { requestManifestPath }),
-        ...(waitWindowMs === undefined ? {} : { waitWindowMs }),
-    };
-}
 /**
  * Resolve owner/repo from the project's `origin` remote (github.com only).
  * Supports https and SSH GitHub URL shapes; never scrapes instruction prose.
@@ -1318,745 +1433,64 @@ function isGitRemoteMissing(error) {
     const status = error.status;
     return status === 2;
 }
-/**
- * Admit a Collector Role run: assemble the retained leg manifest from typed
- * declarations, resolve repository + PR target (#676 D1), and place the session under #78.
- * Explicit PR is not preflighted for existence; context resolution uses online association.
- */
-export async function admitCollectorInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    let explicitPrNumber;
-    if (options.prNumber !== undefined) {
-        try {
-            explicitPrNumber = parseCollectorPrNumber(options.prNumber);
-        }
-        catch (error) {
-            const detail = error instanceof Error ? error.message : String(error);
-            throw new CliUsageError(detail, { cause: error });
-        }
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    let repository;
-    if (options.repo !== undefined) {
-        try {
-            repository = parseCollectorRepository(options.repo);
-        }
-        catch (error) {
-            const detail = error instanceof Error ? error.message : String(error);
-            throw new CliUsageError(detail, { cause: error });
-        }
-    }
-    else {
-        repository = resolveGitHubRemoteRepository(projectRoot);
-    }
-    // Validate optional request-manifest before freezing request materials.
-    let manifest = emptyCollectorManifest();
-    let manifestCanonicalJson;
-    if (options.requestManifestPath !== undefined) {
-        try {
-            manifest = await loadCollectorManifest(options.requestManifestPath);
-            manifestCanonicalJson = manifest.canonicalJson;
-        }
-        catch (error) {
-            throw new CliUsageError(error instanceof Error ? error.message : String(error), { cause: error });
-        }
-    }
-    const manifestDigest = manifest.digest;
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "collector",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    // #676 A: freeze task materials BEFORE target resolution so the role receives
-    // real instruction + attachments. Admission binds only explicit --pr or unique
-    // head/commit association — task-text scrape is not a target lock.
-    const attachments = await freezeAttachments(options.attachmentPaths ?? [], attachmentsDirectory);
-    const instruction = options.instruction ?? "";
-    const instructionEmpty = instruction.trim() === "";
-    const target = await resolveCollectorTarget({
-        projectRoot,
-        repository,
-        ...(explicitPrNumber === undefined ? {} : { explicitPrNumber }),
-    });
-    const prNumber = target.kind === "bound" ? target.prNumber : undefined;
-    let requestManifestPath;
-    if (manifestCanonicalJson !== undefined) {
-        requestManifestPath = join(runDirectory, "request-manifest.json");
-        await writeFile(requestManifestPath, manifestCanonicalJson, "utf8");
-    }
-    const admitted = {
-        role: "collector",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty,
-        ...(prNumber === undefined ? {} : { prNumber }),
-        repository: repository.canonical,
-        repositoryDisplay: repository.display,
-        ...(requestManifestPath === undefined ? {} : { requestManifestPath }),
-        ...(options.waitWindowMs === undefined ? {} : { waitWindowMs: options.waitWindowMs }),
-        manifestDigest,
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "collector",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        ...(prNumber === undefined ? {} : { prNumber }),
-        repository,
-        ...(requestManifestPath === undefined ? {} : { requestManifestPath }),
-        ...(options.waitWindowMs === undefined ? {} : { waitWindowMs: options.waitWindowMs }),
-        manifestDigest,
-    };
-}
-/**
- * #676 A: Collector consumes the real call task + frozen attachments so the role
- * can identify issue/PR from materials via ak_collector_bind_target. Explicit --pr
- * still wins at admission; unique head/commit association also binds. No fixed
- * kickoff rewrite of the caller task; no mechanical task-text target lock.
- */
-export function buildCollectorTransportPrompt(admitted, engineMaterial) {
-    return buildInstructionTransportPrompt(admitted, engineMaterial);
-}
 /** Positive Issue number grammar shared with Doctor case path identity. */
 const DOCTOR_ISSUE_NUMBER_PATTERN = /^[1-9]\d*$/;
-/** Match retained Doctor case runs roots (ADR 0017 / loadDoctorCase). */
-/** Canonical Doctor case: `<book>/<ticket>/runs`. Legacy `issues/<n>/runs` is read-only compat. */
-const DOCTOR_CASE_RUNS_PATH_PATTERN = /\/\.ak-roles\/books\/[^/]+\/(?:issues\/)?([1-9]\d*)\/runs$/;
-/**
- * Parse a positive Issue number for public Doctor admission.
- * Leading zeros and non-integers are structural rejects.
- */
-export function parseDoctorIssueNumber(raw) {
-    const trimmed = raw.trim();
-    if (!DOCTOR_ISSUE_NUMBER_PATTERN.test(trimmed)) {
-        throw new CliUsageError(`doctor --issue must be a positive integer, got ${raw}`);
-    }
-    return Number(trimmed);
-}
-/**
- * Parse Doctor-specific argv after the `doctor` token.
- * Requires --issue; optional confined --runs override; common --attach/--project.
- */
-export function parseDoctorArgv(args) {
-    // Spellings from PUBLIC_OPTION_TABLE.doctor (#342).
-    const attachmentPaths = [];
-    let project;
-    let issueRaw;
-    let runs;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("doctor");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "issue") {
-                if (taken.value === undefined || taken.value.trim() === "") {
-                    throw new CliUsageError("doctor --issue requires a positive integer");
-                }
-                issueRaw = taken.value;
-                continue;
-            }
-            if (taken.def.id === "runs") {
-                if (taken.value === undefined || taken.value.trim() === "") {
-                    throw new CliUsageError("doctor --runs requires a path");
-                }
-                runs = taken.value;
-                continue;
-            }
-            if (taken.def.id === "attach") {
-                attachmentPaths.push(requireOptionPath(taken.def.canonical, taken.value));
-                continue;
-            }
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            throw new CliUsageError(`unknown doctor option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown doctor option: ${token}`);
-        }
-        positional.push(token);
-    }
-    // Unconditional required (e.g. --issue) from typed table via shared consumer (#342).
-    options.assertRequired();
-    const issueNumber = parseDoctorIssueNumber(issueRaw);
-    if (runs !== undefined && runs.trim() === "") {
-        throw new CliUsageError("doctor --runs requires a path");
-    }
-    return {
-        issueNumber,
-        instruction: positional.join(" "),
-        attachmentPaths,
-        ...(project === undefined ? {} : { project }),
-        ...(runs === undefined ? {} : { runs }),
-    };
-}
-/**
- * Resolve the retained Doctor case runs root from Issue identity.
- * Default is the #78 book locator; optional --runs must stay project-confined
- * and match Doctor case grammar for the same issue number.
- */
-export async function resolveDoctorCaseRunsPath(options) {
-    const ledgerHome = resolveActivationLedgerHome(options.home);
-    // Canonical topology: <book>/<ticket>/runs (docs/dossier-topology.md).
-    const defaultRuns = join(activationBookDirectory(ledgerHome, options.bookKey), String(options.issueNumber), "runs");
-    if (options.runs === undefined) {
-        return defaultRuns;
-    }
-    const raw = options.runs.trim();
-    if (raw === "") {
-        throw new CliUsageError("doctor --runs requires a path");
-    }
-    // Project-relative only — absolute overrides would bypass confinement.
-    if (isAbsolute(raw)) {
-        throw new CliUsageError("doctor --runs must be a project-relative path");
-    }
-    const resolved = resolve(options.projectRoot, raw);
-    if (resolved !== options.projectRoot &&
-        !pathContainedIn(options.projectRoot, resolved)) {
-        throw new CliUsageError("doctor --runs escapes the project root");
-    }
-    let real;
-    try {
-        real = await realpath(resolved);
-    }
-    catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        throw new CliUsageError(`doctor --runs is not a readable retained runs root: ${detail}`, { cause: error });
-    }
-    const normalized = real.split(sep).join("/");
-    const match = normalized.match(DOCTOR_CASE_RUNS_PATH_PATTERN);
-    if (!match) {
-        throw new CliUsageError("doctor --runs must be an .ak-roles/books/<book>/<n>/runs directory");
-    }
-    if (Number(match[1]) !== options.issueNumber) {
-        throw new CliUsageError(`doctor --runs issue ${match[1]} does not match --issue ${options.issueNumber}`);
-    }
-    return real;
-}
-/**
- * Admit a Doctor Role run: resolve Issue → retained runs root via #78 (or a
- * confined override), construct the structurally exact case identity through
- * loadDoctorCase, and place the Doctor session under the book runs lane.
- * Does not copy session content into a second store.
- */
-export async function admitDoctorInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    if (!Number.isInteger(options.issueNumber) ||
-        options.issueNumber < 1 ||
-        !DOCTOR_ISSUE_NUMBER_PATTERN.test(String(options.issueNumber))) {
-        throw new CliUsageError(`doctor --issue must be a positive integer, got ${options.issueNumber}`);
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "doctor",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    let caseRunsPath;
-    try {
-        caseRunsPath = await resolveDoctorCaseRunsPath({
-            home: options.home,
-            projectRoot,
-            bookKey,
-            issueNumber: options.issueNumber,
-            ...(options.runs === undefined ? {} : { runs: options.runs }),
-        });
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        const detail = error instanceof Error ? error.message : String(error);
-        throw new CliUsageError(detail, { cause: error });
-    }
-    // Default #78 locator may not exist yet — ensure the empty runs root so
-    // loadDoctorCase can form an empty case and Doctor's refusal owns insufficiency.
-    if (options.runs === undefined) {
-        ensureRealDirectoryTree(ledgerHome, caseRunsPath);
-    }
-    let caseIdentity;
-    try {
-        const patient = await loadDoctorCase(caseRunsPath);
-        if (patient.identity.issueNumber !== options.issueNumber) {
-            throw new CliUsageError(`doctor case issue ${patient.identity.issueNumber} does not match --issue ${options.issueNumber}`);
-        }
-        caseIdentity = patient.identity;
-        caseRunsPath = await realpath(caseRunsPath);
-    }
-    catch (error) {
-        if (error instanceof CliUsageError)
-            throw error;
-        const detail = error instanceof Error ? error.message : String(error);
-        throw new CliUsageError(`doctor case could not be constructed from retained evidence: ${detail}`, { cause: error });
-    }
-    const attachments = await freezeAttachments(options.attachmentPaths ?? [], attachmentsDirectory);
-    const instruction = options.instruction ?? "";
-    const instructionEmpty = instruction.trim() === "";
-    const admitted = {
-        role: "doctor",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty,
-        issueNumber: options.issueNumber,
-        caseRunsPath,
-        caseIdentity,
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "doctor",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        issueNumber: options.issueNumber,
-        caseRunsPath,
-        caseIdentity,
-    };
-}
-/** Build the Pi prompt transport for an admitted Doctor request. */
-export function buildDoctorTransportPrompt(admitted, engineMaterial) {
-    const lines = [admitted.instructionEmpty ? "" : admitted.instruction];
-    if (admitted.attachments.length > 0) {
-        lines.push("");
-        lines.push("已受理附件（冻结快照路径）：");
-        for (const attachment of admitted.attachments) {
-            lines.push(`- ${attachment.frozenPath}`);
-        }
-    }
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
-/**
- * Parse Notary-specific argv after the `notary` token.
- * Input contract = zero prompt, zero attachment projection (#448 / #276).
- */
-export function parseNotaryArgv(args) {
-    let project;
-    let sourceRun;
-    const tokens = [...args];
-    const definitions = roleOptions("notary");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            if (tokens.length > 0) {
-                throw new CliUsageError("notary rejects caller prompt/instruction; only --source-run locator is admitted");
-            }
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            if (taken.def.id === "source-run") {
-                if (taken.value === undefined || taken.value.trim() === "") {
-                    throw new CliUsageError("notary --source-run requires a run locator");
-                }
-                sourceRun = taken.value;
-                continue;
-            }
-            throw new CliUsageError(`unknown notary option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown notary option: ${token}`);
-        }
-        throw new CliUsageError("notary rejects caller prompt/instruction; only --source-run locator is admitted");
-    }
-    options.assertRequired();
-    if (sourceRun === undefined || sourceRun.trim() === "") {
-        throw new CliUsageError("notary --source-run requires a run locator");
-    }
-    return {
-        sourceRun,
-        ...(project === undefined ? {} : { project }),
-    };
-}
-export async function admitNotaryInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    let sourceRun;
-    try {
-        sourceRun = await resolveNotarySourceRunLocator({
-            projectRoot,
-            sourceRun: options.sourceRun,
-            home: options.home,
-        });
-    }
-    catch (error) {
-        if (error instanceof NotarySourceRunError) {
-            throw new CliUsageError(error.message, { cause: error });
-        }
-        throw error;
-    }
-    // Notary inherits board identity only — migration-derived stays display/placement.
-    const inheritedTicketNumber = await readBoardTicketNumber(sourceRun.runDirectory);
-    const runId = options.createRunId?.() ?? uuidv7();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "notary",
-        subject: inheritedTicketNumber === undefined
-            ? { unbound: true }
-            : { ticketNumber: inheritedTicketNumber },
-        home: options.home,
-    });
-    const ticketFields = ticketAdmissionFields(inheritedTicketNumber);
-    const admitted = {
-        role: "notary",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction: "",
-        instructionEmpty: true,
-        attachments: [],
-        sourceRunPath: sourceRun.runDirectory,
-        sourceRun,
-        ...ticketFields,
-        ...(options.correlationId === undefined
-            ? {}
-            : { correlationId: options.correlationId }),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "notary",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction: "",
-        instructionEmpty: true,
-        attachments: [],
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        sourceRunPath: sourceRun.runDirectory,
-        sourceRun,
-        ...ticketFields,
-        ...(options.correlationId === undefined
-            ? {}
-            : { correlationId: options.correlationId }),
-    };
-}
-/** Package-owned fixed kickoff only — never caller instruction/attachments.
- * Ticket rides admitted → activation → agent-start typed bound (not free-text kickoff). */
-export function buildNotaryTransportPrompt(_admitted, engineMaterial) {
-    return appendEngineSessionMaterial([NOTARY_FIXED_KICKOFF], engineMaterial).join("\n");
-}
+/** Match retained Doctor case runs roots (ADR 0017 / loadDoctorCase). */
+/** Canonical Doctor case: `<book>/<ticket>/runs`. Legacy `issues/<n>/runs` is read-only compat. */
+const DOCTOR_CASE_RUNS_PATH_PATTERN = /\/\.ak-roles\/books\/[^/]+\/(?:issues\/)?([1-9]\d*)\/runs$/;
 /**
- * Parse Gleaner-Left argv after the `gleaner-left` token.
- * Public flags: --project, required --base. No --attach / ticket face (unanchored self-fetch).
- * Instruction may be empty; callers must not pass directional instruction.
+ * Parse a positive Issue number for public Doctor admission.
+ * Leading zeros and non-integers are structural rejects.
  */
-export function parseGleanerLeftArgv(args) {
-    let project;
-    let baseRevision;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("gleaner-left");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            if (taken.def.id === "base") {
-                baseRevision = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            throw new CliUsageError(`unknown gleaner-left option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown gleaner-left option: ${token}`);
-        }
-        positional.push(token);
+export function parseDoctorIssueNumber(raw) {
+    const trimmed = raw.trim();
+    if (!DOCTOR_ISSUE_NUMBER_PATTERN.test(trimmed)) {
+        throw new CliUsageError(`doctor --issue must be a positive integer, got ${raw}`);
     }
-    options.assertRequired();
-    return {
-        instruction: positional.join(" "),
-        baseRevision: baseRevision,
-        ...(project === undefined ? {} : { project }),
-    };
+    return Number(trimmed);
 }
 /**
- * Admit a Gleaner-Left Role run on the fixed comparison base.
- * Empty instruction is the lawful path; no attachment/ticket admission face.
+ * Resolve the retained Doctor case runs root from Issue identity.
+ * Default is the #78 book locator; optional --runs must stay project-confined
+ * and match Doctor case grammar for the same issue number.
  */
-export async function admitGleanerLeftInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
+export async function resolveDoctorCaseRunsPath(options) {
+    const ledgerHome = resolveActivationLedgerHome(options.home);
+    // Canonical topology: <book>/<ticket>/runs (docs/dossier-topology.md).
+    const defaultRuns = join(activationBookDirectory(ledgerHome, options.bookKey), String(options.issueNumber), "runs");
+    if (options.runs === undefined) {
+        return defaultRuns;
     }
-    if (options.baseRevision.trim() === "") {
-        throw new CliUsageError("--base requires a nonempty revision");
+    const raw = options.runs.trim();
+    if (raw === "") {
+        throw new CliUsageError("doctor --runs requires a path");
     }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "gleaner-left",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    const instruction = options.instruction;
-    const instructionEmpty = instruction.trim() === "";
-    const admitted = {
-        role: "gleaner-left",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty,
-        baseRevision: options.baseRevision,
-        attachments: [],
-        ...(options.correlationId === undefined
-            ? {}
-            : { correlationId: options.correlationId }),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "gleaner-left",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty,
-        attachments: [],
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        baseRevision: options.baseRevision,
-        ...(options.correlationId === undefined
-            ? {}
-            : { correlationId: options.correlationId }),
-    };
-}
-/** Bound comparison base is a typed fact, not a directional instruction. */
-export function buildGleanerLeftTransportPrompt(admitted, engineMaterial) {
-    const lines = [
-        `左拾遗案已受理。比较基线：${admitted.baseRevision}`,
-    ];
-    if (!admitted.instructionEmpty) {
-        lines.push("", admitted.instruction);
+    // Project-relative only — absolute overrides would bypass confinement.
+    if (isAbsolute(raw)) {
+        throw new CliUsageError("doctor --runs must be a project-relative path");
     }
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
-export function parseReviewerArgv(args) {
-    // Spellings from PUBLIC_OPTION_TABLE.reviewer (#342). No --attach face.
-    const attachmentPaths = [];
-    const authorityRefs = [];
-    let project;
-    let baseRevision;
-    let lens;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("reviewer");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            if (taken.def.id === "base") {
-                baseRevision = requireReviewerBaseRevision(taken.value);
-                continue;
-            }
-            if (taken.def.id === "lens") {
-                // Public override is single-axis only; omission stays undefined for the parallel branch.
-                lens = requireReviewerLens(taken.value);
-                continue;
-            }
-            if (taken.def.id === "authority-ref") {
-                authorityRefs.push(requireAuthorityRef(taken.value));
-                continue;
-            }
-            throw new CliUsageError(`unknown reviewer option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown reviewer option: ${token}`);
-        }
-        positional.push(token);
+    const resolved = resolve(options.projectRoot, raw);
+    if (resolved !== options.projectRoot &&
+        !pathContainedIn(options.projectRoot, resolved)) {
+        throw new CliUsageError("doctor --runs escapes the project root");
     }
-    // Base and authority are required; omitted lens selects the parallel two-axis mode.
-    options.assertRequired();
-    return {
-        instruction: positional.join(" "),
-        attachmentPaths,
-        baseRevision: baseRevision,
-        ...(lens === undefined ? {} : { lens }),
-        authorityRefs,
-        ...(project === undefined ? {} : { project }),
-    };
-}
-/**
- * Admit a Reviewer Role run on the fixed base + lens + authority set.
- * Caller instruction is optional provenance; typed fields project Skill inputs.
- * authorityRefs are frozen as durable references only — not Spec prose.
- */
-export async function admitReviewerInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
+    let real;
+    try {
+        real = await realpath(resolved);
     }
-    const baseRevision = requireReviewerBaseRevision(options.baseRevision);
-    const lens = requireReviewerLens(options.lens);
-    if (options.authorityRefs.length === 0) {
-        throw new CliUsageError("reviewer requires --authority-ref <ref>");
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new CliUsageError(`doctor --runs is not a readable retained runs root: ${detail}`, { cause: error });
     }
-    const authorityRefs = Object.freeze(options.authorityRefs.map((ref) => requireAuthorityRef(ref)));
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "reviewer",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    // Public parse already rejects attachments; keep freeze loop for structural symmetry.
-    const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-    const instruction = options.instruction;
-    const instructionEmpty = instruction.trim() === "";
-    const admitted = {
-        role: "reviewer",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty,
-        baseRevision,
-        lens,
-        authorityRefs: [...authorityRefs],
-        ...(options.correlationId === undefined
-            ? {}
-            : { correlationId: options.correlationId }),
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "reviewer",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        baseRevision,
-        lens,
-        authorityRefs,
-        ...(options.correlationId === undefined
-            ? {}
-            : { correlationId: options.correlationId }),
-    };
+    const normalized = real.split(sep).join("/");
+    const match = normalized.match(DOCTOR_CASE_RUNS_PATH_PATTERN);
+    if (!match) {
+        throw new CliUsageError("doctor --runs must be an .ak-roles/books/<book>/<n>/runs directory");
+    }
+    if (Number(match[1]) !== options.issueNumber) {
+        throw new CliUsageError(`doctor --runs issue ${match[1]} does not match --issue ${options.issueNumber}`);
+    }
+    return real;
 }
 /** Frozen Skill arg projection shared by initial and resume (never reverse-parsed). */
 export function buildReviewerSkillArgProjection(admitted) {
@@ -2066,72 +1500,6 @@ export function buildReviewerSkillArgProjection(admitted) {
         ...admitted.authorityRefs.map((ref) => `--authority ${ref}`),
     ].join(" ");
 }
-/**
- * Build the host-neutral prompt transport for an admitted Reviewer request.
- * Typed base/lens/authority project to Skill invocation args (never reverse-parsed from prose).
- * Optional caller words + engine material follow.
- */
-export function buildReviewerTransportPrompt(admitted, engineMaterial) {
-    const lines = [buildReviewerSkillArgProjection(admitted)];
-    if (!admitted.instructionEmpty && admitted.instruction.trim() !== "") {
-        lines.push("", admitted.instruction);
-    }
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
-/**
- * Parse Merger-specific argv after the `merger` token.
- * Spellings from PUBLIC_OPTION_TABLE.merger; internal packet fields rejected (#342).
- */
-export function parseMergerArgv(args) {
-    const attachmentPaths = [];
-    let project;
-    const positional = [];
-    const tokens = [...args];
-    const definitions = roleOptions("merger");
-    const options = createTypedOptionConsumer(definitions);
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            positional.push(...tokens);
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
-            if (taken.def.id === "attach") {
-                attachmentPaths.push(requireOptionPath(taken.def.canonical, taken.value));
-                continue;
-            }
-            if (taken.def.id === "project") {
-                project = requireOptionPath(taken.def.canonical, taken.value);
-                continue;
-            }
-            throw new CliUsageError(`unknown merger option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        // Rejected public spellings (#342) plus other internal packet field faces.
-        if (isRejectedPublicSpelling("merger", token) ||
-            token === "--targetObjectId" ||
-            token.startsWith("--targetObjectId=") ||
-            token === "--sourceObjectId" ||
-            token.startsWith("--sourceObjectId=") ||
-            token === "--expectedConflictPaths" ||
-            token.startsWith("--expectedConflictPaths=") ||
-            token === "--resolutionScope" ||
-            token.startsWith("--resolutionScope=")) {
-            throw new CliUsageError("merger does not accept public packet fields; the adapter reads Git merge materials");
-        }
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown merger option: ${token}`);
-        }
-        positional.push(token);
-    }
-    options.assertRequired();
-    return {
-        instruction: positional.join(" "),
-        attachmentPaths,
-        ...(project === undefined ? {} : { project }),
-    };
-}
 function mergerMaterialFromUtf8(text) {
     const bytes = Buffer.from(text, "utf8");
     return Object.freeze({
@@ -2155,115 +1523,6 @@ export async function deriveMergerEnvelopeFromActiveMerge(projectRoot, gitState
         resolutionScope,
     });
 }
-/**
- * Admit a Merger Role run on the common Invocation request.
- * Git materials (parents, conflicts, scope) are read from the worktree and
- * handed to the role as assignment materials — including when empty (#827).
- * Callers never supply public packet fields for those facts.
- */
-export async function admitMergerInvocation(options) {
-    if (options.project !== undefined) {
-        requireOptionPath("--project", options.project);
-    }
-    const instruction = options.instruction;
-    if (instruction.trim() === "") {
-        throw new CliUsageError("merger requires a nonblank task instruction");
-    }
-    const projectRoot = resolve(options.project ?? options.cwd);
-    const derived = await deriveMergerEnvelopeFromActiveMerge(projectRoot, options.gitState ?? createProductionMergerGitState(projectRoot));
-    const runId = (options.createRunId ?? uuidv7)();
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
-        cwd: projectRoot,
-        runId,
-        role: "merger",
-        subject: { unbound: true },
-        home: options.home,
-    });
-    const attachments = await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
-    // Intent materials seed primary-source investigation; the method owns the work.
-    const targetLabel = derived.targetObjectId === "" ? "(none observed)" : derived.targetObjectId;
-    const sourceLabel = derived.sourceObjectId === "" ? "(none observed)" : derived.sourceObjectId;
-    const targetIntent = mergerMaterialFromUtf8(`Investigate primary sources for target parent ${targetLabel}. Do not invent intent.`);
-    const sourceIntent = mergerMaterialFromUtf8(`Investigate primary sources for source parent ${sourceLabel}. Do not invent intent.`);
-    const taskMaterial = mergerMaterialFromUtf8(instruction);
-    const authorityMaterial = mergerMaterialFromUtf8(instruction);
-    const mergerInput = validateMergerInput({
-        attemptId: runId,
-        targetObjectId: derived.targetObjectId,
-        sourceObjectId: derived.sourceObjectId,
-        materials: {
-            task: taskMaterial,
-            authority: authorityMaterial,
-            targetIntent,
-            sourceIntent,
-        },
-        expectedConflictPaths: [...derived.expectedConflictPaths],
-        resolutionScope: [...derived.resolutionScope],
-        authorizedChecks: [],
-    });
-    const mergerInputPath = join(runDirectory, "merger-input.json");
-    await writeFile(mergerInputPath, `${JSON.stringify(mergerInput, null, 2)}\n`, "utf8");
-    const admitted = {
-        role: "merger",
-        runId,
-        bookKey,
-        projectRoot,
-        runDirectory,
-        principal,
-        instruction,
-        instructionEmpty: false,
-        mergerInputPath,
-        derived: {
-            targetObjectId: derived.targetObjectId,
-            sourceObjectId: derived.sourceObjectId,
-            expectedConflictPaths: [...derived.expectedConflictPaths],
-            resolutionScope: [...derived.resolutionScope],
-        },
-        attachments: attachments.map((a) => ({
-            provenancePath: a.provenancePath,
-            frozenPath: a.frozenPath,
-            byteLength: a.byteLength,
-            sha256: a.sha256,
-            mediaKind: a.mediaKind,
-        })),
-    };
-    const admittedRequestPath = join(runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
-        sessionDirectory,
-        sessionFile,
-    });
-    await writeRoleInvocationLedger({ ...admitted, sessionDirectory, sessionFile }, admitted.role, options.model);
-    return {
-        role: "merger",
-        runId,
-        bookKey,
-        projectRoot,
-        instruction,
-        instructionEmpty: false,
-        attachments,
-        runDirectory,
-        principal,
-        admittedRequestPath,
-        mergerInputPath,
-        derived: admitted.derived,
-    };
-}
-/**
- * Build the host-neutral prompt transport for an admitted Merger request.
- * Method material binds on RoleTurnRequest.methods; Pi-native `/skill:` form
- * is adapter-internal only (ADR 0082).
- */
-export function buildMergerTransportPrompt(admitted, engineMaterial) {
-    const lines = [admitted.instruction];
-    if (admitted.attachments.length > 0) {
-        lines.push("");
-        lines.push("已受理附件（冻结快照路径）：");
-        for (const attachment of admitted.attachments) {
-            lines.push(`- ${attachment.frozenPath}`);
-        }
-    }
-    return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
-}
 const ANALYST_TICKET_NUMBER_PATTERN = /^[1-9]\d*$/;
 /**
  * Parse a positive ticket / issue number for public analyst admission.
@@ -2369,7 +1628,6 @@ function requireOptionValue(flag, value, what) {
  */
 export function parseAnalystArgv(args) {
     const valueLists = new Map();
-    const tokens = [...args];
     const definitions = roleOptions("analyst");
     // Shared typed consumer: dashed + positional take, repeatable, required (#342).
     const options = createTypedOptionConsumer(definitions);
@@ -2380,63 +1638,61 @@ export function parseAnalystArgv(args) {
         else
             existing.push(value);
     };
-    while (tokens.length > 0) {
-        if (tokens[0] === "--") {
-            tokens.shift();
-            if (tokens.length > 0) {
-                throw new CliUsageError(`unexpected analyst argument: ${tokens[0]}`);
-            }
-            break;
-        }
-        const taken = options.takeDashed(tokens);
-        if (taken !== undefined) {
+    scanPublicArgv(args, options, {
+        onDashed(taken) {
             if (taken.def.valueMetavar === null) {
                 pushValue(taken.def.id, "");
-                continue;
+                return;
             }
             if (taken.def.id === "ticket") {
                 if (taken.value === undefined || taken.value.trim() === "") {
                     throw new CliUsageError("analyst --ticket requires a positive integer");
                 }
                 pushValue("ticket", taken.value);
-                continue;
+                return;
             }
             if (taken.def.id === "attach") {
                 pushValue("attach", requireOptionPath(taken.def.canonical, taken.value));
-                continue;
+                return;
             }
             if (taken.def.id === "group-a-label" || taken.def.id === "group-b-label") {
                 pushValue(taken.def.id, requireOptionValue(taken.def.canonical, taken.value, "a label"));
-                continue;
+                return;
             }
             if (taken.def.id === "group-a-issues" || taken.def.id === "group-b-issues") {
                 pushValue(taken.def.id, requireOptionValue(taken.def.canonical, taken.value, "a comma-separated list of N or book:N"));
-                continue;
+                return;
             }
             throw new CliUsageError(`unknown analyst option: ${taken.def.canonical}`);
-        }
-        const token = tokens.shift();
-        // #399: deleted --project-root; disabled --model-groups public face.
-        if (isRejectedPublicSpelling("analyst", token)) {
-            if (token === "--project-root" || token.startsWith("--project-root=")) {
-                throw new CliUsageError("analyst no longer accepts --project-root (deleted); use bare call for whole book or --ticket N (cwd git common-dir selects the book)");
+        },
+        onBare(token) {
+            // #399: deleted --project-root; disabled --model-groups public face.
+            if (isRejectedPublicSpelling("analyst", token)) {
+                if (token === "--project-root" || token.startsWith("--project-root=")) {
+                    throw new CliUsageError("analyst no longer accepts --project-root (deleted); use bare call for whole book or --ticket N (cwd git common-dir selects the book)");
+                }
+                if (token === "--model-groups" || token.startsWith("--model-groups=")) {
+                    throw new CliUsageError("analyst --model-groups public CLI face is disabled; input face is being redesigned for multi-issue comparison (see follow-up ticket)");
+                }
+                throw new CliUsageError(`unknown analyst option: ${token}`);
             }
-            if (token === "--model-groups" || token.startsWith("--model-groups=")) {
-                throw new CliUsageError("analyst --model-groups public CLI face is disabled; input face is being redesigned for multi-issue comparison (see follow-up ticket)");
+            if (token.startsWith("-") && token !== "-") {
+                throw new CliUsageError(`unknown analyst option: ${token}`);
             }
-            throw new CliUsageError(`unknown analyst option: ${token}`);
-        }
-        if (token.startsWith("-") && token !== "-") {
-            throw new CliUsageError(`unknown analyst option: ${token}`);
-        }
-        // Positional selectors (e.g. sweep) via shared typed consumer — not a parallel list.
-        const positional = options.takePositional(token);
-        if (positional !== undefined) {
-            pushValue(positional.id, "");
-            continue;
-        }
-        throw new CliUsageError(`unexpected analyst argument: ${token}`);
-    }
+            // Positional selectors (e.g. sweep) via shared typed consumer — not a parallel list.
+            const positional = options.takePositional(token);
+            if (positional !== undefined) {
+                pushValue(positional.id, "");
+                return;
+            }
+            throw new CliUsageError(`unexpected analyst argument: ${token}`);
+        },
+        onDoubleDash(rest) {
+            if (rest.length > 0) {
+                throw new CliUsageError(`unexpected analyst argument: ${rest[0]}`);
+            }
+        },
+    });
     const counts = new Map();
     for (const [id, values] of valueLists) {
         counts.set(id, values.length);