@akagilnc/pi-workflow-roles 0.1.5015 → 0.1.5037

package/dist/public-cli/main.js

@@ -15831,7 +15831,7 @@ var init_packaged_role_registry = __esm({
         activationStage: "load-and-install",
         receiptStatusKey: "status",
         // #924: 公用《票面法》三席同装
-        sessionMaterials: ["CLAUDE.md", "souls/countersign.md", "souls/ticket-law.md"]
+        sessionMaterials: ["CLAUDE.md", "souls/countersign.md", "souls/ticket-law.md", "resources/countersign-ticket-issue.md"]
       },
       {
         role: "secretariat",
@@ -15839,7 +15839,7 @@ var init_packaged_role_registry = __esm({
         presentSettled: "always",
         summonResume: false,
         admission: "instruction",
-        sameParent: "court-diarist",
+        sameParent: "none",
         phases: [null],
         outputTool: SECRETARIAT_OUTPUT_TOOL_NAME,
         settlement: "accepted",
@@ -15855,6 +15855,7 @@ var init_packaged_role_registry = __esm({
           "CLAUDE.md",
           "souls/secretariat.md",
           "souls/ticket-law.md",
+          "resources/secretariat-ticket-identity.md",
           "souls/countersign.md",
           "souls/notary.md"
         ]
@@ -18895,6 +18896,22 @@ async function clearTypedProviderHttpObservation(runDirectory) {
     throw error;
   }
 }
+async function recordTypedProviderHttpStatus(runDirectory, observation) {
+  if (observation.httpStatus >= 200 && observation.httpStatus < 300) {
+    await clearTypedProviderHttpObservation(runDirectory);
+    return;
+  }
+  const body = {
+    httpStatus: observation.httpStatus,
+    provider: observation.provider
+  };
+  await writeFile2(
+    typedProviderHttpPath(runDirectory),
+    `${JSON.stringify(body)}
+`,
+    "utf8"
+  );
+}
 async function readLatestTypedProviderHttpObservation(runDirectory) {
   let text;
   try {
@@ -18927,6 +18944,41 @@ var init_typed_provider_http = __esm({
 });
 
 // src/public-cli/run-lifecycle.ts
+var run_lifecycle_exports = {};
+__export(run_lifecycle_exports, {
+  AUTO_RESUME_LIMIT: () => AUTO_RESUME_LIMIT,
+  GATE_DOSSIER_POINTER_PREFIX: () => GATE_DOSSIER_POINTER_PREFIX,
+  RESUME_TRANSPORT_ENVELOPE: () => RESUME_TRANSPORT_ENVELOPE,
+  RunWriterLeaseHeldError: () => RunWriterLeaseHeldError,
+  V1_RESUMABLE_PROVIDERS: () => V1_RESUMABLE_PROVIDERS,
+  acquireRunWriterLease: () => acquireRunWriterLease,
+  autopsyWriterLock: () => autopsyWriterLock,
+  buildAutoResumeContinuationPrompt: () => buildAutoResumeContinuationPrompt,
+  clearCurrentCourt: () => clearCurrentCourt,
+  clearTypedProviderHttpObservation: () => clearTypedProviderHttpObservation,
+  describeErrorIdentity: () => describeErrorIdentity,
+  findLatestRunIdForSeatTicket: () => findLatestRunIdForSeatTicket,
+  findRunDirectoryById: () => findRunDirectoryById,
+  isDurablePrincipalAvailable: () => isDurablePrincipalAvailable,
+  isV1ResumableProvider: () => isV1ResumableProvider,
+  loadResumablePublicRole: () => loadResumablePublicRole,
+  markRunAdmitted: () => markRunAdmitted,
+  markRunResumable: () => markRunResumable,
+  markRunRunning: () => markRunRunning,
+  markRunTerminal: () => markRunTerminal,
+  parentRunPathFromGatePointerInstruction: () => parentRunPathFromGatePointerInstruction,
+  peekRoleRunRole: () => peekRoleRunRole,
+  readCurrentCourt: () => readCurrentCourt,
+  readLatestTypedProviderHttpObservation: () => readLatestTypedProviderHttpObservation,
+  readRoleRunIdentity: () => readRoleRunIdentity,
+  readRoleRunState: () => readRoleRunState,
+  readRunParentPath: () => readRunParentPath,
+  readTypedHttp429Observation: () => readTypedHttp429Observation,
+  recordCurrentCourt: () => recordCurrentCourt,
+  recordTypedProviderHttpStatus: () => recordTypedProviderHttpStatus,
+  renderResumeCommand: () => renderResumeCommand,
+  writeRoleRunState: () => writeRoleRunState
+});
 import { chmod, lstat as lstat2, open, readdir as readdir4, readFile as readFile12, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
 import { basename as basename6, join as join15 } from "node:path";
 function buildAutoResumeContinuationPrompt(options) {
@@ -19127,6 +19179,11 @@ function materializeRoleRunFromDisk(disk, authority) {
     return void 0;
   }
 }
+async function readRoleRunState(runDirectory, authority) {
+  const disk = await readRoleRunStateDisk(runDirectory);
+  if (disk === void 0) return void 0;
+  return materializeRoleRunFromDisk(disk, authority)?.run;
+}
 async function readRoleRunIdentity(runDirectory) {
   const raw = await readRoleRunStateRaw(runDirectory);
   return raw === void 0 ? void 0 : parseRoleRunIdentity(raw, runDirectory);
@@ -19510,7 +19567,7 @@ async function findLatestRunIdForSeatTicket(input) {
     const runId = entry.slice(0, entry.length - suffix.length);
     if (runId.length === 0) continue;
     const parentPath = await readRunParentPath(runDirectory);
-    if (parentPath !== input.parentRunPath) continue;
+    if (parentPath !== input.parentRunPath && basename6(parentPath ?? "") !== basename6(input.parentRunPath)) continue;
     if (!await runHasFormedSessionPrincipal(runDirectory)) continue;
     if (best === void 0 || runId > best) best = runId;
   }
@@ -19572,7 +19629,7 @@ function restoredTicketFields(fields) {
     ...fields.courtTicketNumbers === void 0 ? {} : { courtTicketNumbers: fields.courtTicketNumbers }
   };
 }
-async function loadResumableRunRecord(home, runId, authority) {
+async function loadResumableRunRecord(home, runId, authority, allowUnformedAdmitted = false) {
   const runDirectory = await findRunDirectoryById(home, runId);
   if (runDirectory === void 0) {
     throw new CliUsageError(`unknown role run id: ${runId}`);
@@ -19586,7 +19643,7 @@ async function loadResumableRunRecord(home, runId, authority) {
     throw new CliUsageError(`unknown role run id: ${runId}`);
   }
   const { run, principal } = materialized;
-  if (!await isDurablePrincipalAvailable(principal, authority)) {
+  if (!(allowUnformedAdmitted && run.state === "admitted") && !await isDurablePrincipalAvailable(principal, authority)) {
     throw new CliUsageError(
       `role run Pi session principal is unavailable: ${runId}`
     );
@@ -19867,8 +19924,8 @@ async function peekRoleRunRole(home, runId) {
   const run = await readRoleRunIdentity(runDirectory);
   return run?.role;
 }
-async function loadResumablePublicRole(home, runId, authority) {
-  const loaded = await loadResumableRunRecord(home, runId, authority);
+async function loadResumablePublicRole(home, runId, authority, allowUnformedAdmitted = false) {
+  const loaded = await loadResumableRunRecord(home, runId, authority, allowUnformedAdmitted);
   return seatLoadedResult(loaded, admitResumedRole(loaded));
 }
 function admitResumedRole(loaded) {
@@ -21448,12 +21505,7 @@ async function persistAdmittedSourceRunPath(admitted, sourceRunPath) {
   );
 }
 async function bindAdmittedTicketNumber(admitted, ticketNumber) {
-  if (admitted.ticketNumber !== void 0) {
-    if (admitted.ticketNumber === ticketNumber) return;
-    throw new Error(
-      `bindAdmittedTicketNumber refuses to replace existing ticket #${admitted.ticketNumber} with #${ticketNumber}`
-    );
-  }
+  if (admitted.ticketNumber === ticketNumber) return;
   await bindTicketNumberOnRunDirectory(admitted.runDirectory, ticketNumber);
   admitted.ticketNumber = ticketNumber;
 }
@@ -21537,6 +21589,7 @@ async function relocateAdmittedRunToTicket(admitted, authority, heldLease) {
     for (const childRunId of Array.isArray(childRunIds) ? childRunIds : []) {
       if (typeof childRunId !== "string") continue;
       const childDirectory = join17(dirname11(oldRunDirectory), `${childRunId}@diarist`);
+      if (!existsSync5(childDirectory)) continue;
       const childTarget = roleRunPlacement(ledgerHome, {
         bookKey: admitted.bookKey,
         subject: { ticketNumber: admitted.ticketNumber },
@@ -21544,7 +21597,6 @@ async function relocateAdmittedRunToTicket(admitted, authority, heldLease) {
         role: "diarist"
       });
       authority.seal(childTarget);
-      if (!existsSync5(childDirectory) && existsSync5(childTarget.runDirectory)) continue;
       await bindTicketNumberOnRunDirectory(childDirectory, admitted.ticketNumber);
       await rehomeUnboundTicketProvenance(childDirectory, admitted.ticketNumber, admitted.projectRoot, homeFromRunDirectory(oldRunDirectory));
       ensureRoleRunDirectory(ledgerHome, dirname11(childTarget.runDirectory));
@@ -21594,25 +21646,8 @@ async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
     "bindTicketNumberOnRunDirectory"
   );
   const admittedPath = join17(runDirectory, "admitted-request.json");
-  const invocationPath = join17(runDirectory, "invocation.json");
   const admitted = JSON.parse(await readFile13(admittedPath, "utf8"));
-  const existing = admitted.ticketNumber;
-  if (typeof existing === "number") {
-    if (existing === ticketNumber) return;
-    throw new Error(
-      `bindTicketNumberOnRunDirectory refuses to replace existing ticket #${existing} with #${ticketNumber}`
-    );
-  }
-  if (existsSync5(invocationPath)) {
-    const invocation = JSON.parse(
-      await readFile13(invocationPath, "utf8")
-    );
-    if (typeof invocation.ticketNumber === "number" && invocation.ticketNumber !== ticketNumber) {
-      throw new Error(
-        `bindTicketNumberOnRunDirectory refuses to replace invocation ticket #${invocation.ticketNumber} with #${ticketNumber}`
-      );
-    }
-  }
+  if (admitted.ticketNumber === ticketNumber) return;
   await writeFile4(
     admittedPath,
     `${JSON.stringify({ ...admitted, ticketNumber }, null, 2)}
@@ -27121,8 +27156,9 @@ function withOnceSuccessfulBeforeDispatch(adapters) {
     ...adapters,
     beforeDispatch: async (admitted, lease) => {
       if (succeeded) return;
-      await hook(admitted, lease);
+      const result = await hook(admitted, lease);
       succeeded = true;
+      return result;
     }
   };
 }
@@ -27384,7 +27420,10 @@ async function dispatchPostAdmissionTurn(input) {
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     if (adapters.beforeDispatch !== void 0) {
       try {
-        await adapters.beforeDispatch(admitted, lease);
+        const paused = await adapters.beforeDispatch(admitted, lease);
+        if (paused !== void 0) {
+          return { exitCode: 0, admitted, terminal: paused, skipAutoResume: true };
+        }
       } catch (error) {
         const settled2 = await presentControlledFailure2(
           admitted,
@@ -28438,7 +28477,10 @@ async function summonPublicRole(options) {
     result = stepped.ok;
   }
   const stderr = captured?.stderrText();
-  const runDirectory = result.admitted?.runDirectory;
+  const runDirectory = result.terminal !== void 0 && result.terminal.roleOutcome.role !== options.role && typeof result.terminal.runId === "string" ? await (await Promise.resolve().then(() => (init_run_lifecycle(), run_lifecycle_exports))).findRunDirectoryById(
+    home,
+    result.terminal.runId
+  ) : result.admitted?.runDirectory;
   return {
     exitCode: result.exitCode,
     ...result.terminal === void 0 ? {} : { terminal: result.terminal },
@@ -28642,8 +28684,10 @@ async function summonGateOfficer(options) {
         `countersign gate summon requires parent runId from sourceRunDirectory: ${options.sourceRunDirectory}`
       );
     }
-    const { readBoardTicketNumber: readBoardTicketNumber2 } = await Promise.resolve().then(() => (init_run_ticket_number(), run_ticket_number_exports));
+    const { isSafePositiveTicketNumber: isSafePositiveTicketNumber2, readBoardTicketNumber: readBoardTicketNumber2 } = await Promise.resolve().then(() => (init_run_ticket_number(), run_ticket_number_exports));
     const parentTicket = await readBoardTicketNumber2(options.sourceRunDirectory);
+    const submittedTicket = options.submission !== null && typeof options.submission === "object" && !Array.isArray(options.submission) ? options.submission.ticketNumber : void 0;
+    const courtTicket = isSafePositiveTicketNumber2(submittedTicket) ? submittedTicket : parentTicket;
     const instruction = options.reask ?? gateReviewInstruction ?? "";
     return summonPublicRole({
       role: options.officer,
@@ -28651,7 +28695,7 @@ async function summonGateOfficer(options) {
       ...common,
       correlationId,
       parentRunPath: options.sourceRunDirectory,
-      ...parentTicket === void 0 ? {} : { boundTicketNumber: parentTicket }
+      ...courtTicket === void 0 ? {} : { boundTicketNumber: courtTicket }
     });
   }
   return summonPublicRole({
@@ -28671,11 +28715,6 @@ var init_public_role_summons = __esm({
 });
 
 // src/public-cli/countersign-run.ts
-var countersign_run_exports = {};
-__export(countersign_run_exports, {
-  invokeCourtDiarist: () => invokeCourtDiarist,
-  runCountersignCourtDiaristStation: () => runCountersignCourtDiaristStation
-});
 function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -28775,7 +28814,8 @@ async function invokeCourtDiarist(input, env, io) {
         kind: "escalate",
         diagnostic: courtDiaristEscalateDiagnostic(roleOutcome, submissions)
       },
-      ...result.admitted === void 0 ? {} : { admitted: result.admitted }
+      ...result.admitted === void 0 ? {} : { admitted: result.admitted },
+      ...result.terminal === void 0 ? {} : { terminal: result.terminal }
     };
   }
   if (result.exitCode !== 0) {
@@ -28809,7 +28849,7 @@ async function invokeCourtDiarist(input, env, io) {
     ...result.admitted === void 0 ? {} : { admitted: result.admitted }
   };
 }
-async function runCountersignCourtDiaristStation(admitted, env, io) {
+async function runCountersignCourtDiaristStation(admitted, env, io, afterTicketNumber) {
   if (env.runCourtDiaristStation !== void 0) {
     await env.runCourtDiaristStation(admitted);
     return;
@@ -28826,7 +28866,8 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
   } else {
     refreshTickets = [admitted.ticketNumber];
   }
-  for (const ticketNumber of refreshTickets) {
+  const completedIndex = afterTicketNumber === void 0 ? -1 : refreshTickets.indexOf(afterTicketNumber);
+  for (const ticketNumber of refreshTickets.slice(completedIndex + 1)) {
     const outcome = await invokeCourtDiarist(
       {
         instruction: `\u6574\u7406 #${ticketNumber} \u7684\u672C\u6848\u4F9D\u636E\u3002`,
@@ -28839,14 +28880,17 @@ async function runCountersignCourtDiaristStation(admitted, env, io) {
       env,
       io
     );
-    if (outcome.identity.kind === "escalate") {
-      throw new StationChildExhaustedError(outcome.identity.diagnostic);
-    }
     if (outcome.failedWithoutEscalate !== void 0) {
       throw new StationChildExhaustedError(
         outcome.failedWithoutEscalate.diagnostic
       );
     }
+    if (outcome.identity.kind === "escalate" && outcome.terminal !== void 0) {
+      return {
+        terminal: outcome.terminal,
+        ...outcome.admitted === void 0 ? {} : { childRunId: outcome.admitted.runId }
+      };
+    }
   }
 }
 var init_countersign_run = __esm({
@@ -28863,6 +28907,7 @@ var init_countersign_run = __esm({
 var instruction_seat_run_exports = {};
 __export(instruction_seat_run_exports, {
   buildInstructionSeatTurnRequest: () => buildInstructionSeatTurnRequest,
+  continueParentAfterChild: () => continueParentAfterChild,
   runPublicInstructionSeat: () => runPublicInstructionSeat,
   runPublicInstructionSeatResume: () => runPublicInstructionSeatResume
 });
@@ -29088,7 +29133,7 @@ async function runCountersignBody(parsed, env, io) {
       projectRoot: resolve10(parsed.project ?? env.cwd),
       role: "countersign",
       parentRunPath: gateParentRunPath,
-      ...env.boundTicketNumber === void 0 ? {} : { ticketNumber: env.boundTicketNumber },
+      ...isSafePositiveTicketNumber(env.boundTicketNumber) ? { ticketNumber: env.boundTicketNumber } : {},
       freshSummons: env.freshSummons,
       summons: {
         sourceRunPath: gateParentRunPath,
@@ -29125,14 +29170,16 @@ async function runCountersignBody(parsed, env, io) {
       let typedTicket;
       let typedCourtTicketNumbers;
       let identityDiaristRan = false;
-      let unboundDiaristRunId;
-      if (env.runCourtDiaristStation === void 0) {
+      let childDiaristRunId;
+      let pausedDiaristTerminal;
+      if (gateParentRunPath === void 0 && env.runCourtDiaristStation === void 0) {
         let outcome;
         try {
           outcome = await invokeCourtDiarist({
             instruction: parsed.instruction ?? "",
             projectRoot: admitted.projectRoot,
             failureLabel: "unbound summons",
+            correlationId: admitted.runId,
             ...env.boundTicketNumber === void 0 ? {} : { boundTicketNumber: env.boundTicketNumber }
           }, env, io);
         } catch (error) {
@@ -29148,15 +29195,16 @@ async function runCountersignBody(parsed, env, io) {
           }, seatAdapters(admitted, env), env.principalAuthority, io);
         }
         identityDiaristRan = true;
+        if (outcome.identity.kind === "escalate") pausedDiaristTerminal = outcome.terminal;
         if (outcome.admitted?.runDirectory.includes(`${sep5}unbound${sep5}runs${sep5}`)) {
-          unboundDiaristRunId = outcome.admitted.runId;
+          childDiaristRunId = outcome.admitted.runId;
         }
-        if (outcome.identity.kind === "escalate" || outcome.failedWithoutEscalate !== void 0) {
-          const diagnostic = outcome.identity.kind === "escalate" ? outcome.identity.diagnostic : outcome.failedWithoutEscalate?.diagnostic ?? "";
+        if (outcome.failedWithoutEscalate !== void 0) {
+          const diagnostic = outcome.failedWithoutEscalate.diagnostic;
           await materializeAdmission(
             isSafePositiveTicketNumber(env.boundTicketNumber) ? env.boundTicketNumber : void 0
           );
-          if (unboundDiaristRunId !== void 0) await recordChildDiaristRun(admitted, unboundDiaristRunId);
+          if (childDiaristRunId !== void 0) await recordChildDiaristRun(admitted, childDiaristRunId);
           await markRunAdmitted(admitted, env.principalAuthority);
           return await presentControlledFailure2(admitted, {
             timedOut: false,
@@ -29166,16 +29214,18 @@ async function runCountersignBody(parsed, env, io) {
           }, seatAdapters(admitted, env), env.principalAuthority, io);
         }
         if (outcome.identity.kind === "ticket") {
-          typedTicket = isSafePositiveTicketNumber(env.boundTicketNumber) ? env.boundTicketNumber : outcome.identity.ticketNumber;
+          typedTicket = outcome.identity.ticketNumber;
           typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
-        } else if (isSafePositiveTicketNumber(env.boundTicketNumber)) {
-          typedTicket = env.boundTicketNumber;
         }
       }
       await materializeAdmission(typedTicket);
       await markRunAdmitted(admitted, env.principalAuthority);
-      if (unboundDiaristRunId !== void 0) {
-        await recordChildDiaristRun(admitted, unboundDiaristRunId);
+      if (childDiaristRunId !== void 0) {
+        await recordChildDiaristRun(admitted, childDiaristRunId);
+      }
+      if (pausedDiaristTerminal !== void 0) {
+        io.stdout(formatTerminalResult(pausedDiaristTerminal));
+        return { exitCode: 0, admitted, terminal: pausedDiaristTerminal };
       }
       if (gateParentRunPath !== void 0) {
         await persistAdmittedSourceRunPath(admitted, gateParentRunPath);
@@ -29225,7 +29275,11 @@ async function runCountersignBody(parsed, env, io) {
           beforeDispatch: async (admittedSeat, lease) => {
             if (!packagedAdmitsCountersign(admittedSeat.role)) return;
             if (!identityDiaristRan || typedTicket !== void 0) {
-              await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              const refresh = await runCountersignCourtDiaristStation(admittedSeat, env, io);
+              if (refresh !== void 0) {
+                io.stdout(formatTerminalResult(refresh.terminal));
+                return refresh.terminal;
+              }
             }
             await relocateAdmittedRunToTicket(admittedSeat, env.principalAuthority, lease);
             Object.assign(turnRequest, buildInstructionSeatTurnRequest(admittedSeat, turnProjection));
@@ -29302,7 +29356,6 @@ async function runPublicInstructionSeat(argv2, env, io, role, parseArgv2) {
         projectRoot,
         role,
         parentRunPath: sourceDirectory,
-        ...auditorTicket === void 0 ? {} : { ticketNumber: auditorTicket },
         freshSummons: env.freshSummons,
         summons,
         resume: (runId, materials) => runPublicInstructionSeatResume(
@@ -29328,7 +29381,6 @@ async function runPublicInstructionSeat(argv2, env, io, role, parseArgv2) {
         projectRoot,
         role,
         parentRunPath,
-        ...env.boundTicketNumber === void 0 ? {} : { ticketNumber: env.boundTicketNumber },
         freshSummons: env.freshSummons,
         summons,
         resume: (runId, materials) => runPublicInstructionSeatResume(
@@ -29356,7 +29408,6 @@ async function runPublicInstructionSeat(argv2, env, io, role, parseArgv2) {
       throw error;
     }
     const resumeInstruction = env.reviewReask ?? env.gateReviewInstruction;
-    const knownTicket = await readBoardTicketNumber(source.runDirectory) ?? env.boundTicketNumber;
     const summons = {
       sourceRunPath: source.runDirectory,
       sourceRun: source,
@@ -29367,7 +29418,6 @@ async function runPublicInstructionSeat(argv2, env, io, role, parseArgv2) {
       projectRoot,
       role,
       parentRunPath: source.runDirectory,
-      ...knownTicket === void 0 ? {} : { ticketNumber: knownTicket },
       freshSummons: env.freshSummons,
       summons,
       resume: (runId, materials) => runPublicInstructionSeatResume(
@@ -29404,50 +29454,38 @@ async function runPublicInstructionSeat(argv2, env, io, role, parseArgv2) {
   }
   const runAdmitted = async () => {
     await markRunAdmitted(admitted, env.principalAuthority);
-    if (record4.sameParent === "court-diarist") {
-      const { invokeCourtDiarist: invokeCourtDiarist2 } = await Promise.resolve().then(() => (init_countersign_run(), countersign_run_exports));
-      const outcome = await invokeCourtDiarist2({
-        instruction: parsed.instruction ?? "",
-        projectRoot: admitted.projectRoot,
-        failureLabel: "secretariat unbound summons",
-        attachmentPaths: admitted.attachments.map((attachment) => attachment.frozenPath),
-        correlationId: admitted.runId
-      }, {
-        cwd: env.cwd,
-        home: env.home,
-        agentDir: env.agentDir,
-        packageRoot: env.packageRoot,
-        ...env.credentials === void 0 ? {} : { credentials: env.credentials },
-        ...env.signal === void 0 ? {} : { signal: env.signal },
-        ...env.hostAdapters === void 0 ? {} : { hostAdapters: env.hostAdapters }
-      }, io);
+    if (role === "secretariat") {
+      let outcome;
+      try {
+        outcome = await invokeCourtDiarist({
+          instruction: parsed.instruction ?? "",
+          projectRoot: admitted.projectRoot,
+          failureLabel: "secretariat unbound summons",
+          attachmentPaths: admitted.attachments.map((attachment) => attachment.frozenPath),
+          correlationId: admitted.runId
+        }, env, io);
+      } catch (error) {
+        return await presentControlledFailure2(admitted, {
+          timedOut: false,
+          code: null,
+          stderr: "",
+          thrown: error
+        }, seatAdapters(admitted, env), env.principalAuthority, io);
+      }
       if (outcome.admitted?.runDirectory.includes(`${sep5}unbound${sep5}runs${sep5}`)) {
         await recordChildDiaristRun(admitted, outcome.admitted.runId);
       }
-      if (outcome.identity.kind === "escalate" || outcome.failedWithoutEscalate !== void 0) {
-        const diagnostic = outcome.identity.kind === "escalate" ? outcome.identity.diagnostic : outcome.failedWithoutEscalate?.diagnostic ?? "";
+      if (outcome.failedWithoutEscalate !== void 0) {
         return await presentControlledFailure2(admitted, {
           timedOut: false,
           code: null,
           stderr: "",
-          thrown: new Error(diagnostic)
+          thrown: new Error(outcome.failedWithoutEscalate.diagnostic)
         }, seatAdapters(admitted, env), env.principalAuthority, io);
       }
-      if (outcome.identity.kind === "ticket") {
-        try {
-          if (outcome.admitted === void 0) throw new Error("court diarist ticket has no admitted run");
-          await bindAdmittedTicketNumber(outcome.admitted, outcome.identity.ticketNumber);
-          await relocateAdmittedRunToTicket(outcome.admitted, env.principalAuthority);
-          await bindAdmittedTicketNumber(admitted, outcome.identity.ticketNumber);
-          await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
-        } catch (error) {
-          return await presentControlledFailure2(admitted, {
-            timedOut: false,
-            code: null,
-            stderr: "",
-            thrown: error
-          }, seatAdapters(admitted, env), env.principalAuthority, io);
-        }
+      if (outcome.identity.kind === "escalate" && outcome.terminal !== void 0) {
+        io.stdout(formatTerminalResult(outcome.terminal));
+        return { exitCode: 0, admitted, terminal: outcome.terminal };
       }
     }
     return dispatchAdmitted(admitted, env, io);
@@ -29511,6 +29549,21 @@ async function runPublicInstructionSeatResume(request, env, io) {
     ...env.engine === void 0 ? {} : { effectiveEngine: env.engine }
   });
 }
+async function continueParentAfterChild(parentRunId, child, env, io) {
+  const loaded = await loadResumablePublicRole(env.home, parentRunId, env.principalAuthority, true);
+  if (loaded.run.state !== "admitted") {
+    return runPublicInstructionSeatResume({ runId: parentRunId }, env, io);
+  }
+  const admitted = loaded.admitted;
+  if (admitted.role === "countersign" && admitted.ticketNumber !== void 0) {
+    const refresh = await runCountersignCourtDiaristStation(admitted, env, io, child.ticketNumber);
+    if (refresh !== void 0) {
+      io.stdout(formatTerminalResult(refresh.terminal));
+      return { exitCode: 0, admitted, terminal: refresh.terminal };
+    }
+  }
+  return dispatchAdmitted(admitted, env, io);
+}
 var init_instruction_seat_run = __esm({
   "src/public-cli/instruction-seat-run.ts"() {
     "use strict";
@@ -32470,7 +32523,24 @@ async function runAkRole(argv2, env) {
         }),
         io
       );
-      return cliResultFromRoleRun(result);
+      let current = result;
+      while (current.exitCode === 0 && current.admitted?.correlationId !== void 0 && current.terminal?.roleOutcome.kind === "accepted" && !courtDiaristEscalated(current.terminal.roleOutcome)) {
+        const parentRunId = current.admitted.correlationId;
+        const parentRole = await peekRoleRunRole(home, parentRunId);
+        if (parentRole === void 0) break;
+        const parentSeat = resolveEffectiveSeat(config, parentRole, credentials, invocationFromParsed(parsed));
+        const parentEnv = createRoleEnvironment(env, {
+          role: parentRole,
+          home,
+          agentDir,
+          cwd,
+          credentials,
+          seat: parentSeat,
+          config
+        });
+        current = await continueParentAfterChild(parentRunId, current.admitted, parentEnv, io);
+      }
+      return cliResultFromRoleRun(current);
     }
     if (parsed.command !== void 0 && isPublicCliSupportCommand(parsed.command)) {
       throw new CliUsageError(`unhandled support command: ${parsed.command}`);
@@ -32539,6 +32609,7 @@ var init_cli = __esm({
     init_invocation();
     init_option_definitions();
     init_instruction_seat_run();
+    init_countersign_run();
     init_analyst_run();
     init_run_lifecycle();
     init_registry2();

package/dist/public-cli/post-admission.js

@@ -104,8 +104,9 @@ function withOnceSuccessfulBeforeDispatch(adapters) {
         beforeDispatch: async (admitted, lease) => {
             if (succeeded)
                 return;
-            await hook(admitted, lease);
+            const result = await hook(admitted, lease);
             succeeded = true;
+            return result;
         },
     };
 }
@@ -333,9 +334,8 @@ export async function dispatchPostAdmissionTurn(input) {
             };
         }
         try {
-            // #858: an unbound seat may assert its ticket on the existing receipt.
-            // Read the original accepted payload; do not rewrite it, infer from prose,
-            // or reject missing/malformed declarations. An existing binding wins.
+            // #858: the first typed assertion files an unbound run. Later receipts
+            // remain untouched; this seam does not adjudicate a ticket change.
             if (admitted.ticketNumber === undefined) {
                 const rows = await readRecordedSubmissionRows(admitted.projectRoot, admitted.runId, { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join(admitted.runDirectory, "session", "session.jsonl") });
                 const asserted = rows
@@ -429,7 +429,10 @@ export async function dispatchPostAdmissionTurn(input) {
         // (#840 父子不层叠).
         if (adapters.beforeDispatch !== undefined) {
             try {
-                await adapters.beforeDispatch(admitted, lease);
+                const paused = await adapters.beforeDispatch(admitted, lease);
+                if (paused !== undefined) {
+                    return { exitCode: 0, admitted, terminal: paused, skipAutoResume: true };
+                }
             }
             catch (error) {
                 const settled = (await presentControlledFailure(admitted, withEngineDetourInvocationScope({

package/dist/public-cli/run-lifecycle.js

@@ -816,11 +816,10 @@ async function runHasFormedSessionPrincipal(runDirectory) {
 /**
  * Locate the latest retained run for one seat under a book (#637 / #747).
  * Same walk surface as findRunDirectoryById (listBookRunDirectories). Match by
- * parent run path (officer / gate seats, #747 / #987). A typed ticket number
- * does not select a run. runId is UUIDv7 — lexicographic max is latest among
- * runs that formed a session principal. No parallel index. Public ticket-number
- * selection of a prior run was deleted (#987 Result 7); callers use explicit
- * `ak-role resume <runId>`.
+ * parent run path (officer / gate seats, #747 / #987), narrowed to a supplied
+ * typed ticket for same-ticket gate re-summons. runId is UUIDv7 — lexicographic
+ * max is latest among runs that formed a session principal. No parallel index;
+ * callers can use explicit `ak-role resume <runId>`.
  * Only a truly missing book directory means no history; damage/permission errors propagate.
  */
 export async function findLatestRunIdForSeatTicket(input) {
@@ -831,11 +830,7 @@ export async function findLatestRunIdForSeatTicket(input) {
     const bookDir = activationBookDirectory(ledgerHome, input.bookKey);
     let runDirectories;
     try {
-        // A typed ticket narrows the existing walk surface to that ticket's runs;
-        // same-parent matching below still selects the actual prior leg.
-        runDirectories = await listBookRunDirectories(input.ticketNumber === undefined
-            ? bookDir
-            : join(bookDir, String(input.ticketNumber)));
+        runDirectories = await listBookRunDirectories(input.ticketNumber === undefined ? bookDir : join(bookDir, String(input.ticketNumber)));
     }
     catch (error) {
         if (errorCodeOf(error) === "ENOENT")
@@ -852,7 +847,9 @@ export async function findLatestRunIdForSeatTicket(input) {
         if (runId.length === 0)
             continue;
         const parentPath = await readRunParentPath(runDirectory);
-        if (parentPath !== input.parentRunPath)
+        // The parent's ticket can change after this child was admitted. Within one
+        // book the run leaf is its stable identity; directory placement is not.
+        if (parentPath !== input.parentRunPath && basename(parentPath ?? "") !== basename(input.parentRunPath))
             continue;
         // Durable fact: never resume-select a provisional that never formed principal.
         if (!(await runHasFormedSessionPrincipal(runDirectory)))
@@ -935,7 +932,7 @@ function restoredTicketFields(fields) {
             : { courtTicketNumbers: fields.courtTicketNumbers }),
     };
 }
-async function loadResumableRunRecord(home, runId, authority) {
+async function loadResumableRunRecord(home, runId, authority, allowUnformedAdmitted = false) {
     const runDirectory = await findRunDirectoryById(home, runId);
     if (runDirectory === undefined) {
         throw new CliUsageError(`unknown role run id: ${runId}`);
@@ -952,7 +949,7 @@ async function loadResumableRunRecord(home, runId, authority) {
         throw new CliUsageError(`unknown role run id: ${runId}`);
     }
     const { run, principal } = materialized;
-    if (!(await isDurablePrincipalAvailable(principal, authority))) {
+    if (!(allowUnformedAdmitted && run.state === "admitted") && !(await isDurablePrincipalAvailable(principal, authority))) {
         throw new CliUsageError(`role run Pi session principal is unavailable: ${runId}`);
     }
     // Reconstruct admitted identity from durable run record + admitted-request.json.
@@ -1271,8 +1268,8 @@ export async function peekRoleRunRole(home, runId) {
  * selects the existing restore checks. The stored native host session id is
  * read on the public explicit resume seam, not from this load.
  */
-export async function loadResumablePublicRole(home, runId, authority) {
-    const loaded = await loadResumableRunRecord(home, runId, authority);
+export async function loadResumablePublicRole(home, runId, authority, allowUnformedAdmitted = false) {
+    const loaded = await loadResumableRunRecord(home, runId, authority, allowUnformedAdmitted);
     return seatLoadedResult(loaded, admitResumedRole(loaded));
 }
 /**