@akagilnc/pi-workflow-roles 0.1.5066 → 0.1.5079

package/dist/review-submission.js

@@ -1,13 +1,24 @@
-/** One shared terminating receipt contract for review officers (#1028). */
+/** One shared terminating receipt contract for review officers (#1028 / #1055). */
 import { Type } from "typebox";
-import { openToolObject } from "./open-tool-schema.js";
 import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.js";
 export const REVIEW_SUBMISSION_OUTPUT_TOOL_NAME = "ak_submission_output";
-/** Open receipt: the queue reads only status; all other submitted fields ride unchanged. */
-export const reviewSubmissionSchema = withTerminatingOutputDeclarations(openToolObject(Type.Object({
-    status: Type.Optional(Type.Unknown({
-        description: "converged | continue | escalate — 非三态时请重读后重交，勿改标。",
-    })),
+/** Single schema copy of the review queue words. Runtime membership reads this set. */
+export const REVIEW_QUEUE_WORDS = ["converged", "continue", "escalate"];
+export const REVIEW_QUEUE_STATUSES = new Set(REVIEW_QUEUE_WORDS);
+/**
+ * One object root. Codex structured output rejects a root anyOf, and status
+ * stays a required three-state enum with no omitted-status failure branch.
+ * A review seat that can still submit records a real external-dependency
+ * failure as escalate plus the existing infrastructureFailure field.
+ */
+export const reviewSubmissionSchema = withTerminatingOutputDeclarations(Type.Object({
+    status: Type.Union([
+        Type.Literal(REVIEW_QUEUE_WORDS[0]),
+        Type.Literal(REVIEW_QUEUE_WORDS[1]),
+        Type.Literal(REVIEW_QUEUE_WORDS[2]),
+    ], {
+        description: "审核队列三态枚举，必填。审核席仍能交卷而完成审核所需的外部依赖发生真实基础设施失败时，status 取 escalate，细节写入 infrastructureFailure。不得省略 status，不得用另两个枚举值充当放行或封驳。包侧不因格式拒收。",
+    }),
     findings: Type.Optional(Type.Unknown({ description: "审核发现，原样留存" })),
     reason: Type.Optional(Type.Unknown({ description: "上呈理由" })),
     violations: Type.Optional(Type.Unknown({ description: "违规条目" })),
@@ -17,4 +28,4 @@ export const reviewSubmissionSchema = withTerminatingOutputDeclarations(openTool
     note: Type.Optional(Type.Unknown({ description: "裁决附注" })),
     evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
     decisionGate: Type.Optional(Type.Unknown({ description: "需人权威处置的问题与选项；可说明 question、options，原样留存" })),
-})));
+}, { additionalProperties: true }));

package/dist/submission-errors.js

@@ -50,6 +50,23 @@ export class WorkerUnfinishedReasonReminderError extends Error {
         this.name = "WorkerUnfinishedReasonReminderError";
     }
 }
+/**
+ * Host constraint missed a routing discriminator (#1055).
+ * Names live only in the submission schema. This notice carries the field and the received value.
+ */
+export function unreadableDiscriminatorNotice(field, received) {
+    if (received === undefined)
+        return `读不出 ${field}`;
+    return `读不出 ${field}：${readableGateItem(received)}`;
+}
+/** The received discriminator only — never the rest of the receipt. */
+export function receivedDiscriminator(receipt, field) {
+    if (receipt === null || typeof receipt !== "object" || Array.isArray(receipt))
+        return undefined;
+    if (!Object.hasOwn(receipt, field))
+        return undefined;
+    return receipt[field];
+}
 /**
  * Parent seat status unreadable for queueing (#753).
  * Correctable back to the parent itself — not a gate officer bounce, no officer field.

package/dist/submission-ledger.js

@@ -6,7 +6,8 @@ import { runIdFromRunDirectory } from "./run-terminal-artifacts.js";
 import { readSitianRecords, resolveSitianRecordPathInLedger, sitianReport } from "./sitian-facade.js";
 import { findRunDirectoryById } from "./public-cli/run-lifecycle.js";
 import { isCorrectableExecuteError } from "./submission-correctable-error.js";
-import { failOnInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.js";
+import { failOnInfrastructureFailureDeclaration, infrastructureFailureDiagnostic } from "./package-contracts/terminating-infrastructure.js";
+import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.js";
 /**
  * Admitted run identity for the ledger subject.
  * Prefer AK_ROLE_RUN_DIR via sole runDirectory→runId parser (public-CLI correlation);
@@ -480,11 +481,22 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                     });
                     let result;
                     try {
-                        failOnInfrastructureFailureDeclaration(params, {
-                            failInfrastructure(error, ctx) {
-                                failInfrastructure(error, ctx);
-                            },
-                        }, context, toolCallId, tool.bounceInfrastructureDeclaration);
+                        // A review escalate that carries the failure declaration is the
+                        // seat's own submission. Every other declaration stays on the
+                        // host-failure seam. Tool identity comes from the registry map.
+                        const reviewEscalate = tool.name === REVIEW_SUBMISSION_OUTPUT_TOOL_NAME
+                            && infrastructureFailureDiagnostic(params) !== undefined
+                            && params !== null
+                            && typeof params === "object"
+                            && !Array.isArray(params)
+                            && params.status === "escalate";
+                        if (!reviewEscalate) {
+                            failOnInfrastructureFailureDeclaration(params, {
+                                failInfrastructure(error, ctx) {
+                                    failInfrastructure(error, ctx);
+                                },
+                            }, context, toolCallId, tool.bounceInfrastructureDeclaration);
+                        }
                         result = await tool.execute(toolCallId, params, signal, update, context);
                     }
                     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5066",
+  "version": "0.1.5079",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/souls/countersign.md

@@ -22,11 +22,11 @@
 对于修复票，判断根因是什么、证据在哪；对于新功能设计票，判断设计是不是合理，是不是陛下想要的方向。以及因果链本身站不站得住。
 此步不成立即封驳，不必再走后三步。
 
-**三、相抵** 票面，相关票与在飞分支与法源有无抵触。
+**三、相抵** 票面，相关票与在飞分支与法源有无抵触。票面自相抵同为相抵。
 
 **四、缺失** 法源要求的，票面有没有漏：适用法只查两类：票面与某条 ADR 决定相抵的，和把某条决定留给别的票承接的，票面须写明该条与「由 #x 承接」；这两类之外的 ADR 没引不算缺失，不得为此封驳；验收面须覆盖票面每条主张；票面里每一条行为都须答得出《送庭前三问》第一问——由哪条接缝、哪条 run 担它：起、停、续、终、接各归谁没写的行为，即缺失；前置产物、决定、答复须在；承重主张的源头不存在、不支持、已过时，同为缺失。缺失列表在能力范围内一次扫完，尽量避免因缺失导致多轮往返。
 
-**五、擅加** 票面有没有超出法源的机制、约束、验收、术语。
+**五、擅加** 票面有没有超出法源的机制、约束、验收、术语。票面按类各定一套行为或文案的，就是在要分类机制；陛下没点名要的，上呈，附单一做法。
 
 各步取证按《审法·取证授权》：工具与方式不受限，读码、开卷、传召、下探针皆可；不得删除、覆写或移动 worktree 与临时目录之外的既存路径（《审法·取证边界》）。交付时候清理回原样
 

package/souls/ticket-law.md

@@ -4,7 +4,7 @@
 
 * 陛下要什么——先用一两句写出他真正要的结果；后附撑这个读法的原话，逐字，带 uuid；源卷没有 id 的，给起居录里的来源标识。他的质问——他在问这张票、这条约束凭什么存在——要用事实或法源答到他问的那个点上，不是答字面；答不到的票不送庭，上呈。没有原话的票，写它出自哪张父票（授权在父票的对话里，给 uuid），或现状违反了哪条法源。
 * 现象——现在看得见的错是什么；一个能复现、能开卷核的实例就够。新造的东西没有现象，写要造什么。
-* 目的——改完以后看得见的行为是什么。
+* 目的——改完以后看得见的行为是什么。一句；不按现象实例逐个定行为或文案，实例只作验收样本。
 * 怎么验——从真实入口走一遍，看见什么算对；覆盖票面每条主张。
 * 适用法——`docs/adr/...md` 路径，一行一条，不必复述其决定。只有本票与它某条决定相抵、或把某条决定留给别的票承接时，才在那一行写明是哪一条。
 

package/src/compliance-transport.ts

@@ -4,7 +4,8 @@ import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
 import type { HostContext } from "./host-contracts.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 import type { PublicSummonResult } from "./public-role-summons.ts";
-import { OFFICER_CONCLUSION_REASK } from "./gatekeeper-role.ts";
+import { officerConclusionReask } from "./gatekeeper-role.ts";
+import { receivedDiscriminator } from "./submission-errors.ts";
 import { coalesceSubmissionRows } from "./public-cli/terminal.ts";
 import { readableGateItem } from "./readable-gate-item.ts";
 
@@ -226,7 +227,7 @@ export async function runComplianceAudit(options: RunComplianceAuditOptions): Pr
     const summoned = await summon(subject, runDirectory, options.signal, reask, submission);
     const decision = await projectAuditorTerminal(summoned);
     if (decision.status === "received") {
-      reask = OFFICER_CONCLUSION_REASK;
+      reask = officerConclusionReask(receivedDiscriminator(decision.reply, "status"));
       continue;
     }
     return decision;

package/src/countersign-contracts.ts

@@ -5,7 +5,7 @@
  * is defaulted, rewritten, or dropped (ADR 0055).
  */
 
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 
 export const COUNTERSIGN_OUTPUT_TOOL_NAME = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 
@@ -37,7 +37,7 @@ export function validateRecordedCountersignOutput(verdict: unknown): Countersign
   if (typeof status !== "string") {
     throw new Error("Countersign verdict has no execution discriminator");
   }
-  if (["converged", "continue", "escalate"].includes(status)) {
+  if (REVIEW_QUEUE_STATUSES.has(status)) {
     return verdict as CountersignVerdict;
   }
   throw new Error("Countersign verdict has no execution discriminator");

package/src/countersign-role.ts

@@ -11,13 +11,9 @@ export type { CountersignVerdict };
 // #836 r16 class 1: fix/note/decisionGate are LLM/human-read narrative content —
 // no code branches on their length or nested presence. `status` alone is the
 // machine discriminator the queue reads.
-// #836 (2026-09-11 御批 / ADR 0003 Amendment): registered-to-provider closed
-// value domains reject an unknown status before the submission
-// ledger ever records it, defeating 读不出三态→resume 说话者本人. Kept open
-// (Type.Unknown) like every other gate-queue status field in this package
-// (notary/auditor/gatekeeper/navigator); src/role-runtime.ts:997-1025 still
-// classifies the recorded value and reasks the countersign itself when it
-// isn't one of the three states — code, not the transport, does that work.
+// #1055: the three-state field is an enum+required host generation constraint
+// on reviewSubmissionSchema. Package execute still does not reject; an unreadable
+// value reasks the countersign itself with the received value.
 /** 给事中票庭审读五问的交卷形状（ADR 0074）；形状指引，非 schema 闸。 */
 export const countersignVerdictSchema = reviewSubmissionSchema;
 export type CountersignVerdictParameters = import("./review-submission.ts").ReviewSubmission;

package/src/gatekeeper-role.ts

@@ -4,9 +4,9 @@ import type { HostContext } from "./host-contracts.ts";
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
 import { packagedGateStageLabel } from "./packaged-role-registry.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
-import { GatekeeperDecisionError } from "./submission-errors.ts";
+import { GatekeeperDecisionError, receivedDiscriminator, unreadableDiscriminatorNotice } from "./submission-errors.ts";
 import { INSPECTOR_OUTPUT_TOOL_NAME } from "./inspector-contracts.ts";
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 import {
   GATEKEEPER_OUTPUT_TOOL_NAME,
   gatekeeperDecisionSchema,
@@ -66,6 +66,8 @@ export type GatekeeperResult =
       readonly status: "needs_reask";
       readonly officer: GateOfficer;
       readonly receipt: unknown;
+      /** Discriminator the queue already read. Not written back onto the receipt. */
+      readonly receivedStatus?: unknown;
       readonly runId?: string;
     }
   | { readonly status: "no_receipt"; readonly stage: GateOfficer; readonly reason: string; readonly facts: NoReceiptLifecycleFacts }
@@ -210,12 +212,9 @@ function readRecord(value: unknown): Record<string, unknown> | undefined {
  * `fallbackStatus` is the terminal outcome.status when the receipt body has no status key
  * (keeps missing-args sentinel intact as the receipt).
  */
-/** Map the shared review verdict onto the gate queue words (#1028). */
+/** Map the shared review verdict onto the gate queue words (#1028 / #1055). */
 function reviewQueueStatus(status: string): string | undefined {
-  if (status === "converged") return "converged";
-  if (status === "continue") return "continue";
-  if (status === "escalate") return "escalate";
-  return undefined;
+  return REVIEW_QUEUE_STATUSES.has(status) ? status : undefined;
 }
 
 function projectOfficerDecision(
@@ -235,7 +234,7 @@ function projectOfficerDecision(
   if (queueStatus === "continue" || queueStatus === "escalate") {
     return { status: queueStatus, officer, receipt };
   }
-  return { status: "needs_reask", officer, receipt };
+  return { status: "needs_reask", officer, receipt, receivedStatus: status };
 }
 
 /**
@@ -371,12 +370,14 @@ function projectOfficerTerminal(
       summoned,
     );
   }
+  const receipt = thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome);
   return withOfficerRunId(
     {
       status: "needs_reask",
       officer,
       // This-court receipt only (#879).
-      receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
+      receipt,
+      receivedStatus: receivedDiscriminator(receipt, "status"),
     },
     summoned,
   );
@@ -391,16 +392,11 @@ export type GatekeeperProjection = {
 };
 
 /**
- * Plain-language re-ask when the officer conclusion is not converged|continue|escalate.
- * Not a packaged engine handbook line (#755 exception for 读不出三态).
- * Every review officer uses the same `status` field and three queue words (#1028).
+ * Officer conclusion was missing or not a queue word (#1055).
+ * `received` is the status value only, not the rest of the receipt.
  */
-export const OFFICER_CONCLUSION_REASK =
-  "上次交卷的 status 不是 converged、continue、escalate 三态之一。请重新输出，status 写明其一；continue 或 escalate 的话就是给对方看的原文。" as const;
-
-/** Pick the re-ask line for the officer under review. */
-export function officerConclusionReask(officer: GateOfficer): string {
-  return OFFICER_CONCLUSION_REASK;
+export function officerConclusionReask(received: unknown): string {
+  return unreadableDiscriminatorNotice("status", received);
 }
 
 /**

package/src/inspector-contracts.ts

@@ -4,7 +4,7 @@
  * Dual path: gate-dispatched and independently callable (#568 / ADR 0074).
  */
 
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 
 export const INSPECTOR_OUTPUT_TOOL_NAME: string = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 export const INSPECTOR_SOURCE_RUN_FLAG = {
@@ -30,7 +30,10 @@ export function validateRecordedInspectorOutput(value: unknown): InspectorOutput
   } catch {
     throw new Error("Inspector output has no execution discriminator");
   }
-  if (status === "converged" || status === "continue" || status === "escalate") {
+  if (typeof status !== "string") {
+    throw new Error("Inspector output has no execution discriminator");
+  }
+  if (REVIEW_QUEUE_STATUSES.has(status)) {
     return value as InspectorOutput;
   }
   throw new Error("Inspector output has no execution discriminator");

package/src/judge-role.ts

@@ -1,19 +1,15 @@
 import type { RoleHost, HostContext, HostToolResult, HostGatekeeperActions } from "./host-contracts.ts";
 import type { Static } from "typebox";
-import { reviewSubmissionSchema } from "./review-submission.ts";
-import { GatekeeperDecisionError, ParentQueueReaskError } from "./submission-errors.ts";
+import { REVIEW_QUEUE_STATUSES, reviewSubmissionSchema } from "./review-submission.ts";
+import { GatekeeperDecisionError, ParentQueueReaskError, unreadableDiscriminatorNotice } from "./submission-errors.ts";
 import { projectGatekeeperEscalation } from "./audit-escalation.ts";
 
 import { readableGateItem } from "./readable-gate-item.ts";
 import {
   JUDGE_OUTPUT_TOOL_NAME,
-  validateAcceptedJudgeDetails,
   type JudgeVerdict,
 } from "./package-contracts/judge-output.ts";
 
-const JUDGE_QUEUE_STATUSES = new Set(["converged", "continue", "escalate"]);
-const JUDGE_STATUS_REASK =
-  "status 不是 converged、continue、escalate 三态之一。请重新交卷，status 写明其一。" as const;
 
 export { JUDGE_OUTPUT_TOOL_NAME };
 export type { JudgeVerdict };
@@ -25,8 +21,6 @@ export type { JudgeVerdict };
 // The shared open schema preserves role-specific prose without adding another contract.
 export const judgeVerdictSchema = reviewSubmissionSchema;
 
-type JudgeVerdictParameters = Static<typeof judgeVerdictSchema>;
-
 export type JudgeRoleDependencies = {
   loadSoul(): Promise<string>;
 };
@@ -36,10 +30,6 @@ export type JudgeRoleHostActions = HostGatekeeperActions & {
   bindPriorGatePass(toolCallId: string, receipt: unknown): void;
 };
 
-export function validateVerdict(verdict: JudgeVerdictParameters): JudgeVerdict {
-  return validateAcceptedJudgeDetails(verdict);
-}
-
 
 export function createJudgeRoleRuntime(
   pi: RoleHost,
@@ -70,19 +60,21 @@ export function createJudgeRoleRuntime(
               && typeof (parameters as Record<string, unknown>).status === "string"
                 ? (parameters as Record<string, unknown>).status as string
                 : undefined;
-            if (rawStatus === undefined || !JUDGE_QUEUE_STATUSES.has(rawStatus)) {
-              throw new ParentQueueReaskError(JUDGE_STATUS_REASK);
+            if (rawStatus === undefined || !REVIEW_QUEUE_STATUSES.has(rawStatus)) {
+              const received = parameters !== null && typeof parameters === "object" && !Array.isArray(parameters)
+                ? (parameters as Record<string, unknown>).status
+                : undefined;
+              throw new ParentQueueReaskError(unreadableDiscriminatorNotice("status", received));
             }
             if (rawStatus === "escalate") {
               // Parent escalate → throw to caller as-is; officers do not attend (#753 / #756).
-              const verdict = validateVerdict(parameters);
               return {
                 content: [],
-                details: verdict,
+                details: parameters,
                 terminate: true as const,
               };
             }
-            const verdict = validateVerdict(parameters);
+            // Queue membership above is the only three-state check. The receipt is not re-judged.
             // Candidate verdict is already on the parent session books as this
             // tool-call leaf (first-record-then-audit; run 019fea05 L61/L62).
             // #753: 符宝郎内闸 — continue returns the raw receipt as a nonterminal tool result.
@@ -101,7 +93,7 @@ export function createJudgeRoleRuntime(
               if (draftPass?.status === "continue") {
                 return {
                   content: [{ type: "text" as const, text: readableGateItem(draftPass.receipt) }],
-                  details: verdict,
+                  details: parameters,
                   terminate: false,
                 };
               }
@@ -121,18 +113,18 @@ export function createJudgeRoleRuntime(
               if (compliancePass?.status === "continue") {
                 return {
                   content: [draftPass, compliancePass].filter((pass) => pass !== undefined).map((pass) => ({ type: "text" as const, text: readableGateItem(pass.receipt) })),
-                  details: verdict,
+                  details: parameters,
                   terminate: false,
                 };
               }
               return {
                 content: [draftPass, compliancePass].filter((pass) => pass !== undefined).map((pass) => ({ type: "text" as const, text: readableGateItem(pass.receipt) })),
-                details: verdict,
+                details: parameters,
                 terminate: true as const,
               };
             } catch (error) {
               if (error instanceof GatekeeperDecisionError && error.result.status === "escalate") {
-                return projectGatekeeperEscalation(error.result, verdict);
+                return projectGatekeeperEscalation(error.result, parameters);
               }
               throw error;
             }

package/src/open-tool-schema.ts

@@ -12,7 +12,7 @@ function declarationIdentity(schema: TSchema): string {
   return JSON.stringify(semantic);
 }
 
-/** Collapse transport variants into one provider-compatible, zero-required open object. */
+/** Collapse transport variants into one provider-compatible open object. Non-three-state tools stay zero-required. */
 export function openToolObjectFromUnion(schema: UnionSchema): TSchema {
   const declarations = new Map<string, TSchema[]>();
   for (const variant of schema.anyOf) {
@@ -35,10 +35,15 @@ export function openToolObjectFromUnion(schema: UnionSchema): TSchema {
   return object;
 }
 
-/** Open a pre-existing object transport schema without changing declarations. */
-export function openToolObject(schema: TSchema & { properties: Record<string, TSchema> }): TSchema {
+/** Open a pre-existing object transport schema. Every field stays optional. */
+export function openToolObject(
+  schema: TSchema & { properties: Record<string, TSchema> },
+): TSchema {
   const object = Type.Object(
-    Object.fromEntries(Object.entries(schema.properties).map(([name, declaration]) => [name, Type.Optional(described(name, declaration))])),
+    Object.fromEntries(Object.entries(schema.properties).map(([name, declaration]) => [
+      name,
+      Type.Optional(described(name, declaration)),
+    ])),
     { additionalProperties: true },
   );
   (object as unknown as { required: string[] }).required = [];

package/src/package-contracts/judge-output.ts

@@ -1,7 +1,7 @@
 /** Package-owned Judge output leaf — no role registration surface. */
 
 
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "../review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "../review-submission.ts";
 
 export const JUDGE_OUTPUT_TOOL_NAME: string = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 
@@ -39,9 +39,7 @@ export function validateAcceptedJudgeDetails(verdict: unknown): JudgeVerdict {
   if (typeof status !== "string") {
     throw new Error("Judge verdict has no execution discriminator");
   }
-  if (
-    ["converged", "continue", "escalate"].includes(status)
-  ) {
+  if (REVIEW_QUEUE_STATUSES.has(status)) {
     return verdict as JudgeVerdict;
   }
   throw new Error("Judge verdict has no execution discriminator");

package/src/package-contracts/terminating-infrastructure.ts

@@ -50,8 +50,9 @@ const infrastructureFailureDeclarationSchema = Type.Object(
 
 /**
  * Compose declarations shared by terminating output tools: infrastructure failure
- * and the optional role-asserted ticket identity. Returns an open object (additionalProperties: true,
- * required: []) with the base schema's properties plus the shared declaration.
+ * and the optional role-asserted ticket identity. Returns an open object (additionalProperties: true)
+ * with the base schema's properties plus the shared declaration. Incoming required
+ * keys that still exist are kept; every other key stays optional.
  * Static typing is preserved on the base (`as S`), so existing
  * `Static<typeof ...>` derived parameter types are unchanged.
  */
@@ -78,7 +79,11 @@ export function withTerminatingOutputDeclarations<
       ],
   };
   const object = Type.Object(properties, { additionalProperties: true });
-  (object as unknown as { required: string[] }).required = [];
+  const incoming = (schema as { required?: unknown }).required;
+  const preserved = Array.isArray(incoming)
+    ? incoming.filter((key): key is string => typeof key === "string" && Object.hasOwn(properties, key))
+    : [];
+  (object as unknown as { required: string[] }).required = preserved;
   return object as unknown as S;
 }
 
@@ -115,7 +120,7 @@ function isInfrastructureFailureDeclaration(
 }
 
 /** Non-empty trimmed diagnostic from the declaration, else undefined. */
-function infrastructureFailureDiagnostic(
+export function infrastructureFailureDiagnostic(
   parameters: unknown,
 ): string | undefined {
   if (!isInfrastructureFailureDeclaration(parameters)) return undefined;

package/src/review-submission.ts

@@ -1,18 +1,33 @@
-/** One shared terminating receipt contract for review officers (#1028). */
+/** One shared terminating receipt contract for review officers (#1028 / #1055). */
 import { Type } from "typebox";
 
-import { openToolObject } from "./open-tool-schema.ts";
 import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 
 export const REVIEW_SUBMISSION_OUTPUT_TOOL_NAME = "ak_submission_output" as const;
 
-/** Open receipt: the queue reads only status; all other submitted fields ride unchanged. */
+/** Single schema copy of the review queue words. Runtime membership reads this set. */
+export const REVIEW_QUEUE_WORDS = ["converged", "continue", "escalate"] as const;
+export type ReviewQueueWord = (typeof REVIEW_QUEUE_WORDS)[number];
+export const REVIEW_QUEUE_STATUSES: ReadonlySet<string> = new Set(REVIEW_QUEUE_WORDS);
+
+/**
+ * One object root. Codex structured output rejects a root anyOf, and status
+ * stays a required three-state enum with no omitted-status failure branch.
+ * A review seat that can still submit records a real external-dependency
+ * failure as escalate plus the existing infrastructureFailure field.
+ */
 export const reviewSubmissionSchema = withTerminatingOutputDeclarations(
-  openToolObject(
-    Type.Object({
-      status: Type.Optional(Type.Unknown({
-        description: "converged | continue | escalate — 非三态时请重读后重交，勿改标。",
-      })),
+  Type.Object({
+      status: Type.Union(
+        [
+          Type.Literal(REVIEW_QUEUE_WORDS[0]),
+          Type.Literal(REVIEW_QUEUE_WORDS[1]),
+          Type.Literal(REVIEW_QUEUE_WORDS[2]),
+        ],
+        {
+          description: "审核队列三态枚举，必填。审核席仍能交卷而完成审核所需的外部依赖发生真实基础设施失败时，status 取 escalate，细节写入 infrastructureFailure。不得省略 status，不得用另两个枚举值充当放行或封驳。包侧不因格式拒收。",
+        },
+      ),
       findings: Type.Optional(Type.Unknown({ description: "审核发现，原样留存" })),
       reason: Type.Optional(Type.Unknown({ description: "上呈理由" })),
       violations: Type.Optional(Type.Unknown({ description: "违规条目" })),
@@ -22,8 +37,7 @@ export const reviewSubmissionSchema = withTerminatingOutputDeclarations(
       note: Type.Optional(Type.Unknown({ description: "裁决附注" })),
       evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
       decisionGate: Type.Optional(Type.Unknown({ description: "需人权威处置的问题与选项；可说明 question、options，原样留存" })),
-    }),
-  ),
+    }, { additionalProperties: true }),
 );
 
 export type ReviewSubmission = { readonly status?: unknown; readonly [key: string]: unknown };

package/src/role-runtime.ts

@@ -314,7 +314,8 @@ export {
   gateOfficerForSubject,
 };
 export type { GatekeeperResult, GatekeeperSubject, SubmissionGateNonPassResult, GateOfficer, RunGatekeeperOptions } from "./gatekeeper-role.ts";
-import { ParentQueueReaskError } from "./submission-errors.ts";
+import { ParentQueueReaskError, unreadableDiscriminatorNotice } from "./submission-errors.ts";
+import { REVIEW_QUEUE_STATUSES } from "./review-submission.ts";
 
 export {
   DOCTOR_EVIDENCE_TOOL_NAME,
@@ -872,8 +873,6 @@ function readDiaristRunCoordinates(ctx: HostContext): {
 const DIARIST_BOUNDS_REASK =
   "边界无法使用。请重交 sessions：每卷 path + ranges，每端以原生 id 或本轮行号二选一指名。" as const;
 const DIARIST_ROUTING_STATUSES = new Set(["completed", "escalate"]);
-const DIARIST_STATUS_REASK =
-  "status 不是 completed、escalate 之一。请重新交卷，status 写明其一。" as const;
 
 /**
  * #708 / #779 / #901: 起居郎 public seat on the shared filed-officer envelope.
@@ -900,7 +899,7 @@ export function createDiaristRoleRuntime(
         // before interpreting any other submitted field; caller-owned data stays open.
         const status = submitted?.status;
         if (typeof status !== "string" || !DIARIST_ROUTING_STATUSES.has(status)) {
-          throw new ParentQueueReaskError(DIARIST_STATUS_REASK);
+          throw new ParentQueueReaskError(unreadableDiscriminatorNotice("status", submitted?.status));
         }
         if (status === "escalate") return parameters;
         const assertion = readDiaristTicketAssertion(submitted);
@@ -943,26 +942,9 @@ export function createDiaristRoleRuntime(
   );
 }
 
-/** Shared review-submission status words the queue reads (#1028). */
-const COUNTERSIGN_QUEUE_STATUSES = new Set(["converged", "continue", "escalate"]);
-
-/**
- * Plain-language re-ask when status is not a known queue word.
- * Back to countersign itself — notary is not summoned (#753).
- */
-const COUNTERSIGN_STATUS_REASK =
-  "status 不是 converged、continue、escalate 三态之一。请重新交卷，status 写明其一。" as const;
-
-/** Secretariat status words the submission gate reads. */
+/** Secretariat status words the submission gate reads. Not the review three-state field. */
 const SECRETARIAT_QUEUE_STATUSES = new Set(["converged", "escalate"]);
 
-/**
- * Plain-language re-ask when secretariatStatus is not a known queue word.
- * Back to secretariat itself — 给事中 is not summoned for escalation.
- */
-const SECRETARIAT_STATUS_REASK =
-  "secretariatStatus 不是 converged、escalate 之一。请重新交卷，status 写明其一。" as const;
-
 /**
  * Secretariat output is terminal; converged submissions enter the shared
  * submission gate on every host that mounts gatekeeper actions.
@@ -989,7 +971,9 @@ export function createSecretariatRoleRuntime(
               ? record.secretariatStatus
               : undefined;
           if (status === undefined || !SECRETARIAT_QUEUE_STATUSES.has(status)) {
-            throw new ParentQueueReaskError(SECRETARIAT_STATUS_REASK);
+            throw new ParentQueueReaskError(
+              unreadableDiscriminatorNotice("secretariatStatus", record?.secretariatStatus),
+            );
           }
           if (status === "escalate") {
             // Parent escalate → throw to caller as-is; countersign does not attend.
@@ -1132,10 +1116,10 @@ export function createCountersignRoleRuntime(
             record !== undefined && typeof record.status === "string"
               ? record.status
               : undefined;
-          if (status === undefined || !COUNTERSIGN_QUEUE_STATUSES.has(status)) {
+          if (status === undefined || !REVIEW_QUEUE_STATUSES.has(status)) {
             // Parent status unreadable → back to countersign itself; do not summon notary,
             // do not forge an officer bounce face (#753).
-            throw new ParentQueueReaskError(COUNTERSIGN_STATUS_REASK);
+            throw new ParentQueueReaskError(unreadableDiscriminatorNotice("status", record?.status));
           }
           if (status === "escalate") {
             // Parent escalate → throw to caller as-is; notary does not attend (#753).

package/src/submission-errors.ts

@@ -58,6 +58,22 @@ export class WorkerUnfinishedReasonReminderError extends Error {
   }
 }
 
+/**
+ * Host constraint missed a routing discriminator (#1055).
+ * Names live only in the submission schema. This notice carries the field and the received value.
+ */
+export function unreadableDiscriminatorNotice(field: string, received: unknown): string {
+  if (received === undefined) return `读不出 ${field}`;
+  return `读不出 ${field}：${readableGateItem(received)}`;
+}
+
+/** The received discriminator only — never the rest of the receipt. */
+export function receivedDiscriminator(receipt: unknown, field: string): unknown {
+  if (receipt === null || typeof receipt !== "object" || Array.isArray(receipt)) return undefined;
+  if (!Object.hasOwn(receipt, field)) return undefined;
+  return (receipt as Record<string, unknown>)[field];
+}
+
 /**
  * Parent seat status unreadable for queueing (#753).
  * Correctable back to the parent itself — not a gate officer bounce, no officer field.