@akagilnc/pi-workflow-roles 0.1.5068 → 0.1.5079

package/dist/review-submission.js

@@ -1,13 +1,24 @@
-/** One shared terminating receipt contract for review officers (#1028). */
+/** One shared terminating receipt contract for review officers (#1028 / #1055). */
 import { Type } from "typebox";
-import { openToolObject } from "./open-tool-schema.js";
 import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.js";
 export const REVIEW_SUBMISSION_OUTPUT_TOOL_NAME = "ak_submission_output";
-/** Open receipt: the queue reads only status; all other submitted fields ride unchanged. */
-export const reviewSubmissionSchema = withTerminatingOutputDeclarations(openToolObject(Type.Object({
-    status: Type.Optional(Type.Unknown({
-        description: "converged | continue | escalate — 非三态时请重读后重交，勿改标。",
-    })),
+/** Single schema copy of the review queue words. Runtime membership reads this set. */
+export const REVIEW_QUEUE_WORDS = ["converged", "continue", "escalate"];
+export const REVIEW_QUEUE_STATUSES = new Set(REVIEW_QUEUE_WORDS);
+/**
+ * One object root. Codex structured output rejects a root anyOf, and status
+ * stays a required three-state enum with no omitted-status failure branch.
+ * A review seat that can still submit records a real external-dependency
+ * failure as escalate plus the existing infrastructureFailure field.
+ */
+export const reviewSubmissionSchema = withTerminatingOutputDeclarations(Type.Object({
+    status: Type.Union([
+        Type.Literal(REVIEW_QUEUE_WORDS[0]),
+        Type.Literal(REVIEW_QUEUE_WORDS[1]),
+        Type.Literal(REVIEW_QUEUE_WORDS[2]),
+    ], {
+        description: "审核队列三态枚举，必填。审核席仍能交卷而完成审核所需的外部依赖发生真实基础设施失败时，status 取 escalate，细节写入 infrastructureFailure。不得省略 status，不得用另两个枚举值充当放行或封驳。包侧不因格式拒收。",
+    }),
     findings: Type.Optional(Type.Unknown({ description: "审核发现，原样留存" })),
     reason: Type.Optional(Type.Unknown({ description: "上呈理由" })),
     violations: Type.Optional(Type.Unknown({ description: "违规条目" })),
@@ -17,4 +28,4 @@ export const reviewSubmissionSchema = withTerminatingOutputDeclarations(openTool
     note: Type.Optional(Type.Unknown({ description: "裁决附注" })),
     evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
     decisionGate: Type.Optional(Type.Unknown({ description: "需人权威处置的问题与选项；可说明 question、options，原样留存" })),
-})));
+}, { additionalProperties: true }));

package/dist/submission-errors.js

@@ -50,6 +50,23 @@ export class WorkerUnfinishedReasonReminderError extends Error {
         this.name = "WorkerUnfinishedReasonReminderError";
     }
 }
+/**
+ * Host constraint missed a routing discriminator (#1055).
+ * Names live only in the submission schema. This notice carries the field and the received value.
+ */
+export function unreadableDiscriminatorNotice(field, received) {
+    if (received === undefined)
+        return `读不出 ${field}`;
+    return `读不出 ${field}：${readableGateItem(received)}`;
+}
+/** The received discriminator only — never the rest of the receipt. */
+export function receivedDiscriminator(receipt, field) {
+    if (receipt === null || typeof receipt !== "object" || Array.isArray(receipt))
+        return undefined;
+    if (!Object.hasOwn(receipt, field))
+        return undefined;
+    return receipt[field];
+}
 /**
  * Parent seat status unreadable for queueing (#753).
  * Correctable back to the parent itself — not a gate officer bounce, no officer field.

package/dist/submission-ledger.js

@@ -6,7 +6,8 @@ import { runIdFromRunDirectory } from "./run-terminal-artifacts.js";
 import { readSitianRecords, resolveSitianRecordPathInLedger, sitianReport } from "./sitian-facade.js";
 import { findRunDirectoryById } from "./public-cli/run-lifecycle.js";
 import { isCorrectableExecuteError } from "./submission-correctable-error.js";
-import { failOnInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.js";
+import { failOnInfrastructureFailureDeclaration, infrastructureFailureDiagnostic } from "./package-contracts/terminating-infrastructure.js";
+import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.js";
 /**
  * Admitted run identity for the ledger subject.
  * Prefer AK_ROLE_RUN_DIR via sole runDirectory→runId parser (public-CLI correlation);
@@ -480,11 +481,22 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                     });
                     let result;
                     try {
-                        failOnInfrastructureFailureDeclaration(params, {
-                            failInfrastructure(error, ctx) {
-                                failInfrastructure(error, ctx);
-                            },
-                        }, context, toolCallId, tool.bounceInfrastructureDeclaration);
+                        // A review escalate that carries the failure declaration is the
+                        // seat's own submission. Every other declaration stays on the
+                        // host-failure seam. Tool identity comes from the registry map.
+                        const reviewEscalate = tool.name === REVIEW_SUBMISSION_OUTPUT_TOOL_NAME
+                            && infrastructureFailureDiagnostic(params) !== undefined
+                            && params !== null
+                            && typeof params === "object"
+                            && !Array.isArray(params)
+                            && params.status === "escalate";
+                        if (!reviewEscalate) {
+                            failOnInfrastructureFailureDeclaration(params, {
+                                failInfrastructure(error, ctx) {
+                                    failInfrastructure(error, ctx);
+                                },
+                            }, context, toolCallId, tool.bounceInfrastructureDeclaration);
+                        }
                         result = await tool.execute(toolCallId, params, signal, update, context);
                     }
                     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5068",
+  "version": "0.1.5079",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/compliance-transport.ts

@@ -4,7 +4,8 @@ import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
 import type { HostContext } from "./host-contracts.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 import type { PublicSummonResult } from "./public-role-summons.ts";
-import { OFFICER_CONCLUSION_REASK } from "./gatekeeper-role.ts";
+import { officerConclusionReask } from "./gatekeeper-role.ts";
+import { receivedDiscriminator } from "./submission-errors.ts";
 import { coalesceSubmissionRows } from "./public-cli/terminal.ts";
 import { readableGateItem } from "./readable-gate-item.ts";
 
@@ -226,7 +227,7 @@ export async function runComplianceAudit(options: RunComplianceAuditOptions): Pr
     const summoned = await summon(subject, runDirectory, options.signal, reask, submission);
     const decision = await projectAuditorTerminal(summoned);
     if (decision.status === "received") {
-      reask = OFFICER_CONCLUSION_REASK;
+      reask = officerConclusionReask(receivedDiscriminator(decision.reply, "status"));
       continue;
     }
     return decision;

package/src/countersign-contracts.ts

@@ -5,7 +5,7 @@
  * is defaulted, rewritten, or dropped (ADR 0055).
  */
 
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 
 export const COUNTERSIGN_OUTPUT_TOOL_NAME = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 
@@ -37,7 +37,7 @@ export function validateRecordedCountersignOutput(verdict: unknown): Countersign
   if (typeof status !== "string") {
     throw new Error("Countersign verdict has no execution discriminator");
   }
-  if (["converged", "continue", "escalate"].includes(status)) {
+  if (REVIEW_QUEUE_STATUSES.has(status)) {
     return verdict as CountersignVerdict;
   }
   throw new Error("Countersign verdict has no execution discriminator");

package/src/countersign-role.ts

@@ -11,13 +11,9 @@ export type { CountersignVerdict };
 // #836 r16 class 1: fix/note/decisionGate are LLM/human-read narrative content —
 // no code branches on their length or nested presence. `status` alone is the
 // machine discriminator the queue reads.
-// #836 (2026-09-11 御批 / ADR 0003 Amendment): registered-to-provider closed
-// value domains reject an unknown status before the submission
-// ledger ever records it, defeating 读不出三态→resume 说话者本人. Kept open
-// (Type.Unknown) like every other gate-queue status field in this package
-// (notary/auditor/gatekeeper/navigator); src/role-runtime.ts:997-1025 still
-// classifies the recorded value and reasks the countersign itself when it
-// isn't one of the three states — code, not the transport, does that work.
+// #1055: the three-state field is an enum+required host generation constraint
+// on reviewSubmissionSchema. Package execute still does not reject; an unreadable
+// value reasks the countersign itself with the received value.
 /** 给事中票庭审读五问的交卷形状（ADR 0074）；形状指引，非 schema 闸。 */
 export const countersignVerdictSchema = reviewSubmissionSchema;
 export type CountersignVerdictParameters = import("./review-submission.ts").ReviewSubmission;

package/src/gatekeeper-role.ts

@@ -4,9 +4,9 @@ import type { HostContext } from "./host-contracts.ts";
 import { auditorRunDirectory } from "./auditor-dossier-tool.ts";
 import { packagedGateStageLabel } from "./packaged-role-registry.ts";
 import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
-import { GatekeeperDecisionError } from "./submission-errors.ts";
+import { GatekeeperDecisionError, receivedDiscriminator, unreadableDiscriminatorNotice } from "./submission-errors.ts";
 import { INSPECTOR_OUTPUT_TOOL_NAME } from "./inspector-contracts.ts";
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 import {
   GATEKEEPER_OUTPUT_TOOL_NAME,
   gatekeeperDecisionSchema,
@@ -66,6 +66,8 @@ export type GatekeeperResult =
       readonly status: "needs_reask";
       readonly officer: GateOfficer;
       readonly receipt: unknown;
+      /** Discriminator the queue already read. Not written back onto the receipt. */
+      readonly receivedStatus?: unknown;
       readonly runId?: string;
     }
   | { readonly status: "no_receipt"; readonly stage: GateOfficer; readonly reason: string; readonly facts: NoReceiptLifecycleFacts }
@@ -210,12 +212,9 @@ function readRecord(value: unknown): Record<string, unknown> | undefined {
  * `fallbackStatus` is the terminal outcome.status when the receipt body has no status key
  * (keeps missing-args sentinel intact as the receipt).
  */
-/** Map the shared review verdict onto the gate queue words (#1028). */
+/** Map the shared review verdict onto the gate queue words (#1028 / #1055). */
 function reviewQueueStatus(status: string): string | undefined {
-  if (status === "converged") return "converged";
-  if (status === "continue") return "continue";
-  if (status === "escalate") return "escalate";
-  return undefined;
+  return REVIEW_QUEUE_STATUSES.has(status) ? status : undefined;
 }
 
 function projectOfficerDecision(
@@ -235,7 +234,7 @@ function projectOfficerDecision(
   if (queueStatus === "continue" || queueStatus === "escalate") {
     return { status: queueStatus, officer, receipt };
   }
-  return { status: "needs_reask", officer, receipt };
+  return { status: "needs_reask", officer, receipt, receivedStatus: status };
 }
 
 /**
@@ -371,12 +370,14 @@ function projectOfficerTerminal(
       summoned,
     );
   }
+  const receipt = thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome);
   return withOfficerRunId(
     {
       status: "needs_reask",
       officer,
       // This-court receipt only (#879).
-      receipt: thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome),
+      receipt,
+      receivedStatus: receivedDiscriminator(receipt, "status"),
     },
     summoned,
   );
@@ -391,16 +392,11 @@ export type GatekeeperProjection = {
 };
 
 /**
- * Plain-language re-ask when the officer conclusion is not converged|continue|escalate.
- * Not a packaged engine handbook line (#755 exception for 读不出三态).
- * Every review officer uses the same `status` field and three queue words (#1028).
+ * Officer conclusion was missing or not a queue word (#1055).
+ * `received` is the status value only, not the rest of the receipt.
  */
-export const OFFICER_CONCLUSION_REASK =
-  "上次交卷的 status 不是 converged、continue、escalate 三态之一。请重新输出，status 写明其一；continue 或 escalate 的话就是给对方看的原文。" as const;
-
-/** Pick the re-ask line for the officer under review. */
-export function officerConclusionReask(officer: GateOfficer): string {
-  return OFFICER_CONCLUSION_REASK;
+export function officerConclusionReask(received: unknown): string {
+  return unreadableDiscriminatorNotice("status", received);
 }
 
 /**

package/src/inspector-contracts.ts

@@ -4,7 +4,7 @@
  * Dual path: gate-dispatched and independently callable (#568 / ADR 0074).
  */
 
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 
 export const INSPECTOR_OUTPUT_TOOL_NAME: string = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 export const INSPECTOR_SOURCE_RUN_FLAG = {
@@ -30,7 +30,10 @@ export function validateRecordedInspectorOutput(value: unknown): InspectorOutput
   } catch {
     throw new Error("Inspector output has no execution discriminator");
   }
-  if (status === "converged" || status === "continue" || status === "escalate") {
+  if (typeof status !== "string") {
+    throw new Error("Inspector output has no execution discriminator");
+  }
+  if (REVIEW_QUEUE_STATUSES.has(status)) {
     return value as InspectorOutput;
   }
   throw new Error("Inspector output has no execution discriminator");

package/src/judge-role.ts

@@ -1,19 +1,15 @@
 import type { RoleHost, HostContext, HostToolResult, HostGatekeeperActions } from "./host-contracts.ts";
 import type { Static } from "typebox";
-import { reviewSubmissionSchema } from "./review-submission.ts";
-import { GatekeeperDecisionError, ParentQueueReaskError } from "./submission-errors.ts";
+import { REVIEW_QUEUE_STATUSES, reviewSubmissionSchema } from "./review-submission.ts";
+import { GatekeeperDecisionError, ParentQueueReaskError, unreadableDiscriminatorNotice } from "./submission-errors.ts";
 import { projectGatekeeperEscalation } from "./audit-escalation.ts";
 
 import { readableGateItem } from "./readable-gate-item.ts";
 import {
   JUDGE_OUTPUT_TOOL_NAME,
-  validateAcceptedJudgeDetails,
   type JudgeVerdict,
 } from "./package-contracts/judge-output.ts";
 
-const JUDGE_QUEUE_STATUSES = new Set(["converged", "continue", "escalate"]);
-const JUDGE_STATUS_REASK =
-  "status 不是 converged、continue、escalate 三态之一。请重新交卷，status 写明其一。" as const;
 
 export { JUDGE_OUTPUT_TOOL_NAME };
 export type { JudgeVerdict };
@@ -25,8 +21,6 @@ export type { JudgeVerdict };
 // The shared open schema preserves role-specific prose without adding another contract.
 export const judgeVerdictSchema = reviewSubmissionSchema;
 
-type JudgeVerdictParameters = Static<typeof judgeVerdictSchema>;
-
 export type JudgeRoleDependencies = {
   loadSoul(): Promise<string>;
 };
@@ -36,10 +30,6 @@ export type JudgeRoleHostActions = HostGatekeeperActions & {
   bindPriorGatePass(toolCallId: string, receipt: unknown): void;
 };
 
-export function validateVerdict(verdict: JudgeVerdictParameters): JudgeVerdict {
-  return validateAcceptedJudgeDetails(verdict);
-}
-
 
 export function createJudgeRoleRuntime(
   pi: RoleHost,
@@ -70,19 +60,21 @@ export function createJudgeRoleRuntime(
               && typeof (parameters as Record<string, unknown>).status === "string"
                 ? (parameters as Record<string, unknown>).status as string
                 : undefined;
-            if (rawStatus === undefined || !JUDGE_QUEUE_STATUSES.has(rawStatus)) {
-              throw new ParentQueueReaskError(JUDGE_STATUS_REASK);
+            if (rawStatus === undefined || !REVIEW_QUEUE_STATUSES.has(rawStatus)) {
+              const received = parameters !== null && typeof parameters === "object" && !Array.isArray(parameters)
+                ? (parameters as Record<string, unknown>).status
+                : undefined;
+              throw new ParentQueueReaskError(unreadableDiscriminatorNotice("status", received));
             }
             if (rawStatus === "escalate") {
               // Parent escalate → throw to caller as-is; officers do not attend (#753 / #756).
-              const verdict = validateVerdict(parameters);
               return {
                 content: [],
-                details: verdict,
+                details: parameters,
                 terminate: true as const,
               };
             }
-            const verdict = validateVerdict(parameters);
+            // Queue membership above is the only three-state check. The receipt is not re-judged.
             // Candidate verdict is already on the parent session books as this
             // tool-call leaf (first-record-then-audit; run 019fea05 L61/L62).
             // #753: 符宝郎内闸 — continue returns the raw receipt as a nonterminal tool result.
@@ -101,7 +93,7 @@ export function createJudgeRoleRuntime(
               if (draftPass?.status === "continue") {
                 return {
                   content: [{ type: "text" as const, text: readableGateItem(draftPass.receipt) }],
-                  details: verdict,
+                  details: parameters,
                   terminate: false,
                 };
               }
@@ -121,18 +113,18 @@ export function createJudgeRoleRuntime(
               if (compliancePass?.status === "continue") {
                 return {
                   content: [draftPass, compliancePass].filter((pass) => pass !== undefined).map((pass) => ({ type: "text" as const, text: readableGateItem(pass.receipt) })),
-                  details: verdict,
+                  details: parameters,
                   terminate: false,
                 };
               }
               return {
                 content: [draftPass, compliancePass].filter((pass) => pass !== undefined).map((pass) => ({ type: "text" as const, text: readableGateItem(pass.receipt) })),
-                details: verdict,
+                details: parameters,
                 terminate: true as const,
               };
             } catch (error) {
               if (error instanceof GatekeeperDecisionError && error.result.status === "escalate") {
-                return projectGatekeeperEscalation(error.result, verdict);
+                return projectGatekeeperEscalation(error.result, parameters);
               }
               throw error;
             }

package/src/open-tool-schema.ts

@@ -12,7 +12,7 @@ function declarationIdentity(schema: TSchema): string {
   return JSON.stringify(semantic);
 }
 
-/** Collapse transport variants into one provider-compatible, zero-required open object. */
+/** Collapse transport variants into one provider-compatible open object. Non-three-state tools stay zero-required. */
 export function openToolObjectFromUnion(schema: UnionSchema): TSchema {
   const declarations = new Map<string, TSchema[]>();
   for (const variant of schema.anyOf) {
@@ -35,10 +35,15 @@ export function openToolObjectFromUnion(schema: UnionSchema): TSchema {
   return object;
 }
 
-/** Open a pre-existing object transport schema without changing declarations. */
-export function openToolObject(schema: TSchema & { properties: Record<string, TSchema> }): TSchema {
+/** Open a pre-existing object transport schema. Every field stays optional. */
+export function openToolObject(
+  schema: TSchema & { properties: Record<string, TSchema> },
+): TSchema {
   const object = Type.Object(
-    Object.fromEntries(Object.entries(schema.properties).map(([name, declaration]) => [name, Type.Optional(described(name, declaration))])),
+    Object.fromEntries(Object.entries(schema.properties).map(([name, declaration]) => [
+      name,
+      Type.Optional(described(name, declaration)),
+    ])),
     { additionalProperties: true },
   );
   (object as unknown as { required: string[] }).required = [];

package/src/package-contracts/judge-output.ts

@@ -1,7 +1,7 @@
 /** Package-owned Judge output leaf — no role registration surface. */
 
 
-import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "../review-submission.ts";
+import { REVIEW_QUEUE_STATUSES, REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "../review-submission.ts";
 
 export const JUDGE_OUTPUT_TOOL_NAME: string = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 
@@ -39,9 +39,7 @@ export function validateAcceptedJudgeDetails(verdict: unknown): JudgeVerdict {
   if (typeof status !== "string") {
     throw new Error("Judge verdict has no execution discriminator");
   }
-  if (
-    ["converged", "continue", "escalate"].includes(status)
-  ) {
+  if (REVIEW_QUEUE_STATUSES.has(status)) {
     return verdict as JudgeVerdict;
   }
   throw new Error("Judge verdict has no execution discriminator");

package/src/package-contracts/terminating-infrastructure.ts

@@ -50,8 +50,9 @@ const infrastructureFailureDeclarationSchema = Type.Object(
 
 /**
  * Compose declarations shared by terminating output tools: infrastructure failure
- * and the optional role-asserted ticket identity. Returns an open object (additionalProperties: true,
- * required: []) with the base schema's properties plus the shared declaration.
+ * and the optional role-asserted ticket identity. Returns an open object (additionalProperties: true)
+ * with the base schema's properties plus the shared declaration. Incoming required
+ * keys that still exist are kept; every other key stays optional.
  * Static typing is preserved on the base (`as S`), so existing
  * `Static<typeof ...>` derived parameter types are unchanged.
  */
@@ -78,7 +79,11 @@ export function withTerminatingOutputDeclarations<
       ],
   };
   const object = Type.Object(properties, { additionalProperties: true });
-  (object as unknown as { required: string[] }).required = [];
+  const incoming = (schema as { required?: unknown }).required;
+  const preserved = Array.isArray(incoming)
+    ? incoming.filter((key): key is string => typeof key === "string" && Object.hasOwn(properties, key))
+    : [];
+  (object as unknown as { required: string[] }).required = preserved;
   return object as unknown as S;
 }
 
@@ -115,7 +120,7 @@ function isInfrastructureFailureDeclaration(
 }
 
 /** Non-empty trimmed diagnostic from the declaration, else undefined. */
-function infrastructureFailureDiagnostic(
+export function infrastructureFailureDiagnostic(
   parameters: unknown,
 ): string | undefined {
   if (!isInfrastructureFailureDeclaration(parameters)) return undefined;

package/src/review-submission.ts

@@ -1,18 +1,33 @@
-/** One shared terminating receipt contract for review officers (#1028). */
+/** One shared terminating receipt contract for review officers (#1028 / #1055). */
 import { Type } from "typebox";
 
-import { openToolObject } from "./open-tool-schema.ts";
 import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 
 export const REVIEW_SUBMISSION_OUTPUT_TOOL_NAME = "ak_submission_output" as const;
 
-/** Open receipt: the queue reads only status; all other submitted fields ride unchanged. */
+/** Single schema copy of the review queue words. Runtime membership reads this set. */
+export const REVIEW_QUEUE_WORDS = ["converged", "continue", "escalate"] as const;
+export type ReviewQueueWord = (typeof REVIEW_QUEUE_WORDS)[number];
+export const REVIEW_QUEUE_STATUSES: ReadonlySet<string> = new Set(REVIEW_QUEUE_WORDS);
+
+/**
+ * One object root. Codex structured output rejects a root anyOf, and status
+ * stays a required three-state enum with no omitted-status failure branch.
+ * A review seat that can still submit records a real external-dependency
+ * failure as escalate plus the existing infrastructureFailure field.
+ */
 export const reviewSubmissionSchema = withTerminatingOutputDeclarations(
-  openToolObject(
-    Type.Object({
-      status: Type.Optional(Type.Unknown({
-        description: "converged | continue | escalate — 非三态时请重读后重交，勿改标。",
-      })),
+  Type.Object({
+      status: Type.Union(
+        [
+          Type.Literal(REVIEW_QUEUE_WORDS[0]),
+          Type.Literal(REVIEW_QUEUE_WORDS[1]),
+          Type.Literal(REVIEW_QUEUE_WORDS[2]),
+        ],
+        {
+          description: "审核队列三态枚举，必填。审核席仍能交卷而完成审核所需的外部依赖发生真实基础设施失败时，status 取 escalate，细节写入 infrastructureFailure。不得省略 status，不得用另两个枚举值充当放行或封驳。包侧不因格式拒收。",
+        },
+      ),
       findings: Type.Optional(Type.Unknown({ description: "审核发现，原样留存" })),
       reason: Type.Optional(Type.Unknown({ description: "上呈理由" })),
       violations: Type.Optional(Type.Unknown({ description: "违规条目" })),
@@ -22,8 +37,7 @@ export const reviewSubmissionSchema = withTerminatingOutputDeclarations(
       note: Type.Optional(Type.Unknown({ description: "裁决附注" })),
       evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
       decisionGate: Type.Optional(Type.Unknown({ description: "需人权威处置的问题与选项；可说明 question、options，原样留存" })),
-    }),
-  ),
+    }, { additionalProperties: true }),
 );
 
 export type ReviewSubmission = { readonly status?: unknown; readonly [key: string]: unknown };

package/src/role-runtime.ts

@@ -314,7 +314,8 @@ export {
   gateOfficerForSubject,
 };
 export type { GatekeeperResult, GatekeeperSubject, SubmissionGateNonPassResult, GateOfficer, RunGatekeeperOptions } from "./gatekeeper-role.ts";
-import { ParentQueueReaskError } from "./submission-errors.ts";
+import { ParentQueueReaskError, unreadableDiscriminatorNotice } from "./submission-errors.ts";
+import { REVIEW_QUEUE_STATUSES } from "./review-submission.ts";
 
 export {
   DOCTOR_EVIDENCE_TOOL_NAME,
@@ -872,8 +873,6 @@ function readDiaristRunCoordinates(ctx: HostContext): {
 const DIARIST_BOUNDS_REASK =
   "边界无法使用。请重交 sessions：每卷 path + ranges，每端以原生 id 或本轮行号二选一指名。" as const;
 const DIARIST_ROUTING_STATUSES = new Set(["completed", "escalate"]);
-const DIARIST_STATUS_REASK =
-  "status 不是 completed、escalate 之一。请重新交卷，status 写明其一。" as const;
 
 /**
  * #708 / #779 / #901: 起居郎 public seat on the shared filed-officer envelope.
@@ -900,7 +899,7 @@ export function createDiaristRoleRuntime(
         // before interpreting any other submitted field; caller-owned data stays open.
         const status = submitted?.status;
         if (typeof status !== "string" || !DIARIST_ROUTING_STATUSES.has(status)) {
-          throw new ParentQueueReaskError(DIARIST_STATUS_REASK);
+          throw new ParentQueueReaskError(unreadableDiscriminatorNotice("status", submitted?.status));
         }
         if (status === "escalate") return parameters;
         const assertion = readDiaristTicketAssertion(submitted);
@@ -943,26 +942,9 @@ export function createDiaristRoleRuntime(
   );
 }
 
-/** Shared review-submission status words the queue reads (#1028). */
-const COUNTERSIGN_QUEUE_STATUSES = new Set(["converged", "continue", "escalate"]);
-
-/**
- * Plain-language re-ask when status is not a known queue word.
- * Back to countersign itself — notary is not summoned (#753).
- */
-const COUNTERSIGN_STATUS_REASK =
-  "status 不是 converged、continue、escalate 三态之一。请重新交卷，status 写明其一。" as const;
-
-/** Secretariat status words the submission gate reads. */
+/** Secretariat status words the submission gate reads. Not the review three-state field. */
 const SECRETARIAT_QUEUE_STATUSES = new Set(["converged", "escalate"]);
 
-/**
- * Plain-language re-ask when secretariatStatus is not a known queue word.
- * Back to secretariat itself — 给事中 is not summoned for escalation.
- */
-const SECRETARIAT_STATUS_REASK =
-  "secretariatStatus 不是 converged、escalate 之一。请重新交卷，status 写明其一。" as const;
-
 /**
  * Secretariat output is terminal; converged submissions enter the shared
  * submission gate on every host that mounts gatekeeper actions.
@@ -989,7 +971,9 @@ export function createSecretariatRoleRuntime(
               ? record.secretariatStatus
               : undefined;
           if (status === undefined || !SECRETARIAT_QUEUE_STATUSES.has(status)) {
-            throw new ParentQueueReaskError(SECRETARIAT_STATUS_REASK);
+            throw new ParentQueueReaskError(
+              unreadableDiscriminatorNotice("secretariatStatus", record?.secretariatStatus),
+            );
           }
           if (status === "escalate") {
             // Parent escalate → throw to caller as-is; countersign does not attend.
@@ -1132,10 +1116,10 @@ export function createCountersignRoleRuntime(
             record !== undefined && typeof record.status === "string"
               ? record.status
               : undefined;
-          if (status === undefined || !COUNTERSIGN_QUEUE_STATUSES.has(status)) {
+          if (status === undefined || !REVIEW_QUEUE_STATUSES.has(status)) {
             // Parent status unreadable → back to countersign itself; do not summon notary,
             // do not forge an officer bounce face (#753).
-            throw new ParentQueueReaskError(COUNTERSIGN_STATUS_REASK);
+            throw new ParentQueueReaskError(unreadableDiscriminatorNotice("status", record?.status));
           }
           if (status === "escalate") {
             // Parent escalate → throw to caller as-is; notary does not attend (#753).

package/src/submission-errors.ts

@@ -58,6 +58,22 @@ export class WorkerUnfinishedReasonReminderError extends Error {
   }
 }
 
+/**
+ * Host constraint missed a routing discriminator (#1055).
+ * Names live only in the submission schema. This notice carries the field and the received value.
+ */
+export function unreadableDiscriminatorNotice(field: string, received: unknown): string {
+  if (received === undefined) return `读不出 ${field}`;
+  return `读不出 ${field}：${readableGateItem(received)}`;
+}
+
+/** The received discriminator only — never the rest of the receipt. */
+export function receivedDiscriminator(receipt: unknown, field: string): unknown {
+  if (receipt === null || typeof receipt !== "object" || Array.isArray(receipt)) return undefined;
+  if (!Object.hasOwn(receipt, field)) return undefined;
+  return (receipt as Record<string, unknown>)[field];
+}
+
 /**
  * Parent seat status unreadable for queueing (#753).
  * Correctable back to the parent itself — not a gate officer bounce, no officer field.

package/src/submission-gate.ts

@@ -27,6 +27,7 @@ import {
   type GateOfficerSummon,
 } from "./gatekeeper-role.ts";
 import type { PublicSummonResult } from "./public-role-summons.ts";
+
 import { sessionFileFromPublicSummon } from "./session-assistant-usage.ts";
 
 /**
@@ -178,7 +179,7 @@ export async function requireSubmissionGate(options: {
       };
     }
     if (gatekeeper.status === "needs_reask") {
-      reask = officerConclusionReask(projected.officer);
+      reask = officerConclusionReask(gatekeeper.receivedStatus);
       continue;
     }
     if (gatekeeper.status === "transport_failure") {