@akagilnc/pi-workflow-roles 0.1.5096 → 0.1.5124

package/dist/public-cli/post-admission.js

@@ -8,13 +8,13 @@
 import { randomUUID } from "node:crypto";
 import { writeFile } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
-import { buildAutoResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
+import { buildAutoResumeContinuationPrompt, findRunDirectoryById, readRoleRunState, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
 import { CliUsageError } from "./cli-errors.js";
 import { bindAdmittedTicketNumber, buildInstructionTransportPrompt, freezeAttachmentsIntoRun, relocateAdmittedRunToTicket, } from "./invocation.js";
 import { readRecordedSubmissionRows } from "../submission-ledger.js";
 import { pathContainedIn } from "../activation-ledger-topology.js";
 import { pickEngineAxis } from "../package-resources/engine-material.js";
-import { readStoredHostSessionId, resolveHostAwareSessionAvailability } from "../session-identity.js";
+import { readStoredHostSessionId, resolveHostAwareSessionAvailability, } from "../session-identity.js";
 import { rewriteRunDirectoryPathValue } from "../role-run-relocation.js";
 import { isOfficerReviewSeat } from "../packaged-role-registry.js";
 import { deliverCaseDossierAsAttachment } from "./case-dossier-delivery.js";
@@ -39,7 +39,7 @@ import { projectHostTransitionPriorNative } from "../host-transition-prior-nativ
 import { clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, } from "./run-lifecycle.js";
 import { processCancelDiagnostic, processCancelSignalName, } from "./process-cancel.js";
 import { homeFromRunDirectory } from "../activation-ledger-topology.js";
-import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, } from "./settlement.js";
+import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatErrorCauseDetail, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, publishedFailureErrorPath, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, rewritePublishedFailureErrorPath, } from "./settlement.js";
 import {} from "./terminal.js";
 import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
 function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
@@ -56,6 +56,7 @@ function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
         }
     }
     if (result.terminal !== undefined) {
+        rewritePublishedFailureErrorPath(result.terminal, relocation.oldRunDirectory, relocation.newRunDirectory);
         for (const artifact of result.terminal.artifacts) {
             artifact.path = rewrite(artifact.path);
         }
@@ -175,7 +176,7 @@ export async function resolveResumeMethodMaterialAdapters(input) {
             stderr: "",
             thrown: error,
             ...(input.knownCause === undefined ? {} : { knownCause: input.knownCause }),
-        }, input.emptyAdapters, input.authority, input.io);
+        }, input.emptyAdapters, input.authority, { ...input.io, omitFailureStderrDiagnostic: true });
         return { kind: "terminal", ...terminal };
     }
 }
@@ -233,15 +234,27 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
     if (persistRunState && !failureInput.skipRunStateWrite) {
         await persistReturnedRunState(admitted, authority);
     }
-    const terminal = await attachRecordedSubmissions(admitted, await settleFailureTerminalResult(admitted, failure, authority, {
-        ...(resumable
-            ? { resume: { command: renderResumeCommand(admitted.runId) } }
-            : {}),
-        ...(failureInput.invocationScopeId === undefined ||
-            failureInput.invocationScopeId.length === 0
-            ? {}
-            : { invocationScopeId: failureInput.invocationScopeId }),
-    }));
+    let publishedErrorPath;
+    let terminal;
+    try {
+        const settled = await settleFailureTerminalResult(admitted, failure, authority, {
+            ...(resumable
+                ? { resume: { command: renderResumeCommand(admitted.runId) } }
+                : {}),
+            ...(failureInput.invocationScopeId === undefined ||
+                failureInput.invocationScopeId.length === 0
+                ? {}
+                : { invocationScopeId: failureInput.invocationScopeId }),
+            onErrorPublished: (path) => { publishedErrorPath = path; },
+        });
+        terminal = await attachRecordedSubmissions(admitted, settled);
+    }
+    catch (error) {
+        if (io.omitFailureStderrDiagnostic && publishedErrorPath !== undefined) {
+            writeResumeFailurePointer(io, publishedErrorPath);
+        }
+        throw error;
+    }
     presentFailureTerminal(terminal, io);
     return {
         exitCode: exitCodeForTerminalOutcome(terminal.roleOutcome),
@@ -359,8 +372,12 @@ export async function dispatchPostAdmissionTurn(input) {
             if (relocation !== undefined) {
                 projectRelocatedTurnIdentity(request, result, admitted, relocation);
             }
-            if (adapters.afterDispatch !== undefined)
-                await adapters.afterDispatch(admitted, lease);
+            const afterDispatchRelocation = adapters.afterDispatch === undefined
+                ? undefined
+                : await adapters.afterDispatch(admitted, lease);
+            if (afterDispatchRelocation !== undefined) {
+                projectRelocatedTurnIdentity(request, result, admitted, afterDispatchRelocation);
+            }
             return result;
         }
         catch (error) {
@@ -968,16 +985,24 @@ export async function runPostAdmissionSeatResume(input) {
         loaded = await input.load(request);
     }
     catch (error) {
-        if (error instanceof CliUsageError) {
-            presentStructuralRejection(error, input.io);
-            return { exitCode: 2 };
+        const usageError = error instanceof CliUsageError;
+        // Unknown usage failures retain the structural fallback. Other load
+        // failures keep the CLI's outer handling unless an existing run is found.
+        const recorded = await pointExistingRunFailure(input.env.home, request.runId, input.env.principalAuthority, input.io, error);
+        if (!recorded) {
+            if (usageError) {
+                presentStructuralRejection(error, input.io);
+                return { exitCode: 2 };
+            }
+            throw error;
         }
-        throw error;
+        return { exitCode: usageError ? 2 : 1 };
     }
     let adapters = input.adapters;
     if (input.afterAdmittedLoad !== undefined) {
         const prepared = await input.afterAdmittedLoad(loaded.admitted);
         if (prepared.kind === "terminal") {
+            showResumeErrorPointer(input.io, prepared.exitCode, prepared.terminal);
             return {
                 exitCode: prepared.exitCode,
                 admitted: prepared.admitted,
@@ -1116,26 +1141,100 @@ export async function runPostAdmissionSeatResume(input) {
                 }),
             });
         }
-        return await runPostAdmissionManualResume({
+        const resumed = await runPostAdmissionManualResume({
             admitted: loaded.admitted,
             env,
-            io: input.io,
+            io: { ...input.io, omitFailureStderrDiagnostic: true },
             adapters,
             ...(input.effectiveEngine === undefined
                 ? {}
                 : { effectiveEngine: input.effectiveEngine }),
             buildRequestAfterLease,
         });
+        showResumeErrorPointer(input.io, resumed.exitCode, resumed.terminal);
+        return resumed;
     }
     catch (error) {
-        // Turn construction may still surface structural rejection.
-        if (error instanceof CliUsageError) {
-            presentStructuralRejection(error, input.io);
-            return { exitCode: 2 };
+        if (error instanceof TurnDispatchedFailure)
+            throw error;
+        await presentResumeFailurePointer(input.io, error, (failure) => writeResumeDiagnosticFile(loaded.admitted.runDirectory, loaded.admitted.runId, failure, loaded.admitted.role));
+        return { exitCode: error instanceof CliUsageError ? 2 : 1 };
+    }
+}
+async function pointExistingRunFailure(home, runId, authority, io, thrown) {
+    let foundRunDirectory;
+    try {
+        foundRunDirectory = await findRunDirectoryById(home, runId);
+    }
+    catch {
+        return false;
+    }
+    if (foundRunDirectory === undefined)
+        return false;
+    const runDirectory = foundRunDirectory;
+    let record;
+    try {
+        record = await readRoleRunState(runDirectory, authority);
+    }
+    catch {
+        await presentResumeFailurePointer(io, thrown, (failure) => writeResumeDiagnosticFile(runDirectory, runId, failure));
+        return true;
+    }
+    if (record === undefined)
+        return false;
+    await presentResumeFailurePointer(io, thrown, (failure) => writeResumeDiagnosticFile(runDirectory, runId, failure, record.role));
+    return true;
+}
+export async function presentLocatedResumeFailure(home, runId, authority, io, thrown) {
+    return await pointExistingRunFailure(home, runId, authority, io, thrown);
+}
+function writeResumeFailurePointer(io, errorPath) {
+    io.stderr(formatCliDiagnostic(`续跑失败，当次错误记录：${errorPath}`));
+}
+export function showResumeErrorPointer(io, exitCode, terminal) {
+    if (exitCode === 0 || terminal === undefined)
+        return;
+    const publishedError = terminal.artifacts.find((artifact) => artifact.kind === "error")?.path
+        ?? publishedFailureErrorPath(terminal);
+    if (publishedError !== undefined)
+        writeResumeFailurePointer(io, publishedError);
+}
+async function presentResumeFailurePointer(io, thrown, publish) {
+    const failure = classifyPostAdmissionFailure({
+        timedOut: false,
+        code: null,
+        stderr: "",
+        thrown,
+    });
+    try {
+        writeResumeFailurePointer(io, await publish(failure));
+    }
+    catch (publishError) {
+        const cause = {
+            publishError: formatErrorCauseDetail(publishError),
+        };
+        if (thrown instanceof Error && thrown.cause !== undefined) {
+            cause.thrownCause = formatErrorCauseDetail(thrown.cause);
         }
-        throw error;
+        presentStructuralRejection({
+            message: thrown instanceof Error ? thrown.message : String(thrown),
+            cause,
+        }, io);
     }
 }
+async function writeResumeDiagnosticFile(runDirectory, runId, failure, role) {
+    const dir = await ensureRealArtifactsDirectory(runDirectory);
+    const path = join(dir, `resume-diagnostic-${randomUUID()}.json`);
+    await writeFile(path, `${JSON.stringify({
+        runId,
+        ...(role === undefined ? {} : { role }),
+        diagnostic: failure.diagnostic,
+        ...(failure.cause === undefined ? {} : { cause: failure.cause }),
+        ...(failure.identity === undefined ? {} : { identity: failure.identity }),
+        ...(failure.details === undefined ? {} : { details: failure.details }),
+    }, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+    return path;
+}
 /**
  * Shared post-admission one-shot path: folds into runPostAdmissionResumable (#840 / #416).
  * All callable roles share the single auto-resume loop.

package/dist/public-cli/settlement.js

@@ -31,6 +31,7 @@ import { SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY, SECRETARIAT_GATE_OFFICER_ENT
 import { classifyPackagedRoleTerminalResult, findLatestDurablePackagedRoleTerminal, hasNavigatorInfrastructureFailureBase, isAcceptedPackagedRoleTerminalResult, isReceiptSettlementBindingClear, NAVIGATOR_INVOCATION_ENTRY, NAVIGATOR_ROUTE_PLAYBOOK_FAILURE_ENTRY, parseInvocationMarkerIdentity, } from "../navigator-invocation-identity.js";
 import { NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_TURN_LIMIT, noReceiptLifecycleFacts, parseNoReceiptLifecycleFacts, } from "../receipt-delivery-policy.js";
 import { roleRunArtifactsDirectory } from "../role-run-placement.js";
+import { rewriteRunDirectoryPathValue } from "../role-run-relocation.js";
 import { listSeamOwnedUniqueErrorFacePaths, RUN_TERMINAL_ARTIFACT_FILES, RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS, } from "../run-terminal-artifacts.js";
 import { ensureRunArtifactsDir, homeFromRunDirectory, } from "./invocation.js";
 /** Ledger reads use the run's machine home — not ambient process HOME (child write vs parent settle). */
@@ -127,7 +128,11 @@ export async function attachRecordedSubmissions(admitted, terminal, scope) {
     // pass courtAttemptId here — roleOutcome already carries this-court payloads
     // from sealedLedgerOutcome when scoped; withSubmissions keeps them.
     void scope;
-    return withSubmissions(terminal, await recordedSubmissionPayloads(admitted, undefined));
+    const result = withSubmissions(terminal, await recordedSubmissionPayloads(admitted, undefined));
+    const errorPath = privateFailureErrorPaths.get(terminal);
+    if (errorPath !== undefined)
+        privateFailureErrorPaths.set(result, errorPath);
+    return result;
 }
 /**
  * Host ended with no recorded submission — lawful no_receipt (exit 0).
@@ -163,6 +168,18 @@ function coordinatesFromAdmitted(authority, admitted) {
 }
 import { coalesceSubmissionRows, exitCodeForTerminalOutcome, formatTerminalResult, isLawfulTypedTerminalOutcome, adviceNavigatorFact, } from "./terminal.js";
 export { exitCodeForTerminalOutcome, formatTerminalResult, isLawfulTypedTerminalOutcome, };
+// A resumable public Terminal omits artifact paths (#108); its actual error
+// publication remains available only to the CLI's resume presentation seam.
+const privateFailureErrorPaths = new WeakMap();
+export function publishedFailureErrorPath(terminal) {
+    return privateFailureErrorPaths.get(terminal);
+}
+export function rewritePublishedFailureErrorPath(terminal, oldRunDirectory, newRunDirectory) {
+    const errorPath = privateFailureErrorPaths.get(terminal);
+    if (errorPath !== undefined) {
+        privateFailureErrorPaths.set(terminal, rewriteRunDirectoryPathValue(errorPath, oldRunDirectory, newRunDirectory));
+    }
+}
 /**
  * Host stderr as recorded — full bytes, no flood filter, no char clip (#836).
  */
@@ -2282,7 +2299,7 @@ async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbac
     error.publicationAttempts = issues;
     throw error;
 }
-export async function publishFailureArtifacts(admitted, failure, authority) {
+export async function publishFailureArtifacts(admitted, failure, authority, onErrorPublished) {
     const { sessionDirectory, sessionFile } = coordinatesFromAdmitted(authority, admitted);
     const { baseDir, attempt: baseAttempt } = await resolveFailureArtifactsBase(admitted.runDirectory);
     const priorIssues = baseAttempt === undefined ? [] : [baseAttempt];
@@ -2346,6 +2363,7 @@ export async function publishFailureArtifacts(admitted, failure, authority) {
         ...(failure.details === undefined ? {} : { details: failure.details }),
     };
     const errorWrite = await writeFailureJsonRetainingCause(errorCandidates, uniqueFallbackDirs, "error", errorPayloadBase, priorIssues);
+    onErrorPublished?.(errorWrite.path);
     const evidencePayload = {
         runId: admitted.runId,
         sessionDirectory: sessionDirectory,
@@ -2437,7 +2455,8 @@ export async function settleFailureTerminalResult(admitted, failure, authority,
     // Exact-session attendance only — never infer no-advice from caller omission.
     const navigator = await extractNavigatorFactFromAdmittedSession(sessionFile);
     // Private durable artifacts retain the original diagnostic identity (including run ID).
-    const artifacts = await publishFailureArtifacts(admitted, failure, authority);
+    const artifacts = await publishFailureArtifacts(admitted, failure, authority, options.onErrorPublished);
+    const errorPath = artifacts.find((artifact) => artifact.kind === "error")?.path;
     const decisiveFacts = {
         ...(failure.cause === undefined ? {} : { cause: failure.cause }),
         diagnostic: failure.diagnostic,
@@ -2463,12 +2482,15 @@ export async function settleFailureTerminalResult(admitted, failure, authority,
             diagnostic: failure.diagnostic,
             decisiveFacts,
         };
-        return withOptionalGateProjection({
+        const terminal = await withOptionalGateProjection({
             roleOutcome,
             navigator,
             artifacts: [],
             resume: options.resume,
         }, sessionDirectory, detourGateContext(admitted, options));
+        if (errorPath !== undefined)
+            privateFailureErrorPaths.set(terminal, errorPath);
+        return terminal;
     }
     const roleOutcome = {
         kind: "failure",
@@ -2499,6 +2521,8 @@ export function presentFailureTerminal(terminal, io) {
     }
     io.stdout(formatTerminalResult(terminal));
     if (terminal.roleOutcome.kind === "failure") {
+        if (io.omitFailureStderrDiagnostic)
+            return;
         io.stderr(formatFailureStderrDiagnostic({
             ...(terminal.roleOutcome.cause === undefined ? {} : { cause: terminal.roleOutcome.cause }),
             diagnostic: terminal.roleOutcome.diagnostic,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5096",
+  "version": "0.1.5124",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/resources/engines/opencode.md

@@ -10,12 +10,18 @@ parameters.
 ## Invocation examples (local OpenCode CLI)
 
 The machine entrypoint is `opencode`. Run from the role project root.
-Non-interactive labor uses `run` with an explicit model:
+Non-interactive labor uses `run` with `--auto` and an explicit model:
 
 ```bash
-opencode run -m <MODEL_ID> "YOUR_LABOR_PROMPT"
+opencode run --auto -m <MODEL_ID> "YOUR_LABOR_PROMPT"
 ```
 
+- `--auto` is required: it auto-approves permissions that are not explicitly
+  denied. Without it, any `ask` permission (e.g. `external_directory` when the
+  labor reads the case dossier outside the project root) is auto-rejected in a
+  headless `run`, and the engine exits after its opening sentence with no labor
+  done (upstream anomalyco/opencode#36413).
+
 - Model id is not pinned by this note; it comes from the dispatch order
   (owner pool directive), passed verbatim as `provider/model`. **Always
   confirm the current id with `opencode models` first** — provider prefixes
@@ -23,7 +29,6 @@ opencode run -m <MODEL_ID> "YOUR_LABOR_PROMPT"
   GLM lives under `opencode-go/`, e.g. `opencode-go/glm-5.2`; the older
   `zai/glm-5.2` id errors with "Unexpected server error").
 - Plain text output only (never `--format json` for labor — the returned body
-  goes back into the seat's context); `--auto` auto-approves non-denied
-  permissions for unattended runs (per official docs).
+  goes back into the seat's context).
 - Output goes to stdout; long prompts may be passed via shell heredoc or a
   file read into the argument — follow the installed CLI's actual interface.

package/src/public-cli/cli-io.ts

@@ -1,4 +1,6 @@
 export type CliIo = {
   stdout: (text: string) => void;
   stderr: (text: string) => void;
+  /** Public resume presents its failure diagnostic via a durable-file pointer instead. */
+  omitFailureStderrDiagnostic?: boolean;
 };

package/src/public-cli/cli.ts

@@ -1,4 +1,4 @@
-import type { DurablePrincipalAuthority } from "../host-contracts.ts";
+import type { DurablePrincipalAuthority, RoleTurnHost } from "../host-contracts.ts";
 import { piDurablePrincipalAuthority } from "../pi/durable-principal.ts";
 /**
  * Public ak-role CLI dispatcher (roles / config / layered help / Judge run).
@@ -49,8 +49,10 @@ import { seatModelOnly } from "./registry.ts";
 import { CliUsageError } from "./cli-errors.ts";
 import type { CliIo } from "./cli-io.ts";
 import { runMachineSkillSetup } from "./machine-method-skills.ts";
-import type { PostAdmissionEnv } from "./post-admission.ts";
-import type { RoleTurnHost } from "../host-contracts.ts";
+import {
+  presentLocatedResumeFailure,
+  type PostAdmissionEnv,
+} from "./post-admission.ts";
 import { appendPiSessionCustomEntry } from "../pi/role-turn-host.ts";
 import {
   composeRoleTurnHostAdapters,
@@ -78,6 +80,7 @@ import {
   type PublicRoleOptionOwner,
   type TypedOptionConsumer,
 } from "./option-definitions.ts";
+import { TurnDispatchedFailure } from "./auto-resume.ts";
 import { continueParentAfterChild, runPublicInstructionSeat, runPublicInstructionSeatResume } from "./instruction-seat-run.ts";
 import { courtDiaristEscalated } from "./countersign-run.ts";
 import { runPublicAnalyst } from "./analyst-run.ts";
@@ -1093,6 +1096,9 @@ export async function runAkRole(
   env: CliEnv,
 ): Promise<CliResult> {
   const io = env.io ?? defaultIo();
+  let resumeFailureContext:
+    | { readonly home: string; readonly runId: string; readonly authority: DurablePrincipalAuthority }
+    | undefined;
 
   try {
     // Select the installed package identity once, before any role-owned Skill,
@@ -1207,12 +1213,17 @@ export async function runAkRole(
     // must still exist. Seat and dispatch follow the durable admitted role.
     // #471: unique parser owns {runId, message?}; five role paths only consume it.
     if (parsed.command === "resume") {
+      const resumeRequest = parseResumeRequest(parsed.args);
+      resumeFailureContext = {
+        home,
+        runId: resumeRequest.runId,
+        authority: env.principalAuthority ?? piDurablePrincipalAuthority,
+      };
       const agentDir = resolveAgentDir(env, home);
       const cwd = env.cwd ?? process.cwd();
       const config = await loadAndValidateConfig(home, env.packageRoot);
       const credentials =
         env.credentials ?? (await loadCredentialProviders(agentDir));
-      const resumeRequest = parseResumeRequest(parsed.args);
       const resumeRole = await peekRoleRunRole(home, resumeRequest.runId);
       // Missing durable role keeps the judge seat table. The resume entry
       // itself is one function; it reads the stored run.
@@ -1243,6 +1254,11 @@ export async function runAkRole(
         && !courtDiaristEscalated(current.terminal.roleOutcome)
       ) {
         const parentRunId = current.admitted.correlationId;
+        resumeFailureContext = {
+          home,
+          runId: parentRunId,
+          authority: env.principalAuthority ?? piDurablePrincipalAuthority,
+        };
         const parentRole = await peekRoleRunRole(home, parentRunId);
         if (parentRole === undefined) break;
         const parentSeat = resolveEffectiveSeat(config, parentRole, credentials, invocationFromParsed(parsed));
@@ -1287,6 +1303,24 @@ export async function runAkRole(
     // tokens (including misspelled role names) are structural rejects.
     throw new CliUsageError(`unknown command: ${parsed.command}`);
   } catch (error) {
+    // A dispatched turn owns its settlement; only pre-dispatch resume failures
+    // fall through to the located-run diagnostic presenter here.
+    if (
+      resumeFailureContext !== undefined
+      && !(error instanceof TurnDispatchedFailure)
+      && await presentLocatedResumeFailure(
+        resumeFailureContext.home,
+        resumeFailureContext.runId,
+        resumeFailureContext.authority,
+        io,
+        error,
+      )
+    ) {
+      return {
+        exitCode: error instanceof CliUsageError ? 2 : 1,
+        ...(error instanceof HostSelectionError ? { hostFailure: error.failure } : {}),
+      };
+    }
     if (error instanceof HostSelectionError) {
       io.stderr(formatCliDiagnostic(formatHostSelectionFailure(error.failure)));
       return { exitCode: 1, hostFailure: error.failure };

package/src/public-cli/instruction-seat-run.ts

@@ -33,6 +33,7 @@ import {
   type AdmittedCountersignInvocation,
   type AdmittedRoleInvocation,
   type PublicSeatParse,
+  type RunDirectoryRelocation,
 } from "./invocation.ts";
 import {
   presentControlledFailure,
@@ -41,6 +42,7 @@ import {
   runPostAdmissionOneShot,
   runPostAdmissionResumable,
   runPostAdmissionSeatResume,
+  showResumeErrorPointer,
   resumeTurnRequestProjectionOptions,
   type PostAdmissionAdapters,
   type PostAdmissionEnv,
@@ -143,13 +145,13 @@ async function bindAndRelocateDiarist(
   admitted: AdmittedRoleInvocation & { role: "diarist" },
   authority: DurablePrincipalAuthority,
   lease?: RunWriterLease,
-): Promise<void> {
+): Promise<RunDirectoryRelocation | undefined> {
   const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
-  if (boardTicket === undefined) return;
+  if (boardTicket === undefined) return undefined;
   if (admitted.ticketNumber === undefined) {
     await bindAdmittedTicketNumber(admitted, boardTicket);
   }
-  await relocateAdmittedRunToTicket(admitted, authority, lease);
+  return await relocateAdmittedRunToTicket(admitted, authority, lease);
 }
 
 function seatAdapters(
@@ -176,8 +178,8 @@ function seatAdapters(
           await bindAndRelocateDiarist(seat, env.principalAuthority, lease);
         },
         afterDispatch: async (seat: AdmittedRoleInvocation, lease?: RunWriterLease) => {
-          if (!isBoardTicketSeat(seat)) return;
-          await bindAndRelocateDiarist(seat, env.principalAuthority, lease);
+          if (!isBoardTicketSeat(seat)) return undefined;
+          return await bindAndRelocateDiarist(seat, env.principalAuthority, lease);
         },
       }
       : {}),
@@ -824,5 +826,7 @@ export async function continueParentAfterChild(
       return { exitCode: 0, admitted, terminal: refresh.terminal };
     }
   }
-  return dispatchAdmitted(admitted, env, io);
+  const result = await dispatchAdmitted(admitted, env, { ...io, omitFailureStderrDiagnostic: true });
+  showResumeErrorPointer(io, result.exitCode, result.terminal);
+  return result;
 }

package/src/public-cli/invocation.ts

@@ -308,6 +308,11 @@ export type AdmittedRoleInvocation =
   | AdmittedReviewerInvocation
   | AdmittedMergerInvocation;
 
+export type RunDirectoryRelocation = {
+  readonly oldRunDirectory: string;
+  readonly newRunDirectory: string;
+};
+
 /** Persistence projection only — not carried on Admitted (opaque principal owns identity). */
 type RoleInvocationLedgerSource = Pick<
   AdmittedRoleInvocationBase,
@@ -641,7 +646,7 @@ export async function relocateAdmittedRunToTicket(
   admitted: AdmittedRoleInvocation,
   authority: DurablePrincipalAuthority,
   heldLease?: { relocate(runDirectory: string): void },
-): Promise<{ oldRunDirectory: string; newRunDirectory: string } | undefined> {
+): Promise<RunDirectoryRelocation | undefined> {
   if (admitted.ticketNumber === undefined || !admitted.runDirectory.includes(`${sep}unbound${sep}runs${sep}`)) return undefined;
   const oldRunDirectory = admitted.runDirectory;
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(oldRunDirectory));