@akagilnc/pi-workflow-roles 0.1.5245 → 0.1.5270

package/src/public-cli/auto-resume.ts

@@ -53,7 +53,6 @@ const dummyIo: CliIo = { stdout: () => {}, stderr: () => {} };
  */
 export async function persistReturnedRunState(
   admitted: { runDirectory: string; principal?: DurablePrincipal },
-  authority: Pick<DurablePrincipalAuthority, "isAvailable">,
   options?: { readonly lawful?: boolean },
 ): Promise<void> {
   if (options?.lawful === true) {
@@ -65,10 +64,8 @@ export async function persistReturnedRunState(
   });
   const typedHttp429 = resumeObservation.typedHttp429;
   if (admitted.principal !== undefined && typedHttp429 !== undefined) {
-    if (await authority.isAvailable(admitted.principal)) {
-      await markRunResumable(admitted.runDirectory, typedHttp429);
-      return;
-    }
+    await markRunResumable(admitted.runDirectory, typedHttp429);
+    return;
   }
   await markRunTerminal(admitted.runDirectory);
 }
@@ -391,16 +388,6 @@ export async function runWithAutoResumeLoop<
     projectRoot: string;
   };
   principalAuthority: DurablePrincipalAuthority;
-  /**
-   * Host-aware "can this principal's turn still be resumed" probe (#840 P1).
-   * Callers that know the selected host pass
-   * session-identity.ts's resolveHostAwareSessionAvailability(host,
-   * principalAuthority) so an ACP/headless turn's own binding file — not
-   * pi's session.jsonl — decides continuation for that host. Defaults to
-   * principalAuthority.isAvailable (pi-only check) when omitted, so a
-   * caller that never leaves the pi host keeps identical behavior.
-   */
-  isPrincipalAvailable?: (principal: DurablePrincipal) => Promise<boolean>;
   io: CliIo;
   sessionAppender: SessionCustomEntryAppender;
   /**
@@ -433,9 +420,6 @@ export async function runWithAutoResumeLoop<
   // `attempts >= limit` comparison (always false) — reject here, before any dispatch.
   const limit = options.autoResumeLimit ?? AUTO_RESUME_LIMIT;
   parseAutoResumeLimit(limit);
-  const isPrincipalAvailable =
-    options.isPrincipalAvailable ??
-    ((principal: DurablePrincipal) => options.principalAuthority.isAvailable(principal));
   let autoResumeAttempts = 0;
   let isFirst = true;
   let currentPayload = options.buildInitialPayload();
@@ -443,6 +427,14 @@ export async function runWithAutoResumeLoop<
   let lastThrownError: unknown;
   let everyAttemptThrew = true;
   const retainedErrorFiles: string[] = [];
+  const failedAttempts: Array<{
+    attempt: number;
+    diagnostic: string;
+    decisiveFacts?: Readonly<Record<string, unknown>>;
+    errorFile?: string;
+  }> = [];
+  let stoppedResult: T | undefined;
+  let endReason: string | undefined;
 
   while (true) {
     let result: T | undefined;
@@ -465,6 +457,11 @@ export async function runWithAutoResumeLoop<
       // diagnostic-sink-isolation precedent). When a lease is held inside
       // dispatch, that path owns release in its own finally.
       lastThrownError = error;
+      const failedAttempt: (typeof failedAttempts)[number] = {
+        attempt: dispatchOrdinal,
+        diagnostic: describeErrorIdentity(unwrapTurnDispatchedFailure(error)),
+      };
+      failedAttempts.push(failedAttempt);
       turnStartedBeforeThrow = error instanceof TurnDispatchedFailure;
       const attempt = dispatchOrdinal;
       try {
@@ -479,6 +476,7 @@ export async function runWithAutoResumeLoop<
           error,
         );
         retainedErrorFiles.push(file);
+        failedAttempt.errorFile = file;
         options.io.stderr(
           `dispatch attempt ${attempt} threw (${describeErrorIdentity(error)}); full error retained at ${file}\n`,
         );
@@ -508,106 +506,31 @@ export async function runWithAutoResumeLoop<
       const terminal = (result as { terminal?: TerminalResult }).terminal;
       if (terminal !== undefined) {
         (terminal as { autoResumeCount?: number }).autoResumeCount = autoResumeAttempts;
-      }
-
-      const lawful = terminal !== undefined && isLawfulTypedTerminalOutcome(terminal.roleOutcome);
-      if (lawful) {
-        if (terminal !== undefined) {
-          // Present lawful terminal once to real io (dummy was used inside dispatch)
-          options.io.stdout(formatTerminalResult(terminal));
+        if (terminal.roleOutcome.kind === "failure") {
+          failedAttempts.push({
+            attempt: dispatchOrdinal - 1,
+            diagnostic: terminal.roleOutcome.diagnostic,
+            decisiveFacts: terminal.roleOutcome.decisiveFacts,
+          });
         }
-        return result;
-      }
-      if (result.skipAutoResume === true) {
-        if (terminal !== undefined) presentTerminal(terminal, options.io);
-        return result;
       }
-      // #855: process cancel — stop even if dispatch forgot skipAutoResume.
-      if (processCancelSignalName(options.signal) !== undefined) {
-        if (terminal !== undefined) presentTerminal(terminal, options.io);
-        return result;
-      }
-    }
 
-    if (result !== undefined) {
-      const terminal = (result as { terminal?: TerminalResult }).terminal;
-      if (autoResumeAttempts >= limit) {
-        if (terminal !== undefined) presentTerminal(terminal, options.io);
-        return result;
-      }
-      if (
-        result.turnDispatched === true
-        && !(await isPrincipalAvailable(options.admitted.principal))
-      ) {
-        if (terminal !== undefined) presentTerminal(terminal, options.io);
-        return result;
+      if (terminal !== undefined && isLawfulTypedTerminalOutcome(terminal.roleOutcome)
+        || result.skipAutoResume === true
+        || autoResumeAttempts >= limit
+        || processCancelSignalName(options.signal) !== undefined) {
+        stoppedResult = result;
+        break;
       }
     } else {
-      // Exception path: continue through the identical budget/session gates.
       if (autoResumeAttempts >= limit) {
-        const terminal = await attachDispatchExceptionTerminal(
-          options.admitted,
-          dispatchExceptionFailureTerminal({
-            role: options.admitted.role,
-            runId: options.admitted.runId,
-            causeError: lastThrownError,
-            errorFiles: retainedErrorFiles,
-            autoResumeAttempts,
-            endReason: "auto-resume budget exhausted",
-            everyAttemptThrew,
-          }),
-          options.io,
-        );
-        await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
-        presentTerminal(terminal, options.io);
-        return {
-          exitCode: 1,
-          terminal,
-        } as T;
+        endReason = "auto-resume budget exhausted";
+        break;
       }
-      // #855: process cancel on the throw path — do not re-dispatch; name the signal.
       const cancelName = processCancelSignalName(options.signal);
       if (cancelName !== undefined) {
-        const terminal = await attachDispatchExceptionTerminal(
-          options.admitted,
-          dispatchExceptionFailureTerminal({
-            role: options.admitted.role,
-            runId: options.admitted.runId,
-            causeError: lastThrownError,
-            errorFiles: retainedErrorFiles,
-            autoResumeAttempts,
-            endReason: `ak-role terminated by ${cancelName}`,
-            everyAttemptThrew,
-          }),
-          options.io,
-        );
-        await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
-        presentTerminal(terminal, options.io);
-        return {
-          exitCode: 1,
-          terminal,
-        } as T;
-      }
-      if (!(await isPrincipalAvailable(options.admitted.principal))) {
-        const terminal = await attachDispatchExceptionTerminal(
-          options.admitted,
-          dispatchExceptionFailureTerminal({
-            role: options.admitted.role,
-            runId: options.admitted.runId,
-            causeError: lastThrownError,
-            errorFiles: retainedErrorFiles,
-            autoResumeAttempts,
-            endReason: "session principal unavailable before further resume",
-            everyAttemptThrew,
-          }),
-          options.io,
-        );
-        await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
-        presentTerminal(terminal, options.io);
-        return {
-          exitCode: 1,
-          terminal,
-        } as T;
+        endReason = `ak-role terminated by ${cancelName}`;
+        break;
       }
     }
 
@@ -621,4 +544,39 @@ export async function runWithAutoResumeLoop<
       isFirst = false;
     }
   }
+
+  const terminal = stoppedResult === undefined
+    ? await attachDispatchExceptionTerminal(
+        options.admitted,
+        dispatchExceptionFailureTerminal({
+          role: options.admitted.role,
+          runId: options.admitted.runId,
+          causeError: lastThrownError,
+          errorFiles: retainedErrorFiles,
+          autoResumeAttempts,
+          endReason: endReason!,
+          everyAttemptThrew,
+        }),
+        options.io,
+      )
+    : stoppedResult.terminal;
+  if (stoppedResult === undefined) {
+    await finalizeExceptionRunBestEffort(options.admitted.runDirectory, options.io);
+  }
+  const complete: TerminalResult | undefined = terminal !== undefined && failedAttempts.length > 0
+    ? { ...terminal, roleOutcome: {
+      ...terminal.roleOutcome,
+      decisiveFacts: { ...terminal.roleOutcome.decisiveFacts, failedAttempts },
+    } } as TerminalResult
+    : terminal;
+  if (complete !== undefined) {
+    if (isLawfulTypedTerminalOutcome(complete.roleOutcome)) {
+      options.io.stdout(formatTerminalResult(complete));
+    } else {
+      presentTerminal(complete, options.io);
+    }
+  }
+  return stoppedResult === undefined
+    ? { exitCode: 1, terminal: complete } as T
+    : { ...stoppedResult, ...(complete === undefined ? {} : { terminal: complete }) } as T;
 }

package/src/public-cli/instruction-seat-run.ts

@@ -946,7 +946,7 @@ export async function runPublicInstructionSeatResume(
   };
   let binding: Awaited<ReturnType<typeof readAuditorResumeBinding>>;
   try {
-    const loaded = await loadResumablePublicRole(env.home, request.runId, env.principalAuthority, true);
+    const loaded = await loadResumablePublicRole(env.home, request.runId, env.principalAuthority);
     binding = loaded.admitted.role === "auditor"
       ? await readAuditorResumeBinding(loaded.admitted.runDirectory)
       : undefined;
@@ -1014,7 +1014,7 @@ export async function continueParentAfterChild(
   env: InstructionSeatRunEnv,
   io: CliIo,
 ): Promise<SeatRunResult> {
-  const loaded = await loadResumablePublicRole(env.home, parentRunId, env.principalAuthority, true);
+  const loaded = await loadResumablePublicRole(env.home, parentRunId, env.principalAuthority);
   if (loaded.run.state !== "admitted" && !AUDITED_ROLES.has(loaded.admitted.role)) {
     return runPublicInstructionSeatResume({ runId: parentRunId }, env, io);
   }
@@ -1215,7 +1215,7 @@ async function auditSubmittedRole(
         ?? (escalation?.runDirectory === undefined
           ? undefined : runIdFromRunDirectory(escalation.runDirectory));
       if (escalatedRunId === undefined) throw new Error("escalated audit has no resumable run identity");
-      const officer = await loadResumablePublicRole(env.home, escalatedRunId, env.principalAuthority, true);
+      const officer = await loadResumablePublicRole(env.home, escalatedRunId, env.principalAuthority);
       const terminal = await trySettlePublicSeat(officer.admitted, env.principalAuthority, undefined);
       if (terminal === undefined) throw new Error("escalated audit has no terminal result");
       io.stdout(formatTerminalResult(terminal));

package/src/public-cli/post-admission.ts

@@ -29,10 +29,7 @@ import { readRecordedSubmissionRows } from "../submission-ledger.ts";
 import { readDeclaredTicketNumber } from "../run-ticket-number.ts";
 import { pathContainedIn } from "../activation-ledger-topology.ts";
 import { pickEngineAxis } from "../package-resources/engine-material.ts";
-import {
-  readStoredHostSessionId,
-  resolveHostAwareSessionAvailability,
-} from "../session-identity.ts";
+import { readStoredHostSessionId } from "../session-identity.ts";
 import { rewriteRunDirectoryPathValue } from "../role-run-relocation.ts";
 
 import type {
@@ -525,17 +522,11 @@ export async function presentControlledFailure<
     ...(session === undefined ? {} : { session }),
   });
 
-  // #665 / #416: resume hint is seat-uniform — principal available && typed 429 → show.
-  // Do not fork the public terminal face on per-seat hasLawful / isResumableRole (ADR 0040).
-  let resumable = false;
-  const typedHttp429 = resumeObservation.typedHttp429;
-  if (admitted.principal !== undefined) {
-    const sessionPrincipalAvailable = await authority.isAvailable(admitted.principal);
-    resumable = sessionPrincipalAvailable && typedHttp429 !== undefined;
-  }
+  // #665 / #416: typed 429 with a run principal offers resume; the host decides availability.
+  const resumable = admitted.principal !== undefined && resumeObservation.typedHttp429 !== undefined;
 
   if (persistRunState && !failureInput.skipRunStateWrite) {
-    await persistReturnedRunState(admitted, authority);
+    await persistReturnedRunState(admitted);
   }
 
   let publishedErrorPath: string | undefined;
@@ -638,7 +629,7 @@ async function settleDeferredPersist<
   const { needsPersist: _needsPersist, ...settledResult } = result;
   const lawful = isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
   try {
-    await persistReturnedRunState(admitted, authority, lawful ? { lawful: true } : undefined);
+    await persistReturnedRunState(admitted, lawful ? { lawful: true } : undefined);
     return settledResult;
   } catch (error) {
     const failed = await settleAfterTurnStarted(
@@ -1136,7 +1127,7 @@ export async function dispatchPostAdmissionTurn<
       }
       if (persistRunState) {
         try {
-          await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
+          await persistReturnedRunState(admitted, { lawful: true });
         } catch (error) {
           await recordBestEffortPostDispatchDiagnostic(
             admitted,
@@ -1241,7 +1232,7 @@ export async function dispatchPostAdmissionTurn<
     }
     if (persistRunState) {
       try {
-        await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
+        await persistReturnedRunState(admitted, { lawful: true });
       } catch (error) {
         await recordBestEffortPostDispatchDiagnostic(
           admitted,
@@ -1634,10 +1625,6 @@ export async function runPostAdmissionSeatResume<
       return await runWithAutoResumeLoop({
         admitted: loaded.admitted,
         principalAuthority: env.principalAuthority,
-        isPrincipalAvailable: resolveHostAwareSessionAvailability(
-          env.host,
-          env.principalAuthority,
-        ),
         io: input.io,
         sessionAppender: env.sessionAppender,
         autoResumeLimit: env.autoResumeLimit,
@@ -1913,7 +1900,6 @@ export async function runPostAdmissionResumable<
   return runWithAutoResumeLoop({
     admitted,
     principalAuthority: env.principalAuthority,
-    isPrincipalAvailable: resolveHostAwareSessionAvailability(env.host, env.principalAuthority),
     io,
     sessionAppender: env.sessionAppender,
     autoResumeLimit: env.autoResumeLimit,

package/src/public-cli/run-lifecycle.ts

@@ -687,17 +687,6 @@ export async function clearCurrentCourt(
   });
 }
 
-/**
- * True when the host authority reports the durable principal available.
- * Resume must reopen this exact principal; directory-latest is not identity.
- */
-export async function isDurablePrincipalAvailable(
-  principal: DurablePrincipal,
-  authority: DurablePrincipalAuthority,
-): Promise<boolean> {
-  return authority.isAvailable(principal);
-}
-
 export class RunWriterLeaseHeldError extends Error {
   readonly code = "AK_RUN_WRITER_LEASE_HELD" as const;
   constructor(message = "role run writer lease is already held") {
@@ -1325,7 +1314,6 @@ async function loadResumableRunRecord(
   home: string,
   runId: string,
   authority: DurablePrincipalAuthority,
-  allowUnformedAdmitted = false,
 ): Promise<{
   readonly run: RoleRunRecord;
   readonly principal: DurablePrincipal;
@@ -1340,19 +1328,14 @@ async function loadResumableRunRecord(
   if (disk === undefined) {
     throw new CliUsageError(`unknown role run id: ${runId}`);
   }
-  // #416: removed terminal/resumable gates per owner decision "根本不要有限制" (2026-08-22).
-  // Only the exact Pi session principal check remains as honest failure.
+  // #416 / #1091: removed terminal/resumable and local session-file gates.
+  // The load seam locates the run and recovers identity; host CLI answers continuation.
   // One authority.decode of the uninterpreted wire yields both principal and record.
   const materialized = materializeRoleRunFromDisk(disk, authority);
   if (materialized === undefined) {
     throw new CliUsageError(`unknown role run id: ${runId}`);
   }
   const { run, principal } = materialized;
-  if (!(allowUnformedAdmitted && run.state === "admitted") && !(await isDurablePrincipalAvailable(principal, authority))) {
-    throw new CliUsageError(
-      `role run Pi session principal is unavailable: ${runId}`,
-    );
-  }
   // Reconstruct admitted identity from durable run record + admitted-request.json.
   let instruction = "";
   let instructionEmpty = true;
@@ -1755,9 +1738,8 @@ export async function loadResumablePublicRole(
   home: string,
   runId: string,
   authority: DurablePrincipalAuthority,
-  allowUnformedAdmitted = false,
 ): Promise<LoadedResumablePublicRole> {
-  const loaded = await loadResumableRunRecord(home, runId, authority, allowUnformedAdmitted);
+  const loaded = await loadResumableRunRecord(home, runId, authority);
   return seatLoadedResult(loaded, admitResumedRole(loaded));
 }
 

package/src/public-cli/settlement.ts

@@ -88,11 +88,7 @@ import {
   findLatestDurablePackagedRoleTerminal,
   hasNavigatorInfrastructureFailureBase,
   isAcceptedPackagedRoleTerminalResult,
-  isReceiptSettlementBindingClear,
-  NAVIGATOR_INVOCATION_ENTRY,
   NAVIGATOR_ROUTE_PLAYBOOK_FAILURE_ENTRY,
-  parseInvocationMarkerIdentity,
-  type InvocationMarkerIdentity,
 } from "../navigator-invocation-identity.ts";
 import {
   NO_RECEIPT_LIFECYCLE_ENTRY_TYPE,
@@ -1921,23 +1917,6 @@ export async function appendRunAttemptHistory(
   } catch {}
 }
 
-/**
- * Minimal attendance provenance against the bound marker (ADR 0043).
- * Keep only invocationId + post-terminal ordering. Runtime-self-produced
- * role/phase/subject/version are not re-reconciled here (ADR 0042).
- */
-function navigatorAttendanceCorrelatedWithBoundMarker(
-  details: Record<string, unknown>,
-  attendanceIndex: number,
-  terminalIndex: number,
-  marker: InvocationMarkerIdentity,
-): boolean {
-  if (attendanceIndex <= terminalIndex) return false;
-  // Exact current invocation token is the bound marker principal.
-  if (details.invocationId !== marker.invocationId) return false;
-  return true;
-}
-
 function parseNavigatorAttendanceDetails(
   details: Record<string, unknown>,
 ): TerminalNavigatorFact {
@@ -2216,10 +2195,9 @@ export function extractNavigatorFact(
 function extractNavigatorAttendanceFact(
   entries: readonly SessionEntry[],
 ): TerminalNavigatorFact {
-  // Affirmative attendance only. Missing / uncorrelated / unparseable is never no-advice.
-  // Minimal provenance: latest durable terminal + nearest preceding marker +
-  // invocationId + post-terminal order. Marker↔terminal cardinality belongs to
-  // receipt settlement (isReceiptSettlementBindingClear), not attendance extraction.
+  // Affirmative attendance only. Missing / unparseable is never no-advice.
+  // The shared lifecycle places the settled event on this submission's closure;
+  // an unrelated attendance message cannot supply another call's result.
   const terminal = findLatestDurablePackagedRoleTerminal(entries);
   if (terminal === undefined) {
     return {
@@ -2229,57 +2207,12 @@ function extractNavigatorAttendanceFact(
     };
   }
 
-  let markerIndex = -1;
-  for (let i = terminal.index - 1; i >= 0; i -= 1) {
-    const entry = entries[i];
-    if (entry?.type === "custom" && entry.customType === NAVIGATOR_INVOCATION_ENTRY) {
-      markerIndex = i;
-      break;
-    }
-  }
-  if (markerIndex < 0) {
-    return {
-      disposition: "unavailable",
-      source: "unknown",
-      reason: "Navigator attendance is uncorrelated with session invocation facts",
-    };
-  }
-  const marker = parseInvocationMarkerIdentity(entries[markerIndex]?.data);
-  if (marker === undefined) {
-    return {
-      disposition: "unavailable",
-      source: "unknown",
-      reason: "Navigator attendance is uncorrelated with session invocation facts",
-    };
-  }
-
-  for (let i = entries.length - 1; i >= 0; i -= 1) {
+  for (let i = terminal.index; i < entries.length; i += 1) {
     const entry = entries[i];
-    if (entry?.type === "custom_message" && entry.customType === "ak-navigator-attendance") {
-      const details = entry.message?.details ?? (entry as { details?: unknown }).details;
-      if (!isRecord(details)) {
-        return {
-          disposition: "unavailable",
-          source: "unknown",
-          reason: "Navigator attendance is unparseable",
-        };
-      }
-      if (
-        !navigatorAttendanceCorrelatedWithBoundMarker(
-          details,
-          i,
-          terminal.index,
-          marker,
-        )
-      ) {
-        return {
-          disposition: "unavailable",
-          source: "unknown",
-          reason: "Navigator attendance is uncorrelated with session invocation facts",
-        };
-      }
-      return parseNavigatorAttendanceDetails(details);
-    }
+    if (entry?.type !== "custom" || entry.customType !== "ak-role-submission-closure") continue;
+    const details = isRecord(entry.data) ? entry.data.navigator : undefined;
+    if (!isRecord(details)) break;
+    return parseNavigatorAttendanceDetails(details);
   }
   // Absence is not successful no-advice — require affirmative typed attendance.
   return {

package/src/public-cli/terminal.ts

@@ -278,8 +278,10 @@ export function formatTerminalResult(result: TerminalResult): string {
       `diagnostic\t${encodeTerminalField(result.roleOutcome.diagnostic)}`,
     );
   }
-  if (result.roleOutcome.kind === "failure" || result.roleOutcome.kind === "no_receipt" || result.roleOutcome.kind === "audit_escalation") {
-    const facts = result.roleOutcome.decisiveFacts ?? {};
+  if (result.roleOutcome.kind === "failure" || result.roleOutcome.kind === "no_receipt" || result.roleOutcome.kind === "audit_escalation" || result.roleOutcome.decisiveFacts?.failedAttempts !== undefined) {
+    const facts = result.roleOutcome.kind === "accepted"
+      ? { failedAttempts: result.roleOutcome.decisiveFacts?.failedAttempts }
+      : result.roleOutcome.decisiveFacts ?? {};
     for (const [key, value] of Object.entries(facts)) {
       if (value === undefined) continue;
       const rendered =

package/src/role-envelope.ts

@@ -78,8 +78,8 @@ export async function prepareRoleEnvelope(options: {
   readonly listTerminatingToolOnMcp?: boolean;
   /**
    * Durable principal session path (header layout only).
-   * Production passes DurablePrincipalAuthority.decode(principal).sessionFile so
-   * isAvailable and envelope mint the same file. Tests may omit → runDirectory default.
+   * Production passes DurablePrincipalAuthority.decode(principal).sessionFile.
+   * Tests may omit → runDirectory default.
    */
   readonly sessionFile?: string;
 }): Promise<PreparedRoleTurn> {
@@ -113,7 +113,7 @@ export async function prepareRoleEnvelope(options: {
   const runId = request.runDirectory.split("/").filter(Boolean).at(-1) ?? randomUUID();
   await mkdir(request.runDirectory, { recursive: true });
 
-  // Durable principal file for isAvailable / resumable settlement (public-cli).
+  // Durable principal file for package-owned session entries.
   // #617 DK-4: never host conversation/tool writeback into Pi JSONL.
   // #959: package-owned custom entries (invocation marker, submission-closure,
   // navigator attendance, no-receipt) MUST flush so parent settlement can read

package/src/role-runtime.ts

@@ -523,7 +523,7 @@ export async function projectClosedSubmissionLifecycle(
   context: HostContext,
   phase: NavigatorPhase,
   recordAccepted: () => void,
-  settle: (settlement: NavigatorSettlement | undefined) => Promise<void>,
+  settle: (settlement: NavigatorSettlement | undefined) => Promise<NavigatorEvent | undefined>,
 ): Promise<void> {
   recordAccepted();
   const closure = {
@@ -531,8 +531,17 @@ export async function projectClosedSubmissionLifecycle(
     isError: false,
     details: closed.accepted,
   };
-  context.sessionManager.appendCustomEntry?.("ak-role-submission-closure", closure);
-  await settle(publicNavigatorSettlement(closed.role, phase, closure));
+  let navigator: NavigatorEvent | undefined;
+  try {
+    navigator = await settle(publicNavigatorSettlement(closed.role, phase, closure));
+  } finally {
+    // A Navigator failure cannot erase an already accepted role closure.
+    // Missing attendance remains a typed unavailable at public settlement.
+    context.sessionManager.appendCustomEntry?.("ak-role-submission-closure", {
+      ...closure,
+      ...(navigator === undefined ? {} : { navigator }),
+    });
+  }
 }
 
 /**
@@ -1032,6 +1041,8 @@ export function createRoleRuntimeExtension(
     let navigatorAttendance: NavigatorAttendanceDependency | undefined;
     // #351: session-lifecycle owner for periodic OAuth refresh (orthogonal to role admission).
     let pendingNavigatorPresentation: { event: import("./navigator-attendance.ts").NavigatorEvent; report: import("./navigator-attendance.ts").NavigatorReport } | undefined;
+    let navigatorActivation = 0;
+    let navigatorDeliveryClosed = false;
     let pendingNavigatorSettlement: Promise<void> | undefined;
     let navigatorWorkContext: NavigatorWorkContext | undefined;
     let navigatorSessionParent: string | undefined;
@@ -1085,7 +1096,7 @@ export function createRoleRuntimeExtension(
       }
       void Promise.resolve(pending).then(undefined, recordDisposeFailure);
     };
-    const settleNavigatorProjection = async (settlement: NavigatorSettlement | undefined) => {
+    const settleNavigatorProjection = async (settlement: NavigatorSettlement | undefined): Promise<NavigatorEvent | undefined> => {
       const attendance = navigatorAttendance;
       if (settlement === undefined || attendance === undefined) return;
       const workContext = navigatorWorkContext;
@@ -1099,6 +1110,7 @@ export function createRoleRuntimeExtension(
         void settlePromise.catch(() => undefined);
         const raced = await raceNavigatorGrace(settlePromise, NAVIGATOR_POST_ROLE_GRACE_MS);
         if (raced.status !== "timeout") return;
+        navigatorDeliveryClosed = true;
         if (pendingNavigatorPresentation === undefined) {
           const report: NavigatorReport = {
             disposition: "unavailable",
@@ -1124,6 +1136,7 @@ export function createRoleRuntimeExtension(
       })();
       pendingNavigatorSettlement = pending;
       await pending;
+      return pendingNavigatorPresentation?.event;
     };
     projectClosedSubmission = async (closed, context) => projectClosedSubmissionLifecycle(
       closed,
@@ -1695,6 +1708,8 @@ export function createRoleRuntimeExtension(
       receiptDelivery = createReceiptDeliveryPolicy();
       noReceiptRecorded = false;
       pendingNavigatorPresentation = undefined;
+      navigatorActivation += 1;
+      navigatorDeliveryClosed = false;
       pendingNavigatorSettlement = undefined;
       pendingInfrastructureFailures.clear();
       pendingSubmissionNonPassByToolCallId.clear();
@@ -1811,6 +1826,7 @@ export function createRoleRuntimeExtension(
               });
             } catch {}
           }
+          const activation = navigatorActivation;
           navigatorAttendance = await dependencies.createNavigatorAttendance({
             context: ctx,
             role: entry.role,
@@ -1821,7 +1837,9 @@ export function createRoleRuntimeExtension(
             invocationId,
             ...(contextError === undefined ? {} : { contextError }),
             onEvent: (navigatorEvent, report) => {
-              pendingNavigatorPresentation = { event: navigatorEvent, report };
+              if (activation === navigatorActivation && !navigatorDeliveryClosed) {
+                pendingNavigatorPresentation = { event: navigatorEvent, report };
+              }
             },
           });
           // Concrete work context starts standby attendance (record only, no model).

package/src/session-identity.ts

@@ -42,28 +42,6 @@ export function createSessionIdentityAuthority(
   };
 }
 
-/**
- * Host-aware resumable-session probe (#840 P1). The shared auto-resume loop
- * (public-cli/auto-resume.ts) asks one question — "can this principal's turn
- * still be resumed" — without itself knowing which concrete host executed it.
- * Pi's own session.jsonl transcript (DurablePrincipalAuthority#isAvailable)
- * answers that only for the pi host; ACP and headless hosts persist their
- * resumable native session id under their own session-identity binding file
- * instead (#729 / #731 / #645) and never write session.jsonl, so the plain
- * pi check always reports them unavailable after one attempt. One lookup per
- * registered host family — no per-host-name branch, no per-seat whitelist.
- */
-export function resolveHostAwareSessionAvailability(
-  host: string | undefined,
-  principalAuthority: DurablePrincipalAuthority,
-): (principal: DurablePrincipal) => Promise<boolean> {
-  if (host === undefined || host === DEFAULT_ROLE_TURN_HOST) {
-    return (principal) => principalAuthority.isAvailable(principal);
-  }
-  // Unregistered names have no binding file: absence, not a guess at pi.
-  return async (principal) =>
-    (await readStoredHostSessionId(host, principalAuthority, principal)) !== undefined;
-}
 
 /**
  * Native session/thread id already stored for this principal on `host`.