@akagilnc/pi-workflow-roles 0.1.5375 → 0.1.5406

package/dist/submission-gate.js

@@ -1,6 +1,8 @@
 import { bookDirectOfficerRunPointer } from "./archivist-record-pointer.js";
 import { GatekeeperDecisionError, officerConclusionReask, projectGatekeeperRun, } from "./gatekeeper-role.js";
-/** Queue word of the latest this-terminal payload. History does not outrank it. */
+import { receivedDiscriminator } from "./submission-errors.js";
+import { deliveryLimitFromConfig } from "./receipt-delivery-policy.js";
+/** Received discriminator of the latest payload, retained verbatim for re-ask. */
 export function latestQueueStatus(terminal) {
     const outcome = terminal?.roleOutcome;
     if (outcome === undefined)
@@ -10,14 +12,10 @@ export function latestQueueStatus(terminal) {
     if (outcome.kind !== "accepted")
         return undefined;
     const latest = outcome.payloads?.[outcome.payloads.length - 1];
-    if (isRecord(latest)) {
-        const status = latest.status;
-        if (typeof status === "string" && status.trim() !== "")
-            return status;
+    if (isRecord(latest) && Object.hasOwn(latest, "status")) {
+        return receivedDiscriminator(latest, "status");
     }
-    return typeof outcome.status === "string" && outcome.status.trim() !== ""
-        ? outcome.status
-        : undefined;
+    return outcome.status;
 }
 export function latestQueuePayload(terminal) {
     const outcome = terminal?.roleOutcome;
@@ -57,7 +55,7 @@ export function createDefaultGateOfficerSummon(options) {
  * Book a typed pointer under parent session/auditor-roles (archivist-owned write).
  * Offline mocks without a real session leave no nested volume (lawful zero).
  */
-function bookDirectOfficerPointer(context, officer, result, summoned) {
+function bookDirectOfficerPointer(context, officer, result, summoned, toolCallId) {
     if (result.status !== "converged"
         && result.status !== "continue"
         && result.status !== "escalate"
@@ -80,16 +78,20 @@ function bookDirectOfficerPointer(context, officer, result, summoned) {
         ...(typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== ""
             ? { runDirectory: summoned.runDirectory }
             : {}),
+        ...(toolCallId.trim() === "" ? {} : { submissionToolCallId: toolCallId }),
     });
 }
 /**
  * Shared envelope: project gate, book officer pointer, map onto host actions.
- * Review loop has no round cap (#753 no-round-cap).
+ * A real converged / continue / escalate returns immediately. An unreadable
+ * conclusion reasks that officer against the configured ceiling; exhaustion
+ * returns the receipt actually received.
  * On converged, returns the officer snapshot (receipt + nested runId) for seat projection.
  */
 export async function requireSubmissionGate(options) {
     let reask;
-    // No round cap — end only on converged, continue/escalate, or real failure.
+    let reasksSpent = 0;
+    const reaskLimit = deliveryLimitFromConfig(options.autoResumeLimit);
     const summonOfficer = options.summonOfficer ??
         createDefaultGateOfficerSummon({
             cwd: options.context.cwd ?? process.cwd(),
@@ -107,7 +109,7 @@ export async function requireSubmissionGate(options) {
         // Envelope-owned pointer book. Failure is host infrastructure — single face.
         if (projected.summoned !== undefined) {
             try {
-                bookDirectOfficerPointer(options.context, projected.officer, gatekeeper, projected.summoned);
+                bookDirectOfficerPointer(options.context, projected.officer, gatekeeper, projected.summoned, options.toolCallId);
             }
             catch (error) {
                 options.hostActions.failInfrastructure(error, options.context, options.toolCallId);
@@ -134,6 +136,24 @@ export async function requireSubmissionGate(options) {
             };
         }
         if (gatekeeper.status === "needs_reask") {
+            if (reasksSpent >= reaskLimit) {
+                return {
+                    status: "needs_reask",
+                    officer: projected.officer,
+                    receipt: gatekeeper.receipt,
+                    ...(typeof gatekeeper.runId === "string" && gatekeeper.runId.trim() !== ""
+                        ? { runId: gatekeeper.runId }
+                        : {}),
+                    ...(typeof projected.summoned?.runDirectory === "string"
+                        && projected.summoned.runDirectory.trim() !== ""
+                        ? { runDirectory: projected.summoned.runDirectory }
+                        : {}),
+                    ...(projected.summoned?.terminal === undefined
+                        ? {}
+                        : { terminal: projected.summoned.terminal }),
+                };
+            }
+            reasksSpent += 1;
             reask = officerConclusionReask(gatekeeper.receivedStatus);
             continue;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5375",
+  "version": "0.1.5406",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/archivist-record-pointer.ts

@@ -1,5 +1,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { isRecord } from "./unknown-value.ts";
 
 /** Typed parent-side pointer to an independent officer run 正本 (ADR 0079 / #675). */
 export const DIRECT_OFFICER_RUN_POINTER_KIND = "direct-officer-run-pointer" as const;
@@ -12,6 +14,11 @@ export type DirectOfficerRunPointer = {
   readonly sessionFile: string;
   /** Officer run directory when known. */
   readonly runDirectory?: string;
+  /**
+   * Parent submission tool call this officer run was summoned for.
+   * Absent on pointers booked before that binding existed.
+   */
+  readonly submissionToolCallId?: string;
 };
 
 /**
@@ -28,9 +35,11 @@ export function bookDirectOfficerRunPointer(options: {
   readonly officer: "inspector" | "notary" | "auditor" | "countersign";
   readonly sessionFile: string;
   readonly runDirectory?: string;
+  readonly submissionToolCallId?: string;
 }): DirectOfficerRunPointer {
   const nest = join(dirname(options.parentSessionFile), "auditor-roles");
   mkdirSync(nest, { recursive: true });
+  const submissionToolCallId = options.submissionToolCallId?.trim() ?? "";
   const pointer: DirectOfficerRunPointer = {
     version: 1,
     kind: DIRECT_OFFICER_RUN_POINTER_KIND,
@@ -39,6 +48,7 @@ export function bookDirectOfficerRunPointer(options: {
     ...(options.runDirectory !== undefined && options.runDirectory.trim() !== ""
       ? { runDirectory: options.runDirectory }
       : {}),
+    ...(submissionToolCallId === "" ? {} : { submissionToolCallId }),
   };
   writeFileSync(
     join(nest, `${options.officer}.pointer.json`),
@@ -47,3 +57,41 @@ export function bookDirectOfficerRunPointer(options: {
   );
   return pointer;
 }
+
+/**
+ * Read the one officer pointer. Missing or unreadable is not a pass:
+ * the caller re-runs the gate.
+ */
+export async function readDirectOfficerRunPointer(
+  parentSessionFile: string,
+  officer: DirectOfficerRunPointer["officer"],
+): Promise<DirectOfficerRunPointer | undefined> {
+  try {
+    const raw: unknown = JSON.parse(await readFile(
+      join(dirname(parentSessionFile), "auditor-roles", `${officer}.pointer.json`),
+      "utf8",
+    ));
+    if (!isRecord(raw) || raw.kind !== DIRECT_OFFICER_RUN_POINTER_KIND || raw.version !== 1) {
+      return undefined;
+    }
+    if (raw.officer !== officer) return undefined;
+    if (typeof raw.sessionFile !== "string" || raw.sessionFile.trim() === "") return undefined;
+    const runDirectory = typeof raw.runDirectory === "string" && raw.runDirectory.trim() !== ""
+      ? raw.runDirectory
+      : undefined;
+    const submissionToolCallId = typeof raw.submissionToolCallId === "string"
+      && raw.submissionToolCallId.trim() !== ""
+      ? raw.submissionToolCallId
+      : undefined;
+    return {
+      version: 1,
+      kind: DIRECT_OFFICER_RUN_POINTER_KIND,
+      officer,
+      sessionFile: raw.sessionFile,
+      ...(runDirectory === undefined ? {} : { runDirectory }),
+      ...(submissionToolCallId === undefined ? {} : { submissionToolCallId }),
+    };
+  } catch {
+    return undefined;
+  }
+}

package/src/auditor-role.ts

@@ -3,8 +3,8 @@
  */
 import {
   AUDITOR_OUTPUT_TOOL_NAME,
-  auditorOutputSchema,
 } from "./package-contracts/auditor-output.ts";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 
 export { AUDITOR_OUTPUT_TOOL_NAME };
 
@@ -12,10 +12,4 @@ export type AuditorRuntimeDependencies = {
   loadSoul(): Promise<string>;
 };
 
-export const AUDITOR_TOOL_SPEC = {
-  name: AUDITOR_OUTPUT_TOOL_NAME,
-  label: "审刑院输出",
-  description: "审刑院终局回执，status 为 converged、continue 或 escalate。",
-  promptSnippet: "审刑院终局回执",
-  parameters: auditorOutputSchema,
-} as const;
+export const AUDITOR_TOOL_SPEC = roleSubmissionDeclaration("auditor");

package/src/collector-role.ts

@@ -3,8 +3,9 @@
  * #1088: code no longer observes/requests/merges GitHub findings — the LLM
  * uses host CLI tools. Envelope owns host-surface + construction seatbelt.
  */
-import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
-import type { Static } from "typebox";
+import type { RoleHost, HostContext } from "./host-contracts.ts";
+import { registerFiledSubmissionTool } from "./filed-submission.ts";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 
 import {
   emptyCollectorManifest,
@@ -17,8 +18,6 @@ import {
 import {
   COLLECTOR_OUTPUT_TOOL,
 } from "./package-contracts/collector-output.ts";
-import { collectorOutputArgsSchema } from "./collector-tool-schemas.ts";
-
 export { COLLECTOR_OUTPUT_TOOL };
 
 export const COLLECTOR_REQUIRED_TOOLS = [COLLECTOR_OUTPUT_TOOL] as const;
@@ -54,8 +53,6 @@ export const COLLECTOR_TRANSPORT_FLAGS = Object.freeze([
   }),
 ] as const);
 
-const outputSchema = collectorOutputArgsSchema;
-type OutputParams = Static<typeof outputSchema>;
 
 export type CollectorRoleDependencies = {
   loadSoul(): Promise<string>;
@@ -164,28 +161,8 @@ export function createCollectorRoleRuntime(
       if (toolsRegistered) return;
       toolsRegistered = true;
 
-      pi.registerTool({
-        name: COLLECTOR_OUTPUT_TOOL,
-        label: "通进司输出",
-        description: "提交通进司回执。",
-        promptSnippet: "提交通进司回执",
-        parameters: outputSchema,
-        async execute(
-          _toolCallId: string,
-          params: OutputParams,
-          _signal: AbortSignal | undefined,
-          _onUpdate: unknown,
-          _ctx: HostContext,
-        ): Promise<HostToolResult<unknown>> {
-          const activation = getActivation();
-          if (activation === undefined) throw new Error("通进司未激活");
-          // #1088 / #836: record as submitted — runtime does not merge findings.
-          return {
-            content: [],
-            details: params,
-            terminate: true as const,
-          };
-        },
+      registerFiledSubmissionTool(pi, roleSubmissionDeclaration("collector"), {
+        readyError: () => (getActivation() === undefined ? "通进司未激活" : undefined),
       });
     },
   };

package/src/compliance-transport.ts

@@ -8,14 +8,16 @@ import { officerConclusionReask } from "./gatekeeper-role.ts";
 import { receivedDiscriminator } from "./submission-errors.ts";
 import { coalesceSubmissionRows } from "./public-cli/terminal.ts";
 import { readableGateItem } from "./readable-gate-item.ts";
+import { deliveryLimitFromConfig } from "./receipt-delivery-policy.ts";
 import { isRecord } from "./unknown-value.ts";
 
 export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt"; usage?: Usage };
 /**
  * #757 / #750: no unreadable/unusable judgment on auditor replies.
  * Known three-state (converged/continue/escalate) is read for queueing only.
- * Unknown accepted shape rides as `received` with the raw reply — parent stands,
- * no forged pass, no shape-death label. Resume-speaker for three pairs is #753/#756.
+ * Unknown accepted shape rides as `received` with the raw reply. The summon
+ * loop reasks until the configured ceiling, then keeps that reply. No forged
+ * pass, no shape-death label.
  */
 export type ComplianceReceived = {
   readonly status: "received";
@@ -120,6 +122,8 @@ export type RunComplianceAuditOptions = {
   submission?: unknown;
   runDirectory?: string | undefined;
   signal?: AbortSignal;
+  /** This loop's ceiling. Absent uses the package default. */
+  autoResumeLimit?: number;
   /** Test seam — production uses summonPublicRole({ role: "auditor", argv: ["--subject", subject, "--source-run", …] }). */
   summonAuditor?: AuditorSummon;
 };
@@ -224,10 +228,14 @@ export async function runComplianceAudit(options: RunComplianceAuditOptions): Pr
       });
     });
   let reask: string | undefined;
+  let reasksSpent = 0;
+  const reaskLimit = deliveryLimitFromConfig(options.autoResumeLimit);
   for (;;) {
     const summoned = await summon(subject, runDirectory, options.signal, reask, submission);
     const decision = await projectAuditorTerminal(summoned);
     if (decision.status === "received") {
+      if (reasksSpent >= reaskLimit) return decision;
+      reasksSpent += 1;
       reask = officerConclusionReask(receivedDiscriminator(decision.reply, "status"));
       continue;
     }

package/src/countersign-role.ts

@@ -1,4 +1,5 @@
 import { reviewSubmissionSchema } from "./review-submission.ts";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 import {
   COUNTERSIGN_OUTPUT_TOOL_NAME,
   validateRecordedCountersignOutput,
@@ -26,10 +27,4 @@ export type CountersignRuntimeDependencies = {
  * 决定工具规格。生命周期装配（注册、activate、prompt 注入、singleton 检查、
  * terminate）归注册信封 owner——src/role-runtime.ts（ADR 0018 / #572 R2 判词）。
  */
-export const COUNTERSIGN_TOOL_SPEC = {
-  name: COUNTERSIGN_OUTPUT_TOOL_NAME,
-  label: "给事中输出",
-  description: "给事中决议。",
-  promptSnippet: "给事中决议",
-  parameters: countersignVerdictSchema,
-} as const;
+export const COUNTERSIGN_TOOL_SPEC = roleSubmissionDeclaration("countersign");

package/src/diarist-contracts.ts

@@ -7,6 +7,10 @@
  * #901: LLM submits bounds; the mechanical layer projects source bytes.
  */
 
+import { Type } from "typebox";
+
+import { openToolObject } from "./open-tool-schema.ts";
+import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import {
   projectTicketProvenanceSessions,
   type TicketProvenanceSession,
@@ -88,3 +92,36 @@ export function projectDiaristTicketSessions(
   }
   return Array.from(perTicket, ([ticketNumber, sessions]) => ({ ticketNumber, sessions }));
 }
+
+/**
+ * 起居郎交卷形状。
+ * #901：交边界（sessions）；正文与不可解析原字节由机械投影。
+ * status 的合法词（completed | escalate）写在 description，结算认这些词。
+ * sessions / ticketSessions 是投影所读的边界：卷路径或端点读不出时走既有 reask，不中止本轮。
+ * 声明只留字段名和语义说明，不留类型、嵌套、长度、必填。
+ */
+const DIARIST_SESSIONS_DESCRIPTION =
+  "对话边界。每卷含 path（会话卷绝对或可读路径）与 ranges（本卷本轮各区间）。每段区间含 from / to；起点与终点各写 id（原生 id）或 line（本轮行号），二选一。空列表＝本轮无对话可划。端点无法指名时走 reask，不中止。" as const;
+
+export const diaristOutputSchema = withTerminatingOutputDeclarations(
+  openToolObject(
+    Type.Object({
+      status: Type.Unknown({
+        description: "completed | escalate",
+      }),
+      ticketNumber: Type.Optional(
+        Type.Unknown({
+          description:
+            "本庭对象票号（正整数）或 null/省略＝真无票；下游走 typed 键；认不出用 status=escalate，不洗成无录。机械层不重判。",
+        }),
+      ),
+      reason: Type.Unknown({
+        description: "status 为 escalate 时：认不出本庭对象的原因",
+      }),
+      sessions: Type.Optional(Type.Unknown({ description: DIARIST_SESSIONS_DESCRIPTION })),
+      ticketSessions: Type.Unknown({
+        description: `多票庭逐票对话边界；每票含 ticketNumber（本条边界所归票号，正整数）与 sessions（${DIARIST_SESSIONS_DESCRIPTION}）。一次交卷各票各自分录。与单票 sessions 二选一。`,
+      }),
+    }),
+  ),
+);

package/src/diarist-role.ts

@@ -1,53 +1,20 @@
 import type { Static } from "typebox";
-import { Type } from "typebox";
 
-import { openToolObject } from "./open-tool-schema.ts";
-import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
 import {
   DIARIST_OUTPUT_TOOL_NAME,
+  diaristOutputSchema,
   validateRecordedDiaristOutput,
   type DiaristOutput,
 } from "./diarist-contracts.ts";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 
 export {
   DIARIST_OUTPUT_TOOL_NAME,
+  diaristOutputSchema,
 } from "./diarist-contracts.ts";
 export type { DiaristOutput };
 export { validateRecordedDiaristOutput };
 
-/**
- * 起居郎交卷形状。
- * #901：交边界（sessions）；正文与不可解析原字节由机械投影。
- * status 的合法词（completed | escalate）写在 description，结算认这些词。
- * sessions / ticketSessions 是投影所读的边界：卷路径或端点读不出时走既有 reask，不中止本轮。
- * 声明只留字段名和语义说明，不留类型、嵌套、长度、必填。
- */
-const DIARIST_SESSIONS_DESCRIPTION =
-  "对话边界。每卷含 path（会话卷绝对或可读路径）与 ranges（本卷本轮各区间）。每段区间含 from / to；起点与终点各写 id（原生 id）或 line（本轮行号），二选一。空列表＝本轮无对话可划。端点无法指名时走 reask，不中止。" as const;
-
-export const diaristOutputSchema = withTerminatingOutputDeclarations(
-  openToolObject(
-    Type.Object({
-      status: Type.Unknown({
-        description: "completed | escalate",
-      }),
-      ticketNumber: Type.Optional(
-        Type.Unknown({
-          description:
-            "本庭对象票号（正整数）或 null/省略＝真无票；下游走 typed 键；认不出用 status=escalate，不洗成无录。机械层不重判。",
-        }),
-      ),
-      reason: Type.Unknown({
-        description: "status 为 escalate 时：认不出本庭对象的原因",
-      }),
-      sessions: Type.Optional(Type.Unknown({ description: DIARIST_SESSIONS_DESCRIPTION })),
-      ticketSessions: Type.Unknown({
-        description: `多票庭逐票对话边界；每票含 ticketNumber（本条边界所归票号，正整数）与 sessions（${DIARIST_SESSIONS_DESCRIPTION}）。一次交卷各票各自分录。与单票 sessions 二选一。`,
-      }),
-    }),
-  ),
-);
-
 export type DiaristOutputParameters = Static<typeof diaristOutputSchema>;
 
 export type DiaristRuntimeDependencies = {
@@ -57,11 +24,4 @@ export type DiaristRuntimeDependencies = {
 /**
  * 决定工具规格。生命周期装配归注册信封 owner——src/role-runtime.ts（ADR 0018）。
  */
-export const DIARIST_TOOL_SPEC = {
-  name: DIARIST_OUTPUT_TOOL_NAME,
-  label: "起居郎输出",
-  description:
-    "起居郎交单票 sessions 或多票逐票 ticketSessions 边界；认不出本庭对象则 escalate。",
-  promptSnippet: "起居郎交边界",
-  parameters: diaristOutputSchema,
-} as const;
+export const DIARIST_TOOL_SPEC = roleSubmissionDeclaration("diarist");

package/src/doctor-auditor.ts

@@ -16,6 +16,8 @@ export type DoctorAuditOptions = {
   context: HostContext;
   submission: unknown;
   signal?: AbortSignal;
+  /** Same ceiling the public execution seam already resolved. */
+  autoResumeLimit?: number;
   /** Same seam as runComplianceAudit options — offline tracers only. */
   summonAuditor?: AuditorSummon;
 };
@@ -39,6 +41,7 @@ export function createPiDoctorAuditor(): (options: DoctorAuditOptions) => Promis
         ? {}
         : { runDirectory: auditorRunDirectory(options.context) }),
       ...(options.signal === undefined ? {} : { signal: options.signal }),
+      ...(options.autoResumeLimit === undefined ? {} : { autoResumeLimit: options.autoResumeLimit }),
       ...(options.summonAuditor === undefined ? {} : { summonAuditor: options.summonAuditor }),
     });
   };

package/src/doctor-role.ts

@@ -1,7 +1,9 @@
-import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
+import type { RoleHost, HostContext } from "./host-contracts.ts";
+import { registerFiledSubmissionTool } from "./filed-submission.ts";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 import { ComplianceResponseRetentionError } from "./compliance-transport.ts";
 import { DOCTOR_CANDIDATE_ENTRY_TYPE } from "./dossier-resolution.ts";
-import { DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_DESCRIPTION, DOCTOR_OUTPUT_TOOL_NAME, DoctorEvidenceStore, doctorEvidenceReadSchema, doctorSubmissionSchema, validateDoctorOutput, type DoctorCase } from "./doctor-contracts.ts";
+import { DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME, DoctorEvidenceStore, doctorEvidenceReadSchema, validateDoctorOutput, type DoctorCase } from "./doctor-contracts.ts";
 
 import { sitianReport } from "./sitian-facade.ts";
 
@@ -36,15 +38,18 @@ export function createDoctorRoleRuntime(pi: RoleHost, dependencies: DoctorRoleDe
   let activation: { soul: string; patient: DoctorCase; store: DoctorEvidenceStore } | undefined; let registered = false; pi.registerFlag(DOCTOR_CASE_FLAG.name, DOCTOR_CASE_FLAG.definition);
   return { async activate() { const path = pi.getFlag(DOCTOR_CASE_FLAG.name); if (typeof path !== "string" || !path.trim()) throw new Error("Doctor requires --ak-doctor-case"); const soul = (await dependencies.loadSoul()).trim(); if (!soul) throw new Error("Doctor soul is empty"); const patient = await dependencies.loadCase(path); activation = { soul, patient, store: new DoctorEvidenceStore(patient) };
     if (!registered) { registered = true; pi.registerTool({ name: DOCTOR_EVIDENCE_TOOL_NAME, label: "太医署证据", description: "分页读取留存的 Pi session 字节。", parameters: doctorEvidenceReadSchema, async execute(_id: string, params: { evidenceId: string; offset?: number; limit?: number }) { if (!activation) throw new Error("太医署未激活"); const details = activation.store.read(params.evidenceId, params.offset, params.limit); return { content: [{ type: "text" as const, text: JSON.stringify(details) }], details }; } });
-      pi.registerTool({ name: DOCTOR_OUTPUT_TOOL_NAME, label: "太医署输出", description: DOCTOR_OUTPUT_TOOL_DESCRIPTION, parameters: doctorSubmissionSchema, async execute(id: string, params: unknown, _signal: AbortSignal | undefined, _update: unknown, ctx: HostContext): Promise<HostToolResult<unknown>> {
-        if (!activation) throw new Error("太医署未激活");
-        const active = activation;
-        const testimony = validateDoctorOutput(params, active.patient, active.store);
-        try {
-          appendCandidate(ctx, { version: 1, testimony, cost: active.patient.cost, readRecord: active.store.readRecord(), patientIdentity: active.patient.identity });
-        } catch (error) { host.failInfrastructure(error, ctx, id); }
-        return { content: [], details: testimony, terminate: true };
-      } });
+      registerFiledSubmissionTool(pi, roleSubmissionDeclaration("doctor"), {
+        readyError: () => (activation === undefined ? "太医署未激活" : undefined),
+        beforeAccept: async ({ toolCallId, parameters, ctx }) => {
+          if (activation === undefined) throw new Error("太医署未激活");
+          const active = activation;
+          const testimony = validateDoctorOutput(parameters, active.patient, active.store);
+          try {
+            appendCandidate(ctx, { version: 1, testimony, cost: active.patient.cost, readRecord: active.store.readRecord(), patientIdentity: active.patient.identity });
+          } catch (error) { host.failInfrastructure(error, ctx, toolCallId); }
+          return testimony;
+        },
+      });
       pi.on("before_agent_start", (event) => { if (!activation) throw new Error("太医署未激活"); const catalog = { version: activation.patient.version, identity: activation.patient.identity, admittedMetrics: { cost: activation.patient.cost }, lawfulTargetKeys: ["case", ...activation.patient.cost.invocations.sources], evidence: activation.patient.evidence.map(({ id, kind, sha256, byteLength, contentLength }) => ({ id, kind, sha256, byteLength, contentLength })) }; return { systemPrompt: `${event.systemPrompt}\n\n<doctor_soul>\n${activation.soul}\n</doctor_soul>\n\n<doctor_case>\n${JSON.stringify(catalog)}\n</doctor_case>` }; }); }
     const required = [DOCTOR_EVIDENCE_TOOL_NAME, DOCTOR_OUTPUT_TOOL_NAME]; const names = pi.getAllTools().map((tool) => tool.name); for (const name of required) if (names.filter((item) => item === name).length !== 1) throw new Error(`Doctor required tool collision or missing: ${name}`); pi.setActiveTools(required); const active = pi.getActiveTools?.() ?? required; if (active.length !== 2 || !required.every((name) => active.includes(name))) throw new Error("Doctor active tool narrowing failed"); } };
 }

package/src/engine-detour-usage.ts

@@ -329,15 +329,16 @@ export function sessionFileFromSessionDirectory(sessionDirectory: string): strin
 }
 
 /**
- * Mint one public-invocation scope id when an engine is mounted.
+ * Mint one public-invocation scope id.
  * Call once at the public-entry boundary — never inside the auto-resume loop.
- * The id lives on RoleTurnRequest / HostContext only (no detour sidecar file).
+ * Auto-resume reuses it; an explicit new public call, including manual resume,
+ * mints another. The id lives on RoleTurnRequest / HostContext only.
+ * Receipt facts and detour rows both use this id, including calls with no
+ * engine mounted — a missing engine must not merge two public calls.
  */
-export function mintEngineDetourInvocationScope(input: {
+export function mintEngineDetourInvocationScope(_input: {
   readonly effectiveEngine?: string;
-}): string | undefined {
-  const engine = input.effectiveEngine?.trim();
-  if (engine === undefined || engine.length === 0) return undefined;
+}): string {
   return randomUUID();
 }
 

package/src/external-host-turn-loop.ts

@@ -1,6 +1,6 @@
 /**
  * Middle external-host role-turn loop (#820 / ADR 0082).
- * One copy: serial, abort merge/race, 8-round closeRound retry,
+ * One copy: serial, abort merge/race, closeRound re-ask rounds,
  * host-aborted, round-limit. Last hop = ExternalHostTurnDriver (four verbs).
  */
 import type {
@@ -10,11 +10,10 @@ import type {
   RoleTurnResult,
 } from "./host-contracts.ts";
 import type { PreparedRoleTurn } from "./prepared-role-turn.ts";
-
+import { deliveryLimitFromConfig } from "./receipt-delivery-policy.ts";
+import { isOneShotWorkerReminderCode } from "./submission-errors.ts";
 import { errorText } from "./unknown-value.ts";
 
-export const EXTERNAL_ROLE_TURN_ROUND_LIMIT = 8 as const;
-
 export type ExternalPreparedTurn = Pick<PreparedRoleTurn, "prompt" | "abortSignal" | "closeRound">;
 
 export type ExternalHostRoundOutcome =
@@ -144,8 +143,14 @@ export async function driveExternalRoleTurnRounds(
   let prompt = prepared.prompt;
   const abortSignal = mergeRoleTurnAbortSignals(prepared.abortSignal, request.signal);
   let stderr = "";
-
-  for (let attempt = 0; attempt < EXTERNAL_ROLE_TURN_ROUND_LIMIT; attempt += 1) {
+  // #1132: the first round is the initial delivery. Each later counted re-ask
+  // spends the configured ceiling. The one commit reminder and the one prefix
+  // reminder are not counted re-asks (ADR 0066/0070).
+  const countedReaskLimit = deliveryLimitFromConfig(request.deliveryRequestLimit);
+  const exemptReminders = new Set<string>();
+  let countedReasks = 0;
+
+  for (let attempt = 0; ; attempt += 1) {
     if (abortSignal?.aborted) return settleHostAborted(prepared, driver.currentSessionId());
 
     let round: ExternalHostRoundOutcome;
@@ -168,15 +173,22 @@ export async function driveExternalRoleTurnRounds(
       return { code: 0, stderr, timedOut: false };
     }
     if ("failure" in closure) return asFailure(closure.failure, stderr);
+    const reminderCode = closure.retry.code;
+    const exempt = isOneShotWorkerReminderCode(reminderCode) && !exemptReminders.has(reminderCode);
+    if (exempt) exemptReminders.add(reminderCode);
+    else {
+      countedReasks += 1;
+      if (countedReasks > countedReaskLimit) {
+        return asFailure({
+          cause: "output",
+          identity: { name: driver.roundLimitName, code: "round-retry-limit" },
+          ...(driver.currentSessionId() === undefined ? {} : { details: { sessionId: driver.currentSessionId() } }),
+        });
+      }
+    }
     prompt = closure.retry.message;
     driver.afterRetry?.();
   }
-
-  return asFailure({
-    cause: "output",
-    identity: { name: driver.roundLimitName, code: "round-retry-limit" },
-    ...(driver.currentSessionId() === undefined ? {} : { details: { sessionId: driver.currentSessionId() } }),
-  });
 }
 
 export function createSerializedRoleTurnHost(

package/src/filed-submission.ts

@@ -0,0 +1,44 @@
+import type { HostContext, HostToolResult, RoleHost } from "./host-contracts.ts";
+import type { RoleSubmissionDeclaration } from "./role-submission-declarations.ts";
+
+export type FiledSubmissionBeforeAccept = (input: {
+  readonly toolCallId: string;
+  readonly parameters: unknown;
+  readonly signal: AbortSignal | undefined;
+  readonly ctx: HostContext;
+}) => Promise<unknown>;
+
+/**
+ * One host-neutral submission execute for every public seat.
+ * Records nothing itself — the ledger seam already appends the original payload.
+ * Ends this tool call. Does not summon an auditor and does not end the role run.
+ * Shape is not an admission gate (ADR 0055). Seat reminders stay on beforeAccept.
+ */
+export function registerFiledSubmissionTool(
+  roleHost: RoleHost,
+  tool: RoleSubmissionDeclaration,
+  options: {
+    readonly readyError: () => string | undefined;
+    readonly beforeAccept?: FiledSubmissionBeforeAccept;
+  },
+): void {
+  roleHost.registerTool({
+    name: tool.name,
+    label: tool.label,
+    description: tool.description,
+    ...(tool.promptSnippet === undefined ? {} : { promptSnippet: tool.promptSnippet }),
+    parameters: tool.parameters as never,
+    async execute(toolCallId, parameters, signal, _onUpdate, ctx): Promise<HostToolResult<unknown>> {
+      const blocked = options.readyError();
+      if (blocked !== undefined) throw new Error(blocked);
+      const projected = options.beforeAccept === undefined
+        ? undefined
+        : await options.beforeAccept({ toolCallId, parameters, signal, ctx });
+      return {
+        content: [],
+        details: projected === undefined ? parameters : projected,
+        terminate: true as const,
+      };
+    },
+  });
+}