@akagilnc/pi-workflow-roles 0.1.5375 → 0.1.5406

package/src/public-cli/settlement.ts

@@ -92,9 +92,10 @@ import {
 } from "../navigator-invocation-identity.ts";
 import {
   NO_RECEIPT_LIFECYCLE_ENTRY_TYPE,
-  RECEIPT_DELIVERY_TURN_LIMIT,
   noReceiptLifecycleFacts,
   parseNoReceiptLifecycleFacts,
+  priorReceiptContinuation,
+  receiptAttemptPointer,
   type NoReceiptLifecycleFacts,
 } from "../receipt-delivery-policy.ts";
 import type {
@@ -290,17 +291,101 @@ export async function attachRecordedSubmissions<T extends TerminalResult>(
  * Does not invent an output failure for an empty ledger.
  * #953: empty public terminal face — clear every reader-adoptable prior face.
  */
+/**
+ * Lifecycle fact the in-process runtime already wrote for this run and attempt.
+ * Absent, malformed, or a previous attempt's bytes are not a count.
+ */
+function lifecycleFactsFromEntry(entry: SessionEntry): unknown {
+  const customType = entry.customType ?? entry.message?.customType;
+  if (customType !== NO_RECEIPT_LIFECYCLE_ENTRY_TYPE) return undefined;
+  return entry.data ?? entry.message?.details;
+}
+
+async function readCurrentAttemptNoReceiptFacts(
+  admitted: AdmittedRoleInvocation,
+  authority: DurablePrincipalAuthority,
+  scope?: SettlementCourtScope,
+): Promise<NoReceiptLifecycleFacts | undefined> {
+  const { sessionFile } = coordinatesFromAdmitted(authority, admitted);
+  const entries = await readBoundSessionEntries(sessionFile).catch(() => undefined);
+  if (entries === undefined) return undefined;
+  const scopeId = scope?.invocationScopeId?.trim() ?? "";
+  if (scopeId.length > 0) {
+    const pointer = receiptAttemptPointer(admitted.runDirectory, scopeId);
+    let selected: NoReceiptLifecycleFacts | undefined;
+    for (const entry of entries) {
+      const raw = lifecycleFactsFromEntry(entry);
+      if (raw === undefined) continue;
+      try {
+        const facts = parseNoReceiptLifecycleFacts(raw);
+        if (facts.runPointer !== admitted.runDirectory) continue;
+        if (facts.attemptPointer !== pointer) continue;
+        if (selected === undefined || facts.deliveryTurns >= selected.deliveryTurns) {
+          selected = facts;
+        }
+      } catch {
+        // A malformed historical entry is not this call's count.
+      }
+    }
+    return selected;
+  }
+  let attemptStart = 0;
+  for (let index = entries.length - 1; index >= 0; index -= 1) {
+    if (entries[index]?.type === "message" && entries[index]?.message?.role === "user") {
+      attemptStart = index;
+      break;
+    }
+  }
+  const lifecycleEntry = entries.slice(attemptStart).reverse().find((entry: SessionEntry) =>
+    lifecycleFactsFromEntry(entry) !== undefined);
+  const raw = lifecycleEntry === undefined ? undefined : lifecycleFactsFromEntry(lifecycleEntry);
+  if (raw === undefined) return undefined;
+  let facts: NoReceiptLifecycleFacts;
+  try {
+    facts = parseNoReceiptLifecycleFacts(raw);
+  } catch {
+    return undefined;
+  }
+  if (facts.runPointer !== admitted.runDirectory) return undefined;
+  if (facts.attemptPointer !== receiptAttemptPointer(admitted.runDirectory)) return undefined;
+  return facts;
+}
+
 export async function settleHostEndedNoReceipt(
   admitted: AdmittedRoleInvocation,
   authority: DurablePrincipalAuthority,
   scope?: SettlementCourtScope,
+  /**
+   * #1132: delivery requests this run actually issued. Zero stays zero when
+   * nothing was sent and this attempt has no lifecycle fact. A fact already
+   * written for this run and attempt supplies the count when it is larger.
+   * The budget is never the count, and another loop's resumes are not催交.
+   */
+  issuedDeliveryRequests = 0,
 ): Promise<TerminalResult> {
+  const scopeId = scope?.invocationScopeId?.trim() ?? "";
+  const persisted = scopeId.length > 0
+    ? undefined
+    : await readCurrentAttemptNoReceiptFacts(admitted, authority, scope);
+  let terminalToolCalled = persisted?.terminalToolCalled ?? false;
+  let rejectedReceipts: readonly { reason: string }[] = persisted?.rejectedReceipts ?? [];
+  let recordedTurns = persisted?.deliveryTurns ?? 0;
+  if (scopeId.length > 0) {
+    const { sessionFile } = coordinatesFromAdmitted(authority, admitted);
+    const entries = await readBoundSessionEntries(sessionFile).catch(() => undefined);
+    if (entries !== undefined) {
+      const prior = priorReceiptContinuation(entries, scopeId);
+      terminalToolCalled = prior.terminalToolCalled;
+      rejectedReceipts = prior.rejectedReceipts;
+      recordedTurns = prior.deliveryTurns;
+    }
+  }
   const facts = noReceiptLifecycleFacts({
-    terminalToolCalled: false,
-    rejectedReceipts: [],
-    deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
+    terminalToolCalled,
+    rejectedReceipts,
+    deliveryTurns: Math.max(issuedDeliveryRequests, recordedTurns),
     runPointer: admitted.runDirectory,
-    attemptPointer: `current:${admitted.runDirectory}`,
+    attemptPointer: receiptAttemptPointer(admitted.runDirectory, scope?.invocationScopeId),
   });
   const coordinates = coordinatesFromAdmitted(authority, admitted);
   await clearOppositeTerminalArtifactFace(admitted.runDirectory);
@@ -3191,51 +3276,28 @@ export async function settleFailureTerminalResult(
   // current-attempt fact. Transcript reconstruction must not turn arbitrary output
   // failures (or bytes retained from a prior resume attempt) into exit zero.
   if (failure.cause === "output") {
-    const entries = await readBoundSessionEntries(sessionFile).catch(() => undefined);
-    if (entries !== undefined) {
-      let attemptStart = 0;
-      for (let index = entries.length - 1; index >= 0; index -= 1) {
-        if (entries[index]?.type === "message" && entries[index]?.message?.role === "user") { attemptStart = index; break; }
-      }
-      const lifecycleEntry = entries.slice(attemptStart).reverse().find((entry: SessionEntry) =>
-        entry.customType === NO_RECEIPT_LIFECYCLE_ENTRY_TYPE || entry.message?.customType === NO_RECEIPT_LIFECYCLE_ENTRY_TYPE);
-      const raw = lifecycleEntry?.data ?? lifecycleEntry?.message?.details;
-      if (raw !== undefined) {
-        // Catch only covers lifecycle-byte parse. Clear / navigator / gate I/O
-        // after a valid parse must keep their real failure identity (#953).
-        let facts: NoReceiptLifecycleFacts | undefined;
-        try {
-          facts = parseNoReceiptLifecycleFacts(raw);
-        } catch {
-          /* malformed lifecycle bytes remain the existing nonzero output failure */
-        }
-        if (
-          facts !== undefined &&
-          facts.runPointer === admitted.runDirectory &&
-          facts.attemptPointer === `current:${admitted.runDirectory}`
-        ) {
-          let decisiveFacts: NoReceiptLifecycleFacts & Record<string, unknown> = facts;
-          // #478: no_receipt is still a public Terminal — project accepted gate facts.
-          // #953: empty public terminal face — clear every reader-adoptable prior face.
-          await clearOppositeTerminalArtifactFace(admitted.runDirectory);
-          return withOptionalGateProjection(
-            {
-              roleOutcome: {
-                kind: "no_receipt",
-                role: admitted.role,
-                status: "no-accepted-receipt",
-                ...facts,
-                decisiveFacts,
-              },
-              navigator: await extractNavigatorFactFromAdmittedSession(sessionFile),
-              artifacts: [],
-              runId: admitted.runId,
-            },
-            sessionDirectory,
-            detourGateContext(admitted, options),
-          );
-        }
-      }
+    const facts = await readCurrentAttemptNoReceiptFacts(admitted, authority, options);
+    if (facts !== undefined) {
+      const decisiveFacts: NoReceiptLifecycleFacts & Record<string, unknown> = facts;
+      // #478: no_receipt is still a public Terminal — project accepted gate facts.
+      // #953: empty public terminal face — clear every reader-adoptable prior face.
+      await clearOppositeTerminalArtifactFace(admitted.runDirectory);
+      return withOptionalGateProjection(
+        {
+          roleOutcome: {
+            kind: "no_receipt",
+            role: admitted.role,
+            status: "no-accepted-receipt",
+            ...facts,
+            decisiveFacts,
+          },
+          navigator: await extractNavigatorFactFromAdmittedSession(sessionFile),
+          artifacts: [],
+          runId: admitted.runId,
+        },
+        sessionDirectory,
+        detourGateContext(admitted, options),
+      );
     }
   }
   // Exact-session attendance only — never infer no-advice from caller omission.

package/src/public-cli/terminal.ts

@@ -263,6 +263,19 @@ export function formatTerminalResult(result: TerminalResult): string {
       `diagnostic\t${encodeTerminalField(result.roleOutcome.diagnostic)}`,
     );
   }
+  // Accepted volumes do not dump decisiveFacts unless a failed attempt is
+  // recorded. The unsettled-direction fact still has to be visible on its own.
+  // audit_escalation already dumps every decisiveFact below.
+  if (
+    result.roleOutcome.kind === "accepted"
+    && result.roleOutcome.decisiveFacts?.directionUnsettled === true
+  ) {
+    lines.push("fact\tdirectionUnsettled\ttrue");
+    const subsequent = result.roleOutcome.decisiveFacts.subsequentAudit;
+    if (typeof subsequent === "string") {
+      lines.push(`fact\tsubsequentAudit\t${encodeTerminalField(subsequent)}`);
+    }
+  }
   if (result.roleOutcome.kind === "failure" || result.roleOutcome.kind === "no_receipt" || result.roleOutcome.kind === "audit_escalation" || result.roleOutcome.decisiveFacts?.failedAttempts !== undefined) {
     const facts = result.roleOutcome.kind === "accepted"
       ? { failedAttempts: result.roleOutcome.decisiveFacts?.failedAttempts }
@@ -337,11 +350,10 @@ export function formatTerminalResult(result: TerminalResult): string {
       lines.push(`recorded-submission\t${encodeTerminalField(rendered)}`);
     }
   } else {
-    const payloads =
-      result.roleOutcome.kind === "accepted" ||
+    const payloads = result.roleOutcome.kind === "accepted" ||
       result.roleOutcome.kind === "audit_escalation"
-        ? coalesceSubmissionRows(result.roleOutcome.payloads, result.submissions)
-        : result.submissions ?? [];
+      ? coalesceSubmissionRows(result.submissions, result.roleOutcome.payloads)
+      : result.submissions ?? [];
     for (let i = payloads.length - 1; i >= 0; i -= 1) {
       const payload = payloads[i]!;
       const rendered =

package/src/public-cli/turn-request.ts

@@ -70,7 +70,13 @@ export type RoleTurnRequestProjectionOptions = {
   /** #537 public-invocation scope (one ak-role call). */
   invocationScopeId?: string;
   /** Station child role run (#840): omit automatic navigator attendance. */
-  stationChild?: boolean;
+  readonly stationChild?: boolean;
+  /**
+   * #1132: the one effective delivery-request ceiling (#422 single resolve by
+   * the caller). Projected so the host adapter's own re-ask loop and the AK
+   * execution seam count with the same configured number.
+   */
+  readonly deliveryRequestLimit?: number;
 };
 
 export type AdmittedTurnInvocation = {
@@ -118,6 +124,9 @@ export function projectRoleTurnRequest(
       ? {}
       : { invocationScopeId: options.invocationScopeId }),
     ...(options.stationChild === undefined ? {} : { stationChild: options.stationChild }),
+    ...(options.deliveryRequestLimit === undefined
+      ? {}
+      : { deliveryRequestLimit: options.deliveryRequestLimit }),
   };
 }
 

package/src/receipt-delivery-policy.ts

@@ -1,14 +1,69 @@
+/**
+ * Shared accepted-receipt delivery budget for role, auditor, and Navigator sessions (#288).
+ *
+ * #1132: the ceiling is the one configured auto-resume value (public-cli.json
+ * top-level `autoResumeLimit`). This module owns no number of its own — the one
+ * package default stays with AUTO_RESUME_LIMIT (#422), and `deliveryTurns`
+ * records the delivery requests actually issued, never the budget
+ * (零次即记零，不把额度或其他续跑次数冒充催交次数).
+ */
+import { AUTO_RESUME_LIMIT } from "./public-cli/run-lifecycle.ts";
+import { parseAutoResumeLimit } from "./public-cli/config.ts";
 import { isRecord } from "./unknown-value.ts";
-/** Shared accepted-receipt delivery budget for role, auditor, and Navigator sessions (#288). */
-export const RECEIPT_DELIVERY_TURN_LIMIT = 2 as const;
 
 export const NO_RECEIPT_LIFECYCLE_ENTRY_TYPE = "ak-no-receipt-lifecycle" as const;
 
+/** One in-process催交 send, tagged with the public call that issued it. */
+export const RECEIPT_DELIVERY_REQUEST_ENTRY = "ak-receipt-delivery-request" as const;
+
+/** A rejection observed by the output-tool hook, bound before any delivery turn. */
+export const RECEIPT_REJECTION_ENTRY = "ak-receipt-rejection" as const;
+
+/**
+ * Facts of one public call. A call with an invocation scope does not share
+ * `current:<runDirectory>` with the previous call on the same run.
+ */
+export function receiptAttemptPointer(runPointer: string, invocationScopeId?: string): string {
+  const scope = invocationScopeId?.trim() ?? "";
+  if (scope.length > 0) return `invocation:${scope}`;
+  return `current:${runPointer}`;
+}
+
+/** Child-process transport for the effective ceiling (#1132). */
+export const RECEIPT_DELIVERY_LIMIT_ENV = "AK_ROLE_RECEIPT_DELIVERY_LIMIT" as const;
+
+/**
+ * The effective receipt-delivery ceiling: the caller's already-resolved
+ * configured value, else the single package default. Domain-validated at this
+ * one seam (#422) so NaN/negative/fractional/Infinity never silently disable
+ * or bypass the comparison downstream.
+ */
+export function deliveryLimitFromConfig(value: number | undefined): number {
+  return parseAutoResumeLimit(value ?? AUTO_RESUME_LIMIT);
+}
+
+/** Effective ceiling for an in-child role runtime reading its own env (#1132). */
+export function deliveryLimitFromEnv(env: NodeJS.ProcessEnv): number {
+  const raw = env[RECEIPT_DELIVERY_LIMIT_ENV];
+  if (raw === undefined || raw.trim() === "") return deliveryLimitFromConfig(undefined);
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed)) return deliveryLimitFromConfig(undefined);
+  return deliveryLimitFromConfig(parsed);
+}
+
+function deliveryTurnsFact(value: unknown): number {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new TypeError("deliveryTurns must be a non-negative integer");
+  }
+  return value;
+}
+
 /** The sole schema shared by lifecycle owners and Terminal projections. */
 export type NoReceiptLifecycleFacts = {
   terminalToolCalled: boolean;
   rejectedReceipts: readonly { reason: string; diagnosticAvailable: boolean }[];
-  deliveryTurns: typeof RECEIPT_DELIVERY_TURN_LIMIT;
+  /** Delivery requests actually issued on this run (#1132 — not a budget). */
+  deliveryTurns: number;
   sessionCompletion: "settled-without-accepted-receipt";
   runPointer: string;
   attemptPointer: string;
@@ -19,7 +74,6 @@ export type NoReceiptLifecycleFacts = {
 export function parseNoReceiptLifecycleFacts(input: unknown): NoReceiptLifecycleFacts {
   if (!isRecord(input)
     || typeof input.terminalToolCalled !== "boolean"
-    || input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT
     || input.sessionCompletion !== "settled-without-accepted-receipt"
     || input.acceptedReceipt !== false
     || typeof input.runPointer !== "string" || input.runPointer.trim() === ""
@@ -35,7 +89,7 @@ export function parseNoReceiptLifecycleFacts(input: unknown): NoReceiptLifecycle
       reason: item.reason as string,
       diagnosticAvailable: (item.reason as string).trim() !== "",
     })),
-    deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
+    deliveryTurns: deliveryTurnsFact(input.deliveryTurns),
     sessionCompletion: "settled-without-accepted-receipt",
     runPointer: input.runPointer,
     attemptPointer: input.attemptPointer,
@@ -43,22 +97,24 @@ export function parseNoReceiptLifecycleFacts(input: unknown): NoReceiptLifecycle
   };
 }
 
+/**
+ * #1132: exhaustion is the caller's decision — the receipt-delivery loop only
+ * settles after its budget is actually spent — so this records the issued
+ * count verbatim instead of demanding it equal a package constant.
+ */
 export function noReceiptLifecycleFacts(
   input: Omit<NoReceiptLifecycleFacts, "rejectedReceipts" | "deliveryTurns" | "sessionCompletion" | "acceptedReceipt"> & {
     rejectedReceipts: readonly { reason: string }[];
     deliveryTurns: number;
   },
 ): NoReceiptLifecycleFacts {
-  if (input.deliveryTurns !== RECEIPT_DELIVERY_TURN_LIMIT) {
-    throw new TypeError("no-receipt lifecycle requires an exhausted delivery budget");
-  }
   return {
     terminalToolCalled: input.terminalToolCalled,
     rejectedReceipts: input.rejectedReceipts.map(({ reason }) => ({
       reason,
       diagnosticAvailable: reason.trim() !== "",
     })),
-    deliveryTurns: RECEIPT_DELIVERY_TURN_LIMIT,
+    deliveryTurns: deliveryTurnsFact(input.deliveryTurns),
     sessionCompletion: "settled-without-accepted-receipt",
     runPointer: input.runPointer,
     attemptPointer: input.attemptPointer,
@@ -66,39 +122,66 @@ export function noReceiptLifecycleFacts(
   };
 }
 
-export function createReceiptDeliveryPolicy() {
+export function createReceiptDeliveryPolicy(limit?: number) {
+  const deliveryLimit = deliveryLimitFromConfig(limit);
   let accepted = false;
+  let closed = false;
   let terminalToolCalled = false;
+  /** Requests actually sent. Rejections and a nested close do not invent sends. */
   let deliveryTurns = 0;
+  /** Stop counter. Separate from the issued-count fact (#1132). */
+  let budgetSpent = 0;
   const rejectedReceipts: { reason: string; diagnosticAvailable: boolean }[] = [];
+  const spend = (): void => {
+    if (budgetSpent < deliveryLimit) budgetSpent += 1;
+  };
   return {
+    /** The effective ceiling this budget spends (#1132 — never re-read). */
+    limit: deliveryLimit,
     recordAccepted() {
       accepted = true;
       terminalToolCalled = true;
     },
     /** Infrastructure owns terminality and must never trigger receipt催交. */
     stopForInfrastructure() { accepted = true; },
+    /**
+     * Record the rejection this turn already produced.
+     * The fact does not spend a budget. The seam that sends the next prompt
+     * owns that count.
+     */
     recordRejected(reason: string) {
       terminalToolCalled = true;
       rejectedReceipts.push({ reason, diagnosticAvailable: reason.trim() !== "" });
-      deliveryTurns = Math.min(RECEIPT_DELIVERY_TURN_LIMIT, deliveryTurns + 1);
     },
     recordDeliveryRequest() {
-      deliveryTurns = Math.min(RECEIPT_DELIVERY_TURN_LIMIT, deliveryTurns + 1);
+      deliveryTurns += 1;
+      spend();
     },
     /**
-     * A nested session settled without an accepted receipt after spending its own
-     * delivery budget. Adopt its facts and close this budget: another prompt would
-     * open an independent session, not a delivery request on the settled one.
+     * Stop asking. The issued count stays whatever was actually sent (#1132 —
+     * do not fill the remainder up to the ceiling).
+     */
+    closeBudget() { closed = true; },
+    /**
+     * A nested session settled without an accepted receipt. Close so this layer
+     * does not open another prompt on that session. The issued count stays the
+     * larger of the two seams: a nested zero must not wipe prompts this layer
+     * already sent, and adding the two counts would bill one send twice.
      */
     recordNestedNoReceipt(facts: NoReceiptLifecycleFacts) {
       terminalToolCalled = terminalToolCalled || facts.terminalToolCalled;
       rejectedReceipts.push(...facts.rejectedReceipts);
-      deliveryTurns = RECEIPT_DELIVERY_TURN_LIMIT;
+      deliveryTurns = Math.max(deliveryTurns, facts.deliveryTurns);
+      closed = true;
     },
     nextAction(): "accepted" | "request-delivery" | "no-receipt" {
       if (accepted) return "accepted";
-      return deliveryTurns < RECEIPT_DELIVERY_TURN_LIMIT ? "request-delivery" : "no-receipt";
+      if (closed) return "no-receipt";
+      return budgetSpent < deliveryLimit ? "request-delivery" : "no-receipt";
+    },
+    /** Delivery requests actually issued so far (#1132). */
+    issuedDeliveryRequests(): number {
+      return deliveryTurns;
     },
     /** Current typed delivery facts. No prose. */
     deliveryState() {
@@ -112,5 +195,114 @@ export function createReceiptDeliveryPolicy() {
     facts(binding: { runPointer: string; attemptPointer: string }): NoReceiptLifecycleFacts {
       return noReceiptLifecycleFacts({ terminalToolCalled, rejectedReceipts: [...rejectedReceipts], deliveryTurns, ...binding });
     },
+    /**
+     * Continue a public call after the in-memory policy was rebuilt.
+     * Sends already issued spend the same budget; copied rejections keep
+     * the fact and do not spend again.
+     */
+    continueIssued(prior: {
+      readonly deliveryTurns: number;
+      readonly rejectedReceipts: readonly { reason: string }[];
+      readonly terminalToolCalled?: boolean;
+    }) {
+      for (const receipt of prior.rejectedReceipts) {
+        this.recordRejected(receipt.reason);
+      }
+      if (prior.terminalToolCalled === true) terminalToolCalled = true;
+      for (let index = 0; index < prior.deliveryTurns; index += 1) {
+        this.recordDeliveryRequest();
+      }
+    },
+  };
+}
+
+function entryRecord(entry: unknown): Record<string, unknown> | undefined {
+  return isRecord(entry) ? entry : undefined;
+}
+
+/** Sends, observed rejections, and the latest lifecycle fact for this public call. */
+export type ReceiptContinuation = {
+  readonly deliveryTurns: number;
+  readonly rejectedReceipts: readonly { reason: string }[];
+  readonly terminalToolCalled: boolean;
+};
+
+function customTypeOf(record: Record<string, unknown>, message: Record<string, unknown> | undefined): unknown {
+  return record.customType ?? message?.customType;
+}
+
+function dataOf(record: Record<string, unknown>, message: Record<string, unknown> | undefined): unknown {
+  return record.data ?? message?.details;
+}
+
+/** Scope id carried by a delivery request or an invocation-scoped lifecycle fact. */
+function scopeTag(record: Record<string, unknown>): string | undefined {
+  const message = isRecord(record.message) ? record.message : undefined;
+  const customType = customTypeOf(record, message);
+  const data = dataOf(record, message);
+  if (
+    (customType === RECEIPT_DELIVERY_REQUEST_ENTRY || customType === RECEIPT_REJECTION_ENTRY)
+    && isRecord(data)
+    && typeof data.invocationScopeId === "string"
+    && data.invocationScopeId.trim() !== ""
+  ) {
+    return data.invocationScopeId;
+  }
+  if (customType !== NO_RECEIPT_LIFECYCLE_ENTRY_TYPE) return undefined;
+  try {
+    const facts = parseNoReceiptLifecycleFacts(data);
+    const prefix = "invocation:";
+    if (!facts.attemptPointer.startsWith(prefix)) return undefined;
+    const scope = facts.attemptPointer.slice(prefix.length);
+    return scope.trim() === "" ? undefined : scope;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Restore only facts explicitly bound to this public call, never inferred from dialogue. */
+export function priorReceiptContinuation(
+  entries: Iterable<unknown>,
+  invocationScopeId: string,
+): ReceiptContinuation {
+  const pointer = receiptAttemptPointer("", invocationScopeId);
+  let entryTurns = 0;
+  let factTurns = 0;
+  let rejectedReceipts: { reason: string }[] = [];
+  let snapshotTerminal = false;
+  for (const entry of entries) {
+    const record = entryRecord(entry);
+    if (record === undefined) continue;
+    const tagged = scopeTag(record);
+    if (tagged !== undefined) {
+      const message = isRecord(record.message) ? record.message : undefined;
+      const customType = customTypeOf(record, message);
+      if (tagged !== invocationScopeId) continue;
+      if (customType === RECEIPT_DELIVERY_REQUEST_ENTRY) entryTurns += 1;
+      if (customType === RECEIPT_REJECTION_ENTRY) {
+        const data = dataOf(record, message);
+        if (isRecord(data) && typeof data.reason === "string") rejectedReceipts.push({ reason: data.reason });
+      }
+      if (customType !== NO_RECEIPT_LIFECYCLE_ENTRY_TYPE) continue;
+      try {
+        const facts = parseNoReceiptLifecycleFacts(dataOf(record, message));
+        if (facts.attemptPointer !== pointer) continue;
+        factTurns = Math.max(factTurns, facts.deliveryTurns);
+        // Snapshots include all preceding observations. Replay later events,
+        // rather than treating their free-text reasons as deduplication keys.
+        if (facts.rejectedReceipts.length >= rejectedReceipts.length) {
+          rejectedReceipts = facts.rejectedReceipts.map(({ reason }) => ({ reason }));
+        }
+        snapshotTerminal ||= facts.terminalToolCalled;
+      } catch {
+        // A malformed historical entry is not this call's count.
+      }
+      continue;
+    }
+  }
+  return {
+    deliveryTurns: Math.max(entryTurns, factTurns),
+    rejectedReceipts,
+    terminalToolCalled: snapshotTerminal || rejectedReceipts.length > 0,
   };
 }

package/src/reviewer-role.ts

@@ -1,12 +1,9 @@
-import type { RoleHost, HostContext, HostToolResult } from "./host-contracts.ts";
-import { Type } from "typebox";
-import { openToolObject } from "./open-tool-schema.ts";
-import { withTerminatingOutputDeclarations } from "./package-contracts/terminating-infrastructure.ts";
+import type { RoleHost, HostContext } from "./host-contracts.ts";
 
-import { REVIEWER_OUTPUT_TOOL_NAME, type ReviewerIntent } from "./package-contracts/reviewer-output.ts";
+import { registerFiledSubmissionTool } from "./filed-submission.ts";
+import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 
-export { REVIEWER_OUTPUT_TOOL_NAME };
-export type { ReviewerIntent };
+export { REVIEWER_OUTPUT_TOOL_NAME, reviewerOutputSchema, type ReviewerIntent } from "./package-contracts/reviewer-output.ts";
 
 /** Frozen admitted inputs the behavior layer may consume — no flag surface. */
 export type ReviewerAdmittedInputs = Readonly<{
@@ -17,25 +14,6 @@ export type ReviewerAdmittedInputs = Readonly<{
   ticketNumber?: number;
 }>;
 
-const REVIEWER_AMENDMENTS_DESCRIPTION =
-  "已运行 lens 的 amendments 承载 candidates、逐条处置与 verdict 的完整报告（非仅 verdict 行）；显式单轴时另一轴可省略（completeness / correctness）。hard-stop／usage error 为 refused 时，已产出报告仍照录对应 lens 字段。" as const;
-// #1134: `status` alone is the trajectory field (#917 §6 two normal lens verdicts →
-// completed; hard-stop / usage error → refused); its words ride the description.
-// amendments/diagnostic are LLM/human-read narrative content returned as
-// submitted — declaration keeps name + semantic description only, no nested
-// object shape, no string type, no required constraint.
-const REVIEWER_STATUS_DESCRIPTION =
-  "completed | refused。两种正常 lens verdict（completeness / correctness）均 completed；hard-stop 与 usage error 为 refused（已产出报告仍照录进所选 lens amendments）。" as const;
-const reviewerOutputObject = Type.Object({
-  status: Type.Unknown({ description: REVIEWER_STATUS_DESCRIPTION }),
-  amendments: Type.Unknown({ description: REVIEWER_AMENDMENTS_DESCRIPTION }),
-  diagnostic: Type.Unknown({
-    description: "拒绝诊断说明；hard-stop／usage error 原因进此字段，已产出报告另照录 amendments",
-  }),
-});
-export const reviewerOutputSchema = withTerminatingOutputDeclarations(
-  openToolObject(reviewerOutputObject),
-);
 export type ReviewerRoleDependencies = {
   loadSoul(): Promise<string>;
 };
@@ -70,15 +48,9 @@ export function createReviewerRoleRuntime(
 
       if (!registered) {
         registered = true;
-        pi.registerTool({ name: REVIEWER_OUTPUT_TOOL_NAME, label: "御史台输出", description: "提交御史台终局回执。", promptSnippet: "提交御史台终局回执", parameters: reviewerOutputSchema,
-          async execute(_id: string, parameters: unknown): Promise<HostToolResult<unknown>> {
-            if (!soul) throw new Error("御史台输入未装载");
-            return {
-              content: [],
-              details: parameters,
-              terminate: true as const,
-            };
-          } });
+        registerFiledSubmissionTool(pi, roleSubmissionDeclaration("reviewer"), {
+          readyError: () => (soul === undefined || soul.length === 0 ? "御史台输入未装载" : undefined),
+        });
       }
       const activatedSoul = soul;
       const activatedBase = fixedBaseRevision;

package/src/role-envelope.ts

@@ -19,6 +19,7 @@ import type {
   RoleTurnRequest,
 } from "./host-contracts.ts";
 import { packagedRoleOutputTool } from "./packaged-role-registry.ts";
+import { deliveryLimitFromConfig } from "./receipt-delivery-policy.ts";
 import {
   createRoleRuntimeExtension,
   type RoleRuntimeDependencies,
@@ -250,7 +251,10 @@ export async function prepareRoleEnvelope(options: {
     startKeepalive() {},
     stopKeepalive() {},
   };
-  createRoleRuntimeExtension(options.dependencies)(envelope);
+  createRoleRuntimeExtension(
+    options.dependencies,
+    deliveryLimitFromConfig(options.request.deliveryRequestLimit),
+  )(envelope);
 
   const token = randomUUID();
   const server = createServer((socket) => serveSocket(socket));

package/src/role-runtime-dependencies.ts

@@ -64,6 +64,7 @@ export function createRoleRuntimeDependencies(packageRoot: string): RoleRuntimeD
       authority: options.authority,
       invocationId: options.invocationId,
       createSession: navigatorSessionFactory,
+      ...(options.deliveryRequestLimit === undefined ? {} : { deliveryRequestLimit: options.deliveryRequestLimit }),
       ...(options.contextError === undefined ? {} : { contextError: options.contextError }),
       onEvent: options.onEvent,
     }),