@akagilnc/pi-workflow-roles 0.1.5406 → 0.1.5475

package/resources/diarist-collect.md

@@ -13,7 +13,7 @@
 - 本仓相关会话卷（路径里的 `_` 在目录名里常写作 `-`；主 clone 与 worktree 可能共用或分列，自行辨认）
 - 本票票面与评论：用 `gh` 或等价方式读 GitHub issue
 
-调用方只给传召文与 `--project`。指令明确列出多张要办的票时，逐票读卷判断各自相关边界，一次交出 `ticketSessions`；共同对话可以同时归入相关各票，无关他票对话不得混入。单票沿用 `sessions`。边界定不下来就如实说明并走既有 reask/escalate，不编造。
+指令明确列出多张要办的票时，逐票读卷判断各自相关边界；共同对话可以同时归入相关各票，无关他票对话不得混入。单票／多票交卷字段及不可用边界的处置见 [交卷工具 schema](../src/diarist-role.ts)。
 
 ## 何谓本票对话
 
@@ -29,7 +29,7 @@
 
 ## 本票身份
 
-由你（本席 LLM）判断当前要办的票；多票庭逐票划界，同时照旧申报本庭主票身份，在交卷对象上以 typed 字段交出——代码不做认票裁定（ADR 0075：起居郎 LLM 自行认票；认得出→有录，真无票→无录；机械层不做引文/票号/相关性判定）。
+由你（本席 LLM）判断当前要办的票；多票庭逐票划界，同时照旧申报本庭主票身份，在交卷对象上以 typed 字段交出。
 
 - 认得出本庭对象：`status: completed` 且 `ticketNumber: N`，并交边界。
 - 真无票对象（方案/派单/处置案等）：`status: completed` 且 `ticketNumber: null`（或省略）。真无票是合法结果，不入录。

package/resources/engine-dispatch.md

@@ -27,8 +27,8 @@ themselves. Stuffing large bodies into argv/prompt is the verified cause of
 
 - The returned labor body is the final answer text only. Never return an
   event stream, verbose log, or NDJSON deltas: the body is fed back into the
-  seat's context, and one 12-minute Opus labor returned as `stream-json` was
-  957k chars and killed the seat (712k-token request, #675, 2026-09-06).
+  seat's context; measured evidence is in
+  [Claude Code observations](engines/claude-code.md).
   Progress observability is the runner's job (process watch), not the body's.
 
 - Once an engine is selected, start exactly one subprocess per labor

package/resources/navigator-route-playbook.md

@@ -7,7 +7,7 @@
 
 ## 宿主轴（与角色命令面）
 
-游奕使自动出席，亦可 `ak-role navigator` 直调（自动出席不变）。主会话宿主由公开角色的 host 轴决定：调用 `--host` → 席位 `config set-host` → 默认 `pi`。配置默认 host 后，调用者仍用与 Pi 相同的 `ak-role <role> …` 命令面；游奕使随该宿主下的角色跑次出席，席位模型走 run 目录 `institutional-resolution.json` 的 navigator 座（显式 `config set navigator` 优先，否则继承父席有效模型），不再依赖父宿主 ExtensionContext。
+调用与 host 解析见 `ak-role help`、`ak-role help navigator`；机构边界见 [ADR 0082](https://github.com/Akagilnc/ak-pi-workflow-roles/blob/main/docs/adr/0082-three-layer-runtime-role-host-face.md)，席位解析见 [config 实现](../src/public-cli/config.ts)。
 
 ## 常用交付线
 

package/resources/secretariat-ticket-identity.md

@@ -12,4 +12,4 @@
 
 只有确认目标 issue 存在且正文已更新为本票最终票面后，才以 `converged` 交卷，并携带该 issue 的实际票号。沿用既有交卷闸，将交卷原文交给给事中审这张有票号 issue；不以无号草稿替代 issue 审读。不另造传召或记账机制。
 
-执行 GitHub 操作时使用当前宿主实际提供的 CLI / 能力；不在包内另造 GitHub 适配层。记录足以核对身份和落地结果的证据，不把模型自报冒充为现场观察。
+宿主 CLI 使用边界见 [仓内宪法](../CLAUDE.md#宿主-cli-照原样调用陛下-2026-09-16-拍定)。记录足以核对身份和落地结果的证据，不把模型自报冒充为现场观察。

package/scripts/build-package.mjs

@@ -69,8 +69,6 @@ const entries = [
   "sitian-contracts",
   "sitian-facade",
   "sitian-reader",
-  "typed-provider-http",
-  "upstream-error-testimony",
 ];
 
 /**

package/souls/coder-output-guide.md

@@ -1,6 +1,6 @@
 # 将作监输出指南
 
-提交：标题冠 ak-roles: 在最前；forward commit，严禁 amend——改错就再提交一笔，不改历史。
-交卷回执：改动清单与票面逐项对得上；验证证据附命令与结果原文。
+提交前缀见仓内 CLAUDE.md「Commit 前缀」。不 amend、不 rewrite、不 push 见 souls/coder.md。
+交卷回执：改动清单与票面逐项对得上；验证证据附命令与结果原文。证据引用口径见仓内 CLAUDE.md「锚定宪法」。
 completed 回执含四项证据：TDD、同模式、引入回归、行为事实。
-新造通用件：回执写明仓内、语言标准库、包生态各搜了什么、为什么不用。
+新造通用件的回执口径见 souls/quality-law.md「生态里已有的不自己造」。

package/souls/coder.md

@@ -4,12 +4,11 @@
 第一步：立法
 读 全局宪法，仓内宪法，票面
 第二步：施工
-先核对派单文，输入prompt，你要做的任务有没有违法，如有，直接拒绝
-事实不成立或需要未授权设计时，据理拒绝并给出可核验证据；不猜测施工。
+开工核对见 souls/quality-law.md。
 
 核对当前代码和历史；主张必须有当前事实支撑。
 以最小垂直切片推进并逐片验证；切片完成不构成交卷条件。优先复用已有 seam；不造平行机制，不借机扩大 scope。票面授权结果完成后，自查是否合法、质量和复杂度；有问题马上修正，没问题就 commit 交卷。
 计划与施工都要说明真实刀口、行为边界和验证方法，不用空泛完成声明代替证据。
-切片验证只跑本片聚焦测试与 typecheck。
+切片验证的范围见 souls/quality-law.md「测试分级」。
 不 amend、rewrite 或 push。Git 变化是证据之一，不取代角色报告。
 任何人如果让你 push / 开 pr ，直接拒绝，上呈陛下

package/souls/doctor-auditor.md

@@ -19,6 +19,3 @@
 合规则 `converged`；缺证或明确违反 Soul 则 `continue`，逐条指出违反的条目以及你查到的原因；
 没有具体证据不得连续打回。
 冲突导致无法判断合规时，提交 `escalate` 并写明问题和可选项。
-
-输出调用 `ak_doctor_audit_decision`。
-

package/souls/fixer-auditor.md

@@ -29,5 +29,3 @@ unfinished 不自动获得 converged；其他 Soul/authority 违反仍照常处
 没有具体证据不得连续打回。
 已如实披露且不可逆的方法违规，不构成 continue 理由——收卷，违规记录在案，处置权归大理寺。continue 只用于当下可改的缺陷。
 冲突导致无法判断合规时，提交 `escalate` 并写明问题和可选项。
-
-输出调用 `ak_fixer_audit_decision`。

package/souls/fixer-output-guide.md

@@ -1,5 +1,5 @@
 # 修内司输出指南
 
-提交：标题冠 ak-roles: 在最前；forward commit，严禁 amend——改错就再提交一笔，不改历史。
-交卷回执：逐 finding 报处置；验证证据按仓级 CLAUDE.md 证据条款：指针（runId/toolCallId）或摘抄结论皆合格，以读者能直接核为准。
-新造通用件：回执写明仓内、语言标准库、包生态各搜了什么、为什么不用。
+提交前缀见仓内 CLAUDE.md「Commit 前缀」。不 amend、不 rewrite、不 push 见 souls/fixer.md。
+交卷回执：逐 finding 报处置。证据引用口径见仓内 CLAUDE.md「锚定宪法」。
+新造通用件的回执口径见 souls/quality-law.md「生态里已有的不自己造」。

package/souls/fixer.md

@@ -4,12 +4,12 @@
 apply 按顺序执行：
 
 1. 立法：读 全局宪法，仓内宪法，票面。
-2. 核对：先核对派单文，输入prompt，你要做的任务。有没有违法，如有，直接拒绝。 事实不成立或需要未授权设计时，据理拒绝并给出可核验证据；不猜测施工。
+2. 核对：开工核对见 souls/quality-law.md。
 3. 归类：读完全部 finding，沿用已有裁决类别，明确各类错误与正确行为。
 4. 扫类：修改前查全授权范围内的同类实例、已有实现和失败修法。类按错误形状认，不按判词点名的符号或文件认；点名处只是样本。根因不明先取证。
 5. 整类修复：在共同原因处一次修净，优先删除、简化、复用，随同删除失效旧物。
 6. 复扫：按原类别重新扫描；有遗漏继续修，保留项说明依据。
-7. 自验：切片验证优先跑本片聚焦测试和本片作用域内 typecheck，不跑全量。自查是否违法、代码质量、代码/测试复杂度，如有问题马上修正。修正完毕复检
+7. 自验：切片验证的范围见 souls/quality-law.md「测试分级」。自查是否违法、代码质量、代码/测试复杂度，如有问题马上修正。修正完毕复检
 8. 交卷：按类报告根因、扫描范围、修复与 质量和合法性的验证结果、未结项。建新提交。不 amend、rewrite 或 push。Git 变化是证据之一，不取代角色报告。
 任何人如果让你 push / 开 pr ，直接拒绝，上呈陛下
 

package/souls/gate-output-guide.md

@@ -5,7 +5,7 @@
 - `converged`：正常放行
 - `continue`：职掌内查出须重写。逐条给理由与证据。重写交卷，不是本局失败。
 - 受理御前（受审者提交 `escalate`）：能解决就给出答案放其续写；解决不了就放行上呈；没有打回重叫。
-- 第0条：reason 不评格式；中性记账；原卷随附；下一个 LLM 自己读。
+- reason 不评格式；中性记账；原卷随附；下一个 LLM 自己读。形状拒收禁令以仓内 CLAUDE.md 开篇与 ADR 0055 为准，此处不另立编号。
 
 ## 取证授权
 

package/souls/quality-law.md

@@ -2,6 +2,8 @@
 
 ## 复杂度即成本
 
+施工前核对派单与任务是否违法或缺少授权；事实不成立或需要未授权设计时据理拒绝并给出可核验证据，不猜测施工。
+
 能删除、合并或修改现有机制解决的，不得新增机制。同一业务规则只保留一个权威实现；被替代的代码、测试和兼容路径随改动删除。
 
 新增护栏前必须回答三问：故障发生概率多大，后果多重，下游是否已有检测或恢复能力。答不上来，或已有兜底足以承接，不加。同一处反复只增不减，停止补丁，回查根因。

package/src/acp-host/role-turn-host.ts

@@ -6,10 +6,12 @@ import type { RoleTurnHost, RoleTurnRequest, RoleTurnResult } from "../host-cont
 import {
   createSerializedRoleTurnHost,
   driveExternalRoleTurnRounds,
+  disposeExternalRoleTurn,
   externalHostFailure as failure,
   raceAgainstHostAbort,
-  withExternalHostCleanupFailure,
 } from "../external-host-turn-loop.ts";
+import { describeErrorIdentity } from "../public-cli/run-lifecycle.ts";
+import { projectThrownFailureLeaf, retainPackageFault } from "../public-cli/settlement.ts";
 
 import {
   copyAndRecordHostDossier,
@@ -84,7 +86,10 @@ export interface AcpConnection {
   onNotification?(handler: (method: string, params: Readonly<Record<string, unknown>>) => void): void;
   /** Full process stderr accumulated so far (#836). */
   stderr?(): string;
-  close(): Promise<void>;
+  /** Observed native termination / RPC report, absent before either exists. */
+  result?(): RoleTurnResult | undefined;
+  /** Return spontaneous native termination, not a package-initiated daemon stop. */
+  close(): Promise<void | RoleTurnResult>;
 }
 
 export type AcpRoleTurnHostConfig = Readonly<{
@@ -116,15 +121,20 @@ export function connectAcpStdio(options: {
   readonly onNotification?: (method: string, params: Readonly<Record<string, unknown>>) => void;
 }): Promise<AcpConnection> {
   const child = spawn(options.binary, [...options.args], { cwd: options.cwd, env: options.env, stdio: ["pipe", "pipe", "pipe"] });
-  const pending = new Map<number, { resolve(value: Readonly<Record<string, unknown>>): void; reject(error: Error): void }>();
+  const pending = new Map<number, { resolve(value: Readonly<Record<string, unknown>>): void; reject(error: unknown): void }>();
   const notificationHandlers: Array<(method: string, params: Readonly<Record<string, unknown>>) => void> = [];
   if (options.onNotification !== undefined) notificationHandlers.push(options.onNotification);
   let nextId = 0;
   let closed = false;
-  let terminalError: Error | undefined;
-  // Rolling diagnostic tail only — not an unbounded transcript face (same class as headless).
+  let terminalError: unknown;
+  let spawned = false;
+  let stoppedByPackage = false;
+  let nativeExit: Pick<RoleTurnResult, "code" | "signal" | "timedOut"> | undefined;
+  let rpcFailure: RoleTurnResult["knownFailure"];
+  child.once("spawn", () => { spawned = true; });
+  // Native stderr bytes stay separate from transport exception diagnostics.
   let stderr = "";
-  const settleClosed = (error: Error): void => {
+  const settleClosed = (error: unknown): void => {
     if (closed) return;
     closed = true;
     terminalError = error;
@@ -134,59 +144,71 @@ export function connectAcpStdio(options: {
   // Framing corruption or a known required capability with unusable shape still
   // closes the child. Unknown client methods are answered in-band (JSON-RPC
   // method not found) and do not terminate the leg (#760).
-  const terminate = (error: Error): void => {
+  const terminate = (error: unknown): void => {
     settleClosed(error);
     child.stdin.end();
-    child.kill("SIGTERM");
+    stoppedByPackage = child.kill("SIGTERM") || stoppedByPackage;
   };
   child.stderr.setEncoding("utf8").on("data", (chunk: string) => {
     stderr += chunk;
-  });
-  child.on("error", (error) => settleClosed(acpError("acp-process-error", `ACP process error: ${error.message}`, error)));
-  createInterface({ input: child.stdout }).on("line", (line) => {
-    let message: RpcReply;
-    try { message = JSON.parse(line) as RpcReply; }
-    catch (error) {
-      terminate(acpError("acp-invalid-json", `Invalid ACP JSON: ${String(error)}`, error));
-      return;
-    }
-    if (typeof message.method === "string") {
-      const params = typeof message.params === "object" && message.params !== null
-        ? message.params as Readonly<Record<string, unknown>> : {};
-      for (const handler of notificationHandlers) handler(message.method, params);
-      if (typeof message.id === "number") {
-        if (message.method !== "session/request_permission") {
-          // Vendor extensions (_x.ai/*, …) and any other unhandled client request:
-          // JSON-RPC method-not-found reply; session continues (#760).
-          child.stdin.write(`${JSON.stringify({
-            jsonrpc: "2.0",
-            id: message.id,
-            error: { code: -32601, message: `Method not found: ${message.method}` },
-          })}\n`);
-          return;
-        }
-        const choices = Array.isArray(params.options) ? params.options : [];
-        const selected = choices.find((value) =>
-          typeof value === "object" && value !== null && (value as { kind?: unknown }).kind === "allow_once") as { optionId?: unknown } | undefined;
-        if (typeof selected?.optionId !== "string") {
-          terminate(acpError("acp-permission-missing-allow-once", "ACP permission request omitted allow_once"));
-          return;
+  }).on("error", terminate);
+  child.on("error", settleClosed);
+  child.stdin.on("error", terminate);
+  createInterface({ input: child.stdout }).on("error", terminate).on("line", (line) => {
+    try {
+      const message = JSON.parse(line) as RpcReply;
+      if (typeof message.method === "string") {
+        const params = typeof message.params === "object" && message.params !== null
+          ? message.params as Readonly<Record<string, unknown>> : {};
+        for (const handler of notificationHandlers) handler(message.method, params);
+        if (typeof message.id === "number") {
+          if (message.method !== "session/request_permission") {
+            // Vendor extensions (_x.ai/*, …) and any other unhandled client request:
+            // JSON-RPC method-not-found reply; session continues (#760).
+            child.stdin.write(`${JSON.stringify({
+              jsonrpc: "2.0",
+              id: message.id,
+              error: { code: -32601, message: `Method not found: ${message.method}` },
+            })}\n`);
+            return;
+          }
+          const choices = Array.isArray(params.options) ? params.options : [];
+          const selected = choices.find((value) =>
+            typeof value === "object" && value !== null && (value as { kind?: unknown }).kind === "allow_once") as { optionId?: unknown } | undefined;
+          if (typeof selected?.optionId !== "string") {
+            terminate(acpError("acp-permission-missing-allow-once", "ACP permission request omitted allow_once"));
+            return;
+          }
+          child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id: message.id, result: { outcome: { outcome: "selected", optionId: selected.optionId } } })}\n`);
         }
-        child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id: message.id, result: { outcome: { outcome: "selected", optionId: selected.optionId } } })}\n`);
+        return;
       }
-      return;
+      if (typeof message.id !== "number") return;
+      const waiter = pending.get(message.id);
+      if (waiter === undefined) return;
+      pending.delete(message.id);
+      if (message.error !== undefined) {
+        const diagnostic = typeof message.error === "object" && message.error !== null
+          && "message" in message.error && typeof message.error.message === "string"
+          ? message.error.message : JSON.stringify(message.error);
+        rpcFailure ??= { diagnostic, details: message };
+        waiter.reject(acpError("acp-upstream-error", diagnostic, message));
+      } else waiter.resolve((message.result ?? {}) as Readonly<Record<string, unknown>>);
+    } catch (error) {
+      terminate(error);
     }
-    if (typeof message.id !== "number") return;
-    const waiter = pending.get(message.id);
-    if (waiter === undefined) return;
-    pending.delete(message.id);
-    if (message.error !== undefined) waiter.reject(acpError("acp-upstream-error", `ACP error: ${JSON.stringify(message.error)}`));
-    else waiter.resolve((message.result ?? {}) as Readonly<Record<string, unknown>>);
   });
-  child.on("close", (code) => settleClosed(acpError("acp-closed", `ACP closed (${String(code)}): ${stderr}`)));
+  const processClosed = new Promise<void>((resolve) => {
+    child.once("close", (code, signal) => {
+      // ENOENT also emits close, but no host process was launched in that case.
+      if (spawned) nativeExit = { code, timedOut: false, ...(signal === null ? {} : { signal }) };
+      settleClosed(acpError("acp-closed", "ACP process closed"));
+      resolve();
+    });
+  });
   return Promise.resolve({
     request(method, params) {
-      if (closed) return Promise.reject(terminalError ?? acpError("acp-connection-closed", "ACP connection is closed"));
+      if (closed) return Promise.reject(terminalError);
       const id = ++nextId;
       return new Promise((resolve, reject) => {
         pending.set(id, { resolve, reject });
@@ -195,12 +217,12 @@ export function connectAcpStdio(options: {
           const waiter = pending.get(id);
           if (waiter === undefined) return;
           pending.delete(id);
-          waiter.reject(acpError("acp-write-failed", `ACP write failed: ${error.message}`, error));
+          waiter.reject(error);
         });
       });
     },
     notify(method, params) {
-      if (closed) throw terminalError ?? acpError("acp-connection-closed", "ACP connection is closed");
+      if (closed) throw terminalError;
       child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
     },
     onNotification(handler) {
@@ -209,12 +231,18 @@ export function connectAcpStdio(options: {
     stderr() {
       return stderr;
     },
+    result() {
+      if (nativeExit === undefined && rpcFailure === undefined) return undefined;
+      return {
+        ...(nativeExit ?? { code: null, timedOut: false }),
+        stderr,
+        ...(rpcFailure === undefined ? {} : { knownFailure: rpcFailure }),
+      };
+    },
     async close() {
-      if (closed) return;
-      settleClosed(acpError("acp-connection-closed", "ACP connection is closed"));
-      child.stdin.end();
-      child.kill("SIGTERM");
-      await new Promise<void>((resolve) => child.once("close", () => resolve()));
+      if (!closed) terminate(acpError("acp-connection-closed", "ACP connection is closed"));
+      await processClosed;
+      return !stoppedByPackage && nativeExit !== undefined ? { ...nativeExit, stderr } : undefined;
     },
   });
 }
@@ -229,8 +257,9 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
     let sessionOpened = false;
     let accepted = false;
     const sessionParent = config.sessionIdentity.resolveSessionFile(request.principal);
-    // Mutable so dispose failure can outrank a clean turn.
     let outcome: RoleTurnResult = failure("session", "AcpNoOutcome", "no-outcome");
+    let reportedFailure: RoleTurnResult["knownFailure"];
+    let packageFailure: RoleTurnResult["knownFailure"];
     try {
       if (prepared.mcpServers.length === 0) {
         outcome = failure("activation", "UncontrolledAcpSession", "ak-config-missing");
@@ -361,9 +390,15 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
             collectAgentProse = false;
             if (result.stopReason === "refusal") {
               agentProseChunks.length = 0;
+              reportedFailure = { diagnostic: result.stopReason, details: result };
               return {
                 status: "terminal",
-                result: failure("output", "AcpRefusal", "refusal", { sessionId }),
+                result: {
+                  code: null,
+                  stderr: activeConnection.stderr?.() ?? "",
+                  timedOut: false,
+                  knownFailure: reportedFailure,
+                },
               };
             }
             // #959: navigator prose exit when the model spoke without the output tool.
@@ -389,32 +424,90 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
         } // sessionReady
         } // model match else
       } // mcpServers else
+    } catch (error) {
+      const native = connection?.result?.();
+      reportedFailure = native?.knownFailure;
+      outcome = native ?? { code: null, stderr: connection?.stderr?.() ?? "", timedOut: false };
+      await retainPackageFault({
+        runDirectory: request.runDirectory,
+        diagnostic: `ACP turn exception beside native host facts: ${describeErrorIdentity(error)}`,
+        error,
+      });
+      // Native abnormal exit / RPC report stays primary. Otherwise this is a
+      // real package exception, not a host cause inferred from missing output.
+      if (outcome.knownFailure === undefined && !outcome.timedOut && outcome.signal === undefined
+        && (native === undefined || outcome.code === 0 || outcome.code === null)) {
+        packageFailure = projectThrownFailureLeaf(error);
+        outcome = { ...outcome, knownFailure: packageFailure };
+      }
     } finally {
+      let naturalTermination: RoleTurnResult | void = undefined;
       if (connection !== undefined) {
         if (sessionId !== undefined && !accepted) {
           try { connection.notify("session/cancel", { sessionId }); }
-          catch { /* keep turn result */ }
+          catch (error) {
+            await retainPackageFault({
+              runDirectory: request.runDirectory,
+              diagnostic: `session cancel failed beside host terminal: ${describeErrorIdentity(error)}`,
+              error,
+            });
+          }
+        }
+        try { naturalTermination = await connection.close(); }
+        catch (error) {
+          await retainPackageFault({
+            runDirectory: request.runDirectory,
+            diagnostic: `connection close failed beside host terminal: ${describeErrorIdentity(error)}`,
+            error,
+          });
         }
-        try { await connection.close(); }
-        catch { /* keep turn result */ }
       }
-      if (config.hostName !== "hermes" && sessionOpened && sessionId !== undefined) {
-        copyAndRecordHostDossier({
-          host: config.hostName,
-          sessionId,
-          cwd: request.cwd,
-          sessionDirectory: join(request.runDirectory, "session"),
-          sessionParent,
-          continuation: request.continuation,
-          ...(request.model !== undefined ? { model: request.model } : {}),
-          ...(request.home !== undefined ? { home: request.home } : {}),
-        });
+      // Both success and failure drain the native stderr stream, including
+      // bytes arriving after the last RPC response.
+      outcome = { ...outcome, stderr: connection?.stderr?.() ?? outcome.stderr };
+      // On abnormal paths, teardown has now drained the real close/stderr.
+      // A successful ACP protocol turn remains successful: its ordinary
+      // connection cleanup is not reclassified as a role failure.
+      const native = connection?.result?.() ?? naturalTermination;
+      if (native !== undefined && (naturalTermination !== undefined || outcome.code !== 0
+        || outcome.knownFailure !== undefined || outcome.timedOut || outcome.signal !== undefined)) {
+        // A late native failure stays primary over a package failure. An own
+        // SIGTERM stop alone is ordinary disposal, not a guessed host cause.
+        const nativeFailed = (native.code !== null && native.code !== 0)
+          || (naturalTermination !== undefined && (native.timedOut || native.signal !== undefined));
+        let knownFailure = outcome.knownFailure;
+        if (nativeFailed && knownFailure !== undefined && knownFailure !== reportedFailure) {
+          if (knownFailure !== packageFailure) await retainPackageFault({
+            runDirectory: request.runDirectory,
+            diagnostic: knownFailure.diagnostic ?? "ACP package failure beside late native termination",
+            error: knownFailure,
+          });
+          knownFailure = reportedFailure;
+        }
+        const { knownFailure: _nativeFailure, ...facts } = native;
+        outcome = { ...facts, ...(knownFailure === undefined ? {} : { knownFailure }) };
       }
-      try {
-        await prepared.dispose?.();
-      } catch (cleanupError) {
-        outcome = withExternalHostCleanupFailure(outcome, cleanupError, "AcpDisposeFailure");
+      if (config.hostName !== "hermes" && sessionOpened && sessionId !== undefined) {
+        try {
+          copyAndRecordHostDossier({
+            host: config.hostName,
+            sessionId,
+            cwd: request.cwd,
+            sessionDirectory: join(request.runDirectory, "session"),
+            sessionParent,
+            continuation: request.continuation,
+            ...(request.model !== undefined ? { model: request.model } : {}),
+            ...(request.home !== undefined ? { home: request.home } : {}),
+          });
+        } catch (error) {
+          await retainPackageFault({
+            runDirectory: request.runDirectory,
+            diagnostic: `host dossier copy failed beside host terminal: ${describeErrorIdentity(error)}`,
+            error,
+          });
+        }
       }
+      outcome = await disposeExternalRoleTurn(prepared, request, outcome);
     }
     return outcome;
   });

package/src/collector-tool-schemas.ts

@@ -4,7 +4,7 @@ import { withTerminatingOutputDeclarations } from "./package-contracts/terminati
 
 /**
  * #1088: LLM gathers evidence via host CLI and submits the receipt.
- * Field declarations guide the model — host must not pure-shape-reject (第 0 条 / ADR 0057).
+ * Field declarations guide the model — host must not pure-shape-reject (仓内 CLAUDE.md 开篇 / ADR 0057).
  * Presence of `groups` remains the Collector terminal discriminator for settlement/analyst.
  */
 export const collectorOutputBaseSchema = openToolObject(

package/src/compliance-transport.ts

@@ -6,12 +6,12 @@ import type { NoReceiptLifecycleFacts } from "./receipt-delivery-policy.ts";
 import type { PublicSummonResult } from "./public-role-summons.ts";
 import { officerConclusionReask } from "./gatekeeper-role.ts";
 import { receivedDiscriminator } from "./submission-errors.ts";
-import { coalesceSubmissionRows } from "./public-cli/terminal.ts";
+import { currentReplyRows } from "./public-cli/terminal.ts";
 import { readableGateItem } from "./readable-gate-item.ts";
 import { deliveryLimitFromConfig } from "./receipt-delivery-policy.ts";
 import { isRecord } from "./unknown-value.ts";
 
-export type ComplianceNoReceipt = NoReceiptLifecycleFacts & { status: "no-receipt"; usage?: Usage };
+export type ComplianceNoReceipt = Partial<NoReceiptLifecycleFacts> & { status: "no-receipt"; usage?: Usage };
 /**
  * #757 / #750: no unreadable/unusable judgment on auditor replies.
  * Known three-state (converged/continue/escalate) is read for queueing only.
@@ -172,10 +172,7 @@ async function projectAuditorTerminal(summoned: PublicSummonResult): Promise<Com
     };
   }
   if (outcome.kind === "accepted") {
-    const rows = coalesceSubmissionRows(
-      outcome.payloads,
-      summoned.terminal?.submissions,
-    );
+    const rows = currentReplyRows(summoned.terminal);
     if (rows.length === 0) {
       return readComplianceCandidate({}, usage);
     }

package/src/engine-detour-usage.ts

@@ -37,8 +37,8 @@ export const ENGINE_DETOUR_TOOL_USAGE_FACT_KEY = "engineDetourToolUsage" as cons
 
 /**
  * Run-relative sitian volume path for one detour call.
- * Openable once the run directory is known (resume.command / top-level runId);
- * contains no runId bytes itself (#108 + #537 AC8).
+ * Openable once the run directory is known from the terminal's run id.
+ * Contains no runId bytes itself (#108 + #537).
  */
 export const ENGINE_DETOUR_CALL_RECORD_FILE_RELATIVE =
   `session/${ENGINE_DETOUR_CALL_KIND}/records.jsonl` as const;
@@ -232,7 +232,7 @@ export async function readEngineDetourToolUsage(input: {
     }
     const pointer: RecordPointer = {
       identity: record.identity,
-      recordFile,
+      recordFile: ENGINE_DETOUR_CALL_RECORD_FILE_RELATIVE,
       kind: record.kind,
       level: record.level,
     };
@@ -246,36 +246,6 @@ export async function readEngineDetourToolUsage(input: {
   return { callCount: calls.length, calls };
 }
 
-/**
- * Project usage onto the public Terminal face.
- * Non-resumable: keep absolute recordFile (runId already public via top-level runId).
- * Resumable: keep an openable run-relative recordFile and identity with no runId
- * bytes (#108 single disclosure + #537 AC8 reopen).
- */
-export function projectEngineDetourToolUsageForPublicTerminal(
-  usage: EngineDetourToolUsageFact,
-  options: { readonly discloseRecordFile: boolean },
-): EngineDetourToolUsageFact {
-  if (options.discloseRecordFile) return usage;
-  return {
-    callCount: usage.callCount,
-    calls: usage.calls.map((call) => ({
-      toolCallId: call.toolCallId,
-      durationMs: call.durationMs,
-      ...(call.code === undefined ? {} : { code: call.code }),
-      ...(call.stdoutByteLength === undefined
-        ? {}
-        : { stdoutByteLength: call.stdoutByteLength }),
-      recordPointer: {
-        identity: call.recordPointer.identity,
-        kind: call.recordPointer.kind,
-        level: call.recordPointer.level,
-        recordFile: ENGINE_DETOUR_CALL_RECORD_FILE_RELATIVE,
-      },
-    })),
-  };
-}
-
 /** One shared invocation.json reader (ENOENT → undefined; other errors propagate). */
 function readInvocationRecord(
   runDirectory: string,