@akagilnc/pi-workflow-roles 0.1.5406 → 0.1.5475

package/dist/public-cli/post-admission.js

@@ -37,14 +37,13 @@ function isStationChildOfficerDialogue(role, env) {
     return env.stationChild === true && isOfficerReviewSeat(role);
 }
 import { mintEngineDetourInvocationScope, withEngineDetourInvocationScope, } from "../engine-detour-usage.js";
-import { clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, } from "./run-lifecycle.js";
+import { clearCurrentCourt, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, } from "./run-lifecycle.js";
 import { processCancelDiagnostic, processCancelSignalName, } from "./process-cancel.js";
-import { homeFromRunDirectory } from "../activation-ledger-topology.js";
 import { DEFAULT_ROLE_TURN_HOST } from "../host-descriptions.js";
 import { recordRunStart } from "../host-session-record.js";
-import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatErrorCauseDetail, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, publishedFailureErrorPath, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, rewritePublishedFailureErrorPath, } from "./settlement.js";
+import { classifyPostAdmissionFailure, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatErrorCauseDetail, ledgerReadScope, isLawfulTypedTerminalOutcome, presentStructuralRejection, settleFailureTerminalResult, settleHostEndedNoReceipt, noteSettlementFault, attachRecordedSubmissions, retainPackageFault, } from "./settlement.js";
 import {} from "./terminal.js";
-import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, writeHardenedArtifactFile, } from "./auto-resume.js";
+import { ensureRealArtifactsDirectory, persistReturnedRunState, presentTerminal, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
 import { isRecord, errorText } from "../unknown-value.js";
 function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
     const rewrite = (value) => rewriteRunDirectoryPathValue(value, relocation.oldRunDirectory, relocation.newRunDirectory);
@@ -60,7 +59,6 @@ function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
         }
     }
     if (result.terminal !== undefined) {
-        rewritePublishedFailureErrorPath(result.terminal, relocation.oldRunDirectory, relocation.newRunDirectory);
         for (const artifact of result.terminal.artifacts) {
             artifact.path = rewrite(artifact.path);
         }
@@ -82,8 +80,14 @@ async function settleProcessCancelAfterTurn(input) {
         timedOut: input.result.timedOut,
         code: input.result.code,
         stderr: input.result.stderr,
-        knownDiagnostic: processCancelDiagnostic(input.cancelName),
-    }, input.invocationScopeId), input.adapters, input.env.principalAuthority, input.io, input.persistRunState);
+        ...(input.result.signal === undefined ? {} : { signal: input.result.signal }),
+        // A host report already on this result stays the report. The cancel
+        // name is wording only when the host gave none.
+        ...(input.result.knownFailure === undefined
+            ? { knownDiagnostic: processCancelDiagnostic(input.cancelName) }
+            : { knownFailure: input.result.knownFailure }),
+        cancelName: input.cancelName,
+    }, input.invocationScopeId), input.adapters, input.env.principalAuthority, input.io, input.persistRunState, input.notePackageFault);
     return {
         ...failed,
         turnDispatched: true,
@@ -127,33 +131,16 @@ export const POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE = "ak_post_admission_c
  * redundant second copy (#840 bounce class 1: 同一业务规则只保留一个权威实现).
  */
 async function recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic, io) {
-    const payload = { diagnostic, recordedAt: new Date().toISOString() };
-    let retentionFailure;
-    try {
-        await env.sessionAppender(env.principalAuthority, admitted.principal, POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE, payload);
-    }
-    catch (appendError) {
-        try {
-            const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
-            await writeHardenedArtifactFile(artifactsDir, "post-admission-diagnostic", {
-                version: 1,
-                ...payload,
-            });
-        }
-        catch (artifactError) {
-            retentionFailure =
-                `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`;
-        }
-    }
-    try {
-        io.stderr(formatCliDiagnostic(diagnostic));
-        if (retentionFailure !== undefined) {
-            io.stderr(formatCliDiagnostic(retentionFailure));
-        }
-    }
-    catch {
-        // Presentation is best-effort beside an already-formed host terminal.
-    }
+    await retainPackageFault({
+        runDirectory: admitted.runDirectory,
+        diagnostic,
+        appendSession: (payload) => env.sessionAppender(env.principalAuthority, admitted.principal, POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE, payload),
+        stderr: (text) => io.stderr(text),
+    });
+}
+/** The one package-fault receiver, bound to this admitted run's session and io. */
+export function packageFaultNoteFor(admitted, env, io) {
+    return (diagnostic) => recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic, io);
 }
 /**
  * Factory-seat resume method-material face (#833): one authority for
@@ -175,42 +162,42 @@ export async function resolveResumeMethodMaterialAdapters(input) {
             stderr: "",
             thrown: error,
             ...(input.knownCause === undefined ? {} : { knownCause: input.knownCause }),
-        }, input.emptyAdapters, input.authority, { ...input.io, omitFailureStderrDiagnostic: true });
+        }, input.emptyAdapters, input.authority, { ...input.io, omitFailureStderrDiagnostic: true }, true, (diagnostic) => retainPackageFault({
+            runDirectory: input.admitted.runDirectory,
+            diagnostic,
+            stderr: (text) => input.io.stderr(text),
+        }));
         return { kind: "terminal", ...terminal };
     }
 }
-export async function presentControlledFailure(admitted, failureInput, adapters, authority, io, persistRunState = true) {
+export async function presentControlledFailure(admitted, failureInput, adapters, authority, io, persistRunState = true, notePackageFault) {
     const hasThrown = Object.hasOwn(failureInput, "thrown");
-    const resumeObservation = await resolveControlledFailureResumeObservation({
-        runDirectory: admitted.runDirectory,
-        ...(failureInput.typedHttpObservationSettled === true
-            ? {
-                typedHttpObservationSettled: true,
-                ...(failureInput.typedHttpObservation === undefined
-                    ? {}
-                    : { typedHttpObservation: failureInput.typedHttpObservation }),
-            }
-            : {}),
-    });
-    const knownFailure = failureInput.knownFailure ?? resumeObservation.observationReadFailure;
-    const session = !hasThrown &&
-        !failureInput.timedOut &&
-        knownFailure === undefined &&
-        failureInput.knownCause === undefined &&
-        admitted.principal !== undefined
-        ? await inspectJudgeSession(authority.decode(admitted.principal).sessionFile)
-        : undefined;
+    const knownFailure = failureInput.knownFailure;
     // knownFailure channel owns details when present; otherwise caller knownDetails.
     const fromKnownFailure = explicitInternalKnownFailureClassificationInput(knownFailure);
-    const failure = classifyPostAdmissionFailure({
+    // Merge the two detail sources so a key carried by either survives; a later
+    // spread would otherwise drop the earlier one's keys entirely.
+    const callerDetails = failureInput.knownDetails === undefined && fromKnownFailure.knownDetails === undefined
+        ? undefined
+        : { ...(failureInput.knownDetails ?? {}), ...(fromKnownFailure.knownDetails ?? {}) };
+    const classified = classifyPostAdmissionFailure({
         timedOut: failureInput.timedOut,
         code: failureInput.code,
         stderr: failureInput.stderr,
         ...(hasThrown ? { thrown: failureInput.thrown } : {}),
-        ...(failureInput.knownDetails === undefined
+        // Both detail sources are real; merging keeps each one's keys instead of
+        // letting the later spread drop the earlier one.
+        ...(callerDetails === undefined ? {} : { knownDetails: callerDetails }),
+        // The knownFailure channel's own cause/identity/diagnostic ride with it.
+        ...(fromKnownFailure.knownCause === undefined
+            ? {}
+            : { knownCause: fromKnownFailure.knownCause }),
+        ...(fromKnownFailure.knownIdentity === undefined
+            ? {}
+            : { knownIdentity: fromKnownFailure.knownIdentity }),
+        ...(fromKnownFailure.knownDiagnostic === undefined
             ? {}
-            : { knownDetails: failureInput.knownDetails }),
-        ...fromKnownFailure,
+            : { knownDiagnostic: fromKnownFailure.knownDiagnostic }),
         ...(failureInput.knownCause === undefined
             ? {}
             : { knownCause: failureInput.knownCause }),
@@ -220,20 +207,30 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
         ...(failureInput.knownDiagnostic === undefined
             ? {}
             : { knownDiagnostic: failureInput.knownDiagnostic }),
-        ...(session === undefined ? {} : { session }),
+        ...(failureInput.signal === undefined ? {} : { signal: failureInput.signal }),
+        ...(failureInput.cancelName === undefined ? {} : { cancelName: failureInput.cancelName }),
+        ...(failureInput.packageFact === undefined
+            ? {}
+            : { packageFact: failureInput.packageFact }),
     });
-    // #665 / #416: typed 429 with a run principal offers resume; the host decides availability.
-    const resumable = admitted.principal !== undefined && resumeObservation.typedHttp429 !== undefined;
+    const failure = failureInput.stderr.length === 0 || failureInput.stderr === classified.diagnostic
+        ? classified
+        : { ...classified, stderr: failureInput.stderr };
     if (persistRunState && !failureInput.skipRunStateWrite) {
-        await persistReturnedRunState(admitted);
+        try {
+            await persistReturnedRunState(admitted);
+        }
+        catch (error) {
+            // The host failure is already classified. A run-state write stays beside it.
+            await noteSettlementFault(admitted.runDirectory, notePackageFault === undefined ? undefined : { notePackageFault }, `run-state persistence failed beside host terminal: ${describeErrorIdentity(error)}`);
+        }
     }
     let publishedErrorPath;
     let terminal;
     try {
         const settled = await settleFailureTerminalResult(admitted, failure, authority, {
-            ...(resumable
-                ? { resume: { command: renderResumeCommand(admitted.runId) } }
-                : {}),
+            recordAttemptHistory: true,
+            ...(notePackageFault === undefined ? {} : { notePackageFault }),
             ...(failureInput.invocationScopeId === undefined ||
                 failureInput.invocationScopeId.length === 0
                 ? {}
@@ -248,7 +245,7 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
         }
         throw error;
     }
-    presentFailureTerminal(terminal, io);
+    await presentTerminal(terminal, io, admitted.runDirectory);
     return {
         exitCode: exitCodeForTerminalOutcome(terminal.roleOutcome),
         admitted,
@@ -266,9 +263,9 @@ export async function presentControlledFailure(admitted, failureInput, adapters,
  * the true cause through its own existing dispatch-exception machinery once
  * the retry budget is exhausted.
  */
-async function settleAfterTurnStarted(admitted, failureInput, adapters, authority, io, persistRunState) {
+async function settleAfterTurnStarted(admitted, failureInput, adapters, authority, io, persistRunState, notePackageFault) {
     try {
-        return (await presentControlledFailure(admitted, failureInput, adapters, authority, io, persistRunState));
+        return (await presentControlledFailure(admitted, failureInput, adapters, authority, io, persistRunState, notePackageFault));
     }
     catch (error) {
         throw new TurnDispatchedFailure(error);
@@ -278,33 +275,21 @@ async function settleAfterTurnStarted(admitted, failureInput, adapters, authorit
  * Persist run-state for a result dispatchPostAdmissionTurn deferred
  * (needsPersist — station-child / resumable auto-resume loop, #416/#840):
  * that write must land outside the loop's own retried-dispatch try, but its
- * failure still settles through the single existing controlled-failure
- * authority (settleAfterTurnStarted / presentControlledFailure, ADR 0080:
- * one settlement disposition owner) — never a second hand-rolled
- * classify/artifact/Terminal (#836 r12 class 3), and never lawful/non-lawful
- * settling differently (#836 r13 class 2: a caller's io here may be a no-op,
- * so a stderr-only trace is never seen and the failure is otherwise
- * swallowed — 失败诚实宪法 真因必须落痕). Both cases settle through
- * settleAfterTurnStarted, which attaches the run's already-recorded ledger
- * submissions to the new failure terminal and returns skipAutoResume so the
- * caller presents it once and stops — never re-entering auto-resume.
+ * failure is a package note beside the terminal already settled. It does
+ * not replace that terminal or open another attempt. The note is durable
+ * because the caller's io may be a no-op.
  */
-async function settleDeferredPersist(admitted, authority, adapters, io, result) {
+async function settleDeferredPersist(admitted, env, io, result) {
     if (result.needsPersist !== true || result.terminal === undefined)
         return result;
     const { needsPersist: _needsPersist, ...settledResult } = result;
-    const lawful = isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
     try {
-        await persistReturnedRunState(admitted, lawful ? { lawful: true } : undefined);
+        await persistReturnedRunState(admitted);
         return settledResult;
     }
     catch (error) {
-        const failed = await settleAfterTurnStarted(admitted, { timedOut: false, code: null, stderr: "", thrown: error, skipRunStateWrite: true }, adapters, authority, io, true);
-        return {
-            ...failed,
-            turnDispatched: true,
-            skipAutoResume: true,
-        };
+        await recordBestEffortPostDispatchDiagnostic(admitted, env, `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
+        return settledResult;
     }
 }
 /**
@@ -371,17 +356,10 @@ async function buildReceiptDeliveryRequest(input) {
 async function settleCompletedHostTurn(input) {
     const { admitted, env, io, adapters, shouldPresent, request, result, persistRunState, deferredPersist } = input;
     const finishAfterTurn = input.finishAfterTurn;
-    // `result.stderr` stays live in memory for the real classification below
-    // regardless of whether this durable mirror write succeeds. A write
-    // failure here (unwritable run directory, stderr.log occupied as a
-    // directory, ...) is a real infrastructure problem and must never be
-    // dropped silently (catch-and-continue with no trace is a defect) — but
-    // it also must never become THE controlling failure and wash out a
-    // primary child signal that already arrived on `result`, or an
-    // already-sealed accepted payload (#836: a secondary failure must not
-    // overwrite an already-known cause or an already-recorded leg). It rides
-    // beside whatever the real classification below determines, and only
-    // becomes the reported failure itself when nothing else is wrong.
+    const courtScope = input.courtScope;
+    // `result.stderr` stays live in memory for host-failure settlement
+    // whether or not this mirror write succeeds. A write failure is noted.
+    // It does not replace the host terminal or an already-sealed acceptance.
     //
     // Everything below runs after the host turn genuinely started (#840 r9
     // 判词 class 1 boundary — 覆盖 executeTurn 已启动后至返回带 turnDispatched
@@ -404,138 +382,47 @@ async function settleCompletedHostTurn(input) {
     }
     catch (error) {
         stderrLogWriteFailure = error;
-        // Best-effort: the turn's own stderr capture is secondary to lawful /
-        // controlled-failure settlement below, but the failure itself must
-        // still leave a real trace (失败诚实宪法 真因必须落痕) — durably, since
-        // every auto-resume attempt's io is dummyIo (#840 r9 判词 class 1). It
-        // still rides beside the classification below and, if nothing else is
-        // wrong, becomes the reported failure itself (#836).
+        // Best-effort: stderr.log is secondary to the host terminal. A write
+        // failure leaves a durable note and, on a host failure, rides in
+        // packageFact. It does not become the cause.
         await recordBestEffortPostDispatchDiagnostic(admitted, env, `stderr.log write failed (best-effort continue): ${describeErrorIdentity(error)}`, io);
     }
-    const courtScope = settlementScopeForTurn(request);
-    // Single complete boundary (#840 r9 判词 class 1): resolving the
-    // host/runner failure facts, trySettle, its shouldPresent gate, and the
-    // accepted-settlement cleanup all settle through this one catch — a
-    // throw from any of them (including the session-file decode itself)
-    // still routes through settleAfterTurnStarted's TurnDispatchedFailure
-    // instead of losing turnDispatched to an uncaught throw. The facts are
-    // resolved before trySettle (#836) so an already-accepted settlement is
-    // never presented over a real current host/runner failure signal or a
-    // real stderr.log durable-write failure — both stay a real failure with
-    // the recorded payload riding beside it, not replacing it.
+    // Host facts are resolved before trySettle. A host failure skips trySettle
+    // so a later read cannot replace that report. A clean host whose settlement
+    // read throws is noted above and is not turned into a failure terminal.
+    // stderr.log and run-state writes are notes beside the host terminal.
     let settled;
     let settledOutcome;
-    let hostSignalFailed = false;
-    let resolution;
+    // The host CLI's own report: timeout, declared failure, cancel, or exit.
+    // A null code is a signal death (Node close). No session or history read
+    // takes part (owner ea321c6d / 4743ade7).
+    const processCancelName = processCancelSignalName(env.signal);
+    const hostSignalFailed = result.timedOut
+        || result.knownFailure !== undefined
+        || processCancelName !== undefined
+        || result.code === null
+        || result.code !== 0;
+    const hostReportedFailure = result.knownFailure;
     try {
-        const sessionFile = admitted.principal !== undefined
-            ? env.principalAuthority.decode(admitted.principal).sessionFile
-            : "";
-        const runnerKnownFailure = adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
-            ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
-            : result.knownFailure;
-        resolution = await resolveAuditedRunnerFailureResolution({
-            runner: runnerKnownFailure,
-            sessionFile,
-            credential: undefined,
-            runDirectory: admitted.runDirectory,
-        });
-        // A direct, current signal from the host/runner itself (timeout / host
-        // knownFailure / runner knownFailure / missing credential) is a real
-        // problem regardless of what else already settled — a settled accepted
-        // outcome must not paper over it (it rides beside the recorded payload
-        // via `submissions`, never replacing the payload). The audited
-        // resolution's own typed session read (malformed JSONL, provider-stop,
-        // an illegal/unsealed accepted status, a stale/superseded typed-HTTP
-        // observation, ...) makes a run with no sealed acceptance a true
-        // failure too — it must not be discarded into a lawful no_receipt just
-        // because the raw runner signal alone looked clean. But it must not
-        // retroactively invalidate an acceptance that already sealed this turn
-        // — a resolved 429 observed earlier in the same session is exactly
-        // that.
-        const processCancelName = processCancelSignalName(env.signal);
-        const directHostFailureSignal = result.timedOut
-            || result.knownFailure !== undefined
-            || runnerKnownFailure !== undefined
-            || processCancelName !== undefined;
-        hostSignalFailed =
-            directHostFailureSignal
-                || (result.code !== null && result.code !== 0)
-                || resolution.knownFailure !== undefined;
-        settled = await adapters.trySettle(admitted, env.principalAuthority, courtScope);
-        if (settled !== undefined) {
-            settled = await attachRecordedSubmissions(admitted, settled, courtScope);
-        }
-        // #836 r12 class 2: an accepted/audit_escalation settlement can be
-        // entirely a prior attempt's stale payload (courtAttempt is a
-        // recording tag, not a visibility gate — attachRecordedSubmissions
-        // above still surfaces that historical payload honestly either way).
-        // Consume the ledger's own subject.attemptId (submission-ledger.ts)
-        // only to learn whether *this* attempt itself produced a fresh seal —
-        // never to filter what presents.
-        const settledIsFreshThisAttempt = settled === undefined
-            || (settled.roleOutcome.kind !== "accepted" && settled.roleOutcome.kind !== "audit_escalation")
-            ? true
-            : await attemptProducedFreshSubmission(admitted, courtScope);
-        // A lawful settled outcome already reached this turn takes precedence
-        // over a later bare exit-code / session-inspection signal (trailing
-        // nonzero exit, late stderr noise, a stale already-superseded
-        // typed-HTTP observation, ...) — but never over a direct current
-        // host/runner failure signal, nor over a real stderr.log durable-write
-        // failure (confirmed infrastructure trouble, not weak/bare evidence),
-        // both of which stay a real failure with the recorded payload riding
-        // beside it, not replacing it (#836: never kill an already-recorded
-        // leg, but never wash a real failure away either). Note: the narrower
-        // directHostFailureSignal gates acceptance here; the broader
-        // hostSignalFailed (adds bare exit code / resolution.knownFailure)
-        // only gates the no-settlement fallback below — except when the
-        // settlement itself is entirely stale (no fresh seal this attempt),
-        // where a bare nonzero exit / resolution failure must not be outranked
-        // by someone else's earlier success (#836 r12 class 2).
-        const staleAcceptanceOutranksRealFailure = !settledIsFreshThisAttempt && hostSignalFailed;
-        // #855: re-read cancel after trySettle/attach awaits — a signal in this
-        // window must not land as lawful accepted.
-        const cancelAfterSettle = processCancelSignalName(env.signal);
-        if (settled !== undefined
-            && shouldPresent(settled)
-            && !directHostFailureSignal
-            && !staleAcceptanceOutranksRealFailure
-            && stderrLogWriteFailure === undefined
-            && cancelAfterSettle === undefined) {
-            // This court sealed — drop open-court pointer (bare resume no longer continues it).
-            if (settled.roleOutcome.kind === "accepted" &&
-                request.courtAttemptId !== undefined &&
-                request.courtAttemptId.length > 0) {
-                try {
-                    await clearCurrentCourt(admitted.runDirectory, request.courtAttemptId);
-                }
-                catch (error) {
-                    // Settlement already sealed accepted — a cleanup failure here must
-                    // not erase that fact or make the caller replay this court's
-                    // summons over already-delivered work (#840 已交劳动只整理终局不重做).
-                    // Preserve the cleanup failure as a post-dispatch diagnostic; the
-                    // accepted settlement remains authoritative (#840 r9 判词 class 1).
-                    await recordBestEffortPostDispatchDiagnostic(admitted, env, `current-court cleanup failed after accepted settlement (best-effort continue): ${describeErrorIdentity(error)}`, io);
-                }
+        if (!hostSignalFailed) {
+            settled = await adapters.trySettle(admitted, env.principalAuthority, { ...courtScope, previewOnly: true });
+            const cancelAfterSettle = processCancelSignalName(env.signal);
+            if (settled !== undefined
+                && shouldPresent(settled)
+                && cancelAfterSettle === undefined) {
+                settledOutcome = {
+                    exitCode: exitCodeForTerminalOutcome(settled.roleOutcome),
+                    admitted,
+                    terminal: settled,
+                    turnDispatched: true,
+                };
             }
-            settledOutcome = {
-                exitCode: exitCodeForTerminalOutcome(settled.roleOutcome),
-                admitted,
-                terminal: settled,
-                turnDispatched: true,
-            };
         }
     }
     catch (error) {
-        // Settle (or its shouldPresent gate, or the failure-fact resolution
-        // above) throw is a real failure fact — never swallow into undefined.
-        const settledFailure = await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
-            timedOut: false,
-            code: result.code,
-            stderr: result.stderr,
-            thrown: error,
-        }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-        return { kind: "settled", outcome: await finishAfterTurn({ ...settledFailure, turnDispatched: true, ...deferredPersist }) };
+        // The host did not fail. A settlement read here is a package fault and
+        // must not become the terminal.
+        await recordBestEffortPostDispatchDiagnostic(admitted, env, `settlement read failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
     }
     if (settledOutcome !== undefined) {
         // #855: final cancel re-read before lawful seal — settlement window may
@@ -552,66 +439,46 @@ async function settleCompletedHostTurn(input) {
                     persistRunState,
                     deferredPersist,
                     invocationScopeId: request.invocationScopeId,
+                    notePackageFault: courtScope.notePackageFault,
                 })) };
         }
         if (persistRunState) {
             try {
-                await persistReturnedRunState(admitted, { lawful: true });
+                await persistReturnedRunState(admitted);
             }
             catch (error) {
                 await recordBestEffortPostDispatchDiagnostic(admitted, env, `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
             }
         }
-        // Lawful persist + present is the caller's stop seam (auto-resume loop /
+        // Persist + present is the caller's stop seam (auto-resume loop /
         // manual resume), not this retried host-turn function.
         // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
+        input.markPending(settledOutcome.terminal);
         return { kind: "settled", outcome: await finishAfterTurn({ ...settledOutcome, ...deferredPersist }) };
     }
     // Host/runner true failure coexists with already-recorded payloads — never wash as accepted.
     if (hostSignalFailed) {
-        const resolutionInput = controlledFailureInputFromResolution(resolution);
-        const processCancelName = processCancelSignalName(env.signal);
-        const stderrLogWriteDetails = stderrLogWriteFailure === undefined
+        const stderrLogWriteFact = stderrLogWriteFailure === undefined
             ? undefined
             : { stderrLogWriteFailure: describeCaughtError(stderrLogWriteFailure) };
         const failed = await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
             timedOut: result.timedOut,
             code: result.code,
             stderr: result.stderr,
-            ...resolutionInput,
-            ...(processCancelName === undefined
-                ? {}
-                : { knownDiagnostic: processCancelDiagnostic(processCancelName) }),
-            // Secondary fact only — never the cause. Rides on whichever channel
-            // classification actually reads (knownFailure.details owns it when
-            // a knownFailure exists; the top-level knownDetails otherwise).
-            ...(stderrLogWriteDetails === undefined
-                ? {}
-                : resolutionInput.knownFailure !== undefined
-                    ? {
-                        knownFailure: {
-                            ...resolutionInput.knownFailure,
-                            details: { ...(resolutionInput.knownFailure.details ?? {}), ...stderrLogWriteDetails },
-                        },
-                    }
-                    : { knownDetails: stderrLogWriteDetails }),
-        }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
+            // A signal-killed child is a fact of its own. The synthetic line is
+            // only a fallback for when the host declared no failure of its own —
+            // it must never displace words the host actually reported.
+            ...(result.signal === undefined ? {} : { signal: result.signal }),
+            ...(hostReportedFailure === undefined ? {} : { knownFailure: hostReportedFailure }),
+            // The cancellation is the host's own report of why this call ended;
+            // it supplies the wording only when the host declared nothing else.
+            ...(processCancelName === undefined ? {} : { cancelName: processCancelName }),
+            // Secondary fact only — never the cause, and never merged into the
+            // host's own details.
+            ...(stderrLogWriteFact === undefined ? {} : { packageFact: stderrLogWriteFact }),
+        }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState, courtScope.notePackageFault);
         return { kind: "settled", outcome: await finishAfterTurn(withProcessCancelSkipAutoResume({ ...failed, turnDispatched: true, ...deferredPersist }, env.signal)) };
     }
-    // Nothing else was wrong, but the durable stderr mirror itself failed to
-    // write — that is the real (infrastructure) problem in this case, not a
-    // lawful absence of a receipt. Honest and loud, not silently no_receipt.
-    if (stderrLogWriteFailure !== undefined) {
-        const failed = await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
-            timedOut: false,
-            code: result.code,
-            stderr: result.stderr,
-            thrown: stderrLogWriteFailure,
-        }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-        return { kind: "settled", outcome: await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist }) };
-    }
-    // No receipt at all after a clean host turn: lawful no_receipt, but the
-    // caller owns whether to催交 first (票面 3).
     return { kind: "still-missing" };
 }
 export async function dispatchPostAdmissionTurn(input) {
@@ -625,6 +492,18 @@ export async function dispatchPostAdmissionTurn(input) {
      * lease release — success and failure alike. When a primary failure terminal already
      * exists, keep that cause and leave relocate failure on the shared diagnostic channel.
      */
+    const courtScope = {
+        ...settlementScopeForTurn(request),
+        notePackageFault: (diagnostic) => recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic, io),
+    };
+    let pendingSettlement;
+    /**
+     * The terminal this pending publication belongs to. A later real failure
+     * (e.g. a cancel re-read) replaces `result.terminal` with its own settled
+     * failure; that failure is already durable, so the superseded preview must
+     * not publish over it (失败诚实宪法：接住可以，洗白不行).
+     */
+    let pendingTerminal;
     let afterDispatchApplied = false;
     const receiptDelivery = input.receiptDelivery ?? createReceiptDeliveryPolicy(env.autoResumeLimit);
     let turnDispatched = false;
@@ -638,8 +517,9 @@ export async function dispatchPostAdmissionTurn(input) {
         if (afterDispatchApplied)
             return result;
         afterDispatchApplied = true;
-        // #855: re-read cancel before afterDispatch finalization — never present
-        // lawful success after a catchable process signal. skipRunStateWrite: run-state
+        // #855: re-read cancel before committing the terminal and afterDispatch.
+        // A signal after the history-first commit cannot retroactively erase it.
+        // skipRunStateWrite: run-state
         // may already be terminal from a prior lawful persist; do not reopen as resumable.
         const cancelBeforeFinish = processCancelSignalName(env.signal);
         if (cancelBeforeFinish !== undefined &&
@@ -651,13 +531,43 @@ export async function dispatchPostAdmissionTurn(input) {
                     code: null,
                     stderr: "",
                     knownDiagnostic: processCancelDiagnostic(cancelBeforeFinish),
+                    cancelName: cancelBeforeFinish,
                     skipRunStateWrite: true,
-                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState)),
+                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState, courtScope.notePackageFault)),
                 turnDispatched: true,
                 skipAutoResume: true,
                 ...deferredPersist,
             };
         }
+        // The last cancellation check precedes the one durable settlement. A preview
+        // never publishes pointers or history; a superseding failure owns this turn —
+        // `result.terminal === pendingTerminal` is what makes the publication this
+        // turn's own rather than a superseded one.
+        if (pendingSettlement !== undefined &&
+            pendingTerminal !== undefined &&
+            result.terminal === pendingTerminal) {
+            try {
+                const terminal = pendingSettlement === "sealed"
+                    ? await adapters.trySettle(admitted, env.principalAuthority, { ...courtScope, recordAttemptHistory: true })
+                    : await attachRecordedSubmissions(admitted, await settleHostEndedNoReceipt(admitted, env.principalAuthority, { ...courtScope, recordAttemptHistory: true }, receiptDelivery.issuedDeliveryRequests()), courtScope);
+                if (terminal === undefined)
+                    throw new Error("settled host attempt vanished before publication");
+                result = { ...result, terminal, exitCode: exitCodeForTerminalOutcome(terminal.roleOutcome) };
+                if (pendingSettlement === "sealed" && terminal.roleOutcome.kind === "accepted"
+                    && request.courtAttemptId !== undefined && request.courtAttemptId.length > 0) {
+                    try {
+                        await clearCurrentCourt(admitted.runDirectory, request.courtAttemptId);
+                    }
+                    catch (error) {
+                        // The accepted attempt is already durable; cleanup is diagnostic only.
+                        await recordBestEffortPostDispatchDiagnostic(admitted, env, `current-court cleanup failed after accepted settlement (best-effort continue): ${describeErrorIdentity(error)}`, io);
+                    }
+                }
+            }
+            catch (error) {
+                await recordBestEffortPostDispatchDiagnostic(admitted, env, `terminal publication failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
+            }
+        }
         try {
             // #858 / #1071: the first identifiable ticketNumber field declaration
             // files an unbound run (integer, digit string, or leading #N token).
@@ -666,7 +576,7 @@ export async function dispatchPostAdmissionTurn(input) {
             // Later receipts remain untouched; prose note/report is never consulted;
             // this seam does not adjudicate a ticket change.
             if (admitted.ticketNumber === undefined) {
-                const rows = await readRecordedSubmissionRows(admitted.projectRoot, admitted.runId, { home: homeFromRunDirectory(admitted.runDirectory), sessionParent: join(admitted.runDirectory, "session", "session.jsonl") });
+                const rows = await readRecordedSubmissionRows(admitted.projectRoot, admitted.runId, ledgerReadScope(admitted));
                 let ticketNumber;
                 for (const row of rows) {
                     if (row.role !== admitted.role
@@ -708,7 +618,7 @@ export async function dispatchPostAdmissionTurn(input) {
                     code: null,
                     stderr: "",
                     thrown: error,
-                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState)),
+                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState, courtScope.notePackageFault)),
                 ...(result.turnDispatched === true ? { turnDispatched: true } : {}),
                 ...(result.skipAutoResume === true ? { skipAutoResume: true } : {}),
                 ...deferredPersist,
@@ -718,7 +628,6 @@ export async function dispatchPostAdmissionTurn(input) {
     try {
         // #987: do not pre-block or classify host dispatch from AK credential
         // catalog facts. Per-invocation runner/host evidence owns provider identity.
-        await clearTypedProviderHttpObservation(admitted.runDirectory);
         // The authoritative host write (markRunRunning) is delayed to just before
         // executeTurn — not merely past beforeDispatch (#840 r9 判词 class 2). Any
         // pre-turn retry (beforeDispatch, continuation assembly) must not commit a host
@@ -740,7 +649,7 @@ export async function dispatchPostAdmissionTurn(input) {
                     code: null,
                     stderr: "",
                     thrown: error,
-                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState));
+                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState, courtScope.notePackageFault));
                 return { ...settled, ...deferredPersist };
             }
         }
@@ -772,6 +681,10 @@ export async function dispatchPostAdmissionTurn(input) {
         // auto-resume re-enters this dispatch and must reuse the same scope.
         let result;
         try {
+            // A bare `ak-role resume` only forwards the caller's instruction to the
+            // host CLI's native resume. Nothing here may gate, redirect or reshape
+            // that dispatch on prior conclusions, row counts or report presence;
+            // the authoritative post-turn settlement reads whatever really happened.
             recordRunStart(admitted.runDirectory);
             turnDispatched = true;
             result = await env.roleTurnHost.executeTurn(turnRequest);
@@ -782,10 +695,11 @@ export async function dispatchPostAdmissionTurn(input) {
                 timedOut: false,
                 code: null,
                 stderr: "",
-                thrown: processCancelName === undefined
-                    ? error
-                    : new Error(processCancelDiagnostic(processCancelName), { cause: error }),
-            }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
+                // The thrown value is the host's report. A cancel received on this
+                // call is a second fact; it must not become a new Error in its place.
+                ...(processCancelName === undefined ? {} : { cancelName: processCancelName }),
+                thrown: error,
+            }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState, courtScope.notePackageFault);
             return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...settled, turnDispatched: true, ...deferredPersist }, env.signal));
         }
         // #1132: settle this turn through the ONE post-turn settlement authority,
@@ -801,6 +715,8 @@ export async function dispatchPostAdmissionTurn(input) {
             persistRunState,
             deferredPersist,
             finishAfterTurn,
+            courtScope,
+            markPending: (terminal) => { pendingSettlement = "sealed"; pendingTerminal = terminal; },
         });
         if (settledTurn.kind === "settled")
             return settledTurn.outcome;
@@ -863,6 +779,8 @@ export async function dispatchPostAdmissionTurn(input) {
                 persistRunState: false,
                 deferredPersist,
                 finishAfterTurn,
+                courtScope,
+                markPending: (terminal) => { pendingSettlement = "sealed"; pendingTerminal = terminal; },
             });
             // The delivery turn's own outcome IS the run's outcome, except when it
             // simply still has no receipt — that is the loop's own case to keep going.
@@ -875,9 +793,7 @@ export async function dispatchPostAdmissionTurn(input) {
                 // NOT write; this one, which ends the run, must.
                 if (persistRunState && deliveryTurn.outcome.terminal !== undefined) {
                     try {
-                        await persistReturnedRunState(admitted, {
-                            lawful: isLawfulTypedTerminalOutcome(deliveryTurn.outcome.terminal.roleOutcome),
-                        });
+                        await persistReturnedRunState(admitted);
                     }
                     catch (error) {
                         await recordBestEffortPostDispatchDiagnostic(admitted, env, `run-state persistence failed beside催交 terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
@@ -886,7 +802,7 @@ export async function dispatchPostAdmissionTurn(input) {
                 return await finishAfterTurn(deliveryTurn.outcome);
             }
         }
-        const noReceiptScope = settlementScopeForTurn(request);
+        const noReceiptScope = { ...courtScope, previewOnly: true };
         const noReceipt = await attachRecordedSubmissions(admitted, await settleHostEndedNoReceipt(admitted, env.principalAuthority, noReceiptScope, receiptDelivery.issuedDeliveryRequests()), noReceiptScope);
         // #855: cancel during no_receipt settlement window is not lawful success.
         const noReceiptCancel = processCancelSignalName(env.signal);
@@ -901,17 +817,20 @@ export async function dispatchPostAdmissionTurn(input) {
                 persistRunState,
                 deferredPersist,
                 invocationScopeId: request.invocationScopeId,
+                notePackageFault: courtScope.notePackageFault,
             }));
         }
         if (persistRunState) {
             try {
-                await persistReturnedRunState(admitted, { lawful: true });
+                await persistReturnedRunState(admitted);
             }
             catch (error) {
                 await recordBestEffortPostDispatchDiagnostic(admitted, env, `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
             }
         }
         // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
+        pendingSettlement = "no_receipt";
+        pendingTerminal = noReceipt;
         return await finishAfterTurn({
             exitCode: exitCodeForTerminalOutcome(noReceipt.roleOutcome),
             admitted,
@@ -1008,7 +927,6 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
             kind: "resume",
             prompt,
         },
-        ...(request.message === undefined ? {} : { courtAttemptId: randomUUID() }),
         ...(env.stationChild === undefined ? {} : { stationChild: env.stationChild }),
         // #1132: one configured ceiling, already resolved by the caller (#422).
         deliveryRequestLimit: deliveryLimitFromConfig(env.autoResumeLimit),
@@ -1083,7 +1001,7 @@ async function runSettledAutoResumeLoop(input) {
                         ? {}
                         : { effectiveEngine: input.effectiveEngine }),
                 });
-                return settleDeferredPersist(input.admitted, input.env.principalAuthority, adapters, attemptIo, result);
+                return settleDeferredPersist(input.admitted, input.env, attemptIo, result);
             },
         }),
     });
@@ -1204,11 +1122,13 @@ export async function runPostAdmissionSeatResume(input) {
                 };
             }
         }
-        // Open court continue, or new court for summons / message re-review
-        // (clause 0 新庭可再交卷; #833). Bare resume without open court omits id.
-        if (openCourtAttemptId !== undefined ||
-            request.summons !== undefined ||
-            request.message !== undefined) {
+        // Open court continue, or a new court for a real re-summons
+        // (clause 0 新庭可再交卷; #833). Bare resume — with or without caller
+        // words — carries no summons and no open court, so it mints none:
+        // the package must not turn ordinary continuation bytes into an audit
+        // court whose attempt scope would reshape settlement (#1032 修订票：
+        // 此要求不延伸到没有该传召庭次的裸 resume).
+        if (openCourtAttemptId !== undefined || request.summons !== undefined) {
             const courtAttemptId = openCourtAttemptId ??
                 (turnRequest.courtAttemptId !== undefined &&
                     turnRequest.courtAttemptId.length > 0
@@ -1328,8 +1248,7 @@ function writeResumeFailurePointer(io, errorPath) {
 export function showResumeErrorPointer(io, exitCode, terminal) {
     if (exitCode === 0 || terminal === undefined)
         return;
-    const publishedError = terminal.artifacts.find((artifact) => artifact.kind === "error")?.path
-        ?? publishedFailureErrorPath(terminal);
+    const publishedError = terminal.artifacts.find((artifact) => artifact.kind === "error")?.path;
     if (publishedError !== undefined)
         writeResumeFailurePointer(io, publishedError);
 }
@@ -1470,7 +1389,7 @@ export async function runPostAdmissionManualResume(input) {
         // through its own settleAfterTurnStarted-backed branches; a lawful result
         // only ever reaches this point once that persist has already succeeded
         // (#836 r12 class 3 dedup — one persist owner, not a second here).
-        io.stdout(formatTerminalResult(result.terminal));
+        await presentTerminal(result.terminal, io, admitted.runDirectory);
     }
     if (result.terminal !== undefined) {
         result.terminal.autoResumeCount = 0;