@akagilnc/pi-workflow-roles 0.1.5483 → 0.1.5571

package/dist/public-cli/settlement.js

@@ -6,54 +6,28 @@
 import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { lstat, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { writeHardenedArtifactFile } from "./auto-resume.js";
-import { readAnalystGateCyclesFromAuditorRoles, } from "../analyst-gate-cycles-read.js";
+import { sessionFileOf } from "../role-run-placement.js";
 import { sitianReport } from "../sitian-facade.js";
+import { ATTEMPT_HISTORY_IDENTITY_FIELD, TERMINAL_COURT_ATTEMPT_FIELD, writeRunTerminal, } from "../run-terminal-artifacts.js";
 import { readAttemptScopedSubmissionRows, readRecordedSubmissionRows, readRecordedSubmissions, } from "../submission-ledger.js";
 import { CONTROLLED_FAILURE_CAUSES } from "../host-contracts.js";
 import { childSignalDeathDiagnostic, processCancelDiagnostic, } from "./process-cancel.js";
+import { readStrictPiSessionJsonl } from "../ledger-session-read.js";
 import { serializeThrownValue } from "../serialize-thrown-value.js";
 import { describeErrorIdentity } from "./run-lifecycle.js";
 import { readEngineDetourToolUsage, readInvocationEngineMounted, runDirectoryFromSessionDirectory, sessionFileFromSessionDirectory, withEngineDetourToolUsageFact, } from "../engine-detour-usage.js";
 import { DOCTOR_CANDIDATE_ENTRY_TYPE } from "../dossier-resolution.js";
-import { ensureRunArtifactsDir, homeFromRunDirectory, } from "./invocation.js";
+import { homeFromRunDirectory, } from "./invocation.js";
 import { SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY, SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, } from "../secretariat-contracts.js";
 import { findLatestDurablePackagedRoleTerminal, NAVIGATOR_ROUTE_PLAYBOOK_FAILURE_ENTRY, } from "../navigator-invocation-identity.js";
-import { packagedDurableOfficerEntry, packagedRoleAcceptedOutputTool, packagedRoleMetadata, packagedSkipsGateOnInfrastructureStage, } from "../packaged-role-registry.js";
+import { packagedDurableOfficerEntry, packagedRoleAcceptedOutputTool, packagedRoleMetadata, } from "../packaged-role-registry.js";
 import { NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, noReceiptLifecycleFacts, parseNoReceiptLifecycleFacts, priorReceiptContinuation, receiptAttemptPointer, } from "../receipt-delivery-policy.js";
-import { roleRunArtifactsDirectory } from "../role-run-placement.js";
-import { listSeamOwnedUniqueErrorFacePaths, uniqueErrorFallbackName, UNIQUE_ERROR_FALLBACK_STEM, RUN_TERMINAL_ARTIFACT_FILES, RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS, RUN_TERMINAL_REPORT_FILE, RUN_TERMINAL_ERROR_FILE, RUN_TERMINAL_EVIDENCE_FILE, RUN_TERMINAL_ERROR_SETTLEMENT_FILE, } from "../run-terminal-artifacts.js";
+import { readStateRowsSync, runCurrentPath } from "../run-dossier.js";
+import { reportRunRecord } from "../sitian-facade.js";
 /** Ledger reads use the run's machine home — not ambient process HOME (child write vs parent settle). */
 function sealedLedgerHome(admitted) {
     return homeFromRunDirectory(admitted.runDirectory);
 }
-/**
- * Hardened artifacts directory. A planted symlink at the run directory or the
- * artifacts path must not receive a durable run artifact.
- */
-export async function ensureRealArtifactsDirectory(runDirectory) {
-    const runStat = await lstat(runDirectory);
-    if (runStat.isSymbolicLink() || !runStat.isDirectory()) {
-        throw new Error("run artifact retention: run directory is not a real directory");
-    }
-    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-    try {
-        const existing = await lstat(artifactsDir);
-        if (existing.isSymbolicLink() || !existing.isDirectory()) {
-            throw new Error("run artifact retention: artifacts path is not a real directory");
-        }
-    }
-    catch (error) {
-        if (!isEnoent(error))
-            throw error;
-        await mkdir(artifactsDir, { recursive: true });
-        const created = await lstat(artifactsDir);
-        if (created.isSymbolicLink() || !created.isDirectory()) {
-            throw new Error("run artifact retention: artifacts directory is not a real directory");
-        }
-    }
-    return artifactsDir;
-}
 /**
  * One retention path for a package fault beside an already chosen terminal.
  * Session append is first when the caller has that channel. The artifact file
@@ -67,13 +41,14 @@ export async function retainPackageFault(input) {
         ...(Object.hasOwn(input, "error") ? { failure: projectThrownFailureLeaf(input.error) } : {}),
     };
     let retentionFailure;
-    const writeArtifact = async (appendFailure) => {
-        const artifactsDir = await ensureRealArtifactsDirectory(input.runDirectory);
-        await writeHardenedArtifactFile(artifactsDir, "post-admission-diagnostic", {
+    // The run's log is the fallback after the session append throws, and the only
+    // channel when the caller has none.
+    const writeLog = (appendFailure) => {
+        reportRunRecord(input.runDirectory, "post-admission-diagnostic", {
             version: 1,
             ...payload,
             ...(appendFailure === undefined ? {} : { retentionFailure: appendFailure }),
-        });
+        }, "settlement");
     };
     if (input.appendSession !== undefined) {
         try {
@@ -83,21 +58,21 @@ export async function retainPackageFault(input) {
             retentionFailure =
                 `post-dispatch diagnostic session append failed (best-effort continue): dossier=${describeErrorIdentity(appendError)}`;
             try {
-                await writeArtifact(projectThrownFailureLeaf(appendError));
+                writeLog(projectThrownFailureLeaf(appendError));
             }
-            catch (artifactError) {
+            catch (logError) {
                 retentionFailure =
-                    `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`;
+                    `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; log=${describeErrorIdentity(logError)}`;
             }
         }
     }
     else {
         try {
-            await writeArtifact();
+            writeLog();
         }
-        catch (artifactError) {
+        catch (logError) {
             retentionFailure =
-                `post-dispatch diagnostic durable retention failed (best-effort continue): artifact=${describeErrorIdentity(artifactError)}`;
+                `post-dispatch diagnostic durable retention failed (best-effort continue): log=${describeErrorIdentity(logError)}`;
         }
     }
     const stderr = input.stderr ?? ((text) => {
@@ -123,7 +98,7 @@ export async function noteSettlementFault(runDirectory, scope, diagnostic) {
 export function ledgerReadScope(admitted, scope) {
     return {
         home: sealedLedgerHome(admitted),
-        sessionParent: join(admitted.runDirectory, "session", "session.jsonl"),
+        sessionParent: sessionFileOf(admitted.runDirectory),
         ...(scope?.courtAttemptId === undefined || scope.courtAttemptId.length === 0
             ? {}
             : { attemptId: scope.courtAttemptId }),
@@ -292,17 +267,30 @@ async function settleNoReceiptTerminal(admitted, authority, scope, facts) {
             kind: "no_receipt", role: admitted.role, status: "no-accepted-receipt",
             ...facts, decisiveFacts: facts,
         };
+    let attemptHistoryIdentity;
     if (scope?.recordAttemptHistory === true) {
-        await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
+        const pointer = await appendRunAttemptHistory(attemptHistorySource(admitted, coordinates), roleOutcome);
+        attemptHistoryIdentity = pointer.identity;
+    }
+    else {
+        attemptHistoryIdentity = await belongingAttemptHistoryIdentity(admitted.runDirectory, scope);
+    }
+    if (scope?.previewOnly !== true) {
+        // Belonging settlement only (#1161 甲 / R2): never inherit another court's
+        // latest terminal pointer, and never invent a history row on re-projection (N1).
+        writeRunTerminal(admitted.runDirectory, "no_receipt", {
+            role: admitted.role,
+            runId: admitted.runId,
+            outcome: roleOutcome,
+            ...terminalBelongingFields(attemptHistoryIdentity, scope),
+        });
     }
-    if (scope?.previewOnly !== true)
-        await clearOppositeTerminalArtifactFace(admitted.runDirectory);
-    return withOptionalGateProjection({
+    return attachEngineDetourToolUsage({
         roleOutcome,
         navigator: await extractNavigatorFactFromAdmittedSession(coordinates.sessionFile, admitted.runDirectory, scope),
         artifacts: [],
         runId: admitted.runId,
-    }, coordinates.sessionDirectory, detourGateContext(admitted, scope));
+    }, coordinates.sessionDirectory, detourUsageContext(admitted, scope));
 }
 /** Transitional host-session reads remain only for non-sealed failure and audit evidence. */
 function coordinatesFromAdmitted(authority, admitted) {
@@ -638,12 +626,7 @@ export const NAVIGATOR_POST_ROLE_GRACE_MS = 10_000;
  * terminal note it; they do not relabel it as a host session cause.
  */
 export async function readBoundSessionEntries(sessionFile) {
-    const text = await readFile(sessionFile, "utf8");
-    const entries = [];
-    for (const line of text.trim().split("\n").filter(Boolean)) {
-        entries.push(JSON.parse(line));
-    }
-    return entries;
+    return await readStrictPiSessionJsonl(sessionFile);
 }
 /**
  * #419 per-attempt process history. 史必追加，指针可覆盖；指针可以覆盖的前提是史已落。
@@ -652,9 +635,16 @@ export async function readBoundSessionEntries(sessionFile) {
  * second ledger mechanism is introduced.
  */
 export const ATTEMPT_HISTORY_ENTRY_TYPE = "ak_run_attempt_history";
+function attemptHistorySource(admitted, coordinates) {
+    return {
+        role: admitted.role,
+        runId: admitted.runId,
+        sessionFile: coordinates.sessionFile,
+    };
+}
 /** Append the complete attempt to the package ledger before overwriting pointer artifacts (#419). */
 export async function appendRunAttemptHistory(source, outcome) {
-    sitianReport({
+    return sitianReport({
         level: "event",
         kind: "attempt-history",
         subject: { runId: source.runId },
@@ -737,61 +727,6 @@ function parseNavigatorAttendanceDetails(details) {
         reason: "Navigator attendance disposition is unparseable",
     };
 }
-/**
- * Project direct and historical paired gate rounds onto the public Terminal.
- * actualSeats derive only from accepted receipts, never expected/missing seats.
- */
-export function projectTerminalGateFact(rounds) {
-    if (rounds.length === 0)
-        return undefined;
-    const seen = new Set();
-    for (const round of rounds) {
-        if (round.origin.kind === "historical_dispatch")
-            seen.add("gatekeeper");
-        seen.add(round.officer);
-    }
-    const actualSeats = ["gatekeeper", "inspector", "notary"].filter((seat) => seen.has(seat));
-    return {
-        actualSeats,
-        rounds: rounds.map((round) => ({
-            roundIndex: round.roundIndex,
-            dispatch: round.origin.kind === "direct"
-                ? { kind: "direct", officer: round.officer }
-                : {
-                    kind: "historical_dispatch",
-                    officer: round.officer,
-                    ...(round.origin.reason === undefined
-                        ? {}
-                        : { reason: round.origin.reason }),
-                },
-            officer: {
-                seat: round.officer,
-                status: round.status,
-                findings: round.findings,
-            },
-        })),
-    };
-}
-/**
- * Read gate facts from the run's session/auditor-roles nest (#446/#478).
- * Missing directories → undefined (no-gate zero change).
- * Damaged discovered volumes propagate — never wash to "no gate".
- */
-export async function extractGateFactFromSessionDirectory(sessionDirectory, options = {}) {
-    const directories = [join(sessionDirectory, "auditor-roles")];
-    const parentSessionFile = options.parentSessionFile ?? join(sessionDirectory, "session.jsonl");
-    const rounds = await readAnalystGateCyclesFromAuditorRoles(directories, {
-        parentSessionFile,
-    });
-    return projectTerminalGateFact(rounds);
-}
-/**
- * Attach optional gate projection onto a settled Terminal base.
- * Shared by every settle path so auditor-roles is scanned once here only.
- * `runId` is optional only for a batch projection that has no parent run.
- * Gate read damage is a package note beside the host terminal. It does not
- * replace that terminal and it does not omit the gate without a trace.
- */
 /**
  * #537: project this-invocation ak_engine_detour usage onto decisiveFacts.
  * Absent when engine is not mounted; callCount 0 when mounted with zero calls.
@@ -800,27 +735,27 @@ export async function extractGateFactFromSessionDirectory(sessionDirectory, opti
  * courtAttemptId and never Pi session.jsonl toolResult join. Session damage
  * therefore cannot replace an already-formed roleOutcome (no_receipt / failure).
  */
-async function attachEngineDetourToolUsage(base, sessionDirectory, gateContext = {}) {
-    const runDirectory = typeof gateContext.runDirectory === "string" && gateContext.runDirectory.length > 0
-        ? gateContext.runDirectory
+async function attachEngineDetourToolUsage(base, sessionDirectory, detourContext = {}) {
+    const runDirectory = typeof detourContext.runDirectory === "string" && detourContext.runDirectory.length > 0
+        ? detourContext.runDirectory
         : runDirectoryFromSessionDirectory(sessionDirectory);
     let engineMounted = false;
     try {
         engineMounted = await readInvocationEngineMounted(runDirectory);
     }
     catch (error) {
-        await noteSettlementFault(runDirectory, gateContext.notePackageFault === undefined
+        await noteSettlementFault(runDirectory, detourContext.notePackageFault === undefined
             ? undefined
-            : { notePackageFault: gateContext.notePackageFault }, `engine mount read failed beside host terminal: ${describeErrorIdentity(error)}`);
+            : { notePackageFault: detourContext.notePackageFault }, `engine mount read failed beside host terminal: ${describeErrorIdentity(error)}`);
         return base;
     }
     if (!engineMounted)
         return base;
     // Public-invocation scope from the shared Host envelope (settlement scope), never
     // courtAttemptId and never a detour sidecar file.
-    const invocationScopeId = typeof gateContext.invocationScopeId === "string" &&
-        gateContext.invocationScopeId.length > 0
-        ? gateContext.invocationScopeId
+    const invocationScopeId = typeof detourContext.invocationScopeId === "string" &&
+        detourContext.invocationScopeId.length > 0
+        ? detourContext.invocationScopeId
         : undefined;
     const sessionFile = sessionFileFromSessionDirectory(sessionDirectory);
     let usage;
@@ -833,9 +768,9 @@ async function attachEngineDetourToolUsage(base, sessionDirectory, gateContext =
         });
     }
     catch (error) {
-        await noteSettlementFault(runDirectory, gateContext.notePackageFault === undefined
+        await noteSettlementFault(runDirectory, detourContext.notePackageFault === undefined
             ? undefined
-            : { notePackageFault: gateContext.notePackageFault }, `engine detour read failed beside host terminal: ${describeErrorIdentity(error)}`);
+            : { notePackageFault: detourContext.notePackageFault }, `engine detour read failed beside host terminal: ${describeErrorIdentity(error)}`);
         return base;
     }
     return {
@@ -843,45 +778,16 @@ async function attachEngineDetourToolUsage(base, sessionDirectory, gateContext =
         roleOutcome: withEngineDetourToolUsageFact(base.roleOutcome, usage),
     };
 }
-/** Gate + detour projection context from admitted run + settlement scope. */
-function detourGateContext(admitted, scope) {
+/** Engine-detour usage context from admitted run + settlement scope. */
+function detourUsageContext(admitted, scope) {
     return {
         runDirectory: admitted.runDirectory,
-        ...(scope?.courtAttemptId === undefined || scope.courtAttemptId.length === 0
-            ? {}
-            : { courtAttemptId: scope.courtAttemptId }),
         ...(scope?.invocationScopeId === undefined || scope.invocationScopeId.length === 0
             ? {}
             : { invocationScopeId: scope.invocationScopeId }),
         ...(scope?.notePackageFault === undefined ? {} : { notePackageFault: scope.notePackageFault }),
     };
 }
-async function withOptionalGateProjection(base, sessionDirectory, gateContext = {}) {
-    // A gate transport failure is already represented by typed evidence and has no
-    // accepted gate cycle to project. Re-reading that rejected receipt as an
-    // accepted cycle would replace the original failure with a projection error.
-    const secondaryEvidence = base.roleOutcome.kind === "failure"
-        ? base.roleOutcome.decisiveFacts.secondaryEvidence
-        : undefined;
-    const skipGate = isRecord(secondaryEvidence)
-        && secondaryEvidence.kind === "role_infrastructure_failure"
-        && packagedSkipsGateOnInfrastructureStage(secondaryEvidence.stage);
-    let next = base;
-    if (!skipGate) {
-        try {
-            const gate = await extractGateFactFromSessionDirectory(sessionDirectory, gateContext);
-            if (gate !== undefined)
-                next = { ...base, gate };
-        }
-        catch (error) {
-            const runDirectory = gateContext.runDirectory ?? runDirectoryFromSessionDirectory(sessionDirectory);
-            await noteSettlementFault(runDirectory, gateContext.notePackageFault === undefined
-                ? undefined
-                : { notePackageFault: gateContext.notePackageFault }, `gate read failed beside host terminal: ${describeErrorIdentity(error)}`);
-        }
-    }
-    return attachEngineDetourToolUsage(next, sessionDirectory, gateContext);
-}
 function routePlaybookFailureMessage(entries) {
     for (let i = entries.length - 1; i >= 0; i -= 1) {
         const entry = entries[i];
@@ -956,85 +862,92 @@ async function extractNavigatorFactFromAdmittedSession(sessionFile, runDirectory
     }
 }
 /**
- * Remove one face path (file or directory collision plant).
- * Only missing target is silent — other errno stay loud (失败诚实).
- * recursive: publication may have occupied a face name as a directory (EISDIR plant).
+ * Sole success-terminal publisher (#953): replace the leg's terminal in
+ * current.json. The report carries the outcome's verdict facts; the role's
+ * submitted payloads live in history.jsonl. The terminal names the
+ * attempt-history row that belongs to this settlement — from this settle's
+ * append when recording, otherwise that court's prior terminal row in
+ * state.jsonl (#1161 甲 / R2). Never content-match payloads, never inherit the
+ * leg's latest terminal, never invent a history row on re-projection (N1).
  */
-async function removeFaceIfPresent(path) {
-    try {
-        await rm(path, { recursive: true, force: true });
+async function publishAcceptedTerminal(admitted, roleOutcome, coordinates, scope, report) {
+    // #419: a dispatched turn appends before rewriting last-write-wins views;
+    // a later projection may refresh views but must not invent another attempt.
+    let attemptHistoryIdentity;
+    if (scope?.recordAttemptHistory === true) {
+        const pointer = await appendRunAttemptHistory(attemptHistorySource(admitted, coordinates), roleOutcome);
+        attemptHistoryIdentity = pointer.identity;
     }
-    catch (error) {
-        // force:true already ignores ENOENT; ENOTDIR = face path not enterable
-        // (artifacts-as-file mid-path) — same absent-face semantics as the reader.
-        // Other errno stay loud (失败诚实).
-        if (isMissingPathError(error))
-            return;
-        throw error;
+    else {
+        attemptHistoryIdentity = await belongingAttemptHistoryIdentity(admitted.runDirectory, scope);
     }
+    writeRunTerminal(admitted.runDirectory, "report", {
+        ...report,
+        ...terminalBelongingFields(attemptHistoryIdentity, scope),
+    });
+    return [{ kind: "report", path: runCurrentPath(admitted.runDirectory) }];
 }
-/**
- * #953: artifact face reflects the current terminal only.
- * Reader contract owns the full adoptable set (conventional trio + fixed
- * fallbacks + seam-owned unique). Clear every seam-owned face before the
- * new current publishes — including the conventional name about to be
- * rewritten. Retaining that name left directory collision plants in place
- * (supported publish input); writer then fell back while the reader stopped
- * at EISDIR on the stale conventional path and never adopted the fallback.
- * report / error / empty share one method (no per-branch face list).
- * empty publishes nothing; does not create a no_receipt-shaped public artifact.
- * Non-terminal materials stay. Face names may be directory collision plants —
- * remove recursively. Unique ownership is listSeamOwnedUniqueErrorFacePaths:
- * parent runs/ faces clear only when body.runId binds; unparseable runId → none.
- * Path absence (ENOENT/ENOTDIR) is silent; other delete failures stay loud.
- */
-async function clearOppositeTerminalArtifactFace(runDirectory) {
-    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-    for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-        await removeFaceIfPresent(join(artifactsDir, file));
-    }
-    // Fixed fallbacks + unique clear too; subsequent publish writes the new
-    // durable path after this clear (conventional first when writable).
-    for (const relative of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-        await removeFaceIfPresent(join(runDirectory, relative));
-    }
-    for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
-        await removeFaceIfPresent(path);
-    }
-}
-async function ensureTerminalArtifactFace(runDirectory) {
-    const artifactsDir = await ensureRunArtifactsDir(runDirectory);
-    await clearOppositeTerminalArtifactFace(runDirectory);
-    return artifactsDir;
-}
-function acceptedArtifactAttachmentRefs(attachments) {
-    return attachments.map((a) => ({
-        provenancePath: a.provenancePath,
-        frozenPath: a.frozenPath,
-        sha256: a.sha256,
-        byteLength: a.byteLength,
-    }));
+/** 甲 pointer + court tag carried on the terminal body for later re-projection. */
+function terminalBelongingFields(attemptHistoryIdentity, scope) {
+    const courtAttemptId = scope?.courtAttemptId;
+    return {
+        ...(attemptHistoryIdentity === undefined
+            ? {}
+            : { [ATTEMPT_HISTORY_IDENTITY_FIELD]: attemptHistoryIdentity }),
+        ...(courtAttemptId === undefined || courtAttemptId.length === 0
+            ? {}
+            : { [TERMINAL_COURT_ATTEMPT_FIELD]: courtAttemptId }),
+    };
 }
 /**
- * Sole success-terminal artifact publisher (#953): append attempt history,
- * refresh the public terminal face, write report/evidence, return refs.
- * Seat-specific structured fields stay in callers; do not fork this flow.
+ * Belonging attempt-history identity for a non-recording re-projection (#1161 甲 / R2).
+ * Court-tagged settle recovers from that court's own prior terminal row in
+ * state.jsonl. Untagged normal rewrite (bare resume after a sealed face, no open
+ * court) keeps only the face being rewritten — the last terminal row's own
+ * identity. If that face has none (approved gap), return undefined: never walk
+ * older terminals for a non-empty pointer, never invent-append (N1), never
+ * subject.attemptId on attempt-history. Bare resume therefore cannot restore
+ * court B's pointer while the current face is A (or A's gap). Court-tagged
+ * lookup that finds no row still returns undefined — the approved gap.
  */
-async function publishAcceptedTerminalArtifacts(admitted, roleOutcome, coordinates, recordAttemptHistory, bodies) {
-    // #419: a dispatched turn appends before rewriting last-write-wins views;
-    // a later projection may refresh views but must not invent another attempt.
-    if (recordAttemptHistory) {
-        await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile: coordinates.sessionFile }, roleOutcome);
-    }
-    const artifactsDir = await ensureTerminalArtifactFace(admitted.runDirectory);
-    const reportPath = join(artifactsDir, RUN_TERMINAL_REPORT_FILE);
-    const evidencePath = join(artifactsDir, RUN_TERMINAL_EVIDENCE_FILE);
-    await writeFile(reportPath, `${JSON.stringify(bodies.report, null, 2)}\n`, "utf8");
-    await writeFile(evidencePath, `${JSON.stringify(bodies.evidence, null, 2)}\n`, "utf8");
-    return [
-        { kind: "report", path: reportPath },
-        { kind: "evidence", path: evidencePath },
-    ];
+async function belongingAttemptHistoryIdentity(runDirectory, scope) {
+    const courtAttemptId = scope?.courtAttemptId;
+    let rows;
+    try {
+        rows = readStateRowsSync(runDirectory);
+    }
+    catch (error) {
+        // Documented: history/state failure domain does not block the terminal face
+        // (#1161 / main history disposition). True cause must leave a trace.
+        await noteSettlementFault(runDirectory, scope, `terminal state read failed beside terminal projection: ${describeErrorIdentity(error)}`);
+        return undefined;
+    }
+    if (courtAttemptId !== undefined && courtAttemptId.length > 0) {
+        let found;
+        for (const row of rows) {
+            if (row.kind !== "terminal" || !isRecord(row.payload))
+                continue;
+            const body = row.payload.body;
+            if (!isRecord(body) || body[TERMINAL_COURT_ATTEMPT_FIELD] !== courtAttemptId)
+                continue;
+            const identity = body[ATTEMPT_HISTORY_IDENTITY_FIELD];
+            if (typeof identity === "string" && identity.length > 0)
+                found = identity;
+        }
+        return found;
+    }
+    // Untagged: only the current face (last terminal). Gap face stays a gap.
+    for (let index = rows.length - 1; index >= 0; index -= 1) {
+        const row = rows[index];
+        if (row.kind !== "terminal" || !isRecord(row.payload))
+            continue;
+        const body = row.payload.body;
+        if (!isRecord(body))
+            return undefined;
+        const identity = body[ATTEMPT_HISTORY_IDENTITY_FIELD];
+        return typeof identity === "string" && identity.length > 0 ? identity : undefined;
+    }
+    return undefined;
 }
 /**
  * Read session entries for lawful settlement.
@@ -1070,13 +983,13 @@ async function settleSealedSeat(admitted, authority, scope, options) {
 async function finishLawfulSeat(admitted, coordinates, entries, roleOutcome, scope) {
     const artifacts = scope?.previewOnly === true
         ? []
-        : await publishDeclaredSeatArtifacts(admitted, roleOutcome, coordinates, entries, scope?.recordAttemptHistory === true);
-    const terminal = await withOptionalGateProjection({
+        : await publishDeclaredSeatTerminal(admitted, roleOutcome, coordinates, entries, scope);
+    const terminal = await attachEngineDetourToolUsage({
         roleOutcome,
         navigator: extractNavigatorFact(entries),
         artifacts,
         runId: admitted.runId,
-    }, coordinates.sessionDirectory, detourGateContext(admitted, scope));
+    }, coordinates.sessionDirectory, detourUsageContext(admitted, scope));
     return attachRecordedSubmissions(admitted, terminal, scope);
 }
 /**
@@ -1118,8 +1031,8 @@ function extractDoctorCandidateFacts(entries) {
     }
     return {};
 }
-const EMPTY_ARTIFACT_FACE = { leaves: [] };
-/** Artifact face for one seat. Absent means report/evidence carry only shared leaves. */
+const EMPTY_ARTIFACT_FACE = {};
+/** Terminal face for one seat. Absent means the report carries only the shared facts. */
 function seatArtifactFace(role) {
     const record = packagedRoleMetadata(role);
     if (record !== undefined && "artifactFace" in record && record.artifactFace !== undefined) {
@@ -1127,30 +1040,6 @@ function seatArtifactFace(role) {
     }
     return EMPTY_ARTIFACT_FACE;
 }
-function readAdmittedPath(source, path) {
-    let current = source;
-    for (const part of path.split(".")) {
-        if (typeof current !== "object" || current === null)
-            return undefined;
-        current = current[part];
-    }
-    return current;
-}
-function evidenceLeaves(admitted, leaves) {
-    const evidence = {};
-    for (const leaf of leaves) {
-        if (leaf.callerProvenance === true) {
-            if (!admitted.instructionEmpty)
-                evidence[leaf.key] = admitted.instruction;
-            continue;
-        }
-        const value = readAdmittedPath(admitted, leaf.from ?? leaf.key);
-        if (value === undefined && leaf.omitUndefined === true)
-            continue;
-        evidence[leaf.key] = leaf.copyArray === true && Array.isArray(value) ? [...value] : value;
-    }
-    return evidence;
-}
 function doctorReportFacts(face, roleOutcome, entries) {
     if (face.doctorReportFacts !== true || roleOutcome.kind === "audit_escalation")
         return {};
@@ -1160,28 +1049,19 @@ function doctorReportFacts(face, roleOutcome, entries) {
         ...(facts.auditNoReceipt === undefined ? {} : { auditNoReceipt: facts.auditNoReceipt }),
     };
 }
-async function publishDeclaredSeatArtifacts(admitted, roleOutcome, coordinates, entries, recordAttemptHistory) {
+async function publishDeclaredSeatTerminal(admitted, roleOutcome, coordinates, entries, scope) {
     const face = seatArtifactFace(admitted.role);
     const phase = face.reportPhase === true
-        ? { phase: readAdmittedPath(admitted, "phase") }
+        ? { phase: admitted.phase }
         : {};
-    return publishAcceptedTerminalArtifacts(admitted, roleOutcome, coordinates, recordAttemptHistory, {
-        report: {
-            role: admitted.role,
-            runId: admitted.runId,
-            ...phase,
-            outcome: roleOutcome,
-            ...doctorReportFacts(face, roleOutcome, entries),
-        },
-        evidence: {
-            runId: admitted.runId,
-            ...(face.evidenceRole === true ? { role: admitted.role } : {}),
-            ...evidenceLeaves(admitted, face.leaves),
-            sessionDirectory: coordinates.sessionDirectory,
-            sessionFile: coordinates.sessionFile,
-            admittedRequestPath: admitted.admittedRequestPath,
-            attachments: acceptedArtifactAttachmentRefs(admitted.attachments),
-        },
+    // Payloads are the role's submitted words: they live in history.jsonl, not here.
+    const { payloads: _payloads, ...verdict } = roleOutcome;
+    return publishAcceptedTerminal(admitted, roleOutcome, coordinates, scope, {
+        role: admitted.role,
+        runId: admitted.runId,
+        ...phase,
+        outcome: verdict,
+        ...doctorReportFacts(face, roleOutcome, entries),
     });
 }
 /** Latest top-level user message index; 0 when the session has none (initial attempt). */
@@ -1317,154 +1197,40 @@ async function applySecretariatCountersignTerminal(admitted, authority, settled,
     return settled;
 }
 /**
- * After the audit gate returns, attach gate rounds and the secretariat officer
- * fact onto the terminal this turn already settled. Does not publish again —
- * a second publish would append another attempt-history row for the same attempt.
+ * After the audit gate returns, attach the secretariat officer fact onto the
+ * terminal this turn already settled. Does not publish again — a second publish
+ * would settle the same attempt twice.
  */
-export async function attachPostAuditProjection(admitted, authority, terminal, scope) {
-    const { sessionDirectory, sessionFile } = coordinatesFromAdmitted(authority, admitted);
-    let gate;
-    try {
-        gate = await extractGateFactFromSessionDirectory(sessionDirectory, {
-            runDirectory: admitted.runDirectory,
-            parentSessionFile: sessionFile,
-        });
-    }
-    catch (error) {
-        await noteSettlementFault(admitted.runDirectory, scope, `gate read failed beside host terminal: ${describeErrorIdentity(error)}`);
-    }
-    const withGate = gate === undefined ? terminal : { ...terminal, gate };
+export async function attachPostAuditCountersignFact(admitted, authority, terminal, scope) {
     if (admitted.role !== "secretariat")
-        return withGate;
-    return applySecretariatCountersignTerminal(admitted, authority, withGate, scope);
-}
-function publicationAttemptFromError(path, error) {
-    if (error instanceof Error) {
-        return {
-            path,
-            diagnostic: error.message || error.name || "write failed",
-            identity: thrownIdentity(error),
-        };
-    }
-    return { path, diagnostic: String(error) };
-}
-/**
- * Directories eligible for open-ended unique failure-artifact placement.
- * Always includes the ledger runs/ parent of the run directory so an
- * unwritable run tree cannot strand the original controlled failure.
- */
-function uniqueFailureFallbackDirs(runDirectory, baseDir) {
-    const dirs = [];
-    for (const dir of [baseDir, runDirectory, dirname(runDirectory)]) {
-        if (!dirs.includes(dir))
-            dirs.push(dir);
-    }
-    return dirs;
-}
-/**
- * Resolve a writable artifacts base directory. If `artifacts/` cannot be created
- * (e.g. a file occupies that name), fall back to the run directory itself.
- */
-async function resolveFailureArtifactsBase(runDirectory) {
-    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-    try {
-        await ensureRunArtifactsDir(runDirectory);
-        return { baseDir: artifactsDir };
-    }
-    catch (error) {
-        return {
-            baseDir: runDirectory,
-            attempt: publicationAttemptFromError(artifactsDir, error),
-        };
-    }
+        return terminal;
+    return applySecretariatCountersignTerminal(admitted, authority, terminal, scope);
 }
 /**
- * Write JSON across preferred paths, then unique open-ended fallbacks.
- * Finite fixed names must not be able to exhaust durability and strand the
- * original controlled failure outside settlement.
+ * Replace the leg's terminal with the controlled failure. A write failure
+ * propagates: the caller notes it beside the host terminal.
  */
-async function writeFailureJsonRetainingCause(preferredCandidates, uniqueFallbackDirs, stem, basePayload, priorIssues) {
-    const issues = [...priorIssues];
-    const candidates = [
-        ...preferredCandidates,
-        // One unique name per fallback dir — collisions on fixed names cannot exhaust this.
-        ...uniqueFallbackDirs.map((dir) => join(dir, stem === UNIQUE_ERROR_FALLBACK_STEM ? uniqueErrorFallbackName() : `${stem}.${randomUUID()}.json`)),
-    ];
-    for (let i = 0; i < candidates.length; i += 1) {
-        const path = candidates[i];
-        const payload = issues.length === 0
-            ? basePayload
-            : { ...basePayload, publicationIssues: issues };
-        try {
-            await writeFile(path, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
-            return { path, issues };
-        }
-        catch (error) {
-            issues.push(publicationAttemptFromError(path, error));
-        }
-    }
-    const last = issues.at(-1);
-    const error = new Error(last?.diagnostic ?? "unable to write durable failure artifact");
-    if (last?.identity?.name !== undefined && last.identity.name !== "") {
-        error.name = last.identity.name;
-    }
-    if (last?.identity?.code !== undefined) {
-        error.code = last.identity.code;
-    }
-    error.publicationAttempts = issues;
-    throw error;
-}
-export async function publishFailureArtifacts(admitted, failure, authority, onErrorPublished, recordAttemptHistory = false) {
-    const { sessionDirectory, sessionFile } = coordinatesFromAdmitted(authority, admitted);
-    const { baseDir, attempt: baseAttempt } = await resolveFailureArtifactsBase(admitted.runDirectory);
-    const priorIssues = baseAttempt === undefined ? [] : [baseAttempt];
-    // #419: a dispatched failure joins history before fixed-name views change.
-    // Re-projecting an existing failure does not append. History write failure
-    // rides publicationIssues rather than stranding the controlled failure.
-    if (recordAttemptHistory) {
+export async function publishFailureTerminal(admitted, failure, coordinates, onErrorPublished, scope) {
+    // #419: a dispatched failure joins history before the terminal changes. A history
+    // write failure never strands the failure terminal; it is rethrown after it.
+    let historyFailure;
+    let historyFailed = false;
+    const failureOutcome = { kind: "failure", role: admitted.role, ...failure };
+    let attemptHistoryIdentity;
+    if (scope?.recordAttemptHistory === true) {
         try {
-            await appendRunAttemptHistory({ role: admitted.role, runId: admitted.runId, sessionFile }, {
-                kind: "failure", role: admitted.role, ...failure,
-            });
+            const pointer = await appendRunAttemptHistory(attemptHistorySource(admitted, coordinates), failureOutcome);
+            attemptHistoryIdentity = pointer.identity;
         }
         catch (error) {
-            priorIssues.push(publicationAttemptFromError(sessionFile, error));
+            historyFailure = error;
+            historyFailed = true;
         }
     }
-    // #953: clear the prior success face, but a failure here must not strand
-    // the original controlled cause; preserve the issue beside the fallback.
-    try {
-        await clearOppositeTerminalArtifactFace(admitted.runDirectory);
+    else {
+        attemptHistoryIdentity = await belongingAttemptHistoryIdentity(admitted.runDirectory, scope);
     }
-    catch (error) {
-        priorIssues.push(publicationAttemptFromError(roleRunArtifactsDirectory(admitted.runDirectory), error));
-    }
-    // Prefer conventional names; unique fallback dirs keep colliding fixed paths
-    // from stranding the original failure outside settlement. Include the ledger
-    // runs/ parent so a locked run directory (EACCES) cannot exhaust durability.
-    const underArtifacts = baseDir === roleRunArtifactsDirectory(admitted.runDirectory);
-    const uniqueFallbackDirs = uniqueFailureFallbackDirs(admitted.runDirectory, baseDir);
-    const errorCandidates = underArtifacts
-        ? [
-            join(baseDir, RUN_TERMINAL_ERROR_FILE),
-            join(baseDir, RUN_TERMINAL_ERROR_SETTLEMENT_FILE),
-            join(admitted.runDirectory, RUN_TERMINAL_ERROR_SETTLEMENT_FILE),
-        ]
-        : [
-            join(baseDir, RUN_TERMINAL_ERROR_SETTLEMENT_FILE),
-            join(baseDir, RUN_TERMINAL_ERROR_FILE),
-        ];
-    const evidenceCandidates = underArtifacts
-        ? [
-            join(baseDir, RUN_TERMINAL_EVIDENCE_FILE),
-            join(baseDir, "evidence.settlement.json"),
-            join(admitted.runDirectory, "evidence.settlement.json"),
-        ]
-        : [
-            join(baseDir, "evidence.settlement.json"),
-            join(baseDir, RUN_TERMINAL_EVIDENCE_FILE),
-        ];
-    const errorPayloadBase = {
+    writeRunTerminal(admitted.runDirectory, "error", {
         kind: "error",
         role: admitted.role,
         runId: admitted.runId,
@@ -1475,24 +1241,13 @@ export async function publishFailureArtifacts(admitted, failure, authority, onEr
         // This package's own facts, kept beside the host's report.
         ...(failure.packageFact === undefined ? {} : { packageFact: failure.packageFact }),
         ...(failure.stderr === undefined ? {} : { stderr: failure.stderr }),
-    };
-    const errorWrite = await writeFailureJsonRetainingCause(errorCandidates, uniqueFallbackDirs, UNIQUE_ERROR_FALLBACK_STEM, errorPayloadBase, priorIssues);
-    onErrorPublished?.(errorWrite.path);
-    const evidencePayload = {
-        runId: admitted.runId,
-        sessionDirectory: sessionDirectory,
-        sessionFile: sessionFile,
-        admittedRequestPath: admitted.admittedRequestPath,
-        attachments: acceptedArtifactAttachmentRefs(admitted.attachments),
-        ...(failure.cause === undefined ? {} : { failureCause: failure.cause }),
-    };
-    const evidenceWrite = await writeFailureJsonRetainingCause(evidenceCandidates, uniqueFallbackDirs, "evidence", evidencePayload, 
-    // Evidence records the same publication collisions observed placing the error body.
-    errorWrite.issues);
-    return [
-        { kind: "error", path: errorWrite.path },
-        { kind: "evidence", path: evidenceWrite.path },
-    ];
+        ...terminalBelongingFields(attemptHistoryIdentity, scope),
+    });
+    const path = runCurrentPath(admitted.runDirectory);
+    onErrorPublished?.(path);
+    if (historyFailed)
+        throw historyFailure;
+    return [{ kind: "error", path }];
 }
 /**
  * Shared controlled-failure Terminal settlement (#107 ownership).
@@ -1506,7 +1261,7 @@ export async function settleFailureTerminalResult(admitted, failure, authority,
     let artifacts = [];
     if (options.previewOnly !== true) {
         try {
-            artifacts = await publishFailureArtifacts(admitted, failure, authority, options.onErrorPublished, options.recordAttemptHistory === true);
+            artifacts = await publishFailureTerminal(admitted, failure, coordinates, options.onErrorPublished, options);
         }
         catch (error) {
             await noteSettlementFault(admitted.runDirectory, options, `failure artifact publication failed beside host terminal: ${describeErrorIdentity(error)}`);
@@ -1538,7 +1293,7 @@ export async function settleFailureTerminalResult(admitted, failure, authority,
         diagnostic: failure.diagnostic,
         decisiveFacts,
     };
-    return withOptionalGateProjection({ roleOutcome, navigator, artifacts, runId: admitted.runId }, sessionDirectory, detourGateContext(admitted, options));
+    return attachEngineDetourToolUsage({ roleOutcome, navigator, artifacts, runId: admitted.runId }, sessionDirectory, detourUsageContext(admitted, options));
 }
 /**
  * Emit one complete failure Terminal on stdout and one concise stderr diagnostic.