@akagilnc/pi-workflow-roles 0.1.5483 → 0.1.5571

package/src/packaged-role-registry.ts

@@ -25,22 +25,9 @@ export const LEGACY_REVIEW_OUTPUT_ROLES = new Map<string, string>([
   ["ak_auditor_output", "auditor"],
 ]);
 
-/**
- * Success-face fields that still differ by seat. Presence and omission match
- * the former per-seat publishers. Key order is not part of the contract.
- */
-export type PackagedArtifactLeaf = {
-  readonly key: string;
-  readonly from?: string;
-  readonly omitUndefined?: true;
-  readonly copyArray?: true;
-  readonly callerProvenance?: true;
-};
-
+/** Success-terminal facts that still differ by seat. */
 export type PackagedArtifactFace = {
   readonly reportPhase?: true;
-  readonly evidenceRole?: true;
-  readonly leaves: readonly PackagedArtifactLeaf[];
   readonly doctorReportFacts?: true;
 };
 
@@ -126,13 +113,6 @@ export const PUBLIC_ROLE_RECORDS = [
     settlement: "sealed",
     artifactFace: {
       reportPhase: true,
-      evidenceRole: true,
-      leaves: [
-        { key: "phase" },
-        { key: "packetPath" },
-        { key: "prerequisitesPath", omitUndefined: true },
-        { key: "prerequisites" },
-      ],
     },
     boardPlacement: "marshal",
     activationFlags: [
@@ -164,11 +144,6 @@ export const PUBLIC_ROLE_RECORDS = [
     settlement: "sealed",
     artifactFace: {
       reportPhase: true,
-      evidenceRole: true,
-      leaves: [
-        { key: "phase" },
-        { key: "taskPath" },
-      ],
     },
     activationFlags: [
       { field: "taskPath", flag: "ak-coder-task", binds: "input" },
@@ -203,13 +178,6 @@ export const PUBLIC_ROLE_RECORDS = [
     /** Publish only an accepted ledger outcome; audit escalation stays unsettled here. */
     sealedAcceptedOnly: true,
     artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "baseRevision" },
-        { key: "lens" },
-        { key: "authorityRefs", copyArray: true },
-        { key: "callerProvenance", callerProvenance: true },
-      ],
     },
     /** Frozen base/lens/authority become the initial prompt; instruction follows. */
     transportPrompt: "skill-args",
@@ -242,12 +210,6 @@ export const PUBLIC_ROLE_RECORDS = [
     outputTool: COLLECTOR_OUTPUT_TOOL,
     settlement: "sealed",
     artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "prNumber", omitUndefined: true },
-        { key: "repository", from: "repository.canonical" },
-        { key: "manifestDigest" },
-      ],
     },
     boardPlacement: "collector",
     /** Taishi acceptance is a typed groups array, not a status leaf. */
@@ -277,12 +239,6 @@ export const PUBLIC_ROLE_RECORDS = [
     auditTool: DOCTOR_AUDIT_TOOL_NAME,
     settlement: "sealed",
     artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "issueNumber" },
-        { key: "caseRunsPath" },
-        { key: "caseIdentity" },
-      ],
       doctorReportFacts: true,
     },
     /** Navigator subject is the doctor case, not the case-path file bytes. */
@@ -309,11 +265,6 @@ export const PUBLIC_ROLE_RECORDS = [
     outputTool: MERGER_OUTPUT_TOOL_NAME,
     settlement: "sealed",
     artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "mergerInputPath" },
-        { key: "derived" },
-      ],
     },
     activationFlags: [
       { field: "inputPath", from: "mergerInputPath", flag: "ak-merger-input", binds: "input" },
@@ -334,8 +285,6 @@ export const PUBLIC_ROLE_RECORDS = [
     sourceRunStored: "raw",
     argvResult: "source-run",
     sameParent: "source-locator",
-    /** Infrastructure failure at this stage has no accepted gate cycle to project. */
-    skipGateOnInfrastructureStage: true,
     /** 符宝郎 is a review officer and inherits the gatekeeper model. */
     reviewOfficer: true,
     provinceConfig: true,
@@ -443,8 +392,6 @@ export const PUBLIC_ROLE_RECORDS = [
     sameParent: "gate-pointer",
     /** Resume restores an optional source-run path onto the admitted face. */
     resumeSourcePath: true,
-    /** Infrastructure failure at this stage has no accepted gate cycle to project. */
-    skipGateOnInfrastructureStage: true,
     /** 台院 is a review officer and inherits the gatekeeper model. */
     reviewOfficer: true,
     provinceConfig: true,
@@ -476,8 +423,6 @@ export const PUBLIC_ROLE_RECORDS = [
     presentSettled: "always",
     summonResume: true,
     admission: "instruction",
-    /** Infrastructure failure at this stage has no accepted gate cycle to project. */
-    skipGateOnInfrastructureStage: true,
     sameParent: "none",
     /** Province model root. Officers name this seat via modelInheritsFrom. */
     provinceConfig: true,
@@ -725,15 +670,6 @@ export function packagedAuditToolName(role: string): string | undefined {
   return record.auditTool;
 }
 
-/** Infrastructure-failure stage that must not be re-read as an accepted gate cycle. */
-export function packagedSkipsGateOnInfrastructureStage(stage: unknown): boolean {
-  return typeof stage === "string" && PUBLIC_ROLE_RECORDS.some((record) =>
-    "skipGateOnInfrastructureStage" in record
-    && record.skipGateOnInfrastructureStage === true
-    && record.role === stage
-  );
-}
-
 /** Durable officer entry whose name is the seat role. */
 export function packagedDurableOfficerEntry(officer: unknown): boolean {
   return typeof officer === "string" && PUBLIC_ROLE_RECORDS.some((record) =>

package/src/pi/adapter.ts

@@ -18,6 +18,10 @@ import type {
 import { createOAuthKeepalive, type OAuthKeepaliveOptions } from "../oauth-keepalive.ts";
 import { createRoleRuntimeExtension, type RoleRuntimeDependencies } from "../role-runtime.ts";
 import { renderAgentStartMaterials } from "../agent-start-materials.ts";
+import { runDirectoryFromHostContext } from "../host-contracts.ts";
+import { sitianReportSafe } from "../host-session-record.ts";
+import { isTerminatingToolName } from "../package-contracts/terminating-tools.ts";
+import { sessionFileOf } from "../role-run-placement.ts";
 import { projectCorrectableExecuteRejection } from "../submission-correctable-error.ts";
 import {
   WorkerCommitReminderError,
@@ -148,6 +152,12 @@ export function createPiRoleHostAdapter(
   options: { transcriptFromContext?: (context: ExtensionContext) => string; oauthKeepalive?: OAuthKeepaliveOptions } = {},
 ): PiRoleHostAdapter {
   const keepalive = createOAuthKeepalive(options.oauthKeepalive);
+  // Pi chains the before_agent_start handlers, each seeing the prompt the one before left; the
+  // prompt Pi sends is the one the last registered handler leaves. Only that handler's result is
+  // what a start was given, so only it records.
+  let beforeAgentStartHandlers = 0;
+  // Parameters of registered terminating tools — the schema Pi was handed.
+  const registeredToolParameters = new Map<string, unknown>();
   // Decode transport exactly once before Pi's native handler chain. Pi retains
   // its own transform/image propagation and per-handler error isolation.
   pi.on("input", (value) => {
@@ -160,10 +170,13 @@ export function createPiRoleHostAdapter(
     },
     registerFlag: (name, definition) => pi.registerFlag(name, definition),
     getFlag: (name) => pi.getFlag(name),
-    registerTool: (tool) => pi.registerTool(toPiToolDefinition(
-      tool,
-      (context) => projectPiContext(context, options.transcriptFromContext),
-    )),
+    registerTool: (tool) => {
+      registeredToolParameters.set(tool.name, tool.parameters);
+      return pi.registerTool(toPiToolDefinition(
+        tool,
+        (context) => projectPiContext(context, options.transcriptFromContext),
+      ));
+    },
     getAllTools: () => pi.getAllTools().map(({ name, sourceInfo }) => ({
       name,
       ...(sourceInfo?.path === undefined ? {} : { sourceInfo: { path: sourceInfo.path } }),
@@ -174,10 +187,40 @@ export function createPiRoleHostAdapter(
       const context = (value: ExtensionContext) => projectPiContext(value, options.transcriptFromContext);
       if (registration[0] === "before_agent_start") {
         const [, handler] = registration;
+        const position = beforeAgentStartHandlers;
+        beforeAgentStartHandlers += 1;
         pi.on("before_agent_start", (value, ctx) => {
-          const result = handler({ prompt: value.prompt, systemPrompt: value.systemPrompt, systemPromptOptions: value.systemPromptOptions }, context(ctx));
-          if (result instanceof Promise) return result.then((settled) => foldBeforeAgentStartReturn(settled, value.systemPrompt));
-          return foldBeforeAgentStartReturn(result, value.systemPrompt);
+          const projected = context(ctx);
+          const fold = (settled: unknown) => {
+            const folded = foldBeforeAgentStartReturn(settled, value.systemPrompt);
+            const runDirectory = runDirectoryFromHostContext(projected);
+            if (runDirectory !== undefined && position === beforeAgentStartHandlers - 1) {
+              const delivered = (folded as { systemPrompt?: string } | undefined)?.systemPrompt ?? value.systemPrompt;
+              // Record the same parameters object Pi was handed — not a
+              // headless draft-07 projection of another host's transport.
+              let outputSchema: unknown;
+              for (const [name, parameters] of registeredToolParameters) {
+                if (!isTerminatingToolName(name)) continue;
+                outputSchema = parameters;
+                break;
+              }
+              // History write failures do not stop a run (#833): declared, and Pi starts.
+              sitianReportSafe({
+                level: "event",
+                kind: "turn-delivery",
+                sessionParent: sessionFileOf(runDirectory),
+                source: "pi-adapter",
+                payload: {
+                  systemPrompt: delivered,
+                  ...(outputSchema === undefined ? {} : { outputSchema }),
+                },
+              });
+            }
+            return folded;
+          };
+          const result = handler({ prompt: value.prompt, systemPrompt: value.systemPrompt, systemPromptOptions: value.systemPromptOptions }, projected);
+          if (result instanceof Promise) return result.then(fold);
+          return fold(result);
         });
       } else if (registration[0] === "input") {
         const [, handler] = registration;

package/src/pi/durable-principal.ts

@@ -1,5 +1,3 @@
-import { join } from "node:path";
-
 import type {
   DurablePrincipal,
   DurablePrincipalAuthority,
@@ -8,7 +6,7 @@ import type {
 } from "../host-contracts.ts";
 import { resolveBookKeyFromGit } from "../activation-ledger-git.ts";
 import { resolveActivationLedgerHome } from "../activation-ledger-topology.ts";
-import { roleRunPlacement } from "../role-run-placement.ts";
+import { roleRunPlacement, sessionFileIn } from "../role-run-placement.ts";
 
 type PiDurablePrincipal = DurablePrincipal & {
   readonly sessionDirectory: string;
@@ -69,7 +67,7 @@ export const piDurablePrincipalAuthority: DurablePrincipalAuthority = {
       sessionFile:
         typeof record.sessionFile === "string" && record.sessionFile.trim() !== ""
           ? record.sessionFile
-          : join(record.sessionDirectory, "session.jsonl"),
+          : sessionFileIn(record.sessionDirectory),
     };
   },
 };

package/src/pi/role-turn-host.ts

@@ -5,7 +5,7 @@
  */
 import { execFile, spawn } from "node:child_process";
 import { constants } from "node:fs";
-import { access, appendFile, readFile, realpath } from "node:fs/promises";
+import { access, appendFile, realpath } from "node:fs/promises";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { platform } from "node:process";
 import { promisify } from "node:util";
@@ -25,9 +25,13 @@ import { ExplicitInternalActivationError } from "../host-contracts.ts";
 import { applyEngineChildEnv, ENGINE_MODEL_FLAG_NAME, normalizeEngineName } from "../engine-detour.ts";
 import { projectActivationFlags } from "../role-activation-flags.ts";
 import { encodeUserDialogueStdin } from "../user-dialogue-stdin.ts";
+import { readLedgerSessionJsonlLines, readStrictPiSessionJsonl } from "../ledger-session-read.ts";
+import { copyAndRecordHostDossier } from "../host-session-record.ts";
 import { projectThrownFailureLeaf, retainPackageFault } from "../public-cli/settlement.ts";
 import { describeErrorIdentity } from "../public-cli/run-lifecycle.ts";
 import { RECEIPT_DELIVERY_LIMIT_ENV } from "../receipt-delivery-policy.ts";
+import { createSessionIdentityAuthority } from "../session-identity.ts";
+import { sitianReport } from "../sitian-facade.ts";
 
 /** Package-relative Internal role entrypoint (ADR 0052; same path as public-cli registry). */
 const INTERNAL_ROLE_ENTRYPOINT_RELATIVE = "extensions/role-runtime.ts";
@@ -449,22 +453,96 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
         );
       }
       const timeoutMs = request.timeoutMs ?? config.timeoutMs;
-      return await spawnRunner(args, {
+      const result = await spawnRunner(args, {
         cwd: request.cwd,
         env,
         stdin,
         ...(timeoutMs === undefined ? {} : { timeoutMs }),
         ...(request.signal === undefined ? {} : { signal: request.signal }),
       });
+      // Deliver already-written Pi host facts. Pi lands at session/session.jsonl;
+      // bind projects host.sessions; copy records the landing. Host adapters do
+      // not write current.json — public bind/settlement seams own that render.
+      try {
+        const { sessionFile, sessionDirectory } = config.principalAuthority.decode(request.principal);
+        const sessionId = await readPiSessionHeaderId(sessionFile);
+        if (sessionId !== undefined) {
+          await createSessionIdentityAuthority(config.principalAuthority, "pi").bind(
+            request.principal,
+            sessionId,
+          );
+          copyAndRecordHostDossier({
+            host: "pi",
+            sessionId,
+            cwd: request.cwd,
+            sessionDirectory,
+            sessionParent: sessionFile,
+            ...(request.home !== undefined ? { home: request.home } : {}),
+          });
+        }
+      } catch (error) {
+        await retainPackageFault({
+          runDirectory: request.runDirectory,
+          diagnostic: `pi host dossier record failed beside host terminal: ${describeErrorIdentity(error)}`,
+          error,
+        });
+      }
+      return result;
     },
   };
 }
 
-import { sitianReport } from "../sitian-facade.ts";
+/**
+ * Session header id from the Pi volume the child (or fixture) already wrote.
+ * Reuses the ledger line kernel: a later malformed line must not erase a valid
+ * header already present (ADR 0086 originals are not validated whole-file).
+ */
+async function readPiSessionHeaderId(sessionFile: string): Promise<string | undefined> {
+  try {
+    for (const line of await readLedgerSessionJsonlLines(sessionFile)) {
+      const entry = line.row;
+      if (entry === undefined || entry.type !== "session") continue;
+      if (typeof entry.id === "string" && entry.id.trim() !== "") return entry.id;
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+  return undefined;
+}
+
+/** Last non-session entry id. Session headers are not parents of custom lines. */
+export function piSessionCustomParentId(
+  entries: readonly { id?: unknown; type?: unknown }[],
+): string | null {
+  let parentId: string | null = null;
+  for (const entry of entries) {
+    if (typeof entry.id === "string" && entry.type !== "session") parentId = entry.id;
+  }
+  return parentId;
+}
+
+/** One Pi custom JSONL line: type, customType, data, id, parentId, timestamp. */
+export function formatPiSessionCustomEntry(input: {
+  readonly customType: string;
+  readonly data: unknown;
+  readonly parentId: string | null;
+  readonly timestamp: string;
+}): string {
+  return `${JSON.stringify({
+    type: "custom",
+    customType: input.customType,
+    data: input.data,
+    id: randomUUID(),
+    parentId: input.parentId,
+    timestamp: input.timestamp,
+  })}\n`;
+}
 
 /**
  * Append one custom JSONL entry to the durable principal's session file.
  * Pi session codec only — AK artifact O_EXCL retention stays in public-cli.
+ * Read is raw JSON.parse (SyntaxError propagates). Sitian full-traversal stays elsewhere.
  */
 export async function appendPiSessionCustomEntry(
   authority: DurablePrincipalAuthority,
@@ -473,21 +551,14 @@ export async function appendPiSessionCustomEntry(
   data: unknown,
 ): Promise<void> {
   const { sessionFile } = authority.decode(principal);
-  const text = await readFile(sessionFile, "utf8");
-  let parentId: string | null = null;
-  for (const line of text.trim().split("\n").filter(Boolean)) {
-    const entry = JSON.parse(line) as { id?: unknown; type?: unknown };
-    if (typeof entry.id === "string" && entry.type !== "session") parentId = entry.id;
-  }
+  const entries = await readStrictPiSessionJsonl(sessionFile) as { id?: unknown; type?: unknown }[];
   const timestamp = new Date().toISOString();
-  const pointerLine = `${JSON.stringify({
-    type: "custom",
+  const pointerLine = formatPiSessionCustomEntry({
     customType,
     data,
-    id: randomUUID(),
-    parentId,
+    parentId: piSessionCustomParentId(entries),
     timestamp,
-  })}\n`;
+  });
   await appendFile(sessionFile, pointerLine, "utf8");
   sitianReport({
     level: "event",

package/src/public-cli/auto-resume.ts

@@ -11,10 +11,6 @@
  * path continues: same budget, same call-local count semantics. No failure-type
  * classification — every thrown value is treated identically.
  */
-import { constants as fsConstants } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { open } from "node:fs/promises";
-import { join } from "node:path";
 import type {
   DurablePrincipal,
   DurablePrincipalAuthority,
@@ -33,14 +29,13 @@ import { processCancelSignalName } from "./process-cancel.ts";
 import { isLawfulTypedTerminalOutcome, formatTerminalResult, type TerminalArtifactRef, type TerminalResult, type TerminalRoleName } from "./terminal.ts";
 import {
   attachRecordedSubmissions,
-  ensureRealArtifactsDirectory,
   presentFailureTerminal,
   retainPackageFault,
 } from "./settlement.ts";
 
-export { ensureRealArtifactsDirectory };
 import type { CliIo } from "./cli-io.ts";
 import { serializeThrownValue } from "../serialize-thrown-value.ts";
+import { reportRunRecord } from "../sitian-facade.ts";
 
 import { errorText } from "../unknown-value.ts";
 
@@ -155,41 +150,11 @@ function jsonSafeReplacer(): (key: string, value: unknown) => unknown {
 }
 
 /**
- * Retain one throwing dispatch attempt's complete exception as an independent
- * per-attempt file under the run's artifacts directory, then leave an
- * addressable pointer in the session principal (custom entry). Exclusive-create
- * open (O_EXCL) with a per-attempt unique name enforces 史必追加 (#419): a later
- * attempt can never overwrite an earlier attempt's file.
+ * Retain one throwing dispatch attempt's complete exception as a line in the
+ * run's log.jsonl, then leave an addressable pointer in the session principal
+ * (custom entry). The log only appends (史必追加, #419): a later attempt can
+ * never overwrite an earlier attempt's record.
  */
-/**
- * Hardened create-once JSON write shared by every durable artifact this loop
- * retains directly (dispatch-error dumps, lawful-persist-failure error/
- * evidence records): O_EXCL (fail loud on a colliding name, never overwrite)
- * + O_NOFOLLOW where the platform provides it (a planted symlink is never
- * followed) — mirrors settlement.ts's own hardened artifact writers.
- */
-export async function writeHardenedArtifactFile(
-  artifactsDir: string,
-  namePrefix: string,
-  payload: Record<string, unknown>,
-): Promise<string> {
-  const filePath = join(artifactsDir, `${namePrefix}-${randomUUID()}.json`);
-  const body = `${JSON.stringify(payload, jsonSafeReplacer(), 2)}\n`;
-  const noFollowFlag =
-    typeof fsConstants.O_NOFOLLOW === "number" ? fsConstants.O_NOFOLLOW : 0;
-  const handle = await open(
-    filePath,
-    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag,
-    0o600,
-  );
-  try {
-    await handle.writeFile(body, "utf8");
-  } finally {
-    await handle.close();
-  }
-  return filePath;
-}
-
 async function retainDispatchError(
   admitted: { runDirectory: string; principal: DurablePrincipal },
   principalAuthority: DurablePrincipalAuthority,
@@ -197,14 +162,13 @@ async function retainDispatchError(
   attempt: number,
   error: unknown,
 ): Promise<{ file: string; pointerError?: unknown }> {
-  const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
   // Whole-object dump: everything the thrown value carries, nothing picked.
-  const filePath = await writeHardenedArtifactFile(artifactsDir, `dispatch-error-attempt-${attempt}`, {
+  const filePath = reportRunRecord(admitted.runDirectory, "dispatch-exception", JSON.parse(JSON.stringify({
     version: 1,
     attempt,
     recordedAt: new Date().toISOString(),
     error: serializeThrownValue(error),
-  });
+  }, jsonSafeReplacer())) as Record<string, unknown>, "auto-resume").recordFile;
   // Addressable pointer in the dossier (卷宗): Pi session custom-entry codec
   // (appendPiSessionCustomEntry). Lease still owned here with run-writer.
   let pointerLease: RunWriterLease;

package/src/public-cli/instruction-seat-run.ts

@@ -56,6 +56,7 @@ import {
   type RunDirectoryRelocation,
 } from "./invocation.ts";
 import {
+  bindDiaristAssertedTicketNumber,
   presentControlledFailure,
   packageFaultNoteFor,
   prepareSummonsResumeMaterials,
@@ -83,7 +84,7 @@ import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.ts";
 import {
   presentStructuralRejection,
   readBoundSessionEntries,
-  attachPostAuditProjection,
+  attachPostAuditCountersignFact,
   trySettlePublicSeat,
   type SettlementCourtScope,
 } from "./settlement.ts";
@@ -321,6 +322,8 @@ async function bindAndRelocateDiarist(
   authority: DurablePrincipalAuthority,
   lease?: RunWriterLease,
 ): Promise<RunDirectoryRelocation | undefined> {
+  // The diarist's asserted ticketNumber binds here, in the public call's process.
+  await bindDiaristAssertedTicketNumber(admitted);
   const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
   if (boardTicket === undefined) return undefined;
   if (admitted.ticketNumber === undefined) {
@@ -1096,7 +1099,11 @@ export async function continueParentAfterChild(
       && heldUnreadableTerminal(stopped.terminal)
       && stopped.terminal !== undefined
     ) {
-      const parentTerminal = await trySettlePublicSeat(admitted, env.principalAuthority, undefined);
+      const parentTerminal = await trySettlePublicSeat(
+        admitted,
+        env.principalAuthority,
+        { ...await readCurrentCourt(admitted.runDirectory), ...packageFaultScope(admitted, env, io) },
+      );
       if (
         parentTerminal?.roleOutcome.kind === "accepted"
         || parentTerminal?.roleOutcome.kind === "audit_escalation"
@@ -1115,7 +1122,7 @@ export async function continueParentAfterChild(
       const terminal = await trySettlePublicSeat(
         admitted,
         env.principalAuthority,
-        packageFaultScope(admitted, env, io),
+        { ...await readCurrentCourt(admitted.runDirectory), ...packageFaultScope(admitted, env, io) },
       );
       if (terminal?.roleOutcome.kind !== "accepted") throw new Error("pending submission is not recorded");
       return auditSubmittedRole({ exitCode: 0, admitted, terminal }, env, io, resolved.admitted, latestQueuePayload(resolved.terminal));
@@ -1399,10 +1406,10 @@ async function auditSubmittedRole(
     }
   }
   // The turn already settled this court (payloads, usage, autoResumeCount, history).
-  // Audit only adds gate rounds and, for 中书省, the officer fact. A second
-  // settle would republish the same attempt.
+  // Audit only adds, for 中书省, the officer fact. A second settle would
+  // republish the same attempt.
   if (turn.terminal === undefined) throw new Error(`audited ${admitted.role} submission did not settle`);
-  const terminal = await attachPostAuditProjection(
+  const terminal = await attachPostAuditCountersignFact(
     admitted,
     env.principalAuthority,
     turn.terminal,