@akagilnc/pi-workflow-roles 0.1.5714 → 0.1.5753

package/dist/public-cli/post-admission.js

@@ -6,9 +6,8 @@
  * Role runners supply only turn request projection and narrow settlement adapters.
  */
 import { randomUUID } from "node:crypto";
-import { existsSync } from "node:fs";
 import { writeFile } from "node:fs/promises";
-import { buildAutoResumeContinuationPrompt, findRunDirectoryById, readRoleRunState, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
+import { buildAutoResumeContinuationPrompt, findRunDirectoryById, resolveLiveRunDirectoryPath, readRoleRunState, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
 import { CliUsageError } from "./cli-errors.js";
 import { projectPublicTurnAxes } from "./turn-request.js";
 import { appendCallerFileFlagPaths, bindAdmittedTicketNumber, relocateAdmittedRunToTicket, } from "./invocation.js";
@@ -65,7 +64,7 @@ function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
     }
 }
 /**
- * #1171: after the host returns, re-locate the leg by run id (report-ticket may
+ * #1171: after the host returns, follow the leg's placement (report-ticket may
  * have moved it mid-turn in the tool process). Settlement and render use the
  * live path; lease cleanup follows when the held path changed.
  * Failure is not best-effort: a missing former path with no replacement must not
@@ -73,14 +72,14 @@ function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
  */
 export async function refreshAdmittedPlacementAfterHostTurn(admitted, authority, heldLease) {
     const home = homeFromRunDirectory(admitted.runDirectory);
-    const found = await findRunDirectoryById(home, admitted.runId, admitted.bookKey, admitted.role);
-    if (found === undefined && !existsSync(admitted.runDirectory)) {
+    const found = await resolveLiveRunDirectoryPath(admitted.runDirectory, home);
+    if (found === undefined) {
         throw new Error(`admitted run ${admitted.runId} missing after host turn; not found under ${home}`);
     }
     // Live identity first: later board-ticket read must not leave settlement on the
     // pre-relocate path when facts are damaged (#1171 F4-R1).
     let relocation;
-    if (found !== undefined && found !== admitted.runDirectory) {
+    if (found !== admitted.runDirectory) {
         const oldRunDirectory = admitted.runDirectory;
         const coords = { ...authority.decode(admitted.principal) };
         rewritePrincipalSessionPaths(coords, oldRunDirectory, found);
@@ -92,11 +91,11 @@ export async function refreshAdmittedPlacementAfterHostTurn(admitted, authority,
     }
     // Board re-read discovers a ticket written mid-turn while still unbound
     // (report-ticket board page). Already-bound identity needs no discovery —
-    // path relocate already used findRunDirectoryById. This is not damage
+    // placement refresh already followed the retained path. This is not damage
     // recovery: when unbound, readBoardTicketNumber damage/non-ENOENT IO still
     // propagates (失败诚实; notary: no damaged-control-plane → no-ticket wash).
     if (admitted.ticketNumber === undefined) {
-        const boardTicket = await readBoardTicketNumber(found ?? admitted.runDirectory);
+        const boardTicket = await readBoardTicketNumber(found);
         if (boardTicket !== undefined) {
             admitted.ticketNumber = boardTicket;
         }
@@ -1384,10 +1383,10 @@ export async function runPostAdmissionSeatResume(input) {
         return { exitCode: error instanceof CliUsageError ? 2 : 1 };
     }
 }
-async function pointExistingRunFailure(home, runId, authority, io, thrown) {
+async function pointExistingRunFailure(home, runId, authority, io, thrown, knownRunDirectory) {
     let foundRunDirectory;
     try {
-        foundRunDirectory = await findRunDirectoryById(home, runId);
+        foundRunDirectory = await findRunDirectoryById(home, runId, undefined, undefined, knownRunDirectory);
     }
     catch {
         return false;
@@ -1408,8 +1407,8 @@ async function pointExistingRunFailure(home, runId, authority, io, thrown) {
     await presentResumeFailurePointer(io, thrown, (failure) => writeResumeDiagnostic(runDirectory, runId, failure, record.role));
     return true;
 }
-export async function presentLocatedResumeFailure(home, runId, authority, io, thrown) {
-    return await pointExistingRunFailure(home, runId, authority, io, thrown);
+export async function presentLocatedResumeFailure(home, runId, authority, io, thrown, knownRunDirectory) {
+    return await pointExistingRunFailure(home, runId, authority, io, thrown, knownRunDirectory);
 }
 function writeResumeFailurePointer(io, errorPath) {
     io.stderr(formatCliDiagnostic(`续跑失败，当次错误记录：${errorPath}`));

package/dist/public-cli/run-lifecycle.js

@@ -5,16 +5,17 @@
  * any existing run with an available Pi session principal may be resumed; caller decides.
  * Prose is never regex-classified as quota evidence.
  */
+import { existsSync } from "node:fs";
 import { chmod, lstat, open, readdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { basename, isAbsolute, join } from "node:path";
-import { activationBookDirectory, resolveActivationLedgerHome, } from "../activation-ledger-topology.js";
+import { activationBookDirectory, resolveActivationLedgerHome, tryBookKeyFromAkRolesPath, } from "../activation-ledger-topology.js";
 import { findRoleRunDirectory, listBookRunDirectories, parseRunLeaf, sessionFileIn } from "../role-run-placement.js";
 import { isSafePositiveTicketNumber } from "../run-ticket-number.js";
 import { CliUsageError } from "./cli-errors.js";
 import { parseCollectorRepository } from "../collector-config.js";
 import { retainedRunPathsMatch, rewriteAdmittedRoleRunPage, rewriteRunDirectoryPathValue, } from "../role-run-relocation.js";
 import { packagedResumeSourcePath, packagedRoleMetadata, } from "../packaged-role-registry.js";
-import { admittedReviewerBaseFault, recordEffectiveInvocationModel, requireAuthorityRef, isReviewerLens, normalizeAdmittedAttachment, } from "./invocation.js";
+import { admittedReviewerBaseFault, admittedSourceRunPath, recordEffectiveInvocationModel, requireAuthorityRef, isReviewerLens, normalizeAdmittedAttachment, } from "./invocation.js";
 import { readPageSync, writeSectionSync } from "../run-dossier.js";
 import { isRecord, errorText, isEnoent } from "../unknown-value.js";
 /** Default for the #422 configurable single-call auto-resume ceiling
@@ -53,9 +54,7 @@ function parseSameTicketSummonsMaterials(raw) {
     const attachmentPaths = Array.isArray(record.attachmentPaths)
         ? record.attachmentPaths.filter((p) => typeof p === "string")
         : undefined;
-    const sourceRunPath = typeof record.sourceRunPath === "string" && record.sourceRunPath.trim() !== ""
-        ? record.sourceRunPath
-        : undefined;
+    const sourceRunPath = admittedSourceRunPath(record);
     let sourceRun;
     if (isRecord(record.sourceRun)) {
         const sr = record.sourceRun;
@@ -607,12 +606,20 @@ export async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
 }
 /**
  * Locate a Role run directory by run ID under the ledger books home.
- * Returns undefined when the ID is unknown.
+ * A supplied directory is checked against the ID and retained without a book walk.
+ * Returns undefined when the bare ID is unknown.
  * Walk surface = listBookRunDirectories (flat legacy + subject-tree).
  * Collects every match under the supplied book/role filters: zero → undefined,
  * one → path, many → loud ambiguity (never readdir-first).
  */
-export async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
+export async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole, knownRunDirectory) {
+    if (typeof knownRunDirectory === "string" && knownRunDirectory.trim() !== "") {
+        const parsed = parseRunLeaf(basename(knownRunDirectory));
+        if (parsed === undefined || parsed.runId !== runId) {
+            throw new CliUsageError(`run directory does not match run id ${runId}: ${knownRunDirectory}`);
+        }
+        return knownRunDirectory;
+    }
     if (runId.trim() === "")
         return undefined;
     const ledgerHome = resolveActivationLedgerHome(home);
@@ -631,6 +638,16 @@ export async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
         .filter((bookKey) => onlyBookKey === undefined || bookKey === onlyBookKey)
         .map((bookKey) => activationBookDirectory(ledgerHome, bookKey)), runId, onlyRole);
 }
+/** Keep an existing placement; rediscover only after its recorded path disappeared. */
+export async function resolveLiveRunDirectoryPath(recordedPath, home, onlyBookKey) {
+    if (existsSync(recordedPath))
+        return recordedPath;
+    const parsed = parseRunLeaf(basename(recordedPath));
+    const bookKey = onlyBookKey ?? tryBookKeyFromAkRolesPath(recordedPath);
+    if (parsed === undefined || bookKey === undefined)
+        return undefined;
+    return findRunDirectoryById(home, parsed.runId, bookKey, parsed.role);
+}
 /**
  * Parent-run binding on a retained officer run (#747 / #1166).
  * Typed sourceRunPath only — instruction bytes are never a path protocol.
@@ -638,12 +655,7 @@ export async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
  */
 export async function readRunParentPath(runDirectory) {
     const record = readPageSync(runDirectory, "admitted");
-    if (record === undefined)
-        return undefined;
-    if (typeof record.sourceRunPath === "string" && record.sourceRunPath.trim() !== "") {
-        return record.sourceRunPath;
-    }
-    return undefined;
+    return admittedSourceRunPath(record);
 }
 /**
  * True when durable run-state names a session principal that has actually formed
@@ -681,6 +693,15 @@ async function runHasFormedSessionPrincipal(runDirectory) {
  * Only a truly missing book directory means no history; damage/permission errors propagate.
  */
 export async function findLatestRunIdForSeatTicket(input) {
+    const found = await findLatestRunForSeatTicket(input);
+    return found?.runId;
+}
+/**
+ * Latest retained seat run under one book/parent (and optional ticket), with its
+ * directory — callers that already scoped the search must not drop the path and
+ * re-resolve runId across every book (#1195).
+ */
+export async function findLatestRunForSeatTicket(input) {
     if (input.parentRunPath.trim() === "") {
         return undefined;
     }
@@ -708,8 +729,8 @@ export async function findLatestRunIdForSeatTicket(input) {
         // Durable fact: never resume-select a provisional that never formed principal.
         if (!(await runHasFormedSessionPrincipal(runDirectory)))
             continue;
-        if (best === undefined || runId > best)
-            best = runId;
+        if (best === undefined || runId > best.runId)
+            best = { runId, runDirectory };
     }
     return best;
 }
@@ -732,8 +753,8 @@ function restoredTicketFields(fields) {
         ...(fields.ticketNumber === undefined ? {} : { ticketNumber: fields.ticketNumber }),
     };
 }
-async function loadResumableRunRecord(home, runId, authority) {
-    const runDirectory = await findRunDirectoryById(home, runId);
+async function loadResumableRunRecord(home, runId, authority, knownRunDirectory) {
+    const runDirectory = await findRunDirectoryById(home, runId, undefined, undefined, knownRunDirectory);
     if (runDirectory === undefined) {
         throw new CliUsageError(`unknown role run id: ${runId}`);
     }
@@ -842,9 +863,7 @@ async function loadResumableRunRecord(home, runId, authority) {
                 }
             }
             // Notary — admitted source-run locator identity (#633 resume).
-            if (typeof record.sourceRunPath === "string" && record.sourceRunPath.trim() !== "") {
-                sourceRunPath = record.sourceRunPath;
-            }
+            sourceRunPath = admittedSourceRunPath(record);
             if (isRecord(record.sourceRun)) {
                 const sr = record.sourceRun;
                 if (typeof sr.runId === "string" &&
@@ -930,11 +949,9 @@ async function loadResumableRunRecord(home, runId, authority) {
             throw new CliUsageError(`role run invocation identity is unreadable: ${runId}`, { cause: error });
         }
     }
-    const sourceRunLeaf = parseRunLeaf(basename(sourceRunPath ?? ""));
-    const referencedRunId = sourceRun?.runId ?? sourceRunLeaf?.runId;
-    const referencedRole = sourceRun?.role ?? sourceRunLeaf?.role;
-    if (referencedRunId !== undefined && referencedRunId !== "") {
-        const currentSourceRunDirectory = await findRunDirectoryById(home, referencedRunId, run.bookKey, referencedRole);
+    const recordedSourceDirectory = sourceRunPath ?? sourceRun?.runDirectory;
+    if (recordedSourceDirectory !== undefined) {
+        const currentSourceRunDirectory = await resolveLiveRunDirectoryPath(recordedSourceDirectory, home, run.bookKey);
         if (currentSourceRunDirectory !== undefined) {
             sourceRunPath = currentSourceRunDirectory;
             if (sourceRun !== undefined) {
@@ -997,8 +1014,8 @@ function seatLoadedResult(loaded, admitted) {
         run: loaded.run,
     };
 }
-export async function peekRoleRunRole(home, runId) {
-    const runDirectory = await findRunDirectoryById(home, runId);
+export async function peekRoleRunRole(home, runId, options) {
+    const runDirectory = await findRunDirectoryById(home, runId, undefined, undefined, options?.runDirectory);
     if (runDirectory === undefined)
         return undefined;
     const run = await readRoleRunIdentity(runDirectory);
@@ -1009,8 +1026,8 @@ export async function peekRoleRunRole(home, runId) {
  * selects the existing restore checks. The stored native host session id is
  * read on the public explicit resume seam, not from this load.
  */
-export async function loadResumablePublicRole(home, runId, authority) {
-    const loaded = await loadResumableRunRecord(home, runId, authority);
+export async function loadResumablePublicRole(home, runId, authority, options) {
+    const loaded = await loadResumableRunRecord(home, runId, authority, options?.runDirectory);
     return seatLoadedResult(loaded, admitResumedRole(loaded));
 }
 /**
@@ -1028,25 +1045,30 @@ function admitResumedRole(loaded) {
     const base = resumedBaseAdmitted(loaded);
     switch (record.admission) {
         case "instruction": {
+            // Restore sourceRunPath whenever the admitted page has it (auditor/inspector/…).
+            // Downstream continueParent / seal-id belonging needs this fact (#1195).
+            const withSource = fields.sourceRunPath === undefined
+                ? base
+                : { ...base, sourceRunPath: fields.sourceRunPath };
             if (packagedResumeSourcePath(role)) {
                 const admitted = {
                     role: "inspector",
-                    ...base,
-                    ...(fields.sourceRunPath === undefined
-                        ? {}
-                        : { sourceRunPath: fields.sourceRunPath }),
+                    ...withSource,
                 };
                 return admitted;
             }
             return {
                 role,
-                ...base,
+                ...withSource,
             };
         }
         case "court-materials": {
             const admitted = {
                 role: "countersign",
                 ...base,
+                ...(fields.sourceRunPath === undefined
+                    ? {}
+                    : { sourceRunPath: fields.sourceRunPath }),
             };
             return admitted;
         }

package/dist/public-cli/seat-ticket-binding.js

@@ -9,13 +9,14 @@
  * freshSummons is required so no seat can drift back into its own skip branch.
  */
 import { resolveBookKeyFromGit } from "../activation-ledger-git.js";
-import { findLatestRunIdForSeatTicket, } from "./run-lifecycle.js";
+import { findLatestRunForSeatTicket, } from "./run-lifecycle.js";
 /**
  * Sole same-seat → resume decision by parent run path (#637 / #724 / #747 / #987).
  * A supplied typed ticket only narrows the prior-run search. When a prior run is
- * found, resume carries this summons' materials. Lookup/resume failures
- * propagate (失败诚实) — never wash into a fresh mint. Returns undefined when
- * the caller declared an explicit fresh summons (`ak-role new`), the parent
+ * found, resume carries this summons' materials and the located runDirectory so
+ * load does not re-walk every book for the bare runId (#1195). Lookup/resume
+ * failures propagate (失败诚实) — never wash into a fresh mint. Returns undefined
+ * when the caller declared an explicit fresh summons (`ak-role new`), the parent
  * path is blank, or no prior run exists; those mint new. freshSummons is
  * required so no seat can drift back into its own skip branch.
  */
@@ -24,14 +25,14 @@ export async function tryResumeSameTicketSeatRun(input) {
         return undefined;
     if (input.parentRunPath.trim() === "")
         return undefined;
-    const previousRunId = await findLatestRunIdForSeatTicket({
+    const previous = await findLatestRunForSeatTicket({
         home: input.home,
         bookKey: resolveBookKeyFromGit(input.projectRoot),
         role: input.role,
         parentRunPath: input.parentRunPath,
         ...(input.ticketNumber === undefined ? {} : { ticketNumber: input.ticketNumber }),
     });
-    if (previousRunId === undefined)
+    if (previous === undefined)
         return undefined;
-    return await input.resume(previousRunId, input.summons);
+    return await input.resume(previous.runId, input.summons, previous.runDirectory);
 }

package/dist/public-cli/settlement.js

@@ -18,9 +18,8 @@ import { describeErrorIdentity } from "./run-lifecycle.js";
 import { readEngineDetourToolUsage, readInvocationEngineMounted, runDirectoryFromSessionDirectory, sessionFileFromSessionDirectory, withEngineDetourToolUsageFact, } from "../engine-detour-usage.js";
 import { DOCTOR_CANDIDATE_ENTRY_TYPE } from "../dossier-resolution.js";
 import { homeFromRunDirectory, } from "./invocation.js";
-import { SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY, SECRETARIAT_GATE_OFFICER_ENTRY_TYPE, } from "../secretariat-contracts.js";
 import { findLatestDurablePackagedRoleTerminal, NAVIGATOR_ROUTE_PLAYBOOK_FAILURE_ENTRY, } from "../navigator-invocation-identity.js";
-import { packagedDurableOfficerEntry, packagedRoleAcceptedOutputTool, packagedRoleMetadata, } from "../packaged-role-registry.js";
+import { packagedRoleAcceptedOutputTool, packagedRoleMetadata, } from "../packaged-role-registry.js";
 import { NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, noReceiptLifecycleFacts, parseNoReceiptLifecycleFacts, priorReceiptContinuation, receiptAttemptPointer, } from "../receipt-delivery-policy.js";
 import { readStateRowsSync, runCurrentPath } from "../run-dossier.js";
 import { reportRunRecord } from "../sitian-facade.js";
@@ -135,13 +134,12 @@ function roleOutcomeFromRows(role, rows) {
     return { outcome: { kind: "accepted", role, payloads }, ...belonging };
 }
 async function sealedLedgerOutcome(admitted, role, scope) {
-    const home = sealedLedgerHome(admitted);
     // #879: when court scope is present, roleOutcome is this-court original only —
     // never last-wins over an undivided historical array, and never falls back to
     // full-run history when this court sealed zero rows. #836 presentation of full
     // history stays on attachRecordedSubmissions / terminal.submissions (run-scoped).
     if (scope?.courtAttemptId !== undefined && scope.courtAttemptId.length > 0) {
-        const thisCourt = await readAttemptScopedSubmissionRows(admitted.projectRoot, admitted.runId, scope.courtAttemptId, home);
+        const thisCourt = await readAttemptScopedSubmissionRows(admitted.projectRoot, admitted.runId, scope.courtAttemptId, ledgerReadScope(admitted, scope));
         // Scope present + zero this-court rows → no this-court outcome (not run history).
         return roleOutcomeFromRows(role, thisCourt);
     }
@@ -1084,138 +1082,18 @@ function currentAttemptStartIndex(entries) {
     }
     return 0;
 }
-/** Accepted-tool seats retain declaration checks and optional officer projection. */
+/** Accepted-tool seats: declaration checks only. Other-seat finals stay on their own runs. */
 async function trySettleAcceptedSeatTerminalResult(admitted, authority, scope) {
     const toolName = packagedRoleAcceptedOutputTool(admitted.role);
     if (toolName === undefined) {
         throw new Error(`accepted-seat settlement is not declared for ${admitted.role}`);
     }
-    const settled = await settleSealedSeat(admitted, authority, scope, { acceptedOnly: false });
-    const record = packagedRoleMetadata(admitted.role);
-    if (settled === undefined
-        || record === undefined
-        || !("projectCountersignTerminal" in record)
-        || record.projectCountersignTerminal !== true) {
-        return settled;
-    }
-    return applySecretariatCountersignTerminal(admitted, authority, settled, scope);
+    return settleSealedSeat(admitted, authority, scope, { acceptedOnly: false });
 }
 /** One settlement dispatch. The registry `settlement` leaf selects the path. */
 export async function trySettlePublicSeat(admitted, authority, scope) {
     return settleSeat(admitted, authority, scope);
 }
-/**
- * #969 seat projection sole authority: 给事中 terminal (署|上呈) booked as a
- * durable custom entry (envelope-safe) — ledger accepted stays LLM params (#836).
- * Never scan toolResult rows: those are memory-only on headless/ACP (#617/#959).
- * Receipt bytes stay original; nested runId rides beside them.
- * Caller must only apply this when the terminal-defining submission actually
- * produced the officer entry (gate-bound converged, or 给事中 audit_escalation).
- */
-function countersignTerminalFromEntries(entries) {
-    for (let index = entries.length - 1; index >= 0; index -= 1) {
-        const entry = entries[index];
-        if (entry?.type !== "custom")
-            continue;
-        if (entry.customType !== SECRETARIAT_GATE_OFFICER_ENTRY_TYPE)
-            continue;
-        const data = isRecord(entry.data)
-            ? entry.data
-            : undefined;
-        if (data === undefined || !packagedDurableOfficerEntry(data.officer))
-            continue;
-        if (data.receipt === undefined)
-            continue;
-        const runId = typeof data.runId === "string" && data.runId.trim() !== ""
-            ? data.runId
-            : undefined;
-        return {
-            receipt: data.receipt,
-            ...(runId === undefined ? {} : { runId }),
-        };
-    }
-    return undefined;
-}
-function withCountersignTerminalFact(roleOutcome, officer) {
-    const prior = roleOutcome.decisiveFacts !== undefined && isRecord(roleOutcome.decisiveFacts)
-        ? roleOutcome.decisiveFacts
-        : {};
-    return {
-        ...roleOutcome,
-        decisiveFacts: {
-            ...prior,
-            [SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY]: officer,
-        },
-    };
-}
-/**
- * Terminal-defining secretariat submission owns officer projection.
- * Last readable secretariatStatus on accepted payloads decides: only gate-bound
- * converged projects a prior durable officer entry. Parent escalate bypasses the
- * gate and must not inherit a stale pass entry from an earlier turn (#969).
- */
-function acceptedSecretariatDefinesOfficerProjection(roleOutcome) {
-    const payloads = roleOutcome.payloads ?? [];
-    for (let index = payloads.length - 1; index >= 0; index -= 1) {
-        const payload = payloads[index];
-        if (!isRecord(payload))
-            continue;
-        const status = payload.secretariatStatus;
-        if (typeof status !== "string")
-            continue;
-        return status === "converged";
-    }
-    return false;
-}
-async function applySecretariatCountersignTerminal(admitted, authority, settled, scope) {
-    const coordinates = coordinatesFromAdmitted(authority, admitted);
-    let entries = [];
-    try {
-        entries = await readBoundSessionEntries(coordinates.sessionFile);
-    }
-    catch (error) {
-        if (!isEnoent(error)) {
-            await noteSettlementFault(admitted.runDirectory, scope, `secretariat officer read failed beside lawful terminal: ${describeErrorIdentity(error)}`);
-        }
-        return settled;
-    }
-    const officer = countersignTerminalFromEntries(entries);
-    if (officer === undefined)
-        return settled;
-    // 给事中上呈: public payloads = officer receipt; runId + receipt fact beside.
-    // This kind is produced only when beforeAccept booked the officer entry.
-    if (settled.roleOutcome.kind === "audit_escalation") {
-        return {
-            ...settled,
-            roleOutcome: withCountersignTerminalFact({
-                ...settled.roleOutcome,
-                payloads: [officer.receipt],
-            }, officer),
-        };
-    }
-    // Pass (署): keep 中书省 payloads; present 给事中 判词 + runId via decisiveFacts.
-    // Parent escalate accepted terminal must not project a stale prior pass entry.
-    if (settled.roleOutcome.kind === "accepted") {
-        if (!acceptedSecretariatDefinesOfficerProjection(settled.roleOutcome)) {
-            return settled;
-        }
-        return {
-            ...settled,
-            roleOutcome: withCountersignTerminalFact(settled.roleOutcome, officer),
-        };
-    }
-    return settled;
-}
-/**
- * After the audit gate returns, attach the secretariat officer fact onto the
- * terminal this turn already settled. Does not publish again — a second publish
- * would settle the same attempt twice.
- */
-export async function attachPostAuditCountersignFact(admitted, authority, terminal, scope) {
-    if (admitted.role !== "secretariat")
-        return terminal;
-    return applySecretariatCountersignTerminal(admitted, authority, terminal, scope);
-}
 /**
  * Replace the leg's terminal with the controlled failure. A write failure
  * propagates: the caller notes it beside the host terminal.

package/dist/public-cli/terminal.js

@@ -49,9 +49,9 @@ export function formatTerminalResult(result) {
     if (result.roleOutcome.kind === "failure") {
         lines.push(`diagnostic\t${encodeTerminalField(result.roleOutcome.diagnostic)}`);
     }
-    // Accepted volumes do not dump decisiveFacts unless a failed attempt is
-    // recorded. The unsettled-direction fact still has to be visible on its own.
-    // audit_escalation already dumps every decisiveFact below.
+    // Accepted volumes do not dump internal decisiveFacts unless recorded.
+    // Other-seat finals stay on those runs (#1195); only unsettled-direction is
+    // visible here. audit_escalation already dumps every decisiveFact below.
     if (result.roleOutcome.kind === "accepted"
         && result.roleOutcome.decisiveFacts?.directionUnsettled === true) {
         lines.push("fact\tdirectionUnsettled\ttrue");

package/dist/public-role-summons.js

@@ -248,6 +248,7 @@ async function summonPublicRole(options) {
     const stepped = await runPrepared(parse, (env) => runPublicInstructionSeatResume(
       {
         runId: resumeRunId,
+        ...options.resumeRunDirectory === void 0 ? {} : { runDirectory: options.resumeRunDirectory },
         summons: {
           instruction,
           instructionEmpty: instruction.length === 0
@@ -264,10 +265,13 @@ async function summonPublicRole(options) {
     result = stepped.ok;
   }
   const stderr = captured?.stderrText();
-  const runDirectory = result.terminal !== void 0 && result.terminal.roleOutcome.role !== options.role && typeof result.terminal.runId === "string" ? await (await import("./public-cli/run-lifecycle.js")).findRunDirectoryById(
-    home,
-    result.terminal.runId
-  ) : result.admitted?.runDirectory;
+  let runDirectory = result.admitted?.runDirectory;
+  if (result.terminal !== void 0 && result.terminal.roleOutcome.role !== options.role && typeof result.terminal.runId === "string" && result.admitted?.runId !== result.terminal.runId) {
+    runDirectory = await (await import("./public-cli/run-lifecycle.js")).findRunDirectoryById(
+      home,
+      result.terminal.runId
+    ) ?? runDirectory;
+  }
   return {
     exitCode: result.exitCode,
     ...result.terminal === void 0 ? {} : { terminal: result.terminal },
@@ -348,8 +352,12 @@ async function summonGateOfficer(options) {
   }
   let gateReviewInstruction;
   if (options.reask === void 0 && options.submission !== void 0) {
-    const { readableGateItem } = await import("./readable-gate-item.js");
-    gateReviewInstruction = readableGateItem(options.submission);
+    const { isTicketCourtCountersignSource } = await import("./run-terminal-artifacts.js");
+    const blindTicketCourt = options.officer === "notary" && isTicketCourtCountersignSource(options.sourceRunDirectory);
+    if (!blindTicketCourt) {
+      const { readableGateItem } = await import("./readable-gate-item.js");
+      gateReviewInstruction = readableGateItem(options.submission);
+    }
   }
   const { runIdFromRunDirectory } = await import("./run-terminal-artifacts.js");
   const parentRunId = runIdFromRunDirectory(options.sourceRunDirectory);

package/dist/review-submission.js

@@ -5,20 +5,15 @@ export const REVIEW_SUBMISSION_OUTPUT_TOOL_NAME = "ak_submission_output";
 /** Single schema copy of the review queue words. Runtime membership reads this set. */
 export const REVIEW_QUEUE_WORDS = ["converged", "continue", "escalate"];
 export const REVIEW_QUEUE_STATUSES = new Set(REVIEW_QUEUE_WORDS);
-/**
- * One object root. Codex structured output rejects a root anyOf, and status
- * stays a required three-state enum with no omitted-status failure branch.
- * External-dependency failure while the seat can still submit:
- * docs/adr/0057-schema-narrowing-cuts-the-required-set-not-the-declared-set.md
- */
-export const reviewSubmissionSchema = withTerminatingOutputDeclarations(Type.Object({
-    status: Type.Union([
-        Type.Literal(REVIEW_QUEUE_WORDS[0]),
-        Type.Literal(REVIEW_QUEUE_WORDS[1]),
-        Type.Literal(REVIEW_QUEUE_WORDS[2]),
-    ], {
-        description: "审核席本轮裁决的判别状态。",
-    }),
+const reviewStatusField = Type.Union([
+    Type.Literal(REVIEW_QUEUE_WORDS[0]),
+    Type.Literal(REVIEW_QUEUE_WORDS[1]),
+    Type.Literal(REVIEW_QUEUE_WORDS[2]),
+], {
+    description: "审核席本轮裁决的判别状态。",
+});
+/** Shared optional review narrative fields (generation guidance only). */
+const reviewNarrativeFields = {
     findings: Type.Optional(Type.Unknown({ description: "审核发现，原样留存" })),
     reason: Type.Optional(Type.Unknown({ description: "上呈理由" })),
     violations: Type.Optional(Type.Unknown({ description: "违规条目" })),
@@ -28,4 +23,42 @@ export const reviewSubmissionSchema = withTerminatingOutputDeclarations(Type.Obj
     note: Type.Optional(Type.Unknown({ description: "裁决附注" })),
     evidence: Type.Optional(Type.Unknown({ description: "留存证据" })),
     decisionGate: Type.Optional(Type.Unknown({ description: "需人权威处置的问题与选项；可说明 question、options，原样留存" })),
+};
+/**
+ * One object root. Codex structured output rejects a root anyOf, and status
+ * stays a required three-state enum with no omitted-status failure branch.
+ * External-dependency failure while the seat can still submit:
+ * docs/adr/0057-schema-narrowing-cuts-the-required-set-not-the-declared-set.md
+ */
+export const reviewSubmissionSchema = withTerminatingOutputDeclarations(Type.Object({
+    status: reviewStatusField,
+    ...reviewNarrativeFields,
+}, { additionalProperties: true }));
+/**
+ * #1195 ticket-court clause row: original ticket text, owner uuid (or null),
+ * and one-line derivation. Dual readings of runner context live in derivation.
+ * Generation-required on countersign/notary only; package still records as-is.
+ */
+export const courtClauseItemSchema = Type.Object({
+    clause: Type.String({
+        description: "票面条款原文（改变实际行为的条款；不合并、不改写）",
+    }),
+    ownerUuid: Type.Union([Type.String(), Type.Null()], {
+        description: "推出该条的陛下原话 uuid；无原话则 null",
+    }),
+    derivation: Type.String({
+        description: "一句推导：从原话哪个意思到该条款。用作上下文的 runner 句先写至少两种读法，再写票面取哪种；写不出第二种才记无歧义",
+    }),
+}, { additionalProperties: true });
+export const courtClausesField = Type.Array(courtClauseItemSchema, {
+    description: "票面逐条核旨表：每条改变实际行为的条款的原文、陛下原话 uuid、推导。无原话则 ownerUuid 为 null。",
+});
+/**
+ * Countersign + Notary generation schema (#1195): shared review face plus
+ * required top-level clauses. Package execute does not reject a missing table.
+ */
+export const courtReviewSubmissionSchema = withTerminatingOutputDeclarations(Type.Object({
+    status: reviewStatusField,
+    ...reviewNarrativeFields,
+    clauses: courtClausesField,
 }, { additionalProperties: true }));

package/dist/role-run-relocation.js

@@ -12,7 +12,7 @@ import { dirname, join } from "node:path";
 import { activationBookDirectory, physicalPathIdentity } from "./activation-ledger-topology.js";
 import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.js";
 import { readRoleRunIdentity } from "./public-cli/run-lifecycle.js";
-import { findRoleRunDirectory, roleRunPlacement } from "./role-run-placement.js";
+import { roleRunPlacement } from "./role-run-placement.js";
 import { INVOCATION_PAGE_PATH_FIELDS, PRINCIPAL_SESSION_PATH_FIELDS, RUN_STATE_PAGE_PATH_FIELDS, projectTurnRequestLiveRunDirectory, rewriteAdmittedRoleRunPage, rewritePrincipalSessionPaths, rewriteRunDirectoryPathFields, rewriteRunDirectoryPathFieldsAgainstRewrites, rewriteRunDirectoryPathValue, rewriteRunDirectoryPathValueAgainstRewrites, rewriteSummonsMaterials, } from "./role-run-path-rewrite.js";
 import { readPageSync, updateSectionSync } from "./run-dossier.js";
 import { isEnoent, isRecord } from "./unknown-value.js";
@@ -51,8 +51,9 @@ export async function retainedRunPathsMatch(recordedPath, currentPath, currentRu
         if (rewriteRunDirectoryPathValue(recordedPathIdentity, unbound.runDirectory, runDirectory) !== currentPathIdentity) {
             return false;
         }
-        const placed = await findRoleRunDirectory([directory], identity.runId, identity.role);
-        return placed !== undefined && physicalPathIdentity(placed) === runDirectory;
+        // The current volume's identity and the unbound→ticket rewrite already
+        // establish this relationship; do not select that volume again by bare ID.
+        return true;
     }
     return false;
 }