@akagilnc/pi-workflow-roles 0.1.5714 → 0.1.5753

package/dist/role-submission-declarations.js

@@ -5,7 +5,7 @@
  * Execute lives in filed-submission.ts.
  */
 import { packagedRoleOutputTool } from "./packaged-role-registry.js";
-import { reviewSubmissionSchema } from "./review-submission.js";
+import { courtReviewSubmissionSchema, reviewSubmissionSchema } from "./review-submission.js";
 import { collectorOutputArgsSchema } from "./collector-tool-schemas.js";
 import { diaristOutputSchema } from "./diarist-contracts.js";
 import { doctorSubmissionSchema, DOCTOR_OUTPUT_TOOL_DESCRIPTION } from "./doctor-contracts.js";
@@ -61,15 +61,15 @@ const SUBMISSION_FACE = {
     },
     notary: {
         label: "符宝郎输出",
-        description: "提交引文保真与票面对齐的 converged/continue/escalate 决议。",
+        description: "提交引文保真与票面对齐的 converged/continue/escalate 决议（含逐条核旨 clauses）。",
         promptSnippet: "提交符宝郎决议",
-        parameters: reviewSubmissionSchema,
+        parameters: courtReviewSubmissionSchema,
     },
     countersign: {
         label: "给事中输出",
-        description: "给事中决议。",
+        description: "给事中决议（含逐条核旨 clauses）。",
         promptSnippet: "给事中决议",
-        parameters: reviewSubmissionSchema,
+        parameters: courtReviewSubmissionSchema,
     },
     secretariat: {
         label: "中书省输出",

package/dist/run-dossier.js

@@ -119,14 +119,14 @@ function lastPagePayload(rows, kind, runDirectory) {
 }
 /**
  * Latest officer-pointer payload per officer from already-decoded history rows.
- * Sole reducer for the "last booking wins per officer" rule (#753 / #1161 officers).
+ * Sole reducer for the "last booking wins per officer" rule on archived rows
+ * (#753 / #1161; historical decode only — #1195 does not project into current.json).
  * A booked officer-pointer row with a non-object payload or non-string officer is
  * damaged topology — never silently omitted into lawful zero rounds (#1161 O1).
  * Absence of any officer-pointer row remains lawful empty.
  * Invalid input is a TypeError (same class as other dossier illegal payloads).
  * Control readers (`readBookedOfficerPointers`) let this throw into the existing
- * auditor-roles unreadable seam; `render` catches only that TypeError and marks
- * `history.jsonl` unreadable so other reachable facts stay in current.json.
+ * auditor-roles unreadable seam.
  */
 export function latestOfficerPointersFromRecords(records) {
     const latest = {};
@@ -163,21 +163,9 @@ function render(runDirectory, history, state, log, unreadable) {
             latest = { toolCallId: payload.toolCallId, role: payload.role, accepted: payload.accepted, at: row.timestamp };
         }
     }
-    // Control readers still fail closed via latestOfficerPointersFromRecords.
-    // Render must keep other reachable facts and surface damage on the existing
-    // file unreadable seam — never abort the whole current.json (#1161 O1).
-    // Catch only the reducer's known TypeError; unknown throws stay unknown
-    // (never wash into malformed by free-text message).
-    let officers = {};
-    try {
-        officers = latestOfficerPointersFromRecords(history);
-    }
-    catch (error) {
-        if (!(error instanceof TypeError))
-            throw error;
-        if (unreadable[RUN_HISTORY_FILE] === undefined)
-            unreadable[RUN_HISTORY_FILE] = "malformed";
-    }
+    // #1195: parent current.json no longer projects officers from officer-pointer
+    // history. Archive rows stay in history.jsonl; analysts decode via
+    // readOfficerPointers / latestOfficerPointersFromRecords — not this render.
     const sessions = {};
     for (const row of state) {
         const payload = isRecord(row.payload) ? row.payload : undefined;
@@ -198,7 +186,6 @@ function render(runDirectory, history, state, log, unreadable) {
         original = join(runDirectory, "session", basename(original));
     whole.host = { sessions, ...(original === undefined ? {} : { original }) };
     whole.submission = latest === undefined ? {} : { latest };
-    whole.officers = officers;
     if (Object.keys(unreadable).length > 0)
         whole.unreadable = unreadable;
     return whole;
@@ -248,8 +235,6 @@ export function renderCurrentSync(runDirectory) {
             else if (file.diagnostics !== undefined && file.diagnostics.length > 0)
                 unreadable[name] = "malformed";
         }
-        // Render may add officer-pointer TypeError damage onto the same unreadable map;
-        // declare after render so that cause enters the existing diagnostics/unreadable seam.
         const whole = render(runDirectory, history.rows, state.rows, log.rows, unreadable);
         for (const [name, code] of Object.entries(unreadable)) {
             const key = `${runDirectory}\0${name}`;

package/dist/run-terminal-artifacts.js

@@ -95,3 +95,14 @@ function withSubmittedPayloads(runDirectory, body) {
 export function runIdFromRunDirectory(runDirectory) {
     return parseRunLeaf(basename(runDirectory))?.runId;
 }
+/** Run-directory face → seat role (last `@` split). */
+export function roleFromRunDirectory(runDirectory) {
+    return parseRunLeaf(basename(runDirectory))?.role;
+}
+/**
+ * #1195 ticket-court blind review: notary source is a countersign run.
+ * Identity still binds; countersign body is not preloaded into dialogue.
+ */
+export function isTicketCourtCountersignSource(runDirectory) {
+    return roleFromRunDirectory(runDirectory) === "countersign";
+}

package/dist/secretariat-contracts.js

@@ -20,11 +20,7 @@ const secretariatVerdictSchema = withTerminatingOutputDeclarations(
   )
 );
 secretariatVerdictSchema.required = [];
-const SECRETARIAT_GATE_OFFICER_ENTRY_TYPE = "ak-secretariat-gate-officer";
-const SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY = "countersignTerminal";
 export {
-  SECRETARIAT_COUNTERSIGN_TERMINAL_FACT_KEY,
-  SECRETARIAT_GATE_OFFICER_ENTRY_TYPE,
   SECRETARIAT_OUTPUT_TOOL_NAME,
   secretariatVerdictSchema
 };

package/dist/submission-gate.js

@@ -1,7 +1,31 @@
-import { bookDirectOfficerRunPointer } from "./archivist-record-pointer.js";
+import { persistAdmittedAuditedSubmissionToolCallId } from "./public-cli/invocation.js";
+import { readRunParentPath, readRoleRunIdentity } from "./public-cli/run-lifecycle.js";
 import { GatekeeperDecisionError, officerConclusionReask, projectGatekeeperRun, } from "./gatekeeper-role.js";
 import { receivedDiscriminator } from "./submission-errors.js";
 import { deliveryLimitFromConfig } from "./receipt-delivery-policy.js";
+/**
+ * Directory of the seat this gate actually summoned — not a nested escalate
+ * terminal that public-role-summons may surface on runDirectory (#1195).
+ * Walk sourceRunPath upward until role matches the summoned officer.
+ */
+async function directoryForSummonedOfficer(officer, summoned) {
+    if (summoned.admitted?.role === officer) {
+        return summoned.admitted.runDirectory;
+    }
+    let dir = typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== ""
+        ? summoned.runDirectory
+        : summoned.admitted?.runDirectory;
+    for (let hop = 0; hop < 8 && dir !== undefined; hop += 1) {
+        const identity = await readRoleRunIdentity(dir);
+        if (identity?.role === officer)
+            return dir;
+        const parent = await readRunParentPath(dir);
+        if (parent === undefined || parent === dir)
+            break;
+        dir = parent;
+    }
+    return undefined;
+}
 /** Received discriminator of the latest payload, retained verbatim for re-ask. */
 export function latestQueueStatus(terminal) {
     const outcome = terminal?.roleOutcome;
@@ -26,7 +50,6 @@ export function latestQueuePayload(terminal) {
     const payloads = outcome.payloads ?? [];
     return payloads.length === 0 ? undefined : payloads[payloads.length - 1];
 }
-import { sessionFileFromPublicSummon } from "./session-assistant-usage.js";
 import { isRecord } from "./unknown-value.js";
 /**
  * Shared-envelope default officer summon (ADR 0018).
@@ -52,41 +75,12 @@ export function createDefaultGateOfficerSummon(options) {
     };
 }
 /**
- * Book a typed pointer in the parent run's current.json officers section.
- * Offline mocks without a real session leave no nested volume (lawful zero).
- */
-function bookDirectOfficerPointer(context, officer, result, summoned, toolCallId) {
-    if (result.status !== "converged"
-        && result.status !== "continue"
-        && result.status !== "escalate"
-        && result.status !== "needs_reask"
-        && result.status !== "transport_failure") {
-        return;
-    }
-    const parentFile = context.sessionManager?.getSessionFile?.();
-    if (typeof parentFile !== "string" || parentFile.trim() === "")
-        return;
-    const sessionFile = sessionFileFromPublicSummon(summoned);
-    if (sessionFile === undefined) {
-        // No independent 正本 to point at — do not synthesize a parallel session.
-        return;
-    }
-    bookDirectOfficerRunPointer({
-        parentSessionFile: parentFile,
-        officer,
-        sessionFile,
-        ...(typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== ""
-            ? { runDirectory: summoned.runDirectory }
-            : {}),
-        ...(toolCallId.trim() === "" ? {} : { submissionToolCallId: toolCallId }),
-    });
-}
-/**
- * Shared envelope: project gate, book officer pointer, map onto host actions.
+ * Shared envelope: project gate, map onto host actions.
  * A real converged / continue / escalate returns immediately. An unreadable
  * conclusion reasks that officer against the configured ceiling; exhaustion
  * returns the receipt actually received.
- * On converged, returns the officer snapshot (receipt + nested runId) for seat projection.
+ * Nested incomplete (directionUnsettled) surfaces immediately — resume the
+ * actual audit seat, never convert into a reask of the outer officer (ADR 0055).
  */
 export async function requireSubmissionGate(options) {
     let reask;
@@ -106,13 +100,18 @@ export async function requireSubmissionGate(options) {
             ...(reask === undefined ? {} : { reask }),
         });
         const gatekeeper = projected.result;
-        // Envelope-owned pointer book. Failure is host infrastructure — single face.
-        if (projected.summoned !== undefined) {
-            try {
-                bookDirectOfficerPointer(options.context, projected.officer, gatekeeper, projected.summoned, options.toolCallId);
-            }
-            catch (error) {
-                options.hostActions.failInfrastructure(error, options.context, options.toolCallId);
+        // #1195 option 1: record parent seal on the summoned seat's admitted-request
+        // (not a nested lower terminal that may ride summoned.runDirectory).
+        if (projected.summoned !== undefined
+            && options.toolCallId.trim() !== ""
+            && (gatekeeper.status === "converged"
+                || gatekeeper.status === "continue"
+                || gatekeeper.status === "escalate"
+                || gatekeeper.status === "needs_reask"
+                || gatekeeper.status === "transport_failure")) {
+            const officerRunDirectory = await directoryForSummonedOfficer(projected.officer, projected.summoned);
+            if (officerRunDirectory !== undefined) {
+                persistAdmittedAuditedSubmissionToolCallId(officerRunDirectory, options.toolCallId);
             }
         }
         if (gatekeeper.status === "converged") {
@@ -123,6 +122,15 @@ export async function requireSubmissionGate(options) {
                 ...(typeof gatekeeper.runId === "string" && gatekeeper.runId.trim() !== ""
                     ? { runId: gatekeeper.runId }
                     : {}),
+                ...(typeof projected.summoned?.runDirectory === "string"
+                    && projected.summoned.runDirectory.trim() !== ""
+                    ? { runDirectory: projected.summoned.runDirectory }
+                    : {}),
+                // Keep the officer terminal for escalate / unsettled surfaces; parent
+                // finals do not project other-seat tables (#1195).
+                ...(projected.summoned?.terminal === undefined
+                    ? {}
+                    : { terminal: projected.summoned.terminal }),
             };
         }
         if (gatekeeper.status === "continue") {
@@ -136,7 +144,11 @@ export async function requireSubmissionGate(options) {
             };
         }
         if (gatekeeper.status === "needs_reask") {
-            if (reasksSpent >= reaskLimit) {
+            // Nested incomplete already exhausted the inner seat's own reask. Surface it;
+            // do not convert into a reask of this outer officer (ADR 0055 / #1195).
+            const nestedIncomplete = projected.summoned?.terminal?.roleOutcome.kind === "accepted"
+                && projected.summoned.terminal.roleOutcome.decisiveFacts?.directionUnsettled === true;
+            if (nestedIncomplete || reasksSpent >= reaskLimit) {
                 return {
                     status: "needs_reask",
                     officer: projected.officer,
@@ -176,6 +188,10 @@ export async function requireSubmissionGate(options) {
                     && projected.summoned.runDirectory.trim() !== ""
                     ? { runDirectory: projected.summoned.runDirectory }
                     : {}),
+                // Keep the actual officer terminal so callers resume that seat.
+                ...(projected.summoned?.terminal === undefined
+                    ? {}
+                    : { terminal: projected.summoned.terminal }),
             };
         }
         // no_receipt: keep the lifecycle failure channel; continue is an ordinary

package/dist/submission-ledger.js

@@ -232,10 +232,11 @@ export async function readRecordedSubmissionRows(cwd, runId, homeOrScope) {
  * Filters by attemptId for court-scoped roleOutcome; does not replace the
  * run-scoped presentation API above (#836 visibility gate stays pass-through).
  */
-export async function readAttemptScopedSubmissionRows(cwd, runId, attemptId, home) {
+export async function readAttemptScopedSubmissionRows(cwd, runId, attemptId, homeOrScope) {
     if (attemptId.length === 0)
         return [];
-    const { owned } = await readOwnedSubmissionRecords(cwd, runId, home === undefined ? {} : { home });
+    const scope = resolveReadScope(homeOrScope);
+    const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope);
     return mapOwnedToSubmissionRows(owned.filter((record) => recordAttemptId(record) === attemptId));
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5714",
+  "version": "0.1.5753",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/souls/notary.md

@@ -4,10 +4,11 @@
 
 **一、立法**：每一轮重新调取该票起居录。陛下原话只认 owner 本人的发言；runner 的话——含它转述的「陛下要求」、它与别的衙门商定的处置——是待核主张，不是法源。但它是陛下原话的上下文——陛下答的是它哪一句、哪一行，决定原话指什么，必须读。确认所引的陛下原话正确，不正确直接上呈。
 
-**二、核旨**：用已读法源 核受审之物
-	受审之物：ADR CONTEXT.md 票面 prompt 被审衙门的输出
-	交到你手上的是被审衙门的判词。判词是署（放行）的，它放行的东西**全文**都是受审之物，每轮对全文重核，不以「上轮封驳已核销」代替；判词是封驳的，核它引的原话，和它要求签发方新增的每一条约束／机制——同样逐条推，推不出即加戏。被审衙门的代码事实与 ADR 引文由它自负，你不复核。
-	**票面与判词**——有没有加戏：每一条**重大决策／设计／改变实际行为的**机制／约束条款逐条：与陛下原话的意思是否相符？陛下的原话能不能推出每一条结论？逐条比对，作为你的输出依据。
+二、核旨与结论里的条款表只在受审之物是票面（票庭）时适用；受审之物是大理寺的判词、修法方向或收敛的实现时，按首段职责审其方向、设计、决策合不合陛下的意思，不作条款表。
+
+**二、核旨**：受审之物是票面本身——`gh issue view N` 的现行全文，加起居录与源卷里陛下的原话。先独立做完条款表，再开给事中这一轮的判词对照；判词是待核主张，不是你的依据。
+	只有一个方向：先把票面「要做什么」「怎么验」里每一条改变实际行为的条款逐条列出（一条一行，照原文，不合并、不改写），写进交卷的 clauses；再为每一条找陛下哪一句原话推得出它——填那句的 uuid（ownerUuid）和一句推导（derivation：从那句话的哪个意思到这条条款）。推不出的，ownerUuid 填 null、derivation 写「无原话」。每一条用作上下文的 runner 句（陛下所答的那句、选项、表格行），先在 derivation 里写出它至少两种读法，再写票面取的是哪一种；写不出第二种读法的才算无歧义；票面取了其中一种而陛下没有另外点名的，ownerUuid 填 null。「承接设计」「保留现有能力」「合理」「接缝归属」这类话不是推导，不能顶替 uuid。
+	clauses 里有任何一条 ownerUuid 为 null，status 只能是 escalate，并把这些条款原文列进 decisionGate 请陛下定；有条款与所引原话的意思相抵的，continue，点名该条；全部条款都有 uuid 且推导成立，才可 converged。
 	**是否符合陛下原意**——先根据起居录对话判断陛下意图，再看受审之物 是不是陛下想要的；字面对得上、意思不对（曲解、断章、只取字面不取法意）同为病。
 	**陛下原话逐句核销**——起居录里陛下对本票说过的每一句，逐句过：先写明它答的是起居录哪一句、哪一行（问句、表格行、选项），那一句描述的对象是什么，写进判词证据；再问他这句话想要什么、在担心什么，再看受审之物给没给到——不是为了凑齐引文。受审之物动作的对象比所答对象大——答的是代码代劳却删席位、删衙门、删能力、改流程——而原话没有点名该对象的，封驳。衙门与替它干活的代码是两个对象：说某机制多余、可以删，不是说撤该衙门；席位、衙门、能力的存废只认点名它本身的原话。质问句——陛下在问这张票、这条约束凭什么存在——是对受审之物的未决挑战，不是授权：没被事实或适用的法答掉的，或被摘来当「支持」的，封驳。runner 在录里已自认不成立的理由仍撑着受审之物的，同。
 	**找不到陛下原话**——受审之物里方向、设计、决策一级的条款，从陛下的意思推不出、又指不出哪条过了审的法源的，即加戏。不得以「授权实质在录」放行。
@@ -31,4 +32,4 @@
 
 ## 结论
 
-结论三态，裁的都是被审衙门这份判词站不站得住：'converged'（署）——站得住，不论它署了票还是封驳了票；'continue'（封驳）——站不住，要被审衙门改判词重交；'escalate'（上呈）——须陛下定，你署不了也驳不了。
+结论三态，裁的是票面每一条条款有没有陛下原话撑着：'converged'（署）——clauses 每条都有 ownerUuid 且推导成立；'continue'（封驳）——有条款与所引原话相抵，退签发方改；'escalate'（上呈）——有条款 ownerUuid 为 null（无原话），陛下定。

package/src/analyst-gate-cycles-read.ts

@@ -1,5 +1,6 @@
 /**
- * Sole reader for gate-cycle facts of the officers pointed at from current.json `officers`.
+ * Sole reader for gate-cycle facts of archived officer-pointer history rows
+ * (decoded via readOfficerPointers; parent current.json no longer projects officers — #1195).
  *
  * Consumer: Analyst sole ledger scan (classifyScopedRun). Metric families must
  * not open a second disk scan — they consume retained facts.
@@ -8,7 +9,7 @@
  * the current gatekeeper/inspector/notary English face. Projection always uses
  * the current English officer identity (inspector | notary).
  *
- * Absent `officers` section → empty rounds (lawful zero). A pointer whose
+ * No archived pointers → empty rounds (lawful zero). A pointer whose
  * officer session fails canonical read/parse must fail loudly (never silently under-count).
  * An accepted gate terminating receipt (isError:false pair on dispatch/officer
  * tool) whose required typed facts are unusable — status, dispatch officer, or
@@ -414,10 +415,10 @@ function pairGateRounds(
 }
 
 /**
- * Read and pair gate-cycle rounds from the officer pointers booked in one
- * run's current.json `officers` section; each pointer names the independent
- * officer session 正本. Absent section → [] (lawful zero). A damaged pointer or
- * officer session propagates — damaged topology must not wash to zero rounds.
+ * Read and pair gate-cycle rounds from archived officer-pointer history on one
+ * parent run; each pointer names the independent officer session 正本.
+ * No pointers → [] (lawful zero). A damaged pointer or officer session propagates
+ * — damaged topology must not wash to zero rounds.
  *
  * Pass `parentSessionFile` to keep only rounds whose attempt binding names that parent.
  */

package/src/analyst-ledger.ts

@@ -336,8 +336,8 @@ export type AnalystReadableRunFacts = {
    */
   readonly models: readonly string[];
   /**
-   * Paired gate-cycle rounds of the officers booked in current.json (#446).
-   * No officers booked → empty (lawful zero rounds).
+   * Paired gate-cycle rounds from archived officer-pointer history (#446 / #1195).
+   * No pointers → empty (lawful zero rounds).
    * A damaged officer pointer or session → leg unreadable (`auditor-roles` source).
    */
   readonly gateCycles: readonly AnalystGateCycleRound[];

package/src/archivist-record-pointer.ts

@@ -2,14 +2,18 @@ import { basename, join } from "node:path";
 import { isRecord } from "./unknown-value.ts";
 import { latestOfficerPointersFromRecords, RUN_HISTORY_FILE } from "./run-dossier.ts";
 import { OFFICER_POINTER_RECORD_KIND } from "./run-dossier-files.ts";
-import { readSitianRecords, reportRunRecord } from "./sitian-facade.ts";
+import { readSitianRecords } from "./sitian-facade.ts";
 
 import { homeFromRunDirectory } from "./activation-ledger-topology.ts";
-import { findRunDirectoryById, readRoleRunIdentity } from "./public-cli/run-lifecycle.ts";
+import { resolveLiveRunDirectoryPath, readRoleRunIdentity } from "./public-cli/run-lifecycle.ts";
 import { rewriteRunDirectoryPathValue } from "./role-run-relocation.ts";
 import { parseRunLeaf, runDirectoryOfSessionFile } from "./role-run-placement.ts";
 
-/** Typed parent-side pointer to an independent officer run 正本 (ADR 0079 / #675). */
+/**
+ * Historical parent-side pointer shape (ADR 0079 / #675).
+ * Production no longer writes these (#1195); retained only so analysts can read
+ * already-archived officer volumes. New runs leave officers empty (lawful zero).
+ */
 export const DIRECT_OFFICER_RUN_POINTER_KIND = "direct-officer-run-pointer" as const;
 
 export type DirectOfficerRunPointer = {
@@ -20,48 +24,12 @@ export type DirectOfficerRunPointer = {
   readonly sessionFile: string;
   /** Officer run directory when known. */
   readonly runDirectory?: string;
-  /**
-   * Parent submission tool call this officer run was summoned for.
-   * Absent on pointers booked before that binding existed.
-   */
-  readonly submissionToolCallId?: string;
 };
 
 /** History record kind of a booked officer pointer (appender routes it to history.jsonl). */
 export { OFFICER_POINTER_RECORD_KIND };
 
-/**
- * Book a typed pointer as one history record of the parent run; the settlement
- * seam projects the latest per officer into current.json `officers`.
- * Never fabricates user/assistant/toolResult rows (#675).
- *
- * Latest record wins per officer under one parent (#753 gate-round accounting):
- * a same-parent re-summons supersedes the earlier pointer instead of adding a
- * second one that re-scans the full officer session and multiplies gate-cycle counts.
- */
-export function bookDirectOfficerRunPointer(options: {
-  readonly parentSessionFile: string;
-  readonly officer: "inspector" | "notary" | "auditor" | "countersign";
-  readonly sessionFile: string;
-  readonly runDirectory?: string;
-  readonly submissionToolCallId?: string;
-}): DirectOfficerRunPointer {
-  const submissionToolCallId = options.submissionToolCallId?.trim() ?? "";
-  const pointer: DirectOfficerRunPointer = {
-    version: 1,
-    kind: DIRECT_OFFICER_RUN_POINTER_KIND,
-    officer: options.officer,
-    sessionFile: options.sessionFile,
-    ...(options.runDirectory !== undefined && options.runDirectory.trim() !== ""
-      ? { runDirectory: options.runDirectory }
-      : {}),
-    ...(submissionToolCallId === "" ? {} : { submissionToolCallId }),
-  };
-  reportRunRecord(runDirectoryOfSessionFile(options.parentSessionFile), OFFICER_POINTER_RECORD_KIND, pointer, "submission-gate");
-  return pointer;
-}
-
-/** Shared strict pointer IO; internal audit wraps unreadability as a re-summons. */
+/** Decode one archived pointer; relocates session/run paths when the leaf moved. */
 export async function resolveOfficerPointer(
   raw: unknown,
   parentRunDirectory: string,
@@ -69,7 +37,6 @@ export async function resolveOfficerPointer(
   sessionFile: string;
   officer?: DirectOfficerRunPointer["officer"];
   runDirectory?: string;
-  submissionToolCallId?: string;
 }> {
   const where = `${parentRunDirectory} officers`;
   if (!isRecord(raw) || raw.kind !== DIRECT_OFFICER_RUN_POINTER_KIND || raw.version !== 1) {
@@ -87,21 +54,18 @@ export async function resolveOfficerPointer(
   const leaf = parseRunLeaf(basename(recordedRunDirectory));
   const parentIdentity = await readRoleRunIdentity(parentRunDirectory);
   if (leaf !== undefined && parentIdentity !== undefined) {
-    const currentRunDirectory = await findRunDirectoryById(
-      homeFromRunDirectory(parentRunDirectory), leaf.runId, parentIdentity.bookKey, leaf.role,
+    const currentRunDirectory = await resolveLiveRunDirectoryPath(
+      recordedRunDirectory, homeFromRunDirectory(parentRunDirectory), parentIdentity.bookKey,
     );
     if (currentRunDirectory !== undefined) {
       sessionFile = rewriteRunDirectoryPathValue(sessionFile, recordedRunDirectory, currentRunDirectory) as string;
       if (runDirectory !== undefined) runDirectory = currentRunDirectory;
     }
   }
-  const submissionToolCallId = typeof raw.submissionToolCallId === "string"
-    && raw.submissionToolCallId.trim() !== "" ? raw.submissionToolCallId : undefined;
   return {
     sessionFile,
     ...(officer === undefined ? {} : { officer }),
     ...(runDirectory === undefined ? {} : { runDirectory }),
-    ...(submissionToolCallId === undefined ? {} : { submissionToolCallId }),
   };
 }
 
@@ -127,21 +91,3 @@ export async function readOfficerPointers(parentRunDirectory: string): Promise<r
     Object.keys(officers).sort().map((name) => resolveOfficerPointer(officers[name], parentRunDirectory)),
   );
 }
-
-/** Missing or unreadable is not a pass: the internal audit caller re-runs the gate. */
-export async function readDirectOfficerRunPointer(
-  parentSessionFile: string,
-  officer: DirectOfficerRunPointer["officer"],
-): Promise<DirectOfficerRunPointer | undefined> {
-  try {
-    const parentRunDirectory = runDirectoryOfSessionFile(parentSessionFile);
-    const pointer = await resolveOfficerPointer(
-      (await readBookedOfficerPointers(parentRunDirectory))[officer],
-      parentRunDirectory,
-    );
-    if (pointer.officer !== officer) return undefined;
-    return { ...pointer, officer, version: 1, kind: DIRECT_OFFICER_RUN_POINTER_KIND };
-  } catch {
-    return undefined;
-  }
-}

package/src/auditor-soul.ts

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { readPageSync } from "./run-dossier.ts";
+import { admittedSourceRunPath, type AdmittedRoleInvocation } from "./public-cli/invocation.ts";
 import { basename, join } from "node:path";
 
 import { parseRunLeaf } from "./role-run-placement.ts";
@@ -119,16 +120,17 @@ function subjectFromSourceDirectory(sourceRunDirectory: string): AuditorSoulRole
  * Resume binding already on the admitted page.
  * Explicit subject wins; otherwise the source-run role is the audited object.
  */
-export async function readAuditorResumeBinding(runDirectory: string): Promise<
+export async function readAuditorResumeBinding(admitted: AdmittedRoleInvocation): Promise<
   | { readonly subject: AuditorSoulRole; readonly sourceRunDirectory: string }
   | undefined
 > {
-  const record = readPageSync(runDirectory, "admitted");
+  const record = readPageSync(admitted.runDirectory, "admitted");
   if (record === undefined) return undefined;
-  if (typeof record.sourceRunPath !== "string" || record.sourceRunPath.trim() === "") return undefined;
+  const sourceRunPath = admittedSourceRunPath(admitted);
+  if (sourceRunPath === undefined) return undefined;
   const subject = isAuditorSoulRole(record.auditorSubject)
     ? record.auditorSubject
-    : subjectFromSourceDirectory(record.sourceRunPath);
+    : subjectFromSourceDirectory(sourceRunPath);
   if (subject === undefined) return undefined;
-  return { subject, sourceRunDirectory: record.sourceRunPath };
+  return { subject, sourceRunDirectory: sourceRunPath };
 }

package/src/countersign-role.ts

@@ -1,4 +1,4 @@
-import { reviewSubmissionSchema } from "./review-submission.ts";
+import { courtReviewSubmissionSchema } from "./review-submission.ts";
 import { roleSubmissionDeclaration } from "./role-submission-declarations.ts";
 import {
   COUNTERSIGN_OUTPUT_TOOL_NAME,
@@ -12,11 +12,11 @@ export type { CountersignVerdict };
 // #836 r16 class 1: fix/note/decisionGate are LLM/human-read narrative content —
 // no code branches on their length or nested presence. `status` alone is the
 // machine discriminator the queue reads.
-// #1055: the three-state field is an enum+required host generation constraint
-// on reviewSubmissionSchema. Package execute still does not reject; an unreadable
-// value reasks the countersign itself with the received value.
+// #1055: the three-state field is an enum+required host generation constraint.
+// #1195: clauses is generation-required on this seat; package execute still does
+// not reject a missing table (ADR 0055).
 /** 给事中票庭审读五问的交卷形状（ADR 0074）；形状指引，非 schema 闸。 */
-export const countersignVerdictSchema = reviewSubmissionSchema;
+export const countersignVerdictSchema = courtReviewSubmissionSchema;
 export type CountersignVerdictParameters = import("./review-submission.ts").ReviewSubmission;
 
 export type CountersignRuntimeDependencies = {

package/src/external-host-turn-loop.ts

@@ -14,36 +14,15 @@ import type {
   RoleTurnResult,
 } from "./host-contracts.ts";
 import type { PreparedRoleTurn } from "./prepared-role-turn.ts";
-import { tryBookKeyFromAkRolesPath } from "./activation-ledger-topology.ts";
 import { projectThrownFailureLeaf, retainPackageFault } from "./public-cli/settlement.ts";
-import { describeErrorIdentity, findRunDirectoryById } from "./public-cli/run-lifecycle.ts";
+import { describeErrorIdentity, resolveLiveRunDirectoryPath } from "./public-cli/run-lifecycle.ts";
+export { resolveLiveRunDirectoryPath } from "./public-cli/run-lifecycle.ts";
 import { deliveryLimitFromConfig } from "./receipt-delivery-policy.ts";
 import { parseRunLeaf } from "./role-run-placement.ts";
 import { projectTurnRequestLiveRunDirectory } from "./role-run-relocation.ts";
 import { reportRunRecord } from "./sitian-facade.ts";
 import { isOneShotWorkerReminderCode } from "./submission-errors.ts";
 
-/**
- * #1171: mid-turn report-ticket may have moved the leg. Prefer the recorded
- * path when it still exists; otherwise re-locate by run id inside the book.
- * Undefined means vanished and unlocatable — callers must not revive the dead leaf.
- */
-export async function resolveLiveRunDirectoryPath(
-  recordedPath: string,
-  home: string,
-): Promise<string | undefined> {
-  if (existsSync(recordedPath)) return recordedPath;
-  const parsed = parseRunLeaf(basename(recordedPath));
-  const bookKey = tryBookKeyFromAkRolesPath(recordedPath);
-  if (parsed === undefined || bookKey === undefined) return undefined;
-  return await findRunDirectoryById(
-    home,
-    parsed.runId,
-    bookKey,
-    parsed.role,
-  );
-}
-
 /**
  * Prefer the request path when it still exists; otherwise re-locate by run id
  * (resolveLiveRunDirectoryPath). Mutates the live request so later turn-record /

package/src/gatekeeper-role.ts

@@ -20,7 +20,11 @@ export const NOTARY_OUTPUT_TOOL = REVIEW_SUBMISSION_OUTPUT_TOOL_NAME;
 /** Gate review officers — 台院 / 符宝郎 / 审刑院 / 给事中 (#753 / #756 / #969). */
 export type GateOfficer = "inspector" | "notary" | "auditor" | "countersign";
 
-/** Officer routing only — content is self-fetched via the shared run-dossier tool (#632). */
+/**
+ * Officer routing only. Ordinary audit dialogue is the parent submission body
+ * (or ticket-court blind materials for notary); code does not open a second
+ * run-dossier content channel here.
+ */
 export type GatekeeperSubject =
   | { readonly kind: "worker_completion" }
   | { readonly kind: "judge_draft" }
@@ -34,7 +38,8 @@ export type GatekeeperSubject =
  * `receipt` unchanged — no findings rewrite, no unreadable/unusable label,
  * no next-step selection for the parent.
  * `runId` is the nested officer run id when known (summoned.runDirectory /
- * terminal.runId) — public terminal projection consumes it (#969).
+ * terminal.runId) so callers resume that seat; parent public finals do not
+ * project other-seat tables (#1195).
  */
 export type GatekeeperResult =
   | {
@@ -227,7 +232,7 @@ function projectOfficerPayloads(
   return projectOfficerDecision(officer, payloads[payloads.length - 1], fallbackStatus);
 }
 
-/** Nested officer runId from summoned.runDirectory, else terminal.runId (#969). */
+/** Nested officer runId from summoned.runDirectory, else terminal.runId (resume identity). */
 export function officerRunIdFromSummoned(summoned: PublicSummonResult): string | undefined {
   if (typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== "") {
     const fromDir = runIdFromRunDirectory(summoned.runDirectory);
@@ -314,6 +319,22 @@ function projectOfficerTerminal(
     );
   }
   if (outcome.kind === "accepted") {
+    // Nested / prior incomplete (directionUnsettled) is not a gate pass (ADR 0055).
+    // Receipt stays this-court or retained; runId comes from the summoned volume
+    // (public-role-summons already prefers nested terminal.runId when roles differ).
+    // No parent-side officerPayloads / officerRunId copies (#1195).
+    if (outcome.decisiveFacts?.directionUnsettled === true) {
+      const receipt = thisCourt.length > 0 ? thisCourt[thisCourt.length - 1] : retainedReceipt(outcome);
+      return withOfficerRunId(
+        {
+          status: "needs_reask",
+          officer,
+          receipt,
+          receivedStatus: receivedDiscriminator(receipt, "status"),
+        },
+        summoned,
+      );
+    }
     // outcome.status is the fixture/compat leaf: production settlement leaves
     // it undefined once payloads are recorded. It may interpret a receipt
     // lacking its own status, never substitute for a missing receipt.