@akagilnc/pi-workflow-roles 0.1.5775 → 0.1.5797

package/dist/public-cli/post-admission.js

@@ -408,6 +408,7 @@ function settlementScopeForTurn(request) {
 /** Bare in-call催交 resume: hostSessionId absent; adapter is the sole load authority. */
 function buildReceiptDeliveryRequest(input) {
     const { request, receiptDelivery } = input;
+    // #1199: progress instruction is this turn's prompt (envelope books continuation.prompt).
     return {
         ...request,
         continuation: {
@@ -1070,6 +1071,7 @@ export function resumeTurnRequestProjectionOptions(admitted, request, env, summo
     const officerDialogue = isStationChildOfficerDialogue(admitted.role, env);
     const fileFlags = summonsPrepared?.attachments ?? [];
     let prompt;
+    // #1199: progress instruction = this prompt (actual seat input, file flags included).
     if (request.message !== undefined) {
         if (summonsPrepared !== undefined) {
             // #755: same-ticket review / open-court — caller words + caller file flags.

package/dist/public-cli/run-lifecycle.js

@@ -13,7 +13,7 @@ import { findRoleRunDirectory, listBookRunDirectories, parseRunLeaf, sessionFile
 import { isSafePositiveTicketNumber } from "../run-ticket-number.js";
 import { CliUsageError } from "./cli-errors.js";
 import { parseCollectorRepository } from "../collector-config.js";
-import { retainedRunPathsMatch, rewriteAdmittedRoleRunPage, rewriteRunDirectoryPathValue, } from "../role-run-relocation.js";
+import { retainedRunPathsMatch, rewriteAdmittedRoleRunPage, rewritePrincipalSessionPaths, } from "../role-run-relocation.js";
 import { packagedResumeSourcePath, packagedRoleMetadata, } from "../packaged-role-registry.js";
 import { admittedReviewerBaseFault, admittedSourceRunPath, recordEffectiveInvocationModel, requireAuthorityRef, isReviewerLens, normalizeAdmittedAttachment, } from "./invocation.js";
 import { readPageSync, writeSectionSync } from "../run-dossier.js";
@@ -136,10 +136,16 @@ async function readRoleRunStateDisk(runDirectory) {
         : runDirectory;
     const runDir = runDirectory;
     // Principal wire stays uninterpreted — authority owns legacy sessionFile fallback.
+    // #1199: leg-local session/ moves with the run-prefix rewrite.
+    const principalCoords = {
+        sessionDirectory: record.sessionDirectory,
+        ...(typeof record.sessionFile === "string" ? { sessionFile: record.sessionFile } : {}),
+    };
+    rewritePrincipalSessionPaths(principalCoords, storedRunDirectory, runDirectory);
     const principalWire = {
-        sessionDirectory: rewriteRunDirectoryPathValue(record.sessionDirectory, storedRunDirectory, runDirectory),
-        ...(typeof record.sessionFile === "string"
-            ? { sessionFile: rewriteRunDirectoryPathValue(record.sessionFile, storedRunDirectory, runDirectory) }
+        sessionDirectory: principalCoords.sessionDirectory,
+        ...(typeof principalCoords.sessionFile === "string"
+            ? { sessionFile: principalCoords.sessionFile }
             : {}),
     };
     const phase = record.phase === "plan" || record.phase === "apply"

package/dist/public-cli/turn-request.js

@@ -51,6 +51,9 @@ export function projectRoleTurnRequest(admitted, roleDetails, options) {
         ...(options.deliveryRequestLimit === undefined
             ? {}
             : { deliveryRequestLimit: options.deliveryRequestLimit }),
+        ...(options.host === undefined || options.host.trim() === ""
+            ? {}
+            : { host: options.host.trim() }),
     };
 }
 /**

package/dist/report-ticket-tool.js

@@ -102,6 +102,7 @@ export async function reportTicketFromHostContext(context, rawTicketNumber, auth
         if (process.env.AK_ROLE_RUN_DIR === runDirectory) {
             process.env.AK_ROLE_RUN_DIR = nextDirectory;
         }
+        // Leg-local session/: rewrite the open handle under the renamed run prefix.
         const projectedSessionFile = typeof priorSessionFile === "string" && priorSessionFile.trim() !== ""
             ? rewriteRunDirectoryPathValue(priorSessionFile, runDirectory, nextDirectory)
             : sessionFileOf(nextDirectory);
@@ -109,9 +110,8 @@ export async function reportTicketFromHostContext(context, rawTicketNumber, auth
             context.sessionManager.setSessionFile?.(projectedSessionFile);
         }
     };
-    const relocation = alreadyPlaced
-        ? undefined
-        : await relocateAdmittedRunToTicket(admitted, authority, { relocate: applyLiveHandles });
+    // Always enter relocate: unbound→rename+publish; already-on-ticket→publish leftover staging.
+    const relocation = await relocateAdmittedRunToTicket(admitted, authority, alreadyPlaced ? undefined : { relocate: applyLiveHandles });
     const nextDirectory = relocation?.newRunDirectory ?? admitted.runDirectory;
     if (relocation === undefined)
         applyLiveHandles(nextDirectory);

package/dist/role-run-placement.js

@@ -14,10 +14,20 @@ function parseRunLeaf(name) {
   if (at <= 0 || at === name.length - 1) return void 0;
   return { runId: name.slice(0, at), role: name.slice(at + 1) };
 }
+const ROLE_RUN_SESSION_FILENAME = "session.jsonl";
+function subjectDirectoryOfRun(runDirectory) {
+  const runsParent = dirname(runDirectory);
+  if (basename(runsParent) !== "runs") return void 0;
+  const subjectDirectory = dirname(runsParent);
+  const subjectName = basename(subjectDirectory);
+  if (subjectName === "unbound" || /^[1-9]\d*$/.test(subjectName)) {
+    return subjectDirectory;
+  }
+  return void 0;
+}
 function sessionDirectoryOf(runDirectory) {
   return join(runDirectory, "session");
 }
-const ROLE_RUN_SESSION_FILENAME = "session.jsonl";
 function sessionFileIn(sessionDirectory) {
   return join(sessionDirectory, ROLE_RUN_SESSION_FILENAME);
 }
@@ -107,6 +117,7 @@ function ensureRoleRunDirectory(ledgerHome, directory) {
   return ensureRealDirectoryTree(ledgerHome, directory);
 }
 function ensureRoleRunPlacement(ledgerHome, placement) {
+  ensureRoleRunDirectory(ledgerHome, placement.runDirectory);
   ensureRoleRunDirectory(ledgerHome, placement.sessionDirectory);
 }
 export {
@@ -124,5 +135,6 @@ export {
   runDirectoryOfSessionFile,
   sessionDirectoryOf,
   sessionFileIn,
-  sessionFileOf
+  sessionFileOf,
+  subjectDirectoryOfRun
 };

package/dist/role-run-relocation.js

@@ -12,7 +12,7 @@ import { dirname, join } from "node:path";
 import { activationBookDirectory, physicalPathIdentity } from "./activation-ledger-topology.js";
 import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.js";
 import { readRoleRunIdentity } from "./public-cli/run-lifecycle.js";
-import { roleRunPlacement } from "./role-run-placement.js";
+import { roleRunPlacement, sessionDirectoryOf } from "./role-run-placement.js";
 import { INVOCATION_PAGE_PATH_FIELDS, PRINCIPAL_SESSION_PATH_FIELDS, RUN_STATE_PAGE_PATH_FIELDS, projectTurnRequestLiveRunDirectory, rewriteAdmittedRoleRunPage, rewritePrincipalSessionPaths, rewriteRunDirectoryPathFields, rewriteRunDirectoryPathFieldsAgainstRewrites, rewriteRunDirectoryPathValue, rewriteRunDirectoryPathValueAgainstRewrites, rewriteSummonsMaterials, } from "./role-run-path-rewrite.js";
 import { readPageSync, updateSectionSync } from "./run-dossier.js";
 import { isEnoent, isRecord } from "./unknown-value.js";
@@ -215,7 +215,7 @@ async function rewriteSessionTranscriptBindings(path, rewrites) {
  * session transcript typed parent bindings. Never walks caller file paths.
  */
 async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
-    const sessionRoot = join(pagesDirectory, "session");
+    const sessionRoot = sessionDirectoryOf(pagesDirectory);
     async function walk(directory) {
         let entries;
         try {

package/dist/run-dossier.js

@@ -19,7 +19,7 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
-import { sessionFileOf } from "./role-run-placement.js";
+import { sessionDirectoryOf, sessionFileOf } from "./role-run-placement.js";
 import { projectRenderedPagePaths } from "./role-run-path-rewrite.js";
 import { RUN_CURRENT_FILE, RUN_HISTORY_FILE, RUN_LOG_FILE, RUN_STATE_FILE, OFFICER_POINTER_RECORD_KIND } from "./run-dossier-files.js";
 import { appendSitianRecord } from "./sitian-appender.js";
@@ -181,9 +181,10 @@ function render(runDirectory, history, state, log, unreadable) {
         }
     }
     // The copy row keeps the absolute path it was written to; a run that was filed under its ticket
-    // since lives elsewhere. The original is projected from where this run directory is now.
-    if (typeof original === "string")
-        original = join(runDirectory, "session", basename(original));
+    // since lives elsewhere. The original is projected from where this run's session lands now.
+    if (typeof original === "string") {
+        original = join(sessionDirectoryOf(runDirectory), basename(original));
+    }
     whole.host = { sessions, ...(original === undefined ? {} : { original }) };
     whole.submission = latest === undefined ? {} : { latest };
     if (Object.keys(unreadable).length > 0)

package/dist/session-identity.js

@@ -1,5 +1,6 @@
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { DEFAULT_ROLE_TURN_HOST, lookupHeadlessHostDescription, lookupHostDescription, } from "./host-descriptions.js";
+import { runDirectoryFromSessionDirectory } from "./role-run-placement.js";
 import { renderCurrentSync, RUN_STATE_FILE } from "./run-dossier.js";
 import { readSitianRecords, reportRunRecord } from "./sitian-facade.js";
 import { errorText, isRecord } from "./unknown-value.js";
@@ -14,7 +15,7 @@ export const HOST_SESSION_ID_RECORD_KIND = "host-session-id";
  * host/session failure (facts stay in state.jsonl; settlement still renders).
  */
 export function createSessionIdentityAuthority(authority, hostName) {
-    const runDirectoryOf = (principal) => dirname(authority.decode(principal).sessionDirectory);
+    const runDirectoryOf = (principal) => runDirectoryFromSessionDirectory(authority.decode(principal).sessionDirectory);
     return {
         principalAuthority: authority,
         resolveSessionFile(principal) {

package/dist/sitian-appender.js

@@ -1,7 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { parseRunLeaf, sessionDirectoryOf } from "./role-run-placement.js";
+import {
+  parseRunLeaf,
+  sessionDirectoryOf
+} from "./role-run-placement.js";
 import { RUN_HISTORY_FILE, RUN_HISTORY_KINDS, RUN_LOG_FILE, RUN_STATE_FILE, RUN_STATE_KINDS } from "./run-dossier-files.js";
 import { ticketNumberFromSitianSubject } from "./run-ticket-number.js";
 import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
@@ -33,6 +36,12 @@ function appendSitianRecordBlock(input, block) {
 function resolveSitianVolumeCategory(kind) {
   return kind;
 }
+function runDirectoryOwningSessionParent(sessionParentDir) {
+  if (basename(sessionParentDir) !== "session") return void 0;
+  const runDirectory = dirname(sessionParentDir);
+  if (parseRunLeaf(basename(runDirectory)) === void 0) return void 0;
+  return runDirectory;
+}
 const SITIAN_RECORDS_LEAF = "records.jsonl";
 function sitianVolumeDirectory(sessionDirectory, category) {
   return join(sessionDirectory, category);
@@ -68,8 +77,8 @@ function resolveSitianRecordPathInLedger(input, ledgerHome) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
     const sessionParentDir = dirname(input.sessionParent);
-    const runDirectory = dirname(sessionParentDir);
-    if (basename(sessionParentDir) === "session" && parseRunLeaf(basename(runDirectory)) !== void 0) {
+    const runDirectory = runDirectoryOwningSessionParent(sessionParentDir);
+    if (runDirectory !== void 0) {
       sessionDir = runDirectory;
       recordFile = join(runDirectory, RUN_HISTORY_KINDS.has(input.kind) ? RUN_HISTORY_FILE : RUN_STATE_KINDS.has(input.kind) ? RUN_STATE_FILE : RUN_LOG_FILE);
     } else {

package/dist/submission-ledger.js

@@ -9,6 +9,7 @@ import { failOnInfrastructureFailureDeclaration, infrastructureFailureDiagnostic
 import { reportTicketFromHostContext } from "./report-ticket-tool.js";
 import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.js";
 import { readDeclaredTicketNumber } from "./run-ticket-number.js";
+import { captureWorktreeHead, landTicketProgressForSealedSubmission, } from "./ticket-progress.js";
 import { isRecord, errorText } from "./unknown-value.js";
 /**
  * Admitted run identity for the ledger subject.
@@ -294,6 +295,8 @@ export async function sealAcceptedSubmission(options) {
     const attemptId = attemptIdentity(options.context, runId);
     const sessionParent = sessionParentFromHostContext(options.context);
     const home = homeFromHostContext(options.context, options.home);
+    // #1199: same seal-time HEAD + progress landing as the terminating-tool wrap.
+    const sealHead = captureWorktreeHead(options.context.cwd);
     sitianReport({
         level: "event",
         kind: "sealed",
@@ -310,6 +313,12 @@ export async function sealAcceptedSubmission(options) {
         ...(home !== undefined ? { home } : {}),
         ...(sessionParent === undefined ? {} : { sessionParent }),
     });
+    landTicketProgressForSealedSubmission({
+        context: options.context,
+        role: options.role,
+        accepted: options.accepted,
+        sealHead,
+    });
 }
 /**
  * Submission ledger host — record only (#836).
@@ -457,6 +466,9 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                         kind: "accepted",
                         accepted: params,
                     };
+                    // #1199: seal-time HEAD + ticket progress before projectClosure.
+                    // One seal → one row; post-turn history guessing is not used.
+                    const sealHead = captureWorktreeHead(context.cwd);
                     append({
                         type: "sealed",
                         attemptId,
@@ -464,6 +476,18 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
                         role,
                         accepted: params,
                     });
+                    const rawLens = typeof host.getFlag === "function"
+                        ? host.getFlag("ak-review-lens")
+                        : undefined;
+                    landTicketProgressForSealedSubmission({
+                        context,
+                        role,
+                        accepted: params,
+                        sealHead,
+                        ...(rawLens === "completeness" || rawLens === "correctness"
+                            ? { lens: rawLens }
+                            : {}),
+                    });
                     await projectClosure(closed, context);
                     return result;
                 },

package/dist/ticket-progress.js

@@ -0,0 +1,306 @@
+/**
+ * #1199 ticket-level progress: current.jsonl + leg-local receipts/session.
+ * Write at seal (createSubmissionLedgerHost → projectClosure), never by
+ * post-turn history guessing. Per-leg dossiers stay until #1202.
+ *
+ * Originals stay in the leg directory (owner 14b58f6c / a8d2e72d):
+ * `runs/<leg>/receipts/<n>.json`, `runs/<leg>/session/<原件>`.
+ * Unbound legs stage rows in `progress.jsonl` (round empty); bind renames the
+ * whole leg, then this module fills rounds and appends ticket current.jsonl.
+ * Round authority is progress lines only — no receipt-filename counting,
+ * occupancy placeholders, or claim-retry loops. Reviewer dual-lens series
+ * count independently (`<n>.<lens>`).
+ */
+import { spawnSync } from "node:child_process";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join, relative, sep } from "node:path";
+import { resolveHostDossierLandingPath } from "./host-session-record.js";
+import { runDirectoryFromHostContext } from "./host-contracts.js";
+import { acceptedFacts, isTerminatingToolName, } from "./package-contracts/terminating-tools.js";
+import { packagedRoleOutputTool } from "./packaged-role-registry.js";
+import { isUnboundRunDirectory, sessionDirectoryOf, sessionFileOf, subjectDirectoryOfRun, } from "./role-run-placement.js";
+import { readPageSync } from "./run-dossier.js";
+import { parseSitianRecordText } from "./sitian-reader.js";
+import { isRecord } from "./unknown-value.js";
+const CURRENT_FILENAME = "current.jsonl";
+const RECEIPTS_DIRNAME = "receipts";
+const LEG_PROGRESS_FILENAME = "progress.jsonl";
+/**
+ * Append-only progress JSONL — same posture as run-dossier row files:
+ * sole Sitian decoder keeps reachable rows; malformed lines leave diagnostics
+ * on stderr and do not abort seal/relocate.
+ */
+function parseProgressText(text, pathForDiagnostic) {
+    if (text.trim() === "")
+        return [];
+    const { records, diagnostics } = parseSitianRecordText(text);
+    for (const diagnostic of diagnostics) {
+        process.stderr.write(`[ticket-progress] ${pathForDiagnostic} has malformed row(s); keeps reachable rows and retains the diagnostic: line ${diagnostic.line}: ${diagnostic.error}\n`);
+    }
+    const lines = [];
+    for (const record of records) {
+        const parsed = record;
+        if (!isRecord(parsed))
+            continue;
+        if (typeof parsed.seat !== "string" || typeof parsed.round !== "string")
+            continue;
+        lines.push(parsed);
+    }
+    return lines;
+}
+function readProgressFile(path) {
+    if (!existsSync(path))
+        return [];
+    return parseProgressText(readFileSync(path, "utf8"), path);
+}
+/**
+ * Read progress rows under a subject.
+ * Ticket: append-only `current.jsonl`.
+ * Unbound: each leg's `runs/<leaf>/progress.jsonl` (no shared file).
+ */
+export function readTicketProgressLines(subjectDirectory) {
+    if (basename(subjectDirectory) === "unbound") {
+        const runsDir = join(subjectDirectory, "runs");
+        if (!existsSync(runsDir))
+            return [];
+        const out = [];
+        for (const name of readdirSync(runsDir).sort()) {
+            out.push(...readProgressFile(join(runsDir, name, LEG_PROGRESS_FILENAME)));
+        }
+        return out;
+    }
+    return readProgressFile(join(subjectDirectory, CURRENT_FILENAME));
+}
+function roundBaseNumber(round) {
+    if (round.trim() === "")
+        return 0;
+    const base = round.includes(".") ? round.slice(0, round.indexOf(".")) : round;
+    const n = Number(base);
+    return Number.isSafeInteger(n) && n > 0 ? n : 0;
+}
+function roundLens(round) {
+    return round.includes(".") ? round.slice(round.indexOf(".") + 1) : undefined;
+}
+function nextRoundFromLines(lines, seat, lens) {
+    const want = lens === undefined || lens.trim() === "" ? undefined : lens;
+    let max = 0;
+    for (const line of lines) {
+        if (line.seat !== seat)
+            continue;
+        if (roundLens(line.round) !== want)
+            continue;
+        max = Math.max(max, roundBaseNumber(line.round));
+    }
+    const base = max + 1;
+    return want === undefined ? String(base) : `${base}.${want}`;
+}
+/** Leg-local receipt ordinal: `receipts/<n>.json` (not seat#round). */
+function nextLegReceiptIndex(runDirectory) {
+    const dir = join(runDirectory, RECEIPTS_DIRNAME);
+    if (!existsSync(dir))
+        return 1;
+    let max = 0;
+    for (const name of readdirSync(dir)) {
+        const match = /^(\d+)\.json$/.exec(name);
+        if (match === null)
+            continue;
+        const n = Number(match[1]);
+        if (Number.isSafeInteger(n) && n > max)
+            max = n;
+    }
+    return max + 1;
+}
+/**
+ * Copy structured status/summary from the seat receipt.
+ * Status leaves reuse acceptedFacts (terminating-tools authority) via the seat's
+ * current output tool — legacy judgeStatus/countersignStatus keys are unreachable
+ * at this seal seam (tool is the live registry name, not ak_judge_output).
+ * summary is seat-authored prose on the receipt and is not part of AcceptedFacts.
+ * Missing fields stay absent — never invent "" or "accepted".
+ *
+ * Not receiptStatusFromRegistry: that scans every registry key for navigator
+ * projection when the seat is unknown; here the seal already knows the seat.
+ */
+function statusAndSummaryFromPayload(seat, payload) {
+    if (!isRecord(payload))
+        return {};
+    const toolName = packagedRoleOutputTool(seat);
+    const status = toolName !== undefined && isTerminatingToolName(toolName)
+        ? acceptedFacts(toolName, payload).status
+        : undefined;
+    const summary = typeof payload.summary === "string" ? payload.summary : undefined;
+    return {
+        ...(status === undefined ? {} : { status }),
+        ...(summary === undefined ? {} : { summary }),
+    };
+}
+/** Worktree HEAD at seal. On failure head is empty and fault carries the true cause. */
+export function captureWorktreeHead(projectRoot) {
+    try {
+        const result = spawnSync("git", ["rev-parse", "HEAD"], {
+            cwd: projectRoot,
+            encoding: "utf8",
+            maxBuffer: 1024 * 1024,
+        });
+        if (result.error != null) {
+            const err = result.error;
+            const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
+            return { head: "", fault: `git rev-parse HEAD spawn failed cwd=${projectRoot}: ${detail}` };
+        }
+        if (result.status !== 0) {
+            const detail = [result.stderr, result.stdout]
+                .map((part) => (typeof part === "string" ? part.trim() : ""))
+                .filter((part) => part !== "")
+                .join(" | ");
+            const status = result.status === null ? "null" : String(result.status);
+            const signal = result.signal == null ? "" : ` signal=${result.signal}`;
+            return {
+                head: "",
+                fault: detail === ""
+                    ? `git rev-parse HEAD failed (status=${status}${signal}) cwd=${projectRoot}`
+                    : `git rev-parse HEAD failed (status=${status}${signal}) cwd=${projectRoot}: ${detail}`,
+            };
+        }
+        return { head: (result.stdout ?? "").trim() };
+    }
+    catch (error) {
+        const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
+        return { head: "", fault: `git rev-parse HEAD threw cwd=${projectRoot}: ${message}` };
+    }
+}
+function progressSessionAbsolute(runDirectory, context) {
+    const host = typeof context.host === "string" ? context.host.trim() : "";
+    const sessionDirectory = sessionDirectoryOf(runDirectory);
+    // External hosts: ADR 0086 copy landing (codex.jsonl / grok-build / …), not the
+    // principal wire file. Responsibility unchanged (#1199 R3 disposition).
+    if (host !== "" && host !== "pi" && host !== "hermes") {
+        return resolveHostDossierLandingPath({ host, sessionDirectory });
+    }
+    // Pi/hermes: prefer the issued durable coordinate on the live handle.
+    const issued = context.sessionManager.getSessionFile?.();
+    if (typeof issued === "string" && issued.trim() !== "") {
+        return issued;
+    }
+    return sessionFileOf(runDirectory);
+}
+function lensFromRunDirectory(runDirectory, role) {
+    if (role !== "reviewer")
+        return undefined;
+    const lens = readPageSync(runDirectory, "admitted")?.lens;
+    return lens === "completeness" || lens === "correctness" ? lens : undefined;
+}
+/**
+ * Seal-time landing from createSubmissionLedgerHost (before projectClosure).
+ * Missing run directory → no-op (ledger still sealed).
+ */
+export function landTicketProgressForSealedSubmission(input) {
+    const runDirectory = runDirectoryFromHostContext(input.context);
+    if (runDirectory === undefined)
+        return undefined;
+    const subjectDirectory = subjectDirectoryOfRun(runDirectory);
+    if (subjectDirectory === undefined)
+        return undefined;
+    const lens = (input.lens === "completeness" || input.lens === "correctness"
+        ? input.lens
+        : lensFromRunDirectory(runDirectory, input.role));
+    const leaf = basename(runDirectory);
+    const unbound = basename(subjectDirectory) === "unbound";
+    const progressPath = unbound
+        ? join(runDirectory, LEG_PROGRESS_FILENAME)
+        : join(subjectDirectory, CURRENT_FILENAME);
+    // Original receipt first — independent of derived progress read/append.
+    // Progress I/O failure must not erase an already-accepted payload (#1199 F1).
+    const receiptIndex = nextLegReceiptIndex(runDirectory);
+    const relativePath = `runs/${leaf}/${RECEIPTS_DIRNAME}/${receiptIndex}.json`;
+    const absolutePath = join(subjectDirectory, relativePath);
+    mkdirSync(dirname(absolutePath), { recursive: true });
+    writeFileSync(absolutePath, `${JSON.stringify(input.accepted, null, 2)}\n`, "utf8");
+    // #1199 R1: bound leg with leftover progress.jsonl must publish before this
+    // seal takes the next ticket round — optional ticketNumber must not be required.
+    if (!unbound) {
+        relocateTicketProgressForLeg({ runDirectory });
+    }
+    const existing = unbound
+        ? readProgressFile(progressPath)
+        : readTicketProgressLines(subjectDirectory);
+    // Unbound: round stays empty until whole-leg bind publishes into ticket current.
+    const round = unbound ? "" : nextRoundFromLines(existing, input.role, lens);
+    const sessionFile = progressSessionAbsolute(runDirectory, input.context);
+    const sessionRelative = relative(subjectDirectory, sessionFile).split(sep).join("/");
+    const { status, summary } = statusAndSummaryFromPayload(input.role, input.accepted);
+    const instruction = typeof input.context.summonsInstruction === "string"
+        ? input.context.summonsInstruction
+        : "";
+    const line = {
+        at: new Date().toISOString(),
+        seat: input.role,
+        round,
+        instruction,
+        head: input.sealHead.head,
+        ...(status === undefined ? {} : { status }),
+        ...(summary === undefined ? {} : { summary }),
+        receipt: relativePath,
+        session: sessionRelative,
+    };
+    mkdirSync(dirname(progressPath), { recursive: true });
+    appendFileSync(progressPath, `${JSON.stringify(line)}\n`, "utf8");
+    // HEAD capture fault: keep the raw cause on stderr. Do not invent a second
+    // dossier custom-frame channel beside post-admission's existing retain path.
+    if (input.sealHead.fault !== undefined) {
+        process.stderr.write(`${input.sealHead.fault}\n`);
+    }
+    return line;
+}
+/**
+ * After whole-leg rename (or retry when already under the ticket): fill rounds
+ * on staged `progress.jsonl`, append ticket `current.jsonl`, then drop staging.
+ * Receipt / session / head / instruction keep seal-time values and relative
+ * paths — no copy, delete-source, or rewrite of relative pointers.
+ *
+ * Unbound staging leaves `round` empty; publish takes the leg's sealed lens from
+ * the admitted page (`lensFromRunDirectory`), never from receipt prose.
+ */
+export function relocateTicketProgressForLeg(input) {
+    if (isUnboundRunDirectory(input.runDirectory))
+        return;
+    const subjectDirectory = subjectDirectoryOfRun(input.runDirectory);
+    if (subjectDirectory === undefined)
+        return;
+    const stagedPath = join(input.runDirectory, LEG_PROGRESS_FILENAME);
+    const mine = readProgressFile(stagedPath);
+    if (mine.length === 0) {
+        if (existsSync(stagedPath)) {
+            rmSync(stagedPath, { force: true });
+        }
+        return;
+    }
+    const ticketLines = [...readTicketProgressLines(subjectDirectory)];
+    // Receipt path is the seal identity. Append-then-unlink partial success must
+    // not reassign rounds or re-append the same originals on re-entry (#1199 F2).
+    const publishedReceipts = new Set(ticketLines
+        .map((line) => line.receipt)
+        .filter((receipt) => typeof receipt === "string" && receipt !== ""));
+    const pending = mine.filter((line) => !publishedReceipts.has(line.receipt));
+    if (pending.length === 0) {
+        rmSync(stagedPath, { force: true });
+        return;
+    }
+    const movedLines = [];
+    for (const line of pending) {
+        // Current unbound staging publishes empty rounds; lens comes only from this
+        // leg's admitted page. No legacy staged-round mirror-suffix branch.
+        const lens = lensFromRunDirectory(input.runDirectory, line.seat);
+        const round = nextRoundFromLines(ticketLines, line.seat, lens);
+        const moved = {
+            ...line,
+            round,
+        };
+        movedLines.push(moved);
+        ticketLines.push(moved);
+    }
+    const newCurrent = join(subjectDirectory, CURRENT_FILENAME);
+    mkdirSync(dirname(newCurrent), { recursive: true });
+    appendFileSync(newCurrent, `${movedLines.map((line) => JSON.stringify(line)).join("\n")}\n`, "utf8");
+    // Append succeeded — drop staging. Failure above leaves progress.jsonl in place.
+    rmSync(stagedPath, { force: true });
+}

package/dist/user-dialogue-stdin.js

@@ -2,33 +2,39 @@
  * Typed user-dialogue stdin transport (#879 / #471).
  * Pi's piped-stdin reader trims the wrapper; the body field keeps original bytes.
  * No size cap and no path/pointer substitute — the whole dialogue rides the envelope.
+ *
+ * #1199: progress-line instruction is these same body bytes (what the seat
+ * actually receives). No parallel 传召词 field on the envelope.
  */
 import { isRecord } from "./unknown-value.js";
 export const USER_DIALOGUE_STDIN_KIND = "ak-user-dialogue";
 export function encodeUserDialogueStdin(body) {
-    return JSON.stringify({ kind: USER_DIALOGUE_STDIN_KIND, body });
+    const envelope = { kind: USER_DIALOGUE_STDIN_KIND, body };
+    return JSON.stringify(envelope);
 }
-function isUserDialogueEnvelope(value) {
-    if (!isRecord(value))
-        return false;
-    const record = value;
-    return record.kind === USER_DIALOGUE_STDIN_KIND && typeof record.body === "string";
-}
-/**
- * Host read: recover original dialogue after a trim-capable pipe.
- * Non-envelope text (interactive Pi, officer JSON, headless raw body) is unchanged.
- */
-export function readUserDialogueStdin(raw) {
+/** One parse for the model-facing body — callers must not re-implement. */
+export function tryParseUserDialogueStdin(raw) {
     const trimmed = raw.trim();
     if (!trimmed.startsWith("{"))
-        return raw;
+        return undefined;
     try {
         const parsed = JSON.parse(trimmed);
-        if (isUserDialogueEnvelope(parsed))
-            return parsed.body;
+        if (!isRecord(parsed))
+            return undefined;
+        const record = parsed;
+        if (record.kind !== USER_DIALOGUE_STDIN_KIND || typeof record.body !== "string") {
+            return undefined;
+        }
+        return { kind: USER_DIALOGUE_STDIN_KIND, body: record.body };
     }
     catch {
-        // Not our envelope — leave caller bytes intact.
+        return undefined;
     }
-    return raw;
+}
+/**
+ * Host read: recover original dialogue after a trim-capable pipe.
+ * Non-envelope text (interactive Pi, officer JSON, headless raw body) is unchanged.
+ */
+export function readUserDialogueStdin(raw) {
+    return tryParseUserDialogueStdin(raw)?.body ?? raw;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5775",
+  "version": "0.1.5797",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",