@akagilnc/pi-workflow-roles 0.1.5775 → 0.1.5797

package/src/role-runtime.ts

@@ -1171,7 +1171,16 @@ export function createRoleRuntimeExtension(
         settleNavigatorProjection,
       );
     };
-    roleHost.on("input", (_event) => {
+    roleHost.on("input", (event, ctx) => {
+      // #1199: progress instruction = bytes actually received this turn.
+      // HostContext field only — never process.env body (nested identity / ARG_MAX).
+      // Transport unpack is sole at the host adapter (Pi strips envelope once).
+      // Do not re-parse model-facing body — a legal JSON literal must stay intact.
+      // Adapter already booked the unpacked body; fill only when still absent
+      // (plain hosts without a prior unpack).
+      if (typeof event.text === "string" && ctx.summonsInstruction === undefined) {
+        ctx.summonsInstruction = event.text;
+      }
       const role = roleHost.getFlag(ROLE_FLAG.name);
       if (role !== undefined && !admitted) return { action: "handled" as const };
       return { action: "continue" as const };
@@ -1377,7 +1386,9 @@ export function createRoleRuntimeExtension(
         receiptDelivery.recordDeliveryRequest();
         // Keep the package-owned continuation off the public input lifecycle:
         // receipt delivery must not be mistaken for later caller input.
-        // #1208: resend this turn's actual dialogue; stats stay on policy/lifecycle.
+        // #1208: resend this turn's dialogue; #1199 books the same actual input.
+        const deliveryContent = turnDialoguePrompt ?? "";
+        ctx.summonsInstruction = deliveryContent;
         const scopeId = ctx.invocationScopeId?.trim() ?? "";
         envelopeHost.appendEntry(
           RECEIPT_DELIVERY_REQUEST_ENTRY,
@@ -1393,7 +1404,7 @@ export function createRoleRuntimeExtension(
         });
         envelopeHost.sendMessage({
           customType: "ak-receipt-delivery-prompt",
-          content: turnDialoguePrompt ?? "",
+          content: deliveryContent,
           display: false,
         }, { triggerTurn: true, deliverAs: "followUp" });
       } else if (receiptDelivery.nextAction() === "no-receipt" && !noReceiptRecorded) {

package/src/run-dossier.ts

@@ -20,7 +20,7 @@ import { randomUUID } from "node:crypto";
 import { readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
 
-import { sessionFileOf } from "./role-run-placement.ts";
+import { sessionDirectoryOf, sessionFileOf } from "./role-run-placement.ts";
 import { projectRenderedPagePaths } from "./role-run-path-rewrite.ts";
 import { RUN_CURRENT_FILE, RUN_HISTORY_FILE, RUN_LOG_FILE, RUN_STATE_FILE, OFFICER_POINTER_RECORD_KIND } from "./run-dossier-files.ts";
 import { appendSitianRecord } from "./sitian-appender.ts";
@@ -213,8 +213,10 @@ function render(
     }
   }
   // The copy row keeps the absolute path it was written to; a run that was filed under its ticket
-  // since lives elsewhere. The original is projected from where this run directory is now.
-  if (typeof original === "string") original = join(runDirectory, "session", basename(original));
+  // since lives elsewhere. The original is projected from where this run's session lands now.
+  if (typeof original === "string") {
+    original = join(sessionDirectoryOf(runDirectory), basename(original));
+  }
   whole.host = { sessions, ...(original === undefined ? {} : { original }) };
   whole.submission = latest === undefined ? {} : { latest };
   if (Object.keys(unreadable).length > 0) whole.unreadable = unreadable;

package/src/run-terminal-artifacts.ts

@@ -124,4 +124,3 @@ export function runIdFromRunDirectory(runDirectory: string): string | undefined
 export function roleFromRunDirectory(runDirectory: string): string | undefined {
   return parseRunLeaf(basename(runDirectory))?.role;
 }
-

package/src/session-identity.ts

@@ -1,4 +1,4 @@
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 
 import type { DurablePrincipal, DurablePrincipalAuthority } from "./host-contracts.ts";
 import {
@@ -6,6 +6,7 @@ import {
   lookupHeadlessHostDescription,
   lookupHostDescription,
 } from "./host-descriptions.ts";
+import { runDirectoryFromSessionDirectory } from "./role-run-placement.ts";
 import { renderCurrentSync, RUN_STATE_FILE } from "./run-dossier.ts";
 import { readSitianRecords, reportRunRecord } from "./sitian-facade.ts";
 import { errorText, isRecord } from "./unknown-value.ts";
@@ -27,7 +28,7 @@ export function createSessionIdentityAuthority(
   hostName: string,
 ): SessionIdentityAuthority {
   const runDirectoryOf = (principal: DurablePrincipal): string =>
-    dirname(authority.decode(principal).sessionDirectory);
+    runDirectoryFromSessionDirectory(authority.decode(principal).sessionDirectory);
   return {
     principalAuthority: authority,
     resolveSessionFile(principal) {

package/src/sitian-appender.ts

@@ -7,7 +7,10 @@ import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
-import { parseRunLeaf, sessionDirectoryOf } from "./role-run-placement.ts";
+import {
+  parseRunLeaf,
+  sessionDirectoryOf,
+} from "./role-run-placement.ts";
 import { RUN_HISTORY_FILE, RUN_HISTORY_KINDS, RUN_LOG_FILE, RUN_STATE_FILE, RUN_STATE_KINDS } from "./run-dossier-files.ts";
 import { ticketNumberFromSitianSubject } from "./run-ticket-number.ts";
 
@@ -48,6 +51,14 @@ export function resolveSitianVolumeCategory(kind: string): string {
   return kind;
 }
 
+/** Run directory owning `<run>/session` (leg-local originals; #1199 keeps this landing). */
+function runDirectoryOwningSessionParent(sessionParentDir: string): string | undefined {
+  if (basename(sessionParentDir) !== "session") return undefined;
+  const runDirectory = dirname(sessionParentDir);
+  if (parseRunLeaf(basename(runDirectory)) === undefined) return undefined;
+  return runDirectory;
+}
+
 type SitianRecordPath = {
   readonly sessionDir: string;
   readonly recordFile: string;
@@ -117,8 +128,8 @@ export function resolveSitianRecordPathInLedger(
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
     const sessionParentDir = dirname(input.sessionParent);
-    const runDirectory = dirname(sessionParentDir);
-    if (basename(sessionParentDir) === "session" && parseRunLeaf(basename(runDirectory)) !== undefined) {
+    const runDirectory = runDirectoryOwningSessionParent(sessionParentDir);
+    if (runDirectory !== undefined) {
       // A role run's own session: every record kind shares the run's one log (#1161).
       sessionDir = runDirectory;
       recordFile = join(runDirectory, RUN_HISTORY_KINDS.has(input.kind) ? RUN_HISTORY_FILE : RUN_STATE_KINDS.has(input.kind) ? RUN_STATE_FILE : RUN_LOG_FILE);

package/src/submission-ledger.ts

@@ -22,6 +22,10 @@ import { failOnInfrastructureFailureDeclaration, infrastructureFailureDiagnostic
 import { reportTicketFromHostContext } from "./report-ticket-tool.ts";
 import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.ts";
 import { readDeclaredTicketNumber } from "./run-ticket-number.ts";
+import {
+  captureWorktreeHead,
+  landTicketProgressForSealedSubmission,
+} from "./ticket-progress.ts";
 
 import { isRecord, errorText } from "./unknown-value.ts";
 
@@ -463,6 +467,8 @@ export async function sealAcceptedSubmission(options: {
   const attemptId = attemptIdentity(options.context, runId);
   const sessionParent = sessionParentFromHostContext(options.context);
   const home = homeFromHostContext(options.context, options.home);
+  // #1199: same seal-time HEAD + progress landing as the terminating-tool wrap.
+  const sealHead = captureWorktreeHead(options.context.cwd);
   sitianReport({
     level: "event",
     kind: "sealed",
@@ -479,6 +485,12 @@ export async function sealAcceptedSubmission(options: {
     ...(home !== undefined ? { home } : {}),
     ...(sessionParent === undefined ? {} : { sessionParent }),
   });
+  landTicketProgressForSealedSubmission({
+    context: options.context,
+    role: options.role,
+    accepted: options.accepted,
+    sealHead,
+  });
 }
 
 /**
@@ -636,6 +648,9 @@ export function createSubmissionLedgerHost(
             kind: "accepted",
             accepted: params,
           };
+          // #1199: seal-time HEAD + ticket progress before projectClosure.
+          // One seal → one row; post-turn history guessing is not used.
+          const sealHead = captureWorktreeHead(context.cwd);
           append({
             type: "sealed",
             attemptId,
@@ -643,6 +658,18 @@ export function createSubmissionLedgerHost(
             role,
             accepted: params,
           });
+          const rawLens = typeof host.getFlag === "function"
+            ? host.getFlag("ak-review-lens")
+            : undefined;
+          landTicketProgressForSealedSubmission({
+            context,
+            role,
+            accepted: params,
+            sealHead,
+            ...(rawLens === "completeness" || rawLens === "correctness"
+              ? { lens: rawLens }
+              : {}),
+          });
           await projectClosure(closed, context);
           return result;
         },

package/src/ticket-progress.ts

@@ -0,0 +1,383 @@
+/**
+ * #1199 ticket-level progress: current.jsonl + leg-local receipts/session.
+ * Write at seal (createSubmissionLedgerHost → projectClosure), never by
+ * post-turn history guessing. Per-leg dossiers stay until #1202.
+ *
+ * Originals stay in the leg directory (owner 14b58f6c / a8d2e72d):
+ * `runs/<leg>/receipts/<n>.json`, `runs/<leg>/session/<原件>`.
+ * Unbound legs stage rows in `progress.jsonl` (round empty); bind renames the
+ * whole leg, then this module fills rounds and appends ticket current.jsonl.
+ * Round authority is progress lines only — no receipt-filename counting,
+ * occupancy placeholders, or claim-retry loops. Reviewer dual-lens series
+ * count independently (`<n>.<lens>`).
+ */
+import { spawnSync } from "node:child_process";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join, relative, sep } from "node:path";
+
+import { resolveHostDossierLandingPath } from "./host-session-record.ts";
+import type { HostContext } from "./host-contracts.ts";
+import { runDirectoryFromHostContext } from "./host-contracts.ts";
+import {
+  acceptedFacts,
+  isTerminatingToolName,
+  type AcceptedDetails,
+} from "./package-contracts/terminating-tools.ts";
+import { packagedRoleOutputTool } from "./packaged-role-registry.ts";
+import {
+  isUnboundRunDirectory,
+  sessionDirectoryOf,
+  sessionFileOf,
+  subjectDirectoryOfRun,
+} from "./role-run-placement.ts";
+import { readPageSync } from "./run-dossier.ts";
+import { parseSitianRecordText } from "./sitian-reader.ts";
+import { isRecord } from "./unknown-value.ts";
+
+const CURRENT_FILENAME = "current.jsonl" as const;
+const RECEIPTS_DIRNAME = "receipts" as const;
+const LEG_PROGRESS_FILENAME = "progress.jsonl" as const;
+
+/** One accepted-receipt progress row on the ticket (or unbound leg) subject. */
+export type TicketProgressLine = {
+  readonly at: string;
+  readonly seat: string;
+  /** Seat-local round; reviewer dual-lens uses `<n>.<lens>`. Empty while unbound. */
+  readonly round: string;
+  /** This-round summons instruction bytes; empty string when none. */
+  readonly instruction: string;
+  /** `git rev-parse HEAD` at seal from the seat worktree; empty on failure. */
+  readonly head: string;
+  /** Structured status when present on the receipt — omitted when absent. */
+  readonly status?: string;
+  /** Seat-authored short summary when present on the receipt. */
+  readonly summary?: string;
+  /** Path relative to the subject directory. */
+  readonly receipt: string;
+  /** Path relative to the subject directory. */
+  readonly session: string;
+};
+
+/**
+ * Append-only progress JSONL — same posture as run-dossier row files:
+ * sole Sitian decoder keeps reachable rows; malformed lines leave diagnostics
+ * on stderr and do not abort seal/relocate.
+ */
+function parseProgressText(text: string, pathForDiagnostic: string): TicketProgressLine[] {
+  if (text.trim() === "") return [];
+  const { records, diagnostics } = parseSitianRecordText(text);
+  for (const diagnostic of diagnostics) {
+    process.stderr.write(
+      `[ticket-progress] ${pathForDiagnostic} has malformed row(s); keeps reachable rows and retains the diagnostic: line ${diagnostic.line}: ${diagnostic.error}\n`,
+    );
+  }
+  const lines: TicketProgressLine[] = [];
+  for (const record of records) {
+    const parsed: unknown = record;
+    if (!isRecord(parsed)) continue;
+    if (typeof parsed.seat !== "string" || typeof parsed.round !== "string") continue;
+    lines.push(parsed as unknown as TicketProgressLine);
+  }
+  return lines;
+}
+
+function readProgressFile(path: string): TicketProgressLine[] {
+  if (!existsSync(path)) return [];
+  return parseProgressText(readFileSync(path, "utf8"), path);
+}
+
+/**
+ * Read progress rows under a subject.
+ * Ticket: append-only `current.jsonl`.
+ * Unbound: each leg's `runs/<leaf>/progress.jsonl` (no shared file).
+ */
+export function readTicketProgressLines(subjectDirectory: string): TicketProgressLine[] {
+  if (basename(subjectDirectory) === "unbound") {
+    const runsDir = join(subjectDirectory, "runs");
+    if (!existsSync(runsDir)) return [];
+    const out: TicketProgressLine[] = [];
+    for (const name of readdirSync(runsDir).sort()) {
+      out.push(...readProgressFile(join(runsDir, name, LEG_PROGRESS_FILENAME)));
+    }
+    return out;
+  }
+  return readProgressFile(join(subjectDirectory, CURRENT_FILENAME));
+}
+
+function roundBaseNumber(round: string): number {
+  if (round.trim() === "") return 0;
+  const base = round.includes(".") ? round.slice(0, round.indexOf(".")) : round;
+  const n = Number(base);
+  return Number.isSafeInteger(n) && n > 0 ? n : 0;
+}
+
+function roundLens(round: string): string | undefined {
+  return round.includes(".") ? round.slice(round.indexOf(".") + 1) : undefined;
+}
+
+function nextRoundFromLines(
+  lines: readonly TicketProgressLine[],
+  seat: string,
+  lens?: string,
+): string {
+  const want = lens === undefined || lens.trim() === "" ? undefined : lens;
+  let max = 0;
+  for (const line of lines) {
+    if (line.seat !== seat) continue;
+    if (roundLens(line.round) !== want) continue;
+    max = Math.max(max, roundBaseNumber(line.round));
+  }
+  const base = max + 1;
+  return want === undefined ? String(base) : `${base}.${want}`;
+}
+
+/** Leg-local receipt ordinal: `receipts/<n>.json` (not seat#round). */
+function nextLegReceiptIndex(runDirectory: string): number {
+  const dir = join(runDirectory, RECEIPTS_DIRNAME);
+  if (!existsSync(dir)) return 1;
+  let max = 0;
+  for (const name of readdirSync(dir)) {
+    const match = /^(\d+)\.json$/.exec(name);
+    if (match === null) continue;
+    const n = Number(match[1]);
+    if (Number.isSafeInteger(n) && n > max) max = n;
+  }
+  return max + 1;
+}
+
+/**
+ * Copy structured status/summary from the seat receipt.
+ * Status leaves reuse acceptedFacts (terminating-tools authority) via the seat's
+ * current output tool — legacy judgeStatus/countersignStatus keys are unreachable
+ * at this seal seam (tool is the live registry name, not ak_judge_output).
+ * summary is seat-authored prose on the receipt and is not part of AcceptedFacts.
+ * Missing fields stay absent — never invent "" or "accepted".
+ *
+ * Not receiptStatusFromRegistry: that scans every registry key for navigator
+ * projection when the seat is unknown; here the seal already knows the seat.
+ */
+function statusAndSummaryFromPayload(seat: string, payload: unknown): {
+  readonly status?: string;
+  readonly summary?: string;
+} {
+  if (!isRecord(payload)) return {};
+  const toolName = packagedRoleOutputTool(seat);
+  const status = toolName !== undefined && isTerminatingToolName(toolName)
+    ? acceptedFacts(toolName, payload as AcceptedDetails).status
+    : undefined;
+  const summary = typeof payload.summary === "string" ? payload.summary : undefined;
+  return {
+    ...(status === undefined ? {} : { status }),
+    ...(summary === undefined ? {} : { summary }),
+  };
+}
+
+export type WorktreeHeadCapture = {
+  readonly head: string;
+  readonly fault?: string;
+};
+
+/** Worktree HEAD at seal. On failure head is empty and fault carries the true cause. */
+export function captureWorktreeHead(projectRoot: string): WorktreeHeadCapture {
+  try {
+    const result = spawnSync("git", ["rev-parse", "HEAD"], {
+      cwd: projectRoot,
+      encoding: "utf8",
+      maxBuffer: 1024 * 1024,
+    });
+    if (result.error != null) {
+      const err = result.error;
+      const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
+      return { head: "", fault: `git rev-parse HEAD spawn failed cwd=${projectRoot}: ${detail}` };
+    }
+    if (result.status !== 0) {
+      const detail = [result.stderr, result.stdout]
+        .map((part) => (typeof part === "string" ? part.trim() : ""))
+        .filter((part) => part !== "")
+        .join(" | ");
+      const status = result.status === null ? "null" : String(result.status);
+      const signal = result.signal == null ? "" : ` signal=${result.signal}`;
+      return {
+        head: "",
+        fault: detail === ""
+          ? `git rev-parse HEAD failed (status=${status}${signal}) cwd=${projectRoot}`
+          : `git rev-parse HEAD failed (status=${status}${signal}) cwd=${projectRoot}: ${detail}`,
+      };
+    }
+    return { head: (result.stdout ?? "").trim() };
+  } catch (error) {
+    const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
+    return { head: "", fault: `git rev-parse HEAD threw cwd=${projectRoot}: ${message}` };
+  }
+}
+
+function progressSessionAbsolute(runDirectory: string, context: HostContext): string {
+  const host = typeof context.host === "string" ? context.host.trim() : "";
+  const sessionDirectory = sessionDirectoryOf(runDirectory);
+  // External hosts: ADR 0086 copy landing (codex.jsonl / grok-build / …), not the
+  // principal wire file. Responsibility unchanged (#1199 R3 disposition).
+  if (host !== "" && host !== "pi" && host !== "hermes") {
+    return resolveHostDossierLandingPath({ host, sessionDirectory });
+  }
+  // Pi/hermes: prefer the issued durable coordinate on the live handle.
+  const issued = context.sessionManager.getSessionFile?.();
+  if (typeof issued === "string" && issued.trim() !== "") {
+    return issued;
+  }
+  return sessionFileOf(runDirectory);
+}
+
+function lensFromRunDirectory(runDirectory: string, role: string): string | undefined {
+  if (role !== "reviewer") return undefined;
+  const lens = readPageSync(runDirectory, "admitted")?.lens;
+  return lens === "completeness" || lens === "correctness" ? lens : undefined;
+}
+
+/**
+ * Seal-time landing from createSubmissionLedgerHost (before projectClosure).
+ * Missing run directory → no-op (ledger still sealed).
+ */
+export function landTicketProgressForSealedSubmission(input: {
+  readonly context: HostContext;
+  readonly role: string;
+  readonly accepted: unknown;
+  readonly sealHead: WorktreeHeadCapture;
+  readonly lens?: string;
+}): TicketProgressLine | undefined {
+  const runDirectory = runDirectoryFromHostContext(input.context);
+  if (runDirectory === undefined) return undefined;
+
+  const subjectDirectory = subjectDirectoryOfRun(runDirectory);
+  if (subjectDirectory === undefined) return undefined;
+
+  const lens = (
+    input.lens === "completeness" || input.lens === "correctness"
+      ? input.lens
+      : lensFromRunDirectory(runDirectory, input.role)
+  );
+
+  const leaf = basename(runDirectory);
+  const unbound = basename(subjectDirectory) === "unbound";
+  const progressPath = unbound
+    ? join(runDirectory, LEG_PROGRESS_FILENAME)
+    : join(subjectDirectory, CURRENT_FILENAME);
+  // Original receipt first — independent of derived progress read/append.
+  // Progress I/O failure must not erase an already-accepted payload (#1199 F1).
+  const receiptIndex = nextLegReceiptIndex(runDirectory);
+  const relativePath = `runs/${leaf}/${RECEIPTS_DIRNAME}/${receiptIndex}.json`;
+  const absolutePath = join(subjectDirectory, relativePath);
+  mkdirSync(dirname(absolutePath), { recursive: true });
+  writeFileSync(absolutePath, `${JSON.stringify(input.accepted, null, 2)}\n`, "utf8");
+
+  // #1199 R1: bound leg with leftover progress.jsonl must publish before this
+  // seal takes the next ticket round — optional ticketNumber must not be required.
+  if (!unbound) {
+    relocateTicketProgressForLeg({ runDirectory });
+  }
+
+  const existing = unbound
+    ? readProgressFile(progressPath)
+    : readTicketProgressLines(subjectDirectory);
+  // Unbound: round stays empty until whole-leg bind publishes into ticket current.
+  const round = unbound ? "" : nextRoundFromLines(existing, input.role, lens);
+
+  const sessionFile = progressSessionAbsolute(runDirectory, input.context);
+  const sessionRelative = relative(subjectDirectory, sessionFile).split(sep).join("/");
+  const { status, summary } = statusAndSummaryFromPayload(input.role, input.accepted);
+  const instruction = typeof input.context.summonsInstruction === "string"
+    ? input.context.summonsInstruction
+    : "";
+  const line: TicketProgressLine = {
+    at: new Date().toISOString(),
+    seat: input.role,
+    round,
+    instruction,
+    head: input.sealHead.head,
+    ...(status === undefined ? {} : { status }),
+    ...(summary === undefined ? {} : { summary }),
+    receipt: relativePath,
+    session: sessionRelative,
+  };
+
+  mkdirSync(dirname(progressPath), { recursive: true });
+  appendFileSync(progressPath, `${JSON.stringify(line)}\n`, "utf8");
+  // HEAD capture fault: keep the raw cause on stderr. Do not invent a second
+  // dossier custom-frame channel beside post-admission's existing retain path.
+  if (input.sealHead.fault !== undefined) {
+    process.stderr.write(`${input.sealHead.fault}\n`);
+  }
+  return line;
+}
+
+/**
+ * After whole-leg rename (or retry when already under the ticket): fill rounds
+ * on staged `progress.jsonl`, append ticket `current.jsonl`, then drop staging.
+ * Receipt / session / head / instruction keep seal-time values and relative
+ * paths — no copy, delete-source, or rewrite of relative pointers.
+ *
+ * Unbound staging leaves `round` empty; publish takes the leg's sealed lens from
+ * the admitted page (`lensFromRunDirectory`), never from receipt prose.
+ */
+export function relocateTicketProgressForLeg(input: {
+  readonly runDirectory: string;
+}): void {
+  if (isUnboundRunDirectory(input.runDirectory)) return;
+
+  const subjectDirectory = subjectDirectoryOfRun(input.runDirectory);
+  if (subjectDirectory === undefined) return;
+
+  const stagedPath = join(input.runDirectory, LEG_PROGRESS_FILENAME);
+  const mine = readProgressFile(stagedPath);
+  if (mine.length === 0) {
+    if (existsSync(stagedPath)) {
+      rmSync(stagedPath, { force: true });
+    }
+    return;
+  }
+
+  const ticketLines = [...readTicketProgressLines(subjectDirectory)];
+  // Receipt path is the seal identity. Append-then-unlink partial success must
+  // not reassign rounds or re-append the same originals on re-entry (#1199 F2).
+  const publishedReceipts = new Set(
+    ticketLines
+      .map((line) => line.receipt)
+      .filter((receipt) => typeof receipt === "string" && receipt !== ""),
+  );
+  const pending = mine.filter((line) => !publishedReceipts.has(line.receipt));
+  if (pending.length === 0) {
+    rmSync(stagedPath, { force: true });
+    return;
+  }
+
+  const movedLines: TicketProgressLine[] = [];
+  for (const line of pending) {
+    // Current unbound staging publishes empty rounds; lens comes only from this
+    // leg's admitted page. No legacy staged-round mirror-suffix branch.
+    const lens = lensFromRunDirectory(input.runDirectory, line.seat);
+    const round = nextRoundFromLines(ticketLines, line.seat, lens);
+    const moved: TicketProgressLine = {
+      ...line,
+      round,
+    };
+    movedLines.push(moved);
+    ticketLines.push(moved);
+  }
+
+  const newCurrent = join(subjectDirectory, CURRENT_FILENAME);
+  mkdirSync(dirname(newCurrent), { recursive: true });
+  appendFileSync(
+    newCurrent,
+    `${movedLines.map((line) => JSON.stringify(line)).join("\n")}\n`,
+    "utf8",
+  );
+  // Append succeeded — drop staging. Failure above leaves progress.jsonl in place.
+  rmSync(stagedPath, { force: true });
+}

package/src/user-dialogue-stdin.ts

@@ -2,6 +2,9 @@
  * Typed user-dialogue stdin transport (#879 / #471).
  * Pi's piped-stdin reader trims the wrapper; the body field keeps original bytes.
  * No size cap and no path/pointer substitute — the whole dialogue rides the envelope.
+ *
+ * #1199: progress-line instruction is these same body bytes (what the seat
+ * actually receives). No parallel 传召词 field on the envelope.
  */
 import { isRecord } from "./unknown-value.ts";
 
@@ -13,13 +16,25 @@ export type UserDialogueStdinEnvelope = {
 };
 
 export function encodeUserDialogueStdin(body: string): string {
-  return JSON.stringify({ kind: USER_DIALOGUE_STDIN_KIND, body } satisfies UserDialogueStdinEnvelope);
+  const envelope: UserDialogueStdinEnvelope = { kind: USER_DIALOGUE_STDIN_KIND, body };
+  return JSON.stringify(envelope);
 }
 
-function isUserDialogueEnvelope(value: unknown): value is UserDialogueStdinEnvelope {
-  if (!isRecord(value)) return false;
-  const record = value as { kind?: unknown; body?: unknown };
-  return record.kind === USER_DIALOGUE_STDIN_KIND && typeof record.body === "string";
+/** One parse for the model-facing body — callers must not re-implement. */
+export function tryParseUserDialogueStdin(raw: string): UserDialogueStdinEnvelope | undefined {
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith("{")) return undefined;
+  try {
+    const parsed: unknown = JSON.parse(trimmed);
+    if (!isRecord(parsed)) return undefined;
+    const record = parsed as { kind?: unknown; body?: unknown };
+    if (record.kind !== USER_DIALOGUE_STDIN_KIND || typeof record.body !== "string") {
+      return undefined;
+    }
+    return { kind: USER_DIALOGUE_STDIN_KIND, body: record.body };
+  } catch {
+    return undefined;
+  }
 }
 
 /**
@@ -27,13 +42,5 @@ function isUserDialogueEnvelope(value: unknown): value is UserDialogueStdinEnvel
  * Non-envelope text (interactive Pi, officer JSON, headless raw body) is unchanged.
  */
 export function readUserDialogueStdin(raw: string): string {
-  const trimmed = raw.trim();
-  if (!trimmed.startsWith("{")) return raw;
-  try {
-    const parsed: unknown = JSON.parse(trimmed);
-    if (isUserDialogueEnvelope(parsed)) return parsed.body;
-  } catch {
-    // Not our envelope — leave caller bytes intact.
-  }
-  return raw;
+  return tryParseUserDialogueStdin(raw)?.body ?? raw;
 }