@akagilnc/pi-workflow-roles 0.1.4035 → 0.1.4193

package/src/pi/durable-principal.ts

@@ -8,10 +8,8 @@ import type {
   NewDurablePrincipalRequest,
 } from "../host-contracts.ts";
 import { resolveBookKeyFromGit } from "../activation-ledger-git.ts";
-import {
-  activationBookDirectory,
-  resolveActivationLedgerHome,
-} from "../activation-ledger-topology.ts";
+import { resolveActivationLedgerHome } from "../activation-ledger-topology.ts";
+import { roleRunPlacement } from "../role-run-placement.ts";
 
 type PiDurablePrincipal = DurablePrincipal & {
   readonly sessionDirectory: string;
@@ -31,18 +29,16 @@ export function issuePiDurablePrincipalCoordinates(
 } {
   const ledgerHome = resolveActivationLedgerHome(request.home);
   const bookKey = resolveBookKeyFromGit(request.cwd);
-  const runDirectory = join(
-    activationBookDirectory(ledgerHome, bookKey),
-    "runs",
-    `${request.runId}@${request.role}`,
-  );
-  const sessionDirectory = join(runDirectory, "session");
+  const placement = roleRunPlacement(ledgerHome, {
+    bookKey,
+    subject: { unbound: true },
+    runId: request.runId,
+    role: request.role,
+  });
   return {
     ledgerHome,
     bookKey,
-    runDirectory,
-    sessionDirectory,
-    sessionFile: join(sessionDirectory, "session.jsonl"),
+    ...placement,
   };
 }
 

package/src/pi/role-turn-host.ts

@@ -21,9 +21,10 @@ import type {
   RoleTurnRequest,
   RoleTurnResult,
 } from "../host-contracts.ts";
-import { ExplicitInternalActivationError } from "../host-contracts.ts";
-import { applyEngineChildEnv } from "../engine-detour.ts";
+import { ExplicitInternalActivationError, isOfficerReviewSeat } from "../host-contracts.ts";
+import { applyEngineChildEnv, ENGINE_MODEL_FLAG_NAME, normalizeEngineName } from "../engine-detour.ts";
 import { projectActivationFlags } from "../role-activation-flags.ts";
+import { encodeUserDialogueStdin } from "../user-dialogue-stdin.ts";
 
 
 /** Package-relative Internal role entrypoint (ADR 0052; same path as public-cli registry). */
@@ -119,7 +120,7 @@ export function applyPiNativeSkillInvocation(
  * Pi last-hop argv after `--no-extensions -e entry` (#819).
  * Activation flag membership comes from middle-layer projectActivationFlags;
  * this function only renders session coords, controlled constants, and pairs.
- * Single forced method → Pi-native `/skill:` on the argv prompt (#822).
+ * User dialogue is not an argv element (#879): it rides spawn stdin.
  */
 export function buildPiTurnExtraArgs(
   request: RoleTurnRequest,
@@ -127,14 +128,6 @@ export function buildPiTurnExtraArgs(
   extraPiArgs: readonly string[] = [],
 ): string[] {
   const { sessionFile, sessionDirectory } = authority.decode(request.principal);
-  const rawPrompt =
-    request.continuation.kind === "initial" || request.continuation.kind === "resume"
-      ? request.continuation.prompt
-      : (() => {
-          const _exhaustive: never = request.continuation;
-          return _exhaustive;
-        })();
-  const prompt = applyPiNativeSkillInvocation(request.methods, rawPrompt);
   return [
     "--no-skills",
     ...buildMethodArgs(request.methods),
@@ -148,13 +141,31 @@ export function buildPiTurnExtraArgs(
     ...extraPiArgs,
     // Envelope assembly = projectActivationFlags; pi only renders argv pairs.
     ...activationFlagsToPiArgv(projectActivationFlags(request)),
+    ...piEngineModelArgs(request),
     "--mode",
     "json",
     ...buildSeatModelCliArgs(request.model),
-    prompt,
   ];
 }
 
+/** Engine name stays on child env; model has no env fallback (#883 / #879). */
+function piEngineModelArgs(request: RoleTurnRequest): string[] {
+  const model = normalizeEngineName(request.engineModel);
+  if (model === undefined) return [];
+  return [`--${ENGINE_MODEL_FLAG_NAME}`, model];
+}
+
+function piUserDialogueBody(request: RoleTurnRequest): string {
+  const rawPrompt =
+    request.continuation.kind === "initial" || request.continuation.kind === "resume"
+      ? request.continuation.prompt
+      : (() => {
+          const _exhaustive: never = request.continuation;
+          return _exhaustive;
+        })();
+  return applyPiNativeSkillInvocation(request.methods, rawPrompt);
+}
+
 export type PiSpawnRunner = (
   args: readonly string[],
   options: {
@@ -163,6 +174,8 @@ export type PiSpawnRunner = (
     timeoutMs?: number;
     /** Parent cancellation; the child gets the same graceful SIGTERM as a budget. */
     signal?: AbortSignal;
+    /** User dialogue body; omitted from argv so execve cannot E2BIG (#879). */
+    stdin?: string;
   },
 ) => Promise<{
   code: number | null;
@@ -271,11 +284,22 @@ export function createDefaultPiSpawnRunner(options: {
       const child = spawn(piIdentity.executable, [...args], {
         cwd: spawnOptions.cwd,
         env: spawnOptions.env,
-        stdio: ["ignore", "ignore", "pipe"],
+        stdio: ["pipe", "ignore", "pipe"],
       });
+      if (child.stdin === null) {
+        throw new Error("Pi child stdin pipe was not created");
+      }
       if (child.stderr === null) {
         throw new Error("Pi child stderr pipe was not created");
       }
+      let stdinDeliveryError: Error | undefined;
+      child.stdin.on("error", (error) => {
+        stdinDeliveryError ??= error;
+      });
+      if (spawnOptions.stdin !== undefined) {
+        child.stdin.write(spawnOptions.stdin);
+      }
+      child.stdin.end();
       let stderr = "";
       let timedOut = false;
       // No default wall clock. Only an explicit caller budget arms a timer (ADR 0010).
@@ -344,6 +368,10 @@ export function createDefaultPiSpawnRunner(options: {
               reject(executionError);
               return;
             }
+            if (stdinDeliveryError !== undefined) {
+              reject(stdinDeliveryError);
+              return;
+            }
             resolveResult({
               code,
               stderr,
@@ -375,9 +403,13 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
     async executeTurn(request: RoleTurnRequest): Promise<RoleTurnResult> {
       // #617 DK-7: Pi argv gets projected native paths once; never record bytes.
       // Pi already owns its own session file, so only sitian prior volume rides in.
+      // #879: station-child officer dialogue keeps peer words — do not splice
+      // host-transition priorNativePaths into the review prompt body.
       let turnRequest = request;
+      const officerStationChild =
+        request.stationChild === true && isOfficerReviewSeat(request.activation.role);
       const paths =
-        request.hostTransition?.priorNativeKind === "sitian"
+        !officerStationChild && request.hostTransition?.priorNativeKind === "sitian"
           ? request.hostTransition.priorNativePaths
           : undefined;
       if (
@@ -400,6 +432,7 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
         config.extraPiArgs ?? [],
       );
       const args = buildExplicitInternalActivationArgs(roleEntry, extraArgs);
+      const stdin = encodeUserDialogueStdin(piUserDialogueBody(turnRequest));
       // Shared envelope isolates this call's court identity: omitting courtAttemptId
       // must not inherit a parent process.env.AK_ROLE_COURT_ATTEMPT (#637).
       const env: NodeJS.ProcessEnv = {
@@ -444,6 +477,7 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
       return await spawnRunner(args, {
         cwd: request.cwd,
         env,
+        stdin,
         ...(timeoutMs === undefined ? {} : { timeoutMs }),
         ...(request.signal === undefined ? {} : { signal: request.signal }),
       });

package/src/public-cli/auto-resume.ts

@@ -16,6 +16,7 @@ import { randomUUID } from "node:crypto";
 import { lstat, mkdir, open } from "node:fs/promises";
 import { join } from "node:path";
 
+import { roleRunArtifactsDirectory } from "../role-run-placement.ts";
 import type {
   DurablePrincipal,
   DurablePrincipalAuthority,
@@ -143,11 +144,6 @@ export class TurnDispatchedFailure extends Error {
 /** Session custom-entry type carrying the pointer to one dispatch error file. */
 export const DISPATCH_ERROR_RETENTION_ENTRY_TYPE = "ak_run_dispatch_error_retention" as const;
 
-/** Artifacts subdirectory of a run directory (established run-artifacts location). */
-function runArtifactsDirectory(runDirectory: string): string {
-  return join(runDirectory, "artifacts");
-}
-
 /**
  * #182-A hardened path identity, mirrored from settlement.ts's
  * ensureAuditEvidenceDirectory: a planted symlink at the run directory or the
@@ -163,7 +159,7 @@ export async function ensureRealArtifactsDirectory(runDirectory: string): Promis
   if (runStat.isSymbolicLink() || !runStat.isDirectory()) {
     throw new Error("run artifact retention: run directory is not a real directory");
   }
-  const artifactsDir = runArtifactsDirectory(runDirectory);
+  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
   try {
     const existing = await lstat(artifactsDir);
     if (existing.isSymbolicLink() || !existing.isDirectory()) {

package/src/public-cli/case-dossier-delivery.ts

@@ -5,13 +5,31 @@
  * 只读已有案卷：不刷新、不生成、不校验内容、不新增拒收或停工条件。
  * 机器文本仅中立标识材料（ADR 0073），用途说明归角色材料所有。
  *
- * 递送挂载点唯一：`post-admission` 在 beforeDispatch 之后为每个公共入口追加本段。
+ * 递送挂载点唯一：`post-admission` 在 beforeDispatch 之后为每个公共入口挂载。
+ * 普通入口把本段追加进 continuation；station-child 审核轮次走 attachments
+ * 冻结 + role-runtime `loadCaseDossierReadingMaterial` → readingMaterial →
+ * systemPrompt.materials fold（#879：对话 instruction 保持父腿 payload 原文；
+ * 起居录作独立附件面，不新造 RoleTurnRequest.materials）。
  */
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
 import { resolveTicketProvenanceVolume } from "../ticket-provenance.ts";
+import {
+  freezeAttachmentsIntoRun,
+  type FrozenAttachment,
+} from "./invocation.ts";
 
 /** Section heading of the system-delivered dossier pointer (presentation only). */
 const CASE_DOSSIER_SECTION_HEADING = "## 本票起居录（系统随案提供）" as const;
 
+/** Stable freeze key under run/attachments/ for station-child 0081 delivery. */
+const CASE_DOSSIER_ATTACH_KEY = "case-dossier" as const;
+
+/** Leaf name of the frozen pointer section (content = purpose + paths). */
+const CASE_DOSSIER_ATTACH_FILE = "case-dossier-pointer.md" as const;
+
 /** Pointer only — presence/absence is for the role to observe at the path. */
 function describeDossierFile(path: string): string {
   return path;
@@ -42,3 +60,70 @@ export async function projectCaseDossierPointerSection(input: {
     `记录卷宗：${describeDossierFile(volume.recordFile)}`,
   ].join("\n");
 }
+
+/**
+ * ADR 0081 delivery for station-child officer turns (#879): freeze the same
+ * pointer section through the existing attachments seam. Role-runtime loads
+ * that freeze via loadCaseDossierReadingMaterial onto readingMaterial; the
+ * envelope then folds it into systemPrompt.materials. Peer dialogue instruction
+ * stays the parent payload; never RoleTurnRequest.materials.
+ * Returns frozen attachments, or undefined when unbound (no dossier).
+ */
+export async function deliverCaseDossierAsAttachment(input: {
+  readonly ticketNumber: number | undefined;
+  readonly projectRoot: string;
+  readonly home: string;
+  readonly runDirectory: string;
+}): Promise<readonly FrozenAttachment[] | undefined> {
+  const section = await projectCaseDossierPointerSection({
+    ticketNumber: input.ticketNumber,
+    projectRoot: input.projectRoot,
+    home: input.home,
+  });
+  if (section === undefined) return undefined;
+  // Stage in OS temp only — never leave a run-local .case-dossier-stage copy.
+  const stagingDir = await mkdtemp(join(tmpdir(), "ak-case-dossier-"));
+  try {
+    const stagingPath = join(stagingDir, CASE_DOSSIER_ATTACH_FILE);
+    await writeFile(stagingPath, `${section}\n`, "utf8");
+    return await freezeAttachmentsIntoRun(
+      [stagingPath],
+      input.runDirectory,
+      CASE_DOSSIER_ATTACH_KEY,
+    );
+  } finally {
+    await rm(stagingDir, { recursive: true, force: true });
+  }
+}
+
+/** Typed reading-material face for a frozen station-child 0081 attachment. */
+export type CaseDossierReadingMaterial = {
+  readonly kind: "case-dossier-pointer";
+  readonly frozenPath: string;
+  readonly section: string;
+};
+
+/**
+ * Load a previously frozen case-dossier attachment as reading material
+ * (existing agent-start / systemPrompt.materials fold — not dialogue prompt,
+ * not RoleTurnRequest.materials). Undefined when the run has no such freeze.
+ */
+export async function loadCaseDossierReadingMaterial(
+  runDirectory: string,
+): Promise<CaseDossierReadingMaterial | undefined> {
+  const frozenPath = join(
+    runDirectory,
+    "attachments",
+    CASE_DOSSIER_ATTACH_KEY,
+    `00-${CASE_DOSSIER_ATTACH_FILE}`,
+  );
+  let section: string;
+  try {
+    section = await readFile(frozenPath, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+  if (section.trim() === "") return undefined;
+  return { kind: "case-dossier-pointer", frozenPath, section };
+}

package/src/public-cli/countersign-run.ts

@@ -25,10 +25,16 @@
 import type { DurablePrincipalAuthority, RoleTurnRequest } from "../host-contracts.ts";
 import { engineSessionMaterialFromOptions, pickEngineAxis } from "../package-resources/engine-material.ts";
 import { CliUsageError } from "./cli-errors.ts";
+import {
+  projectCourtTicketNumbers,
+} from "../diarist-contracts.ts";
+import { isSafePositiveTicketNumber } from "../run-ticket-number.ts";
 import {
   admitCountersignInvocation,
   bindAdmittedTicketNumber,
+  bindCourtTicketNumbersOnAdmitted,
   buildCountersignTransportPrompt,
+  relocateAdmittedRunToTicket,
   type AdmittedCountersignInvocation,
   type ParseCountersignArgvResult,
 } from "./invocation.ts";
@@ -46,6 +52,7 @@ import {
   markRunAdmitted,
   markRunTerminal,
   type PublicResumeRequest,
+  type RunWriterLease,
   type SameTicketSummonsMaterials,
 } from "./run-lifecycle.ts";
 import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.ts";
@@ -70,6 +77,12 @@ export type CountersignRunEnv = PostAdmissionEnv & {
   runCourtDiaristStation?: (
     admitted: AdmittedCountersignInvocation,
   ) => Promise<void>;
+  /**
+   * #871: typed co-review set from the identity 起居郎 turn, applied onto the
+   * resumed run before bound refresh (same-ticket re-summons path). Whole-set
+   * replace — never union. Production leaves unset outside that handoff.
+   */
+  pendingCourtTicketNumbers?: readonly number[];
 };
 
 /** Project admitted invocation onto the host-neutral turn request. */
@@ -94,7 +107,16 @@ export function buildCountersignTurnRequest(
 
 /** 起居郎 identity outcome — escalate stays distinct from missing terminal. */
 type CourtDiaristIdentity =
-  | { readonly kind: "ticket"; readonly ticketNumber: number }
+  | {
+      readonly kind: "ticket";
+      readonly ticketNumber: number;
+      /**
+       * #871 typed co-review set when the LLM explicitly submitted one.
+       * Absent means "no new set this turn" — resume must keep the stored run fact
+       * (never silently degrade a multi-ticket set to [main]).
+       */
+      readonly courtTicketNumbers?: readonly number[];
+    }
   | { readonly kind: "unbound" }
   | { readonly kind: "escalate" };
 
@@ -103,6 +125,53 @@ type CourtDiaristInvocationResult = {
   readonly failedWithoutEscalate?: { readonly diagnostic: string };
 };
 
+/**
+ * Read #871 set from preserved diarist payloads.
+ * - Field absent / null / non-array → undefined (no new set; resume keeps store).
+ * - Explicit [] → single-ticket [main] whole-set replace (signed empty-set contract).
+ * - Non-empty array with zero lawful typed members after projection → not a new set
+ *   (do not impersonate explicit empty and wipe a stored multi-ticket fact).
+ * - Non-empty array with ≥1 lawful member → sole type/dedupe projection + principal guarantee.
+ * - Multiple submissions: last qualifying set wins.
+ * Live path never shape-rejects the role turn; durable damage is a separate seam.
+ */
+function courtTicketNumbersFromOutcome(
+  roleOutcome: TerminalRoleOutcome | undefined,
+  principalTicket: number,
+): readonly number[] | undefined {
+  if (roleOutcome === undefined) return undefined;
+  const payloads =
+    roleOutcome.kind === "accepted" ||
+    roleOutcome.kind === "audit_escalation" ||
+    roleOutcome.kind === "failure"
+      ? roleOutcome.payloads ?? []
+      : [];
+  let latest: readonly number[] | undefined;
+  for (const payload of payloads) {
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+      continue;
+    }
+    const record = payload as Record<string, unknown>;
+    if (!Object.hasOwn(record, "courtTicketNumbers")) continue;
+    const raw = record.courtTicketNumbers;
+    // Only a real array is a candidate set. Non-array is not explicit empty.
+    if (!Array.isArray(raw)) continue;
+    // Members only — do not inject principal yet, or all-invalid non-empty becomes [main].
+    const members = projectCourtTicketNumbers(raw);
+    if (members === null) continue;
+    if (members.length === 0) {
+      // Literal [] is the intentional principal-only replace; non-empty garbage is not.
+      if (raw.length === 0) {
+        latest = projectCourtTicketNumbers([], { principalTicket }) ?? undefined;
+      }
+      continue;
+    }
+    latest =
+      projectCourtTicketNumbers(raw, { principalTicket }) ?? undefined;
+  }
+  return latest;
+}
+
 /** Routing boolean over the child's own typed sequence — does not pick or rewrite a sole row. */
 function courtDiaristEscalated(roleOutcome: TerminalRoleOutcome | undefined): boolean {
   if (roleOutcome === undefined) return false;
@@ -181,13 +250,14 @@ async function invokeCourtDiarist(input: {
   }
 
   const asserted = (result.admitted as { ticketNumber?: number } | undefined)?.ticketNumber;
-  if (
-    typeof asserted === "number" &&
-    Number.isSafeInteger(asserted) &&
-    asserted >= 1
-  ) {
+  if (isSafePositiveTicketNumber(asserted)) {
+    const courtTicketNumbers = courtTicketNumbersFromOutcome(roleOutcome, asserted);
     return {
-      identity: { kind: "ticket", ticketNumber: asserted },
+      identity: {
+        kind: "ticket",
+        ticketNumber: asserted,
+        ...(courtTicketNumbers === undefined ? {} : { courtTicketNumbers }),
+      },
     };
   }
   return {
@@ -219,25 +289,45 @@ export async function runCountersignCourtDiaristStation(
   // First-entry unbound identity is owned by runPublicCountersign.
   if (admitted.ticketNumber === undefined) return;
 
-  const outcome = await invokeCourtDiarist(
-    {
-      instruction: `整理 #${admitted.ticketNumber} 的本案依据。`,
-      projectRoot: admitted.projectRoot,
-      failureLabel: `ticket #${admitted.ticketNumber}`,
-      // Refresh holds a typed key — hand it off so identity is bound before turn.
-      boundTicketNumber: admitted.ticketNumber,
-    },
-    env,
-    io,
-  );
+  // #871: refresh every member of the typed co-review set; single-ticket face
+  // is just the set [main]. Present-but-empty / missing-principal is damage —
+  // never silently fall back to main-only (legacy absent field still may).
+  let refreshTickets: readonly number[];
+  if (admitted.courtTicketNumbers !== undefined) {
+    if (
+      admitted.courtTicketNumbers.length === 0 ||
+      !admitted.courtTicketNumbers.includes(admitted.ticketNumber)
+    ) {
+      throw new StationChildExhaustedError(
+        `court diarist station: courtTicketNumbers is damaged (empty or missing principal #${admitted.ticketNumber})`,
+      );
+    }
+    refreshTickets = admitted.courtTicketNumbers;
+  } else {
+    refreshTickets = [admitted.ticketNumber];
+  }
 
-  if (outcome.identity.kind === "escalate") {
-    throw new StationChildExhaustedError(
-      "court diarist station escalated (cannot identify court target)",
+  for (const ticketNumber of refreshTickets) {
+    const outcome = await invokeCourtDiarist(
+      {
+        instruction: `整理 #${ticketNumber} 的本案依据。`,
+        projectRoot: admitted.projectRoot,
+        failureLabel: `ticket #${ticketNumber}`,
+        // Refresh holds a typed key — hand it off so identity is bound before turn.
+        boundTicketNumber: ticketNumber,
+      },
+      env,
+      io,
     );
-  }
-  if (outcome.failedWithoutEscalate !== undefined) {
-    throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+
+    if (outcome.identity.kind === "escalate") {
+      throw new StationChildExhaustedError(
+        "court diarist station escalated (cannot identify court target)",
+      );
+    }
+    if (outcome.failedWithoutEscalate !== undefined) {
+      throw new StationChildExhaustedError(outcome.failedWithoutEscalate.diagnostic);
+    }
   }
 }
 
@@ -293,6 +383,7 @@ export async function runPublicCountersign(
   // hook failures stay on the parent call-local budget, exhausted nested
   // station children still skip parent auto-resume (#840 父子不层叠).
   let typedTicket: number | undefined;
+  let typedCourtTicketNumbers: readonly number[] | undefined;
   let identityDiaristRan = false;
 
   if (env.runCourtDiaristStation === undefined) {
@@ -347,7 +438,10 @@ export async function runPublicCountersign(
     // unbound and continue (true-unbound face). Escalate / typed failure above;
     // bound refresh still fails honest via runCountersignCourtDiaristStation.
     if (outcome.identity.kind === "ticket") {
-      typedTicket = outcome.identity.ticketNumber;
+      const assertedTicket = outcome.identity.ticketNumber;
+      typedTicket = assertedTicket;
+      // #871: identity may hand a co-review set; absent field defaults to [main].
+      typedCourtTicketNumbers = outcome.identity.courtTicketNumbers;
       const summons: SameTicketSummonsMaterials = {
         instruction: parsed.instruction,
         instructionEmpty: parsed.instruction.trim() === "",
@@ -361,16 +455,26 @@ export async function runPublicCountersign(
         freshSummons: env.freshSummons,
         summons,
         resume: async (runId, materials) => {
-          // Resume selected: abandon mint first so a throw cannot leave it admitted.
+          // Resume selected: file the provisional run under the asserted ticket
+          // before abandoning it, so typed identity never leaves an unbound row.
+          await bindAdmittedTicketNumber(admitted, assertedTicket);
+          await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
           await markRunTerminal(admitted.runDirectory);
           // Identity 起居郎 asserted unbound (no issue face). Resume still runs
           // the bound refresh station under the typed key (refresh-every-court).
+          // #871: hand the identity set so resume can whole-replace the run fact
+          // when this summons produced a new typed set (never union).
           return await runPublicCountersignResume(
             {
               runId,
               ...(materials === undefined ? {} : { summons: materials }),
             },
-            env,
+            {
+              ...env,
+              ...(typedCourtTicketNumbers === undefined
+                ? {}
+                : { pendingCourtTicketNumbers: typedCourtTicketNumbers }),
+            },
             io,
           );
         },
@@ -381,6 +485,33 @@ export async function runPublicCountersign(
     }
   }
 
+  if (identityDiaristRan && typedTicket !== undefined) {
+    try {
+      await bindAdmittedTicketNumber(admitted, typedTicket);
+      await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+      // First court: explicit set wins; omitted field → single-ticket face [main].
+      // Set persistence is outside beforeDispatch — route write failures into the
+      // same controlled-failure settlement as station children (#871 B7).
+      await bindCourtTicketNumbersOnAdmitted(
+        admitted,
+        typedCourtTicketNumbers ?? [typedTicket],
+      );
+    } catch (error) {
+      return await presentControlledFailure(
+        admitted,
+        {
+          timedOut: false,
+          code: null,
+          stderr: "",
+          thrown: error,
+        },
+        countersignAdapters(),
+        env.principalAuthority,
+        io,
+      );
+    }
+  }
+
   const turnProjection: RoleTurnRequestProjectionOptions = {
     packageRoot: env.packageRoot,
     home: env.home,
@@ -405,23 +536,25 @@ export async function runPublicCountersign(
   // Mutable shell: ticket bind re-projects activation before executeTurn.
   const turnRequest = buildCountersignTurnRequest(admitted, turnProjection);
 
-  return await runPostAdmissionOneShot({
+  const result = await runPostAdmissionOneShot({
     admitted,
     env,
     io,
     request: turnRequest,
     adapters: countersignAdapters({
-      beforeDispatch: async (admittedSeat) => {
+      beforeDispatch: async (admittedSeat, lease) => {
         // Dossier pointer delivery rides post-admission after this hook (#709).
         if (!identityDiaristRan) {
           // Test seam (or any deferred identity): station owns assert + bind.
           await runCountersignCourtDiaristStation(admittedSeat, env, io);
         } else if (typedTicket !== undefined) {
-          // Production identity asserted unbound; bind typed key, then bound
-          // refresh so freeze loads issue face (typed handoff, not prose match).
-          await bindAdmittedTicketNumber(admittedSeat, typedTicket);
           await runCountersignCourtDiaristStation(admittedSeat, env, io);
         }
+        await relocateAdmittedRunToTicket(
+          admittedSeat,
+          env.principalAuthority,
+          lease,
+        );
         Object.assign(
           turnRequest,
           buildCountersignTurnRequest(admittedSeat, turnProjection),
@@ -430,11 +563,14 @@ export async function runPublicCountersign(
     }),
     ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
   });
+  await relocateAdmittedRunToTicket(admitted, env.principalAuthority);
+  return result;
 }
 
 function countersignAdapters(options?: {
   beforeDispatch?: (
     admitted: AdmittedCountersignInvocation,
+    lease: RunWriterLease,
   ) => void | Promise<void>;
 }) {
   return {
@@ -496,6 +632,20 @@ export async function runPublicCountersignResume(
     },
     adapters: countersignAdapters({
       beforeDispatch: async (admitted) => {
+        // #871 B7: durable set damage already identified at load — settle as
+        // station-child exhausted → presentControlledFailure (not structural exit 2).
+        if (admitted.courtTicketNumbersDamage !== undefined) {
+          throw new StationChildExhaustedError(admitted.courtTicketNumbersDamage);
+        }
+        // #871: same-ticket re-summons may hand a fresh typed set from identity.
+        // Whole-set replace onto this run fact; no new set → keep stored set.
+        // Manual resume (no pending) keeps the durable set and never invents one.
+        if (env.pendingCourtTicketNumbers !== undefined) {
+          await bindCourtTicketNumbersOnAdmitted(
+            admitted,
+            env.pendingCourtTicketNumbers,
+          );
+        }
         await runCountersignCourtDiaristStation(admitted, env, io);
       },
     }),