@akagilnc/pi-workflow-roles 0.1.4062 → 0.1.4196

package/src/run-ticket-number.ts

@@ -1,11 +1,17 @@
 /**
  * Typed ticketNumber reader for a retained run's durable pages.
- * admitted-request.json first, invocation.json fallback. Missing page (ENOENT)
- * → try next / undefined; damage and non-ENOENT IO failures propagate.
+ * Board pages first (admitted-request, then invocation); migration derivation
+ * page last so worktree-derived placement stays readable without forging a
+ * board assertion. Missing page (ENOENT) → try next / undefined; damage and
+ * non-ENOENT IO failures propagate.
  */
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 
+/** Sole on-disk page for worktree-basename ticket derivation (#865). */
+export const MIGRATION_TICKET_DERIVATION_PAGE =
+  "migration-ticket-derivation.json" as const;
+
 function isEnoent(error: unknown): boolean {
   return (
     error instanceof Error &&
@@ -14,40 +20,94 @@ function isEnoent(error: unknown): boolean {
   );
 }
 
-function ticketFromRecord(record: Record<string, unknown>): number | undefined {
-  const ticketNumber = record.ticketNumber;
-  if (
-    typeof ticketNumber === "number" &&
-    Number.isSafeInteger(ticketNumber) &&
-    ticketNumber >= 1
-  ) {
-    return ticketNumber;
+/** Sole safe-positive ticket invariant (bind / admission / placement / readers). */
+export function isSafePositiveTicketNumber(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+}
+
+/** Loud reject for non-safe-positive ticket numbers before placement or bind. */
+export function requireSafePositiveTicketNumber(
+  ticketNumber: number,
+  context = "ticketNumber",
+): number {
+  if (!isSafePositiveTicketNumber(ticketNumber)) {
+    throw new Error(
+      `${context} requires a safe positive integer, got ${String(ticketNumber)}`,
+    );
   }
-  return undefined;
+  return ticketNumber;
 }
 
-async function readPageTicketNumber(
-  runDirectory: string,
-  page: "admitted-request.json" | "invocation.json",
-): Promise<number | undefined> {
+function ticketFromRecord(record: Record<string, unknown>): number | undefined {
+  return isSafePositiveTicketNumber(record.ticketNumber)
+    ? record.ticketNumber
+    : undefined;
+}
+
+async function readJsonObject(
+  path: string,
+): Promise<Record<string, unknown> | undefined> {
   try {
-    const raw = JSON.parse(await readFile(join(runDirectory, page), "utf8")) as unknown;
+    const raw: unknown = JSON.parse(await readFile(path, "utf8"));
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
       return undefined;
     }
-    return ticketFromRecord(raw as Record<string, unknown>);
+    return raw as Record<string, unknown>;
   } catch (error) {
     if (isEnoent(error)) return undefined;
     throw error;
   }
 }
 
-/** Sole reader of ticketNumber from a retained run's admitted then invocation pages. */
+async function readBoardPageTicketNumber(
+  runDirectory: string,
+  page: "admitted-request.json" | "invocation.json",
+): Promise<number | undefined> {
+  const record = await readJsonObject(join(runDirectory, page));
+  if (record === undefined) return undefined;
+  return ticketFromRecord(record);
+}
+
+/**
+ * Board-only ticketNumber (admitted → invocation). Placement attribution and
+ * any caller that must ignore derivation pages use this sole projection.
+ */
+export async function readBoardTicketNumber(
+  runDirectory: string,
+): Promise<number | undefined> {
+  return (
+    (await readBoardPageTicketNumber(runDirectory, "admitted-request.json")) ??
+    (await readBoardPageTicketNumber(runDirectory, "invocation.json"))
+  );
+}
+
+/**
+ * Worktree-derivation ticket only — never a board assertion. Callers that must
+ * distinguish board vs derived use this; effective readers use readRunTicketNumber.
+ */
+export async function readMigrationDerivedTicketNumber(
+  runDirectory: string,
+): Promise<number | undefined> {
+  const record = await readJsonObject(
+    join(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE),
+  );
+  if (record === undefined) return undefined;
+  if (record.derivation !== "worktree-path-basename") return undefined;
+  return ticketFromRecord(record);
+}
+
+/**
+ * Display / historical-placement ticketNumber for a retained run:
+ * board admitted → board invocation → migration derivation.
+ * Derivation is last so board wins. Callers that mint, resume, inherit, or
+ * otherwise write ticket identity must use readBoardTicketNumber instead —
+ * derived placement is never a board assertion.
+ */
 export async function readRunTicketNumber(
   runDirectory: string,
 ): Promise<number | undefined> {
   return (
-    (await readPageTicketNumber(runDirectory, "admitted-request.json")) ??
-    (await readPageTicketNumber(runDirectory, "invocation.json"))
+    (await readBoardTicketNumber(runDirectory)) ??
+    (await readMigrationDerivedTicketNumber(runDirectory))
   );
 }

package/src/sitian-appender.ts

@@ -11,7 +11,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { dirname, join } from "node:path";
 
 import { resolveBookKeyFromGit } from "./activation-ledger-git.ts";
 import {
@@ -204,14 +204,6 @@ export function resolveSitianVolumeCategory(kind: string): string {
   return kind;
 }
 
-function safeBookKey(cwd: string): string {
-  try {
-    return resolveBookKeyFromGit(cwd);
-  } catch {
-    return basename(resolve(cwd)) || "default";
-  }
-}
-
 type SitianRecordPath = {
   readonly sessionDir: string;
   readonly recordFile: string;
@@ -223,30 +215,35 @@ export function resolveSitianRecordPathInLedger(
   input: SitianRecordInput,
   ledgerHome: string,
 ): SitianRecordPath {
-  const cwd = input.cwd ?? process.cwd();
   const category = resolveSitianVolumeCategory(input.kind);
+  const ticketNumber = category === "ticket-provenance"
+    ? typeof input.subject === "string" && /^[1-9][0-9]*$/.test(input.subject)
+      ? input.subject
+      : typeof input.subject === "object"
+        && typeof input.subject.ticketNumber === "number"
+        && Number.isSafeInteger(input.subject.ticketNumber)
+        && input.subject.ticketNumber > 0
+        ? String(input.subject.ticketNumber)
+        : undefined
+    : undefined;
 
   let sessionDir: string;
-
-  if (input.sessionParent !== undefined && input.sessionParent.length > 0 && physicallyContainedIn(ledgerHome, input.sessionParent)) {
-    sessionDir = join(dirname(input.sessionParent), category);
+  if (ticketNumber !== undefined) {
+    // docs/dossier-topology.md: ticket dir holds records.jsonl + 起居录.md directly.
+    const bookDir = activationBookDirectory(
+      ledgerHome,
+      resolveBookKeyFromGit(input.cwd ?? process.cwd()),
+    );
+    sessionDir = join(bookDir, ticketNumber);
   } else {
-    const bookKey = safeBookKey(cwd);
-    const bookDir = activationBookDirectory(ledgerHome, bookKey);
-    if (input.subject !== undefined) {
-      let subjectStr: string;
-      if (typeof input.subject === "string") {
-        subjectStr = input.subject;
-      } else if (typeof input.subject.runId === "string" && input.subject.runId.length > 0) {
-        subjectStr = input.subject.runId;
-      } else {
-        subjectStr = JSON.stringify(input.subject);
-      }
-      const digest = createHash("sha256").update(subjectStr).digest("hex").slice(0, 32);
-      sessionDir = join(bookDir, category, digest);
-    } else {
-      sessionDir = join(bookDir, category);
+    if (
+      input.sessionParent === undefined
+      || input.sessionParent.length === 0
+      || !physicallyContainedIn(ledgerHome, input.sessionParent)
+    ) {
+      throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
+    sessionDir = join(dirname(input.sessionParent), category);
   }
 
   const recordFile = join(sessionDir, "records.jsonl");

package/src/submission-ledger.ts

@@ -1,3 +1,5 @@
+import { join } from "node:path";
+
 import {
   resolveActivationLedgerHome,
   tryHomeFromAkRolesPath,
@@ -14,6 +16,8 @@ import { isAuditEscalationProjection } from "./audit-escalation.ts";
 
 import { runIdFromRunDirectory } from "./run-terminal-artifacts.ts";
 import { readSitianRecords, resolveSitianRecordPathInLedger, sitianReport, type RecordPointer } from "./sitian-facade.ts";
+import type { SitianRecord } from "./sitian-contracts.ts";
+import { findRunDirectoryById } from "./public-cli/run-lifecycle.ts";
 import type { TerminalRoleName } from "./public-cli/terminal.ts";
 import { isCorrectableExecuteError } from "./submission-correctable-error.ts";
 import { failOnInfrastructureFailureDeclaration } from "./package-contracts/terminating-infrastructure.ts";
@@ -111,28 +115,64 @@ export type ClosedSubmission = {
 
 export type ClosedSubmissionProjection = ClosedSubmission;
 
-function submissionRecordFile(cwd: string, runId: string, home?: string): string {
-  const ledgerHome = resolveActivationLedgerHome(home);
+/**
+ * Resolve the submission-ledger record file for a run.
+ * Unknown run (no sessionParent and no discoverable directory) → undefined so
+ * read APIs return their empty set at the read boundary. Write paths always
+ * supply sessionParent and keep the ownership gate.
+ */
+async function submissionRecordFile(cwd: string, runId: string, scope: SubmissionLedgerReadScope): Promise<string | undefined> {
+  const ledgerHome = resolveActivationLedgerHome(scope.home);
+  let sessionParent = scope.sessionParent;
+  if (sessionParent === undefined) {
+    const discoveredRun = await findRunDirectoryById(scope.home, runId);
+    if (discoveredRun === undefined) return undefined;
+    sessionParent = join(discoveredRun, "session", "session.jsonl");
+  }
   return resolveSitianRecordPathInLedger({
     level: "event",
     kind: "candidate",
     subject: { runId },
     cwd,
+    sessionParent,
   }, ledgerHome).recordFile;
 }
 
-async function readOwnedSubmissionRecords(cwd: string, runId: string, home?: string) {
-  const file = submissionRecordFile(cwd, runId, home);
+/**
+ * Discriminated owned-row view:
+ * - unknown run → file absent + empty owned (read APIs only)
+ * - located ledger → file is string; prior/write consumers may build RecordPointer
+ */
+type OwnedSubmissionRecords =
+  | { readonly file: undefined; readonly owned: readonly [] }
+  | { readonly file: string; readonly owned: readonly SitianRecord[] };
+
+async function readOwnedSubmissionRecords(
+  cwd: string,
+  runId: string,
+  scope: SubmissionLedgerReadScope = {},
+): Promise<OwnedSubmissionRecords> {
+  const file = await submissionRecordFile(cwd, runId, scope);
+  if (file === undefined) {
+    return { file: undefined, owned: [] };
+  }
   const { records } = await readSitianRecords(file);
   return {
     file,
-    owned: records.filter((record) => typeof record.subject === "object" && record.subject !== null && (record.subject as { runId?: string }).runId === runId),
+    owned: records.filter(
+      (record) =>
+        typeof record.subject === "object"
+        && record.subject !== null
+        && (record.subject as { runId?: string }).runId === runId,
+    ),
   };
 }
 
 /** Optional court-turn scope for settlement reads (#637). */
 export type SubmissionLedgerReadScope = {
   readonly home?: string;
+  /** Durable run principal; the direct ownership coordinate when already known. */
+  readonly sessionParent?: string;
   /**
    * Recording tag for this court. Presentation of original payloads is run-scoped
    * (#836: attempt/latest must not hide already-recorded rows).
@@ -184,9 +224,9 @@ export async function hasFreshAttemptSubmission(
   cwd: string,
   runId: string,
   attemptId: string,
-  home?: string,
+  homeOrScope?: string | SubmissionLedgerReadScope,
 ): Promise<boolean> {
-  const { owned } = await readOwnedSubmissionRecords(cwd, runId, home);
+  const { owned } = await readOwnedSubmissionRecords(cwd, runId, resolveReadScope(homeOrScope));
   return owned.some((record) => {
     if (recordAttemptId(record) !== attemptId) return false;
     if (record.kind === "sealed") return true;
@@ -374,7 +414,7 @@ export async function readRecordedSubmissionRows(
   homeOrScope?: string | SubmissionLedgerReadScope,
 ): Promise<readonly RecordedSubmissionRow[]> {
   const scope = resolveReadScope(homeOrScope);
-  const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope.home);
+  const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope);
   const scoped = recordsForAttempt(owned, scope.attemptId);
   return mapOwnedToSubmissionRows(scoped);
 }
@@ -391,7 +431,11 @@ export async function readAttemptScopedSubmissionRows(
   home?: string,
 ): Promise<readonly RecordedSubmissionRow[]> {
   if (attemptId.length === 0) return [];
-  const { owned } = await readOwnedSubmissionRecords(cwd, runId, home);
+  const { owned } = await readOwnedSubmissionRecords(
+    cwd,
+    runId,
+    home === undefined ? {} : { home },
+  );
   return mapOwnedToSubmissionRows(owned.filter((record) => recordAttemptId(record) === attemptId));
 }
 
@@ -425,7 +469,7 @@ export async function readLatestSubmissionOutcome(
   homeOrScope?: string | SubmissionLedgerReadScope,
 ): Promise<LatestSubmissionOutcome | undefined> {
   const scope = resolveReadScope(homeOrScope);
-  const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope.home);
+  const { owned } = await readOwnedSubmissionRecords(cwd, runId, scope);
   const scoped = recordsForAttempt(owned, scope.attemptId);
   for (let index = scoped.length - 1; index >= 0; index -= 1) {
     const record = scoped[index];
@@ -440,14 +484,35 @@ export async function readLatestSubmissionOutcome(
 
 type LedgerState = { prior?: RecordPointer; sequence: number };
 
-async function restoreState(cwd: string, runId: string, home?: string): Promise<LedgerState> {
-  const { file, owned } = await readOwnedSubmissionRecords(cwd, runId, home);
+async function restoreState(cwd: string, runId: string, scope: SubmissionLedgerReadScope): Promise<LedgerState> {
+  const located = await readOwnedSubmissionRecords(cwd, runId, scope);
+  // Unknown-run empty set: no prior chain. Owned rows without a file are an internal bug.
+  if (located.file === undefined) {
+    if (located.owned.length !== 0) {
+      throw new Error(
+        `submission ledger invariant: owned rows present without recordFile for run ${runId}`,
+      );
+    }
+    return { sequence: 0 };
+  }
+  const { file, owned } = located;
   const last = owned.at(-1);
   return {
-    ...(last === undefined ? {} : { prior: { identity: last.identity, recordFile: file, kind: last.kind, level: last.level } }),
+    ...(last === undefined
+      ? {}
+      : {
+          prior: {
+            identity: last.identity,
+            recordFile: file,
+            kind: last.kind,
+            level: last.level,
+          },
+        }),
     sequence: owned.reduce((maximum, record) => {
       const payload = record.payload as Partial<SubmissionLedgerEvent> | undefined;
-      return payload?.type === "candidate" && typeof payload.sequence === "number" ? Math.max(maximum, payload.sequence) : maximum;
+      return payload?.type === "candidate" && typeof payload.sequence === "number"
+        ? Math.max(maximum, payload.sequence)
+        : maximum;
     }, 0),
   };
 }
@@ -466,21 +531,38 @@ export function createSubmissionLedgerHost(
   options?: { home?: string },
 ): RoleHost {
   const states = new Map<string, Promise<LedgerState>>();
+  /** Sole HostContext-derived run coordinate for restore and append (never process.env). */
+  const sessionParentFromContext = (context: HostContext): string | undefined => {
+    const runDirectory = runDirectoryFromHostContext(context);
+    if (runDirectory !== undefined) {
+      return join(runDirectory, "session", "session.jsonl");
+    }
+    const sessionFile = context.sessionManager.getSessionFile?.();
+    if (typeof sessionFile === "string" && sessionFile.length > 0) return sessionFile;
+    const sessionDir = context.sessionManager.getSessionDir?.();
+    if (typeof sessionDir === "string" && sessionDir.length > 0) {
+      return join(sessionDir, "session.jsonl");
+    }
+    return undefined;
+  };
   const resolveHomeFromContext = (context: HostContext): string | undefined => {
     if (options?.home !== undefined) return options.home;
-    const sessionFile = context.sessionManager.getSessionFile?.() || context.sessionManager.getSessionDir?.();
-    return typeof sessionFile === "string" && sessionFile.length > 0
-      ? tryHomeFromAkRolesPath(sessionFile)
-      : undefined;
+    const sessionParent = sessionParentFromContext(context);
+    return sessionParent !== undefined ? tryHomeFromAkRolesPath(sessionParent) : undefined;
   };
   const stateFor = (context: HostContext, runId: string) => states.get(runId) ?? (() => {
     const home = resolveHomeFromContext(context);
-    const pending = restoreState(context.cwd, runId, home);
+    const sessionParent = sessionParentFromContext(context);
+    const pending = restoreState(context.cwd, runId, {
+      ...(home === undefined ? {} : { home }),
+      ...(sessionParent === undefined ? {} : { sessionParent }),
+    });
     states.set(runId, pending);
     return pending;
   })();
   const appendFor = (state: LedgerState, context: HostContext, runId: string, attemptId: string, event: SubmissionLedgerEvent): RecordPointer => {
     const home = resolveHomeFromContext(context);
+    const sessionParent = sessionParentFromContext(context);
     const pointer = sitianReport({
       level: "event",
       kind: event.type,
@@ -490,6 +572,7 @@ export function createSubmissionLedgerHost(
       source: "role-runtime",
       cwd: context.cwd,
       ...(home !== undefined ? { home } : {}),
+      ...(sessionParent === undefined ? {} : { sessionParent }),
     });
     state.prior = pointer;
     return pointer;

package/src/ticket-provenance.ts

@@ -13,6 +13,7 @@ import {
   type RecordPointer,
   type SitianRecord,
 } from "./sitian-facade.ts";
+import { isSafePositiveTicketNumber } from "./run-ticket-number.ts";
 import {
   TICKET_PROVENANCE_HUMAN_VIEW,
   TICKET_PROVENANCE_KIND,
@@ -25,7 +26,7 @@ import {
 
 /** Subject string for ticket-keyed volumes — history follows the ticket. */
 export function ticketProvenanceSubject(ticketNumber: number): string {
-  if (!Number.isSafeInteger(ticketNumber) || ticketNumber < 1) {
+  if (!isSafePositiveTicketNumber(ticketNumber)) {
     throw new Error(`ticket-provenance subject requires a positive ticket number, got ${String(ticketNumber)}`);
   }
   return String(ticketNumber);
@@ -57,6 +58,7 @@ export function ticketProvenanceEntryIdentity(
 export type AppendTicketProvenanceInput = {
   readonly ticketNumber: number;
   readonly cwd: string;
+  readonly sessionParent: string;
   /** Original diarist row (or `{ original, unprojected: true }` envelope). */
   readonly payload: unknown;
   /** Explicit package home (tests / admitted run); never process.env.HOME (#604). */
@@ -107,6 +109,7 @@ export function appendTicketProvenanceEntry(
     identity,
     subject,
     cwd: input.cwd,
+    sessionParent: input.sessionParent,
     ...(input.home === undefined ? {} : { home: input.home }),
     host: input.host ?? "diarist",
     source: input.source ?? "diarist",

package/src/ticket-trajectory.ts

@@ -29,6 +29,8 @@ import {
   formatTokensCompact,
   formatUsdPrecise,
 } from "./human-format.ts";
+import { listBookRunDirectories } from "./role-run-placement.ts";
+import { readRunTicketNumber } from "./run-ticket-number.ts";
 import {
   extractSessionTimestampSpan,
   readLedgerSessionJsonl,
@@ -302,16 +304,12 @@ async function readInvocation(runDir: string): Promise<InvocationInfo | undefine
         info.model = rawModel;
       }
     }
-    if (
-      typeof parsed.ticketNumber === "number" &&
-      Number.isInteger(parsed.ticketNumber) &&
-      parsed.ticketNumber >= 1
-    ) {
-      info.ticketNumber = parsed.ticketNumber;
-    }
     if (typeof parsed.correlationId === "string" && parsed.correlationId.trim() !== "") {
       info.correlationId = parsed.correlationId;
     }
+    // Display placement: board pages first, then migration-derived (never forges board).
+    const ticketNumber = await readRunTicketNumber(runDir);
+    if (ticketNumber !== undefined) info.ticketNumber = ticketNumber;
     return info;
   } catch (error) {
     // Only genuine absence activates the invocation fallback. Malformed JSON and
@@ -656,56 +654,47 @@ ${stationBlocks || "<p data-empty=\"true\">no runs</p>"}
  * Load one ticket's runs via the S1 tracer path (read-only ledger scan).
  * Factory board reuses this — no parallel receipt parser.
  *
- * Flat-run attribution (#176 option A): read typed `ticketNumber` from each
- * `runs/<run>@<role>/invocation.json`. Legacy `issues/<N>/runs` remains a
- * read-only compatibility entrance. Unbound flat runs never join a ticket.
+ * Book-run attribution (#176 / #859): read typed `ticketNumber` from each run's
+ * invocation.json under listBookRunDirectories (flat legacy `runs/` + subject-tree
+ * `<ticket|unbound>/runs/`). Legacy `issues/<N>/runs` remains a read-only
+ * compatibility entrance. Unbound runs never join a ticket.
  */
 
-/** One flat run's typed binding projection from invocation.json. */
+/** One book run's typed binding projection from invocation.json. */
 export type FlatRunTicketBinding = {
   readonly runDir: string;
   readonly runFolder: string;
+  /** Book-relative coord (e.g. `runs/id@role` or `582/runs/id@role`). */
+  readonly ledgerCoord: string;
   readonly ticketNumber?: number;
   readonly role?: string;
   readonly correlationId?: string;
 };
 
 /**
- * Book-level flat-run index built once per lane/render and reused per ticket.
- * Pure derived view of flat runs' invocation.json files — not a parallel ledger.
+ * Book-level run index built once per lane/render and reused per ticket.
+ * Pure derived view of book runs' invocation.json files — not a parallel ledger.
  */
 export type TicketTrajectoryBookIndex = {
-  /** ticket number → flat runs bound via invocation.json ticketNumber. */
+  /** ticket number → runs bound via invocation.json ticketNumber. */
   readonly runsByTicket: ReadonlyMap<number, readonly FlatRunTicketBinding[]>;
-  /** Flat runs with no typed ticketNumber (unknown/unbound seam). */
+  /** Runs with no typed ticketNumber (unknown/unbound seam). */
   readonly unboundRuns: readonly FlatRunTicketBinding[];
 };
 
-async function listFlatRunDirectories(ledgerDir: string): Promise<string[]> {
-  const runsDir = join(resolve(ledgerDir), "runs");
-  try {
-    const entries = await readdir(runsDir, { withFileTypes: true });
-    return entries
-      .filter((entry) => entry.isDirectory())
-      .map((entry) => join(runsDir, entry.name))
-      .sort();
-  } catch (error) {
-    if (isMissingPathError(error)) return [];
-    throw error;
-  }
-}
-
 export async function buildTicketTrajectoryBookIndex(
   ledgerDir: string,
 ): Promise<TicketTrajectoryBookIndex> {
   const root = resolve(ledgerDir);
   const runsByTicket = new Map<number, FlatRunTicketBinding[]>();
   const unboundRuns: FlatRunTicketBinding[] = [];
-  for (const runDir of await listFlatRunDirectories(root)) {
+  for (const runDir of await listBookRunDirectories(root)) {
     const invocation = await readInvocation(runDir);
+    const rel = relative(root, runDir).split(sep).join("/");
     const binding: FlatRunTicketBinding = {
       runDir,
       runFolder: basename(runDir),
+      ledgerCoord: rel,
       ...(invocation?.ticketNumber !== undefined
         ? { ticketNumber: invocation.ticketNumber }
         : {}),
@@ -744,8 +733,7 @@ export async function loadUnboundTrajectoryRuns(
   const index = bookIndex ?? (await buildTicketTrajectoryBookIndex(root));
   const out: UnboundTrajectoryRun[] = [];
   for (const binding of index.unboundRuns) {
-    const ledgerCoord = ["runs", binding.runFolder].join("/");
-    const run = await parseRunDirectory(binding.runDir, ledgerCoord);
+    const run = await parseRunDirectory(binding.runDir, binding.ledgerCoord);
     out.push({
       run,
       role: binding.role ?? run.station,
@@ -781,14 +769,13 @@ export async function loadTicketTrajectoryRuns(
     runs.push(parsed);
   }
 
-  // Flat runs bound by typed invocation.json ticketNumber.
+  // Book runs (flat + subject-tree) bound by typed invocation.json ticketNumber.
   const flatBindings = index.runsByTicket.get(issueNumber) ?? [];
   for (const binding of flatBindings) {
     const resolvedRunDir = resolve(binding.runDir);
     if (seenRunDirs.has(resolvedRunDir)) continue;
     seenRunDirs.add(resolvedRunDir);
-    const ledgerCoord = ["runs", binding.runFolder].join("/");
-    runs.push(await parseRunDirectory(binding.runDir, ledgerCoord));
+    runs.push(await parseRunDirectory(binding.runDir, binding.ledgerCoord));
   }
 
   return runs;

package/src/worker-role.ts

@@ -145,8 +145,8 @@ export type CoderRoleDependencies = {
 
 export type WorkerRoleRuntime = {
   activate(ctx?: HostContext): Promise<void>;
-  /** Arm gate ① baseline after envelope places the worktree (coder/fixer). Parent feeds archivist durability. */
-  armSubmissionGate(cwd: string, parent?: { getSessionFile(): string | undefined }): void;
+  /** Arm gate ① baseline after envelope places the worktree (coder/fixer). Durable parent required (#857). */
+  armSubmissionGate(cwd: string, parent: { getSessionFile(): string | undefined }): void;
 };
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -328,7 +328,7 @@ export function createFixerRoleRuntime(
         });
       }
     },
-    armSubmissionGate(cwd: string, parent?: { getSessionFile(): string | undefined }) {
+    armSubmissionGate(cwd: string, parent: { getSessionFile(): string | undefined }) {
       submissionGate.arm(cwd, parent);
     },
   };
@@ -477,7 +477,7 @@ export function createCoderRoleRuntime(
         });
       }
     },
-    armSubmissionGate(cwd: string, parent?: { getSessionFile(): string | undefined }) {
+    armSubmissionGate(cwd: string, parent: { getSessionFile(): string | undefined }) {
       submissionGate.arm(cwd, parent);
     },
   };

package/src/worker-submission-gates.ts

@@ -221,9 +221,8 @@ function reliableWindow(
 
 export type CreateWorkerSubmissionGateOptions = {
   /**
-   * Explicit package home for sitian writes when no parent session is armed.
-   * Existing injection point on sitianReport — does not change fallback when omitted
-   * (path-derive from parent, else package machine home). #604 Scope 2.
+   * Explicit package home for sitian writes (tests / admitted run).
+   * Path still derives from required parent session; home only pins ledger root. #604 Scope 2.
    */
   readonly home?: string;
 };
@@ -231,7 +230,8 @@ export type CreateWorkerSubmissionGateOptions = {
 export function createWorkerSubmissionGate(
   options: CreateWorkerSubmissionGateOptions = {},
 ): {
-  arm(cwd: string, parent?: WorkerSubmissionGateParent): void;
+  /** Durable parent is required — ownership must be known at arm (#857 loud failure). */
+  arm(cwd: string, parent: WorkerSubmissionGateParent): void;
   assertAcceptable(status: string, details?: unknown): void;
 } {
   let baseline: string | null | undefined;
@@ -267,11 +267,11 @@ export function createWorkerSubmissionGate(
     arm(cwd, parent) {
       uninstallPackageWorkerHooks(cwd);
       root = cwd;
-      sessionParent = parent?.getSessionFile();
+      sessionParent = parent.getSessionFile();
       record = createRecordSession({
         cwd,
         kind: WORKER_SUBMISSION_GATE_RECORD_KIND,
-        ...(parent === undefined ? {} : { parent }),
+        parent,
       });
       const prior = readGateState(record);
       if (prior.baseline !== undefined) {