@akagilnc/pi-workflow-roles 0.1.4062 → 0.1.4196

package/dist/public-cli/option-definitions.js

@@ -529,8 +529,8 @@ const DOCTOR_OPTIONS = [
         repeatable: false,
         form: "option",
         description: {
-            en: "Optional project-relative .ak-roles/books/<book>/issues/<n>/runs override matching --issue.",
-            zh: "可选项目相对 .ak-roles/books/<book>/issues/<n>/runs 覆盖，且须匹配 --issue。",
+            en: "Optional project-relative .ak-roles/books/<book>/<n>/runs override matching --issue.",
+            zh: "可选项目相对 .ak-roles/books/<book>/<n>/runs 覆盖，且须匹配 --issue。",
         },
     },
 ];

package/dist/public-cli/post-admission.js

@@ -62,10 +62,10 @@ function withOnceSuccessfulBeforeDispatch(adapters) {
     let succeeded = false;
     return {
         ...adapters,
-        beforeDispatch: async (admitted) => {
+        beforeDispatch: async (admitted, lease) => {
             if (succeeded)
                 return;
-            await hook(admitted);
+            await hook(admitted, lease);
             succeeded = true;
         },
     };
@@ -259,6 +259,41 @@ export async function dispatchPostAdmissionTurn(input) {
     const persistRunState = input.persistRunState !== false;
     const deferredPersist = persistRunState ? {} : { needsPersist: true };
     const shouldPresent = adapters.shouldPresentSettled ?? ((terminal) => isLawfulTypedTerminalOutcome(terminal.roleOutcome));
+    /**
+     * Once-only post-host-turn hook (Diarist bind/relocate, etc.) under the still-held
+     * writer lease. Every exit after the host turn has started must pass here before
+     * lease release — success and failure alike. When a primary failure terminal already
+     * exists, keep that cause and leave relocate failure on the shared diagnostic channel.
+     */
+    let afterDispatchApplied = false;
+    const finishAfterTurn = async (result) => {
+        if (adapters.afterDispatch === undefined || afterDispatchApplied)
+            return result;
+        afterDispatchApplied = true;
+        try {
+            await adapters.afterDispatch(admitted, lease);
+            return result;
+        }
+        catch (error) {
+            const primaryFailure = result.terminal !== undefined
+                && !isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
+            if (primaryFailure) {
+                await recordBestEffortPostDispatchDiagnostic(admitted, env, `afterDispatch failed beside primary terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
+                return result;
+            }
+            return {
+                ...(await presentControlledFailure(admitted, {
+                    timedOut: false,
+                    code: null,
+                    stderr: "",
+                    thrown: error,
+                }, adapters, env.principalAuthority, io, persistRunState)),
+                ...(result.turnDispatched === true ? { turnDispatched: true } : {}),
+                ...(result.skipAutoResume === true ? { skipAutoResume: true } : {}),
+                ...deferredPersist,
+            };
+        }
+    };
     try {
         const missingCredential = missingCredentialPreDispatchFailure(env.model, env.credentials);
         if (missingCredential !== undefined) {
@@ -315,7 +350,7 @@ export async function dispatchPostAdmissionTurn(input) {
         // (#840 父子不层叠).
         if (adapters.beforeDispatch !== undefined) {
             try {
-                await adapters.beforeDispatch(admitted);
+                await adapters.beforeDispatch(admitted, lease);
             }
             catch (error) {
                 const settled = (await presentControlledFailure(admitted, {
@@ -384,7 +419,7 @@ export async function dispatchPostAdmissionTurn(input) {
                 stderr: "",
                 thrown: error,
             }, adapters, env.principalAuthority, io, persistRunState);
-            return { ...settled, turnDispatched: true, ...deferredPersist };
+            return await finishAfterTurn({ ...settled, turnDispatched: true, ...deferredPersist });
         }
         // `result.stderr` stays live in memory for the real classification below
         // regardless of whether this durable mirror write succeeds. A write
@@ -551,7 +586,7 @@ export async function dispatchPostAdmissionTurn(input) {
                 stderr: result.stderr,
                 thrown: error,
             }, adapters, env.principalAuthority, io, persistRunState);
-            return { ...settledFailure, turnDispatched: true, ...deferredPersist };
+            return await finishAfterTurn({ ...settledFailure, turnDispatched: true, ...deferredPersist });
         }
         if (settledOutcome !== undefined) {
             if (persistRunState) {
@@ -576,12 +611,12 @@ export async function dispatchPostAdmissionTurn(input) {
                         thrown: error,
                         skipRunStateWrite: true,
                     }, adapters, env.principalAuthority, io, persistRunState);
-                    return { ...failed, turnDispatched: true, ...deferredPersist };
+                    return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
                 }
             }
             // Lawful persist + present is the caller's stop seam (auto-resume loop /
             // manual resume), not this retried host-turn function.
-            return { ...settledOutcome, ...deferredPersist };
+            return await finishAfterTurn({ ...settledOutcome, ...deferredPersist });
         }
         // Host/runner true failure coexists with already-recorded payloads — never wash as accepted.
         if (hostSignalFailed) {
@@ -608,7 +643,7 @@ export async function dispatchPostAdmissionTurn(input) {
                         }
                         : { knownDetails: stderrLogWriteDetails }),
             }, adapters, env.principalAuthority, io, persistRunState);
-            return { ...failed, turnDispatched: true, ...deferredPersist };
+            return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
         }
         // Nothing else was wrong, but the durable stderr mirror itself failed to
         // write — that is the real (infrastructure) problem in this case, not a
@@ -620,7 +655,7 @@ export async function dispatchPostAdmissionTurn(input) {
                 stderr: result.stderr,
                 thrown: stderrLogWriteFailure,
             }, adapters, env.principalAuthority, io, persistRunState);
-            return { ...failed, turnDispatched: true, ...deferredPersist };
+            return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
         }
         const noReceipt = await attachRecordedSubmissions(admitted, await settleHostEndedNoReceipt(admitted, env.principalAuthority), courtScope);
         if (persistRunState) {
@@ -640,16 +675,16 @@ export async function dispatchPostAdmissionTurn(input) {
                     thrown: error,
                     skipRunStateWrite: true,
                 }, adapters, env.principalAuthority, io, persistRunState);
-                return { ...failed, turnDispatched: true, ...deferredPersist };
+                return await finishAfterTurn({ ...failed, turnDispatched: true, ...deferredPersist });
             }
         }
-        return {
+        return await finishAfterTurn({
             exitCode: exitCodeForTerminalOutcome(noReceipt.roleOutcome),
             admitted,
             terminal: noReceipt,
             turnDispatched: true,
             ...deferredPersist,
-        };
+        });
     }
     finally {
         try {

package/dist/public-cli/run-lifecycle.js

@@ -5,14 +5,16 @@
  * any existing run with an available Pi session principal may be resumed; caller decides.
  * Prose is never regex-classified as quota evidence.
  */
-import { chmod, open, readdir, readFile, unlink, writeFile } from "node:fs/promises";
-import { isAbsolute, join } from "node:path";
+import { chmod, lstat, open, readdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { basename, isAbsolute, join } from "node:path";
 import { activationBookDirectory, resolveActivationLedgerHome, } from "../activation-ledger-topology.js";
-import { readRunTicketNumber } from "../run-ticket-number.js";
+import { listBookRunDirectories } from "../role-run-placement.js";
+import { isSafePositiveTicketNumber, readBoardTicketNumber, } from "../run-ticket-number.js";
 import { CliUsageError } from "./cli-errors.js";
 import { readLatestTypedProviderHttpObservation, } from "../typed-provider-http.js";
 export { clearTypedProviderHttpObservation, recordTypedProviderHttpStatus, readLatestTypedProviderHttpObservation, } from "../typed-provider-http.js";
 import { parseCollectorRepository } from "../collector-config.js";
+import { interpretDurableCourtTicketNumbers, sameCourtTicketNumbers, } from "../diarist-contracts.js";
 import { appendEngineSessionMaterial, engineSessionMaterialFromOptions, pickEngineAxis, } from "../package-resources/engine-material.js";
 import { recordEffectiveInvocationModel, requireAuthorityRef, } from "./invocation.js";
 /** Providers eligible for v1 typed-429 resume (Codex / xAI only).
@@ -477,14 +479,11 @@ function isProcessAlive(pid) {
     }
 }
 /**
- * Holder autopsy for an existing writer.lock (#552). "absent" covers no file,
- * no parseable pid (a live creator mid-acquisition reads as empty, and so does
- * the crash-window leftover), and unreadable files — absent alone never
- * authorizes reclaim; only a "dead" verdict does. A non-ENOENT read failure
- * still decides "absent" but rides along as readFailure so the true cause can
- * land in the cleanup sink instead of being laundered away.
+ * The writer lease holder is the shared authority for current run activity.
+ * Only ENOENT proves no holder; malformed or unreadable locks remain unknown
+ * because they can be observed while a live creator is writing its pid.
  */
-async function autopsyWriterLock(lockPath) {
+export async function autopsyWriterLock(lockPath) {
     let content;
     try {
         content = await readFile(lockPath, "utf8");
@@ -492,14 +491,16 @@ async function autopsyWriterLock(lockPath) {
     catch (error) {
         if (errorCodeOf(error) === "ENOENT")
             return { verdict: "absent" };
-        return { verdict: "absent", readFailure: error };
+        return { verdict: "unknown", reason: "unreadable", readFailure: error };
     }
     const normalized = content.trim();
-    if (!/^[1-9]\d*$/.test(normalized))
-        return { verdict: "absent" };
+    if (!/^[1-9]\d*$/.test(normalized)) {
+        return { verdict: "unknown", reason: "unparseable", content };
+    }
     const pid = Number.parseInt(normalized, 10);
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return { verdict: "absent" };
+    if (!Number.isSafeInteger(pid) || pid <= 0) {
+        return { verdict: "unknown", reason: "unparseable", content };
+    }
     return isProcessAlive(pid) ? { verdict: "alive", pid } : { verdict: "dead", pid };
 }
 function describeAutopsy(autopsy) {
@@ -509,9 +510,9 @@ function describeAutopsy(autopsy) {
         case "dead":
             return `dead pid ${autopsy.pid}`;
         case "absent":
-            return autopsy.readFailure !== undefined
-                ? "unreadable lock"
-                : "absent or unparseable holder";
+            return "absent holder";
+        case "unknown":
+            return autopsy.reason === "unreadable" ? "unreadable lock" : "unparseable holder";
     }
 }
 /**
@@ -565,28 +566,36 @@ async function createWriterLease(lockPath, runDirectory, reportCleanupFailure) {
         throw error;
     }
     let released = false;
+    let currentRunDirectory = runDirectory;
+    let currentLockPath = lockPath;
     return {
-        lockPath,
+        get lockPath() {
+            return currentLockPath;
+        },
+        relocate(nextRunDirectory) {
+            currentRunDirectory = nextRunDirectory;
+            currentLockPath = join(nextRunDirectory, WRITER_LOCK_FILE);
+        },
         async release() {
             if (released)
                 return;
             released = true;
             await handle.close().catch(() => undefined);
             try {
-                await unlink(lockPath);
+                await unlink(currentLockPath);
             }
             catch (error) {
                 if (errorCodeOf(error) === "EACCES") {
                     try {
-                        await chmod(runDirectory, 0o755);
-                        await unlink(lockPath);
+                        await chmod(currentRunDirectory, 0o755);
+                        await unlink(currentLockPath);
                     }
                     catch (retryError) {
-                        reportCleanupFailure(retryError);
+                        reportCleanupFailure(retryError, currentLockPath);
                     }
                 }
                 else {
-                    reportCleanupFailure(error);
+                    reportCleanupFailure(error, currentLockPath);
                 }
             }
         },
@@ -640,8 +649,8 @@ export async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
      * acquire reads it as live and rejects; nothing here may promise that the
      * next acquire reclaims it.
      */
-    const reportCleanupFailure = (error) => {
-        reportDiagnostic(`writer lease lock cleanup failed (release is best-effort; residual lock left in place) at ${join(runDirectory, WRITER_LOCK_FILE)}: ${describeErrorIdentity(error)}`);
+    const reportCleanupFailure = (error, lockPath) => {
+        reportDiagnostic(`writer lease lock cleanup failed (release is best-effort; residual lock left in place) at ${lockPath}: ${describeErrorIdentity(error)}`);
     };
     /** Contested-lock read failure: nothing was cleaned up; the lock stays exactly where it is. */
     const reportReadFailure = (error) => {
@@ -659,17 +668,20 @@ export async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
                 throw error;
         }
         lastAutopsy = await autopsyWriterLock(lockPath);
-        if (lastAutopsy.verdict === "absent" && lastAutopsy.readFailure !== undefined) {
+        if (lastAutopsy.verdict === "unknown" && lastAutopsy.reason === "unreadable") {
             reportReadFailure(lastAutopsy.readFailure);
         }
         if (lastAutopsy.verdict === "alive") {
             throw new RunWriterLeaseHeldError(`role run writer lease is already held by live pid ${lastAutopsy.pid} at ${lockPath}`);
         }
-        if (lastAutopsy.verdict === "absent") {
-            throw new RunWriterLeaseHeldError(lastAutopsy.readFailure !== undefined
+        if (lastAutopsy.verdict === "unknown") {
+            throw new RunWriterLeaseHeldError(lastAutopsy.reason === "unreadable"
                 ? `role run writer lease lock is unreadable at ${lockPath}: ${describeErrorIdentity(lastAutopsy.readFailure)}; holder liveness unverifiable, lock left in place`
                 : `role run writer lease lock at ${lockPath} has no verifiable holder pid (empty or unparseable); holder liveness unverifiable, lock left in place`);
         }
+        if (lastAutopsy.verdict === "absent") {
+            throw new RunWriterLeaseHeldError(`role run writer lease disappeared before holder autopsy at ${lockPath}`);
+        }
         if (reclaimsLeft <= 0)
             break;
         let reclaimed = false;
@@ -694,8 +706,11 @@ export async function acquireRunWriterLease(runDirectory, onCleanupFailure) {
 /**
  * Locate a Role run directory by run ID under the ledger books home.
  * Returns undefined when the ID is unknown.
+ * Walk surface = listBookRunDirectories (flat legacy + subject-tree).
+ * Collects every match under the supplied book/role filters: zero → undefined,
+ * one → path, many → loud ambiguity (never readdir-first).
  */
-export async function findRunDirectoryById(home, runId) {
+export async function findRunDirectoryById(home, runId, onlyBookKey, onlyRole) {
     if (runId.trim() === "")
         return undefined;
     const ledgerHome = resolveActivationLedgerHome(home);
@@ -704,25 +719,39 @@ export async function findRunDirectoryById(home, runId) {
     try {
         bookKeys = await readdir(booksRoot);
     }
-    catch {
-        return undefined;
+    catch (error) {
+        // Only a missing books root is "unknown id"; permission/IO damage propagates.
+        if (errorCodeOf(error) === "ENOENT")
+            return undefined;
+        throw error;
     }
+    const matches = [];
     for (const bookKey of bookKeys) {
-        const runsDir = join(activationBookDirectory(ledgerHome, bookKey), "runs");
-        let entries;
+        if (onlyBookKey !== undefined && bookKey !== onlyBookKey)
+            continue;
+        const bookDir = activationBookDirectory(ledgerHome, bookKey);
+        let runDirectories;
         try {
-            entries = await readdir(runsDir);
+            runDirectories = await listBookRunDirectories(bookDir);
         }
-        catch {
-            continue;
+        catch (error) {
+            if (errorCodeOf(error) === "ENOENT")
+                continue;
+            throw error;
         }
-        for (const entry of entries) {
-            if (entry === `${runId}@judge` || entry.startsWith(`${runId}@`)) {
-                return join(runsDir, entry);
+        for (const runDirectory of runDirectories) {
+            const entry = basename(runDirectory);
+            if ((onlyRole === undefined && (entry === `${runId}@judge` || entry.startsWith(`${runId}@`))) ||
+                entry === `${runId}@${onlyRole}`) {
+                matches.push(runDirectory);
             }
         }
     }
-    return undefined;
+    if (matches.length === 0)
+        return undefined;
+    if (matches.length === 1)
+        return matches[0];
+    throw new Error(`ambiguous role run id ${runId}: ${matches.join(", ")}`);
 }
 /** Code-owned gate inspector summons prefix (public-role-summons / #747). */
 export const GATE_DOSSIER_POINTER_PREFIX = "卷宗指针：";
@@ -760,19 +789,49 @@ export async function readRunParentPath(runDirectory) {
     }
     return undefined;
 }
+/**
+ * True when durable run-state names a session principal that has actually formed
+ * (session file present as a real file). Provisional runs relocated+terminalized
+ * before dispatch never form one — same-ticket lookup must skip them so a newer
+ * abandoned mint cannot eclipse an older resumable principal (#859).
+ * Not a terminal-state gate: ADR/#416 allows terminal resume when principal exists.
+ */
+async function runHasFormedSessionPrincipal(runDirectory) {
+    const disk = await readRoleRunStateDisk(runDirectory);
+    if (disk === undefined)
+        return false;
+    const sessionFile = typeof disk.principalWire.sessionFile === "string" &&
+        disk.principalWire.sessionFile.trim() !== ""
+        ? disk.principalWire.sessionFile
+        : join(disk.principalWire.sessionDirectory, "session.jsonl");
+    try {
+        const stat = await lstat(sessionFile);
+        return stat.isFile() && !stat.isSymbolicLink();
+    }
+    catch (error) {
+        // Absent session file → not formed; permission/IO/damage keeps identity.
+        if (errorCodeOf(error) === "ENOENT")
+            return false;
+        throw error;
+    }
+}
 /**
  * Locate the latest retained run for one seat under a book (#637 / #747).
- * Same walk surface as findRunDirectoryById. Match by parent run path (officer
- * seats, #747) or by ticket number (countersign / diarist principal).
- * runId is UUIDv7 — lexicographic max is latest. No parallel index.
- * Only a truly missing runs directory means no history; damage/permission errors propagate.
+ * Same walk surface as findRunDirectoryById (listBookRunDirectories). Match by
+ * parent run path (officer seats, #747) or by ticket number (countersign /
+ * diarist principal). runId is UUIDv7 — lexicographic max is latest among runs
+ * that formed a session principal. No parallel index.
+ * Only a truly missing book directory means no history; damage/permission errors propagate.
  */
 export async function findLatestRunIdForSeatTicket(input) {
+    if (input.ticketNumber === undefined && input.parentRunPath === undefined) {
+        return undefined;
+    }
     const ledgerHome = resolveActivationLedgerHome(input.home);
-    const runsDir = join(activationBookDirectory(ledgerHome, input.bookKey), "runs");
-    let entries;
+    const bookDir = activationBookDirectory(ledgerHome, input.bookKey);
+    let runDirectories;
     try {
-        entries = await readdir(runsDir);
+        runDirectories = await listBookRunDirectories(bookDir);
     }
     catch (error) {
         if (errorCodeOf(error) === "ENOENT")
@@ -781,39 +840,38 @@ export async function findLatestRunIdForSeatTicket(input) {
     }
     const suffix = `@${input.role}`;
     let best;
-    for (const entry of entries) {
+    for (const runDirectory of runDirectories) {
+        const entry = basename(runDirectory);
         if (!entry.endsWith(suffix))
             continue;
         const runId = entry.slice(0, entry.length - suffix.length);
         if (runId.length === 0)
             continue;
-        const runDirectory = join(runsDir, entry);
         if (input.parentRunPath !== undefined) {
             const parentPath = await readRunParentPath(runDirectory);
             if (parentPath !== input.parentRunPath)
                 continue;
         }
         else if (input.ticketNumber !== undefined) {
-            const ticketNumber = await readRunTicketNumber(runDirectory);
+            // Same-ticket resume is board identity only — never migration-derived.
+            const ticketNumber = await readBoardTicketNumber(runDirectory);
             if (ticketNumber !== input.ticketNumber)
                 continue;
         }
-        else {
+        // Durable fact: never resume-select a provisional that never formed principal.
+        if (!(await runHasFormedSessionPrincipal(runDirectory)))
             continue;
-        }
         if (best === undefined || runId > best)
             best = runId;
     }
     return best;
 }
-/** Restore optional correlation + typed ticket identity from a durable admitted page. */
+/** Restore optional correlation + typed main-ticket identity from a durable page. */
 function parsePersistedTicketIdentity(record) {
     const correlationId = typeof record.correlationId === "string" && record.correlationId.trim() !== ""
         ? record.correlationId
         : undefined;
-    const ticketNumber = typeof record.ticketNumber === "number" &&
-        Number.isSafeInteger(record.ticketNumber) &&
-        record.ticketNumber >= 1
+    const ticketNumber = isSafePositiveTicketNumber(record.ticketNumber)
         ? record.ticketNumber
         : undefined;
     return {
@@ -821,10 +879,64 @@ function parsePersistedTicketIdentity(record) {
         ...(ticketNumber === undefined ? {} : { ticketNumber }),
     };
 }
+/**
+ * #871 durable set from one run page.
+ * Absent → absent. Present damage keeps the original reason (no throw here).
+ */
+function readDurableCourtTicketNumbersPage(record, principalTicket, pageLabel) {
+    const interpreted = interpretDurableCourtTicketNumbers(record, {
+        ...(principalTicket === undefined ? {} : { principalTicket }),
+    });
+    if (interpreted.kind === "damage") {
+        return {
+            kind: "damage",
+            reason: `role run ${pageLabel} courtTicketNumbers is damaged: ${interpreted.reason}`,
+        };
+    }
+    if (interpreted.kind === "ok") {
+        return { kind: "ok", tickets: interpreted.tickets };
+    }
+    return { kind: "absent" };
+}
+/**
+ * Merge admitted + invocation #871 sets.
+ * Both present must match; one present wins; both absent stays legacy.
+ * Damage / cross-page mismatch return a diagnostic — countersign resume settles
+ * controlled failure; load itself does not structural-reject.
+ */
+function mergeDurableCourtTicketNumbers(input) {
+    const fromAdmitted = input.admittedRecord === undefined
+        ? { kind: "absent" }
+        : readDurableCourtTicketNumbersPage(input.admittedRecord, input.principalTicket, "admitted-request");
+    const fromInvocation = input.invocationRecord === undefined
+        ? { kind: "absent" }
+        : readDurableCourtTicketNumbersPage(input.invocationRecord, input.principalTicket, "invocation");
+    if (fromAdmitted.kind === "damage")
+        return fromAdmitted;
+    if (fromInvocation.kind === "damage")
+        return fromInvocation;
+    if (fromAdmitted.kind === "ok" && fromInvocation.kind === "ok") {
+        if (!sameCourtTicketNumbers(fromAdmitted.tickets, fromInvocation.tickets)) {
+            return {
+                kind: "damage",
+                reason: "role run courtTicketNumbers differs between admitted-request and invocation",
+            };
+        }
+        return { kind: "ok", tickets: fromAdmitted.tickets };
+    }
+    if (fromAdmitted.kind === "ok")
+        return { kind: "ok", tickets: fromAdmitted.tickets };
+    if (fromInvocation.kind === "ok")
+        return { kind: "ok", tickets: fromInvocation.tickets };
+    return { kind: "ok" };
+}
 function restoredTicketFields(fields) {
     return {
         ...(fields.correlationId === undefined ? {} : { correlationId: fields.correlationId }),
         ...(fields.ticketNumber === undefined ? {} : { ticketNumber: fields.ticketNumber }),
+        ...(fields.courtTicketNumbers === undefined
+            ? {}
+            : { courtTicketNumbers: fields.courtTicketNumbers }),
     };
 }
 async function loadResumableRunRecord(home, runId, authority) {
@@ -862,6 +974,10 @@ async function loadResumableRunRecord(home, runId, authority) {
     let derived;
     let correlationId;
     let ticketNumber;
+    let courtTicketNumbers;
+    let courtTicketNumbersDamage;
+    let admittedIdentityRecord;
+    let invocationIdentityRecord;
     let prNumber;
     let repository;
     let repositoryDisplay;
@@ -996,6 +1112,7 @@ async function loadResumableRunRecord(home, runId, authority) {
                     };
                 }
             }
+            admittedIdentityRecord = record;
             const fromAdmitted = parsePersistedTicketIdentity(record);
             correlationId = fromAdmitted.correlationId;
             ticketNumber = fromAdmitted.ticketNumber;
@@ -1014,6 +1131,7 @@ async function loadResumableRunRecord(home, runId, authority) {
             typeof invocationRaw === "object" &&
             !Array.isArray(invocationRaw)) {
             const rec = invocationRaw;
+            invocationIdentityRecord = rec;
             if (typeof rec.provider === "string" && typeof rec.model === "string") {
                 model = {
                     provider: rec.provider,
@@ -1033,12 +1151,29 @@ async function loadResumableRunRecord(home, runId, authority) {
         }
     }
     catch (error) {
+        if (error instanceof CliUsageError) {
+            throw error;
+        }
         if (!(error instanceof Error &&
             "code" in error &&
             error.code === "ENOENT")) {
             throw new CliUsageError(`role run invocation identity is unreadable: ${runId}`, { cause: error });
         }
     }
+    // #871: resolve set after main ticket so principal membership can be checked.
+    // Present-but-damaged / cross-page mismatch keep diagnostic for countersign
+    // controlled-failure; both-absent stays legacy; single lawful page restores.
+    const mergedSet = mergeDurableCourtTicketNumbers({
+        admittedRecord: admittedIdentityRecord,
+        invocationRecord: invocationIdentityRecord,
+        principalTicket: ticketNumber,
+    });
+    if (mergedSet.kind === "damage") {
+        courtTicketNumbersDamage = mergedSet.reason;
+    }
+    else if (mergedSet.tickets !== undefined) {
+        courtTicketNumbers = mergedSet.tickets;
+    }
     return {
         run,
         principal,
@@ -1058,6 +1193,10 @@ async function loadResumableRunRecord(home, runId, authority) {
             ...(derived === undefined ? {} : { derived }),
             ...(correlationId === undefined ? {} : { correlationId }),
             ...(ticketNumber === undefined ? {} : { ticketNumber }),
+            ...(courtTicketNumbers === undefined ? {} : { courtTicketNumbers }),
+            ...(courtTicketNumbersDamage === undefined
+                ? {}
+                : { courtTicketNumbersDamage }),
             ...(prNumber === undefined ? {} : { prNumber }),
             ...(repository === undefined ? {} : { repository }),
             ...(repositoryDisplay === undefined ? {} : { repositoryDisplay }),
@@ -1213,9 +1352,18 @@ export async function loadResumableCountersignRun(home, runId, authority) {
     if (loaded.run.role !== "countersign") {
         throw new CliUsageError(`role run ${runId} belongs to ${loaded.run.role}, not countersign`);
     }
+    const base = resumedBaseAdmitted(loaded);
     const admitted = {
         role: "countersign",
-        ...resumedBaseAdmitted(loaded),
+        ...base,
+        ...(base.courtTicketNumbers === undefined
+            ? {}
+            : { courtTicketNumbers: base.courtTicketNumbers }),
+        ...(loaded.admittedFields.courtTicketNumbersDamage === undefined
+            ? {}
+            : {
+                courtTicketNumbersDamage: loaded.admittedFields.courtTicketNumbersDamage,
+            }),
     };
     return seatLoadedResult(loaded, admitted);
 }

package/dist/public-cli/seat-ticket-binding.js

@@ -1,17 +1,14 @@
 /**
  * Shared ticket identity seam for public court seats (#635 / #637 / #709 / #747 / #771).
  *
- * ADR 0075 `diarist-resolves-ticket-llm-layer`: the seat's LLM names the court
- * target as a typed assertion; the mechanical layer only verifies that assertion
- * (complete decimal of N appears in the summons; ticket exists). Code never
- * judges which ticket the summons is about — no prose harvest, no first-#N
- * position pick, no matching book-known numbers against instruction text
+ * ADR 0075 `diarist-resolves-ticket-llm-layer`: the diarist LLM recognizes the
+ * court target; recognized ticket → provenance, truly unbound → no provenance,
+ * or escalate when it cannot recognize one. Code does not re-judge the ticket
  * (锚定宪法; owner 2026-09-08: 代码不准做判断). Other seats reuse a typed
  * identity already handed over (起居郎 assertion / source-run / already-bound
  * resume) — they do not re-recognize from instruction. No CLI --ticket, no
  * attachment frontmatter. #747: officer same-parent resume also lives here.
  *
- * Mechanical verify helpers live on diarist.ts / invocation.ts (sole owners).
  * This module owns same-ticket / same-parent resume only.
  */
 import { resolveBookKeyFromGit } from "../activation-ledger-git.js";