@akagilnc/pi-workflow-roles 0.1.4062 → 0.1.4196

package/dist/public-cli/settlement.js

@@ -39,6 +39,7 @@ import { AUDITOR_OUTPUT_TOOL_NAME, } from "../package-contracts/auditor-output.j
 import { observePackagedMethodSkillInvocation, } from "../package-resources/method-skill.js";
 import { classifyPackagedRoleTerminalResult, findLatestDurablePackagedRoleTerminal, hasNavigatorInfrastructureFailureBase, isAcceptedPackagedRoleTerminalResult, isReceiptSettlementBindingClear, NAVIGATOR_INVOCATION_ENTRY, parseInvocationMarkerIdentity, } from "../navigator-invocation-identity.js";
 import { NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_TURN_LIMIT, noReceiptLifecycleFacts, parseNoReceiptLifecycleFacts, } from "../receipt-delivery-policy.js";
+import { roleRunArtifactsDirectory } from "../role-run-placement.js";
 import { ensureRunArtifactsDir, homeFromRunDirectory, } from "./invocation.js";
 /** Ledger reads use the run's machine home — not ambient process HOME (child write vs parent settle). */
 function sealedLedgerHome(admitted) {
@@ -47,6 +48,7 @@ function sealedLedgerHome(admitted) {
 function ledgerReadScope(admitted, scope) {
     return {
         home: sealedLedgerHome(admitted),
+        sessionParent: join(admitted.runDirectory, "session", "session.jsonl"),
         ...(scope?.courtAttemptId === undefined || scope.courtAttemptId.length === 0
             ? {}
             : { attemptId: scope.courtAttemptId }),
@@ -94,7 +96,7 @@ async function sealedLedgerOutcome(admitted, role, scope) {
 export async function attemptProducedFreshSubmission(admitted, scope) {
     if (scope?.courtAttemptId === undefined || scope.courtAttemptId.length === 0)
         return true;
-    return hasFreshAttemptSubmission(admitted.projectRoot, admitted.runId, scope.courtAttemptId, sealedLedgerHome(admitted));
+    return hasFreshAttemptSubmission(admitted.projectRoot, admitted.runId, scope.courtAttemptId, ledgerReadScope(admitted, scope));
 }
 /** #836: every raw role payload in settle scope (调几次记几次). */
 export async function recordedSubmissionPayloads(admitted, scope) {
@@ -2591,7 +2593,7 @@ function uniqueFailureFallbackDirs(runDirectory, baseDir) {
  * (e.g. a file occupies that name), fall back to the run directory itself.
  */
 async function resolveFailureArtifactsBase(runDirectory) {
-    const artifactsDir = join(runDirectory, "artifacts");
+    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
     try {
         await ensureRunArtifactsDir(runDirectory);
         return { baseDir: artifactsDir };
@@ -2660,7 +2662,7 @@ export async function publishFailureArtifacts(admitted, failure, authority) {
     // Prefer conventional names; unique fallback dirs keep colliding fixed paths
     // from stranding the original failure outside settlement. Include the ledger
     // runs/ parent so a locked run directory (EACCES) cannot exhaust durability.
-    const underArtifacts = baseDir === join(admitted.runDirectory, "artifacts");
+    const underArtifacts = baseDir === roleRunArtifactsDirectory(admitted.runDirectory);
     const uniqueFallbackDirs = uniqueFailureFallbackDirs(admitted.runDirectory, baseDir);
     const errorCandidates = underArtifacts
         ? [

package/dist/role-run-placement.js

@@ -0,0 +1,84 @@
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import {
+  activationBookDirectory,
+  ensureRealDirectoryTree
+} from "./activation-ledger-topology.js";
+import { requireSafePositiveTicketNumber } from "./run-ticket-number.js";
+function isMissingPathError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function listBookRunDirectories(bookDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const collect = async (runsDir) => {
+    let entries;
+    try {
+      entries = await readdir(runsDir, { withFileTypes: true });
+    } catch (error) {
+      if (isMissingPathError(error)) return;
+      throw error;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const runDir = join(runsDir, entry.name);
+      if (seen.has(runDir)) continue;
+      seen.add(runDir);
+      out.push(runDir);
+    }
+  };
+  await collect(join(bookDir, "runs"));
+  let subjects;
+  try {
+    subjects = await readdir(bookDir, { withFileTypes: true });
+  } catch (error) {
+    if (isMissingPathError(error)) return out.sort();
+    throw error;
+  }
+  for (const subject of subjects) {
+    if (!subject.isDirectory() || subject.name === "runs") continue;
+    await collect(join(bookDir, subject.name, "runs"));
+  }
+  return out.sort();
+}
+function roleRunPlacement(ledgerHome, input) {
+  const subjectDirectory = "ticketNumber" in input.subject ? String(requireSafePositiveTicketNumber(
+    input.subject.ticketNumber,
+    "roleRunPlacement subject.ticketNumber"
+  )) : "unbound";
+  const runDirectory = join(
+    activationBookDirectory(ledgerHome, input.bookKey),
+    subjectDirectory,
+    "runs",
+    `${input.runId}@${input.role}`
+  );
+  const sessionDirectory = join(runDirectory, "session");
+  return {
+    runDirectory,
+    sessionDirectory,
+    sessionFile: join(sessionDirectory, "session.jsonl"),
+    artifactsDirectory: roleRunArtifactsDirectory(runDirectory),
+    attachmentsDirectory: join(runDirectory, "attachments")
+  };
+}
+function roleRunArtifactsDirectory(runDirectory) {
+  return join(runDirectory, "artifacts");
+}
+function ensureRoleRunDirectory(ledgerHome, directory) {
+  return ensureRealDirectoryTree(ledgerHome, directory);
+}
+function ensureRoleRunPlacement(ledgerHome, placement) {
+  for (const directory of [
+    placement.sessionDirectory,
+    placement.attachmentsDirectory
+  ]) {
+    ensureRoleRunDirectory(ledgerHome, directory);
+  }
+}
+export {
+  ensureRoleRunDirectory,
+  ensureRoleRunPlacement,
+  listBookRunDirectories,
+  roleRunArtifactsDirectory,
+  roleRunPlacement
+};

package/dist/role-run-relocation.js

@@ -0,0 +1,358 @@
+/**
+ * Single authority for rewriting durable run pages after a run directory moves.
+ * Live unbound→ticket relocate and book-topology migration both call this.
+ *
+ * Scope is typed machine-consumed path fields only — never free text, never
+ * frozen attachment/artifact bytes. Nested walk is confined to package-owned
+ * `session/` seams.
+ */
+import { existsSync } from "node:fs";
+import { readdir, readFile, writeFile } from "node:fs/promises";
+import { join, sep } from "node:path";
+import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.js";
+const ADMITTED_PAGE_FIELDS = [
+    "runDirectory",
+    "admittedRequestPath",
+    "sessionDirectory",
+    "sessionFile",
+    "taskPath",
+    "packetPath",
+    "prerequisitesPath",
+    "requestManifestPath",
+    "mergerInputPath",
+    "sourceRunPath",
+];
+const INVOCATION_PAGE_FIELDS = [
+    "runDirectory",
+    "sessionDirectory",
+    "sessionFile",
+];
+const RUN_STATE_PAGE_FIELDS = [
+    "runDirectory",
+    "admittedRequestPath",
+    "sessionDirectory",
+    "sessionFile",
+];
+const SOURCE_RUN_LOCATOR_FIELDS = ["runDirectory"];
+const SUMMONS_PATH_FIELDS = ["sourceRunPath"];
+const CURRENT_SESSION_FIELDS = ["sessionFile"];
+const OFFICER_POINTER_FIELDS = ["sessionFile", "runDirectory"];
+const SITIAN_RECORD_FIELDS = ["sessionParent"];
+const SESSION_HEADER_FIELDS = ["parentSession"];
+const BINDING_PARENT_FIELDS = ["sessionFile"];
+function isEnoent(error) {
+    return (error instanceof Error &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+/** Rewrite one path value that points at or under oldRunDirectory. */
+export function rewriteRunDirectoryPathValue(value, oldRunDirectory, newRunDirectory) {
+    if (typeof value !== "string")
+        return value;
+    if (value === oldRunDirectory)
+        return newRunDirectory;
+    const prefix = `${oldRunDirectory}${sep}`;
+    if (value.startsWith(prefix)) {
+        return `${newRunDirectory}${value.slice(oldRunDirectory.length)}`;
+    }
+    return value;
+}
+/**
+ * Apply the longest matching oldRunDirectory rewrite. Longer keys win so a
+ * nested run path is not partially claimed by a shorter sibling prefix.
+ */
+export function rewriteRunDirectoryPathValueAgainstRewrites(value, rewrites) {
+    if (typeof value !== "string" || rewrites.length === 0)
+        return value;
+    let best;
+    for (const rewrite of rewrites) {
+        if (value === rewrite.oldRunDirectory ||
+            value.startsWith(`${rewrite.oldRunDirectory}${sep}`)) {
+            if (best === undefined ||
+                rewrite.oldRunDirectory.length > best.oldRunDirectory.length) {
+                best = rewrite;
+            }
+        }
+    }
+    if (best === undefined)
+        return value;
+    return rewriteRunDirectoryPathValue(value, best.oldRunDirectory, best.newRunDirectory);
+}
+/** In-place rewrite of selected fields on one record (single pair). */
+export function rewriteRunDirectoryPathFields(record, fields, oldRunDirectory, newRunDirectory) {
+    rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, [
+        { oldRunDirectory, newRunDirectory },
+    ]);
+}
+/** In-place rewrite of selected fields against a rewrite set. */
+export function rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, rewrites) {
+    for (const field of fields) {
+        if (field in record) {
+            record[field] = rewriteRunDirectoryPathValueAgainstRewrites(record[field], rewrites);
+        }
+    }
+}
+function collectRewrites(input) {
+    const own = {
+        oldRunDirectory: input.oldRunDirectory,
+        newRunDirectory: input.newRunDirectory,
+    };
+    if (input.crossRunRewrites === undefined ||
+        input.crossRunRewrites.length === 0) {
+        return [own];
+    }
+    // Own pair first; duplicates of the same old path keep the first (own) target.
+    const seen = new Set([own.oldRunDirectory]);
+    const out = [own];
+    for (const rewrite of input.crossRunRewrites) {
+        if (seen.has(rewrite.oldRunDirectory))
+            continue;
+        seen.add(rewrite.oldRunDirectory);
+        out.push(rewrite);
+    }
+    return out;
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Typed notary/source-run locator: only runDirectory is a path. */
+function rewriteSourceRunLocator(value, rewrites) {
+    if (!isPlainObject(value))
+        return;
+    rewriteRunDirectoryPathFieldsAgainstRewrites(value, SOURCE_RUN_LOCATOR_FIELDS, rewrites);
+}
+/** Same-ticket summons materials: typed source-run + frozen attachment pointers. */
+function rewriteSummonsMaterials(value, rewrites) {
+    if (!isPlainObject(value))
+        return;
+    rewriteRunDirectoryPathFieldsAgainstRewrites(value, SUMMONS_PATH_FIELDS, rewrites);
+    rewriteSourceRunLocator(value.sourceRun, rewrites);
+    // Bare-resume frozen attachment pointers (string[]), not free text / bytes.
+    if (Array.isArray(value.attachmentPaths)) {
+        value.attachmentPaths = value.attachmentPaths.map((path) => rewriteRunDirectoryPathValueAgainstRewrites(path, rewrites));
+    }
+}
+async function rewriteJsonObjectFile(path, fields, rewrites) {
+    if (!existsSync(path))
+        return;
+    const page = JSON.parse(await readFile(path, "utf8"));
+    if (!isPlainObject(page))
+        return;
+    rewriteRunDirectoryPathFieldsAgainstRewrites(page, fields, rewrites);
+    await writeFile(path, `${JSON.stringify(page, null, 2)}\n`, "utf8");
+}
+async function rewriteOfficerPointerFile(path, rewrites) {
+    if (!existsSync(path))
+        return;
+    const page = JSON.parse(await readFile(path, "utf8"));
+    if (!isPlainObject(page))
+        return;
+    // Only the typed direct-officer pointer shape — never arbitrary .pointer.json.
+    if (page.kind !== "direct-officer-run-pointer")
+        return;
+    rewriteRunDirectoryPathFieldsAgainstRewrites(page, OFFICER_POINTER_FIELDS, rewrites);
+    await writeFile(path, `${JSON.stringify(page)}\n`, "utf8");
+}
+async function rewriteSitianRecordsJsonl(path, rewrites) {
+    if (!existsSync(path))
+        return;
+    const raw = await readFile(path, "utf8");
+    if (raw.length === 0)
+        return;
+    const endsWithNewline = raw.endsWith("\n");
+    const lines = raw.split("\n");
+    // split keeps a trailing empty slot when file ends with \n — preserve it.
+    let changed = false;
+    const out = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i];
+        if (line === "" && i === lines.length - 1 && endsWithNewline) {
+            out.push("");
+            continue;
+        }
+        if (line.trim() === "") {
+            out.push(line);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            out.push(line);
+            continue;
+        }
+        if (!isPlainObject(parsed)) {
+            out.push(line);
+            continue;
+        }
+        if (!("sessionParent" in parsed)) {
+            out.push(line);
+            continue;
+        }
+        const before = parsed.sessionParent;
+        rewriteRunDirectoryPathFieldsAgainstRewrites(parsed, SITIAN_RECORD_FIELDS, rewrites);
+        if (parsed.sessionParent !== before)
+            changed = true;
+        out.push(JSON.stringify(parsed));
+    }
+    if (!changed)
+        return;
+    const body = out.join("\n");
+    await writeFile(path, endsWithNewline && !body.endsWith("\n") ? `${body}\n` : body, "utf8");
+}
+/**
+ * Session transcript typed locators only: header.parentSession and
+ * ak_auditor_parent_attempt_binding data.parent.sessionFile. Never message text.
+ */
+async function rewriteSessionTranscriptBindings(path, rewrites) {
+    if (!existsSync(path))
+        return;
+    const raw = await readFile(path, "utf8");
+    if (raw.length === 0)
+        return;
+    const endsWithNewline = raw.endsWith("\n");
+    const lines = raw.split("\n");
+    let changed = false;
+    const out = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i];
+        if (line === "" && i === lines.length - 1 && endsWithNewline) {
+            out.push("");
+            continue;
+        }
+        if (line.trim() === "") {
+            out.push(line);
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            out.push(line);
+            continue;
+        }
+        if (!isPlainObject(parsed)) {
+            out.push(line);
+            continue;
+        }
+        let lineChanged = false;
+        if (parsed.type === "session" && "parentSession" in parsed) {
+            const before = parsed.parentSession;
+            rewriteRunDirectoryPathFieldsAgainstRewrites(parsed, SESSION_HEADER_FIELDS, rewrites);
+            if (parsed.parentSession !== before)
+                lineChanged = true;
+        }
+        else if (parsed.type === "custom" &&
+            parsed.customType === AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE &&
+            isPlainObject(parsed.data) &&
+            isPlainObject(parsed.data.parent)) {
+            const parent = parsed.data.parent;
+            const before = parent.sessionFile;
+            rewriteRunDirectoryPathFieldsAgainstRewrites(parent, BINDING_PARENT_FIELDS, rewrites);
+            if (parent.sessionFile !== before)
+                lineChanged = true;
+        }
+        if (lineChanged)
+            changed = true;
+        out.push(lineChanged ? JSON.stringify(parsed) : line);
+    }
+    if (!changed)
+        return;
+    const body = out.join("\n");
+    await writeFile(path, endsWithNewline && !body.endsWith("\n") ? `${body}\n` : body, "utf8");
+}
+/**
+ * Package-owned nested seams under session/ only:
+ * current-session.json, direct-officer *.pointer.json, sitian records.jsonl,
+ * session transcript typed parent bindings. Never walks attachments/ or artifacts/.
+ */
+async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
+    const sessionRoot = join(pagesDirectory, "session");
+    async function walk(directory) {
+        let entries;
+        try {
+            entries = await readdir(directory, { withFileTypes: true });
+        }
+        catch (error) {
+            if (isEnoent(error))
+                return;
+            throw error;
+        }
+        for (const entry of entries) {
+            const path = join(directory, entry.name);
+            if (entry.isDirectory()) {
+                await walk(path);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (entry.name === "current-session.json") {
+                await rewriteJsonObjectFile(path, CURRENT_SESSION_FIELDS, rewrites);
+            }
+            else if (entry.name.endsWith(".pointer.json")) {
+                await rewriteOfficerPointerFile(path, rewrites);
+            }
+            else if (entry.name === "records.jsonl") {
+                await rewriteSitianRecordsJsonl(path, rewrites);
+            }
+            else if (entry.name.endsWith(".jsonl")) {
+                await rewriteSessionTranscriptBindings(path, rewrites);
+            }
+        }
+    }
+    await walk(sessionRoot);
+}
+/**
+ * Rewrite admitted-request / invocation / run-state path fields (attachment
+ * frozenPath / summons.attachmentPaths pointers only), then nested package-owned
+ * session seams, after the run directory has already been moved or copied.
+ * `pagesDirectory` is where the pages now live; path strings still naming an
+ * old run directory become the matching new directory. `crossRunRewrites`
+ * covers officer/parent pointers that landed under a different final placement.
+ */
+export async function rewriteRoleRunDurablePages(input) {
+    const { pagesDirectory } = input;
+    const rewrites = collectRewrites(input);
+    const admittedPath = join(pagesDirectory, "admitted-request.json");
+    if (existsSync(admittedPath)) {
+        const page = JSON.parse(await readFile(admittedPath, "utf8"));
+        rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_FIELDS, rewrites);
+        // Nested notary typed locator — same value family as top-level sourceRunPath.
+        rewriteSourceRunLocator(page.sourceRun, rewrites);
+        if (Array.isArray(page.attachments)) {
+            for (const attachment of page.attachments) {
+                if (isPlainObject(attachment)) {
+                    // Pointer only — never open or mutate frozen attachment bytes.
+                    rewriteRunDirectoryPathFieldsAgainstRewrites(attachment, ["frozenPath"], rewrites);
+                }
+            }
+        }
+        // Nested principal wire (sessionDirectory/sessionFile) when present.
+        if (isPlainObject(page.principal)) {
+            rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, ["sessionDirectory", "sessionFile"], rewrites);
+        }
+        await writeFile(admittedPath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
+    }
+    const invocationPath = join(pagesDirectory, "invocation.json");
+    if (existsSync(invocationPath)) {
+        const page = JSON.parse(await readFile(invocationPath, "utf8"));
+        rewriteRunDirectoryPathFieldsAgainstRewrites(page, INVOCATION_PAGE_FIELDS, rewrites);
+        await writeFile(invocationPath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
+    }
+    const statePath = join(pagesDirectory, "run-state.json");
+    if (existsSync(statePath)) {
+        const page = JSON.parse(await readFile(statePath, "utf8"));
+        rewriteRunDirectoryPathFieldsAgainstRewrites(page, RUN_STATE_PAGE_FIELDS, rewrites);
+        if (isPlainObject(page.principal)) {
+            rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, ["sessionDirectory", "sessionFile"], rewrites);
+        }
+        // Open court summons: source-run locators + frozen attachment path pointers.
+        if (isPlainObject(page.currentCourt)) {
+            rewriteSummonsMaterials(page.currentCourt.summons, rewrites);
+        }
+        await writeFile(statePath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
+    }
+    await rewriteNestedMachinePathPages(pagesDirectory, rewrites);
+}

package/dist/run-terminal-artifacts.js

@@ -8,6 +8,7 @@
  */
 import { readdir, readFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import { roleRunArtifactsDirectory } from "./role-run-placement.js";
 export const RUN_TERMINAL_ARTIFACT_FILES = [
     "report.json",
     "error.json",
@@ -154,7 +155,7 @@ function presentUniqueFallbackBoundToRun(body, expectedRunId) {
  * A present file that cannot be parsed as a usable typed JSON object is unreadable.
  */
 export async function readRunTerminalArtifact(runDirectory) {
-    const artifactsDir = join(runDirectory, "artifacts");
+    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
     for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
         const path = join(artifactsDir, file);
         const read = await readTerminalArtifactAtPath(path, file);

package/dist/run-ticket-number.js

@@ -1,40 +1,59 @@
-/**
- * Typed ticketNumber reader for a retained run's durable pages.
- * admitted-request.json first, invocation.json fallback. Missing page (ENOENT)
- * → try next / undefined; damage and non-ENOENT IO failures propagate.
- */
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+const MIGRATION_TICKET_DERIVATION_PAGE = "migration-ticket-derivation.json";
 function isEnoent(error) {
-    return (error instanceof Error &&
-        "code" in error &&
-        error.code === "ENOENT");
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function isSafePositiveTicketNumber(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+}
+function requireSafePositiveTicketNumber(ticketNumber, context = "ticketNumber") {
+  if (!isSafePositiveTicketNumber(ticketNumber)) {
+    throw new Error(
+      `${context} requires a safe positive integer, got ${String(ticketNumber)}`
+    );
+  }
+  return ticketNumber;
 }
 function ticketFromRecord(record) {
-    const ticketNumber = record.ticketNumber;
-    if (typeof ticketNumber === "number" &&
-        Number.isSafeInteger(ticketNumber) &&
-        ticketNumber >= 1) {
-        return ticketNumber;
-    }
-    return undefined;
-}
-async function readPageTicketNumber(runDirectory, page) {
-    try {
-        const raw = JSON.parse(await readFile(join(runDirectory, page), "utf8"));
-        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-            return undefined;
-        }
-        return ticketFromRecord(raw);
-    }
-    catch (error) {
-        if (isEnoent(error))
-            return undefined;
-        throw error;
+  return isSafePositiveTicketNumber(record.ticketNumber) ? record.ticketNumber : void 0;
+}
+async function readJsonObject(path) {
+  try {
+    const raw = JSON.parse(await readFile(path, "utf8"));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      return void 0;
     }
+    return raw;
+  } catch (error) {
+    if (isEnoent(error)) return void 0;
+    throw error;
+  }
+}
+async function readBoardPageTicketNumber(runDirectory, page) {
+  const record = await readJsonObject(join(runDirectory, page));
+  if (record === void 0) return void 0;
+  return ticketFromRecord(record);
+}
+async function readBoardTicketNumber(runDirectory) {
+  return await readBoardPageTicketNumber(runDirectory, "admitted-request.json") ?? await readBoardPageTicketNumber(runDirectory, "invocation.json");
+}
+async function readMigrationDerivedTicketNumber(runDirectory) {
+  const record = await readJsonObject(
+    join(runDirectory, MIGRATION_TICKET_DERIVATION_PAGE)
+  );
+  if (record === void 0) return void 0;
+  if (record.derivation !== "worktree-path-basename") return void 0;
+  return ticketFromRecord(record);
 }
-/** Sole reader of ticketNumber from a retained run's admitted then invocation pages. */
-export async function readRunTicketNumber(runDirectory) {
-    return ((await readPageTicketNumber(runDirectory, "admitted-request.json")) ??
-        (await readPageTicketNumber(runDirectory, "invocation.json")));
+async function readRunTicketNumber(runDirectory) {
+  return await readBoardTicketNumber(runDirectory) ?? await readMigrationDerivedTicketNumber(runDirectory);
 }
+export {
+  MIGRATION_TICKET_DERIVATION_PAGE,
+  isSafePositiveTicketNumber,
+  readBoardTicketNumber,
+  readMigrationDerivedTicketNumber,
+  readRunTicketNumber,
+  requireSafePositiveTicketNumber
+};

package/dist/sitian-appender.js

@@ -6,7 +6,7 @@ import {
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { dirname, join } from "node:path";
 import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
 import {
   activationBookDirectory,
@@ -152,36 +152,21 @@ function resolveSitianVolumeCategory(kind) {
   }
   return kind;
 }
-function safeBookKey(cwd) {
-  try {
-    return resolveBookKeyFromGit(cwd);
-  } catch {
-    return basename(resolve(cwd)) || "default";
-  }
-}
 function resolveSitianRecordPathInLedger(input, ledgerHome) {
-  const cwd = input.cwd ?? process.cwd();
   const category = resolveSitianVolumeCategory(input.kind);
+  const ticketNumber = category === "ticket-provenance" ? typeof input.subject === "string" && /^[1-9][0-9]*$/.test(input.subject) ? input.subject : typeof input.subject === "object" && typeof input.subject.ticketNumber === "number" && Number.isSafeInteger(input.subject.ticketNumber) && input.subject.ticketNumber > 0 ? String(input.subject.ticketNumber) : void 0 : void 0;
   let sessionDir;
-  if (input.sessionParent !== void 0 && input.sessionParent.length > 0 && physicallyContainedIn(ledgerHome, input.sessionParent)) {
-    sessionDir = join(dirname(input.sessionParent), category);
+  if (ticketNumber !== void 0) {
+    const bookDir = activationBookDirectory(
+      ledgerHome,
+      resolveBookKeyFromGit(input.cwd ?? process.cwd())
+    );
+    sessionDir = join(bookDir, ticketNumber);
   } else {
-    const bookKey = safeBookKey(cwd);
-    const bookDir = activationBookDirectory(ledgerHome, bookKey);
-    if (input.subject !== void 0) {
-      let subjectStr;
-      if (typeof input.subject === "string") {
-        subjectStr = input.subject;
-      } else if (typeof input.subject.runId === "string" && input.subject.runId.length > 0) {
-        subjectStr = input.subject.runId;
-      } else {
-        subjectStr = JSON.stringify(input.subject);
-      }
-      const digest = createHash("sha256").update(subjectStr).digest("hex").slice(0, 32);
-      sessionDir = join(bookDir, category, digest);
-    } else {
-      sessionDir = join(bookDir, category);
+    if (input.sessionParent === void 0 || input.sessionParent.length === 0 || !physicallyContainedIn(ledgerHome, input.sessionParent)) {
+      throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
+    sessionDir = join(dirname(input.sessionParent), category);
   }
   const recordFile = join(sessionDir, "records.jsonl");
   return { sessionDir, recordFile, ledgerHome };