@akagilnc/pi-workflow-roles 0.1.4291 → 0.1.4321

package/dist/session-dialogue.js

@@ -104,8 +104,8 @@ function isCodexOwnerResponseItemUser(message) {
 }
 /**
  * 入队事件适配：人类这次输入经队列的来源。
- * 配对的出队事件不另取，也不做正文比对去重——被吸收的插话正是靠入队事件入录
- * （它没有独立的消息记录，#901 用户故事 11）。
+ * 被吸收的插话靠入队事件入录（无独立消息记录，#901 用户故事 11）。
+ * 机器入队由整卷适配层排除（#918）；本函数不读正文、不自判机器。
  */
 function fromQueueEvent(row) {
     if (row.type !== "queue-operation" || row.operation !== "enqueue")
@@ -116,6 +116,51 @@ function fromQueueEvent(row) {
     const id = nativeEventId(row);
     return [{ speaker: "owner", text: content, ...(id === undefined ? {} : { id }) }];
 }
+/**
+ * 票面 #918 准许的唯一固定起始形状：`<task-notification`。
+ * 其它标签不在御裁射程内——不得扩表，不得伪造 decision key / 「陛下拍定」。
+ * 开标签后可直接 `>`（无属性）、EOF 或空白再接属性；其它字符不成立。
+ *
+ * 机器 enqueue 的完整判据＝结构化来源（origin.kind）／本固定形状／真实因果与位置；
+ * 用可变载荷正文（全等或子串）做 identity join 仍为锚定宪法所禁。
+ */
+const TASK_NOTIFICATION_OPEN_TAG = "<task-notification";
+function hasFixedOpenTagPrefix(content, tag) {
+    if (!content.startsWith(tag))
+        return false;
+    const next = content.charAt(tag.length);
+    return (next === "" ||
+        next === ">" ||
+        next === " " ||
+        next === "\t" ||
+        next === "\n" ||
+        next === "\r");
+}
+/** enqueue.content 是否以票面准许的 `<task-notification` 固定开标签起头。 */
+function isFixedNonOwnerEnqueueShape(content) {
+    return hasFixedOpenTagPrefix(content, TASK_NOTIFICATION_OPEN_TAG);
+}
+/**
+ * 物化 user 行上的结构化来源 kind（CC top-level `origin.kind`）。不读正文。
+ * 活体取值含 human / task-notification / peer；缺字段＝旧形无 provenance。
+ */
+function materializationOriginKind(row) {
+    if (!isRecord(row.origin))
+        return undefined;
+    const kind = row.origin.kind;
+    return typeof kind === "string" && kind !== "" ? kind : undefined;
+}
+/**
+ * origin.kind 取值是否为非陛下来源（#918 第二类）。
+ * - 缺 origin 或 kind=human → 真人路（经队列的真人输入必须保留）
+ * - task-notification / peer / 其他具名非 human → 机器或跨会话投递，不得署 owner
+ * 判别落在 kind 取值上，不落在字段是否存在。
+ */
+function isNonOwnerOriginKind(kind) {
+    if (kind === undefined)
+        return false;
+    return kind !== "human";
+}
 /**
  * 消息事件适配：助手回话，以及未经入队事件记录的人类输入。
  * 思考块、工具调用块、工具结果块按块排除；同消息的说话人 text 保留
@@ -146,76 +191,29 @@ function fromMessageEvent(row) {
     const id = nativeEventId(row);
     return [{ speaker, text, ...(id === undefined ? {} : { id }) }];
 }
-/** 该行是否为可产出 owner 对话正文的消息（工具结果块不算；旁路 text 算）。 */
-function isOwnerDialogueMessage(row) {
-    // CC/Pi queue pairing only — Codex owner path is separate.
-    if (row.type === "response_item" || row.type === "event_msg")
-        return false;
-    return fromMessageEvent(row).some((event) => event.speaker === "owner");
-}
-/** 该行是否为 runner 回话事件（用于解除未物化的 dequeue 配对）。 */
-function isRunnerMessage(row) {
-    const message = messageBody(row);
-    return message !== undefined && message.role === "assistant";
-}
-/**
- * 逐次来源配对：仅当对应 enqueue 已由 fromQueueEvent 实际形成 retained owner
- * 对话时，才把随后的物化 user 当副本跳过。FIFO 对齐 enqueue→dequeue/remove。
- * 无正文 enqueue、旧宿主或其他不可投影形状：dequeue 不产生 skip，后续真人
- * user 原样保留。未物化的 retained dequeue（被吸收插话）遇 runner 解除。
- * 不用「卷内曾出现 enqueue」整卷布尔，也不按正文过滤。
- */
-function ownerMessagesMaterializingQueue(rows) {
-    const skip = new Set();
-    /** 各 enqueue 是否已留下 owner 对话，按入队顺序等 dequeue/remove 消费。 */
-    const retainedByEnqueue = [];
-    let pendingSkips = 0;
-    for (let index = 0; index < rows.length; index += 1) {
-        const row = rows[index];
-        if (row === undefined)
-            continue;
-        if (row.type === "queue-operation") {
-            if (row.operation === "enqueue") {
-                retainedByEnqueue.push(fromQueueEvent(row).length > 0);
-                continue;
-            }
-            if (row.operation === "dequeue" || row.operation === "remove") {
-                const retained = retainedByEnqueue.shift();
-                // 只在 enqueue 真留下对话且本事件是 dequeue 物化时才跳过后续 user。
-                // remove 只消费队列槽，不制造 skip（无物化消息）。
-                if (row.operation === "dequeue" && retained === true) {
-                    pendingSkips += 1;
-                }
-                continue;
-            }
-        }
-        if (isRunnerMessage(row)) {
-            pendingSkips = 0;
-            continue;
-        }
-        if (pendingSkips > 0 && isOwnerDialogueMessage(row)) {
-            skip.add(index);
-            pendingSkips -= 1;
-        }
-    }
-    return skip;
-}
 /**
  * 整卷适配：返回与入参行等长的对话事实数组（该行不是对话则为空数组）。
- * 需要整卷视野：enqueue/dequeue 配对跨行。
+ *
+ * 物化 user 只消费自身的 typed `origin.kind`：human 保留，具名非 human 排除。
+ * enqueue 没有与物化 user 的 typed 关联，故不得以位置把某个 user 来源反扣给它；
+ * 仅票面准许的 `<task-notification` 固定形状可直接排除，其余维持既有投影。
  */
 export function adaptSessionDialogue(rows) {
-    const skipOwner = ownerMessagesMaterializingQueue(rows);
-    return rows.map((row, index) => {
+    return rows.map((row) => {
         if (row === undefined)
             return [];
+        const originKind = materializationOriginKind(row);
+        if (isNonOwnerOriginKind(originKind))
+            return [];
+        if (row.type === "queue-operation" &&
+            row.operation === "enqueue" &&
+            typeof row.content === "string" &&
+            isFixedNonOwnerEnqueueShape(row.content)) {
+            return [];
+        }
         const queued = fromQueueEvent(row);
         if (queued.length > 0)
             return queued;
-        // Codex event_msg.user_message 无 content_item_kinds 等 provenance，旧 exec
-        // 卷中与 worker entrypoint 注入同形——无法证明为 owner 则不取（不猜、不咬正文）。
-        if (skipOwner.has(index))
-            return [];
         return fromMessageEvent(row);
     });
 }

package/dist/sitian-facade.js

@@ -2,7 +2,6 @@ import { appendSitianRecord } from "./sitian-appender.js";
 export * from "./sitian-contracts.js";
 export * from "./sitian-appender.js";
 export * from "./sitian-reader.js";
-export * from "./sitian-volume.js";
 function sitianReport(input) {
   return appendSitianRecord(input);
 }

package/dist/ticket-provenance-contracts.js

@@ -1,9 +1,10 @@
 /**
- * 起居录（ticket-provenance）typed 形状 —— ADR 0075「2026-09-14 修订」/ #901。
+ * 起居录（ticket-provenance）typed 形状 —— ADR 0075「2026-09-14 修订」/ #901 / #918。
  *
- * 一册＝一个文件：第一行册子头，其后每行一条对话。
- * 每轮按册子头当前各区间**重投影**这份唯一文件：册子头与各条定位可更新，
- * 正文原样不改（`single-volume` / `one-volume-per-issue`）。
+ * 一册＝一个追加式 records.jsonl；逻辑册子头与对话由读取时折叠不可变投影提交得到。
+ * 既有「首行册子头＋裸对话行」snapshot 向后可读，后续提交不回写旧行。
+ * sessions 为 prior ∪ 各轮累计并集（遗漏不删除），已结转正文不因历史源重读而改。
+ * 交卷 `sessions` 输入语义仍是「本轮对话边界」；累计并集是机械合并，不是角色交什么。
  */
 /** Sitian kind for per-ticket court diary volumes. */
 export const TICKET_PROVENANCE_KIND = "ticket-provenance";

package/dist/ticket-provenance.js

@@ -1,17 +1,20 @@
 /**
- * 起居录 volume helpers — ADR 0075「2026-09-14 修订」/ #901。
- * 一册＝一个文件：首行册子头，其后裸对话行。每轮按当前区间重投影是唯一机制；
- * 无 append 水位、无 SitianRecord 外壳。目的地解析与读写经司天台唯一入口
- * （ADR 0065 records-owner / record-entry；ADR 0081 入录经司天台）。
+ * 起居录 volume helpers — ADR 0075「2026-09-14 修订」/ #901 / #918。
+ * 一册＝一个追加式 records.jsonl。每轮新投影经司天台 appender 追加为不可变提交；
+ * 读取时折叠全部提交得到累计 sessions 与对话视图。既有首行册子头＋裸对话行的
+ * snapshot 继续可读，但后续不为升级回写旧卷。
  */
+import { createHash } from "node:crypto";
+import { appendFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
-import { errnoCode, packageMachineHome, physicallyContainedIn, resolveActivationLedgerHome, } from "./activation-ledger-topology.js";
+import { ensureRealDirectoryTree, errnoCode, packageMachineHome, physicalPathIdentity, physicallyContainedIn, resolveActivationLedgerHome, } from "./activation-ledger-topology.js";
 import { readLedgerSessionJsonlLines, } from "./ledger-session-read.js";
 import { isSafePositiveTicketNumber } from "./run-ticket-number.js";
 import { adaptSessionDialogue, nativeEventId } from "./session-dialogue.js";
-import { ensureSitianVolume, readSitianVolumeText, resolveSitianVolume, rewriteSitianVolume, } from "./sitian-facade.js";
-import { TICKET_PROVENANCE_KIND, projectTicketProvenanceHeader, projectTicketProvenanceLine, } from "./ticket-provenance-contracts.js";
+import { appendSitianRecord, resolveSitianRecordPath, } from "./sitian-facade.js";
+import { TICKET_PROVENANCE_KIND, projectTicketProvenanceHeader, projectTicketProvenanceLine, projectTicketProvenanceSessions, } from "./ticket-provenance-contracts.js";
 /**
  * Typed input failure for diarist bounds/session path (reask, not infrastructure).
  * Accept hook discriminates with instanceof — never Error.message prefixes.
@@ -28,7 +31,9 @@ export class TicketProvenanceInputError extends Error {
  * Narrow directory identities — not whole `.pi` / whole `.ak-roles`.
  */
 export function dialogueSessionSourceRoots(home) {
-    const machineHome = typeof home === "string" && home.trim() !== "" ? home : packageMachineHome();
+    const machineHome = typeof home === "string" && home.trim() !== ""
+        ? home
+        : packageMachineHome();
     return [
         join(machineHome, ".claude", "projects"),
         join(machineHome, ".codex", "sessions"),
@@ -40,11 +45,14 @@ export function dialogueSessionSourceRoots(home) {
  * `<ledger>/books/.../session/session.jsonl` (basename + parent only — no body probe).
  */
 function isLedgerRoleSessionFile(absolute, home) {
-    const machineHome = typeof home === "string" && home.trim() !== "" ? home : packageMachineHome();
+    const machineHome = typeof home === "string" && home.trim() !== ""
+        ? home
+        : packageMachineHome();
     const ledgerHome = resolveActivationLedgerHome(machineHome);
     if (!physicallyContainedIn(ledgerHome, absolute))
         return false;
-    return basename(absolute) === "session.jsonl" && basename(dirname(absolute)) === "session";
+    return (basename(absolute) === "session.jsonl" &&
+        basename(dirname(absolute)) === "session");
 }
 /** Real I/O seam gate: only host session stores or sitian role-run session.jsonl. */
 function assertDialogueSessionSourcePath(path, home) {
@@ -76,17 +84,51 @@ function ticketProvenanceRecordInput(ticketNumber, cwd, home) {
 }
 /** Resolve volume paths for a ticket without writing. */
 export function resolveTicketProvenanceVolume(ticketNumber, cwd, home) {
-    return resolveSitianVolume(ticketProvenanceRecordInput(ticketNumber, cwd, home));
+    const path = resolveSitianRecordPath(ticketProvenanceRecordInput(ticketNumber, cwd, home));
+    return { recordFile: path.recordFile, volumeDir: path.sessionDir };
+}
+function projectTicketProvenanceCommit(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (record.kind !== TICKET_PROVENANCE_KIND || typeof record.timestamp !== "string") {
+        return undefined;
+    }
+    const payload = record.payload;
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload))
+        return undefined;
+    const body = payload;
+    if (body.type !== "ticket-provenance-append")
+        return undefined;
+    const sessions = projectTicketProvenanceSessions(body.sessions);
+    if (sessions === undefined || !Array.isArray(body.lines))
+        return undefined;
+    const lines = [];
+    for (const raw of body.lines) {
+        const line = projectTicketProvenanceLine(raw);
+        if (line === undefined)
+            return undefined;
+        lines.push(line);
+    }
+    return { timestamp: record.timestamp, sessions, lines };
 }
 /** Read the unique diary file (empty/absent → no header, no lines). */
 export async function readTicketProvenance(ticketNumber, cwd, home) {
-    const { recordFile, text } = await readSitianVolumeText(ticketProvenanceRecordInput(ticketNumber, cwd, home));
-    if (text === undefined) {
-        return { header: undefined, lines: [], recordFile };
+    const { recordFile } = resolveTicketProvenanceVolume(ticketNumber, cwd, home);
+    let text;
+    try {
+        text = await readFile(recordFile, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { header: undefined, lines: [], unprojectedRaw: [], recordFile };
+        }
+        throw error;
     }
     const physical = text.split("\n");
     let header;
     const lines = [];
+    const unprojectedRaw = [];
     let sawFirst = false;
     for (let index = 0; index < physical.length; index += 1) {
         const raw = physical[index];
@@ -97,28 +139,59 @@ export async function readTicketProvenance(ticketNumber, cwd, home) {
             parsed = JSON.parse(raw);
         }
         catch {
-            // Stock / damaged rows stay unprojected — no backfill, no guess.
+            // Stock / damaged rows stay unprojected — keep raw bytes on rewrite.
+            unprojectedRaw.push(raw);
             continue;
         }
         if (!sawFirst) {
             sawFirst = true;
             header = projectTicketProvenanceHeader(parsed);
-            // First line that is not a header is treated as a body line (stock shapes).
+            // Legacy snapshot: first line header followed by bare dialogue rows.
             if (header !== undefined)
                 continue;
         }
         const line = projectTicketProvenanceLine(parsed);
-        if (line !== undefined)
+        if (line !== undefined) {
             lines.push(line);
+            continue;
+        }
+        const commit = projectTicketProvenanceCommit(parsed);
+        if (commit !== undefined) {
+            const merged = mergeSessionBounds(header?.sessions, commit.sessions);
+            const remapped = commit.lines.map((entry) => ({
+                ...entry,
+                s: merged.incomingIndexes[entry.s] ?? entry.s,
+            }));
+            const now = commit.timestamp;
+            header = {
+                repo: header?.repo ?? resolveBookKeyFromGit(cwd),
+                ticket: ticketNumber,
+                createdAt: header?.createdAt ?? now,
+                updatedAt: now,
+                sessions: merged.sessions,
+            };
+            const carried = lines.map((entry) => ({
+                ...entry,
+                s: merged.priorIndexes[entry.s] ?? entry.s,
+            }));
+            lines.splice(0, lines.length, ...mergeFreshIntoCarried(carried, remapped));
+            continue;
+        }
+        // Unknown stock / damaged rows remain readable and are never upgraded in place.
+        unprojectedRaw.push(raw);
     }
-    return { header, lines, recordFile };
+    return { header, lines, unprojectedRaw, recordFile };
 }
 /**
  * Ensure the per-ticket directory + volume file exist (ADR 0075 ticket-provenance-file).
  * Empty file is lawful (bound court with no dialogue yet). Does not forge entries.
  */
 export function ensureTicketProvenanceVolume(ticketNumber, cwd, home) {
-    return ensureSitianVolume(ticketProvenanceRecordInput(ticketNumber, cwd, home));
+    const input = ticketProvenanceRecordInput(ticketNumber, cwd, home);
+    const path = resolveSitianRecordPath(input);
+    ensureRealDirectoryTree(path.ledgerHome, path.sessionDir);
+    appendFileSync(path.recordFile, "", "utf8");
+    return { recordFile: path.recordFile, volumeDir: path.sessionDir };
 }
 /**
  * Resolve a bound endpoint against this round's session lines.
@@ -148,6 +221,127 @@ function resolveBoundIndex(bound, sessionLines) {
 function amendmentKey(s, line) {
     return `${s}:${line}`;
 }
+/** Exact range identity for cumulative header dedupe (idempotent resubmit). */
+function rangeDeclarationKey(range) {
+    return JSON.stringify({
+        from: range.from,
+        to: range.to,
+    });
+}
+/**
+ * #918 甲案：prior ranges ∪ 本轮 ranges。按 path 合并；先保 prior 序，再追加新 path。
+ * path identity 与 I/O 接缝同用 `physicalPathIdentity`（symlink-stable），故
+ * `p` / `p/./` / 经 symlink 祖先的别名合为一条；保留首见 path 字面与累计 ranges。
+ * 即使 prior 缺失 / sessions=[]，incoming 自身也必须按 identity 归并——首轮同一
+ * 物理卷不得铸出多个 s（#918 C5）。遗漏不代表删除。
+ */
+function mergeSessionBounds(prior, incoming) {
+    const merged = [];
+    const indexByIdentity = new Map();
+    const absorb = (sessions) => {
+        const indexes = [];
+        for (const session of sessions) {
+            const identity = physicalPathIdentity(session.path);
+            let targetIndex = indexByIdentity.get(identity);
+            if (targetIndex === undefined) {
+                targetIndex = merged.length;
+                indexByIdentity.set(identity, targetIndex);
+                merged.push({ path: session.path, ranges: [] });
+            }
+            indexes.push(targetIndex);
+            const target = merged[targetIndex];
+            const seen = new Set(target.ranges.map(rangeDeclarationKey));
+            for (const range of session.ranges) {
+                const key = rangeDeclarationKey(range);
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                target.ranges.push({ from: { ...range.from }, to: { ...range.to } });
+            }
+        }
+        return indexes;
+    };
+    const priorIndexes = absorb(prior ?? []);
+    const incomingIndexes = absorb(incoming);
+    return { sessions: merged, priorIndexes, incomingIndexes };
+}
+/**
+ * #918 第一节：已投影行即卷宗。只对 prior 未声明的 range（按 path identity + 精确
+ * from/to）读源；已声明的按 s,line 结转，不重读历史源。
+ */
+function undeclaredSessionRanges(prior, merged) {
+    const priorKeys = new Map();
+    for (const session of prior ?? []) {
+        const identity = physicalPathIdentity(session.path);
+        let keys = priorKeys.get(identity);
+        if (keys === undefined) {
+            keys = new Set();
+            priorKeys.set(identity, keys);
+        }
+        for (const range of session.ranges)
+            keys.add(rangeDeclarationKey(range));
+    }
+    const out = [];
+    for (let s = 0; s < merged.length; s += 1) {
+        const session = merged[s];
+        const declared = priorKeys.get(physicalPathIdentity(session.path)) ?? new Set();
+        const fresh = session.ranges.filter((range) => !declared.has(rangeDeclarationKey(range)));
+        if (fresh.length === 0)
+            continue;
+        out.push({
+            s,
+            session: {
+                path: session.path,
+                ranges: fresh.map((range) => ({
+                    from: { ...range.from },
+                    to: { ...range.to },
+                })),
+            },
+        });
+    }
+    return out;
+}
+/** Sort archive rows by session index then source line (stable within equal keys). */
+function compareLinePosition(left, right) {
+    if (left.s !== right.s)
+        return left.s - right.s;
+    const leftLine = left.line ?? Number.MAX_SAFE_INTEGER;
+    const rightLine = right.line ?? Number.MAX_SAFE_INTEGER;
+    return leftLine - rightLine;
+}
+/**
+ * Merge newly projected rows into the carried archive.
+ * 既有卷宗按 (s,line) 优先；fresh 不得复制无 id 行（#918 C2/G1）。
+ * id 去重仍保留（跨 path 同 id 首见胜）。
+ */
+function mergeFreshIntoCarried(carried, fresh) {
+    const seenIds = new Set();
+    const seenPositions = new Set();
+    const out = [];
+    for (const line of carried) {
+        if (line.id !== undefined)
+            seenIds.add(line.id);
+        if (line.line !== undefined)
+            seenPositions.add(amendmentKey(line.s, line.line));
+        out.push(line);
+    }
+    for (const line of fresh) {
+        if (line.id !== undefined) {
+            if (seenIds.has(line.id))
+                continue;
+            seenIds.add(line.id);
+        }
+        if (line.line !== undefined) {
+            const position = amendmentKey(line.s, line.line);
+            if (seenPositions.has(position))
+                continue;
+            seenPositions.add(position);
+        }
+        out.push(line);
+    }
+    out.sort(compareLinePosition);
+    return out;
+}
 /**
  * Resolve submitted ranges against the session, then sort by source position and
  * merge overlaps so each physical row is visited once (#901 source order).
@@ -244,88 +438,110 @@ async function projectSessionRanges(input) {
     return { lines, unparsable };
 }
 /**
- * Reproject the unique diary file from the submitted bounds + optional amendments.
- * Header + locating fields may change; dialogue text is taken from the source
- * (or from a typed amendment). Does not append; the whole file is the projection.
- * Persistence goes through the Sitian volume seam (rewriteSitianVolume).
+ * Reproject the unique diary from cumulative bounds + optional amendments.
+ * #918：已投影行即卷宗——按 s,line 结转；本轮只读 prior 未声明的 range（或新
+ * session 区间）。精确重复提交＝幂等 no-op，不因历史源不可读而失败。
+ * amendments 只在本轮读取的新范围确有对应坏行时生效；空 sessions 保持 no-op。
+ * 证不出的 body 原字节经 unprojectedRaw 原样留存。
+ * Persistence appends one immutable commit through the Sitian appender seam.
  */
 export async function reprojectTicketProvenance(input) {
-    const recordInput = ticketProvenanceRecordInput(input.ticketNumber, input.cwd, input.home);
     const prior = await readTicketProvenance(input.ticketNumber, input.cwd, input.home);
-    const priorRaw = await readSitianVolumeText(recordInput);
-    const priorNonEmpty = priorRaw.text !== undefined && priorRaw.text.trim() !== "";
-    const amendments = input.amendments ?? [];
-    // Empty sessions: pure empty selection preserves non-empty volume. Amendments-only
-    // continuation reuses prior header sessions — never wash into accepted no-op.
-    let sessions = input.sessions;
-    if (sessions.length === 0) {
-        if (amendments.length > 0) {
-            const priorSessions = prior.header?.sessions;
-            if (priorSessions === undefined || priorSessions.length === 0) {
-                throw new TicketProvenanceInputError("amendments require sessions bounds (none submitted and no prior header sessions)");
-            }
-            sessions = priorSessions;
-        }
-        else if (priorNonEmpty) {
-            const now = new Date().toISOString();
-            const header = prior.header ??
-                {
-                    repo: resolveBookKeyFromGit(input.cwd),
-                    ticket: input.ticketNumber,
-                    createdAt: now,
-                    updatedAt: now,
-                    sessions: [],
-                };
-            return {
-                recordFile: prior.recordFile,
-                header,
-                lines: prior.lines,
-                unparsable: [],
-            };
-        }
+    if (input.sessions.length === 0) {
+        const now = new Date().toISOString();
+        return {
+            recordFile: prior.recordFile,
+            header: prior.header ?? {
+                repo: resolveBookKeyFromGit(input.cwd),
+                ticket: input.ticketNumber,
+                createdAt: now,
+                updatedAt: now,
+                sessions: [],
+            },
+            lines: prior.lines,
+            unparsable: [],
+        };
+    }
+    const merged = mergeSessionBounds(prior.header?.sessions, input.sessions);
+    const deltas = undeclaredSessionRanges(prior.header?.sessions, merged.sessions);
+    if (deltas.length === 0) {
+        const now = new Date().toISOString();
+        return {
+            recordFile: prior.recordFile,
+            header: prior.header ?? {
+                repo: resolveBookKeyFromGit(input.cwd),
+                ticket: input.ticketNumber,
+                createdAt: now,
+                updatedAt: now,
+                sessions: merged.sessions,
+            },
+            lines: prior.lines,
+            unparsable: [],
+        };
     }
     const amendmentsByKey = new Map();
-    for (const amendment of amendments) {
-        amendmentsByKey.set(amendmentKey(amendment.s, amendment.line), amendment);
+    for (const amendment of input.amendments ?? []) {
+        const cumulativeIndex = merged.incomingIndexes[amendment.s];
+        if (cumulativeIndex === undefined)
+            continue;
+        amendmentsByKey.set(amendmentKey(cumulativeIndex, amendment.line), {
+            ...amendment,
+            s: cumulativeIndex,
+        });
     }
-    const lines = [];
+    const seenIds = new Set(prior.lines.flatMap((line) => line.id === undefined ? [] : [line.id]));
+    const fresh = [];
     const unparsable = [];
-    // First-seen native id across the whole reproject (rewritten session copies).
-    const seenIds = new Set();
-    for (let s = 0; s < sessions.length; s += 1) {
+    for (const delta of deltas) {
         const projected = await projectSessionRanges({
-            s,
-            session: sessions[s],
+            s: delta.s,
+            session: delta.session,
             amendmentsByKey,
             seenIds,
             ...(input.home === undefined ? {} : { home: input.home }),
         });
-        lines.push(...projected.lines);
+        fresh.push(...projected.lines);
         unparsable.push(...projected.unparsable);
     }
+    const lines = mergeFreshIntoCarried(prior.lines, fresh);
     const now = new Date().toISOString();
     const header = {
-        repo: resolveBookKeyFromGit(input.cwd),
+        repo: prior.header?.repo ?? resolveBookKeyFromGit(input.cwd),
         ticket: input.ticketNumber,
         createdAt: prior.header?.createdAt ?? now,
         updatedAt: now,
-        sessions,
+        sessions: merged.sessions,
     };
-    // Still-open gaps → reask without publishing a partial/rejected projection.
     if (unparsable.length > 0) {
-        return {
-            recordFile: prior.recordFile,
-            header,
-            lines,
-            unparsable,
-        };
+        return { recordFile: prior.recordFile, header, lines, unparsable };
     }
-    const body = `${[JSON.stringify(header), ...lines.map((line) => JSON.stringify(line))].join("\n")}\n`;
-    const volume = await rewriteSitianVolume({ ...recordInput, body });
+    // One immutable projection commit. Its deterministic identity makes retries of
+    // the same logical increment converge, while unrelated concurrent increments
+    // append independently and are folded by readTicketProvenance.
+    const identityMaterial = JSON.stringify({
+        ticket: input.ticketNumber,
+        deltas: deltas.map(({ s, session }) => ({
+            s,
+            path: physicalPathIdentity(session.path),
+            ranges: session.ranges,
+        })),
+        lines: fresh,
+    });
+    const identity = `ticket-provenance:${createHash("sha256").update(identityMaterial).digest("hex")}`;
+    const pointer = appendSitianRecord({
+        ...ticketProvenanceRecordInput(input.ticketNumber, input.cwd, input.home),
+        identity,
+        payload: {
+            type: "ticket-provenance-append",
+            sessions: merged.sessions,
+            lines: fresh,
+        },
+    });
+    const folded = await readTicketProvenance(input.ticketNumber, input.cwd, input.home);
     return {
-        recordFile: volume.recordFile,
-        header,
-        lines,
-        unparsable,
+        recordFile: pointer.recordFile,
+        header: folded.header ?? header,
+        lines: folded.lines,
+        unparsable: [],
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4291",
+  "version": "0.1.4321",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",