@akagilnc/pi-workflow-roles 0.1.4745 → 0.1.4772

package/dist/public-cli/post-admission.js

@@ -10,11 +10,12 @@ import { writeFile } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
 import { buildAutoResumeContinuationPrompt, buildResumeContinuationPrompt, RESUME_TRANSPORT_ENVELOPE, } from "./run-lifecycle.js";
 import { CliUsageError } from "./cli-errors.js";
-import { bindAdmittedTicketNumber, buildInstructionTransportPrompt, freezeAttachmentsIntoRun, } from "./invocation.js";
+import { bindAdmittedTicketNumber, buildInstructionTransportPrompt, freezeAttachmentsIntoRun, relocateAdmittedRunToTicket, } from "./invocation.js";
 import { readRecordedSubmissionRows } from "../submission-ledger.js";
 import { pathContainedIn } from "../activation-ledger-topology.js";
 import { pickEngineAxis } from "../package-resources/engine-material.js";
 import { resolveHostAwareSessionAvailability } from "../session-identity.js";
+import { rewriteRunDirectoryPathValue } from "../role-run-relocation.js";
 import { isOfficerReviewSeat } from "../host-contracts.js";
 import { deliverCaseDossierAsAttachment } from "./case-dossier-delivery.js";
 /** Original error bytes, never relabeled — a secondary fact riding beside a classified cause. */
@@ -35,13 +36,31 @@ function isStationChildOfficerDialogue(role, env) {
 }
 import { mintEngineDetourInvocationScope, readInvocationSelectedHost, withEngineDetourInvocationScope, } from "../engine-detour-usage.js";
 import { projectHostTransitionPriorNative } from "../host-transition-prior-native.js";
-import { missingCredentialPreDispatchFailure, postRunMissingCredentialFailure, } from "./public-run-credentials.js";
-import { acquireRunWriterLease, clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
+import { clearCurrentCourt, clearTypedProviderHttpObservation, describeErrorIdentity, markRunRunning, readCurrentCourt, recordCurrentCourt, renderResumeCommand, } from "./run-lifecycle.js";
 import { processCancelDiagnostic, processCancelSignalName, } from "./process-cancel.js";
 import { homeFromRunDirectory } from "../activation-ledger-topology.js";
 import { attemptProducedFreshSubmission, classifyPostAdmissionFailure, controlledFailureInputFromResolution, exitCodeForTerminalOutcome, explicitInternalKnownFailureClassificationInput, formatCliDiagnostic, formatTerminalResult, inspectJudgeSession, isLawfulTypedTerminalOutcome, presentFailureTerminal, presentStructuralRejection, resolveAuditedRunnerFailureResolution, resolveControlledFailureResumeObservation, settleFailureTerminalResult, settleHostEndedNoReceipt, attachRecordedSubmissions, } from "./settlement.js";
 import {} from "./terminal.js";
 import { ensureRealArtifactsDirectory, persistReturnedRunState, runWithAutoResumeLoop, TurnDispatchedFailure, } from "./auto-resume.js";
+function projectRelocatedTurnIdentity(request, result, admitted, relocation) {
+    const rewrite = (value) => rewriteRunDirectoryPathValue(value, relocation.oldRunDirectory, relocation.newRunDirectory);
+    const mutableRequest = request;
+    mutableRequest.runDirectory = admitted.runDirectory;
+    mutableRequest.principal = admitted.principal;
+    const activation = mutableRequest.activation;
+    if (activation !== null && typeof activation === "object" && !Array.isArray(activation)) {
+        for (const field of ["taskPath", "packetPath", "prerequisitesPath", "inputPath", "requestManifestPath"]) {
+            const record = activation;
+            if (field in record)
+                record[field] = rewrite(record[field]);
+        }
+    }
+    if (result.terminal !== undefined) {
+        for (const artifact of result.terminal.artifacts) {
+            artifact.path = rewrite(artifact.path);
+        }
+    }
+}
 /** #855: process-cancel settlement never re-enters auto-resume. */
 function withProcessCancelSkipAutoResume(result, signal) {
     if (processCancelSignalName(signal) === undefined) {
@@ -110,11 +129,10 @@ export const POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE = "ak_post_admission_c
  * redundant second copy (#840 bounce class 1: 同一业务规则只保留一个权威实现).
  */
 async function recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic, io) {
-    io.stderr(formatCliDiagnostic(diagnostic));
     const payload = { diagnostic, recordedAt: new Date().toISOString() };
+    let retentionFailure;
     try {
         await env.sessionAppender(env.principalAuthority, admitted.principal, POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE, payload);
-        return;
     }
     catch (appendError) {
         try {
@@ -122,9 +140,19 @@ async function recordBestEffortPostDispatchDiagnostic(admitted, env, diagnostic,
             await writeFile(join(artifactsDir, `post-admission-diagnostic-${randomUUID()}.json`), `${JSON.stringify({ version: 1, ...payload }, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
         }
         catch (artifactError) {
-            io.stderr(formatCliDiagnostic(`post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`));
+            retentionFailure =
+                `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`;
         }
     }
+    try {
+        io.stderr(formatCliDiagnostic(diagnostic));
+        if (retentionFailure !== undefined) {
+            io.stderr(formatCliDiagnostic(retentionFailure));
+        }
+    }
+    catch {
+        // Presentation is best-effort beside an already-formed host terminal.
+    }
 }
 /**
  * Factory-seat resume method-material face (#833): one authority for
@@ -325,15 +353,19 @@ export async function dispatchPostAdmissionTurn(input) {
                 if (ticketNumber !== undefined)
                     await bindAdmittedTicketNumber(admitted, ticketNumber);
             }
+            // #863: shared post-admission bind must relocate unbound→ticket in-home
+            // before lease release (work-seat self-report and any prior board bind).
+            const relocation = await relocateAdmittedRunToTicket(admitted, env.principalAuthority, lease);
+            if (relocation !== undefined) {
+                projectRelocatedTurnIdentity(request, result, admitted, relocation);
+            }
             if (adapters.afterDispatch !== undefined)
                 await adapters.afterDispatch(admitted, lease);
             return result;
         }
         catch (error) {
-            const primaryFailure = result.terminal !== undefined
-                && !isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
-            if (primaryFailure) {
-                await recordBestEffortPostDispatchDiagnostic(admitted, env, `afterDispatch failed beside primary terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
+            if (result.terminal !== undefined) {
+                await recordBestEffortPostDispatchDiagnostic(admitted, env, `afterDispatch failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
                 return result;
             }
             return {
@@ -350,13 +382,8 @@ export async function dispatchPostAdmissionTurn(input) {
         }
     };
     try {
-        const missingCredential = missingCredentialPreDispatchFailure(env.model, env.credentials);
-        if (missingCredential !== undefined) {
-            return {
-                ...(await presentControlledFailure(admitted, withEngineDetourInvocationScope(missingCredential, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState)),
-                ...deferredPersist,
-            };
-        }
+        // #987: do not pre-block or classify host dispatch from AK credential
+        // catalog facts. Per-invocation runner/host evidence owns provider identity.
         // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
         // Single authority projectHostTransitionPriorNative classifies the prior native volume.
         // Same-run resume (#637) keeps host identity on the run's invocation page.
@@ -549,11 +576,10 @@ export async function dispatchPostAdmissionTurn(input) {
             const runnerKnownFailure = adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
                 ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
                 : result.knownFailure;
-            const credentialFailure = postRunMissingCredentialFailure(result, env.model, env.credentials);
             resolution = await resolveAuditedRunnerFailureResolution({
                 runner: runnerKnownFailure,
                 sessionFile,
-                credential: credentialFailure,
+                credential: undefined,
                 runDirectory: admitted.runDirectory,
             });
             // A direct, current signal from the host/runner itself (timeout / host
@@ -573,7 +599,6 @@ export async function dispatchPostAdmissionTurn(input) {
             const directHostFailureSignal = result.timedOut
                 || result.knownFailure !== undefined
                 || runnerKnownFailure !== undefined
-                || credentialFailure !== undefined
                 || processCancelName !== undefined;
             hostSignalFailed =
                 directHostFailureSignal
@@ -679,24 +704,7 @@ export async function dispatchPostAdmissionTurn(input) {
                     await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
                 }
                 catch (error) {
-                    // #836: `settledOutcome.terminal` already carries recorded
-                    // submissions (attachRecordedSubmissions above). A real run-state
-                    // persistence failure here must surface loudly through the same
-                    // controlled-failure seam every other dispatch-time failure in
-                    // this function uses (ADR 0080: one settlement disposition owner)
-                    // — not escape uncaught to auto-resume's dispatch-retry path,
-                    // whose exhausted-budget terminal carries no recorded submissions
-                    // at all. skipRunStateWrite: the write that just threw is the same
-                    // write presentControlledFailure would otherwise retry — don't
-                    // call a known-failing operation twice.
-                    const failed = await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
-                        timedOut: false,
-                        code: null,
-                        stderr: "",
-                        thrown: error,
-                        skipRunStateWrite: true,
-                    }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-                    return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...failed, turnDispatched: true, ...deferredPersist }, env.signal));
+                    await recordBestEffortPostDispatchDiagnostic(admitted, env, `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
                 }
             }
             // Lawful persist + present is the caller's stop seam (auto-resume loop /
@@ -768,19 +776,7 @@ export async function dispatchPostAdmissionTurn(input) {
                 await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
             }
             catch (error) {
-                // #836: same run-state persistence hazard as the settled/accepted
-                // branch above — route through the shared controlled-failure seam so
-                // the real failure surfaces loudly instead of escaping uncaught to
-                // auto-resume's dispatch-retry path with no recorded submissions.
-                // skipRunStateWrite: don't retry the write that just threw.
-                const failed = await settleAfterTurnStarted(admitted, withEngineDetourInvocationScope({
-                    timedOut: false,
-                    code: null,
-                    stderr: "",
-                    thrown: error,
-                    skipRunStateWrite: true,
-                }, request.invocationScopeId), adapters, env.principalAuthority, io, persistRunState);
-                return await finishAfterTurn(withProcessCancelSkipAutoResume({ ...failed, turnDispatched: true, ...deferredPersist }, env.signal));
+                await recordBestEffortPostDispatchDiagnostic(admitted, env, `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`, io);
             }
         }
         // #855 cancel re-read lives in finishAfterTurn (before afterDispatch).
@@ -793,17 +789,20 @@ export async function dispatchPostAdmissionTurn(input) {
         });
     }
     finally {
-        try {
-            await lease.release();
-        }
-        catch (error) {
-            // lease.release() is documented best-effort and never rejects in the
-            // production acquireRunWriterLease implementation (createWriterLease
-            // reports cleanup failures via callback, never throws) — this guard is
-            // structural only: an uncaught throw from a finally block silently
-            // replaces whatever the try already returned, including a properly
-            // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
-            io.stderr(formatCliDiagnostic(`writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`));
+        // Public manual resume (#987) holds no package writer lease.
+        if (lease !== undefined) {
+            try {
+                await lease.release();
+            }
+            catch (error) {
+                // lease.release() is documented best-effort and never rejects in the
+                // production acquireRunWriterLease implementation (createWriterLease
+                // reports cleanup failures via callback, never throws) — this guard is
+                // structural only: an uncaught throw from a finally block silently
+                // replaces whatever the try already returned, including a properly
+                // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
+                io.stderr(formatCliDiagnostic(`writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`));
+            }
         }
     }
 }
@@ -951,8 +950,10 @@ export async function prepareSummonsResumeMaterials(runDirectory, summons) {
  */
 export async function runPostAdmissionSeatResume(input) {
     let request = input.request;
-    // Load once for runDirectory / structural rejection / afterAdmittedLoad;
-    // court identity is judged only after the writer lease is held (below).
+    // Load once for runDirectory / structural rejection / afterAdmittedLoad.
+    // Court identity for public manual resume is judged in the turn builder
+    // (#987: no package writer-lease gate before host CLI resume). Station-child
+    // auto-resume still acquires the shared lease in runWithAutoResumeLoop.
     let loaded;
     try {
         loaded = await input.load(request);
@@ -981,8 +982,9 @@ export async function runPostAdmissionSeatResume(input) {
     let preparedCleanup;
     const buildRequestAfterLease = async () => {
         let openCourtAttemptId;
-        // Build uses the admitted judged under this lease (rehydrated when open
-        // court materials ride). Settlement identity stays on the outer admitted.
+        // Build uses the admitted for this resume (rehydrated when open court
+        // materials ride). Settlement identity stays on the outer admitted.
+        // Name kept for station-child callers that still build under lease.
         let admittedForBuild = loaded.admitted;
         // Bare resume: open-court pointer is the continue signal (not ledger seal).
         if (request.summons === undefined) {
@@ -1043,9 +1045,10 @@ export async function runPostAdmissionSeatResume(input) {
         }
         return turnRequest;
     };
-    // Court recovery / open under lease, then dispatch.
+    // Court recovery / open, then dispatch. Public manual resume does not take a
+    // package writer lease before the host CLI (#987 / ADR 0080 one-shot).
     // Station-child same-ticket/same-parent resume is call-local auto-resume
-    // (#840 / #416). Public `ak-role resume` stays one-shot (ADR 0080).
+    // (#840 / #416) and still acquires the shared lease in its loop.
     // afterAdmittedPrepare runs inside this try so mint failure and cleanup share one finally.
     try {
         if (input.afterAdmittedPrepare !== undefined) {
@@ -1217,74 +1220,41 @@ export async function runPostAdmissionResumable(input) {
     });
 }
 /**
- * Manual resume: lease + dispatch. Pass-through to the host — no sealed-accepted
- * short-circuit (#833 / #416). Court open (summons / message / open court) is
- * built under lease when using buildRequestAfterLease; sole-final stays per-attempt.
- * After-lease build shares dispatchAfterWriterLease with station-child auto-resume.
+ * Manual resume: pass-through to the host CLI resume — no package writer-lease
+ * pre-gate (#987), no sealed-accepted short-circuit (#833 / #416). Court open
+ * (summons / message / open court) is built when using buildRequestAfterLease;
+ * sole-final stays per-attempt. Station-child auto-resume keeps shared lease
+ * acquire in runWithAutoResumeLoop + dispatchAfterWriterLease.
  */
 export async function runPostAdmissionManualResume(input) {
     const { admitted, env, io, adapters, effectiveEngine, buildRequestAfterLease, } = input;
     let request = input.request;
     // #617 DK-3: manual resume writes the live seat/env model (same as new legs).
     const effectiveModel = env.model;
-    let lease;
-    let staleWriterLeaseReclaimed;
-    try {
-        lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic, kind) => {
-            // Record the typed fact before the fallible sink: if io.stderr throws
-            // (acquire deliberately swallows diagnostic-sink failures), the reclaim
-            // still happened and must stay observable.
-            if (kind === "stale-reclaimed")
-                staleWriterLeaseReclaimed = true;
-            io.stderr(diagnostic);
-        });
-    }
-    catch (error) {
-        if (error instanceof RunWriterLeaseHeldError) {
-            io.stderr(formatCliDiagnostic(error.message));
-            // A held rejection after our own reclaim must still carry the fact that
-            // this caller reclaimed the stale lock — e.g. another resumer re-locked
-            // before our retry create (#629).
-            return {
-                exitCode: 1,
-                ...(staleWriterLeaseReclaimed === true
-                    ? { staleWriterLeaseReclaimed: true }
-                    : {}),
-            };
-        }
-        throw error;
-    }
     // Explicit public resume is a new counting unit — mint once for this call.
     const invocationScopeId = mintEngineDetourInvocationScope({
         ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
     });
-    const result = await dispatchAfterWriterLease({
-        lease,
-        build: async () => {
-            if (request === undefined) {
-                if (buildRequestAfterLease === undefined) {
-                    throw new Error("runPostAdmissionManualResume requires request or buildRequestAfterLease");
-                }
-                request = await buildRequestAfterLease();
-            }
-            request = withEngineDetourInvocationScope(request, invocationScopeId);
-            return request;
+    if (request === undefined) {
+        if (buildRequestAfterLease === undefined) {
+            throw new Error("runPostAdmissionManualResume requires request or buildRequestAfterLease");
+        }
+        request = await buildRequestAfterLease();
+    }
+    request = withEngineDetourInvocationScope(request, invocationScopeId);
+    const result = await dispatchPostAdmissionTurn({
+        admitted,
+        env: {
+            ...env,
+            ...(effectiveModel === undefined ? {} : { model: effectiveModel }),
+            ...(admitted.correlationId === undefined
+                ? {}
+                : { correlationId: admitted.correlationId }),
         },
-        dispatch: (turnRequest) => dispatchPostAdmissionTurn({
-            admitted,
-            env: {
-                ...env,
-                ...(effectiveModel === undefined ? {} : { model: effectiveModel }),
-                ...(admitted.correlationId === undefined
-                    ? {}
-                    : { correlationId: admitted.correlationId }),
-            },
-            io,
-            request: turnRequest,
-            lease,
-            adapters,
-            ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
-        }),
+        io,
+        request,
+        adapters,
+        ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
     });
     if (result.terminal !== undefined &&
         isLawfulTypedTerminalOutcome(result.terminal.roleOutcome)) {
@@ -1298,10 +1268,5 @@ export async function runPostAdmissionManualResume(input) {
     if (result.terminal !== undefined) {
         result.terminal.autoResumeCount = 0;
     }
-    return {
-        ...result,
-        ...(staleWriterLeaseReclaimed === true
-            ? { staleWriterLeaseReclaimed: true }
-            : {}),
-    };
+    return result;
 }

package/dist/public-cli/run-lifecycle.js

@@ -15,6 +15,7 @@ import { readLatestTypedProviderHttpObservation, } from "../typed-provider-http.
 export { clearTypedProviderHttpObservation, recordTypedProviderHttpStatus, readLatestTypedProviderHttpObservation, } from "../typed-provider-http.js";
 import { parseCollectorRepository } from "../collector-config.js";
 import { interpretDurableCourtTicketNumbers, sameCourtTicketNumbers, } from "../diarist-contracts.js";
+import { rewriteAdmittedRoleRunPage, rewriteRunDirectoryPathValue, } from "../role-run-relocation.js";
 import { appendEngineSessionMaterial, engineSessionMaterialFromOptions, pickEngineAxis, } from "../package-resources/engine-material.js";
 import { recordEffectiveInvocationModel, requireAuthorityRef, isReviewerLens, } from "./invocation.js";
 /** Providers eligible for v1 typed-429 resume (Codex / xAI only).
@@ -209,14 +210,15 @@ async function readRoleRunStateDisk(runDirectory) {
         return undefined;
     if (typeof record.admittedRequestPath !== "string")
         return undefined;
-    const runDir = typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
+    const storedRunDirectory = typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
         ? record.runDirectory
         : runDirectory;
+    const runDir = runDirectory;
     // Principal wire stays uninterpreted — authority owns legacy sessionFile fallback.
     const principalWire = {
-        sessionDirectory: record.sessionDirectory,
+        sessionDirectory: rewriteRunDirectoryPathValue(record.sessionDirectory, storedRunDirectory, runDirectory),
         ...(typeof record.sessionFile === "string"
-            ? { sessionFile: record.sessionFile }
+            ? { sessionFile: rewriteRunDirectoryPathValue(record.sessionFile, storedRunDirectory, runDirectory) }
             : {}),
     };
     let resumable;
@@ -242,7 +244,7 @@ async function readRoleRunStateDisk(runDirectory) {
         bookKey: record.bookKey,
         projectRoot: record.projectRoot,
         runDirectory: runDir,
-        admittedRequestPath: record.admittedRequestPath,
+        admittedRequestPath: rewriteRunDirectoryPathValue(record.admittedRequestPath, storedRunDirectory, runDirectory),
         principalWire,
         ...(phase === undefined ? {} : { phase }),
         ...(resumable === undefined ? {} : { resumable }),
@@ -1017,6 +1019,13 @@ async function loadResumableRunRecord(home, runId, authority) {
         const raw = JSON.parse(await readFile(run.admittedRequestPath, "utf8"));
         if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
             const record = raw;
+            const storedRunDirectory = typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
+                ? record.runDirectory
+                : run.runDirectory;
+            rewriteAdmittedRoleRunPage(record, [{
+                    oldRunDirectory: storedRunDirectory,
+                    newRunDirectory: run.runDirectory,
+                }]);
             if (typeof record.instruction === "string") {
                 instruction = record.instruction;
             }
@@ -1201,6 +1210,18 @@ async function loadResumableRunRecord(home, runId, authority) {
     else if (mergedSet.tickets !== undefined) {
         courtTicketNumbers = mergedSet.tickets;
     }
+    const sourceRunLeaf = basename(sourceRunPath ?? "").split("@");
+    const referencedRunId = sourceRun?.runId ?? sourceRunLeaf[0];
+    const referencedRole = sourceRun?.role ?? sourceRunLeaf[1];
+    if (referencedRunId !== undefined && referencedRunId !== "") {
+        const currentSourceRunDirectory = await findRunDirectoryById(home, referencedRunId, run.bookKey, referencedRole);
+        if (currentSourceRunDirectory !== undefined) {
+            sourceRunPath = currentSourceRunDirectory;
+            if (sourceRun !== undefined) {
+                sourceRun = { ...sourceRun, runDirectory: currentSourceRunDirectory };
+            }
+        }
+    }
     return {
         run,
         principal,

package/dist/role-run-relocation.js

@@ -132,6 +132,21 @@ function rewriteSummonsMaterials(value, rewrites) {
         value.attachmentPaths = value.attachmentPaths.map((path) => rewriteRunDirectoryPathValueAgainstRewrites(path, rewrites));
     }
 }
+/** Project one admitted page in memory after its containing run moved. */
+export function rewriteAdmittedRoleRunPage(page, rewrites) {
+    rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_FIELDS, rewrites);
+    rewriteSourceRunLocator(page.sourceRun, rewrites);
+    if (Array.isArray(page.attachments)) {
+        for (const attachment of page.attachments) {
+            if (isPlainObject(attachment)) {
+                rewriteRunDirectoryPathFieldsAgainstRewrites(attachment, ["frozenPath"], rewrites);
+            }
+        }
+    }
+    if (isPlainObject(page.principal)) {
+        rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, ["sessionDirectory", "sessionFile"], rewrites);
+    }
+}
 async function rewriteJsonObjectFile(path, fields, rewrites) {
     if (!existsSync(path))
         return;
@@ -307,9 +322,9 @@ async function rewriteNestedMachinePathPages(pagesDirectory, rewrites) {
 /**
  * Rewrite admitted-request / invocation / run-state path fields (attachment
  * frozenPath / summons.attachmentPaths pointers only), then nested package-owned
- * session seams, after the run directory has already been moved or copied.
- * `pagesDirectory` is where the pages now live; path strings still naming an
- * old run directory become the matching new directory. `crossRunRewrites`
+ * session seams. Callers may rewrite before or after the filesystem move/copy:
+ * `pagesDirectory` is where the pages currently live on disk; path strings that
+ * still name `oldRunDirectory` become `newRunDirectory`. `crossRunRewrites`
  * covers officer/parent pointers that landed under a different final placement.
  */
 export async function rewriteRoleRunDurablePages(input) {
@@ -318,21 +333,7 @@ export async function rewriteRoleRunDurablePages(input) {
     const admittedPath = join(pagesDirectory, "admitted-request.json");
     if (existsSync(admittedPath)) {
         const page = JSON.parse(await readFile(admittedPath, "utf8"));
-        rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_FIELDS, rewrites);
-        // Nested notary typed locator — same value family as top-level sourceRunPath.
-        rewriteSourceRunLocator(page.sourceRun, rewrites);
-        if (Array.isArray(page.attachments)) {
-            for (const attachment of page.attachments) {
-                if (isPlainObject(attachment)) {
-                    // Pointer only — never open or mutate frozen attachment bytes.
-                    rewriteRunDirectoryPathFieldsAgainstRewrites(attachment, ["frozenPath"], rewrites);
-                }
-            }
-        }
-        // Nested principal wire (sessionDirectory/sessionFile) when present.
-        if (isPlainObject(page.principal)) {
-            rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, ["sessionDirectory", "sessionFile"], rewrites);
-        }
+        rewriteAdmittedRoleRunPage(page, rewrites);
         await writeFile(admittedPath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
     }
     const invocationPath = join(pagesDirectory, "invocation.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.4745",
+  "version": "0.1.4772",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/book-topology-migration-placement.ts

@@ -397,7 +397,15 @@ export async function findPlacedMigratingRun(
     const preferred = destPathFromSourceRelative(booksDirectory, bookKey, sourceRelative);
     if (preferred !== undefined) {
       const hit = matches.find((path) => path === preferred);
-      return hit === undefined ? undefined : placedRunFromPath(hit);
+      if (hit !== undefined) return placedRunFromPath(hit);
+      // T9 may have used the board ticket to move an historical unbound leaf
+      // under `<ticket>/runs`. The complete leaf is the placement identity;
+      // when it remains unique, downstream record/mixed/T11 consumers must
+      // follow that authoritative T9 result rather than re-derive unbound.
+      if (sourceRelative.replaceAll("\\", "/").startsWith("unbound/runs/")) {
+        return uniquePlacedRun(leafName, matches);
+      }
+      return undefined;
     }
     // Historical flat `runs/<leaf>` alias after T9 nested the unique complete leaf.
     if (isFlatRunsRelative(sourceRelative, leafName)) {