@akagilnc/pi-workflow-roles 0.1.4745 → 0.1.4772

package/src/book-topology-runs-migrator.ts

@@ -2,9 +2,10 @@
  * #865 T9: migrate retained runs into ticket-scoped or unbound placement.
  * Inventory covers legacy flat `runs/`, existing `<ticket>/runs/`, and
  * `unbound/runs/`. Attribution reuses the shared migrating-run helper;
- * already-canonical trees copy as-is.
+ * already-canonical ticket trees copy as-is. Unbound leaves that already
+ * hold a board typed ticketNumber place under that ticket (#863 stock).
  */
-import { cp, mkdir, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, rename, readdir, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join, relative, sep } from "node:path";
 
 import {
@@ -16,16 +17,21 @@ import {
   resolveMigratingRunTicket,
 } from "./book-topology-migration-placement.ts";
 import {
+  assertBookTopologyMigrationPrerequisites,
   reconcileMigrationPartition,
   type BookTopologyMigrationContext,
   type BookTopologyPartitionMigrator,
   type MigrationItemOutcome,
 } from "./book-topology-migration.ts";
+import { listBookRunDirectories } from "./role-run-placement.ts";
 import {
   rewriteRoleRunDurablePages,
   type RunDirectoryPathRewrite,
 } from "./role-run-relocation.ts";
-import { MIGRATION_TICKET_DERIVATION_PAGE } from "./run-ticket-number.ts";
+import {
+  MIGRATION_TICKET_DERIVATION_PAGE,
+  readBoardTicketNumber,
+} from "./run-ticket-number.ts";
 
 const RUNS_PARTITION = "runs";
 
@@ -141,9 +147,38 @@ async function planBookMoves(
         historicalRunDirectory = join(booksDirectory, bookKey, leaf.relativePath);
       }
       derivation = undefined;
+    } else if (leaf.layout === "unbound") {
+      // #863: board typed ticket on an unbound leaf → place under that ticket.
+      // No board ticket → stay unbound. Never invent from prose or derivation.
+      const boardTicket = leaf.isDirectory
+        ? await readBoardTicketNumber(leaf.sourcePath)
+        : undefined;
+      if (parsed !== undefined && boardTicket !== undefined) {
+        targetPath = destinationRunDirectory(
+          booksDirectory,
+          bookKey,
+          boardTicket,
+          parsed.runId,
+          parsed.role,
+        );
+        disposition = "placed";
+        historicalRunDirectory = join(
+          booksDirectory,
+          bookKey,
+          "unbound",
+          "runs",
+          leaf.leafName,
+        );
+      } else {
+        targetPath = join(booksDirectory, bookKey, leaf.relativePath);
+        disposition = "unbound";
+        historicalRunDirectory = undefined;
+      }
+      derivation = undefined;
     } else if (leaf.layout !== "flat") {
+      // Already-canonical `<ticket>/runs/` — copy as-is.
       targetPath = join(booksDirectory, bookKey, leaf.relativePath);
-      disposition = leaf.layout === "unbound" ? "unbound" : "placed";
+      disposition = "placed";
       historicalRunDirectory = undefined;
       derivation = undefined;
     } else if (parsed === undefined) {
@@ -242,3 +277,120 @@ export const bookTopologyRunsMigrator: BookTopologyPartitionMigrator = {
     return reconcileMigrationPartition(RUNS_PARTITION, "entries", outcomes);
   },
 };
+
+export type BoardBoundUnboundRelocation = {
+  readonly from: string;
+  readonly to: string;
+  readonly ticketNumber: number;
+};
+
+type PlannedBoardBoundMove = {
+  readonly sourcePath: string;
+  readonly targetPath: string;
+  readonly ticketNumber: number;
+};
+
+/**
+ * Live in-place repair for already-migrated trees (#863 stock): plan the full
+ * board-bound unbound→ticket batch first, refuse any overwrite before mutation,
+ * rewrite durable pages (including batch `crossRunRewrites`) while sources still
+ * sit at unbound, then rename. Parse/write failures therefore leave sources in
+ * place so a retry can finish the same closure; rename-only retries still find
+ * remaining unbound sources. Leaves without a board ticket stay unbound.
+ */
+export async function relocateBoardBoundUnboundRunsInBook(
+  bookDirectory: string,
+): Promise<readonly BoardBoundUnboundRelocation[]> {
+  const bookKey = basename(bookDirectory);
+  const booksDirectory = dirname(bookDirectory);
+  const unboundRuns = join(bookDirectory, "unbound", "runs");
+  let entries;
+  try {
+    entries = await readdir(unboundRuns, { withFileTypes: true });
+  } catch (error) {
+    if (isMigrationEnoent(error)) return [];
+    throw error;
+  }
+
+  const planned: PlannedBoardBoundMove[] = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const parsed = parseRunLeaf(entry.name);
+    if (parsed === undefined) continue;
+    const sourcePath = join(unboundRuns, entry.name);
+    const boardTicket = await readBoardTicketNumber(sourcePath);
+    if (boardTicket === undefined) continue;
+    const targetPath = destinationRunDirectory(
+      booksDirectory,
+      bookKey,
+      boardTicket,
+      parsed.runId,
+      parsed.role,
+    );
+    planned.push({
+      sourcePath,
+      targetPath,
+      ticketNumber: boardTicket,
+    });
+  }
+
+  if (planned.length === 0) return [];
+
+  for (const move of planned) {
+    if (await pathExists(move.targetPath)) {
+      throw new Error(
+        `board-bound unbound relocate refuses to overwrite ${move.targetPath} with ${move.sourcePath}`,
+      );
+    }
+  }
+
+  const crossRunRewrites: RunDirectoryPathRewrite[] = planned.map((move) => ({
+    oldRunDirectory: move.sourcePath,
+    newRunDirectory: move.targetPath,
+  }));
+  const relocatedBySource = new Map(
+    planned.map((move) => [move.sourcePath, move] as const),
+  );
+
+  // Rewrite before any rename so durable-page failures remain retryable from
+  // the same unbound sources (failure-honesty: no relocatedCount=0 whitewash).
+  for (const runDir of await listBookRunDirectories(bookDirectory)) {
+    const move = relocatedBySource.get(runDir);
+    await rewriteRoleRunDurablePages({
+      pagesDirectory: runDir,
+      oldRunDirectory: move?.sourcePath ?? runDir,
+      newRunDirectory: move?.targetPath ?? runDir,
+      crossRunRewrites,
+    });
+  }
+
+  for (const move of planned) {
+    await mkdir(dirname(move.targetPath), { recursive: true });
+    await rename(move.sourcePath, move.targetPath);
+  }
+
+  return planned.map((move) => ({
+    from: move.sourcePath,
+    to: move.targetPath,
+    ticketNumber: move.ticketNumber,
+  }));
+}
+
+/**
+ * Walk every book under `booksDirectory` and relocate board-bound unbound
+ * runs in place. Requires zero live writer locks (same gate as topology migrate).
+ */
+export async function relocateBoardBoundUnboundRunsInBooks(
+  booksDirectory: string,
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<readonly BoardBoundUnboundRelocation[]> {
+  await assertBookTopologyMigrationPrerequisites(booksDirectory, env);
+  const relocated: BoardBoundUnboundRelocation[] = [];
+  for (const bookKey of await listMigrationBookKeys(booksDirectory)) {
+    const batch = await relocateBoardBoundUnboundRunsInBook(
+      join(booksDirectory, bookKey),
+    );
+    relocated.push(...batch);
+  }
+  return relocated;
+}

package/src/notary-source-run.ts

@@ -87,7 +87,8 @@ export async function resolveNotarySourceRunLocator(options: {
 
   const ledgerHome = resolveActivationLedgerHome(options.home);
   const bookKey = resolveBookKeyFromGit(options.projectRoot);
-  const bookRunsRoot = join(activationBookDirectory(ledgerHome, bookKey), "runs");
+  const bookDirectory = activationBookDirectory(ledgerHome, bookKey);
+  const bookRunsRoot = join(bookDirectory, "runs");
 
   let candidate: string;
   const bare = parseRunDirectoryName(raw);
@@ -96,12 +97,27 @@ export async function resolveNotarySourceRunLocator(options: {
       ?? join(bookRunsRoot, `${bare.runId}@${bare.role}`);
   } else {
     candidate = isAbsolute(raw) ? raw : resolve(options.projectRoot, raw);
+    const identity = parseRunDirectoryName(basename(candidate));
+    const subjectDirectory = dirname(dirname(candidate));
+    const isLegacyUnboundLocator =
+      identity !== undefined &&
+      basename(dirname(candidate)) === "runs" &&
+      basename(subjectDirectory) === "unbound" &&
+      resolve(dirname(subjectDirectory)) === resolve(bookDirectory);
+    if (isLegacyUnboundLocator) {
+      candidate = (await findRunDirectoryById(
+        options.home,
+        identity.runId,
+        bookKey,
+        identity.role,
+      )) ?? candidate;
+    }
   }
 
   const real = await requireRunDirectory(candidate, raw);
   const identity = parseRunDirectoryName(basename(real))!;
 
-  const bookIdentity = physicalPathIdentity(activationBookDirectory(ledgerHome, bookKey));
+  const bookIdentity = physicalPathIdentity(bookDirectory);
   const parentIdentity = physicalPathIdentity(dirname(real));
   const subjectBookIdentity = physicalPathIdentity(dirname(dirname(dirname(real))));
   if (

package/src/public-cli/cli.ts

@@ -124,7 +124,6 @@ const RESUME_SEAT_DISPATCH: Record<
     ) => Promise<{
       exitCode: number;
       terminal?: TerminalResult;
-      staleWriterLeaseReclaimed?: true;
     }>;
   }
 > = {
@@ -473,19 +472,15 @@ export type CliResult = {
   /** Settled Terminal when an admitted Role run produced one (programmatic/tests). */
   terminal?: TerminalResult;
   hostFailure?: HostSelectionFailure;
-  /** Typed #556 fact from public resume/dispatch when a dead holder lock was unlinked. */
-  staleWriterLeaseReclaimed?: true;
 };
 
 function cliResultFromRoleRun(result: {
   exitCode: number;
   terminal?: TerminalResult;
-  staleWriterLeaseReclaimed?: true;
 }): CliResult {
   return {
     exitCode: result.exitCode,
     ...(result.terminal === undefined ? {} : { terminal: result.terminal }),
-    ...(result.staleWriterLeaseReclaimed === true ? { staleWriterLeaseReclaimed: true as const } : {}),
   };
 }
 

package/src/public-cli/config.ts

@@ -813,7 +813,6 @@ export function listRolesForDisplay(
 
 /**
  * Read configured credential presence from a Pi auth.json document.
- * Presence drives the selected-provider fail-closed seam (public-run-credentials).
  */
 export function credentialProvidersFromAuthData(
   data: unknown,

package/src/public-cli/countersign-run.ts

@@ -785,7 +785,7 @@ export async function runPublicCountersign(
 function countersignAdapters(options?: {
   beforeDispatch?: (
     admitted: AdmittedCountersignInvocation,
-    lease: RunWriterLease,
+    lease?: RunWriterLease,
   ) => void | Promise<void>;
 }) {
   return {

package/src/public-cli/diarist-run.ts

@@ -76,7 +76,7 @@ export function buildDiaristTurnRequest(
 async function bindAndRelocateDiaristIfBoardBound(
   admitted: AdmittedDiaristInvocation,
   authority: DiaristRunEnv["principalAuthority"],
-  lease: RunWriterLease,
+  lease?: RunWriterLease,
 ): Promise<void> {
   const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
   if (boardTicket === undefined) return;

package/src/public-cli/invocation.ts

@@ -41,7 +41,6 @@ import {
   requireSafePositiveTicketNumber,
 } from "../run-ticket-number.ts";
 import {
-  rewriteRoleRunDurablePages,
   rewriteRunDirectoryPathFields,
   rewriteRunDirectoryPathValue,
 } from "../role-run-relocation.ts";
@@ -628,8 +627,8 @@ export async function relocateAdmittedRunToTicket(
   admitted: AdmittedRoleInvocation,
   authority: DurablePrincipalAuthority,
   heldLease?: { relocate(runDirectory: string): void },
-): Promise<void> {
-  if (admitted.ticketNumber === undefined || !admitted.runDirectory.includes(`${sep}unbound${sep}runs${sep}`)) return;
+): Promise<{ oldRunDirectory: string; newRunDirectory: string } | undefined> {
+  if (admitted.ticketNumber === undefined || !admitted.runDirectory.includes(`${sep}unbound${sep}runs${sep}`)) return undefined;
   const oldRunDirectory = admitted.runDirectory;
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(oldRunDirectory));
   const target = roleRunPlacement(ledgerHome, {
@@ -639,7 +638,17 @@ export async function relocateAdmittedRunToTicket(
     role: admitted.role,
   });
   ensureRoleRunDirectory(ledgerHome, dirname(target.runDirectory));
+  // Host sealing is pure identity projection, but may reject the coordinates.
+  // Keep that failure before the filesystem commit point.
+  const principal = authority.seal(target);
+
+  // Rename is the only durable commit. Persisted paths are resolved from typed
+  // run identity on read, so online relocation never writes unleased peers or
+  // pretends a directory rename plus page rewrites form one transaction.
   await rename(oldRunDirectory, target.runDirectory);
+
+  // rename moved the open lock inode with the directory. Transfer cleanup
+  // ownership immediately after the commit.
   heldLease?.relocate(target.runDirectory);
 
   const admittedRecord = admitted as unknown as Record<string, unknown>;
@@ -664,14 +673,9 @@ export async function relocateAdmittedRunToTicket(
       target.runDirectory,
     ) as string;
   }
-  const principal = authority.seal(target);
   (admitted as { principal: DurablePrincipal }).principal = principal;
 
-  await rewriteRoleRunDurablePages({
-    pagesDirectory: target.runDirectory,
-    oldRunDirectory,
-    newRunDirectory: target.runDirectory,
-  });
+  return { oldRunDirectory, newRunDirectory: target.runDirectory };
 }
 
 /**