@akagilnc/pi-workflow-roles 0.1.4745 → 0.1.4772

package/src/public-cli/post-admission.ts

@@ -22,11 +22,13 @@ import {
   bindAdmittedTicketNumber,
   buildInstructionTransportPrompt,
   freezeAttachmentsIntoRun,
+  relocateAdmittedRunToTicket,
 } from "./invocation.ts";
 import { readRecordedSubmissionRows } from "../submission-ledger.ts";
 import { pathContainedIn } from "../activation-ledger-topology.ts";
 import { pickEngineAxis } from "../package-resources/engine-material.ts";
 import { resolveHostAwareSessionAvailability } from "../session-identity.ts";
+import { rewriteRunDirectoryPathValue } from "../role-run-relocation.ts";
 
 import type {
   ControlledFailureCause,
@@ -69,11 +71,6 @@ import {
 import { projectHostTransitionPriorNative } from "../host-transition-prior-native.ts";
 import type { CredentialProviders, SeatModelConfig } from "./config.ts";
 import {
-  missingCredentialPreDispatchFailure,
-  postRunMissingCredentialFailure,
-} from "./public-run-credentials.ts";
-import {
-  acquireRunWriterLease,
   clearCurrentCourt,
   clearTypedProviderHttpObservation,
   describeErrorIdentity,
@@ -81,11 +78,9 @@ import {
   readCurrentCourt,
   recordCurrentCourt,
   renderResumeCommand,
-  RunWriterLeaseHeldError,
   type CurrentCourtState,
   type RunWriterLease,
   type TypedProviderHttpObservation,
-  type WriterLeaseDiagnosticKind,
 } from "./run-lifecycle.ts";
 import {
   processCancelDiagnostic,
@@ -124,6 +119,34 @@ import {
   TurnDispatchedFailure,
 } from "./auto-resume.ts";
 
+function projectRelocatedTurnIdentity(
+  request: RoleTurnRequest,
+  result: { readonly terminal?: TerminalResult },
+  admitted: AdmittedRoleInvocation,
+  relocation: { readonly oldRunDirectory: string; readonly newRunDirectory: string },
+): void {
+  const rewrite = (value: unknown) => rewriteRunDirectoryPathValue(
+    value,
+    relocation.oldRunDirectory,
+    relocation.newRunDirectory,
+  );
+  const mutableRequest = request as unknown as Record<string, unknown>;
+  mutableRequest.runDirectory = admitted.runDirectory;
+  mutableRequest.principal = admitted.principal;
+  const activation = mutableRequest.activation;
+  if (activation !== null && typeof activation === "object" && !Array.isArray(activation)) {
+    for (const field of ["taskPath", "packetPath", "prerequisitesPath", "inputPath", "requestManifestPath"] as const) {
+      const record = activation as Record<string, unknown>;
+      if (field in record) record[field] = rewrite(record[field]);
+    }
+  }
+  if (result.terminal !== undefined) {
+    for (const artifact of result.terminal.artifacts) {
+      artifact.path = rewrite(artifact.path) as string;
+    }
+  }
+}
+
 /** #855: process-cancel settlement never re-enters auto-resume. */
 function withProcessCancelSkipAutoResume<T extends object>(
   result: T,
@@ -234,8 +257,8 @@ async function recordBestEffortPostDispatchDiagnostic<A extends AdmittedRoleInvo
   diagnostic: string,
   io: CliIo,
 ): Promise<void> {
-  io.stderr(formatCliDiagnostic(diagnostic));
   const payload = { diagnostic, recordedAt: new Date().toISOString() };
+  let retentionFailure: string | undefined;
   try {
     await env.sessionAppender(
       env.principalAuthority,
@@ -243,7 +266,6 @@ async function recordBestEffortPostDispatchDiagnostic<A extends AdmittedRoleInvo
       POST_ADMISSION_CLEANUP_DIAGNOSTIC_ENTRY_TYPE,
       payload,
     );
-    return;
   } catch (appendError) {
     try {
       const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
@@ -253,13 +275,18 @@ async function recordBestEffortPostDispatchDiagnostic<A extends AdmittedRoleInvo
         { encoding: "utf8", flag: "wx" },
       );
     } catch (artifactError) {
-      io.stderr(
-        formatCliDiagnostic(
-          `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`,
-        ),
-      );
+      retentionFailure =
+        `post-dispatch diagnostic durable retention failed on both channels (best-effort continue): dossier=${describeErrorIdentity(appendError)}; artifact=${describeErrorIdentity(artifactError)}`;
     }
   }
+  try {
+    io.stderr(formatCliDiagnostic(diagnostic));
+    if (retentionFailure !== undefined) {
+      io.stderr(formatCliDiagnostic(retentionFailure));
+    }
+  } catch {
+    // Presentation is best-effort beside an already-formed host terminal.
+  }
 }
 
 export type PostAdmissionEnv = {
@@ -327,13 +354,14 @@ export type PostAdmissionAdapters<
     result: RoleTurnResult;
     sessionFile: string;
   }) => Promise<RoleTurnKnownFailure | undefined>;
-  beforeDispatch?: (admitted: A, lease: RunWriterLease) => Promise<void> | void;
+  beforeDispatch?: (admitted: A, lease?: RunWriterLease) => Promise<void> | void;
   /**
-   * After the host turn settles and before the writer lease is released.
-   * Post-turn bind/relocate (e.g. Diarist first assert) must run here so the
-   * held lease follows the run directory and failures stay controlled.
+   * After the host turn settles and before any held writer lease is released.
+   * Post-turn bind/relocate (e.g. Diarist first assert) must run here so a
+   * held lease (when present) follows the run directory and failures stay
+   * controlled. Public manual resume (#987) may omit the lease.
    */
-  afterDispatch?: (admitted: A, lease: RunWriterLease) => Promise<void> | void;
+  afterDispatch?: (admitted: A, lease?: RunWriterLease) => Promise<void> | void;
 };
 
 export type ControlledFailureInput = {
@@ -614,7 +642,8 @@ export async function dispatchPostAdmissionTurn<
   env: PostAdmissionEnv;
   io: CliIo;
   request: RoleTurnRequest;
-  lease: RunWriterLease;
+  /** Absent on public manual resume (#987): no package lease gate before host CLI resume. */
+  lease?: RunWriterLease;
   adapters: PostAdmissionAdapters<A, T>;
   effectiveEngine?: string;
   persistRunState?: boolean;
@@ -704,17 +733,20 @@ export async function dispatchPostAdmissionTurn<
           : (asserted as { ticketNumber: number }).ticketNumber;
         if (ticketNumber !== undefined) await bindAdmittedTicketNumber(admitted, ticketNumber);
       }
+      // #863: shared post-admission bind must relocate unbound→ticket in-home
+      // before lease release (work-seat self-report and any prior board bind).
+      const relocation = await relocateAdmittedRunToTicket(admitted, env.principalAuthority, lease);
+      if (relocation !== undefined) {
+        projectRelocatedTurnIdentity(request, result, admitted, relocation);
+      }
       if (adapters.afterDispatch !== undefined) await adapters.afterDispatch(admitted, lease);
       return result;
     } catch (error) {
-      const primaryFailure =
-        result.terminal !== undefined
-        && !isLawfulTypedTerminalOutcome(result.terminal.roleOutcome);
-      if (primaryFailure) {
+      if (result.terminal !== undefined) {
         await recordBestEffortPostDispatchDiagnostic(
           admitted,
           env,
-          `afterDispatch failed beside primary terminal (best-effort continue): ${describeErrorIdentity(error)}`,
+          `afterDispatch failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`,
           io,
         );
         return result;
@@ -740,23 +772,8 @@ export async function dispatchPostAdmissionTurn<
     }
   };
   try {
-    const missingCredential = missingCredentialPreDispatchFailure(
-      env.model,
-      env.credentials,
-    );
-    if (missingCredential !== undefined) {
-      return {
-        ...(await presentControlledFailure(
-          admitted,
-          withEngineDetourInvocationScope(missingCredential, request.invocationScopeId),
-          adapters,
-          env.principalAuthority,
-          io,
-          persistRunState,
-        )) as { exitCode: number; admitted: A; terminal: T },
-        ...deferredPersist,
-      };
-    }
+    // #987: do not pre-block or classify host dispatch from AK credential
+    // catalog facts. Per-invocation runner/host evidence owns provider identity.
     // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
     // Single authority projectHostTransitionPriorNative classifies the prior native volume.
     // Same-run resume (#637) keeps host identity on the run's invocation page.
@@ -1001,15 +1018,10 @@ export async function dispatchPostAdmissionTurn<
         adapters.resolveRunnerKnownFailure !== undefined && sessionFile !== ""
           ? await adapters.resolveRunnerKnownFailure({ result, sessionFile })
           : result.knownFailure;
-      const credentialFailure = postRunMissingCredentialFailure(
-        result,
-        env.model,
-        env.credentials,
-      );
       resolution = await resolveAuditedRunnerFailureResolution({
         runner: runnerKnownFailure,
         sessionFile,
-        credential: credentialFailure,
+        credential: undefined,
         runDirectory: admitted.runDirectory,
       });
       // A direct, current signal from the host/runner itself (timeout / host
@@ -1030,7 +1042,6 @@ export async function dispatchPostAdmissionTurn<
         result.timedOut
         || result.knownFailure !== undefined
         || runnerKnownFailure !== undefined
-        || credentialFailure !== undefined
         || processCancelName !== undefined;
       hostSignalFailed =
         directHostFailureSignal
@@ -1153,35 +1164,11 @@ export async function dispatchPostAdmissionTurn<
         try {
           await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
         } catch (error) {
-          // #836: `settledOutcome.terminal` already carries recorded
-          // submissions (attachRecordedSubmissions above). A real run-state
-          // persistence failure here must surface loudly through the same
-          // controlled-failure seam every other dispatch-time failure in
-          // this function uses (ADR 0080: one settlement disposition owner)
-          // — not escape uncaught to auto-resume's dispatch-retry path,
-          // whose exhausted-budget terminal carries no recorded submissions
-          // at all. skipRunStateWrite: the write that just threw is the same
-          // write presentControlledFailure would otherwise retry — don't
-          // call a known-failing operation twice.
-          const failed = await settleAfterTurnStarted(
-          admitted,
-          withEngineDetourInvocationScope({
-              timedOut: false,
-              code: null,
-              stderr: "",
-              thrown: error,
-              skipRunStateWrite: true,
-            }, request.invocationScopeId),
-            adapters,
-            env.principalAuthority,
+          await recordBestEffortPostDispatchDiagnostic(
+            admitted,
+            env,
+            `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`,
             io,
-            persistRunState,
-          );
-          return await finishAfterTurn(
-            withProcessCancelSkipAutoResume(
-              { ...failed, turnDispatched: true as const, ...deferredPersist },
-              env.signal,
-            ),
           );
         }
       }
@@ -1282,30 +1269,11 @@ export async function dispatchPostAdmissionTurn<
       try {
         await persistReturnedRunState(admitted, env.principalAuthority, { lawful: true });
       } catch (error) {
-        // #836: same run-state persistence hazard as the settled/accepted
-        // branch above — route through the shared controlled-failure seam so
-        // the real failure surfaces loudly instead of escaping uncaught to
-        // auto-resume's dispatch-retry path with no recorded submissions.
-        // skipRunStateWrite: don't retry the write that just threw.
-        const failed = await settleAfterTurnStarted(
+        await recordBestEffortPostDispatchDiagnostic(
           admitted,
-          withEngineDetourInvocationScope({
-            timedOut: false,
-            code: null,
-            stderr: "",
-            thrown: error,
-            skipRunStateWrite: true,
-          }, request.invocationScopeId),
-          adapters,
-          env.principalAuthority,
+          env,
+          `run-state persistence failed beside host terminal (best-effort continue): ${describeErrorIdentity(error)}`,
           io,
-          persistRunState,
-        );
-        return await finishAfterTurn(
-          withProcessCancelSkipAutoResume(
-            { ...failed, turnDispatched: true as const, ...deferredPersist },
-            env.signal,
-          ),
         );
       }
     }
@@ -1318,20 +1286,23 @@ export async function dispatchPostAdmissionTurn<
       ...deferredPersist,
     });
   } finally {
-    try {
-      await lease.release();
-    } catch (error) {
-      // lease.release() is documented best-effort and never rejects in the
-      // production acquireRunWriterLease implementation (createWriterLease
-      // reports cleanup failures via callback, never throws) — this guard is
-      // structural only: an uncaught throw from a finally block silently
-      // replaces whatever the try already returned, including a properly
-      // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
-      io.stderr(
-        formatCliDiagnostic(
-          `writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`,
-        ),
-      );
+    // Public manual resume (#987) holds no package writer lease.
+    if (lease !== undefined) {
+      try {
+        await lease.release();
+      } catch (error) {
+        // lease.release() is documented best-effort and never rejects in the
+        // production acquireRunWriterLease implementation (createWriterLease
+        // reports cleanup failures via callback, never throws) — this guard is
+        // structural only: an uncaught throw from a finally block silently
+        // replaces whatever the try already returned, including a properly
+        // tagged turnDispatched:true result (#840 r9 判词 class 1 boundary).
+        io.stderr(
+          formatCliDiagnostic(
+            `writer lease release failed unexpectedly (best-effort continue): ${describeErrorIdentity(error)}`,
+          ),
+        );
+      }
     }
   }
 }
@@ -1543,8 +1514,10 @@ export async function runPostAdmissionSeatResume<
 }): Promise<{ exitCode: number; admitted?: A; terminal?: T }> {
   let request = input.request;
 
-  // Load once for runDirectory / structural rejection / afterAdmittedLoad;
-  // court identity is judged only after the writer lease is held (below).
+  // Load once for runDirectory / structural rejection / afterAdmittedLoad.
+  // Court identity for public manual resume is judged in the turn builder
+  // (#987: no package writer-lease gate before host CLI resume). Station-child
+  // auto-resume still acquires the shared lease in runWithAutoResumeLoop.
   let loaded;
   try {
     loaded = await input.load(request);
@@ -1575,8 +1548,9 @@ export async function runPostAdmissionSeatResume<
 
   const buildRequestAfterLease = async (): Promise<RoleTurnRequest> => {
         let openCourtAttemptId: string | undefined;
-        // Build uses the admitted judged under this lease (rehydrated when open
-        // court materials ride). Settlement identity stays on the outer admitted.
+        // Build uses the admitted for this resume (rehydrated when open court
+        // materials ride). Settlement identity stays on the outer admitted.
+        // Name kept for station-child callers that still build under lease.
         let admittedForBuild = loaded.admitted;
 
         // Bare resume: open-court pointer is the continue signal (not ledger seal).
@@ -1652,9 +1626,10 @@ export async function runPostAdmissionSeatResume<
     return turnRequest;
   };
 
-  // Court recovery / open under lease, then dispatch.
+  // Court recovery / open, then dispatch. Public manual resume does not take a
+  // package writer lease before the host CLI (#987 / ADR 0080 one-shot).
   // Station-child same-ticket/same-parent resume is call-local auto-resume
-  // (#840 / #416). Public `ak-role resume` stays one-shot (ADR 0080).
+  // (#840 / #416) and still acquires the shared lease in its loop.
   // afterAdmittedPrepare runs inside this try so mint failure and cleanup share one finally.
   try {
     if (input.afterAdmittedPrepare !== undefined) {
@@ -1873,10 +1848,11 @@ export async function runPostAdmissionResumable<
 }
 
 /**
- * Manual resume: lease + dispatch. Pass-through to the host — no sealed-accepted
- * short-circuit (#833 / #416). Court open (summons / message / open court) is
- * built under lease when using buildRequestAfterLease; sole-final stays per-attempt.
- * After-lease build shares dispatchAfterWriterLease with station-child auto-resume.
+ * Manual resume: pass-through to the host CLI resume — no package writer-lease
+ * pre-gate (#987), no sealed-accepted short-circuit (#833 / #416). Court open
+ * (summons / message / open court) is built when using buildRequestAfterLease;
+ * sole-final stays per-attempt. Station-child auto-resume keeps shared lease
+ * acquire in runWithAutoResumeLoop + dispatchAfterWriterLease.
  */
 export async function runPostAdmissionManualResume<
   A extends AdmittedRoleInvocation,
@@ -1885,9 +1861,9 @@ export async function runPostAdmissionManualResume<
   admitted: A;
   env: PostAdmissionEnv;
   io: CliIo;
-  /** Eager turn request (non-court path / seats that build before lease). */
+  /** Eager turn request (non-court path / seats that build before dispatch). */
   request?: RoleTurnRequest;
-  /** After-lease builder (#637). Mutually exclusive with a prebuilt request. */
+  /** Turn builder (#637). Mutually exclusive with a prebuilt request. */
   buildRequestAfterLease?: () => Promise<RoleTurnRequest>;
   adapters: PostAdmissionAdapters<A, T>;
   /** Seat-table engine axis on resume (#600). */
@@ -1896,7 +1872,6 @@ export async function runPostAdmissionManualResume<
   exitCode: number;
   admitted?: A;
   terminal?: T;
-  staleWriterLeaseReclaimed?: true;
 }> {
   const {
     admitted,
@@ -1910,67 +1885,34 @@ export async function runPostAdmissionManualResume<
   // #617 DK-3: manual resume writes the live seat/env model (same as new legs).
   const effectiveModel = env.model;
 
-  let lease: RunWriterLease;
-  let staleWriterLeaseReclaimed: true | undefined;
-  try {
-    lease = await acquireRunWriterLease(admitted.runDirectory, (diagnostic, kind?: WriterLeaseDiagnosticKind) => {
-      // Record the typed fact before the fallible sink: if io.stderr throws
-      // (acquire deliberately swallows diagnostic-sink failures), the reclaim
-      // still happened and must stay observable.
-      if (kind === "stale-reclaimed") staleWriterLeaseReclaimed = true;
-      io.stderr(diagnostic);
-    });
-  } catch (error) {
-    if (error instanceof RunWriterLeaseHeldError) {
-      io.stderr(formatCliDiagnostic(error.message));
-      // A held rejection after our own reclaim must still carry the fact that
-      // this caller reclaimed the stale lock — e.g. another resumer re-locked
-      // before our retry create (#629).
-      return {
-        exitCode: 1,
-        ...(staleWriterLeaseReclaimed === true
-          ? { staleWriterLeaseReclaimed: true as const }
-          : {}),
-      };
-    }
-    throw error;
-  }
-
   // Explicit public resume is a new counting unit — mint once for this call.
   const invocationScopeId = mintEngineDetourInvocationScope({
     ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
   });
 
-  const result = await dispatchAfterWriterLease({
-    lease,
-    build: async () => {
-      if (request === undefined) {
-        if (buildRequestAfterLease === undefined) {
-          throw new Error(
-            "runPostAdmissionManualResume requires request or buildRequestAfterLease",
-          );
-        }
-        request = await buildRequestAfterLease();
-      }
-      request = withEngineDetourInvocationScope(request, invocationScopeId);
-      return request;
+  if (request === undefined) {
+    if (buildRequestAfterLease === undefined) {
+      throw new Error(
+        "runPostAdmissionManualResume requires request or buildRequestAfterLease",
+      );
+    }
+    request = await buildRequestAfterLease();
+  }
+  request = withEngineDetourInvocationScope(request, invocationScopeId);
+
+  const result = await dispatchPostAdmissionTurn({
+    admitted,
+    env: {
+      ...env,
+      ...(effectiveModel === undefined ? {} : { model: effectiveModel }),
+      ...(admitted.correlationId === undefined
+        ? {}
+        : { correlationId: admitted.correlationId }),
     },
-    dispatch: (turnRequest) =>
-      dispatchPostAdmissionTurn({
-        admitted,
-        env: {
-          ...env,
-          ...(effectiveModel === undefined ? {} : { model: effectiveModel }),
-          ...(admitted.correlationId === undefined
-            ? {}
-            : { correlationId: admitted.correlationId }),
-        },
-        io,
-        request: turnRequest,
-        lease,
-        adapters,
-        ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
-      }),
+    io,
+    request,
+    adapters,
+    ...(effectiveEngine === undefined ? {} : { effectiveEngine }),
   });
   if (
     result.terminal !== undefined &&
@@ -1986,10 +1928,5 @@ export async function runPostAdmissionManualResume<
   if (result.terminal !== undefined) {
     (result.terminal as { autoResumeCount?: number }).autoResumeCount = 0;
   }
-  return {
-    ...result,
-    ...(staleWriterLeaseReclaimed === true
-      ? { staleWriterLeaseReclaimed: true as const }
-      : {}),
-  };
+  return result;
 }

package/src/public-cli/run-lifecycle.ts

@@ -40,6 +40,10 @@ import {
 } from "../diarist-contracts.ts";
 import type { DoctorCaseIdentity } from "../doctor-contracts.ts";
 import type { NotarySourceRunLocator } from "../notary-contracts.ts";
+import {
+  rewriteAdmittedRoleRunPage,
+  rewriteRunDirectoryPathValue,
+} from "../role-run-relocation.ts";
 import {
   appendEngineSessionMaterial,
   engineSessionMaterialFromOptions,
@@ -419,15 +423,20 @@ async function readRoleRunStateDisk(
   if (typeof record.projectRoot !== "string") return undefined;
   if (typeof record.sessionDirectory !== "string") return undefined;
   if (typeof record.admittedRequestPath !== "string") return undefined;
-  const runDir =
+  const storedRunDirectory =
     typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
       ? record.runDirectory
       : runDirectory;
+  const runDir = runDirectory;
   // Principal wire stays uninterpreted — authority owns legacy sessionFile fallback.
   const principalWire: RoleRunPrincipalWire = {
-    sessionDirectory: record.sessionDirectory,
+    sessionDirectory: rewriteRunDirectoryPathValue(
+      record.sessionDirectory,
+      storedRunDirectory,
+      runDirectory,
+    ) as string,
     ...(typeof record.sessionFile === "string"
-      ? { sessionFile: record.sessionFile }
+      ? { sessionFile: rewriteRunDirectoryPathValue(record.sessionFile, storedRunDirectory, runDirectory) as string }
       : {}),
   };
   let resumable: TypedHttp429Observation | undefined;
@@ -458,7 +467,11 @@ async function readRoleRunStateDisk(
     bookKey: record.bookKey,
     projectRoot: record.projectRoot,
     runDirectory: runDir,
-    admittedRequestPath: record.admittedRequestPath,
+    admittedRequestPath: rewriteRunDirectoryPathValue(
+      record.admittedRequestPath,
+      storedRunDirectory,
+      runDirectory,
+    ) as string,
     principalWire,
     ...(phase === undefined ? {} : { phase }),
     ...(resumable === undefined ? {} : { resumable }),
@@ -1433,6 +1446,14 @@ async function loadResumableRunRecord(
     );
     if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
       const record = raw as Record<string, unknown>;
+      const storedRunDirectory =
+        typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
+          ? record.runDirectory
+          : run.runDirectory;
+      rewriteAdmittedRoleRunPage(record, [{
+        oldRunDirectory: storedRunDirectory,
+        newRunDirectory: run.runDirectory,
+      }]);
       if (typeof record.instruction === "string") {
         instruction = record.instruction;
       }
@@ -1649,6 +1670,23 @@ async function loadResumableRunRecord(
   } else if (mergedSet.tickets !== undefined) {
     courtTicketNumbers = mergedSet.tickets;
   }
+  const sourceRunLeaf = basename(sourceRunPath ?? "").split("@");
+  const referencedRunId = sourceRun?.runId ?? sourceRunLeaf[0];
+  const referencedRole = sourceRun?.role ?? sourceRunLeaf[1];
+  if (referencedRunId !== undefined && referencedRunId !== "") {
+    const currentSourceRunDirectory = await findRunDirectoryById(
+      home,
+      referencedRunId,
+      run.bookKey,
+      referencedRole,
+    );
+    if (currentSourceRunDirectory !== undefined) {
+      sourceRunPath = currentSourceRunDirectory;
+      if (sourceRun !== undefined) {
+        sourceRun = { ...sourceRun, runDirectory: currentSourceRunDirectory };
+      }
+    }
+  }
   return {
     run,
     principal,

package/src/role-run-relocation.ts

@@ -196,6 +196,29 @@ function rewriteSummonsMaterials(
   }
 }
 
+/** Project one admitted page in memory after its containing run moved. */
+export function rewriteAdmittedRoleRunPage(
+  page: Record<string, unknown>,
+  rewrites: readonly RunDirectoryPathRewrite[],
+): void {
+  rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_FIELDS, rewrites);
+  rewriteSourceRunLocator(page.sourceRun, rewrites);
+  if (Array.isArray(page.attachments)) {
+    for (const attachment of page.attachments) {
+      if (isPlainObject(attachment)) {
+        rewriteRunDirectoryPathFieldsAgainstRewrites(attachment, ["frozenPath"], rewrites);
+      }
+    }
+  }
+  if (isPlainObject(page.principal)) {
+    rewriteRunDirectoryPathFieldsAgainstRewrites(
+      page.principal,
+      ["sessionDirectory", "sessionFile"],
+      rewrites,
+    );
+  }
+}
+
 async function rewriteJsonObjectFile(
   path: string,
   fields: readonly string[],
@@ -394,9 +417,9 @@ async function rewriteNestedMachinePathPages(
 /**
  * Rewrite admitted-request / invocation / run-state path fields (attachment
  * frozenPath / summons.attachmentPaths pointers only), then nested package-owned
- * session seams, after the run directory has already been moved or copied.
- * `pagesDirectory` is where the pages now live; path strings still naming an
- * old run directory become the matching new directory. `crossRunRewrites`
+ * session seams. Callers may rewrite before or after the filesystem move/copy:
+ * `pagesDirectory` is where the pages currently live on disk; path strings that
+ * still name `oldRunDirectory` become `newRunDirectory`. `crossRunRewrites`
  * covers officer/parent pointers that landed under a different final placement.
  */
 export async function rewriteRoleRunDurablePages(input: {
@@ -414,33 +437,7 @@ export async function rewriteRoleRunDurablePages(input: {
       string,
       unknown
     >;
-    rewriteRunDirectoryPathFieldsAgainstRewrites(
-      page,
-      ADMITTED_PAGE_FIELDS,
-      rewrites,
-    );
-    // Nested notary typed locator — same value family as top-level sourceRunPath.
-    rewriteSourceRunLocator(page.sourceRun, rewrites);
-    if (Array.isArray(page.attachments)) {
-      for (const attachment of page.attachments) {
-        if (isPlainObject(attachment)) {
-          // Pointer only — never open or mutate frozen attachment bytes.
-          rewriteRunDirectoryPathFieldsAgainstRewrites(
-            attachment,
-            ["frozenPath"],
-            rewrites,
-          );
-        }
-      }
-    }
-    // Nested principal wire (sessionDirectory/sessionFile) when present.
-    if (isPlainObject(page.principal)) {
-      rewriteRunDirectoryPathFieldsAgainstRewrites(
-        page.principal,
-        ["sessionDirectory", "sessionFile"],
-        rewrites,
-      );
-    }
+    rewriteAdmittedRoleRunPage(page, rewrites);
     await writeFile(admittedPath, `${JSON.stringify(page, null, 2)}\n`, "utf8");
   }