@akagilnc/pi-workflow-roles 0.1.5216 → 0.1.5235

package/src/public-cli/post-admission.ts

@@ -69,10 +69,8 @@ function isStationChildOfficerDialogue(
 }
 import {
   mintEngineDetourInvocationScope,
-  readInvocationSelectedHost,
   withEngineDetourInvocationScope,
 } from "../engine-detour-usage.ts";
-import { projectHostTransitionPriorNative } from "../host-transition-prior-native.ts";
 import type { CredentialProviders, SeatModelConfig } from "./config.ts";
 import {
   clearCurrentCourt,
@@ -92,6 +90,7 @@ import {
   type CatchableProcessSignal,
 } from "./process-cancel.ts";
 import { homeFromRunDirectory } from "../activation-ledger-topology.ts";
+import { recordRunStart } from "../host-session-record.ts";
 import {
   attemptProducedFreshSubmission,
   classifyPostAdmissionFailure,
@@ -808,53 +807,11 @@ export async function dispatchPostAdmissionTurn<
   try {
     // #987: do not pre-block or classify host dispatch from AK credential
     // catalog facts. Per-invocation runner/host evidence owns provider identity.
-    // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
-    // Single authority projectHostTransitionPriorNative classifies the prior native volume.
-    // Same-run resume (#637) keeps host identity on the run's invocation page.
-    let previousHost: string | undefined;
-    const liveHost = env.host;
-    const principalCoordinates =
-      admitted.principal === undefined
-        ? undefined
-        : env.principalAuthority.decode(admitted.principal);
-    let hostTransition: RoleTurnRequest["hostTransition"];
-    try {
-      previousHost = readInvocationSelectedHost(admitted.runDirectory);
-      hostTransition =
-        previousHost !== undefined && liveHost !== undefined && principalCoordinates !== undefined
-          ? await projectHostTransitionPriorNative({
-              previousHost,
-              liveHost,
-              piSessionFile: principalCoordinates.sessionFile,
-            })
-          : undefined;
-    } catch (error) {
-      // prior-native IO is on the public one-shot path — controlled failure, not bare throw.
-      return {
-        ...(await presentControlledFailure(
-          admitted,
-          withEngineDetourInvocationScope({
-            timedOut: false,
-            code: null,
-            stderr: "",
-            thrown: error,
-          }, request.invocationScopeId),
-          adapters,
-          env.principalAuthority,
-          io,
-          persistRunState,
-        )) as { exitCode: number; admitted: A; terminal: T },
-        ...deferredPersist,
-      };
-    }
-
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     // The authoritative host write (markRunRunning) is delayed to just before
     // executeTurn — not merely past beforeDispatch (#840 r9 判词 class 2). Any
-    // pre-turn retry (beforeDispatch, dossier projection, continuation
-    // assembly) must still see the prior invocation host on its next attempt;
-    // committing env.host earlier would make readInvocationSelectedHost read back the
-    // new host on the retry and silently drop hostTransition.
+    // pre-turn retry (beforeDispatch, continuation assembly) must not commit a host
+    // identity until the turn is ready.
     // Failures settle the run (presentControlledFailure); they must not leave it
     // permanently running. Call-local auto-resume retries this hook until it
     // succeeds; only an exhausted nested station child skips the parent loop
@@ -903,13 +860,10 @@ export async function dispatchPostAdmissionTurn<
     if (env.stationChild !== undefined) {
       turnRequest = { ...turnRequest, stationChild: env.stationChild };
     }
-    if (hostTransition !== undefined) {
-      turnRequest = { ...turnRequest, hostTransition };
-    }
     // Selected host axis rides the shared Host envelope for in-turn tools
     // (detour usage ledger) — never a pre-spawn invocation.json reread.
-    if (typeof liveHost === "string" && liveHost.trim() !== "") {
-      turnRequest = { ...turnRequest, host: liveHost.trim() };
+    if (typeof env.host === "string" && env.host.trim() !== "") {
+      turnRequest = { ...turnRequest, host: env.host.trim() };
     }
     // 0081 non-dialogue face: freeze pointer section under run/attachments/.
     // Seat consumes via loadCaseDossierReadingMaterial → existing agent-start
@@ -939,6 +893,7 @@ export async function dispatchPostAdmissionTurn<
 
     let result: RoleTurnResult;
     try {
+      recordRunStart(admitted.runDirectory);
       result = await env.roleTurnHost.executeTurn(turnRequest);
     } catch (error) {
       const processCancelName = processCancelSignalName(env.signal);

package/src/public-role-summons.ts

@@ -796,8 +796,7 @@ export async function summonGateOfficer(options: {
     // Hard path resolve: fail loud — never fall through to packageMachineHome (#604 / #675).
     home = homeFromRunDirectory(options.sourceRunDirectory);
   }
-  // Officer host is seat-owned only (#821). Parent invocation.json.host stays a
-  // hostTransition consumer in post-admission — not an officer override channel.
+  // Officer host is seat-owned only (#821), not a parent override channel.
   // #879: binding pointer = parent run directory; dialogue content = submission body.
   // Conclusion re-ask keeps sole ownership of reviewReask when present.
   let gateReviewInstruction: string | undefined;

package/src/sitian-appender.ts

@@ -1,16 +1,10 @@
 /**
- * Sitian Appender kernel (ADR 0065).
+ * Sitian Appender kernel (ADR 0065 / ADR 0086).
  * Computes destination automatically from ledger topology without destination parameters.
- * Owns volume open, torn-tail recovery, entry-level idempotency, and commit boundary.
+ * Log4j-style append-only record sink: appends one row, no deduplication, no read-back, no torn-tail repair.
  */
-import { createHash, randomUUID } from "node:crypto";
-import {
-  appendFileSync,
-  existsSync,
-  readFileSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { randomUUID } from "node:crypto";
+import { appendFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { resolveBookKeyFromGit } from "./activation-ledger-git.ts";
@@ -29,59 +23,13 @@ import {
   type SitianRecordInput,
 } from "./sitian-contracts.ts";
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function errorCodeOf(error: unknown): unknown {
-  return (error as { code?: unknown }).code;
-}
-
-function identityClaimPath(recordFile: string, identity: string): string {
-  const digest = createHash("sha256").update(identity, "utf8").digest("hex");
-  return `${recordFile}.id-${digest}`;
-}
-
-/**
- * Exclusive create at `path` exactly once across processes.
- * Reuses the package's existing `wx` / O_EXCL zero-content occupancy primitive
- * (same shape as activation-ledger-session / archivist-record-entry).
- */
-function createExclusiveFile(path: string, contents: string): void {
-  writeFileSync(path, contents, { encoding: "utf8", flag: "wx" });
-}
-
-function sealTornTail(recordFile: string): void {
-  if (!existsSync(recordFile)) return;
-  const buffer = readFileSync(recordFile);
-  if (buffer.length > 0 && buffer[buffer.length - 1] !== 0x0a) {
-    appendFileSync(recordFile, "\n", "utf8");
-  }
-}
-
 /** Assign already-recorded lines, preserving their original text and malformed lines. */
 export function appendSitianRecordBlock(input: SitianRecordInput, block: string): void {
   if (block === "") return;
   try {
     const { sessionDir, recordFile, ledgerHome } = resolveSitianRecordPath(input);
     ensureRealDirectoryTree(ledgerHome, sessionDir);
-    appendFileSync(recordFile, "", "utf8");
-    sealTornTail(recordFile);
-    const identityOf = (line: string): string | undefined => {
-      try {
-        const row: unknown = JSON.parse(line);
-        return isRecord(row) && typeof row.identity === "string" ? row.identity : undefined;
-      } catch {
-        return undefined;
-      }
-    };
-    const identities = new Set(readFileSync(recordFile, "utf8").split("\n").map(identityOf).filter((id): id is string => id !== undefined));
-    for (const line of block.match(/[^\n]*\n|[^\n]+$/g) ?? []) {
-      const identity = identityOf(line);
-      if (identity !== undefined && identities.has(identity)) continue;
-      appendFileSync(recordFile, line, "utf8");
-      if (identity !== undefined) identities.add(identity);
-    }
+    appendFileSync(recordFile, block, "utf8");
   } catch (error) {
     if (error instanceof SitianInfrastructureError) throw error;
     throw new SitianInfrastructureError(
@@ -91,134 +39,6 @@ export function appendSitianRecordBlock(input: SitianRecordInput, block: string)
   }
 }
 
-function findIdentityPointer(
-  recordFile: string,
-  identity: string,
-  kind: string,
-  level: SitianRecord["level"],
-): RecordPointer | undefined {
-  if (!existsSync(recordFile)) return undefined;
-  const text = readFileSync(recordFile, "utf8");
-  for (const line of text.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (isRecord(parsed) && parsed.identity === identity) {
-        return { identity, recordFile, kind, level };
-      }
-    } catch {
-      // Malformed lines (including substate b preserved bad lines) are ignored during self-check
-    }
-  }
-  return undefined;
-}
-
-function unlinkAbsentOk(path: string): Error | undefined {
-  try {
-    unlinkSync(path);
-    return undefined;
-  } catch (error) {
-    if (errorCodeOf(error) === "ENOENT") return undefined;
-    return error instanceof Error ? error : new Error(errorText(error));
-  }
-}
-
-/**
- * Same-identity uniqueness under normal concurrent writers.
- *
- * Exclusive per-identity claim (`wx`) makes check+append atomic for one
- * identity. The winner appends under the claim and always releases it on both
- * normal and throwing exits. A loser that already sees the published row
- * returns that pointer; a loser that hits claim EEXIST without a published row
- * fails as SitianInfrastructureError (knownCause session). Crash residue can
- * leave that one identity blocked — identity-scoped, never a volume lock. No
- * wait loop, write-ahead recovery, PID reclaim, or compare-and-unlink.
- */
-function appendWithIdentityClaim(
-  recordFile: string,
-  record: SitianRecord,
-  row: string,
-): RecordPointer {
-  sealTornTail(recordFile);
-  const claimPath = identityClaimPath(recordFile, record.identity);
-  const existing = findIdentityPointer(
-    recordFile,
-    record.identity,
-    record.kind,
-    record.level,
-  );
-  if (existing !== undefined) {
-    // Best-effort: drop leftover claim after a prior crash-after-append.
-    unlinkAbsentOk(claimPath);
-    return existing;
-  }
-
-  try {
-    createExclusiveFile(claimPath, "");
-  } catch (error) {
-    if (errorCodeOf(error) !== "EEXIST") throw error;
-    sealTornTail(recordFile);
-    const published = findIdentityPointer(
-      recordFile,
-      record.identity,
-      record.kind,
-      record.level,
-    );
-    if (published !== undefined) {
-      unlinkAbsentOk(claimPath);
-      return published;
-    }
-    throw new SitianInfrastructureError(
-      `Sitian identity claim at ${claimPath} already exists for identity ${record.identity}`,
-      { cause: error },
-    );
-  }
-
-  let primaryFailure: unknown;
-  let result: RecordPointer | undefined;
-  let cleanupFailure: Error | undefined;
-  try {
-    sealTornTail(recordFile);
-    const raced = findIdentityPointer(
-      recordFile,
-      record.identity,
-      record.kind,
-      record.level,
-    );
-    if (raced !== undefined) {
-      result = raced;
-    } else {
-      appendFileSync(recordFile, row, "utf8");
-      result = {
-        identity: record.identity,
-        recordFile,
-        kind: record.kind,
-        level: record.level,
-      };
-    }
-  } catch (error) {
-    primaryFailure = error;
-  } finally {
-    cleanupFailure = unlinkAbsentOk(claimPath);
-  }
-
-  if (primaryFailure !== undefined) {
-    if (primaryFailure instanceof SitianInfrastructureError) throw primaryFailure;
-    throw new SitianInfrastructureError(
-      `Sitian appender persistence failure: ${errorText(primaryFailure)}`,
-      { cause: primaryFailure },
-    );
-  }
-  if (cleanupFailure !== undefined) {
-    throw new SitianInfrastructureError(
-      `Sitian identity claim at ${claimPath} could not be released after append for identity ${record.identity}: ${errorText(cleanupFailure)}`,
-      { cause: cleanupFailure },
-    );
-  }
-  return result as RecordPointer;
-}
-
 /** Authorized S4 submission ledger kinds that share a common run submission volume. */
 export const S4_SUBMISSION_LEDGER_KINDS = new Set([
   "candidate",
@@ -331,11 +151,10 @@ export function resolveSitianRecordPath(input: SitianRecordInput): SitianRecordP
 }
 
 /**
- * Appends a canonical record to its self-computed volume under the Sitian contract.
- * - Idempotency: checks volume by deterministic canonical identity; returns existing pointer on hit.
- * - Torn-tail recovery: checks file tail; un-terminated trailing bytes are sealed with a newline and re-parsed.
- *   Substate a (valid JSON): committed on recovery, returns existing pointer.
- *   Substate b (malformed): preserved as bad line, check misses, appends new row.
+ * Appends a canonical record to its self-computed volume under the Sitian contract (ADR 0086).
+ * - Log4j-style append-only record sink: O(1) append, unconditionally writes a new line.
+ * - Zero read-back, zero per-append identity check / idempotency deduplication.
+ * - Zero torn-tail repair.
  * - Commit point: full JSON string ending with newline.
  */
 export function appendSitianRecord(input: SitianRecordInput): RecordPointer {
@@ -362,7 +181,13 @@ export function appendSitianRecord(input: SitianRecordInput): RecordPointer {
     };
 
     const row = `${JSON.stringify(record)}\n`;
-    return appendWithIdentityClaim(recordFile, record, row);
+    appendFileSync(recordFile, row, "utf8");
+    return {
+      identity: record.identity,
+      recordFile,
+      kind: record.kind,
+      level: record.level,
+    };
   } catch (error) {
     if (error instanceof SitianInfrastructureError) throw error;
     throw new SitianInfrastructureError(

package/dist/host-transition-prior-native.js

@@ -1,78 +0,0 @@
-/**
- * Single authority for #617 DK-4 cross-host prior-native projection.
- * Classifies the prior volume into the two record families that exist
- * (Pi native session file / sitian run records), never by host name.
- */
-import { access, readdir } from "node:fs/promises";
-import { dirname, join } from "node:path";
-function isEnoent(error) {
-    return typeof error === "object" && error !== null && error.code === "ENOENT";
-}
-/** Present Pi native session path, or empty when ENOENT. */
-async function listPiNativeRecordPaths(sessionFile) {
-    try {
-        await access(sessionFile);
-        return [sessionFile];
-    }
-    catch (error) {
-        if (isEnoent(error))
-            return [];
-        throw error;
-    }
-}
-/**
- * Present sitian records.jsonl paths under sessionParent topology (#717).
- * resolveSitianRecordPathInLedger writes dirname(sessionParent)/<category>/records.jsonl
- * when sessionParent is inside ledger home — never session.jsonl itself.
- */
-async function listSitianRecordPaths(sessionParent) {
-    const sessionRoot = dirname(sessionParent);
-    let entries;
-    try {
-        entries = await readdir(sessionRoot, { withFileTypes: true });
-    }
-    catch (error) {
-        if (isEnoent(error))
-            return [];
-        throw error;
-    }
-    const recordPaths = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const recordFile = join(sessionRoot, entry.name, "records.jsonl");
-        try {
-            await access(recordFile);
-            recordPaths.push(recordFile);
-        }
-        catch (error) {
-            if (!isEnoent(error))
-                throw error;
-        }
-    }
-    recordPaths.sort();
-    return recordPaths;
-}
-/**
- * Project one hostTransition only for a real host switch. Empty native volume
- * still yields a typed switch (empty path list).
- *
- * Pi wrote its own session.jsonl; every other host's run volume is the sitian
- * record set on the live run (ADR 0077 全宿主 session 卷宗统一直写, #717) — the CLI's
- * own journals stay in the operator home and are never copied here.
- */
-export async function projectHostTransitionPriorNative(input) {
-    if (input.previousHost === input.liveHost)
-        return undefined;
-    if (input.previousHost === "pi") {
-        return {
-            priorNativeKind: "pi-native",
-            priorNativePaths: await listPiNativeRecordPaths(input.piSessionFile),
-        };
-    }
-    // Sitian path handoff only — do not read bytes.
-    return {
-        priorNativeKind: "sitian",
-        priorNativePaths: await listSitianRecordPaths(input.piSessionFile),
-    };
-}

package/src/host-transition-prior-native.ts

@@ -1,80 +0,0 @@
-/**
- * Single authority for #617 DK-4 cross-host prior-native projection.
- * Classifies the prior volume into the two record families that exist
- * (Pi native session file / sitian run records), never by host name.
- */
-import { access, readdir } from "node:fs/promises";
-import { dirname, join } from "node:path";
-
-import type { RoleTurnHostTransition } from "./host-contracts.ts";
-
-function isEnoent(error: unknown): boolean {
-  return typeof error === "object" && error !== null && (error as NodeJS.ErrnoException).code === "ENOENT";
-}
-
-/** Present Pi native session path, or empty when ENOENT. */
-async function listPiNativeRecordPaths(sessionFile: string): Promise<string[]> {
-  try {
-    await access(sessionFile);
-    return [sessionFile];
-  } catch (error) {
-    if (isEnoent(error)) return [];
-    throw error;
-  }
-}
-
-/**
- * Present sitian records.jsonl paths under sessionParent topology (#717).
- * resolveSitianRecordPathInLedger writes dirname(sessionParent)/<category>/records.jsonl
- * when sessionParent is inside ledger home — never session.jsonl itself.
- */
-async function listSitianRecordPaths(sessionParent: string): Promise<string[]> {
-  const sessionRoot = dirname(sessionParent);
-  let entries;
-  try {
-    entries = await readdir(sessionRoot, { withFileTypes: true });
-  } catch (error) {
-    if (isEnoent(error)) return [];
-    throw error;
-  }
-  const recordPaths: string[] = [];
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const recordFile = join(sessionRoot, entry.name, "records.jsonl");
-    try {
-      await access(recordFile);
-      recordPaths.push(recordFile);
-    } catch (error) {
-      if (!isEnoent(error)) throw error;
-    }
-  }
-  recordPaths.sort();
-  return recordPaths;
-}
-
-/**
- * Project one hostTransition only for a real host switch. Empty native volume
- * still yields a typed switch (empty path list).
- *
- * Pi wrote its own session.jsonl; every other host's run volume is the sitian
- * record set on the live run (ADR 0077 全宿主 session 卷宗统一直写, #717) — the CLI's
- * own journals stay in the operator home and are never copied here.
- */
-export async function projectHostTransitionPriorNative(input: {
-  readonly previousHost: string;
-  readonly liveHost: string;
-  readonly piSessionFile: string;
-}): Promise<RoleTurnHostTransition | undefined> {
-  if (input.previousHost === input.liveHost) return undefined;
-  if (input.previousHost === "pi") {
-    return {
-      priorNativeKind: "pi-native",
-      priorNativePaths: await listPiNativeRecordPaths(input.piSessionFile),
-    };
-  }
-  // Sitian path handoff only — do not read bytes.
-  return {
-    priorNativeKind: "sitian",
-    priorNativePaths: await listSitianRecordPaths(input.piSessionFile),
-  };
-}