@akagilnc/pi-workflow-roles 0.1.5483 → 0.1.5571

package/src/run-terminal-artifacts.ts

@@ -1,277 +1,121 @@
 /**
- * Canonical layout and reader for run-directory typed terminal artifacts.
- * Settlement publish*Artifacts uses these names (report.json / error.json /
- * audit-incomplete.json under artifacts/, plus durable failure fallbacks).
- * The reader only checks presence and structural
+ * The leg's terminal: the `terminal` section of current.json (#1161), written
+ * whole by settlement, last write wins. `report` = an accepted / escalated
+ * receipt, `error` = a controlled failure, `no_receipt` = the leg ended with no
+ * accepted receipt (#836). The reader only checks presence and structural
  * readability — it does not re-derive role outcomes or invent a second
  * candidate algorithm.
  */
-import { randomUUID } from "node:crypto";
-import { readdir, readFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { basename } from "node:path";
 
-import { roleRunArtifactsDirectory } from "./role-run-placement.ts";
-import { isRecord, errorText, isMissingPathError } from "./unknown-value.ts";
+import { parseRunLeaf } from "./role-run-placement.ts";
+import { readHistoryRowsSync, readSectionSync, writeSectionSync } from "./run-dossier.ts";
 
-export const RUN_TERMINAL_REPORT_FILE = "report.json" as const;
-export const RUN_TERMINAL_ERROR_FILE = "error.json" as const;
-export const RUN_TERMINAL_EVIDENCE_FILE = "evidence.json" as const;
-export const RUN_TERMINAL_ERROR_SETTLEMENT_FILE = "error.settlement.json" as const;
-export const RUN_TERMINAL_ARTIFACT_FILES = [
-  RUN_TERMINAL_REPORT_FILE,
-  RUN_TERMINAL_ERROR_FILE,
-  "audit-incomplete.json",
-] as const;
+import { isRecord } from "./unknown-value.ts";
 
-export type RunTerminalArtifactFile = (typeof RUN_TERMINAL_ARTIFACT_FILES)[number];
+export type RunTerminalFace = "report" | "error" | "no_receipt";
 
-/**
- * Fixed durable failure paths publishFailureArtifacts may settle when the
- * conventional artifacts/error.json name cannot be written. Shared face so the
- * reader follows the publisher — not a parallel search algorithm.
- * Relative to the run directory.
- */
-export const RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS = [
-  `artifacts/${RUN_TERMINAL_ERROR_SETTLEMENT_FILE}`,
-  RUN_TERMINAL_ERROR_SETTLEMENT_FILE,
-] as const;
-
-/** Publisher and reader share the open-ended error face stem. */
-export const UNIQUE_ERROR_FALLBACK_STEM = "error";
-export function uniqueErrorFallbackName(): string {
-  return `${UNIQUE_ERROR_FALLBACK_STEM}.${randomUUID()}.json`;
-}
-const UNIQUE_ERROR_FALLBACK_NAME = new RegExp(
-  `^${UNIQUE_ERROR_FALLBACK_STEM}\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.json$`, "i",
-);
-
-export type RunTerminalArtifactRead =
+export type RunTerminalRead =
   | { readonly status: "absent" }
   | {
       readonly status: "present";
-      readonly file: RunTerminalArtifactFile;
-      readonly path: string;
+      readonly face: RunTerminalFace;
       readonly body: Record<string, unknown>;
     }
-  | {
-      readonly status: "unreadable";
-      readonly file: RunTerminalArtifactFile;
-      readonly path: string;
-      readonly reason: string;
-    };
+  | { readonly status: "unreadable"; readonly reason: string };
+
+/**
+ * Terminal body field naming the `attempt-history` row this settlement appended.
+ * Readers resolve submitted payloads by this identity (#1161 甲); they must not
+ * pick the last history row of the same role.
+ */
+export const ATTEMPT_HISTORY_IDENTITY_FIELD = "attemptHistoryIdentity" as const;
 
 /**
- * Minimum producer-owned face shared by settlement terminal artifacts
- * (report / error / audit-incomplete). Consumer-driven: enough to identify a
- * usable typed terminal artifact; null, arrays, primitives, and role-less
- * objects are unreadable (ADR 0043).
+ * Terminal body field naming the court that wrote this terminal (#1161 R2).
+ * Historical `state.jsonl` terminal rows keep it so a later re-projection of the
+ * same court can recover that court's `attemptHistoryIdentity` without reading
+ * the leg's latest terminal or guessing by payload.
  */
-function readUsableTerminalArtifactBody(
-  body: unknown,
-): { readonly ok: true; readonly body: Record<string, unknown> } | { readonly ok: false; readonly reason: string } {
-  if (body === null) {
-    return { ok: false, reason: "terminal artifact JSON value is null" };
+export const TERMINAL_COURT_ATTEMPT_FIELD = "courtAttemptId" as const;
+
+/** Replace the leg's terminal. */
+export function writeRunTerminal(
+  runDirectory: string,
+  face: RunTerminalFace,
+  body: Record<string, unknown>,
+): void {
+  writeSectionSync(runDirectory, "terminal", { face, at: new Date().toISOString(), body });
+}
+
+/**
+ * Read the leg's terminal. Minimum producer-owned face: a typed object body
+ * with a nonblank `role` (ADR 0043); anything else is unreadable. Absence is a
+ * valid no-receipt state. A damaged current.json throws.
+ */
+export function readRunTerminal(runDirectory: string): RunTerminalRead {
+  const terminal = readSectionSync(runDirectory, "terminal");
+  if (terminal === undefined) return { status: "absent" };
+  const { face, body } = terminal;
+  if (face !== "report" && face !== "error" && face !== "no_receipt") {
+    return { status: "unreadable", reason: "terminal section has no known face" };
   }
   if (!isRecord(body)) {
-    return {
-      ok: false,
-      reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`,
-    };
+    return { status: "unreadable", reason: "terminal body is not a typed object" };
   }
   if (typeof body.role !== "string" || body.role.trim() === "") {
-    return {
-      ok: false,
-      reason: "terminal artifact missing nonblank producer-owned role field",
-    };
+    return { status: "unreadable", reason: "terminal body missing nonblank producer-owned role field" };
   }
-  return { ok: true, body };
+  if (face !== "report") return { status: "present", face, body };
+  const resolved = withSubmittedPayloads(runDirectory, body);
+  if (resolved.status === "unreadable") return resolved;
+  return { status: "present", face, body: resolved.body };
 }
 
-async function readTerminalArtifactAtPath(
-  path: string,
-  file: RunTerminalArtifactFile,
-): Promise<RunTerminalArtifactRead | undefined> {
-  let raw: string;
-  try {
-    raw = await readFile(path, "utf8");
-  } catch (error) {
-    if (isMissingPathError(error)) return undefined;
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason: errorText(error),
-    };
-  }
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason:
-        error instanceof Error
-          ? error.message
-          : `terminal artifact JSON parse failed: ${String(error)}`,
-    };
+/**
+ * The report's outcome carries the verdict facts only; the role's submitted payloads are not
+ * stored a second time. A reader that wants them takes them from the attempt-history row this
+ * settlement named on the terminal body (`attemptHistoryIdentity`). When payloads are absent
+ * and that identity is missing or cannot supply them, the gap is unreadable — never a silent
+ * present body (#1161 R2-gap).
+ */
+function withSubmittedPayloads(
+  runDirectory: string,
+  body: Record<string, unknown>,
+):
+  | { readonly status: "present"; readonly body: Record<string, unknown> }
+  | { readonly status: "unreadable"; readonly reason: string } {
+  const outcome = body.outcome;
+  if (!isRecord(outcome) || outcome.payloads !== undefined) {
+    return { status: "present", body };
   }
-  const usable = readUsableTerminalArtifactBody(parsed);
-  if (!usable.ok) {
+  const identity = body[ATTEMPT_HISTORY_IDENTITY_FIELD];
+  if (typeof identity !== "string" || identity.trim() === "") {
     return {
       status: "unreadable",
-      file,
-      path,
-      reason: usable.reason,
+      reason: "terminal report has no payloads and no attemptHistoryIdentity",
     };
   }
-  return { status: "present", file, path, body: usable.body };
-}
-
-async function listUniqueErrorFallbackPaths(
-  directories: readonly string[],
-): Promise<string[]> {
-  const found: string[] = [];
-  for (const dir of directories) {
-    let names: string[];
-    try {
-      names = await readdir(dir);
-    } catch (error) {
-      if (isMissingPathError(error)) continue;
-      throw error;
-    }
-    for (const name of names.sort((a, b) => a.localeCompare(b))) {
-      if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
-      found.push(join(dir, name));
+  for (const row of readHistoryRowsSync(runDirectory)) {
+    if (row.kind !== "attempt-history" || row.identity !== identity || !isRecord(row.payload)) continue;
+    const attempt = row.payload.outcome;
+    if (isRecord(attempt) && Array.isArray(attempt.payloads)) {
+      return {
+        status: "present",
+        body: { ...body, outcome: { ...outcome, payloads: attempt.payloads } },
+      };
     }
   }
-  return found;
+  return {
+    status: "unreadable",
+    reason: `terminal attemptHistoryIdentity ${identity} has no readable attempt-history payloads`,
+  };
 }
 
 /**
- * Publisher run-directory face is `<runId>@<role>`. Parent-directory unique
- * fallbacks are shared across sibling runs, so binding uses this runId only.
+ * Run-directory face is `<runId>@<role>`.
  * Sole authority for runDirectory → runId (last `@` split).
  */
 export function runIdFromRunDirectory(runDirectory: string): string | undefined {
-  const name = basename(runDirectory);
-  const at = name.lastIndexOf("@");
-  if (at <= 0 || at === name.length - 1) return undefined;
-  return name.slice(0, at);
-}
-
-/**
- * Shared parent-directory unique fallback may be adopted only when the
- * publisher-owned body.runId equals this run directory's runId. Same-run
- * artifactsDir / runDirectory candidates keep path ownership and skip this.
- * expectedRunId undefined (unparseable run dir) → never bound.
- */
-function presentUniqueFallbackBoundToRun(
-  body: Record<string, unknown>,
-  expectedRunId: string | undefined,
-): boolean {
-  if (expectedRunId === undefined) return false;
-  return typeof body.runId === "string" && body.runId === expectedRunId;
-}
-
-/**
- * Sole authority for seam-owned unique error.<uuid>.json candidates.
- * Used by both clearOpposite (settlement) and readRunTerminalArtifact — do not
- * re-enumerate the same-run / parent unique set elsewhere.
- * Ownership:
- * - same-run dirs (artifacts/, runDir): path ownership — all unique names
- * - parent runs/: only body.runId-bound faces; unparseable runId or unreadable body → none
- */
-export async function listSeamOwnedUniqueErrorFacePaths(
-  runDirectory: string,
-): Promise<readonly string[]> {
-  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-  const owned: string[] = await listUniqueErrorFallbackPaths([
-    artifactsDir,
-    runDirectory,
-  ]);
-  const expectedRunId = runIdFromRunDirectory(runDirectory);
-  for (const path of await listUniqueErrorFallbackPaths([dirname(runDirectory)])) {
-    const read = await readTerminalArtifactAtPath(path, "error.json");
-    if (read === undefined || read.status !== "present") continue;
-    if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId)) continue;
-    owned.push(path);
-  }
-  return owned;
-}
-
-type PresentOrUnreadable = Exclude<RunTerminalArtifactRead, { status: "absent" }>;
-
-/**
- * Publish contract (#953): only failure publish continues after clearOpposite
- * failure, so a multi-class residue (residual report/audit beside a new error
- * face) means the current settlement is failure. Prefer failure-class faces
- * over success/audit — never filesystem mtime (copy/restore/utimes can lie).
- */
-function failureClassRank(file: RunTerminalArtifactFile): number {
-  return file === "error.json" ? 1 : 0;
-}
-
-/**
- * Read the current typed terminal artifact for a run directory.
- *
- * Candidate set (publisher-owned faces only):
- * 1) conventional artifacts/{report,error,audit-incomplete}.json
- * 2) publisher fixed failure fallbacks (error.settlement.json faces)
- * 3) seam-owned unique error.<uuid>.json via listSeamOwnedUniqueErrorFacePaths
- *    (same-run path ownership + parent body.runId binding — shared with clear)
- *
- * Invariant: when more than one present face remains (e.g. clearOpposite failed
- * during failure publish and a fallback was settled beside a residual report),
- * adopt failure-class over success/audit by the publish contract — not mtime.
- * Same-class ties keep candidate enumeration order (conventional before
- * fallbacks before unique).
- *
- * Unreadable faces never outrank a present face. Parent unique unreadable
- * files never enter the shared enumerator (cannot prove run identity).
- * Absence of every known durable face is a valid no-receipt state.
- */
-export async function readRunTerminalArtifact(
-  runDirectory: string,
-): Promise<RunTerminalArtifactRead> {
-  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-  const present: Array<Extract<PresentOrUnreadable, { status: "present" }>> = [];
-  const unreadable: Array<Extract<PresentOrUnreadable, { status: "unreadable" }>> =
-    [];
-
-  const consider = (read: RunTerminalArtifactRead | undefined): void => {
-    if (read === undefined || read.status === "absent") return;
-    if (read.status === "present") {
-      present.push(read);
-      return;
-    }
-    unreadable.push(read);
-  };
-
-  for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    consider(await readTerminalArtifactAtPath(join(artifactsDir, file), file));
-  }
-
-  for (const relative of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-    consider(
-      await readTerminalArtifactAtPath(join(runDirectory, relative), "error.json"),
-    );
-  }
-
-  // Unique same-run + parent-bound faces: one enumerator shared with clear.
-  for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
-    consider(await readTerminalArtifactAtPath(path, "error.json"));
-  }
-
-  if (present.length > 0) {
-    present.sort(
-      (a, b) => failureClassRank(b.file) - failureClassRank(a.file),
-    );
-    return present[0]!;
-  }
-  if (unreadable.length > 0) {
-    return unreadable[0]!;
-  }
-  return { status: "absent" };
+  return parseRunLeaf(basename(runDirectory))?.runId;
 }

package/src/run-ticket-number.ts

@@ -1,10 +1,12 @@
 /**
  * Typed ticketNumber reader for a retained run's durable pages.
- * Board pages first (admitted-request, then invocation); migration derivation
- * page last so worktree-derived placement stays readable without forging a
- * board assertion. Missing page (ENOENT) → try next / undefined; damage and
- * non-ENOENT IO failures propagate.
+ * Production board reads use state.jsonl rows only (admitted, then invocation).
+ * Pre-#1161 page files are readable only via readMigrationBoardTicketNumber.
+ * Migration derivation page last so worktree-derived placement stays readable
+ * without forging a board assertion. Missing page (ENOENT) → try next / undefined;
+ * damage and non-ENOENT IO failures propagate.
  */
+import { readPageSync } from "./run-dossier.ts";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 
@@ -14,9 +16,48 @@ import { isEnoent, isRecord } from "./unknown-value.ts";
 export const MIGRATION_TICKET_DERIVATION_PAGE =
   "migration-ticket-derivation.json" as const;
 
+/** Positive-integer contract for display / snapshot inputs; binding uses the safe subset below. */
+export function isPositiveTicketNumber(value: unknown): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1;
+}
+
 /** Sole safe-positive ticket invariant (bind / admission / placement / readers). */
 export function isSafePositiveTicketNumber(value: unknown): value is number {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+  return isPositiveTicketNumber(value) && Number.isSafeInteger(value);
+}
+
+/** Shared digit spelling, also used for consumer-specific rejection diagnostics. */
+export function isTicketNumberString(value: unknown): value is string {
+  return typeof value === "string" && /^[1-9][0-9]*$/.test(value);
+}
+
+/**
+ * Ticket spelling shared by placement, migration, and sitian subject routing.
+ * A number, or a digit string with no sign, zero-pad, decimal, or `#`.
+ * Unsafe integers are unidentified. Leading `#N` stays on readDeclaredTicketNumber.
+ */
+export function parseTicketNumber(value: unknown): number | undefined {
+  if (isSafePositiveTicketNumber(value)) return value;
+  if (!isTicketNumberString(value)) return undefined;
+  const parsed = Number(value);
+  return isSafePositiveTicketNumber(parsed) ? parsed : undefined;
+}
+
+/** Ticket number carried by a sitian subject, when the subject is a ticket. */
+export function sitianSubjectTicketNumber(subject: unknown): number | undefined {
+  if (typeof subject === "string" || typeof subject === "number") {
+    return parseTicketNumber(subject);
+  }
+  if (subject !== null && typeof subject === "object" && !Array.isArray(subject)) {
+    return parseTicketNumber((subject as { ticketNumber?: unknown }).ticketNumber);
+  }
+  return undefined;
+}
+
+/** Ticket-provenance directory id from a sitian subject, when the subject is a ticket. */
+export function ticketNumberFromSitianSubject(subject: unknown): string | undefined {
+  const parsed = sitianSubjectTicketNumber(subject);
+  return parsed === undefined ? undefined : String(parsed);
 }
 
 /**
@@ -35,8 +76,7 @@ export function readDeclaredTicketNumber(value: unknown): number | undefined {
   // (word-boundary alone would truncate at the decimal point).
   const match = /^#?([1-9]\d*)(?!\.\d)(?:\b|$)/.exec(trimmed);
   if (match === null) return undefined;
-  const ticketNumber = Number(match[1]);
-  return isSafePositiveTicketNumber(ticketNumber) ? ticketNumber : undefined;
+  return parseTicketNumber(match[1]);
 }
 
 /** Loud reject for non-safe-positive ticket numbers before placement or bind. */
@@ -73,25 +113,53 @@ async function readJsonObject(
   }
 }
 
-async function readBoardPageTicketNumber(
+/** Pre-#1161 separate board pages — migration input only, not a runtime fact path. */
+const LEGACY_BOARD_PAGE: Readonly<Record<"admitted" | "invocation", string>> = {
+  admitted: "admitted-request.json",
+  invocation: "invocation.json",
+};
+
+function readBoardPageTicketNumberFromRows(
   runDirectory: string,
-  page: "admitted-request.json" | "invocation.json",
+  section: "admitted" | "invocation",
+): number | undefined {
+  const fromRows = readPageSync(runDirectory, section);
+  return fromRows === undefined ? undefined : ticketFromRecord(fromRows);
+}
+
+async function readBoardPageTicketNumberFromLegacy(
+  runDirectory: string,
+  section: "admitted" | "invocation",
 ): Promise<number | undefined> {
-  const record = await readJsonObject(join(runDirectory, page));
+  const record = await readJsonObject(join(runDirectory, LEGACY_BOARD_PAGE[section]));
   if (record === undefined) return undefined;
   return ticketFromRecord(record);
 }
 
 /**
- * Board-only ticketNumber (admitted → invocation). Placement attribution and
- * any caller that must ignore derivation pages use this sole projection.
+ * Board-only ticketNumber from fact rows (admitted → invocation).
+ * Public / production identity paths use this sole projection — never legacy pages.
  */
 export async function readBoardTicketNumber(
   runDirectory: string,
 ): Promise<number | undefined> {
   return (
-    (await readBoardPageTicketNumber(runDirectory, "admitted-request.json")) ??
-    (await readBoardPageTicketNumber(runDirectory, "invocation.json"))
+    readBoardPageTicketNumberFromRows(runDirectory, "admitted") ??
+    readBoardPageTicketNumberFromRows(runDirectory, "invocation")
+  );
+}
+
+/**
+ * Migration-boundary board ticket: fact rows first, then pre-#1161 page files.
+ * Only #852 migrators and placement may call this; runtime identity must not.
+ */
+export async function readMigrationBoardTicketNumber(
+  runDirectory: string,
+): Promise<number | undefined> {
+  return (
+    (await readBoardTicketNumber(runDirectory)) ??
+    (await readBoardPageTicketNumberFromLegacy(runDirectory, "admitted")) ??
+    (await readBoardPageTicketNumberFromLegacy(runDirectory, "invocation"))
   );
 }
 

package/src/session-assistant-usage.ts

@@ -3,7 +3,8 @@
  * Accumulates real cost when rows carry it; never invents cost zeros (#675).
  */
 import type { Usage } from "@earendil-works/pi-ai";
-import { join } from "node:path";
+import { ROLE_RUN_SESSION_FILENAME, sessionFileOf } from "./role-run-placement.ts";
+import { readStrictPiSessionJsonl } from "./ledger-session-read.ts";
 
 import type { PublicSummonResult } from "./public-role-summons.ts";
 
@@ -12,25 +13,12 @@ import { errorText } from "./unknown-value.ts";
 export async function readAssistantUsageFromSessionFile(
   sessionFile: string,
 ): Promise<Usage | undefined> {
-  const { readFile } = await import("node:fs/promises");
-  let text: string;
-  try {
-    text = await readFile(sessionFile, "utf8");
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return undefined;
-    throw error;
-  }
   let rows: Array<{ type?: string; message?: { role?: string; usage?: Usage } }>;
   try {
-    rows = text
-      .trim()
-      .split("\n")
-      .filter(Boolean)
-      .map((line) => JSON.parse(line) as {
-        type?: string;
-        message?: { role?: string; usage?: Usage };
-      });
+    rows = await readStrictPiSessionJsonl(sessionFile) as typeof rows;
   } catch (error) {
+    if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return undefined;
+    if (!(error instanceof SyntaxError)) throw error;
     throw new Error(
       `session usage parse failed (${sessionFile}): ${errorText(error)}`,
       { cause: error },
@@ -95,18 +83,18 @@ export function sessionFileFromPublicSummon(
   summoned: PublicSummonResult,
 ): string | undefined {
   if (typeof summoned.runDirectory === "string" && summoned.runDirectory.trim() !== "") {
-    return join(summoned.runDirectory, "session", "session.jsonl");
+    return sessionFileOf(summoned.runDirectory);
   }
   const fromArtifacts = summoned.terminal?.artifacts
     ?.map((a) => (a as { path?: string }).path)
-    .find((p): p is string => typeof p === "string" && p.endsWith("session.jsonl"));
+    .find((p): p is string => typeof p === "string" && p.endsWith(ROLE_RUN_SESSION_FILENAME));
   if (fromArtifacts !== undefined) return fromArtifacts;
   const outcome = summoned.terminal?.roleOutcome;
   if (outcome === undefined) return undefined;
   const facts = (outcome as { decisiveFacts?: Record<string, unknown> }).decisiveFacts;
   const pointer = facts?.runPointer;
   if (typeof pointer === "string" && pointer.trim() !== "") {
-    return join(pointer, "session", "session.jsonl");
+    return sessionFileOf(pointer);
   }
   return undefined;
 }

package/src/session-identity.ts

@@ -1,4 +1,3 @@
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 
 import type { DurablePrincipal, DurablePrincipalAuthority } from "./host-contracts.ts";
@@ -7,37 +6,72 @@ import {
   lookupHeadlessHostDescription,
   lookupHostDescription,
 } from "./host-descriptions.ts";
+import { renderCurrentSync, RUN_STATE_FILE } from "./run-dossier.ts";
+import { readSitianRecords, reportRunRecord } from "./sitian-facade.ts";
+import { errorText, isRecord } from "./unknown-value.ts";
 import type { SessionIdentityAuthority } from "./prepared-role-turn.ts";
 
-/** Durable session binding stored beside the host-owned session principal. */
+/** Log record kind of one host-session binding (a host's native session id for this run). */
+export const HOST_SESSION_ID_RECORD_KIND = "host-session-id" as const;
+
+/**
+ * Durable session binding: one state row per bind, scoped by host name — a run
+ * that changes hosts on resume must never hand one host's native session id to
+ * another. The latest record for the host wins. The public call projects
+ * `current.json` at the bind so host.sessions appears before the host CLI
+ * starts; a refused projection does not undo the binding fact or become a
+ * host/session failure (facts stay in state.jsonl; settlement still renders).
+ */
 export function createSessionIdentityAuthority(
   authority: DurablePrincipalAuthority,
-  sessionBindingFile: string,
+  hostName: string,
 ): SessionIdentityAuthority {
-  const bindingPath = (principal: DurablePrincipal): string =>
-    join(authority.decode(principal).sessionDirectory, sessionBindingFile);
+  const runDirectoryOf = (principal: DurablePrincipal): string =>
+    dirname(authority.decode(principal).sessionDirectory);
   return {
     resolveSessionFile(principal) {
       return authority.decode(principal).sessionFile;
     },
     async load(principal) {
-      try {
-        const value: unknown = JSON.parse(await readFile(bindingPath(principal), "utf8"));
-        if (typeof value !== "object" || value === null || typeof (value as { sessionId?: unknown }).sessionId !== "string") {
+      const runDirectory = runDirectoryOf(principal);
+      const { records, diagnostics } = await readSitianRecords(join(runDirectory, RUN_STATE_FILE));
+      // Control path fails closed on damaged rows — same class as readPageSync.
+      // Rendering may keep reachable facts; dispatch must not reuse a prior binding
+      // after syntax damage (#1161 C3).
+      if (diagnostics.length > 0) {
+        throw new Error(
+          `${RUN_STATE_FILE} has ${diagnostics.length} malformed row(s); refusing stale session binding: ${runDirectory}`,
+        );
+      }
+      let bound: string | undefined;
+      for (const record of records) {
+        if (record.kind !== HOST_SESSION_ID_RECORD_KIND) continue;
+        // Non-object / cannot name a host: unattributable damage — refuse
+        // (settled C3-payload). Never treat as a skippable "other host" row.
+        if (!isRecord(record.payload) || typeof record.payload.host !== "string") {
           throw new Error("durable session binding is invalid");
         }
-        return (value as { sessionId: string }).sessionId;
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
-        throw error;
+        // Explicit other host only: that host's bad id must not block this one.
+        if (record.payload.host !== hostName) continue;
+        // This host's null / non-string sessionId: refuse — do not reuse a prior
+        // binding for the same host (#1161 C3).
+        if (typeof record.payload.sessionId !== "string") {
+          throw new Error("durable session binding is invalid");
+        }
+        bound = record.payload.sessionId;
       }
+      return bound;
     },
     async bind(principal, sessionId) {
-      const target = bindingPath(principal);
-      await mkdir(dirname(target), { recursive: true });
-      const temporary = `${target}.${process.pid}.tmp`;
-      await writeFile(temporary, `${JSON.stringify({ sessionId })}\n`, { encoding: "utf8", mode: 0o600 });
-      await rename(temporary, target);
+      const runDirectory = runDirectoryOf(principal);
+      reportRunRecord(runDirectory, HOST_SESSION_ID_RECORD_KIND, { host: hostName, sessionId }, "session-identity");
+      try {
+        renderCurrentSync(runDirectory);
+      } catch (error) {
+        process.stderr.write(
+          `[session-identity] current.json render refused after host-session-id; binding fact kept: ${runDirectory}: ${errorText(error)}\n`,
+        );
+      }
     },
   };
 }
@@ -55,10 +89,7 @@ export async function readStoredHostSessionId(
   if (host === undefined || host === DEFAULT_ROLE_TURN_HOST) return undefined;
   const description = lookupHostDescription(host) ?? lookupHeadlessHostDescription(host);
   if (description === undefined) return undefined;
-  const sessionId = await createSessionIdentityAuthority(
-    authority,
-    description.sessionBindingFile,
-  ).load(principal);
+  const sessionId = await createSessionIdentityAuthority(authority, host).load(principal);
   if (sessionId === undefined || sessionId === "") return undefined;
   return sessionId;
 }