@akagilnc/pi-workflow-roles 0.1.5504 → 0.1.5571

package/dist/run-terminal-artifacts.js

@@ -1,226 +1,97 @@
 /**
- * Canonical layout and reader for run-directory typed terminal artifacts.
- * Settlement publish*Artifacts uses these names (report.json / error.json /
- * audit-incomplete.json under artifacts/, plus durable failure fallbacks).
- * The reader only checks presence and structural
+ * The leg's terminal: the `terminal` section of current.json (#1161), written
+ * whole by settlement, last write wins. `report` = an accepted / escalated
+ * receipt, `error` = a controlled failure, `no_receipt` = the leg ended with no
+ * accepted receipt (#836). The reader only checks presence and structural
  * readability — it does not re-derive role outcomes or invent a second
  * candidate algorithm.
  */
-import { randomUUID } from "node:crypto";
-import { readdir, readFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { parseRunLeaf, roleRunArtifactsDirectory } from "./role-run-placement.js";
-import { isRecord, errorText, isMissingPathError } from "./unknown-value.js";
-export const RUN_TERMINAL_REPORT_FILE = "report.json";
-export const RUN_TERMINAL_ERROR_FILE = "error.json";
-export const RUN_TERMINAL_EVIDENCE_FILE = "evidence.json";
-export const RUN_TERMINAL_ERROR_SETTLEMENT_FILE = "error.settlement.json";
-export const RUN_TERMINAL_ARTIFACT_FILES = [
-    RUN_TERMINAL_REPORT_FILE,
-    RUN_TERMINAL_ERROR_FILE,
-    "audit-incomplete.json",
-];
+import { basename } from "node:path";
+import { parseRunLeaf } from "./role-run-placement.js";
+import { readHistoryRowsSync, readSectionSync, writeSectionSync } from "./run-dossier.js";
+import { isRecord } from "./unknown-value.js";
 /**
- * Fixed durable failure paths publishFailureArtifacts may settle when the
- * conventional artifacts/error.json name cannot be written. Shared face so the
- * reader follows the publisher — not a parallel search algorithm.
- * Relative to the run directory.
+ * Terminal body field naming the `attempt-history` row this settlement appended.
+ * Readers resolve submitted payloads by this identity (#1161 甲); they must not
+ * pick the last history row of the same role.
  */
-export const RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS = [
-    `artifacts/${RUN_TERMINAL_ERROR_SETTLEMENT_FILE}`,
-    RUN_TERMINAL_ERROR_SETTLEMENT_FILE,
-];
-/** Publisher and reader share the open-ended error face stem. */
-export const UNIQUE_ERROR_FALLBACK_STEM = "error";
-export function uniqueErrorFallbackName() {
-    return `${UNIQUE_ERROR_FALLBACK_STEM}.${randomUUID()}.json`;
+export const ATTEMPT_HISTORY_IDENTITY_FIELD = "attemptHistoryIdentity";
+/**
+ * Terminal body field naming the court that wrote this terminal (#1161 R2).
+ * Historical `state.jsonl` terminal rows keep it so a later re-projection of the
+ * same court can recover that court's `attemptHistoryIdentity` without reading
+ * the leg's latest terminal or guessing by payload.
+ */
+export const TERMINAL_COURT_ATTEMPT_FIELD = "courtAttemptId";
+/** Replace the leg's terminal. */
+export function writeRunTerminal(runDirectory, face, body) {
+    writeSectionSync(runDirectory, "terminal", { face, at: new Date().toISOString(), body });
 }
-const UNIQUE_ERROR_FALLBACK_NAME = new RegExp(`^${UNIQUE_ERROR_FALLBACK_STEM}\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.json$`, "i");
 /**
- * Minimum producer-owned face shared by settlement terminal artifacts
- * (report / error / audit-incomplete). Consumer-driven: enough to identify a
- * usable typed terminal artifact; null, arrays, primitives, and role-less
- * objects are unreadable (ADR 0043).
+ * Read the leg's terminal. Minimum producer-owned face: a typed object body
+ * with a nonblank `role` (ADR 0043); anything else is unreadable. Absence is a
+ * valid no-receipt state. A damaged current.json throws.
  */
-function readUsableTerminalArtifactBody(body) {
-    if (body === null) {
-        return { ok: false, reason: "terminal artifact JSON value is null" };
+export function readRunTerminal(runDirectory) {
+    const terminal = readSectionSync(runDirectory, "terminal");
+    if (terminal === undefined)
+        return { status: "absent" };
+    const { face, body } = terminal;
+    if (face !== "report" && face !== "error" && face !== "no_receipt") {
+        return { status: "unreadable", reason: "terminal section has no known face" };
     }
     if (!isRecord(body)) {
-        return {
-            ok: false,
-            reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`,
-        };
+        return { status: "unreadable", reason: "terminal body is not a typed object" };
     }
     if (typeof body.role !== "string" || body.role.trim() === "") {
-        return {
-            ok: false,
-            reason: "terminal artifact missing nonblank producer-owned role field",
-        };
+        return { status: "unreadable", reason: "terminal body missing nonblank producer-owned role field" };
     }
-    return { ok: true, body };
+    if (face !== "report")
+        return { status: "present", face, body };
+    const resolved = withSubmittedPayloads(runDirectory, body);
+    if (resolved.status === "unreadable")
+        return resolved;
+    return { status: "present", face, body: resolved.body };
 }
-async function readTerminalArtifactAtPath(path, file) {
-    let raw;
-    try {
-        raw = await readFile(path, "utf8");
-    }
-    catch (error) {
-        if (isMissingPathError(error))
-            return undefined;
-        return {
-            status: "unreadable",
-            file,
-            path,
-            reason: errorText(error),
-        };
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (error) {
-        return {
-            status: "unreadable",
-            file,
-            path,
-            reason: error instanceof Error
-                ? error.message
-                : `terminal artifact JSON parse failed: ${String(error)}`,
-        };
+/**
+ * The report's outcome carries the verdict facts only; the role's submitted payloads are not
+ * stored a second time. A reader that wants them takes them from the attempt-history row this
+ * settlement named on the terminal body (`attemptHistoryIdentity`). When payloads are absent
+ * and that identity is missing or cannot supply them, the gap is unreadable — never a silent
+ * present body (#1161 R2-gap).
+ */
+function withSubmittedPayloads(runDirectory, body) {
+    const outcome = body.outcome;
+    if (!isRecord(outcome) || outcome.payloads !== undefined) {
+        return { status: "present", body };
     }
-    const usable = readUsableTerminalArtifactBody(parsed);
-    if (!usable.ok) {
+    const identity = body[ATTEMPT_HISTORY_IDENTITY_FIELD];
+    if (typeof identity !== "string" || identity.trim() === "") {
         return {
             status: "unreadable",
-            file,
-            path,
-            reason: usable.reason,
+            reason: "terminal report has no payloads and no attemptHistoryIdentity",
         };
     }
-    return { status: "present", file, path, body: usable.body };
-}
-async function listUniqueErrorFallbackPaths(directories) {
-    const found = [];
-    for (const dir of directories) {
-        let names;
-        try {
-            names = await readdir(dir);
-        }
-        catch (error) {
-            if (isMissingPathError(error))
-                continue;
-            throw error;
-        }
-        for (const name of names.sort((a, b) => a.localeCompare(b))) {
-            if (!UNIQUE_ERROR_FALLBACK_NAME.test(name))
-                continue;
-            found.push(join(dir, name));
+    for (const row of readHistoryRowsSync(runDirectory)) {
+        if (row.kind !== "attempt-history" || row.identity !== identity || !isRecord(row.payload))
+            continue;
+        const attempt = row.payload.outcome;
+        if (isRecord(attempt) && Array.isArray(attempt.payloads)) {
+            return {
+                status: "present",
+                body: { ...body, outcome: { ...outcome, payloads: attempt.payloads } },
+            };
         }
     }
-    return found;
+    return {
+        status: "unreadable",
+        reason: `terminal attemptHistoryIdentity ${identity} has no readable attempt-history payloads`,
+    };
 }
 /**
- * Publisher run-directory face is `<runId>@<role>`. Parent-directory unique
- * fallbacks are shared across sibling runs, so binding uses this runId only.
+ * Run-directory face is `<runId>@<role>`.
  * Sole authority for runDirectory → runId (last `@` split).
  */
 export function runIdFromRunDirectory(runDirectory) {
     return parseRunLeaf(basename(runDirectory))?.runId;
 }
-/**
- * Shared parent-directory unique fallback may be adopted only when the
- * publisher-owned body.runId equals this run directory's runId. Same-run
- * artifactsDir / runDirectory candidates keep path ownership and skip this.
- * expectedRunId undefined (unparseable run dir) → never bound.
- */
-function presentUniqueFallbackBoundToRun(body, expectedRunId) {
-    if (expectedRunId === undefined)
-        return false;
-    return typeof body.runId === "string" && body.runId === expectedRunId;
-}
-/**
- * Sole authority for seam-owned unique error.<uuid>.json candidates.
- * Used by both clearOpposite (settlement) and readRunTerminalArtifact — do not
- * re-enumerate the same-run / parent unique set elsewhere.
- * Ownership:
- * - same-run dirs (artifacts/, runDir): path ownership — all unique names
- * - parent runs/: only body.runId-bound faces; unparseable runId or unreadable body → none
- */
-export async function listSeamOwnedUniqueErrorFacePaths(runDirectory) {
-    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-    const owned = await listUniqueErrorFallbackPaths([
-        artifactsDir,
-        runDirectory,
-    ]);
-    const expectedRunId = runIdFromRunDirectory(runDirectory);
-    for (const path of await listUniqueErrorFallbackPaths([dirname(runDirectory)])) {
-        const read = await readTerminalArtifactAtPath(path, "error.json");
-        if (read === undefined || read.status !== "present")
-            continue;
-        if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId))
-            continue;
-        owned.push(path);
-    }
-    return owned;
-}
-/**
- * Publish contract (#953): only failure publish continues after clearOpposite
- * failure, so a multi-class residue (residual report/audit beside a new error
- * face) means the current settlement is failure. Prefer failure-class faces
- * over success/audit — never filesystem mtime (copy/restore/utimes can lie).
- */
-function failureClassRank(file) {
-    return file === "error.json" ? 1 : 0;
-}
-/**
- * Read the current typed terminal artifact for a run directory.
- *
- * Candidate set (publisher-owned faces only):
- * 1) conventional artifacts/{report,error,audit-incomplete}.json
- * 2) publisher fixed failure fallbacks (error.settlement.json faces)
- * 3) seam-owned unique error.<uuid>.json via listSeamOwnedUniqueErrorFacePaths
- *    (same-run path ownership + parent body.runId binding — shared with clear)
- *
- * Invariant: when more than one present face remains (e.g. clearOpposite failed
- * during failure publish and a fallback was settled beside a residual report),
- * adopt failure-class over success/audit by the publish contract — not mtime.
- * Same-class ties keep candidate enumeration order (conventional before
- * fallbacks before unique).
- *
- * Unreadable faces never outrank a present face. Parent unique unreadable
- * files never enter the shared enumerator (cannot prove run identity).
- * Absence of every known durable face is a valid no-receipt state.
- */
-export async function readRunTerminalArtifact(runDirectory) {
-    const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-    const present = [];
-    const unreadable = [];
-    const consider = (read) => {
-        if (read === undefined || read.status === "absent")
-            return;
-        if (read.status === "present") {
-            present.push(read);
-            return;
-        }
-        unreadable.push(read);
-    };
-    for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-        consider(await readTerminalArtifactAtPath(join(artifactsDir, file), file));
-    }
-    for (const relative of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-        consider(await readTerminalArtifactAtPath(join(runDirectory, relative), "error.json"));
-    }
-    // Unique same-run + parent-bound faces: one enumerator shared with clear.
-    for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
-        consider(await readTerminalArtifactAtPath(path, "error.json"));
-    }
-    if (present.length > 0) {
-        present.sort((a, b) => failureClassRank(b.file) - failureClassRank(a.file));
-        return present[0];
-    }
-    if (unreadable.length > 0) {
-        return unreadable[0];
-    }
-    return { status: "absent" };
-}

package/dist/run-ticket-number.js

@@ -1,3 +1,4 @@
+import { readPageSync } from "./run-dossier.js";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { isEnoent, isRecord } from "./unknown-value.js";
@@ -61,13 +62,24 @@ async function readJsonObject(path) {
     throw error;
   }
 }
-async function readBoardPageTicketNumber(runDirectory, page) {
-  const record = await readJsonObject(join(runDirectory, page));
+const LEGACY_BOARD_PAGE = {
+  admitted: "admitted-request.json",
+  invocation: "invocation.json"
+};
+function readBoardPageTicketNumberFromRows(runDirectory, section) {
+  const fromRows = readPageSync(runDirectory, section);
+  return fromRows === void 0 ? void 0 : ticketFromRecord(fromRows);
+}
+async function readBoardPageTicketNumberFromLegacy(runDirectory, section) {
+  const record = await readJsonObject(join(runDirectory, LEGACY_BOARD_PAGE[section]));
   if (record === void 0) return void 0;
   return ticketFromRecord(record);
 }
 async function readBoardTicketNumber(runDirectory) {
-  return await readBoardPageTicketNumber(runDirectory, "admitted-request.json") ?? await readBoardPageTicketNumber(runDirectory, "invocation.json");
+  return readBoardPageTicketNumberFromRows(runDirectory, "admitted") ?? readBoardPageTicketNumberFromRows(runDirectory, "invocation");
+}
+async function readMigrationBoardTicketNumber(runDirectory) {
+  return await readBoardTicketNumber(runDirectory) ?? await readBoardPageTicketNumberFromLegacy(runDirectory, "admitted") ?? await readBoardPageTicketNumberFromLegacy(runDirectory, "invocation");
 }
 async function readMigrationDerivedTicketNumber(runDirectory) {
   const record = await readJsonObject(
@@ -88,6 +100,7 @@ export {
   parseTicketNumber,
   readBoardTicketNumber,
   readDeclaredTicketNumber,
+  readMigrationBoardTicketNumber,
   readMigrationDerivedTicketNumber,
   readRunTicketNumber,
   requireSafePositiveTicketNumber,

package/dist/session-identity.js

@@ -1,32 +1,63 @@
-import { mkdir, readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { writeFileAtomically } from "./atomic-write.js";
 import { DEFAULT_ROLE_TURN_HOST, lookupHeadlessHostDescription, lookupHostDescription, } from "./host-descriptions.js";
-/** Durable session binding stored beside the host-owned session principal. */
-export function createSessionIdentityAuthority(authority, sessionBindingFile) {
-    const bindingPath = (principal) => join(authority.decode(principal).sessionDirectory, sessionBindingFile);
+import { renderCurrentSync, RUN_STATE_FILE } from "./run-dossier.js";
+import { readSitianRecords, reportRunRecord } from "./sitian-facade.js";
+import { errorText, isRecord } from "./unknown-value.js";
+/** Log record kind of one host-session binding (a host's native session id for this run). */
+export const HOST_SESSION_ID_RECORD_KIND = "host-session-id";
+/**
+ * Durable session binding: one state row per bind, scoped by host name — a run
+ * that changes hosts on resume must never hand one host's native session id to
+ * another. The latest record for the host wins. The public call projects
+ * `current.json` at the bind so host.sessions appears before the host CLI
+ * starts; a refused projection does not undo the binding fact or become a
+ * host/session failure (facts stay in state.jsonl; settlement still renders).
+ */
+export function createSessionIdentityAuthority(authority, hostName) {
+    const runDirectoryOf = (principal) => dirname(authority.decode(principal).sessionDirectory);
     return {
         resolveSessionFile(principal) {
             return authority.decode(principal).sessionFile;
         },
         async load(principal) {
-            try {
-                const value = JSON.parse(await readFile(bindingPath(principal), "utf8"));
-                if (typeof value !== "object" || value === null || typeof value.sessionId !== "string") {
+            const runDirectory = runDirectoryOf(principal);
+            const { records, diagnostics } = await readSitianRecords(join(runDirectory, RUN_STATE_FILE));
+            // Control path fails closed on damaged rows — same class as readPageSync.
+            // Rendering may keep reachable facts; dispatch must not reuse a prior binding
+            // after syntax damage (#1161 C3).
+            if (diagnostics.length > 0) {
+                throw new Error(`${RUN_STATE_FILE} has ${diagnostics.length} malformed row(s); refusing stale session binding: ${runDirectory}`);
+            }
+            let bound;
+            for (const record of records) {
+                if (record.kind !== HOST_SESSION_ID_RECORD_KIND)
+                    continue;
+                // Non-object / cannot name a host: unattributable damage — refuse
+                // (settled C3-payload). Never treat as a skippable "other host" row.
+                if (!isRecord(record.payload) || typeof record.payload.host !== "string") {
                     throw new Error("durable session binding is invalid");
                 }
-                return value.sessionId;
-            }
-            catch (error) {
-                if (error.code === "ENOENT")
-                    return undefined;
-                throw error;
+                // Explicit other host only: that host's bad id must not block this one.
+                if (record.payload.host !== hostName)
+                    continue;
+                // This host's null / non-string sessionId: refuse — do not reuse a prior
+                // binding for the same host (#1161 C3).
+                if (typeof record.payload.sessionId !== "string") {
+                    throw new Error("durable session binding is invalid");
+                }
+                bound = record.payload.sessionId;
             }
+            return bound;
         },
         async bind(principal, sessionId) {
-            const target = bindingPath(principal);
-            await mkdir(dirname(target), { recursive: true });
-            await writeFileAtomically(target, `${JSON.stringify({ sessionId })}\n`, { mode: 0o600 });
+            const runDirectory = runDirectoryOf(principal);
+            reportRunRecord(runDirectory, HOST_SESSION_ID_RECORD_KIND, { host: hostName, sessionId }, "session-identity");
+            try {
+                renderCurrentSync(runDirectory);
+            }
+            catch (error) {
+                process.stderr.write(`[session-identity] current.json render refused after host-session-id; binding fact kept: ${runDirectory}: ${errorText(error)}\n`);
+            }
         },
     };
 }
@@ -41,7 +72,7 @@ export async function readStoredHostSessionId(host, authority, principal) {
     const description = lookupHostDescription(host) ?? lookupHeadlessHostDescription(host);
     if (description === undefined)
         return undefined;
-    const sessionId = await createSessionIdentityAuthority(authority, description.sessionBindingFile).load(principal);
+    const sessionId = await createSessionIdentityAuthority(authority, host).load(principal);
     if (sessionId === undefined || sessionId === "")
         return undefined;
     return sessionId;

package/dist/sitian-appender.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { sessionDirectoryOf } from "./role-run-placement.js";
+import { basename, dirname, join } from "node:path";
+import { parseRunLeaf, sessionDirectoryOf } from "./role-run-placement.js";
+import { RUN_HISTORY_FILE, RUN_HISTORY_KINDS, RUN_LOG_FILE, RUN_STATE_FILE, RUN_STATE_KINDS } from "./run-dossier-files.js";
 import { ticketNumberFromSitianSubject } from "./run-ticket-number.js";
 import { resolveBookKeyFromGit } from "./activation-ledger-git.js";
 import {
@@ -29,17 +30,7 @@ function appendSitianRecordBlock(input, block) {
     );
   }
 }
-const S4_SUBMISSION_LEDGER_KINDS = /* @__PURE__ */ new Set([
-  "candidate",
-  "roundContext",
-  "outcome",
-  "sealed",
-  "post-seal-anomaly"
-]);
 function resolveSitianVolumeCategory(kind) {
-  if (S4_SUBMISSION_LEDGER_KINDS.has(kind)) {
-    return "submission-ledger";
-  }
   return kind;
 }
 const SITIAN_RECORDS_LEAF = "records.jsonl";
@@ -71,13 +62,20 @@ function resolveSitianRecordPathInLedger(input, ledgerHome) {
     recordFile = paths.recordFile;
   } else if (category === "ticket-provenance" && input.runDirectory !== void 0) {
     sessionDir = input.runDirectory;
-    recordFile = sitianVolumeRecordsFile(sessionDir);
+    recordFile = join(sessionDir, RUN_HISTORY_FILE);
   } else {
     if (input.sessionParent === void 0 || input.sessionParent.length === 0 || !physicallyContainedIn(ledgerHome, input.sessionParent)) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = sitianVolumeDirectory(dirname(input.sessionParent), category);
-    recordFile = sitianVolumeRecordsFile(sessionDir);
+    const sessionParentDir = dirname(input.sessionParent);
+    const runDirectory = dirname(sessionParentDir);
+    if (basename(sessionParentDir) === "session" && parseRunLeaf(basename(runDirectory)) !== void 0) {
+      sessionDir = runDirectory;
+      recordFile = join(runDirectory, RUN_HISTORY_KINDS.has(input.kind) ? RUN_HISTORY_FILE : RUN_STATE_KINDS.has(input.kind) ? RUN_STATE_FILE : RUN_LOG_FILE);
+    } else {
+      sessionDir = sitianVolumeDirectory(sessionParentDir, category);
+      recordFile = sitianVolumeRecordsFile(sessionDir);
+    }
   }
   if (!physicallyContainedIn(ledgerHome, sessionDir)) {
     throw new Error("Sitian record ownership requires a directory inside the ledger home");
@@ -126,7 +124,6 @@ function appendSitianRecord(input) {
   }
 }
 export {
-  S4_SUBMISSION_LEDGER_KINDS,
   appendSitianRecord,
   appendSitianRecordBlock,
   resolveSitianRecordPath,

package/dist/sitian-facade.js

@@ -1,3 +1,4 @@
+import { sessionFileOf } from "./role-run-placement.js";
 import { appendSitianRecord } from "./sitian-appender.js";
 export * from "./sitian-contracts.js";
 export * from "./sitian-appender.js";
@@ -5,6 +6,16 @@ export * from "./sitian-reader.js";
 function sitianReport(input) {
   return appendSitianRecord(input);
 }
+function reportRunRecord(runDirectory, kind, payload, source) {
+  return appendSitianRecord({
+    level: "event",
+    kind,
+    sessionParent: sessionFileOf(runDirectory),
+    source,
+    payload
+  });
+}
 export {
+  reportRunRecord,
   sitianReport
 };

package/dist/sitian-reader.js

@@ -1,41 +1,56 @@
-import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { isRecord, errorText } from "./unknown-value.js";
-async function readSitianRecords(recordFile) {
-  if (!existsSync(recordFile)) {
-    return { records: [], diagnostics: [] };
+import { isRecord, errorText, isEnoent } from "./unknown-value.js";
+function decodeSitianRecordLine(line, lineNumber) {
+  if (!line.trim()) return void 0;
+  try {
+    const parsed = JSON.parse(line);
+    if (isRecord(parsed)) {
+      return { ok: true, record: parsed };
+    }
+    const typeDesc = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
+    return {
+      ok: false,
+      diagnostic: {
+        kind: "malformed",
+        line: lineNumber,
+        raw: line,
+        error: `expected JSON object, got ${typeDesc}`
+      }
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      diagnostic: {
+        kind: "malformed",
+        line: lineNumber,
+        raw: line,
+        error: errorText(error)
+      }
+    };
   }
-  const text = await readFile(recordFile, "utf8");
+}
+function parseSitianRecordText(text) {
   const lines = text.split("\n");
   const records = [];
   const diagnostics = [];
   for (let index = 0; index < lines.length; index += 1) {
-    const line = lines[index];
-    if (!line.trim()) continue;
-    try {
-      const parsed = JSON.parse(line);
-      if (isRecord(parsed)) {
-        records.push(parsed);
-      } else {
-        const typeDesc = parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed;
-        diagnostics.push({
-          kind: "malformed",
-          line: index + 1,
-          raw: line,
-          error: `expected JSON object, got ${typeDesc}`
-        });
-      }
-    } catch (error) {
-      diagnostics.push({
-        kind: "malformed",
-        line: index + 1,
-        raw: line,
-        error: errorText(error)
-      });
-    }
+    const decoded = decodeSitianRecordLine(lines[index], index + 1);
+    if (decoded === void 0) continue;
+    if (decoded.ok) records.push(decoded.record);
+    else diagnostics.push(decoded.diagnostic);
   }
   return { records, diagnostics };
 }
+async function readSitianRecords(recordFile) {
+  try {
+    return parseSitianRecordText(await readFile(recordFile, "utf8"));
+  } catch (error) {
+    if (isEnoent(error)) return { records: [], diagnostics: [] };
+    throw error;
+  }
+}
 export {
+  decodeSitianRecordLine,
+  parseSitianRecordText,
   readSitianRecords
 };

package/dist/submission-gate.js

@@ -52,7 +52,7 @@ export function createDefaultGateOfficerSummon(options) {
     };
 }
 /**
- * Book a typed pointer under parent session/auditor-roles (archivist-owned write).
+ * Book a typed pointer in the parent run's current.json officers section.
  * Offline mocks without a real session leave no nested volume (lawful zero).
  */
 function bookDirectOfficerPointer(context, officer, result, summoned, toolCallId) {