@akagilnc/pi-workflow-roles 0.1.5504 → 0.1.5571

package/src/public-cli/post-admission.ts

@@ -26,10 +26,11 @@ import {
   relocateAdmittedRunToTicket,
 } from "./invocation.ts";
 import { readRecordedSubmissionRows } from "../submission-ledger.ts";
-import { readDeclaredTicketNumber } from "../run-ticket-number.ts";
+import { parseTicketNumber, readDeclaredTicketNumber } from "../run-ticket-number.ts";
 import { pathContainedIn } from "../activation-ledger-topology.ts";
 import { pickEngineAxis } from "../package-resources/engine-material.ts";
 import { readStoredHostSessionId } from "../session-identity.ts";
+import { reportRunRecord } from "../sitian-facade.ts";
 import {
   createReceiptDeliveryPolicy,
   deliveryLimitFromConfig,
@@ -86,7 +87,6 @@ import {
   type CatchableProcessSignal,
 } from "./process-cancel.ts";
 import { DEFAULT_ROLE_TURN_HOST } from "../host-descriptions.ts";
-import { recordRunStart } from "../host-session-record.ts";
 import {
   classifyPostAdmissionFailure,
   exitCodeForTerminalOutcome,
@@ -112,7 +112,6 @@ import {
   type TerminalResult,
 } from "./terminal.ts";
 import {
-  ensureRealArtifactsDirectory,
   persistReturnedRunState,
   presentTerminal,
   runWithAutoResumeLoop,
@@ -175,6 +174,7 @@ async function settleProcessCancelAfterTurn<A extends AdmittedRoleInvocation, T
   deferredPersist: { needsPersist?: true } | Record<string, never>;
   invocationScopeId: string | undefined;
   notePackageFault?: (diagnostic: string) => void | Promise<void>;
+  courtAttemptId?: string;
 }): Promise<{
   exitCode: number;
   admitted: A;
@@ -205,6 +205,7 @@ async function settleProcessCancelAfterTurn<A extends AdmittedRoleInvocation, T
     input.io,
     input.persistRunState,
     input.notePackageFault,
+    input.courtAttemptId,
   );
   return {
     ...failed,
@@ -379,7 +380,7 @@ export type ControlledFailureInput = {
   knownDetails?: Readonly<Record<string, unknown>>;
   /**
    * A real failure this package hit while handling the call (e.g. the
-   * stderr.log durable write). Recorded beside the host's report; never a
+   * stderr log-line write). Recorded beside the host's report; never a
    * cause, and never written into the host's open `details`.
    */
   packageFact?: PackageSideFact;
@@ -473,6 +474,8 @@ export async function presentControlledFailure<
   io: CliIo,
   persistRunState = true,
   notePackageFault?: (diagnostic: string) => void | Promise<void>,
+  /** Open-court identity already on the turn request / currentCourt (#1161). */
+  courtAttemptId?: string,
 ): Promise<{
   exitCode: number;
   admitted: A;
@@ -545,6 +548,9 @@ export async function presentControlledFailure<
     const settled = await settleFailureTerminalResult(admitted, failure, authority, {
       recordAttemptHistory: true,
       ...(notePackageFault === undefined ? {} : { notePackageFault }),
+      ...(courtAttemptId === undefined || courtAttemptId.length === 0
+        ? {}
+        : { courtAttemptId }),
       ...(failureInput.invocationScopeId === undefined ||
         failureInput.invocationScopeId.length === 0
         ? {}
@@ -588,6 +594,7 @@ async function settleAfterTurnStarted<
   io: CliIo,
   persistRunState: boolean,
   notePackageFault?: (diagnostic: string) => void | Promise<void>,
+  courtAttemptId?: string,
 ): Promise<{ exitCode: number; admitted: A; terminal: T }> {
   try {
     return (await presentControlledFailure(
@@ -598,6 +605,7 @@ async function settleAfterTurnStarted<
       io,
       persistRunState,
       notePackageFault,
+      courtAttemptId,
     )) as { exitCode: number; admitted: A; terminal: T };
   } catch (error) {
     throw new TurnDispatchedFailure(error);
@@ -666,18 +674,12 @@ function settlementScopeForTurn(request: RoleTurnRequest): SettlementCourtScope
  *
  * The caller owns the live delivery policy; the request projects its next send.
  */
-async function buildReceiptDeliveryRequest<A extends AdmittedRoleInvocation>(input: {
-  admitted: A;
-  env: PostAdmissionEnv;
+/** Bare in-call催交 resume: hostSessionId absent; adapter is the sole load authority. */
+function buildReceiptDeliveryRequest(input: {
   request: RoleTurnRequest;
   receiptDelivery: ReturnType<typeof createReceiptDeliveryPolicy>;
-}): Promise<RoleTurnRequest> {
-  const { admitted, env, request, receiptDelivery } = input;
-  const hostSessionId = await readStoredHostSessionId(
-    env.host,
-    env.principalAuthority,
-    admitted.principal,
-  );
+}): RoleTurnRequest {
+  const { request, receiptDelivery } = input;
   return {
     ...request,
     continuation: {
@@ -686,7 +688,6 @@ async function buildReceiptDeliveryRequest<A extends AdmittedRoleInvocation>(inp
         ...receiptDelivery.deliveryState(),
         deliveryTurns: receiptDelivery.issuedDeliveryRequests() + 1,
       }),
-      ...(hostSessionId === undefined ? {} : { hostSessionId }),
     },
     deliveryRequestLimit: receiptDelivery.limit,
   };
@@ -760,20 +761,16 @@ async function settleCompletedHostTurn<
   // machinery once the retry budget is exhausted.
   let stderrLogWriteFailure: unknown;
   try {
-    await writeFile(
-      join(admitted.runDirectory, "stderr.log"),
-      result.stderr,
-      "utf8",
-    );
+    reportRunRecord(admitted.runDirectory, "stderr", { text: result.stderr }, "post-admission");
   } catch (error) {
     stderrLogWriteFailure = error;
-    // Best-effort: stderr.log is secondary to the host terminal. A write
+    // Best-effort: the stderr log line is secondary to the host terminal. A write
     // failure leaves a durable note and, on a host failure, rides in
     // packageFact. It does not become the cause.
     await recordBestEffortPostDispatchDiagnostic(
       admitted,
       env,
-      `stderr.log write failed (best-effort continue): ${describeErrorIdentity(error)}`,
+      `stderr log write failed (best-effort continue): ${describeErrorIdentity(error)}`,
       io,
     );
   }
@@ -781,7 +778,7 @@ async function settleCompletedHostTurn<
   // Host facts are resolved before trySettle. A host failure skips trySettle
   // so a later read cannot replace that report. A clean host whose settlement
   // read throws is noted above and is not turned into a failure terminal.
-  // stderr.log and run-state writes are notes beside the host terminal.
+  // the stderr log line and run-state writes are notes beside the host terminal.
   let settled: T | undefined;
   let settledOutcome:
     | { exitCode: number; admitted: A; terminal: T; turnDispatched: true }
@@ -841,6 +838,9 @@ async function settleCompletedHostTurn<
           deferredPersist,
           invocationScopeId: request.invocationScopeId,
           notePackageFault: courtScope.notePackageFault,
+          ...(courtScope.courtAttemptId === undefined
+            ? {}
+            : { courtAttemptId: courtScope.courtAttemptId }),
         }),
       ) };
     }
@@ -892,6 +892,7 @@ async function settleCompletedHostTurn<
       io,
       persistRunState,
       courtScope.notePackageFault,
+      courtScope.courtAttemptId,
     );
     return { kind: "settled", outcome: await finishAfterTurn(
       withProcessCancelSkipAutoResume(
@@ -904,6 +905,64 @@ async function settleCompletedHostTurn<
   return { kind: "still-missing" };
 }
 
+/**
+ * #858 / #1071: the first identifiable ticketNumber field declaration among the
+ * run's sealed rows files an unbound run (integer, digit string, or leading #N
+ * token). Terminal rows match settlement (#881): accepted and audit-escalation —
+ * an escalated submission still carries the original role params. Later
+ * receipts remain untouched; prose note/report is never consulted; this seam
+ * does not adjudicate a ticket change. Runs in the public call's own process
+ * (no role leg writes the run's current.json).
+ */
+export async function bindSealedTicketNumber(admitted: AdmittedRoleInvocation): Promise<void> {
+  if (admitted.ticketNumber !== undefined) return;
+  const rows = await readRecordedSubmissionRows(
+    admitted.projectRoot,
+    admitted.runId,
+    ledgerReadScope(admitted),
+  );
+  let ticketNumber: number | undefined;
+  for (const row of rows) {
+    if (
+      row.role !== admitted.role
+      || (row.kind !== "accepted" && row.kind !== "audit-escalation")
+    ) {
+      continue;
+    }
+    const payload = row.accepted;
+    if (!isRecord(payload)) continue;
+    ticketNumber = readDeclaredTicketNumber(
+      (payload as { ticketNumber?: unknown }).ticketNumber,
+    );
+    if (ticketNumber !== undefined) break;
+  }
+  if (ticketNumber !== undefined) await bindAdmittedTicketNumber(admitted, ticketNumber);
+}
+
+/**
+ * The ticket a diarist asserted on a completed submission, whether or not the
+ * rest of that submission was later accepted (a bounds reask does not unsay the
+ * ticket). Before this ran in the leg's accept hook; the leg now only appends its
+ * ledger rows and the public call's own process binds the ticket from them.
+ */
+export async function bindDiaristAssertedTicketNumber(admitted: AdmittedRoleInvocation): Promise<void> {
+  if (admitted.ticketNumber !== undefined) return;
+  const rows = await readRecordedSubmissionRows(
+    admitted.projectRoot,
+    admitted.runId,
+    ledgerReadScope(admitted),
+  );
+  for (const row of rows) {
+    if (row.role !== admitted.role || !isRecord(row.accepted)) continue;
+    if (row.accepted.status !== "completed" || !("ticketNumber" in row.accepted)) continue;
+    const ticketNumber = parseTicketNumber(row.accepted.ticketNumber);
+    if (ticketNumber !== undefined) {
+      await bindAdmittedTicketNumber(admitted, ticketNumber);
+      return;
+    }
+  }
+}
+
 export async function dispatchPostAdmissionTurn<
   A extends AdmittedRoleInvocation,
   T extends TerminalResult = TerminalResult,
@@ -991,6 +1050,7 @@ export async function dispatchPostAdmissionTurn<
           io,
           persistRunState,
           courtScope.notePackageFault,
+          courtScope.courtAttemptId,
         )),
         turnDispatched: true as const,
         skipAutoResume: true as const,
@@ -1042,29 +1102,7 @@ export async function dispatchPostAdmissionTurn<
       // an escalated submission still carries the original role params.
       // Later receipts remain untouched; prose note/report is never consulted;
       // this seam does not adjudicate a ticket change.
-      if (admitted.ticketNumber === undefined) {
-        const rows = await readRecordedSubmissionRows(
-          admitted.projectRoot,
-          admitted.runId,
-          ledgerReadScope(admitted),
-        );
-        let ticketNumber: number | undefined;
-        for (const row of rows) {
-          if (
-            row.role !== admitted.role
-            || (row.kind !== "accepted" && row.kind !== "audit-escalation")
-          ) {
-            continue;
-          }
-          const payload = row.accepted;
-          if (!isRecord(payload)) continue;
-          ticketNumber = readDeclaredTicketNumber(
-            (payload as { ticketNumber?: unknown }).ticketNumber,
-          );
-          if (ticketNumber !== undefined) break;
-        }
-        if (ticketNumber !== undefined) await bindAdmittedTicketNumber(admitted, ticketNumber);
-      }
+      await bindSealedTicketNumber(admitted);
       // #863: shared post-admission bind must relocate unbound→ticket in-home
       // before lease release (work-seat self-report and any prior board bind).
       const relocation = await relocateAdmittedRunToTicket(admitted, env.principalAuthority, lease);
@@ -1102,6 +1140,7 @@ export async function dispatchPostAdmissionTurn<
           io,
           persistRunState,
           courtScope.notePackageFault,
+          courtScope.courtAttemptId,
         )) as { exitCode: number; admitted: A; terminal: T },
         ...(result.turnDispatched === true ? { turnDispatched: true as const } : {}),
         ...(result.skipAutoResume === true ? { skipAutoResume: true as const } : {}),
@@ -1140,6 +1179,7 @@ export async function dispatchPostAdmissionTurn<
           io,
           persistRunState,
           courtScope.notePackageFault,
+          courtScope.courtAttemptId,
         )) as { exitCode: number; admitted: A; terminal: T };
         return { ...settled, ...deferredPersist };
       }
@@ -1160,7 +1200,7 @@ export async function dispatchPostAdmissionTurn<
       turnRequest = { ...turnRequest, stationChild: env.stationChild };
     }
     // Selected host axis rides the shared Host envelope for in-turn tools
-    // (detour usage ledger) — never a pre-spawn invocation.json reread.
+    // (detour usage ledger) — never a pre-spawn current.json reread.
     if (typeof env.host === "string" && env.host.trim() !== "") {
       turnRequest = { ...turnRequest, host: env.host.trim() };
     }
@@ -1186,7 +1226,6 @@ export async function dispatchPostAdmissionTurn<
       // host CLI's native resume. Nothing here may gate, redirect or reshape
       // that dispatch on prior conclusions, row counts or report presence;
       // the authoritative post-turn settlement reads whatever really happened.
-      recordRunStart(admitted.runDirectory);
       turnDispatched = true;
       result = await env.roleTurnHost.executeTurn(turnRequest);
     } catch (error) {
@@ -1207,6 +1246,7 @@ export async function dispatchPostAdmissionTurn<
         io,
         persistRunState,
         courtScope.notePackageFault,
+        courtScope.courtAttemptId,
       );
       return await finishAfterTurn(
         withProcessCancelSkipAutoResume(
@@ -1248,11 +1288,9 @@ export async function dispatchPostAdmissionTurn<
       let deliveryResult: RoleTurnResult;
       let deliveryTurnRequest: RoleTurnRequest;
       try {
-        const deliveryRequest = await buildReceiptDeliveryRequest({
-          admitted,
-          env,
-          // Host and the other axes already selected on this turn ride the
-          // shared projection. The pre-projection request does not have them.
+        // Host and the other axes already selected on this turn ride the
+        // shared projection. The pre-projection request does not have them.
+        const deliveryRequest = buildReceiptDeliveryRequest({
           request: turnRequest,
           receiptDelivery,
         });
@@ -1281,6 +1319,8 @@ export async function dispatchPostAdmissionTurn<
           env.principalAuthority,
           io,
           persistRunState,
+          courtScope.notePackageFault,
+          courtScope.courtAttemptId,
         );
         return await finishAfterTurn(
           withProcessCancelSkipAutoResume(
@@ -1361,6 +1401,9 @@ export async function dispatchPostAdmissionTurn<
           deferredPersist,
           invocationScopeId: request.invocationScopeId,
           notePackageFault: courtScope.notePackageFault,
+          ...(courtScope.courtAttemptId === undefined
+            ? {}
+            : { courtAttemptId: courtScope.courtAttemptId }),
         }),
       );
     }
@@ -1758,6 +1801,9 @@ export async function runPostAdmissionSeatResume<
           }
         }
 
+        // Public explicit resume: attach the stored native id when the caller
+        // left it unset (399c3c8c). In-call auto-resume / 催交 / gate retry omit
+        // the field; those load inside the host adapter (host-contracts).
         let turnRequest = await input.buildTurnRequest(admittedForBuild, request);
         if (
           turnRequest.continuation.kind === "resume"
@@ -1872,7 +1918,7 @@ export async function runPostAdmissionSeatResume<
     await presentResumeFailurePointer(
       input.io,
       error,
-      (failure) => writeResumeDiagnosticFile(
+      (failure) => writeResumeDiagnostic(
         loaded.admitted.runDirectory,
         loaded.admitted.runId,
         failure,
@@ -1904,13 +1950,13 @@ async function pointExistingRunFailure(
     record = await readRoleRunState(runDirectory, authority);
   } catch {
     await presentResumeFailurePointer(io, thrown, (failure) =>
-      writeResumeDiagnosticFile(runDirectory, runId, failure),
+      writeResumeDiagnostic(runDirectory, runId, failure),
     );
     return true;
   }
   if (record === undefined) return false;
   await presentResumeFailurePointer(io, thrown, (failure) =>
-    writeResumeDiagnosticFile(runDirectory, runId, failure, record.role),
+    writeResumeDiagnostic(runDirectory, runId, failure, record.role),
   );
   return true;
 }
@@ -1966,27 +2012,20 @@ async function presentResumeFailurePointer(
   }
 }
 
-async function writeResumeDiagnosticFile(
+async function writeResumeDiagnostic(
   runDirectory: string,
   runId: string,
   failure: ControlledFailure,
   role?: AdmittedRoleInvocation["role"],
 ): Promise<string> {
-  const dir = await ensureRealArtifactsDirectory(runDirectory);
-  const path = join(dir, `resume-diagnostic-${randomUUID()}.json`);
-  await writeFile(
-    path,
-    `${JSON.stringify({
-      runId,
-      ...(role === undefined ? {} : { role }),
-      diagnostic: failure.diagnostic,
-      ...(failure.cause === undefined ? {} : { cause: failure.cause }),
-      ...(failure.identity === undefined ? {} : { identity: failure.identity }),
-      ...(failure.details === undefined ? {} : { details: failure.details }),
-    }, null, 2)}\n`,
-    { encoding: "utf8", flag: "wx" },
-  );
-  return path;
+  return reportRunRecord(runDirectory, "resume-diagnostic", {
+    runId,
+    ...(role === undefined ? {} : { role }),
+    diagnostic: failure.diagnostic,
+    ...(failure.cause === undefined ? {} : { cause: failure.cause }),
+    ...(failure.identity === undefined ? {} : { identity: failure.identity }),
+    ...(failure.details === undefined ? {} : { details: failure.details }),
+  }, "post-admission").recordFile;
 }
 
 /**

package/src/public-cli/run-lifecycle.ts

@@ -63,6 +63,7 @@ import {
   type ReviewerLens,
 } from "./invocation.ts";
 
+import { readPageSync, writeSectionSync } from "../run-dossier.ts";
 import { isRecord, errorText, isEnoent } from "../unknown-value.ts";
 
 export type RoleRunState = "admitted" | "running" | "resumable" | "terminal";
@@ -83,7 +84,6 @@ export type RoleRunRecord = {
   /** Exact Pi session file principal reopened on resume (not directory-latest). */
   readonly sessionFile: string;
   readonly runDirectory: string;
-  readonly admittedRequestPath: string;
   /** Coder/Fixer — preserved for resume continuation. */
   readonly phase?: CoderPhase | FixerPhase;
 };
@@ -154,7 +154,6 @@ export function buildAutoResumeContinuationPrompt(options: {
   ).join("\n");
 }
 
-const RUN_STATE_FILE = "run-state.json";
 const WRITER_LOCK_FILE = "writer.lock";
 
 export async function writeRoleRunState(
@@ -162,15 +161,11 @@ export async function writeRoleRunState(
   record: Omit<RoleRunRecord, "runDirectory">,
 ): Promise<void> {
   const payload: RoleRunRecord = { ...record, runDirectory };
-  await writeFile(
-    join(runDirectory, RUN_STATE_FILE),
-    `${JSON.stringify(payload, null, 2)}\n`,
-    "utf8",
-  );
+  writeSectionSync(runDirectory, "runState", { ...payload });
 }
 
 /**
- * Uninterpreted principal wire as stored on run-state.json.
+ * Uninterpreted principal wire as stored on the state.jsonl run-state row.
  * Legacy rows may omit sessionFile; only DurablePrincipalAuthority decodes it.
  */
 type RoleRunPrincipalWire = {
@@ -186,7 +181,6 @@ type RoleRunStateDisk = {
   readonly bookKey: string;
   readonly projectRoot: string;
   readonly runDirectory: string;
-  readonly admittedRequestPath: string;
   readonly principalWire: RoleRunPrincipalWire;
   readonly phase?: CoderPhase | FixerPhase;
   /** Open court turn (#637); omit when no unsealed current court. */
@@ -263,20 +257,13 @@ function parseCurrentCourtState(raw: unknown): CurrentCourtState | undefined {
 }
 
 async function readRoleRunStateRaw(runDirectory: string): Promise<unknown | undefined> {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(await readFile(join(runDirectory, RUN_STATE_FILE), "utf8"));
-  } catch (error) {
-    // Only true absence (ENOENT) is a lawful "no run state yet". A real read
-    // failure (EISDIR, EACCES, ...) or a JSON.parse SyntaxError on a present
-    // file is genuine infrastructure/data damage and must keep its own
-    // identity — callers route it through the controlled-failure seam
-    // (markRunRunning/markRunTerminal/recordCurrentCourt)
-    // instead of it being relabeled "run state missing" (#836).
-    if (errorCodeOf(error) === "ENOENT") return undefined;
-    throw error;
-  }
-  return raw;
+  // Only true absence (no state.jsonl run-state row) is a lawful "no run state
+  // yet". A real read failure (EISDIR, EACCES, ...) or an illegal latest payload
+  // is genuine infrastructure/data damage and must keep its own identity —
+  // callers route it through the controlled-failure seam
+  // (markRunRunning/markRunTerminal/recordCurrentCourt) instead of it being
+  // relabeled "run state missing" (#836). readPageSync throws those.
+  return readPageSync(runDirectory, "runState");
 }
 
 function parseRoleRunIdentity(raw: unknown, runDirectory: string): {
@@ -287,15 +274,15 @@ function parseRoleRunIdentity(raw: unknown, runDirectory: string): {
   readonly state: RoleRunState;
 } {
   if (!isRecord(raw)) {
-    throw new TypeError("Invalid run-state.json");
+    throw new TypeError("Invalid state.jsonl run-state");
   }
   const record = raw;
   if (typeof record.runId !== "string" || record.runId.trim() === "") {
-    throw new TypeError("Invalid run-state.json");
+    throw new TypeError("Invalid state.jsonl run-state");
   }
   const role = typeof record.role === "string" ? packagedRoleMetadata(record.role)?.role : undefined;
   if (role === undefined) {
-    throw new TypeError("Invalid run-state.json");
+    throw new TypeError("Invalid state.jsonl run-state");
   }
   if (
     record.state !== "admitted" &&
@@ -303,9 +290,9 @@ function parseRoleRunIdentity(raw: unknown, runDirectory: string): {
     record.state !== "resumable" &&
     record.state !== "terminal"
   ) {
-    throw new TypeError("Invalid run-state.json");
+    throw new TypeError("Invalid state.jsonl run-state");
   }
-  if (typeof record.bookKey !== "string") throw new TypeError("Invalid run-state.json");
+  if (typeof record.bookKey !== "string") throw new TypeError("Invalid state.jsonl run-state");
   return {
     runId: record.runId,
     role,
@@ -322,9 +309,8 @@ async function readRoleRunStateDisk(
   if (raw === undefined) return undefined;
   const identity = parseRoleRunIdentity(raw, runDirectory);
   const record = raw as Record<string, unknown>;
-  if (typeof record.projectRoot !== "string") throw new TypeError("Invalid run-state.json");
-  if (typeof record.sessionDirectory !== "string") throw new TypeError("Invalid run-state.json");
-  if (typeof record.admittedRequestPath !== "string") throw new TypeError("Invalid run-state.json");
+  if (typeof record.projectRoot !== "string") throw new TypeError("Invalid state.jsonl run-state");
+  if (typeof record.sessionDirectory !== "string") throw new TypeError("Invalid state.jsonl run-state");
   const storedRunDirectory =
     typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
       ? record.runDirectory
@@ -353,11 +339,6 @@ async function readRoleRunStateDisk(
     bookKey: identity.bookKey,
     projectRoot: record.projectRoot,
     runDirectory: runDir,
-    admittedRequestPath: rewriteRunDirectoryPathValue(
-      record.admittedRequestPath,
-      storedRunDirectory,
-      runDirectory,
-    ) as string,
     principalWire,
     ...(phase === undefined ? {} : { phase }),
     ...(currentCourt === undefined ? {} : { currentCourt }),
@@ -379,15 +360,10 @@ async function writeRoleRunStateDisk(
     ...(disk.principalWire.sessionFile === undefined
       ? {}
       : { sessionFile: disk.principalWire.sessionFile }),
-    admittedRequestPath: disk.admittedRequestPath,
     ...(disk.phase === undefined ? {} : { phase: disk.phase }),
     ...(disk.currentCourt === undefined ? {} : { currentCourt: disk.currentCourt }),
   };
-  await writeFile(
-    join(runDirectory, RUN_STATE_FILE),
-    `${JSON.stringify(payload, null, 2)}\n`,
-    "utf8",
-  );
+  writeSectionSync(runDirectory, "runState", payload);
 }
 
 /** One authority.decode of the uninterpreted wire → record + opaque principal (frozen wire itself). */
@@ -408,7 +384,6 @@ function materializeRoleRunFromDisk(
         sessionDirectory: coordinates.sessionDirectory,
         sessionFile: coordinates.sessionFile,
         runDirectory: disk.runDirectory,
-        admittedRequestPath: disk.admittedRequestPath,
         ...(disk.phase === undefined ? {} : { phase: disk.phase }),
       },
     };
@@ -467,7 +442,6 @@ export async function markRunAdmitted(
     projectRoot: admitted.projectRoot,
     sessionDirectory,
     sessionFile,
-    admittedRequestPath: admitted.admittedRequestPath,
     ...(workerPhase === undefined ? {} : { phase: workerPhase }),
   });
 }
@@ -475,7 +449,7 @@ export async function markRunAdmitted(
 /**
  * Shared dispatch execution seam: transition to running, then record the
  * effective launch model (initial or resume override) and the authoritative
- * seat engine/host onto invocation.json.
+ * seat engine/host onto the invocation section.
  * Role runners must not coordinate lifecycle ledger writes themselves.
  * Engine axis is authoritative here (#617): present string is written; omit/undefined
  * clears any prior engine key so unset-engine + resume does not keep a stale value.
@@ -945,19 +919,8 @@ export function parentRunPathFromGatePointerInstruction(
 export async function readRunParentPath(
   runDirectory: string,
 ): Promise<string | undefined> {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(
-      await readFile(join(runDirectory, "admitted-request.json"), "utf8"),
-    );
-  } catch (error) {
-    if (errorCodeOf(error) === "ENOENT") return undefined;
-    throw error;
-  }
-  if (!isRecord(raw)) {
-    return undefined;
-  }
-  const record = raw;
+  const record = readPageSync(runDirectory, "admitted");
+  if (record === undefined) return undefined;
   if (typeof record.sourceRunPath === "string" && record.sourceRunPath.trim() !== "") {
     return record.sourceRunPath;
   }
@@ -1127,7 +1090,7 @@ async function loadResumableRunRecord(
     throw new CliUsageError(`unknown role run id: ${runId}`);
   }
   const { run, principal } = materialized;
-  // Reconstruct admitted identity from durable run record + admitted-request.json.
+  // Reconstruct admitted identity from durable run record + the admitted section.
   let instruction = "";
   let instructionEmpty = true;
   let attachments: FrozenAttachment[] = [];
@@ -1155,11 +1118,9 @@ async function loadResumableRunRecord(
   let sourceRunPath: string | undefined;
   let sourceRun: NotarySourceRunLocator | undefined;
   try {
-    const raw: unknown = JSON.parse(
-      await readFile(run.admittedRequestPath, "utf8"),
-    );
-    if (isRecord(raw)) {
-      const record = raw as Record<string, unknown>;
+    const record = readPageSync(run.runDirectory, "admitted");
+    if (record === undefined) throw new Error("state.jsonl has no admitted-request row");
+    {
       const storedRunDirectory =
         typeof record.runDirectory === "string" && record.runDirectory.trim() !== ""
           ? record.runDirectory
@@ -1318,13 +1279,8 @@ async function loadResumableRunRecord(
   }
   let model: InvocationEffectiveModel | undefined;
   try {
-    const invocationRaw: unknown = JSON.parse(
-      await readFile(join(run.runDirectory, "invocation.json"), "utf8"),
-    );
-    if (
-      isRecord(invocationRaw)
-    ) {
-      const rec = invocationRaw as Record<string, unknown>;
+    const rec = readPageSync(run.runDirectory, "invocation");
+    if (rec !== undefined) {
       if (typeof rec.provider === "string" && typeof rec.model === "string") {
         model = {
           provider: rec.provider,
@@ -1423,7 +1379,6 @@ function resumedBaseAdmitted(loaded: {
     attachments: loaded.admittedFields.attachments,
     runDirectory: loaded.run.runDirectory,
     principal: loaded.principal,
-    admittedRequestPath: loaded.run.admittedRequestPath,
     ...(loaded.admittedFields.model === undefined ? {} : { model: loaded.admittedFields.model }),
     ...restoredTicketFields(loaded.admittedFields),
   };