@akagilnc/pi-workflow-roles 0.1.5504 → 0.1.5575

package/src/pi/role-turn-host.ts

@@ -25,10 +25,13 @@ import { ExplicitInternalActivationError } from "../host-contracts.ts";
 import { applyEngineChildEnv, ENGINE_MODEL_FLAG_NAME, normalizeEngineName } from "../engine-detour.ts";
 import { projectActivationFlags } from "../role-activation-flags.ts";
 import { encodeUserDialogueStdin } from "../user-dialogue-stdin.ts";
-import { readStrictPiSessionJsonl } from "../ledger-session-read.ts";
+import { readLedgerSessionJsonlLines, readStrictPiSessionJsonl } from "../ledger-session-read.ts";
+import { copyAndRecordHostDossier } from "../host-session-record.ts";
 import { projectThrownFailureLeaf, retainPackageFault } from "../public-cli/settlement.ts";
 import { describeErrorIdentity } from "../public-cli/run-lifecycle.ts";
 import { RECEIPT_DELIVERY_LIMIT_ENV } from "../receipt-delivery-policy.ts";
+import { createSessionIdentityAuthority } from "../session-identity.ts";
+import { sitianReport } from "../sitian-facade.ts";
 
 /** Package-relative Internal role entrypoint (ADR 0052; same path as public-cli registry). */
 const INTERNAL_ROLE_ENTRYPOINT_RELATIVE = "extensions/role-runtime.ts";
@@ -450,18 +453,63 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
         );
       }
       const timeoutMs = request.timeoutMs ?? config.timeoutMs;
-      return await spawnRunner(args, {
+      const result = await spawnRunner(args, {
         cwd: request.cwd,
         env,
         stdin,
         ...(timeoutMs === undefined ? {} : { timeoutMs }),
         ...(request.signal === undefined ? {} : { signal: request.signal }),
       });
+      // Deliver already-written Pi host facts. Pi lands at session/session.jsonl;
+      // bind projects host.sessions; copy records the landing. Host adapters do
+      // not write current.json — public bind/settlement seams own that render.
+      try {
+        const { sessionFile, sessionDirectory } = config.principalAuthority.decode(request.principal);
+        const sessionId = await readPiSessionHeaderId(sessionFile);
+        if (sessionId !== undefined) {
+          await createSessionIdentityAuthority(config.principalAuthority, "pi").bind(
+            request.principal,
+            sessionId,
+          );
+          copyAndRecordHostDossier({
+            host: "pi",
+            sessionId,
+            cwd: request.cwd,
+            sessionDirectory,
+            sessionParent: sessionFile,
+            ...(request.home !== undefined ? { home: request.home } : {}),
+          });
+        }
+      } catch (error) {
+        await retainPackageFault({
+          runDirectory: request.runDirectory,
+          diagnostic: `pi host dossier record failed beside host terminal: ${describeErrorIdentity(error)}`,
+          error,
+        });
+      }
+      return result;
     },
   };
 }
 
-import { sitianReport } from "../sitian-facade.ts";
+/**
+ * Session header id from the Pi volume the child (or fixture) already wrote.
+ * Reuses the ledger line kernel: a later malformed line must not erase a valid
+ * header already present (ADR 0086 originals are not validated whole-file).
+ */
+async function readPiSessionHeaderId(sessionFile: string): Promise<string | undefined> {
+  try {
+    for (const line of await readLedgerSessionJsonlLines(sessionFile)) {
+      const entry = line.row;
+      if (entry === undefined || entry.type !== "session") continue;
+      if (typeof entry.id === "string" && entry.id.trim() !== "") return entry.id;
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+  return undefined;
+}
 
 /** Last non-session entry id. Session headers are not parents of custom lines. */
 export function piSessionCustomParentId(

package/src/public-cli/auto-resume.ts

@@ -11,10 +11,6 @@
  * path continues: same budget, same call-local count semantics. No failure-type
  * classification — every thrown value is treated identically.
  */
-import { constants as fsConstants } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { open } from "node:fs/promises";
-import { join } from "node:path";
 import type {
   DurablePrincipal,
   DurablePrincipalAuthority,
@@ -33,14 +29,13 @@ import { processCancelSignalName } from "./process-cancel.ts";
 import { isLawfulTypedTerminalOutcome, formatTerminalResult, type TerminalArtifactRef, type TerminalResult, type TerminalRoleName } from "./terminal.ts";
 import {
   attachRecordedSubmissions,
-  ensureRealArtifactsDirectory,
   presentFailureTerminal,
   retainPackageFault,
 } from "./settlement.ts";
 
-export { ensureRealArtifactsDirectory };
 import type { CliIo } from "./cli-io.ts";
 import { serializeThrownValue } from "../serialize-thrown-value.ts";
+import { reportRunRecord } from "../sitian-facade.ts";
 
 import { errorText } from "../unknown-value.ts";
 
@@ -155,41 +150,11 @@ function jsonSafeReplacer(): (key: string, value: unknown) => unknown {
 }
 
 /**
- * Retain one throwing dispatch attempt's complete exception as an independent
- * per-attempt file under the run's artifacts directory, then leave an
- * addressable pointer in the session principal (custom entry). Exclusive-create
- * open (O_EXCL) with a per-attempt unique name enforces 史必追加 (#419): a later
- * attempt can never overwrite an earlier attempt's file.
+ * Retain one throwing dispatch attempt's complete exception as a line in the
+ * run's log.jsonl, then leave an addressable pointer in the session principal
+ * (custom entry). The log only appends (史必追加, #419): a later attempt can
+ * never overwrite an earlier attempt's record.
  */
-/**
- * Hardened create-once JSON write shared by every durable artifact this loop
- * retains directly (dispatch-error dumps, lawful-persist-failure error/
- * evidence records): O_EXCL (fail loud on a colliding name, never overwrite)
- * + O_NOFOLLOW where the platform provides it (a planted symlink is never
- * followed) — mirrors settlement.ts's own hardened artifact writers.
- */
-export async function writeHardenedArtifactFile(
-  artifactsDir: string,
-  namePrefix: string,
-  payload: Record<string, unknown>,
-): Promise<string> {
-  const filePath = join(artifactsDir, `${namePrefix}-${randomUUID()}.json`);
-  const body = `${JSON.stringify(payload, jsonSafeReplacer(), 2)}\n`;
-  const noFollowFlag =
-    typeof fsConstants.O_NOFOLLOW === "number" ? fsConstants.O_NOFOLLOW : 0;
-  const handle = await open(
-    filePath,
-    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag,
-    0o600,
-  );
-  try {
-    await handle.writeFile(body, "utf8");
-  } finally {
-    await handle.close();
-  }
-  return filePath;
-}
-
 async function retainDispatchError(
   admitted: { runDirectory: string; principal: DurablePrincipal },
   principalAuthority: DurablePrincipalAuthority,
@@ -197,14 +162,13 @@ async function retainDispatchError(
   attempt: number,
   error: unknown,
 ): Promise<{ file: string; pointerError?: unknown }> {
-  const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
   // Whole-object dump: everything the thrown value carries, nothing picked.
-  const filePath = await writeHardenedArtifactFile(artifactsDir, `dispatch-error-attempt-${attempt}`, {
+  const filePath = reportRunRecord(admitted.runDirectory, "dispatch-exception", JSON.parse(JSON.stringify({
     version: 1,
     attempt,
     recordedAt: new Date().toISOString(),
     error: serializeThrownValue(error),
-  });
+  }, jsonSafeReplacer())) as Record<string, unknown>, "auto-resume").recordFile;
   // Addressable pointer in the dossier (卷宗): Pi session custom-entry codec
   // (appendPiSessionCustomEntry). Lease still owned here with run-writer.
   let pointerLease: RunWriterLease;

package/src/public-cli/instruction-seat-run.ts

@@ -56,6 +56,7 @@ import {
   type RunDirectoryRelocation,
 } from "./invocation.ts";
 import {
+  bindDiaristAssertedTicketNumber,
   presentControlledFailure,
   packageFaultNoteFor,
   prepareSummonsResumeMaterials,
@@ -321,6 +322,8 @@ async function bindAndRelocateDiarist(
   authority: DurablePrincipalAuthority,
   lease?: RunWriterLease,
 ): Promise<RunDirectoryRelocation | undefined> {
+  // The diarist's asserted ticketNumber binds here, in the public call's process.
+  await bindDiaristAssertedTicketNumber(admitted);
   const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
   if (boardTicket === undefined) return undefined;
   if (admitted.ticketNumber === undefined) {
@@ -1096,7 +1099,11 @@ export async function continueParentAfterChild(
       && heldUnreadableTerminal(stopped.terminal)
       && stopped.terminal !== undefined
     ) {
-      const parentTerminal = await trySettlePublicSeat(admitted, env.principalAuthority, undefined);
+      const parentTerminal = await trySettlePublicSeat(
+        admitted,
+        env.principalAuthority,
+        { ...await readCurrentCourt(admitted.runDirectory), ...packageFaultScope(admitted, env, io) },
+      );
       if (
         parentTerminal?.roleOutcome.kind === "accepted"
         || parentTerminal?.roleOutcome.kind === "audit_escalation"
@@ -1115,7 +1122,7 @@ export async function continueParentAfterChild(
       const terminal = await trySettlePublicSeat(
         admitted,
         env.principalAuthority,
-        packageFaultScope(admitted, env, io),
+        { ...await readCurrentCourt(admitted.runDirectory), ...packageFaultScope(admitted, env, io) },
       );
       if (terminal?.roleOutcome.kind !== "accepted") throw new Error("pending submission is not recorded");
       return auditSubmittedRole({ exitCode: 0, admitted, terminal }, env, io, resolved.admitted, latestQueuePayload(resolved.terminal));

package/src/public-cli/invocation.ts

@@ -30,7 +30,6 @@ import {
   formatRunLeaf,
   isUnboundRunDirectory,
   listBookRunDirectories,
-  roleRunArtifactsDirectory,
   roleRunPlacement,
   type RoleRunSubject,
 } from "../role-run-placement.ts";
@@ -60,6 +59,7 @@ import {
   rewriteRunDirectoryPathFields,
   rewriteRunDirectoryPathValue,
 } from "../role-run-relocation.ts";
+import { readPageSync, renderCurrentSync, updateSectionSync, writeSectionSync } from "../run-dossier.ts";
 import {
   loadDoctorCase,
 } from "../doctor-evidence.ts";
@@ -137,7 +137,6 @@ export type AdmittedRoleInvocationBase = {
   readonly runDirectory: string;
   /** Host-issued opaque durable principal (coordinates only via authority.decode). */
   readonly principal: DurablePrincipal;
-  readonly admittedRequestPath: string;
   /**
    * Optional opaque invocation correlation restored from a prior admitted page
    * (ADR 0049 host channel). Admission does not mint ticket-binding ids.
@@ -318,7 +317,6 @@ export type AdmissionPlacement = {
   readonly sessionDirectory: string;
   readonly sessionFile: string;
   readonly runDirectory: string;
-  readonly artifactsDirectory: string;
   readonly attachmentsDirectory: string;
   readonly ledgerHome: string;
   readonly bookKey: string;
@@ -356,25 +354,20 @@ export function issueAdmissionPlacement(
 }
 
 /**
- * Unique admitted-request.json persistence projection: top-level sessionDirectory/sessionFile
+ * Unique `admitted` section projection of current.json: top-level sessionDirectory/sessionFile
  * (base wire shape). Memory Admitted keeps only the opaque principal — never dual-carry.
  */
-async function writeAdmittedRequestPersistence(
-  admittedRequestPath: string,
+function writeAdmittedRequestPersistence(
+  runDirectory: string,
   body: Record<string, unknown>,
   coordinates: { readonly sessionDirectory: string; readonly sessionFile: string },
-): Promise<void> {
+): void {
   const { principal: _omitPrincipal, ...rest } = body;
-  const projection = {
+  writeSectionSync(runDirectory, "admitted", {
     ...rest,
     sessionDirectory: coordinates.sessionDirectory,
     sessionFile: coordinates.sessionFile,
-  };
-  await writeFile(
-    admittedRequestPath,
-    `${JSON.stringify(projection, null, 2)}\n`,
-    "utf8",
-  );
+  });
 }
 
 /**
@@ -403,7 +396,7 @@ function effectiveModelLedgerFields(
 export { homeFromRunDirectory };
 
 /**
- * Persist one `invocation.json` identity page for the public run.
+ * Persist the `invocation` identity section of current.json for the public run.
  * Admission is the sole source for every field; this is the only identity
  * projection and callers never provide an independent ledger shape.
  * When an effective model is known at admission, provider/model (and thinking
@@ -426,11 +419,7 @@ async function writeRoleInvocationLedger(
     ...(source.ticketNumber === undefined ? {} : { ticketNumber: source.ticketNumber }),
     ...effectiveModelLedgerFields(effectiveModel),
   };
-  await writeFile(
-    join(source.runDirectory, "invocation.json"),
-    `${JSON.stringify(identity, null, 2)}\n`,
-    "utf8",
-  );
+  writeSectionSync(source.runDirectory, "invocation", identity);
 }
 
 /**
@@ -450,7 +439,7 @@ export async function recordEffectiveInvocationModel(
   host?: string,
   engineModel?: string | null,
 ): Promise<void> {
-  await updateDurableJsonPage(join(runDirectory, "invocation.json"), (current) => {
+  updateSectionSync(runDirectory, "invocation", (current) => {
     const next: Record<string, unknown> = { ...current };
     if (model !== undefined) {
       next.provider = model.provider;
@@ -478,33 +467,19 @@ export async function recordEffectiveInvocationModel(
   });
 }
 
-/**
- * Read one durable JSON object, let the caller keep its field rules, and write
- * the page back. `undefined` means the caller decided not to change the page.
- */
-async function updateDurableJsonPage(
-  path: string,
-  update: (current: Record<string, unknown>) => Record<string, unknown> | undefined,
-): Promise<void> {
-  const current = JSON.parse(await readFile(path, "utf8")) as Record<string, unknown>;
-  const next = update(current);
-  if (next === undefined) return;
-  await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, "utf8");
-}
-
-/** Merge observed launch-time fields into the single existing invocation.json identity page. */
+/** Merge observed launch-time fields into the single existing invocation section of current.json. */
 async function mergeInvocationIdentityPage(
   runDirectory: string,
   fields: Record<string, unknown>,
 ): Promise<void> {
-  await updateDurableJsonPage(join(runDirectory, "invocation.json"), (current) => ({
+  updateSectionSync(runDirectory, "invocation", (current) => ({
     ...current,
     ...fields,
   }));
 }
 
 /**
- * Persist parent --source-run path onto admitted-request for officer resume lookup (#747).
+ * Persist parent --source-run path onto the admitted section for officer resume lookup (#747).
  * Reuses the existing notary sourceRunPath key; does not invent a new field name.
  */
 export async function persistAdmittedSourceRunPath(
@@ -515,7 +490,7 @@ export async function persistAdmittedSourceRunPath(
   if (sourceRunPath.trim() === "") {
     throw new Error("persistAdmittedSourceRunPath requires a non-empty sourceRunPath");
   }
-  await updateDurableJsonPage(admitted.admittedRequestPath, (current) => {
+  updateSectionSync(admitted.runDirectory, "admitted", (current) => {
     if (typeof current.sourceRunPath === "string" && current.sourceRunPath !== sourceRunPath) {
       throw new Error(
         `persistAdmittedSourceRunPath refuses to replace ${current.sourceRunPath} with ${sourceRunPath}`,
@@ -533,7 +508,7 @@ export async function persistAdmittedSourceRunPath(
 
 /**
  * Bind a post-admission resolved ticketNumber onto the in-memory admitted
- * object and both durable pages (invocation.json + admitted-request.json).
+ * object and both durable sections (invocation + admitted).
  * A later typed role receipt replaces an earlier assertion (#1025).
  */
 export async function bindAdmittedTicketNumber(
@@ -551,7 +526,7 @@ export async function recordAdmittedCorrelation(
   correlationId: string,
 ): Promise<void> {
   let correlationIds: string[] = [];
-  await updateDurableJsonPage(admitted.admittedRequestPath, (current) => {
+  updateSectionSync(admitted.runDirectory, "admitted", (current) => {
     const prior = [
       ...(Array.isArray(current.correlationIds)
         ? current.correlationIds.filter((value): value is string =>
@@ -598,8 +573,7 @@ export async function relocateAdmittedRunToTicket(
   const principal = authority.seal(target);
 
   if (admitted.role !== "diarist") {
-    const parentPage = JSON.parse(await readFile(admitted.admittedRequestPath, "utf8")) as Record<string, unknown>;
-    const childRunIds = parentPage.childDiaristRunIds;
+    const childRunIds = readPageSync(oldRunDirectory, "admitted")?.childDiaristRunIds;
     for (const childRunId of Array.isArray(childRunIds) ? childRunIds : []) {
       if (typeof childRunId !== "string") continue;
       const childDirectory = join(dirname(oldRunDirectory), formatRunLeaf(childRunId, "diarist"));
@@ -616,6 +590,16 @@ export async function relocateAdmittedRunToTicket(
       await rehomeUnboundTicketProvenance(childDirectory, admitted.ticketNumber, admitted.projectRoot, homeFromRunDirectory(oldRunDirectory));
       ensureRoleRunDirectory(ledgerHome, dirname(childTarget.runDirectory));
       await rename(childDirectory, childTarget.runDirectory);
+      // Finished child legs will not settle again; refresh derived host.original
+      // after the rename commit. A derived render fault must not undo or block
+      // the committed placement (#1161 L1) — note and keep the true cause.
+      try {
+        renderCurrentSync(childTarget.runDirectory);
+      } catch (error) {
+        process.stderr.write(
+          `[invocation] current.json render refused after child relocate; placement kept: ${childTarget.runDirectory}: ${errorText(error)}\n`,
+        );
+      }
     }
   }
 
@@ -629,8 +613,9 @@ export async function relocateAdmittedRunToTicket(
   // Persisted paths are resolved from typed run identity on read.
   await rename(oldRunDirectory, target.runDirectory);
 
-  // rename moved the open lock inode with the directory. Transfer cleanup
-  // ownership immediately after the commit.
+  // rename moved the open lock inode with the directory. Transfer cleanup and
+  // admitted path ownership immediately after the commit — before any derived
+  // render that may refuse (#1161 L1 / BASE order).
   heldLease?.relocate(target.runDirectory);
 
   const admittedRecord = admitted as unknown as Record<string, unknown>;
@@ -638,7 +623,6 @@ export async function relocateAdmittedRunToTicket(
     admittedRecord,
     [
       "runDirectory",
-      "admittedRequestPath",
       "taskPath",
       "packetPath",
       "prerequisitesPath",
@@ -657,6 +641,11 @@ export async function relocateAdmittedRunToTicket(
   }
   (admitted as { principal: DurablePrincipal }).principal = principal;
 
+  // current.json projects host.original from this run directory. Ownership is
+  // already transferred; a refuse still carries the true cause to the caller
+  // (#1161 L1) without leaving the leg under the unbound path.
+  renderCurrentSync(target.runDirectory);
+
   return { oldRunDirectory, newRunDirectory: target.runDirectory };
 }
 
@@ -665,7 +654,7 @@ export async function recordChildDiaristRun(
   parent: AdmittedRoleInvocation,
   childRunId: string,
 ): Promise<void> {
-  await updateDurableJsonPage(parent.admittedRequestPath, (page) => {
+  updateSectionSync(parent.runDirectory, "admitted", (page) => {
     const existing = Array.isArray(page.childDiaristRunIds)
       ? page.childDiaristRunIds.filter((runId): runId is string => typeof runId === "string")
       : [];
@@ -687,9 +676,8 @@ export async function bindTicketNumberOnRunDirectory(
     ticketNumber,
     "bindTicketNumberOnRunDirectory",
   );
-  const admittedPath = join(runDirectory, "admitted-request.json");
   let unchanged = false;
-  await updateDurableJsonPage(admittedPath, (admitted) => {
+  updateSectionSync(runDirectory, "admitted", (admitted) => {
     if (admitted.ticketNumber === ticketNumber) {
       unchanged = true;
       return undefined;
@@ -712,7 +700,7 @@ export async function recordLaunchedPiIdentity(
 }
 
 /**
- * Observed role-package launch provenance written onto the same invocation.json page.
+ * Observed role-package launch provenance written onto the same state.jsonl invocation row.
  * Values are field observations from the public CLI activation seam — never fixed schema markers.
  */
 export type LaunchedRolePackageIdentity = {
@@ -1303,10 +1291,16 @@ async function freezeRegularFileAttachment(
 
 /** Freeze attachments only — ticket binding is the shared LLM seat path (#635). */
 async function freezeAttachments(
+  ledgerHome: string,
   attachmentPaths: readonly string[],
   attachmentsDirectory: string,
 ): Promise<readonly FrozenAttachment[]> {
   const attachments: FrozenAttachment[] = [];
+  // attachments/ appears only when something is frozen; created through the
+  // ledger's symlink-rejecting tree walk, never a plain mkdir.
+  if (attachmentPaths.length > 0) {
+    ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+  }
   for (let i = 0; i < attachmentPaths.length; i += 1) {
     const frozen = await freezeRegularFileAttachment(
       attachmentPaths[i]!,
@@ -1332,7 +1326,7 @@ export async function freezeAttachmentsIntoRun(
   const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
   const attachmentsDirectory = join(runDirectory, "attachments", summonsKey);
   ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-  return freezeAttachments(attachmentPaths, attachmentsDirectory);
+  return freezeAttachments(ledgerHome, attachmentPaths, attachmentsDirectory);
 }
 
 /** Freeze prepared bytes and metadata through one path for birth or retained runs. */
@@ -1673,7 +1667,7 @@ export async function admitPublicRole(
               { cause: error },
             );
           }
-          frozenAttachments = await freezeAttachments(attachmentPaths, placed.attachmentsDirectory);
+          frozenAttachments = await freezeAttachments(placed.ledgerHome, attachmentPaths, placed.attachmentsDirectory);
           return {
             issueNumber,
             caseRunsPath,
@@ -1832,7 +1826,7 @@ export type AdmitJudgeInvocationOptions = {
   /** Injectable clock/id for tests. */
   createRunId?: () => string;
   principalAuthority: DurablePrincipalAuthority;
-  /** Effective model for this invocation — written onto invocation.json. */
+  /** Effective model for this invocation — written onto the state.jsonl invocation row. */
   model?: InvocationEffectiveModel;
   /** Typed ticket already on this summons (起居录 / parent board). Never parsed from prose. */
   assertedTicketNumber?: number;
@@ -1904,7 +1898,7 @@ async function placeRoleAdmission(options: {
   });
   const attachments = options.freezeAttachments === false
     ? []
-    : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
+    : await freezeAttachments(ledgerHome, options.attachmentPaths, attachmentsDirectory);
   return {
     runId,
     bookKey,
@@ -1954,9 +1948,8 @@ async function persistPlacedAdmission(
   },
   placed: PlacedRoleAdmission,
   model: InvocationEffectiveModel | undefined,
-): Promise<string> {
-  const admittedRequestPath = join(placed.runDirectory, "admitted-request.json");
-  await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+): Promise<void> {
+  writeAdmittedRequestPersistence(placed.runDirectory, admitted, {
     sessionDirectory: placed.sessionDirectory,
     sessionFile: placed.sessionFile,
   });
@@ -1969,12 +1962,11 @@ async function persistPlacedAdmission(
     admitted.role,
     model,
   );
-  return admittedRequestPath;
 }
 
 /**
  * Shared admission: project check, placement, attachment freeze,
- * admitted-request and invocation ledger write.
+ * admitted and invocation section write.
  * Countersign passes deferPersistence so same-ticket lookup can reserve coordinates
  * before materializeCountersignInvocation writes the page.
  * Seats whose extra facts are known before placement pass them as admittedFields.
@@ -1988,7 +1980,7 @@ async function admitStandardMaterialInvocation<
 >(
   role: R,
   options: AdmitInspectorInvocationOptions & {
-    /** Reserve coordinates; skip freeze, placement disk, and admitted-request write. */
+    /** Reserve coordinates; skip freeze, placement disk, and admitted section write. */
     readonly deferPersistence?: boolean;
     /** Skip attachment freeze. Gleaner-left admits no caller attachments. */
     readonly freezeAttachments?: boolean;
@@ -2039,9 +2031,7 @@ async function admitStandardMaterialInvocation<
     attachments: persistedAttachmentRefs(placed.attachments),
     ...placed.ticketFields,
   };
-  const admittedRequestPath = defer
-    ? join(placed.runDirectory, "admitted-request.json")
-    : await persistPlacedAdmission(admitted, placed, options.model);
+  if (!defer) await persistPlacedAdmission(admitted, placed, options.model);
   return {
     role,
     runId: placed.runId,
@@ -2052,7 +2042,6 @@ async function admitStandardMaterialInvocation<
     attachments: placed.attachments,
     runDirectory: placed.runDirectory,
     principal: placed.principal,
-    admittedRequestPath,
     ...correlationFields,
     ...placed.ticketFields,
     ...admittedFields,
@@ -2145,7 +2134,7 @@ export type AdmitCountersignInvocationOptions = {
   /** Injectable clock/id for tests. */
   createRunId?: () => string;
   principalAuthority: DurablePrincipalAuthority;
-  /** Effective model for this invocation — written onto invocation.json. */
+  /** Effective model for this invocation — written onto the state.jsonl invocation row. */
   model?: InvocationEffectiveModel;
   correlationId?: string;
   /** Same-ticket lookup may select an existing run before a new run is persisted. */
@@ -2175,10 +2164,6 @@ export async function materializeCountersignInvocation(
   });
   const placement = placed;
   (admitted as { runDirectory: string }).runDirectory = placement.runDirectory;
-  (admitted as { admittedRequestPath: string }).admittedRequestPath = join(
-    placement.runDirectory,
-    "admitted-request.json",
-  );
   (admitted as { principal: DurablePrincipal }).principal = placement.principal;
   const ticketFields = ticketAdmissionFields(options.ticketNumber);
   if (ticketFields.ticketNumber !== undefined) {
@@ -2189,7 +2174,7 @@ export async function materializeCountersignInvocation(
     admitted.runDirectory,
   );
   (admitted as { attachments: readonly FrozenAttachment[] }).attachments = attachments;
-  await writeAdmittedRequestPersistence(admitted.admittedRequestPath, admitted, {
+  writeAdmittedRequestPersistence(admitted.runDirectory, admitted, {
     sessionDirectory: placement.sessionDirectory,
     sessionFile: placement.sessionFile,
   });
@@ -2200,7 +2185,7 @@ export async function materializeCountersignInvocation(
   );
 }
 
-/** Load admitted-request.json written at admission (Navigator work-context seam). */
+/** Load the admitted section written at admission (Navigator work-context seam). */
 export async function loadAdmittedJudgeRequest(
   runDirectory: string,
 ): Promise<{
@@ -2209,11 +2194,8 @@ export async function loadAdmittedJudgeRequest(
   attachments: readonly FrozenAttachment[];
 } | undefined> {
   try {
-    const raw = JSON.parse(
-      await readFile(join(runDirectory, "admitted-request.json"), "utf8"),
-    ) as unknown;
-    if (!isRecord(raw)) return undefined;
-    const record = raw;
+    const record = readPageSync(runDirectory, "admitted");
+    if (record === undefined) return undefined;
     if (!packagedPublicInstructionSubject(record.role)) return undefined;
     if (typeof record.instruction !== "string") return undefined;
     if (typeof record.instructionEmpty !== "boolean") return undefined;
@@ -2228,14 +2210,6 @@ export async function loadAdmittedJudgeRequest(
   }
 }
 
-export async function ensureRunArtifactsDir(runDirectory: string): Promise<string> {
-  const directory = roleRunArtifactsDirectory(runDirectory);
-  return ensureRoleRunDirectory(
-    resolveActivationLedgerHome(homeFromRunDirectory(runDirectory)),
-    directory,
-  );
-}
-
 export type AdmitFixerInvocationOptions = {
   home: string;
   principalAuthority: DurablePrincipalAuthority;
@@ -2247,7 +2221,7 @@ export type AdmitFixerInvocationOptions = {
   prerequisitesPath?: string;
   project?: string;
   createRunId?: () => string;
-  /** Effective model for this invocation — written onto invocation.json. */
+  /** Effective model for this invocation — written onto the state.jsonl invocation row. */
   model?: InvocationEffectiveModel;
   /** Typed ticket already on this summons. Placement uses it; code does not infer one. */
   assertedTicketNumber?: number;
@@ -2402,7 +2376,7 @@ export type AdmitReviewerInvocationOptions = {
   project?: string;
   createRunId?: () => string;
   correlationId?: string;
-  /** Effective model for this invocation — written onto invocation.json. */
+  /** Effective model for this invocation — written onto the state.jsonl invocation row. */
   model?: InvocationEffectiveModel;
   /** Typed ticket already on this summons. Placement uses it; code does not infer one. */
   assertedTicketNumber?: number;
@@ -2455,7 +2429,7 @@ export type AdmitMergerInvocationOptions = {
   attachmentPaths: readonly string[];
   project?: string;
   createRunId?: () => string;
-  /** Effective model for this invocation — written onto invocation.json. */
+  /** Effective model for this invocation — written onto the state.jsonl invocation row. */
   model?: InvocationEffectiveModel;
   /** Typed ticket already on this summons. Placement uses it; code does not infer one. */
   assertedTicketNumber?: number;