@akagilnc/pi-workflow-roles 0.1.5504 → 0.1.5575

package/src/run-terminal-artifacts.ts

@@ -1,275 +1,121 @@
 /**
- * Canonical layout and reader for run-directory typed terminal artifacts.
- * Settlement publish*Artifacts uses these names (report.json / error.json /
- * audit-incomplete.json under artifacts/, plus durable failure fallbacks).
- * The reader only checks presence and structural
+ * The leg's terminal: the `terminal` section of current.json (#1161), written
+ * whole by settlement, last write wins. `report` = an accepted / escalated
+ * receipt, `error` = a controlled failure, `no_receipt` = the leg ended with no
+ * accepted receipt (#836). The reader only checks presence and structural
  * readability — it does not re-derive role outcomes or invent a second
  * candidate algorithm.
  */
-import { randomUUID } from "node:crypto";
-import { readdir, readFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
+import { basename } from "node:path";
 
-import { parseRunLeaf, roleRunArtifactsDirectory } from "./role-run-placement.ts";
+import { parseRunLeaf } from "./role-run-placement.ts";
+import { readHistoryRowsSync, readSectionSync, writeSectionSync } from "./run-dossier.ts";
 
-import { isRecord, errorText, isMissingPathError } from "./unknown-value.ts";
+import { isRecord } from "./unknown-value.ts";
 
-export const RUN_TERMINAL_REPORT_FILE = "report.json" as const;
-export const RUN_TERMINAL_ERROR_FILE = "error.json" as const;
-export const RUN_TERMINAL_EVIDENCE_FILE = "evidence.json" as const;
-export const RUN_TERMINAL_ERROR_SETTLEMENT_FILE = "error.settlement.json" as const;
-export const RUN_TERMINAL_ARTIFACT_FILES = [
-  RUN_TERMINAL_REPORT_FILE,
-  RUN_TERMINAL_ERROR_FILE,
-  "audit-incomplete.json",
-] as const;
+export type RunTerminalFace = "report" | "error" | "no_receipt";
 
-export type RunTerminalArtifactFile = (typeof RUN_TERMINAL_ARTIFACT_FILES)[number];
-
-/**
- * Fixed durable failure paths publishFailureArtifacts may settle when the
- * conventional artifacts/error.json name cannot be written. Shared face so the
- * reader follows the publisher — not a parallel search algorithm.
- * Relative to the run directory.
- */
-export const RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS = [
-  `artifacts/${RUN_TERMINAL_ERROR_SETTLEMENT_FILE}`,
-  RUN_TERMINAL_ERROR_SETTLEMENT_FILE,
-] as const;
-
-/** Publisher and reader share the open-ended error face stem. */
-export const UNIQUE_ERROR_FALLBACK_STEM = "error";
-export function uniqueErrorFallbackName(): string {
-  return `${UNIQUE_ERROR_FALLBACK_STEM}.${randomUUID()}.json`;
-}
-const UNIQUE_ERROR_FALLBACK_NAME = new RegExp(
-  `^${UNIQUE_ERROR_FALLBACK_STEM}\\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.json$`, "i",
-);
-
-export type RunTerminalArtifactRead =
+export type RunTerminalRead =
   | { readonly status: "absent" }
   | {
       readonly status: "present";
-      readonly file: RunTerminalArtifactFile;
-      readonly path: string;
+      readonly face: RunTerminalFace;
       readonly body: Record<string, unknown>;
     }
-  | {
-      readonly status: "unreadable";
-      readonly file: RunTerminalArtifactFile;
-      readonly path: string;
-      readonly reason: string;
-    };
+  | { readonly status: "unreadable"; readonly reason: string };
+
+/**
+ * Terminal body field naming the `attempt-history` row this settlement appended.
+ * Readers resolve submitted payloads by this identity (#1161 甲); they must not
+ * pick the last history row of the same role.
+ */
+export const ATTEMPT_HISTORY_IDENTITY_FIELD = "attemptHistoryIdentity" as const;
+
+/**
+ * Terminal body field naming the court that wrote this terminal (#1161 R2).
+ * Historical `state.jsonl` terminal rows keep it so a later re-projection of the
+ * same court can recover that court's `attemptHistoryIdentity` without reading
+ * the leg's latest terminal or guessing by payload.
+ */
+export const TERMINAL_COURT_ATTEMPT_FIELD = "courtAttemptId" as const;
+
+/** Replace the leg's terminal. */
+export function writeRunTerminal(
+  runDirectory: string,
+  face: RunTerminalFace,
+  body: Record<string, unknown>,
+): void {
+  writeSectionSync(runDirectory, "terminal", { face, at: new Date().toISOString(), body });
+}
 
 /**
- * Minimum producer-owned face shared by settlement terminal artifacts
- * (report / error / audit-incomplete). Consumer-driven: enough to identify a
- * usable typed terminal artifact; null, arrays, primitives, and role-less
- * objects are unreadable (ADR 0043).
+ * Read the leg's terminal. Minimum producer-owned face: a typed object body
+ * with a nonblank `role` (ADR 0043); anything else is unreadable. Absence is a
+ * valid no-receipt state. A damaged current.json throws.
  */
-function readUsableTerminalArtifactBody(
-  body: unknown,
-): { readonly ok: true; readonly body: Record<string, unknown> } | { readonly ok: false; readonly reason: string } {
-  if (body === null) {
-    return { ok: false, reason: "terminal artifact JSON value is null" };
+export function readRunTerminal(runDirectory: string): RunTerminalRead {
+  const terminal = readSectionSync(runDirectory, "terminal");
+  if (terminal === undefined) return { status: "absent" };
+  const { face, body } = terminal;
+  if (face !== "report" && face !== "error" && face !== "no_receipt") {
+    return { status: "unreadable", reason: "terminal section has no known face" };
   }
   if (!isRecord(body)) {
-    return {
-      ok: false,
-      reason: `terminal artifact JSON value is not a typed object (${Array.isArray(body) ? "array" : typeof body})`,
-    };
+    return { status: "unreadable", reason: "terminal body is not a typed object" };
   }
   if (typeof body.role !== "string" || body.role.trim() === "") {
-    return {
-      ok: false,
-      reason: "terminal artifact missing nonblank producer-owned role field",
-    };
+    return { status: "unreadable", reason: "terminal body missing nonblank producer-owned role field" };
   }
-  return { ok: true, body };
+  if (face !== "report") return { status: "present", face, body };
+  const resolved = withSubmittedPayloads(runDirectory, body);
+  if (resolved.status === "unreadable") return resolved;
+  return { status: "present", face, body: resolved.body };
 }
 
-async function readTerminalArtifactAtPath(
-  path: string,
-  file: RunTerminalArtifactFile,
-): Promise<RunTerminalArtifactRead | undefined> {
-  let raw: string;
-  try {
-    raw = await readFile(path, "utf8");
-  } catch (error) {
-    if (isMissingPathError(error)) return undefined;
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason: errorText(error),
-    };
-  }
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    return {
-      status: "unreadable",
-      file,
-      path,
-      reason:
-        error instanceof Error
-          ? error.message
-          : `terminal artifact JSON parse failed: ${String(error)}`,
-    };
+/**
+ * The report's outcome carries the verdict facts only; the role's submitted payloads are not
+ * stored a second time. A reader that wants them takes them from the attempt-history row this
+ * settlement named on the terminal body (`attemptHistoryIdentity`). When payloads are absent
+ * and that identity is missing or cannot supply them, the gap is unreadable — never a silent
+ * present body (#1161 R2-gap).
+ */
+function withSubmittedPayloads(
+  runDirectory: string,
+  body: Record<string, unknown>,
+):
+  | { readonly status: "present"; readonly body: Record<string, unknown> }
+  | { readonly status: "unreadable"; readonly reason: string } {
+  const outcome = body.outcome;
+  if (!isRecord(outcome) || outcome.payloads !== undefined) {
+    return { status: "present", body };
   }
-  const usable = readUsableTerminalArtifactBody(parsed);
-  if (!usable.ok) {
+  const identity = body[ATTEMPT_HISTORY_IDENTITY_FIELD];
+  if (typeof identity !== "string" || identity.trim() === "") {
     return {
       status: "unreadable",
-      file,
-      path,
-      reason: usable.reason,
+      reason: "terminal report has no payloads and no attemptHistoryIdentity",
     };
   }
-  return { status: "present", file, path, body: usable.body };
-}
-
-async function listUniqueErrorFallbackPaths(
-  directories: readonly string[],
-): Promise<string[]> {
-  const found: string[] = [];
-  for (const dir of directories) {
-    let names: string[];
-    try {
-      names = await readdir(dir);
-    } catch (error) {
-      if (isMissingPathError(error)) continue;
-      throw error;
-    }
-    for (const name of names.sort((a, b) => a.localeCompare(b))) {
-      if (!UNIQUE_ERROR_FALLBACK_NAME.test(name)) continue;
-      found.push(join(dir, name));
+  for (const row of readHistoryRowsSync(runDirectory)) {
+    if (row.kind !== "attempt-history" || row.identity !== identity || !isRecord(row.payload)) continue;
+    const attempt = row.payload.outcome;
+    if (isRecord(attempt) && Array.isArray(attempt.payloads)) {
+      return {
+        status: "present",
+        body: { ...body, outcome: { ...outcome, payloads: attempt.payloads } },
+      };
     }
   }
-  return found;
+  return {
+    status: "unreadable",
+    reason: `terminal attemptHistoryIdentity ${identity} has no readable attempt-history payloads`,
+  };
 }
 
 /**
- * Publisher run-directory face is `<runId>@<role>`. Parent-directory unique
- * fallbacks are shared across sibling runs, so binding uses this runId only.
+ * Run-directory face is `<runId>@<role>`.
  * Sole authority for runDirectory → runId (last `@` split).
  */
 export function runIdFromRunDirectory(runDirectory: string): string | undefined {
   return parseRunLeaf(basename(runDirectory))?.runId;
 }
-
-/**
- * Shared parent-directory unique fallback may be adopted only when the
- * publisher-owned body.runId equals this run directory's runId. Same-run
- * artifactsDir / runDirectory candidates keep path ownership and skip this.
- * expectedRunId undefined (unparseable run dir) → never bound.
- */
-function presentUniqueFallbackBoundToRun(
-  body: Record<string, unknown>,
-  expectedRunId: string | undefined,
-): boolean {
-  if (expectedRunId === undefined) return false;
-  return typeof body.runId === "string" && body.runId === expectedRunId;
-}
-
-/**
- * Sole authority for seam-owned unique error.<uuid>.json candidates.
- * Used by both clearOpposite (settlement) and readRunTerminalArtifact — do not
- * re-enumerate the same-run / parent unique set elsewhere.
- * Ownership:
- * - same-run dirs (artifacts/, runDir): path ownership — all unique names
- * - parent runs/: only body.runId-bound faces; unparseable runId or unreadable body → none
- */
-export async function listSeamOwnedUniqueErrorFacePaths(
-  runDirectory: string,
-): Promise<readonly string[]> {
-  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-  const owned: string[] = await listUniqueErrorFallbackPaths([
-    artifactsDir,
-    runDirectory,
-  ]);
-  const expectedRunId = runIdFromRunDirectory(runDirectory);
-  for (const path of await listUniqueErrorFallbackPaths([dirname(runDirectory)])) {
-    const read = await readTerminalArtifactAtPath(path, "error.json");
-    if (read === undefined || read.status !== "present") continue;
-    if (!presentUniqueFallbackBoundToRun(read.body, expectedRunId)) continue;
-    owned.push(path);
-  }
-  return owned;
-}
-
-type PresentOrUnreadable = Exclude<RunTerminalArtifactRead, { status: "absent" }>;
-
-/**
- * Publish contract (#953): only failure publish continues after clearOpposite
- * failure, so a multi-class residue (residual report/audit beside a new error
- * face) means the current settlement is failure. Prefer failure-class faces
- * over success/audit — never filesystem mtime (copy/restore/utimes can lie).
- */
-function failureClassRank(file: RunTerminalArtifactFile): number {
-  return file === "error.json" ? 1 : 0;
-}
-
-/**
- * Read the current typed terminal artifact for a run directory.
- *
- * Candidate set (publisher-owned faces only):
- * 1) conventional artifacts/{report,error,audit-incomplete}.json
- * 2) publisher fixed failure fallbacks (error.settlement.json faces)
- * 3) seam-owned unique error.<uuid>.json via listSeamOwnedUniqueErrorFacePaths
- *    (same-run path ownership + parent body.runId binding — shared with clear)
- *
- * Invariant: when more than one present face remains (e.g. clearOpposite failed
- * during failure publish and a fallback was settled beside a residual report),
- * adopt failure-class over success/audit by the publish contract — not mtime.
- * Same-class ties keep candidate enumeration order (conventional before
- * fallbacks before unique).
- *
- * Unreadable faces never outrank a present face. Parent unique unreadable
- * files never enter the shared enumerator (cannot prove run identity).
- * Absence of every known durable face is a valid no-receipt state.
- */
-export async function readRunTerminalArtifact(
-  runDirectory: string,
-): Promise<RunTerminalArtifactRead> {
-  const artifactsDir = roleRunArtifactsDirectory(runDirectory);
-  const present: Array<Extract<PresentOrUnreadable, { status: "present" }>> = [];
-  const unreadable: Array<Extract<PresentOrUnreadable, { status: "unreadable" }>> =
-    [];
-
-  const consider = (read: RunTerminalArtifactRead | undefined): void => {
-    if (read === undefined || read.status === "absent") return;
-    if (read.status === "present") {
-      present.push(read);
-      return;
-    }
-    unreadable.push(read);
-  };
-
-  for (const file of RUN_TERMINAL_ARTIFACT_FILES) {
-    consider(await readTerminalArtifactAtPath(join(artifactsDir, file), file));
-  }
-
-  for (const relative of RUN_TERMINAL_ERROR_FALLBACK_RELATIVE_PATHS) {
-    consider(
-      await readTerminalArtifactAtPath(join(runDirectory, relative), "error.json"),
-    );
-  }
-
-  // Unique same-run + parent-bound faces: one enumerator shared with clear.
-  for (const path of await listSeamOwnedUniqueErrorFacePaths(runDirectory)) {
-    consider(await readTerminalArtifactAtPath(path, "error.json"));
-  }
-
-  if (present.length > 0) {
-    present.sort(
-      (a, b) => failureClassRank(b.file) - failureClassRank(a.file),
-    );
-    return present[0]!;
-  }
-  if (unreadable.length > 0) {
-    return unreadable[0]!;
-  }
-  return { status: "absent" };
-}

package/src/run-ticket-number.ts

@@ -1,10 +1,12 @@
 /**
  * Typed ticketNumber reader for a retained run's durable pages.
- * Board pages first (admitted-request, then invocation); migration derivation
- * page last so worktree-derived placement stays readable without forging a
- * board assertion. Missing page (ENOENT) → try next / undefined; damage and
- * non-ENOENT IO failures propagate.
+ * Production board reads use state.jsonl rows only (admitted, then invocation).
+ * Pre-#1161 page files are readable only via readMigrationBoardTicketNumber.
+ * Migration derivation page last so worktree-derived placement stays readable
+ * without forging a board assertion. Missing page (ENOENT) → try next / undefined;
+ * damage and non-ENOENT IO failures propagate.
  */
+import { readPageSync } from "./run-dossier.ts";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 
@@ -111,25 +113,53 @@ async function readJsonObject(
   }
 }
 
-async function readBoardPageTicketNumber(
+/** Pre-#1161 separate board pages — migration input only, not a runtime fact path. */
+const LEGACY_BOARD_PAGE: Readonly<Record<"admitted" | "invocation", string>> = {
+  admitted: "admitted-request.json",
+  invocation: "invocation.json",
+};
+
+function readBoardPageTicketNumberFromRows(
+  runDirectory: string,
+  section: "admitted" | "invocation",
+): number | undefined {
+  const fromRows = readPageSync(runDirectory, section);
+  return fromRows === undefined ? undefined : ticketFromRecord(fromRows);
+}
+
+async function readBoardPageTicketNumberFromLegacy(
   runDirectory: string,
-  page: "admitted-request.json" | "invocation.json",
+  section: "admitted" | "invocation",
 ): Promise<number | undefined> {
-  const record = await readJsonObject(join(runDirectory, page));
+  const record = await readJsonObject(join(runDirectory, LEGACY_BOARD_PAGE[section]));
   if (record === undefined) return undefined;
   return ticketFromRecord(record);
 }
 
 /**
- * Board-only ticketNumber (admitted → invocation). Placement attribution and
- * any caller that must ignore derivation pages use this sole projection.
+ * Board-only ticketNumber from fact rows (admitted → invocation).
+ * Public / production identity paths use this sole projection — never legacy pages.
  */
 export async function readBoardTicketNumber(
   runDirectory: string,
 ): Promise<number | undefined> {
   return (
-    (await readBoardPageTicketNumber(runDirectory, "admitted-request.json")) ??
-    (await readBoardPageTicketNumber(runDirectory, "invocation.json"))
+    readBoardPageTicketNumberFromRows(runDirectory, "admitted") ??
+    readBoardPageTicketNumberFromRows(runDirectory, "invocation")
+  );
+}
+
+/**
+ * Migration-boundary board ticket: fact rows first, then pre-#1161 page files.
+ * Only #852 migrators and placement may call this; runtime identity must not.
+ */
+export async function readMigrationBoardTicketNumber(
+  runDirectory: string,
+): Promise<number | undefined> {
+  return (
+    (await readBoardTicketNumber(runDirectory)) ??
+    (await readBoardPageTicketNumberFromLegacy(runDirectory, "admitted")) ??
+    (await readBoardPageTicketNumberFromLegacy(runDirectory, "invocation"))
   );
 }
 

package/src/session-identity.ts

@@ -1,42 +1,77 @@
-import { mkdir, readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 
-import { writeFileAtomically } from "./atomic-write.ts";
 import type { DurablePrincipal, DurablePrincipalAuthority } from "./host-contracts.ts";
 import {
   DEFAULT_ROLE_TURN_HOST,
   lookupHeadlessHostDescription,
   lookupHostDescription,
 } from "./host-descriptions.ts";
+import { renderCurrentSync, RUN_STATE_FILE } from "./run-dossier.ts";
+import { readSitianRecords, reportRunRecord } from "./sitian-facade.ts";
+import { errorText, isRecord } from "./unknown-value.ts";
 import type { SessionIdentityAuthority } from "./prepared-role-turn.ts";
 
-/** Durable session binding stored beside the host-owned session principal. */
+/** Log record kind of one host-session binding (a host's native session id for this run). */
+export const HOST_SESSION_ID_RECORD_KIND = "host-session-id" as const;
+
+/**
+ * Durable session binding: one state row per bind, scoped by host name — a run
+ * that changes hosts on resume must never hand one host's native session id to
+ * another. The latest record for the host wins. The public call projects
+ * `current.json` at the bind so host.sessions appears before the host CLI
+ * starts; a refused projection does not undo the binding fact or become a
+ * host/session failure (facts stay in state.jsonl; settlement still renders).
+ */
 export function createSessionIdentityAuthority(
   authority: DurablePrincipalAuthority,
-  sessionBindingFile: string,
+  hostName: string,
 ): SessionIdentityAuthority {
-  const bindingPath = (principal: DurablePrincipal): string =>
-    join(authority.decode(principal).sessionDirectory, sessionBindingFile);
+  const runDirectoryOf = (principal: DurablePrincipal): string =>
+    dirname(authority.decode(principal).sessionDirectory);
   return {
     resolveSessionFile(principal) {
       return authority.decode(principal).sessionFile;
     },
     async load(principal) {
-      try {
-        const value: unknown = JSON.parse(await readFile(bindingPath(principal), "utf8"));
-        if (typeof value !== "object" || value === null || typeof (value as { sessionId?: unknown }).sessionId !== "string") {
+      const runDirectory = runDirectoryOf(principal);
+      const { records, diagnostics } = await readSitianRecords(join(runDirectory, RUN_STATE_FILE));
+      // Control path fails closed on damaged rows — same class as readPageSync.
+      // Rendering may keep reachable facts; dispatch must not reuse a prior binding
+      // after syntax damage (#1161 C3).
+      if (diagnostics.length > 0) {
+        throw new Error(
+          `${RUN_STATE_FILE} has ${diagnostics.length} malformed row(s); refusing stale session binding: ${runDirectory}`,
+        );
+      }
+      let bound: string | undefined;
+      for (const record of records) {
+        if (record.kind !== HOST_SESSION_ID_RECORD_KIND) continue;
+        // Non-object / cannot name a host: unattributable damage — refuse
+        // (settled C3-payload). Never treat as a skippable "other host" row.
+        if (!isRecord(record.payload) || typeof record.payload.host !== "string") {
           throw new Error("durable session binding is invalid");
         }
-        return (value as { sessionId: string }).sessionId;
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
-        throw error;
+        // Explicit other host only: that host's bad id must not block this one.
+        if (record.payload.host !== hostName) continue;
+        // This host's null / non-string sessionId: refuse — do not reuse a prior
+        // binding for the same host (#1161 C3).
+        if (typeof record.payload.sessionId !== "string") {
+          throw new Error("durable session binding is invalid");
+        }
+        bound = record.payload.sessionId;
       }
+      return bound;
     },
     async bind(principal, sessionId) {
-      const target = bindingPath(principal);
-      await mkdir(dirname(target), { recursive: true });
-      await writeFileAtomically(target, `${JSON.stringify({ sessionId })}\n`, { mode: 0o600 });
+      const runDirectory = runDirectoryOf(principal);
+      reportRunRecord(runDirectory, HOST_SESSION_ID_RECORD_KIND, { host: hostName, sessionId }, "session-identity");
+      try {
+        renderCurrentSync(runDirectory);
+      } catch (error) {
+        process.stderr.write(
+          `[session-identity] current.json render refused after host-session-id; binding fact kept: ${runDirectory}: ${errorText(error)}\n`,
+        );
+      }
     },
   };
 }
@@ -54,10 +89,7 @@ export async function readStoredHostSessionId(
   if (host === undefined || host === DEFAULT_ROLE_TURN_HOST) return undefined;
   const description = lookupHostDescription(host) ?? lookupHeadlessHostDescription(host);
   if (description === undefined) return undefined;
-  const sessionId = await createSessionIdentityAuthority(
-    authority,
-    description.sessionBindingFile,
-  ).load(principal);
+  const sessionId = await createSessionIdentityAuthority(authority, host).load(principal);
   if (sessionId === undefined || sessionId === "") return undefined;
   return sessionId;
 }

package/src/sitian-appender.ts

@@ -5,9 +5,10 @@
  */
 import { randomUUID } from "node:crypto";
 import { appendFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 
-import { sessionDirectoryOf } from "./role-run-placement.ts";
+import { parseRunLeaf, sessionDirectoryOf } from "./role-run-placement.ts";
+import { RUN_HISTORY_FILE, RUN_HISTORY_KINDS, RUN_LOG_FILE, RUN_STATE_FILE, RUN_STATE_KINDS } from "./run-dossier-files.ts";
 import { ticketNumberFromSitianSubject } from "./run-ticket-number.ts";
 
 import { resolveBookKeyFromGit } from "./activation-ledger-git.ts";
@@ -42,20 +43,8 @@ export function appendSitianRecordBlock(input: SitianRecordInput, block: string)
   }
 }
 
-/** Authorized S4 submission ledger kinds that share a common run submission volume. */
-export const S4_SUBMISSION_LEDGER_KINDS = new Set([
-  "candidate",
-  "roundContext",
-  "outcome",
-  "sealed",
-  "post-seal-anomaly"
-]);
-
-/** Compute the volume partition key for directory placement. */
+/** Volume directory name for a record kind: the kind itself. */
 export function resolveSitianVolumeCategory(kind: string): string {
-  if (S4_SUBMISSION_LEDGER_KINDS.has(kind)) {
-    return "submission-ledger";
-  }
   return kind;
 }
 
@@ -115,8 +104,10 @@ export function resolveSitianRecordPathInLedger(
     sessionDir = paths.sessionDir;
     recordFile = paths.recordFile;
   } else if (category === "ticket-provenance" && input.runDirectory !== undefined) {
+    // True-unbound diary staging: the run's history volume (#1161). Never a
+    // top-level run/records.jsonl — that leaf is only the ticket-root diary.
     sessionDir = input.runDirectory;
-    recordFile = sitianVolumeRecordsFile(sessionDir);
+    recordFile = join(sessionDir, RUN_HISTORY_FILE);
   } else {
     if (
       input.sessionParent === undefined
@@ -125,8 +116,16 @@ export function resolveSitianRecordPathInLedger(
     ) {
       throw new Error("Sitian record ownership requires a parent session inside the ledger home");
     }
-    sessionDir = sitianVolumeDirectory(dirname(input.sessionParent), category);
-    recordFile = sitianVolumeRecordsFile(sessionDir);
+    const sessionParentDir = dirname(input.sessionParent);
+    const runDirectory = dirname(sessionParentDir);
+    if (basename(sessionParentDir) === "session" && parseRunLeaf(basename(runDirectory)) !== undefined) {
+      // A role run's own session: every record kind shares the run's one log (#1161).
+      sessionDir = runDirectory;
+      recordFile = join(runDirectory, RUN_HISTORY_KINDS.has(input.kind) ? RUN_HISTORY_FILE : RUN_STATE_KINDS.has(input.kind) ? RUN_STATE_FILE : RUN_LOG_FILE);
+    } else {
+      sessionDir = sitianVolumeDirectory(sessionParentDir, category);
+      recordFile = sitianVolumeRecordsFile(sessionDir);
+    }
   }
   if (!physicallyContainedIn(ledgerHome, sessionDir)) {
     throw new Error("Sitian record ownership requires a directory inside the ledger home");

package/src/sitian-facade.ts

@@ -6,6 +6,7 @@
  * - sitianReport → appender (SitianRecord rows, append + identity claim)
  * Read paths: readSitianRecords (canonical rows).
  */
+import { sessionFileOf } from "./role-run-placement.ts";
 import { appendSitianRecord } from "./sitian-appender.ts";
 import type { RecordPointer, SitianRecordInput } from "./sitian-contracts.ts";
 
@@ -20,3 +21,24 @@ export * from "./sitian-reader.ts";
 export function sitianReport(input: SitianRecordInput): RecordPointer {
   return appendSitianRecord(input);
 }
+
+/**
+ * One record of a role run: history.jsonl for the history kinds and state.jsonl for the
+ * state kinds (see the appender), log.jsonl for the run's own diagnostics (host dossier pointers,
+ * dispatch / resume / post-admission faults, host stderr). Same single entry
+ * as every other record; the run is named, never a file path.
+ */
+export function reportRunRecord(
+  runDirectory: string,
+  kind: string,
+  payload: unknown,
+  source: string,
+): RecordPointer {
+  return appendSitianRecord({
+    level: "event",
+    kind,
+    sessionParent: sessionFileOf(runDirectory),
+    source,
+    payload,
+  });
+}