@akagilnc/pi-workflow-roles 0.1.5504 → 0.1.5575

package/dist/notary-source-run.js

@@ -58,7 +58,7 @@ async function requireRunDirectory(candidate, display) {
  * - absolute/relative path that realpath's to that same book runs slot
  *
  * Rejects project-tree projections and any path outside the project's ledger book runs.
- * Retained `run-state.json` must match basename identity and book binding.
+ * Retained state.jsonl run-state must match basename identity and book binding.
  */
 export async function resolveNotarySourceRunLocator(options) {
     const raw = options.sourceRun.trim();

package/dist/packaged-role-registry.js

@@ -88,14 +88,7 @@ const PUBLIC_ROLE_RECORDS = [
     outputTool: FIXER_OUTPUT_TOOL_NAME,
     settlement: "sealed",
     artifactFace: {
-      reportPhase: true,
-      evidenceRole: true,
-      leaves: [
-        { key: "phase" },
-        { key: "packetPath" },
-        { key: "prerequisitesPath", omitUndefined: true },
-        { key: "prerequisites" }
-      ]
+      reportPhase: true
     },
     boardPlacement: "marshal",
     activationFlags: [
@@ -126,12 +119,7 @@ const PUBLIC_ROLE_RECORDS = [
     outputTool: CODER_OUTPUT_TOOL_NAME,
     settlement: "sealed",
     artifactFace: {
-      reportPhase: true,
-      evidenceRole: true,
-      leaves: [
-        { key: "phase" },
-        { key: "taskPath" }
-      ]
+      reportPhase: true
     },
     activationFlags: [
       { field: "taskPath", flag: "ak-coder-task", binds: "input" },
@@ -165,15 +153,7 @@ const PUBLIC_ROLE_RECORDS = [
     settlement: "sealed",
     /** Publish only an accepted ledger outcome; audit escalation stays unsettled here. */
     sealedAcceptedOnly: true,
-    artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "baseRevision" },
-        { key: "lens" },
-        { key: "authorityRefs", copyArray: true },
-        { key: "callerProvenance", callerProvenance: true }
-      ]
-    },
+    artifactFace: {},
     /** Frozen base/lens/authority become the initial prompt; instruction follows. */
     transportPrompt: "skill-args",
     boardPlacement: "marshal",
@@ -204,14 +184,7 @@ const PUBLIC_ROLE_RECORDS = [
     bareCommand: false,
     outputTool: COLLECTOR_OUTPUT_TOOL,
     settlement: "sealed",
-    artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "prNumber", omitUndefined: true },
-        { key: "repository", from: "repository.canonical" },
-        { key: "manifestDigest" }
-      ]
-    },
+    artifactFace: {},
     boardPlacement: "collector",
     /** Taishi acceptance is a typed groups array, not a status leaf. */
     analystTerminal: "groups",
@@ -240,12 +213,6 @@ const PUBLIC_ROLE_RECORDS = [
     auditTool: DOCTOR_AUDIT_TOOL_NAME,
     settlement: "sealed",
     artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "issueNumber" },
-        { key: "caseRunsPath" },
-        { key: "caseIdentity" }
-      ],
       doctorReportFacts: true
     },
     /** Navigator subject is the doctor case, not the case-path file bytes. */
@@ -271,13 +238,7 @@ const PUBLIC_ROLE_RECORDS = [
     phases: [null],
     outputTool: MERGER_OUTPUT_TOOL_NAME,
     settlement: "sealed",
-    artifactFace: {
-      evidenceRole: true,
-      leaves: [
-        { key: "mergerInputPath" },
-        { key: "derived" }
-      ]
-    },
+    artifactFace: {},
     activationFlags: [
       { field: "inputPath", from: "mergerInputPath", flag: "ak-merger-input", binds: "input" }
     ],

package/dist/pi/role-turn-host.js

@@ -14,10 +14,13 @@ import { ExplicitInternalActivationError } from "../host-contracts.js";
 import { applyEngineChildEnv, ENGINE_MODEL_FLAG_NAME, normalizeEngineName } from "../engine-detour.js";
 import { projectActivationFlags } from "../role-activation-flags.js";
 import { encodeUserDialogueStdin } from "../user-dialogue-stdin.js";
-import { readStrictPiSessionJsonl } from "../ledger-session-read.js";
+import { readLedgerSessionJsonlLines, readStrictPiSessionJsonl } from "../ledger-session-read.js";
+import { copyAndRecordHostDossier } from "../host-session-record.js";
 import { projectThrownFailureLeaf, retainPackageFault } from "../public-cli/settlement.js";
 import { describeErrorIdentity } from "../public-cli/run-lifecycle.js";
 import { RECEIPT_DELIVERY_LIMIT_ENV } from "../receipt-delivery-policy.js";
+import { createSessionIdentityAuthority } from "../session-identity.js";
+import { sitianReport } from "../sitian-facade.js";
 /** Package-relative Internal role entrypoint (ADR 0052; same path as public-cli registry). */
 const INTERNAL_ROLE_ENTRYPOINT_RELATIVE = "extensions/role-runtime.ts";
 export function resolveInternalRoleEntrypoint(packageRoot) {
@@ -351,17 +354,64 @@ export function createPiRoleTurnHost(config) {
                 await config.recordLaunchedRolePackageIdentity(request.runDirectory, await config.observeLaunchedRolePackageIdentity(config.packageRoot, roleEntry));
             }
             const timeoutMs = request.timeoutMs ?? config.timeoutMs;
-            return await spawnRunner(args, {
+            const result = await spawnRunner(args, {
                 cwd: request.cwd,
                 env,
                 stdin,
                 ...(timeoutMs === undefined ? {} : { timeoutMs }),
                 ...(request.signal === undefined ? {} : { signal: request.signal }),
             });
+            // Deliver already-written Pi host facts. Pi lands at session/session.jsonl;
+            // bind projects host.sessions; copy records the landing. Host adapters do
+            // not write current.json — public bind/settlement seams own that render.
+            try {
+                const { sessionFile, sessionDirectory } = config.principalAuthority.decode(request.principal);
+                const sessionId = await readPiSessionHeaderId(sessionFile);
+                if (sessionId !== undefined) {
+                    await createSessionIdentityAuthority(config.principalAuthority, "pi").bind(request.principal, sessionId);
+                    copyAndRecordHostDossier({
+                        host: "pi",
+                        sessionId,
+                        cwd: request.cwd,
+                        sessionDirectory,
+                        sessionParent: sessionFile,
+                        ...(request.home !== undefined ? { home: request.home } : {}),
+                    });
+                }
+            }
+            catch (error) {
+                await retainPackageFault({
+                    runDirectory: request.runDirectory,
+                    diagnostic: `pi host dossier record failed beside host terminal: ${describeErrorIdentity(error)}`,
+                    error,
+                });
+            }
+            return result;
         },
     };
 }
-import { sitianReport } from "../sitian-facade.js";
+/**
+ * Session header id from the Pi volume the child (or fixture) already wrote.
+ * Reuses the ledger line kernel: a later malformed line must not erase a valid
+ * header already present (ADR 0086 originals are not validated whole-file).
+ */
+async function readPiSessionHeaderId(sessionFile) {
+    try {
+        for (const line of await readLedgerSessionJsonlLines(sessionFile)) {
+            const entry = line.row;
+            if (entry === undefined || entry.type !== "session")
+                continue;
+            if (typeof entry.id === "string" && entry.id.trim() !== "")
+                return entry.id;
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    return undefined;
+}
 /** Last non-session entry id. Session headers are not parents of custom lines. */
 export function piSessionCustomParentId(entries) {
     let parentId = null;

package/dist/public-cli/auto-resume.js

@@ -1,27 +1,10 @@
-/**
- * Single generic auto-resume loop for #416 (owner scope = single LLM call).
- * Call-local retries, at most the effective autoResumeLimit times (injected once
- * per call by the caller, #422 — never re-read from disk inside the loop),
- * in-place (same runId/session).
- * Unifies presentation: intermediate attempts use dummyIo, only final Terminal is presented.
- *
- * Owner 2026-08-23: a dispatch that exits by throwing used to bypass the entire
- * retry mechanism (the throw escaped the while-loop before the count check ever
- * ran). Every exception is now retained whole, in place, and the ordinary retry
- * path continues: same budget, same call-local count semantics. No failure-type
- * classification — every thrown value is treated identically.
- */
-import { constants as fsConstants } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { open } from "node:fs/promises";
-import { join } from "node:path";
 import { AUTO_RESUME_LIMIT, describeErrorIdentity, acquireRunWriterLease, markRunTerminal, RunWriterLeaseHeldError, } from "./run-lifecycle.js";
 import { parseAutoResumeLimit } from "./config.js";
 import { processCancelSignalName } from "./process-cancel.js";
 import { isLawfulTypedTerminalOutcome, formatTerminalResult } from "./terminal.js";
-import { attachRecordedSubmissions, ensureRealArtifactsDirectory, presentFailureTerminal, retainPackageFault, } from "./settlement.js";
-export { ensureRealArtifactsDirectory };
+import { attachRecordedSubmissions, presentFailureTerminal, retainPackageFault, } from "./settlement.js";
 import { serializeThrownValue } from "../serialize-thrown-value.js";
+import { reportRunRecord } from "../sitian-facade.js";
 import { errorText } from "../unknown-value.js";
 const dummyIo = { stdout: () => { }, stderr: () => { } };
 /**
@@ -105,41 +88,19 @@ function jsonSafeReplacer() {
     };
 }
 /**
- * Retain one throwing dispatch attempt's complete exception as an independent
- * per-attempt file under the run's artifacts directory, then leave an
- * addressable pointer in the session principal (custom entry). Exclusive-create
- * open (O_EXCL) with a per-attempt unique name enforces 史必追加 (#419): a later
- * attempt can never overwrite an earlier attempt's file.
+ * Retain one throwing dispatch attempt's complete exception as a line in the
+ * run's log.jsonl, then leave an addressable pointer in the session principal
+ * (custom entry). The log only appends (史必追加, #419): a later attempt can
+ * never overwrite an earlier attempt's record.
  */
-/**
- * Hardened create-once JSON write shared by every durable artifact this loop
- * retains directly (dispatch-error dumps, lawful-persist-failure error/
- * evidence records): O_EXCL (fail loud on a colliding name, never overwrite)
- * + O_NOFOLLOW where the platform provides it (a planted symlink is never
- * followed) — mirrors settlement.ts's own hardened artifact writers.
- */
-export async function writeHardenedArtifactFile(artifactsDir, namePrefix, payload) {
-    const filePath = join(artifactsDir, `${namePrefix}-${randomUUID()}.json`);
-    const body = `${JSON.stringify(payload, jsonSafeReplacer(), 2)}\n`;
-    const noFollowFlag = typeof fsConstants.O_NOFOLLOW === "number" ? fsConstants.O_NOFOLLOW : 0;
-    const handle = await open(filePath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollowFlag, 0o600);
-    try {
-        await handle.writeFile(body, "utf8");
-    }
-    finally {
-        await handle.close();
-    }
-    return filePath;
-}
 async function retainDispatchError(admitted, principalAuthority, sessionAppender, attempt, error) {
-    const artifactsDir = await ensureRealArtifactsDirectory(admitted.runDirectory);
     // Whole-object dump: everything the thrown value carries, nothing picked.
-    const filePath = await writeHardenedArtifactFile(artifactsDir, `dispatch-error-attempt-${attempt}`, {
+    const filePath = reportRunRecord(admitted.runDirectory, "dispatch-exception", JSON.parse(JSON.stringify({
         version: 1,
         attempt,
         recordedAt: new Date().toISOString(),
         error: serializeThrownValue(error),
-    });
+    }, jsonSafeReplacer())), "auto-resume").recordFile;
     // Addressable pointer in the dossier (卷宗): Pi session custom-entry codec
     // (appendPiSessionCustomEntry). Lease still owned here with run-writer.
     let pointerLease;

package/dist/public-cli/instruction-seat-run.js

@@ -29,7 +29,7 @@ import { packagedAdmitsCountersign, packagedBindsBoardTicket, packagedRebindSour
 import { readAuditorResumeBinding } from "../auditor-soul.js";
 import { CliUsageError } from "./cli-errors.js";
 import { admitPublicRole, bindAdmittedTicketNumber, buildInstructionTransportPrompt, materializeCountersignInvocation, persistAdmittedSourceRunPath, recordAdmittedCorrelation, recordChildDiaristRun, relocateAdmittedRunToTicket, withPreparedAttachments, } from "./invocation.js";
-import { presentControlledFailure, packageFaultNoteFor, prepareSummonsResumeMaterials, roleTurnOptions, runPostAdmissionOneShot, runPostAdmissionResumable, runPostAdmissionSeatResume, showResumeErrorPointer, resumeTurnRequestProjectionOptions, } from "./post-admission.js";
+import { bindDiaristAssertedTicketNumber, presentControlledFailure, packageFaultNoteFor, prepareSummonsResumeMaterials, roleTurnOptions, runPostAdmissionOneShot, runPostAdmissionResumable, runPostAdmissionSeatResume, showResumeErrorPointer, resumeTurnRequestProjectionOptions, } from "./post-admission.js";
 import { presentTerminal } from "./auto-resume.js";
 import { buildAutoResumeContinuationPrompt, loadResumablePublicRole, markRunAdmitted, parentRunPathFromGatePointerInstruction, readCurrentCourt, } from "./run-lifecycle.js";
 import { tryResumeSameTicketSeatRun } from "./seat-ticket-binding.js";
@@ -184,6 +184,8 @@ function isBoardTicketSeat(seat) {
     return packagedBindsBoardTicket(seat.role);
 }
 async function bindAndRelocateDiarist(admitted, authority, lease) {
+    // The diarist's asserted ticketNumber binds here, in the public call's process.
+    await bindDiaristAssertedTicketNumber(admitted);
     const boardTicket = await readBoardTicketNumber(admitted.runDirectory);
     if (boardTicket === undefined)
         return undefined;
@@ -856,7 +858,7 @@ export async function continueParentAfterChild(parentRunId, child, env, io) {
         if (stopped.exitCode === 0
             && heldUnreadableTerminal(stopped.terminal)
             && stopped.terminal !== undefined) {
-            const parentTerminal = await trySettlePublicSeat(admitted, env.principalAuthority, undefined);
+            const parentTerminal = await trySettlePublicSeat(admitted, env.principalAuthority, { ...await readCurrentCourt(admitted.runDirectory), ...packageFaultScope(admitted, env, io) });
             if (parentTerminal?.roleOutcome.kind === "accepted"
                 || parentTerminal?.roleOutcome.kind === "audit_escalation") {
                 const terminal = await presentUnsettledAudit(parentTerminal, stopped.terminal, io, admitted.runDirectory);
@@ -870,7 +872,7 @@ export async function continueParentAfterChild(parentRunId, child, env, io) {
     }
     if (resolved !== undefined && (resolved.status === "continue" || resolved.status === "converged")) {
         if (AUDITED_ROLES.has(admitted.role) && resolved.status === "converged") {
-            const terminal = await trySettlePublicSeat(admitted, env.principalAuthority, packageFaultScope(admitted, env, io));
+            const terminal = await trySettlePublicSeat(admitted, env.principalAuthority, { ...await readCurrentCourt(admitted.runDirectory), ...packageFaultScope(admitted, env, io) });
             if (terminal?.roleOutcome.kind !== "accepted")
                 throw new Error("pending submission is not recorded");
             return auditSubmittedRole({ exitCode: 0, admitted, terminal }, env, io, resolved.admitted, latestQueuePayload(resolved.terminal));

package/dist/public-cli/invocation.js

@@ -9,10 +9,11 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { activationBookDirectory, ensureRealDirectoryTree, homeFromRunDirectory, pathContainedIn, resolveActivationLedgerHome, } from "../activation-ledger-topology.js";
 import { resolveBookKeyFromGit } from "../activation-ledger-git.js";
-import { ensureRoleRunDirectory, ensureRoleRunPlacement, formatRunLeaf, isUnboundRunDirectory, listBookRunDirectories, roleRunArtifactsDirectory, roleRunPlacement, } from "../role-run-placement.js";
+import { ensureRoleRunDirectory, ensureRoleRunPlacement, formatRunLeaf, isUnboundRunDirectory, listBookRunDirectories, roleRunPlacement, } from "../role-run-placement.js";
 import { packagedAdmittedSubject, packagedArgvResult, packagedBareToken, packagedBaseIsRevision, packagedEmitsAuthorityRefs, packagedPublicInstructionSubject, packagedRoleMetadata, packagedStoresSourceRunRaw, packagedSubjectChoices, } from "../packaged-role-registry.js";
 import { isSafePositiveTicketNumber, parseTicketNumber, readBoardTicketNumber, requireSafePositiveTicketNumber, } from "../run-ticket-number.js";
 import { rewriteRunDirectoryPathFields, rewriteRunDirectoryPathValue, } from "../role-run-relocation.js";
+import { readPageSync, renderCurrentSync, updateSectionSync, writeSectionSync } from "../run-dossier.js";
 import { loadDoctorCase, } from "../doctor-evidence.js";
 import { emptyCollectorManifest, loadCollectorManifest, parseCollectorPrNumber, parseCollectorRepository, } from "../collector-config.js";
 import { ownerRepoFromGitHubRemoteUrl } from "./github-remote.js";
@@ -48,17 +49,16 @@ export function issueAdmissionPlacement(authority, request) {
     };
 }
 /**
- * Unique admitted-request.json persistence projection: top-level sessionDirectory/sessionFile
+ * Unique `admitted` section projection of current.json: top-level sessionDirectory/sessionFile
  * (base wire shape). Memory Admitted keeps only the opaque principal — never dual-carry.
  */
-async function writeAdmittedRequestPersistence(admittedRequestPath, body, coordinates) {
+function writeAdmittedRequestPersistence(runDirectory, body, coordinates) {
     const { principal: _omitPrincipal, ...rest } = body;
-    const projection = {
+    writeSectionSync(runDirectory, "admitted", {
         ...rest,
         sessionDirectory: coordinates.sessionDirectory,
         sessionFile: coordinates.sessionFile,
-    };
-    await writeFile(admittedRequestPath, `${JSON.stringify(projection, null, 2)}\n`, "utf8");
+    });
 }
 /** Project effective model onto ledger fields; absent thinking stays absent. */
 function effectiveModelLedgerFields(model) {
@@ -72,7 +72,7 @@ function effectiveModelLedgerFields(model) {
 }
 export { homeFromRunDirectory };
 /**
- * Persist one `invocation.json` identity page for the public run.
+ * Persist the `invocation` identity section of current.json for the public run.
  * Admission is the sole source for every field; this is the only identity
  * projection and callers never provide an independent ledger shape.
  * When an effective model is known at admission, provider/model (and thinking
@@ -91,7 +91,7 @@ async function writeRoleInvocationLedger(source, role, effectiveModel) {
         ...(source.ticketNumber === undefined ? {} : { ticketNumber: source.ticketNumber }),
         ...effectiveModelLedgerFields(effectiveModel),
     };
-    await writeFile(join(source.runDirectory, "invocation.json"), `${JSON.stringify(identity, null, 2)}\n`, "utf8");
+    writeSectionSync(source.runDirectory, "invocation", identity);
 }
 /**
  * Merge the effective launch model / engine / host onto the existing invocation
@@ -104,7 +104,7 @@ async function writeRoleInvocationLedger(source, role, effectiveModel) {
  * Host stays write-if-present (`string` only).
  */
 export async function recordEffectiveInvocationModel(runDirectory, model, engine, host, engineModel) {
-    await updateDurableJsonPage(join(runDirectory, "invocation.json"), (current) => {
+    updateSectionSync(runDirectory, "invocation", (current) => {
         const next = { ...current };
         if (model !== undefined) {
             next.provider = model.provider;
@@ -134,33 +134,22 @@ export async function recordEffectiveInvocationModel(runDirectory, model, engine
         return next;
     });
 }
-/**
- * Read one durable JSON object, let the caller keep its field rules, and write
- * the page back. `undefined` means the caller decided not to change the page.
- */
-async function updateDurableJsonPage(path, update) {
-    const current = JSON.parse(await readFile(path, "utf8"));
-    const next = update(current);
-    if (next === undefined)
-        return;
-    await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, "utf8");
-}
-/** Merge observed launch-time fields into the single existing invocation.json identity page. */
+/** Merge observed launch-time fields into the single existing invocation section of current.json. */
 async function mergeInvocationIdentityPage(runDirectory, fields) {
-    await updateDurableJsonPage(join(runDirectory, "invocation.json"), (current) => ({
+    updateSectionSync(runDirectory, "invocation", (current) => ({
         ...current,
         ...fields,
     }));
 }
 /**
- * Persist parent --source-run path onto admitted-request for officer resume lookup (#747).
+ * Persist parent --source-run path onto the admitted section for officer resume lookup (#747).
  * Reuses the existing notary sourceRunPath key; does not invent a new field name.
  */
 export async function persistAdmittedSourceRunPath(admitted, sourceRunPath, auditorSubject) {
     if (sourceRunPath.trim() === "") {
         throw new Error("persistAdmittedSourceRunPath requires a non-empty sourceRunPath");
     }
-    await updateDurableJsonPage(admitted.admittedRequestPath, (current) => {
+    updateSectionSync(admitted.runDirectory, "admitted", (current) => {
         if (typeof current.sourceRunPath === "string" && current.sourceRunPath !== sourceRunPath) {
             throw new Error(`persistAdmittedSourceRunPath refuses to replace ${current.sourceRunPath} with ${sourceRunPath}`);
         }
@@ -176,7 +165,7 @@ export async function persistAdmittedSourceRunPath(admitted, sourceRunPath, audi
 }
 /**
  * Bind a post-admission resolved ticketNumber onto the in-memory admitted
- * object and both durable pages (invocation.json + admitted-request.json).
+ * object and both durable sections (invocation + admitted).
  * A later typed role receipt replaces an earlier assertion (#1025).
  */
 export async function bindAdmittedTicketNumber(admitted, ticketNumber) {
@@ -188,7 +177,7 @@ export async function bindAdmittedTicketNumber(admitted, ticketNumber) {
 /** Persist each direct caller observed while a retained run is resumed. */
 export async function recordAdmittedCorrelation(admitted, correlationId) {
     let correlationIds = [];
-    await updateDurableJsonPage(admitted.admittedRequestPath, (current) => {
+    updateSectionSync(admitted.runDirectory, "admitted", (current) => {
         const prior = [
             ...(Array.isArray(current.correlationIds)
                 ? current.correlationIds.filter((value) => typeof value === "string" && value.trim() !== "")
@@ -225,8 +214,7 @@ export async function relocateAdmittedRunToTicket(admitted, authority, heldLease
     // Keep that failure before the filesystem commit point.
     const principal = authority.seal(target);
     if (admitted.role !== "diarist") {
-        const parentPage = JSON.parse(await readFile(admitted.admittedRequestPath, "utf8"));
-        const childRunIds = parentPage.childDiaristRunIds;
+        const childRunIds = readPageSync(oldRunDirectory, "admitted")?.childDiaristRunIds;
         for (const childRunId of Array.isArray(childRunIds) ? childRunIds : []) {
             if (typeof childRunId !== "string")
                 continue;
@@ -245,6 +233,15 @@ export async function relocateAdmittedRunToTicket(admitted, authority, heldLease
             await rehomeUnboundTicketProvenance(childDirectory, admitted.ticketNumber, admitted.projectRoot, homeFromRunDirectory(oldRunDirectory));
             ensureRoleRunDirectory(ledgerHome, dirname(childTarget.runDirectory));
             await rename(childDirectory, childTarget.runDirectory);
+            // Finished child legs will not settle again; refresh derived host.original
+            // after the rename commit. A derived render fault must not undo or block
+            // the committed placement (#1161 L1) — note and keep the true cause.
+            try {
+                renderCurrentSync(childTarget.runDirectory);
+            }
+            catch (error) {
+                process.stderr.write(`[invocation] current.json render refused after child relocate; placement kept: ${childTarget.runDirectory}: ${errorText(error)}\n`);
+            }
         }
     }
     // The first ticket assignment moves only an unbound diarist's own diary.
@@ -255,13 +252,13 @@ export async function relocateAdmittedRunToTicket(admitted, authority, heldLease
     // outside the atomic directory move.
     // Persisted paths are resolved from typed run identity on read.
     await rename(oldRunDirectory, target.runDirectory);
-    // rename moved the open lock inode with the directory. Transfer cleanup
-    // ownership immediately after the commit.
+    // rename moved the open lock inode with the directory. Transfer cleanup and
+    // admitted path ownership immediately after the commit — before any derived
+    // render that may refuse (#1161 L1 / BASE order).
     heldLease?.relocate(target.runDirectory);
     const admittedRecord = admitted;
     rewriteRunDirectoryPathFields(admittedRecord, [
         "runDirectory",
-        "admittedRequestPath",
         "taskPath",
         "packetPath",
         "prerequisitesPath",
@@ -272,11 +269,15 @@ export async function relocateAdmittedRunToTicket(admitted, authority, heldLease
         attachment.frozenPath = rewriteRunDirectoryPathValue(attachment.frozenPath, oldRunDirectory, target.runDirectory);
     }
     admitted.principal = principal;
+    // current.json projects host.original from this run directory. Ownership is
+    // already transferred; a refuse still carries the true cause to the caller
+    // (#1161 L1) without leaving the leg under the unbound path.
+    renderCurrentSync(target.runDirectory);
     return { oldRunDirectory, newRunDirectory: target.runDirectory };
 }
 /** Persist the exact child identity; later parent binding never inspects siblings. */
 export async function recordChildDiaristRun(parent, childRunId) {
-    await updateDurableJsonPage(parent.admittedRequestPath, (page) => {
+    updateSectionSync(parent.runDirectory, "admitted", (page) => {
         const existing = Array.isArray(page.childDiaristRunIds)
             ? page.childDiaristRunIds.filter((runId) => typeof runId === "string")
             : [];
@@ -291,9 +292,8 @@ export async function recordChildDiaristRun(parent, childRunId) {
  */
 export async function bindTicketNumberOnRunDirectory(runDirectory, ticketNumber) {
     requireSafePositiveTicketNumber(ticketNumber, "bindTicketNumberOnRunDirectory");
-    const admittedPath = join(runDirectory, "admitted-request.json");
     let unchanged = false;
-    await updateDurableJsonPage(admittedPath, (admitted) => {
+    updateSectionSync(runDirectory, "admitted", (admitted) => {
         if (admitted.ticketNumber === ticketNumber) {
             unchanged = true;
             return undefined;
@@ -701,8 +701,13 @@ async function freezeRegularFileAttachment(sourcePath, destinationDir, index) {
     };
 }
 /** Freeze attachments only — ticket binding is the shared LLM seat path (#635). */
-async function freezeAttachments(attachmentPaths, attachmentsDirectory) {
+async function freezeAttachments(ledgerHome, attachmentPaths, attachmentsDirectory) {
     const attachments = [];
+    // attachments/ appears only when something is frozen; created through the
+    // ledger's symlink-rejecting tree walk, never a plain mkdir.
+    if (attachmentPaths.length > 0) {
+        ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
+    }
     for (let i = 0; i < attachmentPaths.length; i += 1) {
         const frozen = await freezeRegularFileAttachment(attachmentPaths[i], attachmentsDirectory, i);
         attachments.push(frozen.attachment);
@@ -720,7 +725,7 @@ export async function freezeAttachmentsIntoRun(attachmentPaths, runDirectory, su
     const ledgerHome = resolveActivationLedgerHome(homeFromRunDirectory(runDirectory));
     const attachmentsDirectory = join(runDirectory, "attachments", summonsKey);
     ensureRealDirectoryTree(ledgerHome, attachmentsDirectory);
-    return freezeAttachments(attachmentPaths, attachmentsDirectory);
+    return freezeAttachments(ledgerHome, attachmentPaths, attachmentsDirectory);
 }
 /** Freeze prepared bytes and metadata through one path for birth or retained runs. */
 export async function freezePreparedAttachmentsIntoRun(prepared, runDirectory, summonsKey) {
@@ -969,7 +974,7 @@ export async function admitPublicRole(role, parsed, env, override) {
                         const detail = errorText(error);
                         throw new CliUsageError(`doctor case could not be constructed from retained evidence: ${detail}`, { cause: error });
                     }
-                    frozenAttachments = await freezeAttachments(attachmentPaths, placed.attachmentsDirectory);
+                    frozenAttachments = await freezeAttachments(placed.ledgerHome, attachmentPaths, placed.attachmentsDirectory);
                     return {
                         issueNumber,
                         caseRunsPath,
@@ -1126,7 +1131,7 @@ async function placeRoleAdmission(options) {
     });
     const attachments = options.freezeAttachments === false
         ? []
-        : await freezeAttachments(options.attachmentPaths, attachmentsDirectory);
+        : await freezeAttachments(ledgerHome, options.attachmentPaths, attachmentsDirectory);
     return {
         runId,
         bookKey,
@@ -1151,8 +1156,7 @@ function persistedAttachmentRefs(attachments) {
     }));
 }
 async function persistPlacedAdmission(admitted, placed, model) {
-    const admittedRequestPath = join(placed.runDirectory, "admitted-request.json");
-    await writeAdmittedRequestPersistence(admittedRequestPath, admitted, {
+    writeAdmittedRequestPersistence(placed.runDirectory, admitted, {
         sessionDirectory: placed.sessionDirectory,
         sessionFile: placed.sessionFile,
     });
@@ -1161,11 +1165,10 @@ async function persistPlacedAdmission(admitted, placed, model) {
         sessionDirectory: placed.sessionDirectory,
         sessionFile: placed.sessionFile,
     }, admitted.role, model);
-    return admittedRequestPath;
 }
 /**
  * Shared admission: project check, placement, attachment freeze,
- * admitted-request and invocation ledger write.
+ * admitted and invocation section write.
  * Countersign passes deferPersistence so same-ticket lookup can reserve coordinates
  * before materializeCountersignInvocation writes the page.
  * Seats whose extra facts are known before placement pass them as admittedFields.
@@ -1214,9 +1217,8 @@ async function admitStandardMaterialInvocation(role, options) {
         attachments: persistedAttachmentRefs(placed.attachments),
         ...placed.ticketFields,
     };
-    const admittedRequestPath = defer
-        ? join(placed.runDirectory, "admitted-request.json")
-        : await persistPlacedAdmission(admitted, placed, options.model);
+    if (!defer)
+        await persistPlacedAdmission(admitted, placed, options.model);
     return {
         role,
         runId: placed.runId,
@@ -1227,7 +1229,6 @@ async function admitStandardMaterialInvocation(role, options) {
         attachments: placed.attachments,
         runDirectory: placed.runDirectory,
         principal: placed.principal,
-        admittedRequestPath,
         ...correlationFields,
         ...placed.ticketFields,
         ...admittedFields,
@@ -1304,7 +1305,6 @@ export async function materializeCountersignInvocation(admitted, options) {
     });
     const placement = placed;
     admitted.runDirectory = placement.runDirectory;
-    admitted.admittedRequestPath = join(placement.runDirectory, "admitted-request.json");
     admitted.principal = placement.principal;
     const ticketFields = ticketAdmissionFields(options.ticketNumber);
     if (ticketFields.ticketNumber !== undefined) {
@@ -1312,19 +1312,18 @@ export async function materializeCountersignInvocation(admitted, options) {
     }
     const attachments = await freezePreparedAttachmentsIntoRun(options.preparedAttachments, admitted.runDirectory);
     admitted.attachments = attachments;
-    await writeAdmittedRequestPersistence(admitted.admittedRequestPath, admitted, {
+    writeAdmittedRequestPersistence(admitted.runDirectory, admitted, {
         sessionDirectory: placement.sessionDirectory,
         sessionFile: placement.sessionFile,
     });
     await writeRoleInvocationLedger({ ...admitted, sessionDirectory: placement.sessionDirectory, sessionFile: placement.sessionFile }, admitted.role, options.model);
 }
-/** Load admitted-request.json written at admission (Navigator work-context seam). */
+/** Load the admitted section written at admission (Navigator work-context seam). */
 export async function loadAdmittedJudgeRequest(runDirectory) {
     try {
-        const raw = JSON.parse(await readFile(join(runDirectory, "admitted-request.json"), "utf8"));
-        if (!isRecord(raw))
+        const record = readPageSync(runDirectory, "admitted");
+        if (record === undefined)
             return undefined;
-        const record = raw;
         if (!packagedPublicInstructionSubject(record.role))
             return undefined;
         if (typeof record.instruction !== "string")
@@ -1343,10 +1342,6 @@ export async function loadAdmittedJudgeRequest(runDirectory) {
         return undefined;
     }
 }
-export async function ensureRunArtifactsDir(runDirectory) {
-    const directory = roleRunArtifactsDirectory(runDirectory);
-    return ensureRoleRunDirectory(resolveActivationLedgerHome(homeFromRunDirectory(runDirectory)), directory);
-}
 function parsePositivePrOption(raw) {
     if (raw === undefined || raw.trim() === "")
         throw new CliUsageError("--pr requires a positive pull request number");