@akagilnc/pi-workflow-roles 0.1.5614 → 0.1.5650

package/dist/migrate-book-topology.js

@@ -1365,8 +1365,7 @@ function roleRunPlacement(ledgerHome, input) {
   return {
     runDirectory,
     sessionDirectory,
-    sessionFile: sessionFileIn(sessionDirectory),
-    attachmentsDirectory: join5(runDirectory, "attachments")
+    sessionFile: sessionFileIn(sessionDirectory)
   };
 }
 function isUnboundRunDirectory(runDirectory) {
@@ -9993,7 +9992,7 @@ function rewriteAdmittedRoleRunPage(page, rewrites) {
   if (isRecord(page.principal)) {
     rewriteRunDirectoryPathFieldsAgainstRewrites(
       page.principal,
-      ["sessionDirectory", "sessionFile"],
+      PRINCIPAL_SESSION_PATH_FIELDS,
       rewrites
     );
   }
@@ -10166,7 +10165,7 @@ async function rewriteRoleRunDurablePages(input) {
       if (isRecord(page.principal)) {
         rewriteRunDirectoryPathFieldsAgainstRewrites(
           page.principal,
-          ["sessionDirectory", "sessionFile"],
+          PRINCIPAL_SESSION_PATH_FIELDS,
           rewrites
         );
       }
@@ -10206,7 +10205,7 @@ async function rewriteRoleRunDurablePages(input) {
   }
   await rewriteNestedMachinePathPages(pagesDirectory, rewrites);
 }
-var ADMITTED_PAGE_FIELDS, INVOCATION_PAGE_FIELDS, RUN_STATE_PAGE_FIELDS, SOURCE_RUN_LOCATOR_FIELDS, SUMMONS_PATH_FIELDS, OFFICER_POINTER_FIELDS, SITIAN_RECORD_FIELDS, SESSION_HEADER_FIELDS, BINDING_PARENT_FIELDS;
+var ADMITTED_PAGE_FIELDS, INVOCATION_PAGE_FIELDS, RUN_STATE_PAGE_FIELDS, PRINCIPAL_SESSION_PATH_FIELDS, SOURCE_RUN_LOCATOR_FIELDS, SUMMONS_PATH_FIELDS, OFFICER_POINTER_FIELDS, SITIAN_RECORD_FIELDS, SESSION_HEADER_FIELDS, BINDING_PARENT_FIELDS;
 var init_role_run_relocation = __esm({
   "src/role-run-relocation.ts"() {
     "use strict";
@@ -10240,6 +10239,10 @@ var init_role_run_relocation = __esm({
       "sessionDirectory",
       "sessionFile"
     ];
+    PRINCIPAL_SESSION_PATH_FIELDS = [
+      "sessionDirectory",
+      "sessionFile"
+    ];
     SOURCE_RUN_LOCATOR_FIELDS = ["runDirectory"];
     SUMMONS_PATH_FIELDS = ["sourceRunPath"];
     OFFICER_POINTER_FIELDS = ["sessionFile", "runDirectory"];

package/dist/pi/role-turn-host.js

@@ -5,6 +5,7 @@
  */
 import { execFile, spawn } from "node:child_process";
 import { constants } from "node:fs";
+import { existsSync } from "node:fs";
 import { access, appendFile, realpath } from "node:fs/promises";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { platform } from "node:process";
@@ -16,6 +17,8 @@ import { projectActivationFlags } from "../role-activation-flags.js";
 import { encodeUserDialogueStdin } from "../user-dialogue-stdin.js";
 import { readLedgerSessionJsonlLines, readStrictPiSessionJsonl } from "../ledger-session-read.js";
 import { copyAndRecordHostDossier } from "../host-session-record.js";
+import { resolveLiveRunDirectoryPath, retainPackageFaultBesideLivePlacement, syncTurnRequestLivePlacement, } from "../external-host-turn-loop.js";
+import { homeFromRunDirectory } from "../activation-ledger-topology.js";
 import { projectThrownFailureLeaf, retainPackageFault } from "../public-cli/settlement.js";
 import { describeErrorIdentity } from "../public-cli/run-lifecycle.js";
 import { RECEIPT_DELIVERY_LIMIT_ENV } from "../receipt-delivery-policy.js";
@@ -264,7 +267,34 @@ export function createDefaultPiSpawnRunner(options) {
                         packageErrors.push(stdinDeliveryError);
                     for (const error of packageErrors) {
                         const diagnostic = `Pi transport handling failed beside host terminal: ${describeErrorIdentity(error)}`;
-                        const runDirectory = spawnOptions.env.AK_ROLE_RUN_DIR;
+                        // #1171 F4: spawn-time path may have been renamed; reuse
+                        // resolveLiveRunDirectoryPath (same authority as syncTurnRequestLivePlacement).
+                        const spawnDir = spawnOptions.env.AK_ROLE_RUN_DIR;
+                        let runDirectory;
+                        if (typeof spawnDir === "string" && spawnDir.trim() !== "") {
+                            try {
+                                runDirectory = await resolveLiveRunDirectoryPath(spawnDir, homeFromRunDirectory(spawnDir));
+                            }
+                            catch (resolveError) {
+                                // Resolve threw beside an already-closed child: keep both causes
+                                // on the existing retain/stderr presentation path (失败诚实).
+                                runDirectory = existsSync(spawnDir) ? spawnDir : undefined;
+                                const resolveDiagnostic = `live run path resolve failed beside Pi transport fault: ${describeErrorIdentity(resolveError)}`;
+                                if (runDirectory !== undefined) {
+                                    await retainPackageFault({
+                                        runDirectory,
+                                        diagnostic: resolveDiagnostic,
+                                        error: resolveError,
+                                    });
+                                }
+                                else {
+                                    try {
+                                        process.stderr.write(`${resolveDiagnostic}\n`);
+                                    }
+                                    catch { /* Best-effort presentation beside the already closed child. */ }
+                                }
+                            }
+                        }
                         if (runDirectory !== undefined) {
                             await retainPackageFault({ runDirectory, diagnostic, error });
                         }
@@ -374,6 +404,7 @@ export function createPiRoleTurnHost(config) {
             // bind projects host.sessions; copy records the landing. Host adapters do
             // not write current.json — public bind/settlement seams own that render.
             try {
+                await syncTurnRequestLivePlacement(request);
                 const { sessionFile, sessionDirectory } = config.principalAuthority.decode(request.principal);
                 const sessionId = await readPiSessionHeaderId(sessionFile);
                 if (sessionId !== undefined) {
@@ -389,8 +420,7 @@ export function createPiRoleTurnHost(config) {
                 }
             }
             catch (error) {
-                await retainPackageFault({
-                    runDirectory: request.runDirectory,
+                await retainPackageFaultBesideLivePlacement(request, {
                     diagnostic: `pi host dossier record failed beside host terminal: ${describeErrorIdentity(error)}`,
                     error,
                 });

package/dist/public-cli/instruction-seat-run.js

@@ -4,7 +4,10 @@
  * starts two ordinary single-axis runs here.
  */
 import { dirname, resolve } from "node:path";
+import { MISSING_TICKET_REASK_MATERIAL } from "../report-ticket-tool.js";
 import { isUnboundRunDirectory, sessionFileOf } from "../role-run-placement.js";
+import { rewriteRunDirectoryPathValue } from "../role-run-relocation.js";
+import { readPackageMaterial } from "../session-opening-materials.js";
 import { bookDirectOfficerRunPointer, readDirectOfficerRunPointer } from "../archivist-record-pointer.js";
 import { createPiDoctorAuditor } from "../doctor-auditor.js";
 import { officerConclusionReask, gateOfficerForSubject } from "../gatekeeper-role.js";
@@ -21,7 +24,7 @@ import { readRecordedSubmissionRows } from "../submission-ledger.js";
 import { summonPublicRole } from "../public-role-summons.js";
 import { sessionFileFromPublicSummon } from "../session-assistant-usage.js";
 import { latestQueuePayload, latestQueueStatus, } from "../submission-gate.js";
-import { isSafePositiveTicketNumber, readBoardTicketNumber } from "../run-ticket-number.js";
+import { isSafePositiveTicketNumber, readBoardTicketNumber, } from "../run-ticket-number.js";
 import { NotarySourceRunError, resolveNotarySourceRunLocator } from "../notary-source-run.js";
 import { packagedAdmitsCountersign, packagedBindsBoardTicket, packagedRebindSourceOnResume, packagedRoleMetadata, } from "../packaged-role-registry.js";
 import { readAuditorResumeBinding } from "../auditor-soul.js";
@@ -86,11 +89,21 @@ function unreadablePostSubmissionStatus(admitted, terminal) {
  * status: the caller presents the volumes already in hand and does not advance
  * review. ADR 0007 audit continues are not this shape.
  */
+/**
+ * Drop turn-scoped soft-reask identity; keep cross-turn budgets and ownership cell.
+ * #1171 F2-R5 / F2-R9: ordinary status reask and court continue must not inherit
+ * softTicketReaskTurn (that flag only governs the soft-reask turn's own settle).
+ */
+function withoutSoftTicketReaskTurn(env) {
+    const { softTicketReaskTurn: _softTicketReaskTurn, ...rest } = env;
+    return rest;
+}
 function withUnreadableReask(env) {
     const spent = env.unreadableReasksSpent ?? 0;
     if (spent >= deliveryLimitFromConfig(env.autoResumeLimit))
         return undefined;
-    return { ...env, unreadableReasksSpent: spent + 1 };
+    // Ordinary status reask: strip soft-reask turn identity; keep spent budget (#1171 F2-R9).
+    return { ...withoutSoftTicketReaskTurn(env), unreadableReasksSpent: spent + 1 };
 }
 /** Budget spent on an unreadable status. Distinct from "status is readable". */
 const UNREADABLE_REASK_EXHAUSTED = { unreadableReaskExhausted: true };
@@ -156,6 +169,146 @@ async function reaskUnreadablePostSubmissionStatus(admitted, terminal, env, io,
         return UNREADABLE_REASK_EXHAUSTED;
     return runPublicInstructionSeatResume({ runId: admitted.runId, summons: { instruction: message } }, next, io);
 }
+/**
+ * #1171: sealed submission still leaves the leg unbound → soft reask once.
+ * Does not reject the sealed receipt; exhaustion leaves unbound as filed.
+ * Reask copy lives in package resources (ADR 0073).
+ * #1171 F2-R7: ownership comes from this nested resume's settlement seam
+ * (softTicketReaskOwnership.sealedSubstitute set when the soft-reask turn itself seals),
+ * not full-leg sealed count / time-window deltas that can absorb another court's seal.
+ */
+async function reaskMissingTicketOnce(admitted, terminal, env, io) {
+    if ((env.ticketReasksSpent ?? 0) >= 1)
+        return { kind: "none" };
+    if (admitted.ticketNumber !== undefined)
+        return { kind: "none" };
+    if (!isUnboundRunDirectory(admitted.runDirectory))
+        return { kind: "none" };
+    if (terminal?.roleOutcome.kind !== "accepted" && terminal?.roleOutcome.kind !== "audit_escalation") {
+        return { kind: "none" };
+    }
+    const payloads = terminal.roleOutcome.payloads ?? [];
+    if (payloads.length === 0)
+        return { kind: "none" };
+    // Sealed-with-ticket skips via admitted.ticketNumber after bindSealedTicketNumber
+    // (post-admission). Do not re-parse payload.ticketNumber here — that would
+    // duplicate the existing ticket seam (#1171 notary: no rule copy).
+    const instruction = (await readPackageMaterial(MISSING_TICKET_REASK_MATERIAL)).trim();
+    // Spend budget and mark this turn as the soft reask (settlement identity).
+    // Ownership cell is set at that turn's settlement; env spreads keep the same
+    // ref through audit continue — see envForCourtContinue (#1171 F2-R5 / F2-R7).
+    const softTicketReaskOwnership = { sealedSubstitute: false };
+    const softReaskEnv = {
+        ...env,
+        ticketReasksSpent: 1,
+        softTicketReaskTurn: true,
+        softTicketReaskOwnership,
+    };
+    const result = await runPublicInstructionSeatResume({ runId: admitted.runId, summons: { instruction } }, softReaskEnv, io);
+    if (softTicketReaskOwnership.sealedSubstitute
+        || terminalCarriesSealedSubmission(result.terminal)) {
+        return { kind: "nested_owns", result };
+    }
+    return { kind: "no_substitute", result };
+}
+/** Court continue: keep cross-turn budgets + ownership cell; drop turn-scoped soft-reask identity. */
+function envForCourtContinue(env) {
+    return { ...withoutSoftTicketReaskTurn(env), unreadableReasksSpent: 0 };
+}
+/** True when a terminal still carries a sealed accepted / audit_escalation volume. */
+function terminalCarriesSealedSubmission(terminal) {
+    const kind = terminal?.roleOutcome.kind;
+    if (kind !== "accepted" && kind !== "audit_escalation")
+        return false;
+    return (terminal?.roleOutcome.payloads ?? []).length > 0;
+}
+/**
+ * #1171 F2-R2: kept original terminal may still name pre-relocate artifact
+ * paths after a report-only reask moved the leg. Project onto live admitted
+ * via the same rewrite seam post-admission uses after relocate.
+ */
+function projectKeptOriginalArtifactsOntoLiveAdmitted(original, kept) {
+    const oldRunDirectory = original.admitted?.runDirectory;
+    const newRunDirectory = kept.admitted?.runDirectory;
+    if (oldRunDirectory === undefined
+        || newRunDirectory === undefined
+        || oldRunDirectory === newRunDirectory
+        || kept.terminal === undefined) {
+        return;
+    }
+    for (const artifact of kept.terminal.artifacts) {
+        artifact.path = rewriteRunDirectoryPathValue(artifact.path, oldRunDirectory, newRunDirectory);
+    }
+}
+/**
+ * #1171 F2: missing-ticket reask did not seal a substitute — keep original
+ * terminal; take live placement from the reask when it relocated.
+ * #1171 F2-R1: silence / report-only stays on the original chain; a real host
+ * failure (nonzero exit) must be delivered honestly — do not wash it into the
+ * original accepted result. Sealed original volume remains on disk either way.
+ * #1171 F2-R2: after keep, project report artifact paths onto the live
+ * admitted directory so public result, durable face, and artifact refs agree.
+ * Substitute ownership is decided once at the soft-reask call seam (F2-R6);
+ * this helper only finishes the keep path.
+ */
+function mergeMissingTicketReaskKeepOriginal(original, ticketReask) {
+    if (ticketReask.exitCode !== 0)
+        return ticketReask;
+    const admitted = ticketReask.admitted ?? original.admitted;
+    if (admitted === undefined)
+        return { ...original };
+    const kept = { ...original, admitted };
+    projectKeptOriginalArtifactsOntoLiveAdmitted(original, kept);
+    return kept;
+}
+/**
+ * Post-submission status reask, then missing-ticket soft reask, then audit.
+ * #1171 F3: status exhaustion must not skip the one missing-ticket reask.
+ * #1171 F2: ticket reask without a substitute seal continues the original chain.
+ */
+async function continueAfterPostSubmissionGuards(result, admittedRole, env, io, held) {
+    const live = result.admitted;
+    if (live === undefined) {
+        await presentOriginalVolume(held, result.terminal, io);
+        return result;
+    }
+    const unreadableReask = await reaskUnreadablePostSubmissionStatus(live, result.terminal, env, io);
+    let afterStatus = result;
+    if (isUnreadableReaskExhausted(unreadableReask)) {
+        const terminal = result.terminal === undefined
+            ? undefined
+            : withUnsettledDirection(result.terminal);
+        afterStatus = terminal === undefined
+            ? { ...result, admitted: live }
+            : { ...result, admitted: live, terminal };
+        // Fall through: missing-ticket reask still owed on the original sealed volume.
+    }
+    else if (unreadableReask !== undefined) {
+        return unreadableReask;
+    }
+    const forTicket = afterStatus.admitted ?? live;
+    // Ownership is decided once inside reaskMissingTicketOnce (#1171 F2-R6).
+    const softReask = await reaskMissingTicketOnce(forTicket, afterStatus.terminal ?? result.terminal, env, io);
+    if (softReask.kind === "nested_owns") {
+        // Nested resume already finished guards + audit/present for the substitute.
+        // Do not run a second outer settlement of the same public call (#1171 F2-R4b).
+        return softReask.result;
+    }
+    const continued = softReask.kind === "none"
+        ? afterStatus
+        : mergeMissingTicketReaskKeepOriginal(afterStatus, softReask.result);
+    const continuedAdmitted = continued.admitted ?? live;
+    // Spent budget rides the outer audit/continue chain (#1171 F2-R4a). Soft-reask
+    // settlement identity does not — ordinary continue turns publish no_receipt (#1171 F2-R5).
+    const continuedEnv = softReask.kind !== "none"
+        ? { ...env, ticketReasksSpent: 1 }
+        : env;
+    if (AUDITED_ROLES.has(admittedRole) && continued.terminal?.roleOutcome.kind === "accepted") {
+        return auditSubmittedRole({ ...continued, admitted: continuedAdmitted }, continuedEnv, io);
+    }
+    await presentOriginalVolume(held, continued.terminal, io, continuedAdmitted.runDirectory);
+    return { ...continued, admitted: continuedAdmitted };
+}
 function roleRecord(role) {
     const record = packagedRoleMetadata(role);
     if (record === undefined) {
@@ -360,21 +513,9 @@ async function dispatchAdmitted(admitted, env, io) {
         });
     };
     const result = await execute(env);
-    const unreadableReask = await reaskUnreadablePostSubmissionStatus(admitted, result.terminal, env, io);
-    if (isUnreadableReaskExhausted(unreadableReask)) {
-        const terminal = result.terminal === undefined
-            ? undefined
-            : withUnsettledDirection(result.terminal);
-        await presentOriginalVolume(held, terminal, io, admitted.runDirectory);
-        return terminal === undefined ? result : { ...result, terminal };
-    }
-    if (unreadableReask !== undefined)
-        return unreadableReask;
-    if (AUDITED_ROLES.has(admitted.role) && result.terminal?.roleOutcome.kind === "accepted") {
-        return auditSubmittedRole(result, env, io);
-    }
-    await presentOriginalVolume(held, result.terminal, io, admitted.runDirectory);
-    return result;
+    // Prefer the live admitted object returned from the turn (may have relocated).
+    const live = result.admitted ?? admitted;
+    return continueAfterPostSubmissionGuards({ ...result, admitted: live }, admitted.role, env, io, held);
 }
 /**
  * Omitted lens on a parallel-lens seat: two ordinary single-axis runs, no parent run.
@@ -594,10 +735,9 @@ export async function runPublicInstructionSeat(argv, env, io, role, parseArgv) {
         const result = await runCountersignBody(parsed, env, {
             stdout: (value) => held.push(value), stderr: io.stderr,
         });
-        if (result.terminal?.roleOutcome.kind === "accepted")
-            return auditSubmittedRole(result, env, io);
-        await presentOriginalVolume(held, result.terminal, io, result.admitted?.runDirectory);
-        return result;
+        // Same post-submission guards as every other seat (#1171 F8): missing-ticket
+        // soft reask once, then audit — no early return that skips the reask.
+        return continueAfterPostSubmissionGuards(result, "countersign", env, io, held);
     }
     if ("parallelLenses" in record && record.parallelLenses === true) {
         if (parsed.baseRevision === undefined) {
@@ -842,24 +982,11 @@ export async function runPublicInstructionSeatResume(request, env, io) {
             },
             ...(env.engine === undefined ? {} : { effectiveEngine: env.engine }),
         });
-        const unreadableReask = result.admitted === undefined
-            ? undefined
-            : await reaskUnreadablePostSubmissionStatus(result.admitted, result.terminal, env, io);
-        if (isUnreadableReaskExhausted(unreadableReask)) {
-            const terminal = result.terminal === undefined
-                ? undefined
-                : withUnsettledDirection(result.terminal);
-            await presentOriginalVolume(held, terminal, io, result.admitted?.runDirectory);
-            return terminal === undefined ? result : { ...result, terminal };
-        }
-        if (unreadableReask !== undefined)
-            return unreadableReask;
-        if (result.admitted !== undefined && AUDITED_ROLES.has(result.admitted.role)
-            && result.terminal?.roleOutcome.kind === "accepted") {
-            return auditSubmittedRole(result, env, io);
+        if (result.admitted === undefined) {
+            await presentOriginalVolume(held, result.terminal, io);
+            return result;
         }
-        await presentOriginalVolume(held, result.terminal, io, result.admitted?.runDirectory);
-        return result;
+        return continueAfterPostSubmissionGuards(result, result.admitted.role, env, io, held);
     };
     let binding;
     try {
@@ -905,7 +1032,7 @@ async function queueConclusionFromChild(child, env, io) {
     // Notary, auditor, and inspector have no seat-local status reask. This loop
     // is their one budget. The child resume keeps the caller's env so delivery,
     // failure recovery, and other reask loops stay separate.
-    let budgetEnv = { ...env, unreadableReasksSpent: 0 };
+    let budgetEnv = envForCourtContinue(env);
     for (;;) {
         const terminal = await trySettlePublicSeat(current, env.principalAuthority, { ...await readCurrentCourt(current.runDirectory), ...packageFaultScope(current, env, io) });
         const status = latestQueueStatus(terminal);
@@ -966,7 +1093,7 @@ export async function continueParentAfterChild(parentRunId, child, env, io) {
         return runPublicInstructionSeatResume({
             runId: parentRunId,
             summons: { instruction: readableGateItem(latestQueuePayload(resolved.terminal)) },
-        }, { ...env, unreadableReasksSpent: 0 }, io);
+        }, envForCourtContinue(env), io);
     }
     const result = await dispatchAdmitted(admitted, env, { ...io, omitFailureStderrDiagnostic: true });
     showResumeErrorPointer(io, result.exitCode, result.terminal);
@@ -1005,6 +1132,8 @@ async function officerPassedCurrentSubmission(input) {
 }
 /** Finished submissions enter the existing audit gate after their tool call has returned. */
 async function auditSubmittedRole(turn, env, io, resumedOfficer, passedReceipt) {
+    // Ordinary audit chain: drop soft-reask turn identity; keep budgets/ownership (#1171 F2-R9).
+    env = withoutSoftTicketReaskTurn(env);
     const admitted = turn.admitted;
     if (admitted === undefined || !AUDITED_ROLES.has(admitted.role)
         || turn.terminal?.roleOutcome.kind !== "accepted")
@@ -1053,11 +1182,13 @@ async function auditSubmittedRole(turn, env, io, resumedOfficer, passedReceipt)
         await presentTerminal(turn.terminal, { ...io, omitFailureStderrDiagnostic: true }, admitted.runDirectory);
         return turn;
     }
-    const rows = await readRecordedSubmissionRows(admitted.projectRoot, admitted.runId, env.home);
-    const acceptedRow = [...rows].reverse().find((row) => row.role === admitted.role && row.kind === "accepted");
-    const toolCallId = acceptedRow?.toolCallId;
-    if (toolCallId === undefined)
+    // #1171 F2-R8: bind audit to the sealed identity carried on this turn's
+    // settlement terminal — never the whole-leg latest accepted row (another
+    // lawful public call may have sealed and passed台院 meanwhile).
+    const toolCallId = turn.terminal.submissionToolCallId;
+    if (toolCallId === undefined || toolCallId.length === 0) {
         throw new Error("accepted submission has no tool call identity");
+    }
     const sessionFile = env.principalAuthority.decode(admitted.principal).sessionFile;
     const entries = admitted.role === "doctor"
         ? await readBoundSessionEntries(sessionFile)
@@ -1118,7 +1249,7 @@ async function auditSubmittedRole(turn, env, io, resumedOfficer, passedReceipt)
             if (decision.status === "continue") {
                 return runPublicInstructionSeatResume({
                     runId: admitted.runId, summons: { instruction: readableGateItem(decision.receipt ?? decision.violations) },
-                }, { ...env, unreadableReasksSpent: 0 }, io);
+                }, envForCourtContinue(env), io);
             }
             if (decision.status === "received") {
                 if (lastSummon?.terminal === undefined) {
@@ -1224,7 +1355,7 @@ async function auditSubmittedRole(turn, env, io, resumedOfficer, passedReceipt)
             return runPublicInstructionSeatResume({
                 runId: admitted.runId,
                 summons: { instruction: readableGateItem(chain.passes.at(-1)?.receipt) },
-            }, { ...env, unreadableReasksSpent: 0 }, io);
+            }, envForCourtContinue(env), io);
         }
         if (admitted.role === "secretariat") {
             const pass = chain.passes.at(-1);

package/dist/public-cli/invocation.js

@@ -11,7 +11,7 @@ import { resolveBookKeyFromGit } from "../activation-ledger-git.js";
 import { ensureRoleRunDirectory, ensureRoleRunPlacement, formatRunLeaf, isUnboundRunDirectory, listBookRunDirectories, roleRunPlacement, } from "../role-run-placement.js";
 import { packagedAdmittedSubject, packagedArgvResult, packagedBareToken, packagedBaseIsRevision, packagedEmitsAuthorityRefs, packagedPublicInstructionSubject, packagedRoleMetadata, packagedStoresSourceRunRaw, packagedSubjectChoices, } from "../packaged-role-registry.js";
 import { isSafePositiveTicketNumber, parseTicketNumber, readBoardTicketNumber, requireSafePositiveTicketNumber, } from "../run-ticket-number.js";
-import { rewriteRunDirectoryPathFields, } from "../role-run-relocation.js";
+import { rewriteAdmittedRoleRunPage, } from "../role-run-relocation.js";
 import { readPageSync, renderCurrentSync, updateSectionSync, writeSectionSync } from "../run-dossier.js";
 import { loadDoctorCase, } from "../doctor-evidence.js";
 import { parseCollectorPrNumber, parseCollectorRepository, } from "../collector-config.js";
@@ -267,13 +267,7 @@ export async function relocateAdmittedRunToTicket(admitted, authority, heldLease
     // admitted path ownership immediately after the commit — before any derived
     // render that may refuse (#1161 L1 / BASE order).
     heldLease?.relocate(target.runDirectory);
-    const admittedRecord = admitted;
-    rewriteRunDirectoryPathFields(admittedRecord, [
-        "runDirectory",
-        "mergerInputPath",
-    ], oldRunDirectory, target.runDirectory);
-    // #1165/#1168: caller file-flag paths stay as given. Obsolete copy fields
-    // (taskPath/packetPath) are not rewritten — stock volumes keep their bytes.
+    rewriteAdmittedRoleRunPage(admitted, [{ oldRunDirectory, newRunDirectory: target.runDirectory }]);
     admitted.principal = principal;
     // current.json projects host.original from this run directory. Ownership is
     // already transferred; a refuse still carries the true cause to the caller
@@ -969,7 +963,7 @@ async function placeRoleAdmission(options) {
     const projectRoot = resolve(options.project ?? options.cwd);
     const runId = options.runId ?? (options.createRunId ?? uuidv7)();
     const ticketFields = ticketAdmissionFields(options.assertedTicketNumber);
-    const { principal, sessionDirectory, sessionFile, runDirectory, attachmentsDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
+    const { principal, sessionDirectory, sessionFile, runDirectory, ledgerHome, bookKey, } = issueAdmissionPlacement(options.principalAuthority, {
         cwd: projectRoot,
         runId,
         role: options.role,
@@ -989,7 +983,6 @@ async function placeRoleAdmission(options) {
         sessionDirectory,
         sessionFile,
         attachments,
-        attachmentsDirectory,
         ledgerHome,
         ticketFields,
     };
@@ -1009,8 +1002,8 @@ async function persistPlacedAdmission(admitted, placed, model) {
     }, admitted.role, model);
 }
 /**
- * Shared admission: project check, placement, attachment freeze,
- * admitted and invocation section write.
+ * Shared admission: project check, placement, admitted and invocation section write.
+ * Caller file-flag paths are recorded opaque on the admitted page (ADR 0087).
  * Countersign passes deferPersistence so same-ticket lookup can reserve coordinates
  * before materializeCountersignInvocation writes the page.
  * Seats whose extra facts are known before placement pass them as admittedFields.