@akagilnc/pi-workflow-roles 0.1.5679 → 0.1.5698

package/dist/report-ticket-tool.js

@@ -9,6 +9,7 @@ import { runDirectoryFromHostContext } from "./host-contracts.js";
 import { piDurablePrincipalAuthority } from "./pi/durable-principal.js";
 import { bindAdmittedTicketNumber, relocateAdmittedRunToTicket, } from "./public-cli/invocation.js";
 import { isUnboundRunDirectory, sessionDirectoryOf, sessionFileOf } from "./role-run-placement.js";
+import { rewriteRunDirectoryPathValue } from "./role-run-path-rewrite.js";
 import { readPageSync } from "./run-dossier.js";
 import { readDeclaredTicketNumber } from "./run-ticket-number.js";
 import { isRecord } from "./unknown-value.js";
@@ -89,6 +90,11 @@ export async function reportTicketFromHostContext(context, rawTicketNumber, auth
     // Live handles belong with rename ownership — before derived renderCurrentSync
     // (#1171 F4-R2). Reuse relocate's heldLease.relocate seam; keep raw I/O throw.
     const applyLiveHandles = (nextDirectory) => {
+        // Capture live session handle before ownership transfer. After relocate the
+        // write handle must share host-authority coords with the principal (#1183):
+        // project the prior path onto the new leaf — never rebuild default
+        // session.jsonl over a non-default seal (and do not trust a setter rebuild).
+        const priorSessionFile = context.sessionManager.getSessionFile?.();
         context.runDirectory = nextDirectory;
         // Same-leg spawn env only (#1171 F1): never overwrite another leg's ambient
         // AK_ROLE_RUN_DIR in a shared process. HostContext is the per-turn authority
@@ -96,8 +102,12 @@ export async function reportTicketFromHostContext(context, rawTicketNumber, auth
         if (process.env.AK_ROLE_RUN_DIR === runDirectory) {
             process.env.AK_ROLE_RUN_DIR = nextDirectory;
         }
-        // Native host rebind only — SessionManager has no setSessionDir; appends follow sessionFile.
-        context.sessionManager.setSessionFile?.(sessionFileOf(nextDirectory));
+        const projectedSessionFile = typeof priorSessionFile === "string" && priorSessionFile.trim() !== ""
+            ? rewriteRunDirectoryPathValue(priorSessionFile, runDirectory, nextDirectory)
+            : sessionFileOf(nextDirectory);
+        if (typeof projectedSessionFile === "string") {
+            context.sessionManager.setSessionFile?.(projectedSessionFile);
+        }
     };
     const relocation = alreadyPlaced
         ? undefined

package/dist/role-run-path-rewrite.js

@@ -0,0 +1,149 @@
+/**
+ * Sole pure authority for typed run-directory path rewrite / projection.
+ * No dossier I/O — run-dossier render and role-run-relocation durable walks
+ * both consume this module (avoids a cycle through page readers).
+ *
+ * Scope is typed machine-consumed path fields only — never free text, never
+ * caller file-flag path strings.
+ */
+import { sep } from "node:path";
+import { isRecord } from "./unknown-value.js";
+export const ADMITTED_PAGE_PATH_FIELDS = [
+    "runDirectory",
+    "admittedRequestPath", // pre-#1161 pages only
+    "sessionDirectory",
+    "sessionFile",
+    // #1165/#1168: caller file-flag paths stay as given.
+    "mergerInputPath",
+    "sourceRunPath",
+];
+export const INVOCATION_PAGE_PATH_FIELDS = [
+    "runDirectory",
+    "sessionDirectory",
+    "sessionFile",
+];
+export const RUN_STATE_PAGE_PATH_FIELDS = [
+    "runDirectory",
+    "admittedRequestPath", // pre-#1161 pages only
+    "sessionDirectory",
+    "sessionFile",
+];
+/** Typed principal session coordinates rewritten when the owning run leaf moves. */
+export const PRINCIPAL_SESSION_PATH_FIELDS = [
+    "sessionDirectory",
+    "sessionFile",
+];
+const SOURCE_RUN_LOCATOR_FIELDS = ["runDirectory"];
+const SUMMONS_PATH_FIELDS = ["sourceRunPath"];
+/** Rewrite one path value that points at or under oldRunDirectory. */
+export function rewriteRunDirectoryPathValue(value, oldRunDirectory, newRunDirectory) {
+    if (typeof value !== "string")
+        return value;
+    if (value === oldRunDirectory)
+        return newRunDirectory;
+    const prefix = `${oldRunDirectory}${sep}`;
+    if (value.startsWith(prefix)) {
+        return `${newRunDirectory}${value.slice(oldRunDirectory.length)}`;
+    }
+    return value;
+}
+/**
+ * Apply the longest matching oldRunDirectory rewrite. Longer keys win so a
+ * nested run path is not partially claimed by a shorter sibling prefix.
+ */
+export function rewriteRunDirectoryPathValueAgainstRewrites(value, rewrites) {
+    if (typeof value !== "string" || rewrites.length === 0)
+        return value;
+    let best;
+    for (const rewrite of rewrites) {
+        if (value === rewrite.oldRunDirectory ||
+            value.startsWith(`${rewrite.oldRunDirectory}${sep}`)) {
+            if (best === undefined ||
+                rewrite.oldRunDirectory.length > best.oldRunDirectory.length) {
+                best = rewrite;
+            }
+        }
+    }
+    if (best === undefined)
+        return value;
+    return rewriteRunDirectoryPathValue(value, best.oldRunDirectory, best.newRunDirectory);
+}
+/** In-place rewrite of selected fields on one record (single pair). */
+export function rewriteRunDirectoryPathFields(record, fields, oldRunDirectory, newRunDirectory) {
+    rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, [
+        { oldRunDirectory, newRunDirectory },
+    ]);
+}
+/** In-place rewrite of selected fields against a rewrite set. */
+export function rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, rewrites) {
+    for (const field of fields) {
+        if (field in record) {
+            record[field] = rewriteRunDirectoryPathValueAgainstRewrites(record[field], rewrites);
+        }
+    }
+}
+/** Principal session paths only — shared live + durable projection after a run move. */
+export function rewritePrincipalSessionPaths(principal, oldRunDirectory, newRunDirectory) {
+    rewriteRunDirectoryPathFields(principal, PRINCIPAL_SESSION_PATH_FIELDS, oldRunDirectory, newRunDirectory);
+}
+/**
+ * Live turn request: move runDirectory and keep principal session paths on the
+ * new leaf. Sole path = host authority decode → rewrite coords copy → seal
+ * (#1183 / #636). No shape-based in-place rewrite and no silent skip.
+ */
+export function projectTurnRequestLiveRunDirectory(request, newRunDirectory, authority) {
+    const old = request.runDirectory;
+    if (old === newRunDirectory)
+        return;
+    const coords = { ...authority.decode(request.principal) };
+    rewritePrincipalSessionPaths(coords, old, newRunDirectory);
+    const sealed = authority.seal(coords);
+    request.runDirectory = newRunDirectory;
+    request.principal = sealed;
+}
+/** Typed notary/source-run locator: only runDirectory is a path. */
+export function rewriteSourceRunLocator(value, rewrites) {
+    if (!isRecord(value))
+        return;
+    rewriteRunDirectoryPathFieldsAgainstRewrites(value, SOURCE_RUN_LOCATOR_FIELDS, rewrites);
+}
+/** Same-ticket summons materials: typed source-run; caller attach paths stay as-is (#1165). */
+export function rewriteSummonsMaterials(value, rewrites) {
+    if (!isRecord(value))
+        return;
+    rewriteRunDirectoryPathFieldsAgainstRewrites(value, SUMMONS_PATH_FIELDS, rewrites);
+    rewriteSourceRunLocator(value.sourceRun, rewrites);
+    // #1165: summons.attachmentPaths are caller paths — do not rewrite.
+}
+/** Project one admitted page in memory after its containing run moved. */
+export function rewriteAdmittedRoleRunPage(page, rewrites) {
+    rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_PATH_FIELDS, rewrites);
+    rewriteSourceRunLocator(page.sourceRun, rewrites);
+    // #1165: admitted attachments are caller paths outside the run directory — do not rewrite.
+    if (isRecord(page.principal)) {
+        rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, PRINCIPAL_SESSION_PATH_FIELDS, rewrites);
+    }
+}
+/**
+ * #1183: current.json location fields follow the directory being rendered.
+ * Fact rows stay as written (append-only); only the rendering projects stored→actual.
+ * Returns the same object when already aligned. Caller file-flag paths stay opaque.
+ */
+export function projectRenderedPagePaths(page, actualRunDirectory) {
+    const stored = typeof page.runDirectory === "string" && page.runDirectory.trim() !== ""
+        ? page.runDirectory
+        : undefined;
+    if (stored === undefined || stored === actualRunDirectory)
+        return page;
+    const projected = structuredClone(page);
+    const rewrites = [
+        { oldRunDirectory: stored, newRunDirectory: actualRunDirectory },
+    ];
+    // Admitted field set is the location-field superset of invocation; runState adds
+    // principal (covered) and optional currentCourt summons under this run.
+    rewriteAdmittedRoleRunPage(projected, rewrites);
+    if (isRecord(projected.currentCourt)) {
+        rewriteSummonsMaterials(projected.currentCourt.summons, rewrites);
+    }
+    return projected;
+}

package/dist/role-run-relocation.js

@@ -1,64 +1,27 @@
 /**
- * Single authority for rewriting durable run pages after a run directory moves.
- * Live callers project typed fields; only historical migrators walk durable pages.
+ * Durable run-page path rewrite after a run directory moves, plus retained-path
+ * matching for live lookup. Pure path rewrite rules live in role-run-path-rewrite.ts
+ * (sole authority); this module owns I/O walks that need dossier page readers.
  *
  * Scope is typed machine-consumed path fields only — never free text, never
  * caller file-flag path strings. Nested walk is confined to package-owned
  * `session/` seams.
  */
 import { readdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, join, sep } from "node:path";
+import { dirname, join } from "node:path";
 import { activationBookDirectory, physicalPathIdentity } from "./activation-ledger-topology.js";
+import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.js";
 import { readRoleRunIdentity } from "./public-cli/run-lifecycle.js";
 import { findRoleRunDirectory, roleRunPlacement } from "./role-run-placement.js";
-import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.js";
+import { INVOCATION_PAGE_PATH_FIELDS, PRINCIPAL_SESSION_PATH_FIELDS, RUN_STATE_PAGE_PATH_FIELDS, projectTurnRequestLiveRunDirectory, rewriteAdmittedRoleRunPage, rewritePrincipalSessionPaths, rewriteRunDirectoryPathFields, rewriteRunDirectoryPathFieldsAgainstRewrites, rewriteRunDirectoryPathValue, rewriteRunDirectoryPathValueAgainstRewrites, rewriteSummonsMaterials, } from "./role-run-path-rewrite.js";
 import { readPageSync, updateSectionSync } from "./run-dossier.js";
-import { isRecord, isEnoent } from "./unknown-value.js";
-const ADMITTED_PAGE_FIELDS = [
-    "runDirectory",
-    "admittedRequestPath", // pre-#1161 pages only
-    "sessionDirectory",
-    "sessionFile",
-    // #1165/#1168: caller file-flag paths (requestManifestPath, prerequisitesPath)
-    // stay as given. Obsolete copy fields (taskPath/packetPath) are not rewritten —
-    // stock volumes keep their bytes; live relocate no longer maintains them.
-    "mergerInputPath",
-    "sourceRunPath",
-];
-const INVOCATION_PAGE_FIELDS = [
-    "runDirectory",
-    "sessionDirectory",
-    "sessionFile",
-];
-const RUN_STATE_PAGE_FIELDS = [
-    "runDirectory",
-    "admittedRequestPath", // pre-#1161 pages only
-    "sessionDirectory",
-    "sessionFile",
-];
-/** Typed principal session coordinates rewritten when the owning run leaf moves. */
-export const PRINCIPAL_SESSION_PATH_FIELDS = [
-    "sessionDirectory",
-    "sessionFile",
-];
-const SOURCE_RUN_LOCATOR_FIELDS = ["runDirectory"];
-const SUMMONS_PATH_FIELDS = ["sourceRunPath"];
+import { isEnoent, isRecord } from "./unknown-value.js";
+// Re-export the pure path API so existing import sites stay on this module path.
+export { PRINCIPAL_SESSION_PATH_FIELDS, projectTurnRequestLiveRunDirectory, rewriteAdmittedRoleRunPage, rewritePrincipalSessionPaths, rewriteRunDirectoryPathFields, rewriteRunDirectoryPathFieldsAgainstRewrites, rewriteRunDirectoryPathValue, rewriteRunDirectoryPathValueAgainstRewrites, } from "./role-run-path-rewrite.js";
 const OFFICER_POINTER_FIELDS = ["sessionFile", "runDirectory"];
 const SITIAN_RECORD_FIELDS = ["sessionParent"];
 const SESSION_HEADER_FIELDS = ["parentSession"];
 const BINDING_PARENT_FIELDS = ["sessionFile"];
-/** Rewrite one path value that points at or under oldRunDirectory. */
-export function rewriteRunDirectoryPathValue(value, oldRunDirectory, newRunDirectory) {
-    if (typeof value !== "string")
-        return value;
-    if (value === oldRunDirectory)
-        return newRunDirectory;
-    const prefix = `${oldRunDirectory}${sep}`;
-    if (value.startsWith(prefix)) {
-        return `${newRunDirectory}${value.slice(oldRunDirectory.length)}`;
-    }
-    return value;
-}
 /** Match physical aliases or a normal unbound→ticket bind, never historical migration layouts. */
 export async function retainedRunPathsMatch(recordedPath, currentPath, currentRunDirectory) {
     if (recordedPath === currentPath)
@@ -93,56 +56,6 @@ export async function retainedRunPathsMatch(recordedPath, currentPath, currentRu
     }
     return false;
 }
-/**
- * Apply the longest matching oldRunDirectory rewrite. Longer keys win so a
- * nested run path is not partially claimed by a shorter sibling prefix.
- */
-export function rewriteRunDirectoryPathValueAgainstRewrites(value, rewrites) {
-    if (typeof value !== "string" || rewrites.length === 0)
-        return value;
-    let best;
-    for (const rewrite of rewrites) {
-        if (value === rewrite.oldRunDirectory ||
-            value.startsWith(`${rewrite.oldRunDirectory}${sep}`)) {
-            if (best === undefined ||
-                rewrite.oldRunDirectory.length > best.oldRunDirectory.length) {
-                best = rewrite;
-            }
-        }
-    }
-    if (best === undefined)
-        return value;
-    return rewriteRunDirectoryPathValue(value, best.oldRunDirectory, best.newRunDirectory);
-}
-/** In-place rewrite of selected fields on one record (single pair). */
-export function rewriteRunDirectoryPathFields(record, fields, oldRunDirectory, newRunDirectory) {
-    rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, [
-        { oldRunDirectory, newRunDirectory },
-    ]);
-}
-/** Principal session paths only — shared live + durable projection after a run move. */
-export function rewritePrincipalSessionPaths(principal, oldRunDirectory, newRunDirectory) {
-    rewriteRunDirectoryPathFields(principal, PRINCIPAL_SESSION_PATH_FIELDS, oldRunDirectory, newRunDirectory);
-}
-/**
- * Live turn request: move runDirectory and rewrite principal session paths in place.
- * Callers that lack authority.seal use this; admitted refresh seals after the same rewrite.
- */
-export function projectTurnRequestLiveRunDirectory(request, newRunDirectory) {
-    const old = request.runDirectory;
-    if (old === newRunDirectory)
-        return;
-    request.runDirectory = newRunDirectory;
-    rewritePrincipalSessionPaths(request.principal, old, newRunDirectory);
-}
-/** In-place rewrite of selected fields against a rewrite set. */
-export function rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, rewrites) {
-    for (const field of fields) {
-        if (field in record) {
-            record[field] = rewriteRunDirectoryPathValueAgainstRewrites(record[field], rewrites);
-        }
-    }
-}
 function collectRewrites(input) {
     const own = {
         oldRunDirectory: input.oldRunDirectory,
@@ -163,29 +76,6 @@ function collectRewrites(input) {
     }
     return out;
 }
-/** Typed notary/source-run locator: only runDirectory is a path. */
-function rewriteSourceRunLocator(value, rewrites) {
-    if (!isRecord(value))
-        return;
-    rewriteRunDirectoryPathFieldsAgainstRewrites(value, SOURCE_RUN_LOCATOR_FIELDS, rewrites);
-}
-/** Same-ticket summons materials: typed source-run; caller attach paths stay as-is (#1165). */
-function rewriteSummonsMaterials(value, rewrites) {
-    if (!isRecord(value))
-        return;
-    rewriteRunDirectoryPathFieldsAgainstRewrites(value, SUMMONS_PATH_FIELDS, rewrites);
-    rewriteSourceRunLocator(value.sourceRun, rewrites);
-    // #1165: summons.attachmentPaths are caller paths — do not rewrite.
-}
-/** Project one admitted page in memory after its containing run moved. */
-export function rewriteAdmittedRoleRunPage(page, rewrites) {
-    rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_FIELDS, rewrites);
-    rewriteSourceRunLocator(page.sourceRun, rewrites);
-    // #1165: admitted attachments are caller paths outside the run directory — do not rewrite.
-    if (isRecord(page.principal)) {
-        rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, PRINCIPAL_SESSION_PATH_FIELDS, rewrites);
-    }
-}
 /** Pre-#1161 `session/auditor-roles/<officer>.pointer.json` (migrator input only). */
 async function rewriteLegacyOfficerPointerFile(path, rewrites) {
     const page = JSON.parse(await readFile(path, "utf8"));
@@ -371,9 +261,9 @@ export async function rewriteRoleRunDurablePages(input) {
     // One rewriter per page kind; each keeps its own field list.
     const pageRewriters = {
         admitted: (page) => rewriteAdmittedRoleRunPage(page, rewrites),
-        invocation: (page) => rewriteRunDirectoryPathFieldsAgainstRewrites(page, INVOCATION_PAGE_FIELDS, rewrites),
+        invocation: (page) => rewriteRunDirectoryPathFieldsAgainstRewrites(page, INVOCATION_PAGE_PATH_FIELDS, rewrites),
         runState: (page) => {
-            rewriteRunDirectoryPathFieldsAgainstRewrites(page, RUN_STATE_PAGE_FIELDS, rewrites);
+            rewriteRunDirectoryPathFieldsAgainstRewrites(page, RUN_STATE_PAGE_PATH_FIELDS, rewrites);
             if (isRecord(page.principal)) {
                 rewriteRunDirectoryPathFieldsAgainstRewrites(page.principal, PRINCIPAL_SESSION_PATH_FIELDS, rewrites);
             }

package/dist/run-dossier.js

@@ -20,6 +20,7 @@ import { randomUUID } from "node:crypto";
 import { readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { sessionFileOf } from "./role-run-placement.js";
+import { projectRenderedPagePaths } from "./role-run-path-rewrite.js";
 import { RUN_CURRENT_FILE, RUN_HISTORY_FILE, RUN_LOG_FILE, RUN_STATE_FILE, OFFICER_POINTER_RECORD_KIND } from "./run-dossier-files.js";
 import { appendSitianRecord } from "./sitian-appender.js";
 import { parseSitianRecordText } from "./sitian-reader.js";
@@ -144,8 +145,16 @@ function render(runDirectory, history, state, log, unreadable) {
     const whole = {};
     for (const section of ["invocation", "admitted", "runState", "terminal"]) {
         const page = lastPayloadOfKind(state, PAGE_ROW_KIND[section]);
-        if (page !== undefined)
+        if (page === undefined)
+            continue;
+        // #1183: location fields track the directory being rendered; fact rows stay put.
+        if ((section === "invocation" || section === "admitted" || section === "runState")
+            && isRecord(page)) {
+            whole[section] = projectRenderedPagePaths(page, runDirectory);
+        }
+        else {
             whole[section] = page;
+        }
     }
     let latest;
     for (const row of history) {

package/dist/session-identity.js

@@ -16,6 +16,7 @@ export const HOST_SESSION_ID_RECORD_KIND = "host-session-id";
 export function createSessionIdentityAuthority(authority, hostName) {
     const runDirectoryOf = (principal) => dirname(authority.decode(principal).sessionDirectory);
     return {
+        principalAuthority: authority,
         resolveSessionFile(principal) {
             return authority.decode(principal).sessionFile;
         },

package/dist/submission-ledger.js

@@ -6,7 +6,9 @@ import { readSitianRecords, resolveSitianRecordPathInLedger, sitianReport } from
 import { findRunDirectoryById } from "./public-cli/run-lifecycle.js";
 import { isCorrectableExecuteError } from "./submission-correctable-error.js";
 import { failOnInfrastructureFailureDeclaration, infrastructureFailureDiagnostic } from "./package-contracts/terminating-infrastructure.js";
+import { reportTicketFromHostContext } from "./report-ticket-tool.js";
 import { REVIEW_SUBMISSION_OUTPUT_TOOL_NAME } from "./review-submission.js";
+import { readDeclaredTicketNumber } from "./run-ticket-number.js";
 import { isRecord, errorText } from "./unknown-value.js";
 /**
  * Admitted run identity for the ledger subject.
@@ -374,6 +376,15 @@ export function createSubmissionLedgerHost(host, outputTools, failInfrastructure
             host.registerTool({
                 ...tool,
                 async execute(toolCallId, params, signal, update, context) {
+                    // #1183: valid typed ticket on the submission is identity acquisition —
+                    // bind/relocate once here, before reask / ledger restore / seal outcomes.
+                    // Host return must not be the first placement (dossier-topology).
+                    const typedTicket = isRecord(params)
+                        ? readDeclaredTicketNumber(params.ticketNumber)
+                        : undefined;
+                    if (typedTicket !== undefined) {
+                        await reportTicketFromHostContext(context, typedTicket);
+                    }
                     const runId = runIdentity(context);
                     const attemptId = attemptIdentity(context, runId);
                     const state = await stateFor(context, runId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.5679",
+  "version": "0.1.5698",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/resources/navigator-route-playbook.md

@@ -1,13 +1,6 @@
-## 到场阶段（#1160 / ADR 0073）
+## 备答
 
-阶段行为说明住本手册。代码不写阶段句，也不把本手册再拼进用户消息。
-
-- **备答**：父衙门一开始即并行准备。自行判断当前进度——有票时读票卷宗里实际发生的角色运行，必要时看票面；不把过去建议或建议送达当作已经走过的站。按主衙门可能的结局 status 预写建议，经 `byStatus` 提交（键为 status 字面量，值为建议正文）。无状态分叉时可用单条 `prose`。
-- **取用**：父衙门交卷后，代码只按实际 status 取对应原文，不再起模型轮次。没有对应建议则如实无建议。主衙门结束后最多再等十秒；到时停止等待，不扣押主结果。
-
-## 宿主轴（与角色命令面）
-
-调用与 host 解析见 `ak-role help`、`ak-role help navigator`；机构边界见 [ADR 0082](https://github.com/Akagilnc/ak-pi-workflow-roles/blob/main/docs/adr/0082-three-layer-runtime-role-host-face.md)，席位解析见 [config 实现](../src/public-cli/config.ts)。
+父衙门一开始即并行准备。有票时读票卷宗里实际发生的角色运行，必要时看票面；不读过去的建议。按主衙门可能的结局 status 预写建议，经 `byStatus` 提交（键为 status 字面量，值为建议正文）。无状态分叉时可用单条 `prose`。
 
 ## 常用交付线
 
@@ -32,12 +25,9 @@ collector（收齐 current-head 材料）
   ├─ 有问题 → 修内司 → 大理寺
   └─ 收敛   → 调用者合并、关票
 
-既往大理寺收敛不替代其后新一轮线上材料的裁决；缺失 reviewer 腿只是 degraded coverage，不改变 collector 后到大理寺的接力。
-
 ## 未完交棒（unfinished）
 
 修内司 / 将作监 apply 以 unfinished 交棒时，工作仍未结清：
   → 续修（通常仍是同一 worker 的 apply），不要送大理寺
 
 refused / partially_completed 是已结清结算，送大理寺审计仍合法。
-unfinished 不是失败清理信号，也不豁免任何验收。

package/souls/navigator.md

@@ -1,7 +1,5 @@
 # Navigator Soul
 
-根据工作大小与控制性 authority，判断一条最低成本且安全的后续角色路线。保留必要的角色/phase顺序，避免重复站点；路线是建议，不是授权、执行或约束。
+按当前结算判断最低成本且安全的下一站：不跳必要站，不加多余站。只是建议，不授权、不执行。
 
-建议针对**当前角色刚完成的结算**之后的下一步。既有 settlement 历史是背景，不能用更早的收敛或收口替代本轮刚产出的材料/劳动；合并收口只在大理寺对本轮材料收敛之后才合适。
-
-当前 plan 阶段停用。
+一句话，20 字以内。plan 阶段停用。

package/src/acp-host/production-host.ts

@@ -42,6 +42,7 @@ function createComposedAcpRoleTurnHost(
       request,
       dependencies: config.roleRuntimeDependencies,
       sessionFile: config.sessionIdentity.resolveSessionFile(request.principal),
+      principalAuthority: config.sessionIdentity.principalAuthority,
       socketPath: config.socketPath?.(request) ?? `/tmp/ak-acp-mcp-${randomUUID()}.sock`,
     }),
   });

package/src/acp-host/role-turn-host.ts

@@ -382,7 +382,7 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
             // MCP advertises tool.parameters; prepared.jsonSchema is the headless
             // draft-07 stamp of that clone — record the delivered parameters face.
             const { $schema: _headlessStamp, ...deliveredSchema } = prepared.jsonSchema;
-            await recordTurnDelivery(await syncTurnRequestLivePlacement(request), {
+            await recordTurnDelivery(await syncTurnRequestLivePlacement(request, config.sessionIdentity.principalAuthority), {
               systemPrompt: systemPromptOverride,
               outputSchema: deliveredSchema,
             }, "acp-host");
@@ -503,7 +503,7 @@ export function createAcpRoleTurnHost(config: AcpRoleTurnHostConfig): RoleTurnHo
         outcome = { ...facts, ...(knownFailure === undefined ? {} : { knownFailure }) };
       }
       if (config.hostName !== "hermes" && sessionOpened && sessionId !== undefined) {
-        const live = await trySyncTurnRequestLivePlacement(request);
+        const live = await trySyncTurnRequestLivePlacement(request, config.sessionIdentity.principalAuthority);
         if ("runDirectory" in live) {
           try {
             copyAndRecordHostDossier({

package/src/external-host-turn-loop.ts

@@ -7,6 +7,7 @@ import { existsSync } from "node:fs";
 import { basename } from "node:path";
 
 import type {
+  DurablePrincipalAuthority,
   RoleTurnHost,
   RoleTurnKnownFailure,
   RoleTurnRequest,
@@ -46,10 +47,12 @@ export async function resolveLiveRunDirectoryPath(
 /**
  * Prefer the request path when it still exists; otherwise re-locate by run id
  * (resolveLiveRunDirectoryPath). Mutates the live request so later turn-record /
- * exit-copy / fault notes stay on the new leaf.
+ * exit-copy / fault notes stay on the new leaf. Authority is required so opaque
+ * principal wire is resealed — never shape-guessed in place (#1183).
  */
 export async function syncTurnRequestLivePlacement(
   request: RoleTurnRequest,
+  authority: DurablePrincipalAuthority,
 ): Promise<string> {
   const live = await resolveLiveRunDirectoryPath(request.runDirectory, request.home);
   if (live === undefined) {
@@ -59,13 +62,7 @@ export async function syncTurnRequestLivePlacement(
     );
   }
   if (live !== request.runDirectory) {
-    projectTurnRequestLiveRunDirectory(
-      request as {
-        runDirectory: string;
-        principal: { sessionDirectory?: string; sessionFile?: string };
-      },
-      live,
-    );
+    projectTurnRequestLiveRunDirectory(request, live, authority);
   }
   return live;
 }
@@ -76,37 +73,54 @@ export async function syncTurnRequestLivePlacement(
  */
 export async function trySyncTurnRequestLivePlacement(
   request: RoleTurnRequest,
+  authority: DurablePrincipalAuthority,
 ): Promise<{ readonly runDirectory: string } | { readonly resolveError: unknown }> {
   try {
-    return { runDirectory: await syncTurnRequestLivePlacement(request) };
+    return { runDirectory: await syncTurnRequestLivePlacement(request, authority) };
   } catch (resolveError) {
     return { resolveError };
   }
 }
 
 /**
- * Retain a package fault on the live leaf when locatable. Lookup failure must not
- * replace the original fault or block later cleanup — reuse retainPackageFault when
- * the leaf exists; otherwise present both causes on stderr (Pi transport path shape).
+ * Retain a package fault on the live leaf when locatable. Directory lookup only —
+ * does not mutate live principal identity (#1183). Lookup failure must not replace
+ * the original fault or block later cleanup.
  */
 export async function retainPackageFaultBesideLivePlacement(
   request: RoleTurnRequest,
   input: { readonly diagnostic: string; readonly error?: unknown },
 ): Promise<void> {
-  const live = await trySyncTurnRequestLivePlacement(request);
-  if ("resolveError" in live) {
-    const resolveDiagnostic =
-      `live run path resolve failed beside fault: ${describeErrorIdentity(live.resolveError)}`;
+  let runDirectory = request.runDirectory;
+  if (!existsSync(runDirectory)) {
     try {
-      process.stderr.write(`${input.diagnostic}\n`);
-      process.stderr.write(`${resolveDiagnostic}\n`);
-    } catch {
-      // Best-effort presentation beside an already-chosen terminal.
+      const found = await resolveLiveRunDirectoryPath(request.runDirectory, request.home);
+      if (found === undefined) {
+        const resolveDiagnostic =
+          `live run path resolve failed beside fault: admitted run missing under ${request.home}`;
+        try {
+          process.stderr.write(`${input.diagnostic}\n`);
+          process.stderr.write(`${resolveDiagnostic}\n`);
+        } catch {
+          // Best-effort presentation beside an already-chosen terminal.
+        }
+        return;
+      }
+      runDirectory = found;
+    } catch (resolveError) {
+      const resolveDiagnostic =
+        `live run path resolve failed beside fault: ${describeErrorIdentity(resolveError)}`;
+      try {
+        process.stderr.write(`${input.diagnostic}\n`);
+        process.stderr.write(`${resolveDiagnostic}\n`);
+      } catch {
+        // Best-effort presentation beside an already-chosen terminal.
+      }
+      return;
     }
-    return;
   }
   await retainPackageFault({
-    runDirectory: live.runDirectory,
+    runDirectory,
     diagnostic: input.diagnostic,
     ...(Object.hasOwn(input, "error") ? { error: input.error } : {}),
   });

package/src/headless-host/production-host.ts

@@ -54,6 +54,7 @@ export function createProductionHeadlessRoleTurnHost(
           request,
           dependencies: roleRuntimeDependencies,
           sessionFile: sessionIdentity.resolveSessionFile(request.principal),
+          principalAuthority,
           // Same MCP relay as ACP so intermediate AK tools stay reachable;
           // headless adapter projects the row into --mcp-config.
           socketPath: `/tmp/ak-headless-mcp-${randomUUID()}.sock`,

package/src/headless-host/role-turn-host.ts

@@ -564,7 +564,7 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
           }
 
           // What this CLI start was given: one history record per start.
-          await recordTurnDelivery(await syncTurnRequestLivePlacement(request), {
+          await recordTurnDelivery(await syncTurnRequestLivePlacement(request, config.sessionIdentity.principalAuthority), {
             systemPrompt,
             ...(startedWithSchema === undefined ? {} : { outputSchema: startedWithSchema }),
           }, "headless-host");
@@ -748,7 +748,7 @@ export function createHeadlessRoleTurnHost(config: HeadlessRoleTurnHostConfig):
       } finally {
         // Cleanup must not depend on live-path sync: lookup failure stays beside
         // the original cleanup/copy work and never skips rm(inputsDirectory).
-        const live = await trySyncTurnRequestLivePlacement(request);
+        const live = await trySyncTurnRequestLivePlacement(request, config.sessionIdentity.principalAuthority);
         const liveRunDirectory = "runDirectory" in live ? live.runDirectory : undefined;
         if (liveRunDirectory === undefined && "resolveError" in live) {
           await retainPackageFaultBesideLivePlacement(request, {

package/src/pi/role-turn-host.ts

@@ -500,7 +500,7 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
       // bind projects host.sessions; copy records the landing. Host adapters do
       // not write current.json — public bind/settlement seams own that render.
       try {
-        await syncTurnRequestLivePlacement(request);
+        await syncTurnRequestLivePlacement(request, config.principalAuthority);
         const { sessionFile, sessionDirectory } = config.principalAuthority.decode(request.principal);
         const sessionId = await readPiSessionHeaderId(sessionFile);
         if (sessionId !== undefined) {

package/src/prepared-role-turn.ts

@@ -75,4 +75,6 @@ export type SessionIdentityAuthority = Readonly<{
   bind(principal: RoleTurnRequest["principal"], sessionId: string): Promise<void>;
   /** Durable principal session path for layout ownership — not a rebuild source (#617 DK-4). */
   resolveSessionFile(principal: RoleTurnRequest["principal"]): string;
+  /** Host authority that sealed the principal — mid-turn relocate reseals through it (#1183). */
+  readonly principalAuthority: import("./host-contracts.ts").DurablePrincipalAuthority;
 }>;