@akagilnc/pi-workflow-roles 0.1.5679 → 0.1.5698

package/src/report-ticket-tool.ts

@@ -20,6 +20,7 @@ import {
   type AdmittedRoleInvocation,
 } from "./public-cli/invocation.ts";
 import { isUnboundRunDirectory, sessionDirectoryOf, sessionFileOf } from "./role-run-placement.ts";
+import { rewriteRunDirectoryPathValue } from "./role-run-path-rewrite.ts";
 import { readPageSync } from "./run-dossier.ts";
 import { readDeclaredTicketNumber } from "./run-ticket-number.ts";
 import { isRecord } from "./unknown-value.ts";
@@ -128,6 +129,11 @@ export async function reportTicketFromHostContext(
   // Live handles belong with rename ownership — before derived renderCurrentSync
   // (#1171 F4-R2). Reuse relocate's heldLease.relocate seam; keep raw I/O throw.
   const applyLiveHandles = (nextDirectory: string): void => {
+    // Capture live session handle before ownership transfer. After relocate the
+    // write handle must share host-authority coords with the principal (#1183):
+    // project the prior path onto the new leaf — never rebuild default
+    // session.jsonl over a non-default seal (and do not trust a setter rebuild).
+    const priorSessionFile = context.sessionManager.getSessionFile?.();
     (context as { runDirectory?: string }).runDirectory = nextDirectory;
     // Same-leg spawn env only (#1171 F1): never overwrite another leg's ambient
     // AK_ROLE_RUN_DIR in a shared process. HostContext is the per-turn authority
@@ -135,8 +141,12 @@ export async function reportTicketFromHostContext(
     if (process.env.AK_ROLE_RUN_DIR === runDirectory) {
       process.env.AK_ROLE_RUN_DIR = nextDirectory;
     }
-    // Native host rebind only — SessionManager has no setSessionDir; appends follow sessionFile.
-    context.sessionManager.setSessionFile?.(sessionFileOf(nextDirectory));
+    const projectedSessionFile = typeof priorSessionFile === "string" && priorSessionFile.trim() !== ""
+      ? rewriteRunDirectoryPathValue(priorSessionFile, runDirectory, nextDirectory)
+      : sessionFileOf(nextDirectory);
+    if (typeof projectedSessionFile === "string") {
+      context.sessionManager.setSessionFile?.(projectedSessionFile);
+    }
   };
   const relocation = alreadyPlaced
     ? undefined

package/src/role-envelope.ts

@@ -3,7 +3,7 @@ import { appendFile, mkdir, writeFile } from "node:fs/promises";
 import { createServer, type Server, type Socket } from "node:net";
 import { dirname } from "node:path";
 
-import { sessionDirectoryOf, sessionFileOf } from "./role-run-placement.ts";
+import { sessionFileOf } from "./role-run-placement.ts";
 import { fileURLToPath } from "node:url";
 
 import {
@@ -94,6 +94,12 @@ export async function prepareRoleEnvelope(options: {
    * Tests may omit → runDirectory default.
    */
   readonly sessionFile?: string;
+  /**
+   * Host authority that sealed request.principal. Required for mid-turn run
+   * relocate to reseal opaque principal wire (#1183); absent throws on relocate
+   * rather than mutating opaque principal or inventing a host-specific bypass.
+   */
+  readonly principalAuthority?: import("./host-contracts.ts").DurablePrincipalAuthority;
 }): Promise<PreparedRoleTurn> {
   const { request } = options;
   if (options.socketPath === "") {
@@ -170,8 +176,9 @@ export async function prepareRoleEnvelope(options: {
   };
   const mutableRequest = request as {
     runDirectory: string;
-    principal: { sessionDirectory?: string; sessionFile?: string };
+    principal: import("./host-contracts.ts").DurablePrincipal;
   };
+  const principalAuthority = options.principalAuthority;
   const context: HostContext = {
     cwd: request.cwd,
     mode: "print",
@@ -199,8 +206,9 @@ export async function prepareRoleEnvelope(options: {
       // and non-correctable MCP catch). Submission does not abort the turn.
     },
   };
-  // #1171: report-ticket updates HostContext.runDirectory; keep the shared turn
-  // request (and principal session paths) on the same leaf for adapter exit-copy.
+  // #1171 / #1183: report-ticket updates HostContext.runDirectory; reseal principal
+  // through host authority when provided. Never assign Pi session fields onto
+  // opaque/frozen principal wire (DurablePrincipal / #636).
   Object.defineProperty(context, "runDirectory", {
     configurable: true,
     enumerable: true,
@@ -210,14 +218,15 @@ export async function prepareRoleEnvelope(options: {
     set(next: string) {
       if (typeof next !== "string" || next.trim() === "") return;
       if (mutableRequest.runDirectory === next) return;
-      projectTurnRequestLiveRunDirectory(mutableRequest, next);
-      sessionFile = sessionFileOf(next);
-      if (typeof mutableRequest.principal.sessionDirectory !== "string") {
-        mutableRequest.principal.sessionDirectory = sessionDirectoryOf(next);
-      }
-      if (typeof mutableRequest.principal.sessionFile !== "string") {
-        mutableRequest.principal.sessionFile = sessionFile;
+      if (principalAuthority === undefined) {
+        throw new Error(
+          "mid-turn run relocate requires principalAuthority on prepareRoleEnvelope",
+        );
       }
+      projectTurnRequestLiveRunDirectory(mutableRequest, next, principalAuthority);
+      // Live write handle = same host-authority coords as the resealed principal
+      // (#1183). Never rebuild default session.jsonl over a non-default seal.
+      sessionFile = principalAuthority.decode(mutableRequest.principal).sessionFile;
     },
   });
   const bookCustomMessage = (customType: string, message: { content?: string; details?: unknown }): void => {

package/src/role-run-path-rewrite.ts

@@ -0,0 +1,238 @@
+/**
+ * Sole pure authority for typed run-directory path rewrite / projection.
+ * No dossier I/O — run-dossier render and role-run-relocation durable walks
+ * both consume this module (avoids a cycle through page readers).
+ *
+ * Scope is typed machine-consumed path fields only — never free text, never
+ * caller file-flag path strings.
+ */
+import { sep } from "node:path";
+
+import type {
+  DurablePrincipal,
+  DurablePrincipalAuthority,
+} from "./host-contracts.ts";
+import { isRecord } from "./unknown-value.ts";
+
+export const ADMITTED_PAGE_PATH_FIELDS = [
+  "runDirectory",
+  "admittedRequestPath", // pre-#1161 pages only
+  "sessionDirectory",
+  "sessionFile",
+  // #1165/#1168: caller file-flag paths stay as given.
+  "mergerInputPath",
+  "sourceRunPath",
+] as const;
+
+export const INVOCATION_PAGE_PATH_FIELDS = [
+  "runDirectory",
+  "sessionDirectory",
+  "sessionFile",
+] as const;
+
+export const RUN_STATE_PAGE_PATH_FIELDS = [
+  "runDirectory",
+  "admittedRequestPath", // pre-#1161 pages only
+  "sessionDirectory",
+  "sessionFile",
+] as const;
+
+/** Typed principal session coordinates rewritten when the owning run leaf moves. */
+export const PRINCIPAL_SESSION_PATH_FIELDS = [
+  "sessionDirectory",
+  "sessionFile",
+] as const;
+
+const SOURCE_RUN_LOCATOR_FIELDS = ["runDirectory"] as const;
+const SUMMONS_PATH_FIELDS = ["sourceRunPath"] as const;
+
+export type RunDirectoryPathRewrite = {
+  readonly oldRunDirectory: string;
+  readonly newRunDirectory: string;
+};
+
+/** Rewrite one path value that points at or under oldRunDirectory. */
+export function rewriteRunDirectoryPathValue(
+  value: unknown,
+  oldRunDirectory: string,
+  newRunDirectory: string,
+): unknown {
+  if (typeof value !== "string") return value;
+  if (value === oldRunDirectory) return newRunDirectory;
+  const prefix = `${oldRunDirectory}${sep}`;
+  if (value.startsWith(prefix)) {
+    return `${newRunDirectory}${value.slice(oldRunDirectory.length)}`;
+  }
+  return value;
+}
+
+/**
+ * Apply the longest matching oldRunDirectory rewrite. Longer keys win so a
+ * nested run path is not partially claimed by a shorter sibling prefix.
+ */
+export function rewriteRunDirectoryPathValueAgainstRewrites(
+  value: unknown,
+  rewrites: readonly RunDirectoryPathRewrite[],
+): unknown {
+  if (typeof value !== "string" || rewrites.length === 0) return value;
+  let best: RunDirectoryPathRewrite | undefined;
+  for (const rewrite of rewrites) {
+    if (
+      value === rewrite.oldRunDirectory ||
+      value.startsWith(`${rewrite.oldRunDirectory}${sep}`)
+    ) {
+      if (
+        best === undefined ||
+        rewrite.oldRunDirectory.length > best.oldRunDirectory.length
+      ) {
+        best = rewrite;
+      }
+    }
+  }
+  if (best === undefined) return value;
+  return rewriteRunDirectoryPathValue(
+    value,
+    best.oldRunDirectory,
+    best.newRunDirectory,
+  );
+}
+
+/** In-place rewrite of selected fields on one record (single pair). */
+export function rewriteRunDirectoryPathFields(
+  record: Record<string, unknown>,
+  fields: readonly string[],
+  oldRunDirectory: string,
+  newRunDirectory: string,
+): void {
+  rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, [
+    { oldRunDirectory, newRunDirectory },
+  ]);
+}
+
+/** In-place rewrite of selected fields against a rewrite set. */
+export function rewriteRunDirectoryPathFieldsAgainstRewrites(
+  record: Record<string, unknown>,
+  fields: readonly string[],
+  rewrites: readonly RunDirectoryPathRewrite[],
+): void {
+  for (const field of fields) {
+    if (field in record) {
+      record[field] = rewriteRunDirectoryPathValueAgainstRewrites(
+        record[field],
+        rewrites,
+      );
+    }
+  }
+}
+
+/** Principal session paths only — shared live + durable projection after a run move. */
+export function rewritePrincipalSessionPaths(
+  principal: Record<string, unknown>,
+  oldRunDirectory: string,
+  newRunDirectory: string,
+): void {
+  rewriteRunDirectoryPathFields(
+    principal,
+    PRINCIPAL_SESSION_PATH_FIELDS,
+    oldRunDirectory,
+    newRunDirectory,
+  );
+}
+
+/**
+ * Live turn request: move runDirectory and keep principal session paths on the
+ * new leaf. Sole path = host authority decode → rewrite coords copy → seal
+ * (#1183 / #636). No shape-based in-place rewrite and no silent skip.
+ */
+export function projectTurnRequestLiveRunDirectory(
+  request: {
+    runDirectory: string;
+    principal: DurablePrincipal;
+  },
+  newRunDirectory: string,
+  authority: DurablePrincipalAuthority,
+): void {
+  const old = request.runDirectory;
+  if (old === newRunDirectory) return;
+  const coords = { ...authority.decode(request.principal) };
+  rewritePrincipalSessionPaths(
+    coords as Record<string, unknown>,
+    old,
+    newRunDirectory,
+  );
+  const sealed = authority.seal(coords);
+  request.runDirectory = newRunDirectory;
+  (request as { principal: DurablePrincipal }).principal = sealed;
+}
+
+/** Typed notary/source-run locator: only runDirectory is a path. */
+export function rewriteSourceRunLocator(
+  value: unknown,
+  rewrites: readonly RunDirectoryPathRewrite[],
+): void {
+  if (!isRecord(value)) return;
+  rewriteRunDirectoryPathFieldsAgainstRewrites(
+    value,
+    SOURCE_RUN_LOCATOR_FIELDS,
+    rewrites,
+  );
+}
+
+/** Same-ticket summons materials: typed source-run; caller attach paths stay as-is (#1165). */
+export function rewriteSummonsMaterials(
+  value: unknown,
+  rewrites: readonly RunDirectoryPathRewrite[],
+): void {
+  if (!isRecord(value)) return;
+  rewriteRunDirectoryPathFieldsAgainstRewrites(
+    value,
+    SUMMONS_PATH_FIELDS,
+    rewrites,
+  );
+  rewriteSourceRunLocator(value.sourceRun, rewrites);
+  // #1165: summons.attachmentPaths are caller paths — do not rewrite.
+}
+
+/** Project one admitted page in memory after its containing run moved. */
+export function rewriteAdmittedRoleRunPage(
+  page: Record<string, unknown>,
+  rewrites: readonly RunDirectoryPathRewrite[],
+): void {
+  rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_PATH_FIELDS, rewrites);
+  rewriteSourceRunLocator(page.sourceRun, rewrites);
+  // #1165: admitted attachments are caller paths outside the run directory — do not rewrite.
+  if (isRecord(page.principal)) {
+    rewriteRunDirectoryPathFieldsAgainstRewrites(
+      page.principal,
+      PRINCIPAL_SESSION_PATH_FIELDS,
+      rewrites,
+    );
+  }
+}
+
+/**
+ * #1183: current.json location fields follow the directory being rendered.
+ * Fact rows stay as written (append-only); only the rendering projects stored→actual.
+ * Returns the same object when already aligned. Caller file-flag paths stay opaque.
+ */
+export function projectRenderedPagePaths(
+  page: Record<string, unknown>,
+  actualRunDirectory: string,
+): Record<string, unknown> {
+  const stored =
+    typeof page.runDirectory === "string" && page.runDirectory.trim() !== ""
+      ? page.runDirectory
+      : undefined;
+  if (stored === undefined || stored === actualRunDirectory) return page;
+  const projected = structuredClone(page);
+  const rewrites: readonly RunDirectoryPathRewrite[] = [
+    { oldRunDirectory: stored, newRunDirectory: actualRunDirectory },
+  ];
+  // Admitted field set is the location-field superset of invocation; runState adds
+  // principal (covered) and optional currentCourt summons under this run.
+  rewriteAdmittedRoleRunPage(projected, rewrites);
+  if (isRecord(projected.currentCourt)) {
+    rewriteSummonsMaterials(projected.currentCourt.summons, rewrites);
+  }
+  return projected;
+}

package/src/role-run-relocation.ts

@@ -1,81 +1,54 @@
 /**
- * Single authority for rewriting durable run pages after a run directory moves.
- * Live callers project typed fields; only historical migrators walk durable pages.
+ * Durable run-page path rewrite after a run directory moves, plus retained-path
+ * matching for live lookup. Pure path rewrite rules live in role-run-path-rewrite.ts
+ * (sole authority); this module owns I/O walks that need dossier page readers.
  *
  * Scope is typed machine-consumed path fields only — never free text, never
  * caller file-flag path strings. Nested walk is confined to package-owned
  * `session/` seams.
  */
 import { readdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, join, sep } from "node:path";
+import { dirname, join } from "node:path";
 
 import { activationBookDirectory, physicalPathIdentity } from "./activation-ledger-topology.ts";
+import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.ts";
 import { readRoleRunIdentity } from "./public-cli/run-lifecycle.ts";
 import { findRoleRunDirectory, roleRunPlacement } from "./role-run-placement.ts";
-
-import { AUDITOR_PARENT_ATTEMPT_BINDING_ENTRY_TYPE } from "./compliance-transport.ts";
-
+import {
+  INVOCATION_PAGE_PATH_FIELDS,
+  PRINCIPAL_SESSION_PATH_FIELDS,
+  RUN_STATE_PAGE_PATH_FIELDS,
+  type RunDirectoryPathRewrite,
+  projectTurnRequestLiveRunDirectory,
+  rewriteAdmittedRoleRunPage,
+  rewritePrincipalSessionPaths,
+  rewriteRunDirectoryPathFields,
+  rewriteRunDirectoryPathFieldsAgainstRewrites,
+  rewriteRunDirectoryPathValue,
+  rewriteRunDirectoryPathValueAgainstRewrites,
+  rewriteSummonsMaterials,
+} from "./role-run-path-rewrite.ts";
 import { readPageSync, updateSectionSync } from "./run-dossier.ts";
-import { isRecord, isEnoent } from "./unknown-value.ts";
-
-const ADMITTED_PAGE_FIELDS = [
-  "runDirectory",
-  "admittedRequestPath", // pre-#1161 pages only
-  "sessionDirectory",
-  "sessionFile",
-  // #1165/#1168: caller file-flag paths (requestManifestPath, prerequisitesPath)
-  // stay as given. Obsolete copy fields (taskPath/packetPath) are not rewritten —
-  // stock volumes keep their bytes; live relocate no longer maintains them.
-  "mergerInputPath",
-  "sourceRunPath",
-] as const;
-
-const INVOCATION_PAGE_FIELDS = [
-  "runDirectory",
-  "sessionDirectory",
-  "sessionFile",
-] as const;
-
-const RUN_STATE_PAGE_FIELDS = [
-  "runDirectory",
-  "admittedRequestPath", // pre-#1161 pages only
-  "sessionDirectory",
-  "sessionFile",
-] as const;
+import { isEnoent, isRecord } from "./unknown-value.ts";
 
-/** Typed principal session coordinates rewritten when the owning run leaf moves. */
-export const PRINCIPAL_SESSION_PATH_FIELDS = [
-  "sessionDirectory",
-  "sessionFile",
-] as const;
+// Re-export the pure path API so existing import sites stay on this module path.
+export {
+  PRINCIPAL_SESSION_PATH_FIELDS,
+  type RunDirectoryPathRewrite,
+  projectTurnRequestLiveRunDirectory,
+  rewriteAdmittedRoleRunPage,
+  rewritePrincipalSessionPaths,
+  rewriteRunDirectoryPathFields,
+  rewriteRunDirectoryPathFieldsAgainstRewrites,
+  rewriteRunDirectoryPathValue,
+  rewriteRunDirectoryPathValueAgainstRewrites,
+} from "./role-run-path-rewrite.ts";
 
-const SOURCE_RUN_LOCATOR_FIELDS = ["runDirectory"] as const;
-const SUMMONS_PATH_FIELDS = ["sourceRunPath"] as const;
 const OFFICER_POINTER_FIELDS = ["sessionFile", "runDirectory"] as const;
 const SITIAN_RECORD_FIELDS = ["sessionParent"] as const;
 const SESSION_HEADER_FIELDS = ["parentSession"] as const;
 const BINDING_PARENT_FIELDS = ["sessionFile"] as const;
 
-export type RunDirectoryPathRewrite = {
-  readonly oldRunDirectory: string;
-  readonly newRunDirectory: string;
-};
-
-/** Rewrite one path value that points at or under oldRunDirectory. */
-export function rewriteRunDirectoryPathValue(
-  value: unknown,
-  oldRunDirectory: string,
-  newRunDirectory: string,
-): unknown {
-  if (typeof value !== "string") return value;
-  if (value === oldRunDirectory) return newRunDirectory;
-  const prefix = `${oldRunDirectory}${sep}`;
-  if (value.startsWith(prefix)) {
-    return `${newRunDirectory}${value.slice(oldRunDirectory.length)}`;
-  }
-  return value;
-}
-
 /** Match physical aliases or a normal unbound→ticket bind, never historical migration layouts. */
 export async function retainedRunPathsMatch(
   recordedPath: unknown,
@@ -109,100 +82,6 @@ export async function retainedRunPathsMatch(
   return false;
 }
 
-/**
- * Apply the longest matching oldRunDirectory rewrite. Longer keys win so a
- * nested run path is not partially claimed by a shorter sibling prefix.
- */
-export function rewriteRunDirectoryPathValueAgainstRewrites(
-  value: unknown,
-  rewrites: readonly RunDirectoryPathRewrite[],
-): unknown {
-  if (typeof value !== "string" || rewrites.length === 0) return value;
-  let best: RunDirectoryPathRewrite | undefined;
-  for (const rewrite of rewrites) {
-    if (
-      value === rewrite.oldRunDirectory ||
-      value.startsWith(`${rewrite.oldRunDirectory}${sep}`)
-    ) {
-      if (
-        best === undefined ||
-        rewrite.oldRunDirectory.length > best.oldRunDirectory.length
-      ) {
-        best = rewrite;
-      }
-    }
-  }
-  if (best === undefined) return value;
-  return rewriteRunDirectoryPathValue(
-    value,
-    best.oldRunDirectory,
-    best.newRunDirectory,
-  );
-}
-
-/** In-place rewrite of selected fields on one record (single pair). */
-export function rewriteRunDirectoryPathFields(
-  record: Record<string, unknown>,
-  fields: readonly string[],
-  oldRunDirectory: string,
-  newRunDirectory: string,
-): void {
-  rewriteRunDirectoryPathFieldsAgainstRewrites(record, fields, [
-    { oldRunDirectory, newRunDirectory },
-  ]);
-}
-
-/** Principal session paths only — shared live + durable projection after a run move. */
-export function rewritePrincipalSessionPaths(
-  principal: Record<string, unknown>,
-  oldRunDirectory: string,
-  newRunDirectory: string,
-): void {
-  rewriteRunDirectoryPathFields(
-    principal,
-    PRINCIPAL_SESSION_PATH_FIELDS,
-    oldRunDirectory,
-    newRunDirectory,
-  );
-}
-
-/**
- * Live turn request: move runDirectory and rewrite principal session paths in place.
- * Callers that lack authority.seal use this; admitted refresh seals after the same rewrite.
- */
-export function projectTurnRequestLiveRunDirectory(
-  request: {
-    runDirectory: string;
-    principal: { sessionDirectory?: string; sessionFile?: string };
-  },
-  newRunDirectory: string,
-): void {
-  const old = request.runDirectory;
-  if (old === newRunDirectory) return;
-  request.runDirectory = newRunDirectory;
-  rewritePrincipalSessionPaths(
-    request.principal as Record<string, unknown>,
-    old,
-    newRunDirectory,
-  );
-}
-
-/** In-place rewrite of selected fields against a rewrite set. */
-export function rewriteRunDirectoryPathFieldsAgainstRewrites(
-  record: Record<string, unknown>,
-  fields: readonly string[],
-  rewrites: readonly RunDirectoryPathRewrite[],
-): void {
-  for (const field of fields) {
-    if (field in record) {
-      record[field] = rewriteRunDirectoryPathValueAgainstRewrites(
-        record[field],
-        rewrites,
-      );
-    }
-  }
-}
-
 function collectRewrites(input: {
   readonly oldRunDirectory: string;
   readonly newRunDirectory: string;
@@ -229,51 +108,6 @@ function collectRewrites(input: {
   return out;
 }
 
-/** Typed notary/source-run locator: only runDirectory is a path. */
-function rewriteSourceRunLocator(
-  value: unknown,
-  rewrites: readonly RunDirectoryPathRewrite[],
-): void {
-  if (!isRecord(value)) return;
-  rewriteRunDirectoryPathFieldsAgainstRewrites(
-    value,
-    SOURCE_RUN_LOCATOR_FIELDS,
-    rewrites,
-  );
-}
-
-/** Same-ticket summons materials: typed source-run; caller attach paths stay as-is (#1165). */
-function rewriteSummonsMaterials(
-  value: unknown,
-  rewrites: readonly RunDirectoryPathRewrite[],
-): void {
-  if (!isRecord(value)) return;
-  rewriteRunDirectoryPathFieldsAgainstRewrites(
-    value,
-    SUMMONS_PATH_FIELDS,
-    rewrites,
-  );
-  rewriteSourceRunLocator(value.sourceRun, rewrites);
-  // #1165: summons.attachmentPaths are caller paths — do not rewrite.
-}
-
-/** Project one admitted page in memory after its containing run moved. */
-export function rewriteAdmittedRoleRunPage(
-  page: Record<string, unknown>,
-  rewrites: readonly RunDirectoryPathRewrite[],
-): void {
-  rewriteRunDirectoryPathFieldsAgainstRewrites(page, ADMITTED_PAGE_FIELDS, rewrites);
-  rewriteSourceRunLocator(page.sourceRun, rewrites);
-  // #1165: admitted attachments are caller paths outside the run directory — do not rewrite.
-  if (isRecord(page.principal)) {
-    rewriteRunDirectoryPathFieldsAgainstRewrites(
-      page.principal,
-      PRINCIPAL_SESSION_PATH_FIELDS,
-      rewrites,
-    );
-  }
-}
-
 /** Pre-#1161 `session/auditor-roles/<officer>.pointer.json` (migrator input only). */
 async function rewriteLegacyOfficerPointerFile(
   path: string,
@@ -482,9 +316,9 @@ export async function rewriteRoleRunDurablePages(input: {
   const pageRewriters: Readonly<Record<"admitted" | "invocation" | "runState", (page: Record<string, unknown>) => void>> = {
     admitted: (page) => rewriteAdmittedRoleRunPage(page, rewrites),
     invocation: (page) =>
-      rewriteRunDirectoryPathFieldsAgainstRewrites(page, INVOCATION_PAGE_FIELDS, rewrites),
+      rewriteRunDirectoryPathFieldsAgainstRewrites(page, INVOCATION_PAGE_PATH_FIELDS, rewrites),
     runState: (page) => {
-      rewriteRunDirectoryPathFieldsAgainstRewrites(page, RUN_STATE_PAGE_FIELDS, rewrites);
+      rewriteRunDirectoryPathFieldsAgainstRewrites(page, RUN_STATE_PAGE_PATH_FIELDS, rewrites);
       if (isRecord(page.principal)) {
         rewriteRunDirectoryPathFieldsAgainstRewrites(
           page.principal,

package/src/role-runtime.ts

@@ -16,12 +16,19 @@ import { sitianReport } from "./sitian-facade.ts";
 import { sitianReportSafe } from "./host-session-record.ts";
 import { createSubmissionLedgerHost, sealAcceptedSubmission } from "./submission-ledger.ts";
 import { registerFiledSubmissionTool, type FiledSubmissionBeforeAccept } from "./filed-submission.ts";
-import { registerReportTicketTool, REPORT_TICKET_TOOL_NAME } from "./report-ticket-tool.ts";
+import {
+  registerReportTicketTool,
+  reportTicketFromHostContext,
+  REPORT_TICKET_TOOL_NAME,
+} from "./report-ticket-tool.ts";
 import type { RoleSubmissionDeclaration } from "./role-submission-declarations.ts";
 
 import { activationTraceRecordSchema, namedActivationCause, type ActivationTraceRecord, type ActivationTraceWriter } from "./activation-trace.ts";
 import { homeFromRunDirectory } from "./activation-ledger-topology.ts";
-import { isSafePositiveTicketNumber, parseTicketNumber } from "./run-ticket-number.ts";
+import {
+  isSafePositiveTicketNumber,
+  parseTicketNumber,
+} from "./run-ticket-number.ts";
 import {
   durableSessionPointer,
   resolveBookKeyFromGit,
@@ -859,11 +866,17 @@ export function createDiaristRoleRuntime(
         const status = submitted?.status;
         if (status !== "completed") return parameters;
         const assertion = readDiaristTicketAssertion(submitted);
-        const coords = readDiaristRunCoordinates(ctx);
         // #836 7.3: pre-bound ticket is material for the LLM, not an override.
         const ticketNumber = assertion.kind === "ticket" ? assertion.ticketNumber : undefined;
-        // The ticket binds in the public call's own process after the turn, from the sealed
-        // ticketNumber (settlement seam); this leg never writes the run's current.json.
+        // #1183: typed ticket assertion is identity acquisition — one mid-turn
+        // bind/relocate here, before seal / reask / infra outcome branches.
+        // Reuses ak_report_ticket seam; already-placed is a no-op. Host return
+        // must not be the first placement (dossier-topology).
+        if (ticketNumber !== undefined) {
+          await reportTicketFromHostContext(ctx, ticketNumber);
+        }
+        // Live leaf after possible relocate (commit reads history under runDirectory).
+        const coords = readDiaristRunCoordinates(ctx);
         // Strict-schema hosts emit ticketSessions: null for a single ticket.
         const multiTicket = submitted?.ticketSessions != null;
         const singleSessions = submitted && !multiTicket
@@ -1145,13 +1158,17 @@ export function createRoleRuntimeExtension(
       await pending;
       return pendingNavigatorPresentation?.event;
     };
-    projectClosedSubmission = async (closed, context) => projectClosedSubmissionLifecycle(
-      closed,
-      context,
-      navigatorPhase(roleHost, closed.role),
-      () => receiptDelivery.recordAccepted(),
-      settleNavigatorProjection,
-    );
+    projectClosedSubmission = async (closed, context) => {
+      // #1183: typed ticket identity is acquired on the ledger seam when params
+      // are first read — not here after seal. Closure only projects lifecycle.
+      await projectClosedSubmissionLifecycle(
+        closed,
+        context,
+        navigatorPhase(roleHost, closed.role),
+        () => receiptDelivery.recordAccepted(),
+        settleNavigatorProjection,
+      );
+    };
     roleHost.on("input", (_event) => {
       const role = roleHost.getFlag(ROLE_FLAG.name);
       if (role !== undefined && !admitted) return { action: "handled" as const };