@principles/pd-cli 1.133.0 → 1.135.0

package/tests/commands/runtime-activation.test.ts

@@ -1,14 +1,31 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
+const mockRuleHostWriterConfigs = vi.hoisted(() => [] as Array<{ featureFlagProbe?: (flagId: string) => boolean }>);
+const mockFeatureFlags = vi.hoisted(() => ({
+  flags: { rulecode_context_v2: { id: 'rulecode_context_v2', category: 'quiet' as const, enabled: true, since: '2026-06-27', description: 'test' } },
+}));
+
 const mockGetArtifactById = vi.fn();
 const mockClose = vi.fn().mockResolvedValue(undefined);
 const mockApprovalEdit = vi.fn();
 const mockApprovalGetById = vi.fn();
+const mockApprovalApprove = vi.fn();
+const mockApprovalResetToPending = vi.fn();
+const mockCompletionComplete = vi.fn();
+const mockPromoteActivation = vi.fn().mockResolvedValue(true);
+const mockListCodeToolHookActivations = vi.fn().mockResolvedValue([
+  { activationId: 'act-hook-1', artifactId: 'art-002', channel: 'code_tool_hook', action: 'code_tool_hook_shadow_activate', targetRef: 'rule-001', activatedAt: '2026-06-18T00:00:00.000Z', promotedAt: null, deactivatedAt: null },
+]);
 
 vi.mock('../../src/resolve-workspace.js', () => ({
   resolveWorkspaceDir: vi.fn().mockReturnValue('/fake/workspace'),
 }));
 
+vi.mock('../../src/services/pd-config-loader.js', () => ({
+  loadPdConfig: vi.fn().mockReturnValue({ ok: true, effective: {} }),
+  computeFlagsFromLoadResult: vi.fn().mockReturnValue(mockFeatureFlags),
+}));
+
 vi.mock('@principles/core/runtime-v2', async (importOriginal) => {
   const original = await importOriginal() as Record<string, unknown>;
   return {
@@ -38,9 +55,8 @@ vi.mock('@principles/core/runtime-v2', async (importOriginal) => {
         listPromptActivations: vi.fn().mockResolvedValue([
           { activationId: 'act-prompt-1', artifactId: 'art-001', channel: 'prompt', action: 'prompt', targetRef: 'P_001', activatedAt: '2026-06-18T00:00:00.000Z', deactivatedAt: null },
         ]),
-        listCodeToolHookActivations: vi.fn().mockResolvedValue([
-          { activationId: 'act-hook-1', artifactId: 'art-002', channel: 'code_tool_hook', action: 'block', targetRef: 'rule-001', activatedAt: '2026-06-18T00:00:00.000Z', deactivatedAt: null },
-        ]),
+        listCodeToolHookActivations: mockListCodeToolHookActivations,
+        promoteActivation: mockPromoteActivation,
         listAllActivations: vi.fn().mockResolvedValue([
           { activationId: 'act-prompt-1', artifactId: 'art-001', channel: 'prompt', action: 'prompt', targetRef: 'P_001', activatedAt: '2026-06-18T00:00:00.000Z', deactivatedAt: null },
           { activationId: 'act-hook-1', artifactId: 'art-002', channel: 'code_tool_hook', action: 'block', targetRef: 'rule-001', activatedAt: '2026-06-18T00:00:00.000Z', deactivatedAt: null },
@@ -66,17 +82,27 @@ vi.mock('@principles/core/runtime-v2', async (importOriginal) => {
             return { decision: 'activated', activationId: 'act-001', action: 'prompt', targetRef: 'P_001' };
           }
           if (args.channel === 'code_tool_hook') {
-            return { decision: 'refused', activationId: 'act-001', action: 'none', targetRef: 'P_001', reason: 'activation_state_read_failed', riskLevel: 'high', channel: 'code_tool_hook' };
+            return { decision: 'refused', activationId: 'act-001', action: 'none', targetRef: 'P_001', reason: 'activation_state_read_failed', riskLevel: 'high', channel: 'code_tool_hook', nextAction: 'Check activation_state table integrity and retry' };
           }
           return { decision: 'would_activate', activationId: 'act-001', action: 'prompt', targetRef: 'P_001' };
         }),
       };
     }),
+    ApprovalQueue: vi.fn().mockImplementation(function () {
+      return { approve: mockApprovalApprove, resetToPending: mockApprovalResetToPending };
+    }),
+    ApprovalCompletionService: vi.fn().mockImplementation(function () {
+      return { completeApproval: mockCompletionComplete };
+    }),
+    RuleHostWriter: vi.fn().mockImplementation(function (config) {
+      mockRuleHostWriterConfigs.push(config);
+      return { channel: 'code_tool_hook' };
+    }),
     resolveOutputLanguage: vi.fn().mockReturnValue({ outputLanguage: 'zh-CN' }),
   };
 });
 
-import { handleRuntimeActivationDispatch, handleRuntimeActivationDeactivate, handleRuntimeActivationList, handleRuntimeActivationEdit } from '../../src/commands/runtime-activation.js';
+import { handleRuntimeActivationDispatch, handleRuntimeActivationDeactivate, handleRuntimeActivationList, handleRuntimeActivationEdit, handleActivationApprove, handleRuntimeActivationPromote, registerRuntimeActivationDispatchCommand, registerRuntimeActivationDeactivateCommand, registerRuntimeActivationPromoteCommand, registerRuntimeActivationListCommand } from '../../src/commands/runtime-activation.js';
 
 const WS = '/fake/workspace';
 
@@ -101,11 +127,24 @@ describe('handleRuntimeActivationDispatch', () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
+    mockRuleHostWriterConfigs.length = 0;
     consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
     mockGetArtifactById.mockResolvedValue(makeArtifact());
   });
 
+  it('wires the effective workspace feature flags into RuleHostWriter', async () => {
+    await handleRuntimeActivationDispatch({
+      workspace: WS,
+      artifactId: 'art-001',
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    expect(mockRuleHostWriterConfigs).toHaveLength(1);
+    expect(mockRuleHostWriterConfigs[0]?.featureFlagProbe?.('rulecode_context_v2')).toBe(true);
+  });
+
   afterEach(() => {
     consoleLogSpy.mockRestore();
     consoleErrorSpy.mockRestore();
@@ -218,6 +257,50 @@ describe('handleRuntimeActivationDispatch', () => {
     expect(text).toContain('Activation:');
     expect(text).toContain('would_activate');
   });
+
+  // PRI-493 cli-5 no-mutation: missing-artifact failure path must not construct
+  // the activation state store or dispatcher. Production code returns before
+  // instantiating either (runtime-activation.ts lines 148-157). ERR-088
+  // positive path marker: assert the constructors were never invoked, not just
+  // that the output shape is invalid_artifact.
+  it('missing-artifact failure path does not construct SqliteActivationStateStore or ActivationDispatcher', async () => {
+    mockGetArtifactById.mockResolvedValue(null);
+    const { SqliteActivationStateStore, ActivationDispatcher } = await import('@principles/core/runtime-v2');
+
+    vi.mocked(SqliteActivationStateStore).mockClear();
+    vi.mocked(ActivationDispatcher).mockClear();
+
+    await handleRuntimeActivationDispatch({
+      workspace: WS,
+      artifactId: 'nonexistent',
+      channel: 'prompt',
+      json: true,
+    });
+
+    expect(SqliteActivationStateStore).not.toHaveBeenCalled();
+    expect(ActivationDispatcher).not.toHaveBeenCalled();
+    expect(process.exitCode).toBe(1);
+  });
+
+  // PRI-493 cli-5 no-mutation: --dry-run/--confirm mutex failure must not open
+  // any DB-backed store. Production code exits before stateManager.initialize()
+  // (runtime-activation.ts lines 127-131). ERR-088 positive marker.
+  it('mutex failure path (--dry-run + --confirm) does not construct RuntimeStateManager', async () => {
+    const { RuntimeStateManager } = await import('@principles/core/runtime-v2');
+    vi.mocked(RuntimeStateManager).mockClear();
+
+    await handleRuntimeActivationDispatch({
+      workspace: WS,
+      artifactId: 'art-001',
+      channel: 'prompt',
+      dryRun: true,
+      confirm: true,
+      json: true,
+    });
+
+    expect(RuntimeStateManager).not.toHaveBeenCalled();
+    expect(process.exitCode).toBe(1);
+  });
 });
 
 // PRI-408 Contract E: Deactivate (rollback) command tests
@@ -311,6 +394,38 @@ describe('handleRuntimeActivationDeactivate', () => {
     expect(text).toContain('Deactivated: act-001');
     expect(text).toContain('deactivatedAt:');
   });
+
+  // PRI-493 cli-5 no-mutation: not-found failure path must not call insert on
+  // the activation state store. Production code (runtime-activation.ts
+  // lines 253-267) calls deactivateActivation which returns false; no other
+  // mutating method should be invoked. ERR-088 positive path marker: capture
+  // the store instance and assert insert was never called.
+  it('not-found failure path does not call insert on the activation store', async () => {
+    const { SqliteActivationStateStore } = await import('@principles/core/runtime-v2');
+    const capturedInsert = vi.fn().mockResolvedValue(undefined);
+    const capturedDeactivate = vi.fn().mockResolvedValue(false);
+    vi.mocked(SqliteActivationStateStore).mockImplementationOnce(function () {
+      return {
+        findByArtifactId: vi.fn().mockResolvedValue(null),
+        insert: capturedInsert,
+        deactivateActivation: capturedDeactivate,
+        listPromptActivations: vi.fn().mockResolvedValue([]),
+        listCodeToolHookActivations: vi.fn().mockResolvedValue([]),
+        listAllActivations: vi.fn().mockResolvedValue([]),
+      } as never;
+    });
+
+    await handleRuntimeActivationDeactivate({
+      workspace: WS,
+      activationId: 'act-gone',
+      json: true,
+    });
+
+    expect(capturedDeactivate).toHaveBeenCalledTimes(1);
+    expect(capturedDeactivate).toHaveBeenCalledWith('act-gone', expect.any(String));
+    expect(capturedInsert).not.toHaveBeenCalled();
+    expect(process.exitCode).toBe(1);
+  });
 });
 
 // PRI-408 Contract D: List activations (observability) command tests
@@ -320,6 +435,9 @@ describe('handleRuntimeActivationList', () => {
 
   beforeEach(() => {
     vi.clearAllMocks();
+    // F9-1: by default, all artifact_ids are considered valid (exist in pi_artifacts).
+    // Individual tests override this to simulate dangling references.
+    mockGetArtifactById.mockResolvedValue(makeArtifact());
     consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
   });
@@ -341,6 +459,9 @@ describe('handleRuntimeActivationList', () => {
     expect(output.activations.length).toBe(2);
     expect(output.activations[0]).toHaveProperty('activationId');
     expect(output.activations[0]).toHaveProperty('channel');
+    // PRI-500: CLI list output must include principleId (matching Console field).
+    expect(output.activations[0]).toHaveProperty('principleId');
+    expect(output.status).toBe('ok');
   });
 
   it('channel=prompt filter calls listPromptActivations', async () => {
@@ -403,6 +524,425 @@ describe('handleRuntimeActivationList', () => {
     expect(errorText).toContain('Next action');
     expect(process.exitCode).toBe(1);
   });
+
+  // F9-1 regression: dangling artifact_id must produce degraded status + warning
+  it('F9-1: emits degraded status + warning when activation references non-existent artifact_id (JSON)', async () => {
+    // art-001 exists, art-002 does NOT (dangling)
+    mockGetArtifactById.mockImplementation((artifactId: string) => {
+      if (artifactId === 'art-001') return Promise.resolve(makeArtifact({ artifactId: 'art-001' }));
+      return Promise.resolve(null);
+    });
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.status).toBe('degraded');
+    expect(output.reason).toContain('non-existent artifact_id');
+    expect(output.reason).toContain('art-002');
+    expect(output.nextAction).toContain('pd runtime internalization integrity');
+    // The dangling activation should have a per-record warning
+    const danglingAct = output.activations.find((a: { artifactId: string }) => a.artifactId === 'art-002');
+    expect(danglingAct.warning).toContain('does not exist in pi_artifacts');
+    // The valid activation should NOT have a warning
+    const validAct = output.activations.find((a: { artifactId: string }) => a.artifactId === 'art-001');
+    expect(validAct.warning).toBeUndefined();
+  });
+
+  it('F9-1: text output prints WARNING line for dangling artifact_id', async () => {
+    mockGetArtifactById.mockImplementation((artifactId: string) => {
+      if (artifactId === 'art-001') return Promise.resolve(makeArtifact({ artifactId: 'art-001' }));
+      return Promise.resolve(null);
+    });
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+    });
+
+    const text = consoleLogSpy.mock.calls.map(c => c[0]).join('\n');
+    expect(text).toContain('WARNING');
+    expect(text).toContain('art-002');
+    const errorText = consoleErrorSpy.mock.calls.map(c => c[0]).join('\n');
+    expect(errorText).toContain('non-existent artifact_id');
+    expect(errorText).toContain('Next action');
+  });
+
+  it('F9-1: treats getArtifactById throw as dangling (fail loud, rc-9)', async () => {
+    mockGetArtifactById.mockRejectedValue(new Error('DB corruption'));
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.status).toBe('degraded');
+    expect(output.reason).toContain('non-existent artifact_id');
+  });
+
+  it('F9-1: status is ok when all artifact_ids exist (negative case)', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact());
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.status).toBe('ok');
+    expect(output.reason).toBeUndefined();
+    expect(output.nextAction).toBeUndefined();
+  });
+
+  // ── PRI-491: owner observability (mode / status / contextVersion / evidenceRefs) ──
+  //
+  // The CLI list command must surface enough information for the owner to
+  // answer "will this rule block now?" without opening SQLite or reading
+  // logs. The four essential signals are:
+  //   1. mode (shadow / live / undefined for unrecognized)
+  //   2. status (active / suspended_by_flag / deactivated)
+  //   3. contextVersion (v1 / v2) — needed to interpret suspended_by_flag
+  //   4. nextAction (promote / deactivate / enable flag)
+  //
+  // ERR entries:
+  // - ERR-002: suspended_by_flag is a degradation; it MUST carry a reason
+  //   via nextAction (rc-9-no-silent-fallback).
+  // - ERR-088: tests must assert the unique status field, not only absence
+  //   of "active".
+  // - ERR-023/033: --json output must remain a single parseable object.
+
+  it('PRI-491: shadow v2 activation with flag off shows status=suspended_by_flag (JSON)', async () => {
+    // Override the artifact to a v2 artifact with evidenceRefs.
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-v2-shadow',
+      contentJson: JSON.stringify({
+        requiresContextVersion: 2,
+        evidenceRefs: ['ex-1', 'ex-2'],
+        implementationCode: 'return { decision: "allow" };',
+      }),
+    }));
+    // Override listCodeToolHookActivations to return a v2 shadow activation.
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v2-shadow',
+        artifactId: 'art-v2-shadow',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_shadow_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: null,
+        deactivatedAt: null,
+      },
+    ]);
+    // Default mockFeatureFlags has rulecode_context_v2 enabled. Flip it off
+    // to simulate the production default (the flag is quiet/default-off).
+    mockFeatureFlags.flags.rulecode_context_v2.enabled = false;
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.activations).toHaveLength(1);
+    const rec = output.activations[0];
+    expect(rec.status).toBe('suspended_by_flag');
+    expect(rec.mode).toBe('shadow');
+    expect(rec.contextVersion).toBe('v2');
+    expect(rec.evidenceRefs).toEqual(['ex-1', 'ex-2']);
+    expect(rec.evidenceSummary).toContain('2 evidence ref(s)');
+    expect(rec.nextAction).toContain('Enable rulecode_context_v2 flag');
+    expect(rec.nextAction).toContain('pd activation deactivate --activation-id act-v2-shadow --confirm');
+
+    // Restore the mock for subsequent tests.
+    mockFeatureFlags.flags.rulecode_context_v2.enabled = true;
+  });
+
+  it('PRI-491: text output shows [SUSPENDED by flag] for v2 flag-off activation', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-v2-shadow',
+      contentJson: JSON.stringify({
+        requiresContextVersion: 2,
+        evidenceRefs: ['ex-1'],
+        implementationCode: 'return { decision: "allow" };',
+      }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v2-shadow',
+        artifactId: 'art-v2-shadow',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_shadow_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: null,
+        deactivatedAt: null,
+      },
+    ]);
+    mockFeatureFlags.flags.rulecode_context_v2.enabled = false;
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+    });
+
+    const text = consoleLogSpy.mock.calls.map(c => c[0]).join('\n');
+    expect(text).toContain('[SUSPENDED by flag]');
+    expect(text).toContain('(shadow)');
+    expect(text).toContain('contextVersion: v2');
+    expect(text).toContain('evidence:');
+    expect(text).toContain('nextAction:');
+
+    mockFeatureFlags.flags.rulecode_context_v2.enabled = true;
+  });
+
+  it('PRI-491: shadow v1 activation shows status=active and promote nextAction (JSON)', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-v1-shadow',
+      contentJson: JSON.stringify({ implementationCode: 'return { decision: "allow" };' }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v1-shadow',
+        artifactId: 'art-v1-shadow',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_shadow_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: null,
+        deactivatedAt: null,
+      },
+    ]);
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    const rec = output.activations[0];
+    expect(rec.status).toBe('active');
+    expect(rec.mode).toBe('shadow');
+    expect(rec.contextVersion).toBe('v1');
+    expect(rec.evidenceRefs).toBeUndefined();
+    expect(rec.nextAction).toBe('pd activation promote --activation-id act-v1-shadow --confirm');
+  });
+
+  it('PRI-491: live v1 activation shows status=active and deactivate nextAction (JSON)', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-v1-live',
+      contentJson: JSON.stringify({ implementationCode: 'return { decision: "allow" };' }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v1-live',
+        artifactId: 'art-v1-live',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_live_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: '2026-06-19T00:00:00.000Z',
+        deactivatedAt: null,
+      },
+    ]);
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    const rec = output.activations[0];
+    expect(rec.status).toBe('active');
+    expect(rec.mode).toBe('live');
+    expect(rec.promotedAt).toBe('2026-06-19T00:00:00.000Z');
+    expect(rec.nextAction).toBe('pd activation deactivate --activation-id act-v1-live --confirm');
+  });
+
+  it('PRI-491: text output shows promotedAt timestamp when present', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-v1-live',
+      contentJson: JSON.stringify({ implementationCode: 'return { decision: "allow" };' }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v1-live',
+        artifactId: 'art-v1-live',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_live_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: '2026-06-19T00:00:00.000Z',
+        deactivatedAt: null,
+      },
+    ]);
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+    });
+
+    const text = consoleLogSpy.mock.calls.map(c => c[0]).join('\n');
+    expect(text).toContain('(live)');
+    expect(text).toContain('promotedAt: 2026-06-19T00:00:00.000Z');
+    expect(text).toContain('nextAction: pd activation deactivate --activation-id act-v1-live --confirm');
+  });
+
+  it('PRI-491: deactivated activation shows [DEACTIVATED <ts>] regardless of contextVersion (precedence)', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-v2-dead',
+      contentJson: JSON.stringify({
+        requiresContextVersion: 2,
+        evidenceRefs: ['ex-1'],
+        implementationCode: 'return { decision: "allow" };',
+      }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v2-dead',
+        artifactId: 'art-v2-dead',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_live_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: '2026-06-19T00:00:00.000Z',
+        deactivatedAt: '2026-06-20T00:00:00.000Z',
+      },
+    ]);
+    mockFeatureFlags.flags.rulecode_context_v2.enabled = false;
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+      includeDeactivated: true,
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    const rec = output.activations[0];
+    // deactivated > suspended_by_flag > active — a deactivated record is NOT
+    // reported as suspended_by_flag even when v2 + flag-off.
+    expect(rec.status).toBe('deactivated');
+    expect(rec.deactivatedAt).toBe('2026-06-20T00:00:00.000Z');
+    expect(rec.nextAction).toBeUndefined();
+
+    mockFeatureFlags.flags.rulecode_context_v2.enabled = true;
+  });
+
+  it('PRI-491: unrecognized action yields undefined mode and undefined nextAction (no false label)', async () => {
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      artifactId: 'art-unknown',
+      contentJson: JSON.stringify({ implementationCode: 'return { decision: "allow" };' }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-unknown',
+        artifactId: 'art-unknown',
+        channel: 'code_tool_hook',
+        action: 'some_future_action',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: null,
+        deactivatedAt: null,
+      },
+    ]);
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    const rec = output.activations[0];
+    expect(rec.mode).toBeUndefined();
+    expect(rec.status).toBe('active');
+    // No false nextAction — the owner must inspect manually.
+    expect(rec.nextAction).toBeUndefined();
+  });
+
+  it('PRI-491: JSON output remains a single parseable object (cli-1-strict-json)', async () => {
+    // Even with rich enrichment fields, the --json contract requires exactly
+    // one parseable JSON object on stdout (no banners, no extra log lines).
+    mockGetArtifactById.mockResolvedValue(makeArtifact({
+      contentJson: JSON.stringify({
+        requiresContextVersion: 2,
+        evidenceRefs: ['ex-1'],
+        implementationCode: 'return { decision: "allow" };',
+      }),
+    }));
+    mockListCodeToolHookActivations.mockResolvedValue([
+      {
+        activationId: 'act-v2',
+        artifactId: 'art-001',
+        channel: 'code_tool_hook',
+        action: 'code_tool_hook_shadow_activate',
+        targetRef: 'edit_tool',
+        activatedAt: '2026-06-18T00:00:00.000Z',
+        promotedAt: null,
+        deactivatedAt: null,
+      },
+    ]);
+
+    await handleRuntimeActivationList({
+      workspace: WS,
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    // Exactly one console.log call on stdout (the JSON payload).
+    expect(consoleLogSpy.mock.calls).toHaveLength(1);
+    // And it parses cleanly.
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output).toHaveProperty('activations');
+    expect(output).toHaveProperty('status');
+  });
+});
+
+describe('handleRuntimeActivationPromote', () => {
+  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
+  let consoleErrorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockListCodeToolHookActivations.mockResolvedValue([
+      { activationId: 'act-hook-1', artifactId: 'art-002', channel: 'code_tool_hook', action: 'code_tool_hook_shadow_activate', targetRef: 'rule-001', activatedAt: '2026-06-18T00:00:00.000Z', promotedAt: null, deactivatedAt: null },
+    ]);
+    mockPromoteActivation.mockResolvedValue(true);
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    consoleLogSpy.mockRestore();
+    consoleErrorSpy.mockRestore();
+    process.exitCode = 0;
+  });
+
+  it('defaults to dry-run and does not mutate activation state', async () => {
+    await handleRuntimeActivationPromote({ workspace: WS, activationId: 'act-hook-1', json: true });
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.decision).toBe('would_promote');
+    expect(mockPromoteActivation).not.toHaveBeenCalled();
+  });
+
+  it('promotes an eligible shadow activation when confirmed', async () => {
+    await handleRuntimeActivationPromote({ workspace: WS, activationId: 'act-hook-1', confirm: true, json: true });
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.decision).toBe('promoted');
+    expect(mockPromoteActivation).toHaveBeenCalledWith('act-hook-1', expect.any(String));
+  });
+
+  it('rejects mutually exclusive dry-run and confirm without mutation', async () => {
+    await handleRuntimeActivationPromote({ workspace: WS, activationId: 'act-hook-1', dryRun: true, confirm: true, json: true });
+    expect(mockPromoteActivation).not.toHaveBeenCalled();
+    expect(process.exitCode).toBe(1);
+  });
 });
 
 // P1 #2 fix: Edit pending approval command tests
@@ -751,3 +1291,548 @@ describe('handleRuntimeActivationEdit', () => {
   });
 
 });
+
+// Bug-M fix: Approve command tests (CLI closed loop)
+describe('handleActivationApprove', () => {
+  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
+  let consoleErrorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockRuleHostWriterConfigs.length = 0;
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    mockGetArtifactById.mockResolvedValue(makeArtifact());
+    mockApprovalResetToPending.mockResolvedValue({ ok: true });
+  });
+
+  afterEach(() => {
+    consoleLogSpy.mockRestore();
+    consoleErrorSpy.mockRestore();
+    process.exitCode = 0;
+  });
+
+  it('AP-01: missing --approval-id returns structured error with nextAction (JSON)', async () => {
+    await handleActivationApprove({
+      workspace: WS,
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(false);
+    expect(output.reason).toBe('approval_id_required');
+    expect(output.nextAction).toContain('--approval-id');
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('AP-02: approval not_found returns structured error with nextAction (JSON)', async () => {
+    mockApprovalApprove.mockResolvedValue({ ok: false, error: 'not_found' });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-nonexistent',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(false);
+    expect(output.reason).toBe('approval_not_found');
+    expect(output.nextAction).toContain('Check the approval ID');
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('AP-03: already_decided returns structured error with status (JSON)', async () => {
+    mockApprovalApprove.mockResolvedValue({ ok: false, error: 'already_decided', status: 'rejected' });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(false);
+    expect(output.reason).toContain('already_decided');
+    expect(output.reason).toContain('rejected');
+    expect(output.nextAction).toContain('already decided');
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('AP-04: success path returns ok=true with activationId and decision (JSON)', async () => {
+    mockApprovalApprove.mockResolvedValue({
+      ok: true,
+      record: { approvalId: 'appr-001', artifactId: 'art-001', status: 'approved' },
+    });
+    mockCompletionComplete.mockResolvedValue({
+      ok: true,
+      activationId: 'act-001',
+      decision: { decision: 'activated', activationId: 'act-001', action: 'prompt', targetRef: 'P_001' },
+    });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      decidedBy: 'test-owner',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(true);
+    expect(output.approvalId).toBe('appr-001');
+    expect(output.activationId).toBe('act-001');
+    expect(output.decision).toBe('activated');
+    expect(output.nextAction).toBe('pd activation list');
+    expect(process.exitCode).toBe(0);
+  });
+
+  it('AP-05: --json output is a single parseable JSON object (cli-1-strict-json)', async () => {
+    mockApprovalApprove.mockResolvedValue({
+      ok: true,
+      record: { approvalId: 'appr-001', artifactId: 'art-001', status: 'approved' },
+    });
+    mockCompletionComplete.mockResolvedValue({
+      ok: true,
+      activationId: 'act-001',
+      decision: { decision: 'activated', activationId: 'act-001', action: 'prompt', targetRef: 'P_001' },
+    });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      json: true,
+    });
+
+    // Exactly one console.log call with a single JSON object
+    expect(consoleLogSpy).toHaveBeenCalledTimes(1);
+    const rawOutput = consoleLogSpy.mock.calls[0][0];
+    const parsed = JSON.parse(rawOutput);
+    expect(parsed).toBeInstanceOf(Object);
+    expect(parsed.ok).toBe(true);
+  });
+
+  it('AP-06: completeApproval !ok rolls back approval and returns structured error (JSON)', async () => {
+    mockApprovalApprove.mockResolvedValue({
+      ok: true,
+      record: { approvalId: 'appr-001', artifactId: 'art-001', status: 'approved' },
+    });
+    mockCompletionComplete.mockResolvedValue({
+      ok: false,
+      reason: 'artifact_not_validated',
+      nextAction: 'Check artifact validation status and retry dispatch.',
+    });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(false);
+    expect(output.reason).toContain('activation_failed');
+    expect(output.reason).toContain('artifact_not_validated');
+    expect(output.approvalRolledBack).toBe(true);
+    expect(output.nextAction).toContain('rolled back to pending');
+    expect(process.exitCode).toBe(1);
+    // cli-5: rollback was attempted via resetToPending
+    expect(mockApprovalResetToPending).toHaveBeenCalledWith('appr-001');
+  });
+
+  it('AP-06b: completeApproval throw rolls back approval and returns structured error (JSON)', async () => {
+    mockApprovalApprove.mockResolvedValue({
+      ok: true,
+      record: { approvalId: 'appr-001', artifactId: 'art-001', status: 'approved' },
+    });
+    mockCompletionComplete.mockRejectedValue(new Error('sqlite: disk I/O error'));
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(false);
+    expect(output.reason).toContain('activation_completion_failed');
+    expect(output.reason).toContain('disk I/O error');
+    expect(output.approvalRolledBack).toBe(true);
+    expect(output.nextAction).toContain('rolled back to pending');
+    expect(process.exitCode).toBe(1);
+    expect(mockApprovalResetToPending).toHaveBeenCalledWith('appr-001');
+  });
+
+  it('AP-06c: rollback failure surfaces approvalRolledBack=false with retry guidance (JSON)', async () => {
+    mockApprovalApprove.mockResolvedValue({
+      ok: true,
+      record: { approvalId: 'appr-001', artifactId: 'art-001', status: 'approved' },
+    });
+    mockCompletionComplete.mockResolvedValue({
+      ok: false,
+      reason: 'artifact_not_validated',
+      nextAction: 'Check artifact validation status and retry dispatch.',
+    });
+    mockApprovalResetToPending.mockResolvedValue({ ok: false, error: 'not_found' });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      json: true,
+    });
+
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.ok).toBe(false);
+    expect(output.approvalRolledBack).toBe(false);
+    expect(output.nextAction).toContain("remains 'approved'");
+    expect(process.exitCode).toBe(1);
+  });
+
+  it('AP-07: Commander flag wiring — --approval-id is required at parser level (cli-7-test-wiring)', async () => {
+    // cli-7-test-wiring: exercise the real Commander parser path (not just the
+    // handler) to verify `--approval-id` is registered as a required option.
+    // Follows the project's established pattern in runtime-internalization-run-once.test.ts
+    // (buildXxxCommand + program.exitOverride() + parseAsync).
+    const { Command } = await import('commander');
+    const program = new Command();
+    program.exitOverride(); // surface Commander errors as throws instead of process.exit
+
+    const activationCmd = program.command('activation');
+    activationCmd
+      .command('approve')
+      .description('Approve a pending approval and dispatch its activation')
+      .requiredOption('-a, --approval-id <id>', 'Approval ID to approve')
+      .option('--decided-by <user>', 'Reviewer name (default: cli-operator)')
+      .option('--note <text>', 'Optional approval note')
+      .option('-w, --workspace <path>', 'Workspace directory')
+      .option('--json', 'Output raw JSON')
+      .action(async () => { /* no-op for parser test */ });
+
+    // Case 1: missing --approval-id → Commander throws required-option error
+    await expect(
+      program.parseAsync(['node', 'pd', 'activation', 'approve', '--json']),
+    ).rejects.toThrow(/required option.*--approval-id.*not specified/);
+
+    // Case 2: with --approval-id → parses successfully and exposes the option
+    const captured: Record<string, unknown> = {};
+    const program2 = new Command();
+    program2.exitOverride();
+    const activationCmd2 = program2.command('activation');
+    activationCmd2
+      .command('approve')
+      .requiredOption('-a, --approval-id <id>', 'Approval ID to approve')
+      .option('--decided-by <user>', 'Reviewer name')
+      .option('--note <text>', 'Optional approval note')
+      .option('-w, --workspace <path>', 'Workspace directory')
+      .option('--json', 'Output raw JSON')
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program2.parseAsync([
+      'node', 'pd', 'activation', 'approve',
+      '--approval-id', 'appr-007',
+      '--decided-by', 'alice',
+      '--note', 'lgtm',
+      '--json',
+    ]);
+
+    expect(captured.approvalId).toBe('appr-007');
+    expect(captured.decidedBy).toBe('alice');
+    expect(captured.note).toBe('lgtm');
+    expect(captured.json).toBe(true);
+  });
+
+  // PRI-489 AP-08: The approve path must inject the real workspace
+  // `rulecode_context_v2` feature flag probe into RuleHostWriter — same
+  // wiring as the dispatch path (tested at line 136-146) and the Console
+  // model (ApprovalsConsoleModel.dispatchActivationAfterApproval).
+  // Previously this path constructed RuleHostWriter without the probe, so a
+  // v2 artifact in a flag-off workspace would pass canActivate here while
+  // being rejected by dispatch/Console — an inconsistent contract that
+  // violated ERR-024 (validator wired in one enforcement path but not
+  // another) and ERR-089 (sibling approval path diverged from dispatch).
+  it('AP-08: wires the effective workspace feature flags into RuleHostWriter (ERR-024/ERR-089)', async () => {
+    mockApprovalApprove.mockResolvedValue({
+      ok: true,
+      record: { approvalId: 'appr-001', artifactId: 'art-001', status: 'approved' },
+    });
+    mockCompletionComplete.mockResolvedValue({
+      ok: true,
+      activationId: 'act-001',
+      decision: { decision: 'activated', activationId: 'act-001', action: 'prompt', targetRef: 'P_001' },
+    });
+
+    await handleActivationApprove({
+      workspace: WS,
+      approvalId: 'appr-001',
+      decidedBy: 'test-owner',
+      json: true,
+    });
+
+    // The RuleHostWriter mock captures its constructor config — verify the
+    // featureFlagProbe was injected and reflects the mocked feature flags
+    // (rulecode_context_v2: enabled=true, see mockFeatureFlags at top).
+    expect(mockRuleHostWriterConfigs).toHaveLength(1);
+    expect(mockRuleHostWriterConfigs[0]?.featureFlagProbe).toBeDefined();
+    expect(mockRuleHostWriterConfigs[0]?.featureFlagProbe?.('rulecode_context_v2')).toBe(true);
+    // Unknown flags must not be reported as enabled (rc-2-no-as-bypass).
+    expect(mockRuleHostWriterConfigs[0]?.featureFlagProbe?.('nonexistent_flag')).toBe(false);
+  });
+});
+
+// ── PRI-499: CLI parser wiring (cli-7) and exit-stops (cli-2) ─────────────
+//
+// cli-7-test-wiring: every activation subcommand must exercise the real
+// Commander flag registration path. Without this, a future refactor could
+// silently break flag parsing and only surface at runtime. The existing
+// `approve` parser test (AP-07 above) is the template; these tests extend
+// coverage to dispatch, deactivate, promote, and list.
+//
+// cli-2-exit-stops: failure paths that call process.exit must not trigger
+// downstream side effects (DB writes, ledger updates, artifact creation).
+// Stubs process.exit to throw, then asserts no store was constructed.
+
+describe('PRI-499: CLI parser wiring (cli-7) for activation subcommands', () => {
+  it('dispatch: --artifact-id, --channel, --dry-run, --confirm, --json parse correctly', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationDispatchCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'dispatch',
+      '--artifact-id', 'art-parse-001',
+      '--channel', 'prompt',
+      '--dry-run',
+      '--json',
+    ]);
+
+    expect(captured.artifactId).toBe('art-parse-001');
+    expect(captured.channel).toBe('prompt');
+    expect(captured.dryRun).toBe(true);
+    expect(captured.confirm).toBeUndefined();
+    expect(captured.json).toBe(true);
+  });
+
+  it('dispatch: --confirm flag parses and is mutually exclusive with --dry-run at handler level', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationDispatchCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'dispatch',
+      '--artifact-id', 'art-confirm',
+      '--confirm',
+      '--json',
+    ]);
+
+    expect(captured.confirm).toBe(true);
+    expect(captured.dryRun).toBeUndefined();
+  });
+
+  it('deactivate: --activation-id (required) parses correctly', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationDeactivateCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'deactivate',
+      '--activation-id', 'act-parse-deact',
+      '--json',
+    ]);
+
+    expect(captured.activationId).toBe('act-parse-deact');
+    expect(captured.json).toBe(true);
+  });
+
+  it('deactivate: missing --activation-id fails at parser level (required option)', async () => {
+    const { Command } = await import('commander');
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationDeactivateCommand(activationCmd)
+      .action(async () => { /* no-op */ });
+
+    await expect(
+      program.parseAsync(['node', 'pd', 'activation', 'deactivate', '--json']),
+    ).rejects.toThrow(/required option.*--activation-id.*not specified/);
+  });
+
+  it('promote: --activation-id (required), --dry-run, --confirm parse correctly', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationPromoteCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'promote',
+      '--activation-id', 'act-parse-promote',
+      '--dry-run',
+      '--json',
+    ]);
+
+    expect(captured.activationId).toBe('act-parse-promote');
+    expect(captured.dryRun).toBe(true);
+    expect(captured.confirm).toBeUndefined();
+  });
+
+  it('promote: --confirm flag parses (not --dry-run)', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationPromoteCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'promote',
+      '--activation-id', 'act-promote-confirm',
+      '--confirm',
+      '--json',
+    ]);
+
+    expect(captured.confirm).toBe(true);
+    expect(captured.dryRun).toBeUndefined();
+  });
+
+  it('list: --channel filter and --json parse correctly', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationListCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'list',
+      '--channel', 'code_tool_hook',
+      '--json',
+    ]);
+
+    expect(captured.channel).toBe('code_tool_hook');
+    expect(captured.json).toBe(true);
+    expect(captured.includeDeactivated).toBeUndefined();
+  });
+
+  it('list: --include-deactivated flag parses as boolean true', async () => {
+    const { Command } = await import('commander');
+    const captured: Record<string, unknown> = {};
+    const program = new Command();
+    program.exitOverride();
+    const activationCmd = program.command('activation');
+    registerRuntimeActivationListCommand(activationCmd)
+      .action(async (opts) => { Object.assign(captured, opts); });
+
+    await program.parseAsync([
+      'node', 'pd', 'activation', 'list',
+      '--include-deactivated',
+      '--json',
+    ]);
+
+    expect(captured.includeDeactivated).toBe(true);
+  });
+});
+
+// PRI-499 cli-2-exit-stops: Verify failure paths do NOT trigger DB/ledger/
+// artifact side effects. Production code uses `process.exitCode = 1` (not
+// `process.exit(1)`) and returns early — these tests assert both the exit
+// code AND that no store was constructed, covering the high-risk channel
+// refusal path that was not covered by the existing tests at lines 266-303.
+// If a future change replaces `process.exitCode` with `process.exit()` but
+// forgets to add a `return`, these tests will fail because the store mock
+// would be called before the exit.
+describe('PRI-499: cli-2-exit-stops — failure paths set exitCode and do not construct stores', () => {
+  let consoleLogSpy: ReturnType<typeof vi.spyOn>;
+  let consoleErrorSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockRuleHostWriterConfigs.length = 0;
+    consoleLogSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    mockGetArtifactById.mockResolvedValue(makeArtifact());
+  });
+
+  afterEach(() => {
+    consoleLogSpy.mockRestore();
+    consoleErrorSpy.mockRestore();
+    process.exitCode = 0;
+  });
+
+  it('high-risk channel refusal: sets exitCode=1 and returns structured refusal (cli-2)', async () => {
+    await handleRuntimeActivationDispatch({
+      workspace: WS,
+      artifactId: 'art-001',
+      channel: 'code_tool_hook',
+      json: true,
+    });
+
+    // cli-2: exit-stops — refused path must set exitCode and return a
+    // structured refusal. Stores ARE constructed (artifact exists, so
+    // RuntimeStateManager/SqliteActivationStateStore/ActivationDispatcher
+    // are built before dispatch() returns 'refused'). The cli-2 guarantee
+    // for this path = exitCode set + structured output, NOT "no store
+    // construction" (rc-9 + cli-6).
+    expect(process.exitCode).toBe(1);
+
+    // Verify the JSON output is a structured refusal (rc-9 + cli-6).
+    const output = JSON.parse(consoleLogSpy.mock.calls[0][0]);
+    expect(output.decision).toBe('refused');
+    expect(output.reason).toBeDefined();
+    expect(output.nextAction).toBeDefined();
+  });
+
+  it('missing artifact: sets exitCode=1 and does not construct SqliteActivationStateStore or ActivationDispatcher (cli-2)', async () => {
+    mockGetArtifactById.mockResolvedValue(null);
+    const { SqliteActivationStateStore, ActivationDispatcher } = await import('@principles/core/runtime-v2');
+    vi.mocked(SqliteActivationStateStore).mockClear();
+    vi.mocked(ActivationDispatcher).mockClear();
+
+    await handleRuntimeActivationDispatch({
+      workspace: WS,
+      artifactId: 'nonexistent-cli-2',
+      channel: 'prompt',
+      json: true,
+    });
+
+    // cli-2: RuntimeStateManager IS constructed at line 143 (needed to check
+    // artifact existence via getArtifactById). But SqliteActivationStateStore
+    // and ActivationDispatcher are NOT constructed — the handler returns at
+    // line 156 before reaching lines 170/175. This is the no-DB-side-effects
+    // guarantee for the missing-artifact failure path.
+    expect(process.exitCode).toBe(1);
+    expect(SqliteActivationStateStore).not.toHaveBeenCalled();
+    expect(ActivationDispatcher).not.toHaveBeenCalled();
+  });
+
+  it('mutex failure (--dry-run + --confirm): sets exitCode=1 and does not construct RuntimeStateManager', async () => {
+    const { RuntimeStateManager } = await import('@principles/core/runtime-v2');
+    vi.mocked(RuntimeStateManager).mockClear();
+
+    await handleRuntimeActivationDispatch({
+      workspace: WS,
+      artifactId: 'art-001',
+      channel: 'prompt',
+      dryRun: true,
+      confirm: true,
+      json: true,
+    });
+
+    // cli-2: mutex failure must set exitCode and NOT construct state manager.
+    expect(process.exitCode).toBe(1);
+    expect(RuntimeStateManager).not.toHaveBeenCalled();
+  });
+});