@principles/pd-cli 1.152.5 → 1.152.7

package/src/commands/pain-record.ts

@@ -87,18 +87,29 @@ function toIngressEntry(entry: PainEvidenceEntry): IngressEvidenceEntry {
  * PRI-642 (SPEC §7.3/§7.4, review blocker 1): build the report from this
  * adapter's host-specific facts and let the SHARED evaluator decide.
  *
- * Per-channel policy (SPEC §7.3 vs OpenClaw):
+ * Per-channel policy (SPEC §7.3/§8.2 vs OpenClaw):
  *
  * - explicit `--session` + acquisition available (real session + real entries):
  *     → cli_explicit_session + bound → submit with real evidence.
- * - explicit `--session` + acquisition unavailable (session_not_found /
- *     empty_trajectory / trajectory_unavailable / evidence_read_failed):
- *     → cli_explicit_session + unbound → shared evaluator REFUSES
- *       (row 5) before any LLM/task/candidate mutation.
- *     The CLI does NOT share the OpenClaw funnel's "degrade" semantics
- *     because the CLI does not own the session identity the way the host
- *     command context does (Evidence Over Assumption — an unverified
- *     session claimed as bound would be a PRI-642 recurrence).
+ * - explicit `--session` + acquisition unavailable with the binding VERIFIED
+ *     (empty_trajectory / evidence-table-level evidence_read_failed — the
+ *     sessions table was queried and DID contain the id; SPEC §8.2: binding
+ *     failure and evidence failure are separate axes, a real session with
+ *     unusable evidence is bound + unavailable, not unbound):
+ *     → cli_explicit_session + bound → shared evaluator DEGRADES (row 4):
+ *       submit with honest empty evidence; the admission gate owns what
+ *       empty evidence is worth. PRI-783 Owner directive: a correct current
+ *       session id is sufficient — empty evidence must not hard-refuse.
+ * - explicit `--session` + acquisition unavailable with the binding
+ *     UNVERIFIED (session_not_found / trajectory_unavailable / DB-open-level
+ *     evidence_read_failed — SPEC §8.2's "real session" premise does not
+ *     hold: the CLI verifies session ids against trajectory.db itself, so
+ *     when that DB is missing or unopenable the id is unproven):
+ *     → cli_explicit_session + unbound → shared evaluator REFUSES (row 5)
+ *       before any LLM/task/candidate mutation. Claiming bound here would
+ *       also let the observability writer persist the unverified id into a
+ *       freshly created trajectory.db — laundering an unproven fact into
+ *       future "evidence" (PRI-783 review P1, self-proving loop).
  * - no `--session` → unbound Owner report (matrix row 6) → submit with
  *   disclosure; no sentinel session, no placeholder evidence, no trajectory
  *   projection (the CLI skips observability when the ingress yields no
@@ -159,25 +170,38 @@ function resolveIngressDecision(
     return { decision, acquisitionDetail: null, acquisitionReason: null };
   }
 
-  // --session: SPEC §7.3 demands a fail-loud refusal whenever the CLI
-  // cannot actually verify the claimed binding. We do not share the
-  // OpenClaw funnel's "degrade" semantics here because the CLI does
-  // not own the session identity the way the host command context does
-  // (Evidence Over Assumption): an unverified session that we still
-  // claimed as bound would be a PRI-642 recurrence in a different
-  // shape. Per-channel policy differs; semantic authority is shared.
+  // --session: SPEC §7.3/§8.2. Binding failure and evidence failure are
+  // separate axes, and the acquisition result carries the binding fact
+  // directly (PRI-783 review): 'verified' = the sessions table was queried
+  // and DID contain the id; 'unverified' = missing/unopenable DB or absent
+  // id. Only a VERIFIED binding may degrade to a bound submission (row 4);
+  // an unverified one is refused (row 5) — claiming bound for an unverified
+  // id would let the observability writer persist that id into a freshly
+  // created trajectory.db (self-proving loop). Per-channel policy differs;
+  // semantic authority is shared.
   const acquisition = acquireTrajectoryEvidenceFromDb(stateDir, opts.session, workspaceDir);
   if (acquisition.status === 'unavailable') {
-    // session_not_found / empty_trajectory / trajectory_unavailable /
-    // evidence_read_failed — refuse (row 5) before any LLM/task/candidate
-    // mutation. The CLI surfaces the reasonCode with a SPEC §7.3 next
-    // action; the evaluator produces the refuse decision.
-    const {reasonCode} = acquisition;
+    const { reasonCode, binding } = acquisition;
+    if (binding === 'verified') {
+      // empty_trajectory / evidence-table-level evidence_read_failed —
+      // bound + unavailable (row 4): degrade to an honest empty-evidence
+      // submission; the admission gate decides what empty evidence is worth.
+      const decision = evaluatePainIngress({
+        ...base,
+        origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
+        correlation: { status: 'bound', hostKind: 'openclaw', sessionId: opts.session },
+        evidence: { status: 'unavailable', reason: reasonCode },
+      });
+      return { decision, acquisitionDetail: acquisition.detail, acquisitionReason: reasonCode };
+    }
+    // binding 'unverified' (session_not_found / trajectory_unavailable /
+    // DB-open-level evidence_read_failed) — the binding claim could not be
+    // validated: refuse (row 5) before any mutation.
     const decision = evaluatePainIngress({
       ...base,
       origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
       correlation: { status: 'unbound', reason: 'external_cli' },
-      evidence: { status: 'unavailable', reason: reasonCode === 'session_not_found' ? 'not_applicable_unbound' : reasonCode },
+      evidence: { status: 'unavailable', reason: 'not_applicable_unbound' },
     });
     if (decision.action === 'refuse') {
       return { decision, acquisitionDetail: acquisition.detail, acquisitionReason: reasonCode };
@@ -202,8 +226,9 @@ function resolveIngressDecision(
   }
 
   // Exhaustive — acquireTrajectoryEvidenceFromDb returns {available, unavailable}
-  // only. The empty-trajectory branch was collapsed to refuse above; a
-  // future-added reason would land here and must also refuse.
+  // only. Unavailable either returned above (degrade for verified bindings,
+  // refuse for unverified ones); a future-added reason must be classified
+  // explicitly here rather than silently degrading.
   const decision = evaluatePainIngress({
     ...base,
     origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
@@ -315,18 +340,28 @@ export async function handlePainRecord(opts: RecordOptions): Promise<void> {
   const { decision, acquisitionDetail, acquisitionReason } = resolveIngressDecision({ opts, stateDir, workspaceDir, painId });
 
   if (decision.action === 'refuse') {
-    // SPEC §7.3: the CLI must surface the specific acquisition reason
-    // (session_not_found / empty_trajectory / trajectory_unavailable /
-    // evidence_read_failed) — the shared evaluator produces the refuse
-    // decision; we map the acquisition detail to the Operator reason.
+    // SPEC §7.3: the CLI must surface the specific acquisition reason —
+    // the shared evaluator produces the refuse decision; we map the
+    // acquisition detail to the Operator reason. PRI-783: the evaluator's
+    // generic next action suggests `pd pain record --session` — the exact
+    // path that just failed — so every CLI acquisition refuse gets honest,
+    // reason-specific guidance instead.
     const reason = opts.session !== undefined && acquisitionReason !== null
       ? acquisitionReason
       : decision.reasonCode;
     const detailSuffix = acquisitionDetail !== null ? ` (${acquisitionDetail})` : '';
+    const nextAction =
+      reason === 'session_not_found'
+        ? 'Check the session id — it is not present in this workspace trajectory — or drop --session to record an unbound Owner report.'
+        : reason === 'trajectory_unavailable'
+          ? 'No trajectory.db exists in this workspace, so the session id could not be verified — point --workspace at the workspace that owns the session, or drop --session to record an unbound Owner report.'
+          : reason === 'evidence_read_failed'
+            ? 'The workspace trajectory could not be read, so the session id could not be verified — resolve access to .state/trajectory.db, or drop --session to record an unbound Owner report.'
+            : decision.nextAction;
     emitSessionBindingFailure(opts, {
       reason,
       message: `${decision.warning}${detailSuffix}`,
-      nextAction: decision.nextAction,
+      nextAction,
     });
     return;
   }

package/src/commands/runtime-init.ts

@@ -25,6 +25,7 @@ import * as yaml from 'js-yaml';
 import { SqliteConnection, SchemaConformanceReadModel } from '@principles/core/runtime-v2';
 import { getDefaultPdConfig, validatePdConfig } from '@principles/core/runtime-v2';
 import { initTrajectorySchema } from 'principles-disciple';
+import { TRAJECTORY_TABLES } from '@principles/core/runtime-v2';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
 import { emitResult, emitFlagConflict, emitError } from '../services/cli-output.js';
 
@@ -251,12 +252,9 @@ export function buildRuntimeInitOutput(workspaceDir: string, confirm: boolean):
     databases.push({
       name: DB_NAMES.trajectory,
       path: path.join(resolvedWorkspace, '.state', 'trajectory.db'),
-      tables: ['schema_version', 'ingest_checkpoint', 'sessions', 'assistant_turns',
-        'user_turns', 'tool_calls', 'pain_events', 'gate_blocks', 'trust_changes',
-        'principle_events', 'task_outcomes', 'correction_samples', 'sample_reviews',
-        // PRI-790 G2: Stage2 待确认信号的持久队列。
-        'signal_confirmations',
-        'exports_audit'],
+      // PRI-774: derived from TRAJECTORY_TABLES — same canonical source as
+      // the real init, so the dry-run report can never drift.
+      tables: [...TRAJECTORY_TABLES],
       status: 'skipped',
       warnings: [],
     });

package/src/commands/runtime-internalization-run-rulehost.ts

@@ -39,6 +39,8 @@ import {
 } from '@principles/core/runtime-v2';
 import type { EffectivePdConfig, InternalAgentName, PDRuntimeAdapter } from '@principles/core/runtime-v2';
 import type { BehaviorExamplePack } from '@principles/core/runtime-v2';
+import { storeEmitter } from '@principles/core/runtime-v2';
+import { WorkspaceTelemetryEmitter } from '@principles/host-runtime';
 import { resolveRuntimeFromPdConfig } from '../services/resolve-runtime-from-pd-config.js';
 import { resolveRuleHostReadiness } from '../services/rulehost-readiness.js';
 import type { RuleHostReadinessResult } from '../services/rulehost-readiness.js';
@@ -254,6 +256,16 @@ function resolveRunRuleHostRuntime(
   agentRuntimeProfiles.artificer = artificerBinding.profileId;
   agentRuntimeProfiles.evaluator = evaluator.profileId;
 
+  // PRI-795 review P1: the CLI process is one-shot — without a durable sink
+  // the artificer_l2_complete evidence (abortOwner/budget/elapsed/stopReason/
+  // tokenUsage) dies with the process, repeating the EP002-R3
+  // "nothing recoverable after a failure" investigation gap. Reuse the
+  // host-runtime workspace-scoped emitter so completions land in
+  // <workspaceDir>/.pd/telemetry/critical-events.jsonl.
+  const artificerEmitter = new WorkspaceTelemetryEmitter(storeEmitter, workspaceDir, (detail) => {
+    console.error(`[run-rulehost] workspace telemetry persist failed: ${detail}`);
+  });
+
   const artificerAdapter = new ArtificerL2Adapter({
     provider: artificerProfile.provider,
     model: artificerProfile.model,
@@ -261,10 +273,19 @@ function resolveRunRuleHostRuntime(
     baseUrl: artificerProfile.baseUrl,
     gateDeps: createSandboxGateDeps(),
     validator: new DefaultArtificerValidator(),
-    totalBudgetMs: timeoutMs,
+    // PRI-795: fall back to the profile's timeoutMs when --timeout-ms is not
+    // given — parity with resolvePiAiAgentAdapter above. Previously the raw
+    // CLI option (possibly undefined) was passed, silently dropping the L2
+    // loop onto the adapter's 300s default regardless of the profile.
+    totalBudgetMs: timeoutMs ?? artificerProfile.timeoutMs,
     // Forward profile maxTokens — parity with the consumer-cycle adapter;
     // omitting it truncates long artificer JSON at the provider's default cap.
     ...(artificerProfile.maxTokens !== undefined ? { maxTokens: artificerProfile.maxTokens } : {}),
+    // PRI-795: forward profile reasoning so always-thinking models get a
+    // bounded thinking level on the L2 loop too — parity with the
+    // PiAiRuntimeAdapter wiring (it was previously L2-dropped).
+    ...(artificerProfile.reasoning !== undefined ? { reasoning: artificerProfile.reasoning } : {}),
+    eventEmitter: artificerEmitter,
   });
 
   return {

package/src/services/demo-rule-compiler.ts

@@ -1,63 +1,30 @@
 /**
- * Demo Rule Compiler — Minimal bridge for Story A demo runner
+ * Demo Rule Compiler — Minimal bridge for Story A demo runner and the
+ * rulehost pipeline behavior checks.
  *
  * PURPOSE: Compile rule implementation code strings into typed evaluate
- * functions for use in `evaluateInRefinerSandbox`. This allows the demo
- * to perform REAL canActivate validation instead of always returning success.
+ * functions for use in `evaluateInRefinerSandbox`.
  *
- * ARCHITECTURE: This intentionally duplicates the compilation logic from
- * `openclaw-plugin/src/core/rule-implementation-runtime.ts` because pd-cli
- * cannot depend on the bundled openclaw-plugin package. The compilation
- * logic is identical: normalize exports → vm compile → extract evaluate.
- *
- * NOT for production use — the openclaw-plugin's RuleHost uses its own
- * `loadRuleImplementationModule` for production code_tool_hook evaluation.
+ * ARCHITECTURE (PRI-809): compilation delegates to the canonical hardened
+ * replay evaluator in @principles/core — the vm realm with the JSON-string
+ * trust-boundary crossing (input + helpers rebuilt inside the realm), the
+ * same primitive the production gate uses. The previous local vm duplicate
+ * handed host-realm objects to the vm-realm evaluate function, which let
+ * unapproved rule code escape via `input.constructor.constructor`.
  */
 
-import * as vm from 'node:vm';
 import type { RuleHostInput, RuleHostResult } from '@principles/core/runtime-v2';
 import type { RuleHostHelpers } from '@principles/core/runtime-v2';
 import type { ReplayEvaluateFn } from '@principles/core/runtime-v2';
-import { safeStringifyPreview, validateRuleHostResult } from '@principles/core/runtime-v2';
-
-function normalizeSource(sourceCode: string): string {
-  const withoutExports = sourceCode
-    .replace(/export\s+const\s+meta\s*=/, 'const meta =')
-    .replace(/export\s+function\s+evaluate\s*\(/, 'function evaluate(');
-
-  return `${withoutExports}
-globalThis.__pdRuleModule = {
-  meta: typeof meta === 'undefined' ? undefined : meta,
-  evaluate: typeof evaluate === 'undefined' ? undefined : evaluate,
-};`;
-}
-
-function isRuleEvaluator(value: unknown): value is (input: RuleHostInput, helpers: RuleHostHelpers) => unknown {
-  return typeof value === 'function';
-}
+import { compileHardenedRuleEvaluator, safeStringifyPreview, validateRuleHostResult } from '@principles/core/runtime-v2';
 
 /**
  * Compile rule implementation code and return a typed evaluate function.
- * Mirrors `createReplayEvaluateFromCode` in openclaw-plugin.
  *
  * @throws if the code fails to compile or does not define a function evaluate
  */
 export function compileDemoRule(code: string, sourceLabel: string): ReplayEvaluateFn {
-  const context = vm.createContext(Object.create(null));
-  const script = new vm.Script(normalizeSource(code), {
-    filename: sourceLabel,
-  });
-
-  script.runInContext(context, { timeout: 1000, displayErrors: true });
-
-  const moduleExports = (context as { __pdRuleModule?: { meta?: unknown; evaluate?: unknown } }).__pdRuleModule;
-  delete (context as { __pdRuleModule?: unknown }).__pdRuleModule;
-
-  if (!moduleExports || !isRuleEvaluator(moduleExports.evaluate)) {
-    throw new Error(`[compileDemoRule] ${sourceLabel}: compiled module has no evaluate function`);
-  }
-
-  const evaluateFn = moduleExports.evaluate;
+  const evaluateFn = compileHardenedRuleEvaluator(code, sourceLabel);
   return (input: RuleHostInput, helpers: RuleHostHelpers): RuleHostResult => {
     const result = evaluateFn(input, helpers);
     const validation = validateRuleHostResult(result);
@@ -68,6 +35,6 @@ export function compileDemoRule(code: string, sourceLabel: string): ReplayEvalua
         })`,
       );
     }
-    return result as RuleHostResult;
+    return result;
   };
 }

package/src/services/rulehost-pipeline-runner.ts

@@ -17,10 +17,9 @@
  *   - The artificer↔evaluator stage delegates to `runAdversarialLoop` (PRI-428),
  *     which never throws and degrades to { decision: 'rejected' } with a reason.
  *   - gateDeps (the sandbox adapter) is built from `compileDemoRule` +
- *     `evaluateInRefinerSandbox`. Per the Explore finding, `compileDemoRule` is
- *     byte-equivalent to openclaw-plugin's `loadRuleImplementationModule`; the
- *     duplication is a package-boundary necessity (pd-cli cannot import
- *     openclaw-plugin), not a capability gap.
+ *     `evaluateInRefinerSandbox`. `compileDemoRule` delegates to the canonical
+ *     hardened replay evaluator in @principles/core (PRI-809), so pre-activation
+ *     replay crosses the same vm trust boundary as the production gate.
  *
  * @see docs/plans/rulehost-mvp-activation.md
  * @see runAdversarialLoop in @principles/core/runtime-v2
@@ -226,11 +225,9 @@ export interface RuleHostPipelineResult {
 /**
  * Build the sandbox gate deps for adversarial replay.
  *
- * `compileDemoRule` is byte-equivalent to openclaw-plugin's
- * `loadRuleImplementationModule` (same vm.createContext, same normalize, same
- * evaluate-shape check). pd-cli cannot import openclaw-plugin (package
- * boundary), so this duplicate is intentional and capability-identical, not a
- * stripped demo. See demo-rule-compiler.ts header comment.
+ * `compileDemoRule` delegates to the canonical hardened replay evaluator in
+ * @principles/core (PRI-809) — capability-identical across packages without a
+ * duplicate vm implementation. See demo-rule-compiler.ts header comment.
  */
 export function createSandboxGateDeps(): RefinerRuleHostGateDeps {
   return {

package/tests/commands/build-trajectory-evidence.test.ts

@@ -400,3 +400,109 @@ describe('acquireTrajectoryEvidenceFromDb — typed CLI acquisition (PRI-642 Sco
     expect(unreadable.reasonCode).toBe('evidence_read_failed');
   });
 });
+
+// ── PRI-783 review P1: the binding fact gates degrade vs refuse ─────────────
+// 'verified' = the sessions table was queried and DID contain the id;
+// 'unverified' = DB missing / unopenable / id absent / sessions table
+// unreadable. Only verified bindings may degrade to a bound submission.
+
+describe('acquisition binding fact (PRI-783 review P1)', () => {
+  beforeEach(() => {
+    createStateDir();
+  });
+
+  afterEach(() => {
+    try {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+      // ignore cleanup errors
+    }
+  });
+
+  it('session present with zero evidence → empty_trajectory, binding verified (degrade precondition)', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = createTrajectoryDb();
+    db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
+      .run('quiet-session', '2026-01-01T09:00:00Z', '2026-01-01T09:00:00Z');
+    insertUserTurn(db, 'quiet-session', 'ordinary message', false, '2026-01-01T09:01:00Z');
+    db.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'quiet-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('empty_trajectory');
+    expect(result.binding).toBe('verified');
+  });
+
+  it('id absent from sessions table → session_not_found, binding unverified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = createTrajectoryDb();
+    db.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'no-such-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('session_not_found');
+    expect(result.binding).toBe('unverified');
+  });
+
+  it('missing trajectory.db → trajectory_unavailable, binding unverified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'some-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('trajectory_unavailable');
+    expect(result.binding).toBe('unverified');
+  });
+
+  it('corrupt DB (open fails) → evidence_read_failed, binding unverified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const dbPath = path.join(stateDir, 'trajectory.db');
+    fs.writeFileSync(dbPath, Buffer.from('this is not a sqlite database at all'));
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'some-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('evidence_read_failed');
+    expect(result.binding).toBe('unverified');
+  });
+
+  it('session verified but evidence tables unreadable → evidence_read_failed, binding verified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = createTrajectoryDb();
+    db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
+      .run('readable-session', '2026-01-01T09:00:00Z', '2026-01-01T09:00:00Z');
+    db.close();
+    // Drop the evidence tables after the session row exists: the sessions
+    // check passed, the evidence read cannot.
+    const raw = new Database(path.join(stateDir, 'trajectory.db'));
+    raw.exec('DROP TABLE user_turns');
+    raw.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'readable-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('evidence_read_failed');
+    expect(result.binding).toBe('verified');
+  });
+
+  it('sessions table missing entirely → nothing is verified (unverified even when the reason is evidence_read_failed)', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = new Database(path.join(stateDir, 'trajectory.db'));
+    db.exec('CREATE TABLE user_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, raw_excerpt TEXT, correction_detected INTEGER NOT NULL DEFAULT 0, correction_cue TEXT, created_at TEXT NOT NULL)');
+    db.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'never-seen', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    // assistant_turns/tool_calls tables missing → readFailed → evidence_read_failed
+    expect(result.reasonCode).toBe('evidence_read_failed');
+    expect(result.binding).toBe('unverified');
+  });
+});

package/tests/commands/pain-record-session-parser.test.ts

@@ -13,6 +13,7 @@ import Database from 'better-sqlite3';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
+import { acquireTrajectoryEvidenceFromDb } from '../../src/commands/build-trajectory-evidence.js';
 
 let tmpDir: string;
 
@@ -24,7 +25,12 @@ function createWorkspace(): void {
   const db = new Database(path.join(stateDir, 'trajectory.db'));
   db.exec("CREATE TABLE IF NOT EXISTS sessions (session_id TEXT PRIMARY KEY, started_at TEXT, updated_at TEXT)");
   db.exec("CREATE TABLE IF NOT EXISTS assistant_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, sanitized_text TEXT, stop_reason TEXT, created_at TEXT NOT NULL)");
-  db.exec("CREATE TABLE IF NOT EXISTS user_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, raw_excerpt TEXT, correction_detected INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL)");
+  // PRI-783 lesson recorded on the fixture: user_turns MUST carry
+  // correction_cue — collectEvidenceFromDb SELECTs it, and a missing column
+  // silently degraded the user-turns read into evidence_read_failed, so this
+  // file's 'accepts --session' case never actually exercised a real evidence
+  // read (it vacuously asserted on a refusal).
+  db.exec("CREATE TABLE IF NOT EXISTS user_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, raw_excerpt TEXT, correction_detected INTEGER NOT NULL DEFAULT 0, correction_cue TEXT, created_at TEXT NOT NULL)");
   db.exec("CREATE TABLE IF NOT EXISTS tool_calls (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, tool_name TEXT NOT NULL, outcome TEXT NOT NULL, error_type TEXT, exit_code INTEGER, params_json TEXT NOT NULL DEFAULT '{}', result_preview TEXT, created_at TEXT NOT NULL)");
   db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
     .run('real-session-1', '2026-01-01T09:00:00Z', '2026-01-01T09:00:00Z');
@@ -157,22 +163,66 @@ describe('pd pain record --session (real Commander + real trajectory.db)', () =>
     expect(typeof parsed.nextAction).toBe('string');
   }, 15_000);
 
-  it('accepts --session for a session that exists in the trajectory (validation passes, submission proceeds)', async () => {
+  it('accepts --session for a session that exists in the trajectory (real acquisition returns available evidence)', async () => {
+    // The spawned-CLI route is used above for the refusal contracts. The
+    // acceptance route ends in the diagnostician pipeline (out of this file's
+    // scope — the service has its own suite), so the acceptance boundary is
+    // asserted against the REAL acquisition function the CLI delegates to,
+    // over this file's real trajectory.db fixture (cli-7: real parser wiring
+    // is covered by the refusal spawns; real DB semantics here — PRI-783).
+    const stateDir = path.join(tmpDir, '.state');
+    const acquisition = acquireTrajectoryEvidenceFromDb(stateDir, 'real-session-1', tmpDir);
+
+    expect(acquisition.status).toBe('available');
+    if (acquisition.status !== 'available') return;
+    expect(acquisition.entries.length).toBeGreaterThanOrEqual(1);
+    expect(acquisition.entries.some(e => e.sourceRef.startsWith('owner_message:'))).toBe(true);
+  }, 15_000);
+
+  // ── PRI-783 review P1: unverified bindings must refuse, never persist ──────
+
+  it('locks the review P1: --session with a missing trajectory.db refuses and NEVER creates a db containing the fake id', async () => {
+    // Remove the fixture db so the id cannot be verified at all (the shared
+    // createWorkspace always seeds one). The run must fail loud
+    // (trajectory_unavailable) BEFORE any mutation — the observability writer
+    // must not create a trajectory.db and upsert the unverified id into
+    // sessions (self-proving loop).
+    fs.rmSync(path.join(tmpDir, '.state', 'trajectory.db'), { force: true });
     const result = await runBuiltCli([
       'pain', 'record',
-      '--reason', 'parser test pain with real session',
-      '--session', 'real-session-1',
+      '--reason', 'PRI-783 review P1 lock',
+      '--session', 'fake-unverified-id',
       '--workspace', tmpDir,
       '--json',
     ]);
 
-    // The session exists, so session validation must NOT reject it. The run
-    // may still fail later (no LLM runtime configured in this temp
-    // workspace) — the assertion is only about the validation stage.
-    const trimmed = result.stdout.trim();
-    expect(trimmed.length).toBeGreaterThan(0);
-    const parsed = JSON.parse(trimmed) as Record<string, unknown>;
-    expect(parsed.reason).not.toBe('session_not_found');
-    expect(parsed.reason).not.toBe('empty_trajectory');
+    expect(result.status).not.toBe(0);
+    const parsed = JSON.parse(result.stdout.trim()) as Record<string, unknown>;
+    expect(parsed.status).toBe('failed');
+    expect(parsed.reason).toBe('trajectory_unavailable');
+    expect(parsed.nextAction).not.toMatch(/pd pain record --session/);
+    // The lock: no trajectory.db was created by this run — the fake id can
+    // never appear in a sessions table.
+    expect(fs.existsSync(path.join(tmpDir, '.state', 'trajectory.db'))).toBe(false);
+  }, 15_000);
+
+  it('real empty session reports empty_trajectory with a VERIFIED binding (the degrade precondition)', async () => {
+    // Gate the degrade path on the real acquisition semantics: a session
+    // row that exists with zero evidence rows is the only unavailable shape
+    // allowed to degrade to a bound submission.
+    const stateDir = path.join(tmpDir, '.state');
+    const db = new Database(path.join(stateDir, 'trajectory.db'));
+    db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
+      .run('real-empty-session', '2026-01-01T08:00:00Z', '2026-01-01T08:00:00Z');
+    db.prepare('INSERT INTO user_turns (session_id, raw_excerpt, correction_detected, correction_cue, created_at) VALUES (?, ?, ?, ?, ?)')
+      .run('real-empty-session', 'ordinary message, not a correction', 0, null, '2026-01-01T08:01:00Z');
+    db.close();
+
+    const acquisition = acquireTrajectoryEvidenceFromDb(stateDir, 'real-empty-session', tmpDir);
+
+    expect(acquisition.status).toBe('unavailable');
+    if (acquisition.status !== 'unavailable') return;
+    expect(acquisition.reasonCode).toBe('empty_trajectory');
+    expect(acquisition.binding).toBe('verified');
   }, 15_000);
 });