@principles/pd-cli 1.152.7 → 1.152.9

package/tests/commands/run-rulehost-handler.test.ts

@@ -711,3 +711,46 @@ describe('handleRunRuleHost — PR #1122 behavior-examples fail-fast (CodeRabbit
     expect(stdout).toMatch(/Next: fix the code-rule capability issue above/);
   });
 });
+
+// ── Owner Decision v1 review fix (Codex P1): identity-gated publication ─────
+
+describe('describePublicationOutcome — identity-gated refusal reporting (Codex P1)', () => {
+  const baseResult = {
+    decision: 'candidate_ready_for_owner_review' as const,
+    painId: 'pain-1',
+    stages: [],
+    scribeTaskId: 'scribe-1',
+    ruleArtifactId: 'pi-rule-1' as string | null,
+    principleArtifactId: null as string | null,
+    approvalId: null as string | null,
+    degradationReason: null as string | null,
+  };
+
+  it('flags the identity-blocked state and provides a repair nextAction', async () => {
+    const { describePublicationOutcome } = await import('../../src/commands/runtime-internalization-run-rulehost.js');
+    const outcome = describePublicationOutcome({
+      ...baseResult,
+      degradationReason: 'identity_binding_unverified: ledger_missing. Rule artifact NOT enqueued for Owner review (governance publication boundary).',
+    });
+    expect(outcome.blocked).toBe(true);
+    expect(outcome.nextAction).toContain('NOT enqueued');
+    expect(outcome.nextAction).toContain('re-run');
+  });
+
+  it('does not flag a healthy ready result with a real approval id', async () => {
+    const { describePublicationOutcome } = await import('../../src/commands/runtime-internalization-run-rulehost.js');
+    const outcome = describePublicationOutcome({ ...baseResult, approvalId: 'apr-1' });
+    expect(outcome.blocked).toBe(false);
+  });
+
+  it('text output for the identity-blocked result never claims WAITING for owner review', async () => {
+    const { formatTextOutput } = await import('../../src/commands/runtime-internalization-run-rulehost.js');
+    const text = formatTextOutput({
+      ...baseResult,
+      degradationReason: 'identity_binding_unverified: ledger_missing. Rule artifact NOT enqueued for Owner review (governance publication boundary).',
+    });
+    expect(text).toContain('PUBLICATION REFUSED');
+    expect(text).not.toContain('WAITING for owner review');
+    expect(text).toContain('NOT enqueued for Owner review');
+  });
+});

package/tests/commands/runtime-features.test.ts

@@ -59,7 +59,6 @@ function makeValidConfigYaml(): string {
         evaluator: { enabled: false },
         rolloutReviewer: { enabled: false },
         correctionObserver: { enabled: false },
-        empathyObserver: { enabled: false },
       },
     },
     ui: { diagnostics: { mode: 'simple' } },

package/tests/commands/runtime-internalization-run-once-language.test.ts

@@ -72,7 +72,6 @@ function makeWorkspace(outputLanguage?: 'en'): string {
           evaluator: { enabled: false },
           rolloutReviewer: { enabled: false },
           correctionObserver: { enabled: false },
-          empathyObserver: { enabled: false },
         },
       },
       ui: { diagnostics: { mode: 'simple' } },

package/tests/commands/runtime-internalization-run-once-rollout-parity.test.ts

@@ -598,6 +598,31 @@ async function readDispatchOutcome(sm: RuntimeStateManager, workspaceDir: string
   }
 }
 
+/** PRI-811 Phase B: read the pending approval row a rollout recommendation must produce. */
+async function readPendingApproval(
+  workspaceDir: string,
+  artifactId: string,
+  channel: 'prompt' | 'code_tool_hook' | 'defer_archive',
+): Promise<{ artifactId: string; channel: string; status: string } | null> {
+  const connection = new SqliteConnection(workspaceDir);
+  try {
+    const rows = connection.getDb().prepare(
+      'SELECT artifact_id, channel, status FROM approvals WHERE artifact_id = ? AND channel = ? AND status = \'pending\''
+    ).all(artifactId, channel) as unknown;
+    if (!Array.isArray(rows) || rows.length === 0) return null;
+    const row: unknown = rows[0];
+    if (typeof row !== 'object' || row === null || Array.isArray(row)) return null;
+    const record = row as Record<string, unknown>;
+    return {
+      artifactId: String(record['artifact_id']),
+      channel: String(record['channel']),
+      status: String(record['status']),
+    };
+  } finally {
+    try { connection.close(); } catch { /* best-effort */ }
+  }
+}
+
 describe('PRI-713 dispatch parity: approve_rollout through the run-once entry', () => {
   const dirs: string[] = [];
   const states: RuntimeStateManager[] = [];
@@ -631,13 +656,13 @@ describe('PRI-713 dispatch parity: approve_rollout through the run-once entry',
     // rollout 侧: dispatch 完成治理迁移 — 无 NHR、任务 succeeded
     expect(outcome.rolloutStatus).toBe('succeeded');
     expect(outcome.humanReviewReasonCode).toBeUndefined();
-    // 激活事实: prompt 渠道低风险 auto_activate — activations 表有持久记录,
-    // 幂等键 = <scribe artifact>::prompt, activationId 由 PromptWriter 生成
-    expect(outcome.activation).not.toBeNull();
-    expect(outcome.activation!.artifactId).toBe(SCRIBE_ART);
-    expect(outcome.activation!.channel).toBe('prompt');
-    expect(outcome.activation!.activationId).toBe('act_prompt_parity-p');
-    expect(outcome.activation!.deactivatedAt).toBeNull();
+    // PRI-811 Phase B: prompt 渠道推荐只入 approval 队列, activations 表无行;
+    // 幂等键 = <scribe artifact>::prompt 等待 Owner 批准
+    expect(outcome.activation).toBeNull();
+    const pending = await readPendingApproval(ws, SCRIBE_ART, 'prompt');
+    expect(pending).not.toBeNull();
+    expect(pending!.artifactId).toBe(SCRIBE_ART);
+    expect(pending!.channel).toBe('prompt');
   });
 
   it('EQUIVALENCE: production consumer-cycle assembly on the same durable input yields the same dispatch outcome', async () => {
@@ -672,9 +697,10 @@ describe('PRI-713 dispatch parity: approve_rollout through the run-once entry',
     const outcome = await readDispatchOutcome(sm, ws, rolloutTaskId);
     expect(outcome.rolloutStatus).toBe('succeeded');
     expect(outcome.humanReviewReasonCode).toBeUndefined();
-    expect(outcome.activation).not.toBeNull();
-    expect(outcome.activation!.artifactId).toBe(SCRIBE_ART);
-    expect(outcome.activation!.channel).toBe('prompt');
-    expect(outcome.activation!.activationId).toBe('act_prompt_parity-p');
+    expect(outcome.activation).toBeNull();
+    const pending = await readPendingApproval(ws, SCRIBE_ART, 'prompt');
+    expect(pending).not.toBeNull();
+    expect(pending!.artifactId).toBe(SCRIBE_ART);
+    expect(pending!.channel).toBe('prompt');
   });
 });

package/tests/e2e/cross-package-acceptance.test.ts

@@ -56,6 +56,7 @@ import {
   createPITaskDiagnosticJson,
 } from '@principles/core/runtime-v2';
 import type { PIArtifactSnapshot, RuleHostInput } from '@principles/core/runtime-v2';
+import { addPrincipleToLedger } from '@principles/core/principle-tree-ledger';
 
 // ── Scripted adapter (same pattern as rulehost-pipeline-runner.test.ts) ──────
 
@@ -236,11 +237,11 @@ function makeTmpDir(): string {
   return dir;
 }
 
-async function seedDreamerWithId(sm: RuntimeStateManager, taskId: string, painId: string): Promise<void> {
+async function seedDreamerWithId(sm: RuntimeStateManager, taskId: string, painId: string, candidateId?: string): Promise<void> {
   const baseMetadata = JSON.parse(createPITaskDiagnosticJson({
     dependencyTaskIds: [], channel: 'code_tool_hook', timeoutMs: 1000, inputArtifactRefs: [], outputArtifactRefs: [],
   })) as Record<string, unknown>;
-  const diagnosticJson = JSON.stringify({ ...baseMetadata, sourcePainId: painId });
+  const diagnosticJson = JSON.stringify({ ...baseMetadata, sourcePainId: painId, ...(candidateId ? { candidateId } : {}) });
   await sm.createTask({ taskId, taskKind: 'dreamer', status: 'pending', attemptCount: 0, maxAttempts: 3, diagnosticJson });
 }
 
@@ -270,8 +271,17 @@ describe('Cross-Package Acceptance Test (PRI-408 P1/P2 fixes) — unsplippable c
     tmpDir = makeTmpDir();
     const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
     await sm.initialize();
-    await seedDreamerWithId(sm, 'dreamer-xpkg-001', 'pain-xpkg-001');
+    // Owner Decision Experience v1 Phase A: the governance publication boundary
+    // requires a verified chain identity (candidateId → unique ledger entry),
+    // mirroring what the intake bridge creates in production workspaces.
+    await seedDreamerWithId(sm, 'dreamer-xpkg-001', 'pain-xpkg-001', 'cand-xpkg-001');
     await sm.close();
+    addPrincipleToLedger(path.join(tmpDir, '.state'), {
+      id: 'ledger-xpkg-001', version: 1, text: 'cross-package ledger principle', triggerPattern: '', action: '',
+      status: 'candidate', evaluability: 'weak_heuristic', priority: 'P1', scope: 'general',
+      valueScore: 0, adherenceRate: 0, painPreventedCount: 0, derivedFromPainIds: ['cand-xpkg-001'],
+      ruleIds: [], conflictsWithPrincipleIds: [], createdAt: '2026-09-15T00:00:00.000Z', updatedAt: '2026-09-15T00:00:00.000Z',
+    });
 
     // ── Step 2: Run RuleHost pipeline → candidate + auto-enqueue (P1 #1) ───
     const adapter = makeAdapter();

package/tests/services/pd-config-loader.test.ts

@@ -76,7 +76,6 @@ function makeValidConfigYaml(): string {
         evaluator: { enabled: false },
         rolloutReviewer: { enabled: false },
         correctionObserver: { enabled: false },
-        empathyObserver: { enabled: false },
       },
     },
     ui: { diagnostics: { mode: 'simple' } },

package/tests/services/rulehost-pipeline-runner.test.ts

@@ -16,10 +16,11 @@ import { describe, it, expect, afterEach, vi } from 'vitest';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
-import { runRuleHostPipeline } from '../../src/services/rulehost-pipeline-runner.js';
+import { runRuleHostPipeline, backfillScribeIdentity } from '../../src/services/rulehost-pipeline-runner.js';
 import type { CodeRuleCapability } from '../../src/services/rulehost-pipeline-runner.js';
 import type { PDRuntimeAdapter, RunHandle, RunStatus, PIArtifactStore, RuntimeCapabilities, RuntimeHealth, RuntimeArtifactRef, ContextItem, StructuredRunOutput, StartRunInput } from '@principles/core/runtime-v2';
-import { RuntimeStateManager, createPITaskDiagnosticJson } from '@principles/core/runtime-v2';
+import { RuntimeStateManager, createPITaskDiagnosticJson, SqliteApprovalQueueStore } from '@principles/core/runtime-v2';
+import { addPrincipleToLedger, updatePrinciple } from '@principles/core/principle-tree-ledger';
 import { saveHostToolDeclaration } from '@principles/host-runtime';
 
 type StageFactory = (taskId: string, priorArtifactId?: string) => unknown;
@@ -248,11 +249,12 @@ async function seedDreamerWithId(
   taskId: string,
   painId: string,
   channel: 'prompt' | 'code_tool_hook' | 'defer_archive' = 'code_tool_hook',
+  candidateId?: string,
 ): Promise<void> {
   const baseMetadata = JSON.parse(createPITaskDiagnosticJson({
     dependencyTaskIds: [], channel, timeoutMs: 1000, inputArtifactRefs: [], outputArtifactRefs: [],
   })) as Record<string, unknown>;
-  const diagnosticJson = JSON.stringify({ ...baseMetadata, sourcePainId: painId });
+  const diagnosticJson = JSON.stringify({ ...baseMetadata, sourcePainId: painId, ...(candidateId ? { candidateId } : {}) });
   await sm.createTask({ taskId, taskKind: 'dreamer', status: 'pending', attemptCount: 0, maxAttempts: 3, diagnosticJson });
 }
 
@@ -270,12 +272,18 @@ describe('runRuleHostPipeline (PRI-429) — atomic capability + exact pain match
   });
 
   // ── Test 1: Capability ON + approved → candidate_ready_for_owner_review ──
-  it('capability ON + evaluator approved → candidate_ready_for_owner_review', async () => {
+  it('capability ON + evaluator approved → candidate_ready_for_owner_review; scribe identity backfilled on the rule path too (EP002-R4 follow-up #2)', async () => {
     tmpDir = makeTmpDir();
     const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
     await sm.initialize();
-    await seedDreamerWithId(sm, 'dreamer-seeded-001', 'pain-test-001');
+    await seedDreamerWithId(sm, 'dreamer-seeded-001', 'pain-test-001', 'code_tool_hook', 'cand-001');
     await sm.close();
+    addPrincipleToLedger(path.join(tmpDir, '.state'), {
+      id: 'ledger-principle-001', version: 1, text: 'test ledger principle', triggerPattern: '', action: '',
+      status: 'candidate', evaluability: 'weak_heuristic', priority: 'P1', scope: 'general',
+      valueScore: 0, adherenceRate: 0, painPreventedCount: 0, derivedFromPainIds: ['cand-001'],
+      ruleIds: [], conflictsWithPrincipleIds: [], createdAt: '2026-09-15T00:00:00.000Z', updatedAt: '2026-09-15T00:00:00.000Z',
+    });
 
     const adapter = makeAdapter();
     const capability: CodeRuleCapability = { enabled: true, artificerAdapter: adapter };
@@ -292,6 +300,23 @@ describe('runRuleHostPipeline (PRI-429) — atomic capability + exact pain match
     expect(result.ruleArtifactId).not.toBeNull();
     // P1 #1 fix: candidate should be auto-enqueued into the ApprovalQueue
     expect(result.approvalId).not.toBeNull();
+
+    // EP002-R4 follow-up #2: the scribe artifact carries the LEDGER UUID (not
+    // a title) so the evaluator propagates it into the rule artifact and the
+    // Console groups the approval by an id the detail page can resolve.
+    const verify = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await verify.initialize();
+    try {
+      const scribeArt = await verify.piArtifactStore.getArtifactById(
+        (await verify.piArtifactStore.listBySourceTaskId(result.stages.find((s) => s.name === 'scribe')!.taskId!))
+          .find((a) => a.artifactKind === 'principle')!.artifactId,
+      );
+      expect(scribeArt?.sourcePrincipleId).toBe('ledger-principle-001');
+      const ruleArt = await verify.piArtifactStore.getArtifactById(result.ruleArtifactId!);
+      expect(ruleArt?.sourcePrincipleId).toBe('ledger-principle-001');
+    } finally {
+      await verify.close();
+    }
   }, 60_000);
 
   it('adversarial feedback loop drives a second artificer round before creating a candidate', async () => {
@@ -350,17 +375,29 @@ describe('runRuleHostPipeline (PRI-429) — atomic capability + exact pain match
     expect(artificerPrompts[1]).toContain('Prior adversarial replay failures');
     expect(result.decision, JSON.stringify(result)).toBe('candidate_ready_for_owner_review');
     expect(result.ruleArtifactId).toMatch(/^pi-rule-/);
-    // P1 #1 fix: candidate should be auto-enqueued into the ApprovalQueue
-    expect(result.approvalId).not.toBeNull();
+    // Owner Decision Experience v1 Phase A: this seed carries no candidateId and
+    // no ledger principle, so identity binding is unverified (candidate_unresolved)
+    // and the governance publication boundary refuses the approval enqueue — the
+    // two-round adversarial loop itself is unaffected.
+    expect(result.approvalId).toBeNull();
+    expect(result.degradationReason ?? '').toContain('identity_binding_unverified');
   }, 60_000);
 
   // ── Test 2: Capability OFF (explicitly disabled) → text_principle_only ──
-  it('capability OFF (explicitly disabled) → text_principle_only', async () => {
+  it('capability OFF (explicitly disabled) → text_principle_only + prompt approval enqueue + identity backfill (PRI-804)', async () => {
     tmpDir = makeTmpDir();
     const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
     await sm.initialize();
-    await seedDreamerWithId(sm, 'dreamer-seeded-002', 'pain-test-001');
+    await seedDreamerWithId(sm, 'dreamer-seeded-002', 'pain-test-001', 'code_tool_hook', 'cand-002');
     await sm.close();
+    // PRI-804(a): seed the ledger with the principle this chain's candidate maps
+    // to, mirroring what the intake bridge creates in production workspaces.
+    addPrincipleToLedger(path.join(tmpDir, '.state'), {
+      id: 'ledger-principle-002', version: 1, text: 'test ledger principle', triggerPattern: '', action: '',
+      status: 'candidate', evaluability: 'weak_heuristic', priority: 'P1', scope: 'general',
+      valueScore: 0, adherenceRate: 0, painPreventedCount: 0, derivedFromPainIds: ['cand-002'],
+      ruleIds: [], conflictsWithPrincipleIds: [], createdAt: '2026-09-15T00:00:00.000Z', updatedAt: '2026-09-15T00:00:00.000Z',
+    });
 
     const adapter = makeAdapter();
     const capability: CodeRuleCapability = { enabled: false, disabledReason: 'artificer agent disabled in config' };
@@ -380,6 +417,29 @@ describe('runRuleHostPipeline (PRI-429) — atomic capability + exact pain match
     // Adversarial loop stage should be skipped (not present or skipped status).
     const advStage = result.stages.find((s) => s.name === 'adversarial_loop');
     expect(advStage?.status).toBe('skipped');
+
+    // PRI-804: the text principle must NOT dead-end — it is enqueued into the
+    // EXISTING approval queue on the prompt channel for Owner Console review.
+    expect(result.approvalId).not.toBeNull();
+    expect(result.approvalId).toBe(`apr_prompt_${result.principleArtifactId}`);
+
+    // Verify the persisted approval row, the PRI-804(a) identity backfill, and
+    // the terminal validation marking (real store, real SQLite, real ledger).
+    const verify = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await verify.initialize();
+    try {
+      const approvalStore = new SqliteApprovalQueueStore(verify.connection);
+      const record = await approvalStore.getById(result.approvalId!);
+      expect(record).not.toBeNull();
+      expect(record!.status).toBe('pending');
+      expect(record!.channel).toBe('prompt');
+      expect(record!.artifactId).toBe(result.principleArtifactId);
+      const artifact = await verify.piArtifactStore.getArtifactById(result.principleArtifactId!);
+      expect(artifact?.sourcePrincipleId).toBe('ledger-principle-002');
+      expect(artifact?.validationStatus).toBe('validated');
+    } finally {
+      await verify.close();
+    }
   }, 60_000);
 
   // ── Test 3: Capability ON + evaluator rejected → generation_rejected ──
@@ -626,8 +686,14 @@ describe('runRuleHostPipeline (PRI-429) — atomic capability + exact pain match
     expect(dreamerCallCount).toBe(2);
     expect(dreamerStage?.status).toBe('succeeded');
     expect(result.decision).toBe('candidate_ready_for_owner_review');
-    // P1 #1 fix: candidate should be auto-enqueued into the ApprovalQueue
-    expect(result.approvalId).not.toBeNull();
+    // Owner Decision Experience v1 Phase A: this seed carries NO candidateId,
+    // so the chain cannot bind a ledger principle (candidate_unresolved). The
+    // rule artifact is produced and preserved, but the governance publication
+    // boundary REFUSES to create an Owner approval subject for it.
+    expect(result.approvalId).toBeNull();
+    expect(result.degradationReason ?? '').toContain('identity_binding_unverified');
+    expect(result.degradationReason ?? '').toContain('candidate_unresolved');
+    expect(result.ruleArtifactId).not.toBeNull();
   }, 60_000);
 
   // ── Test 9 (E fix): retried status exhausted → stage marked 'degraded' ──
@@ -705,7 +771,6 @@ function writeLanguageConfig(dir: string, outputLanguage?: 'en'): void {
         evaluator: { enabled: false },
         rolloutReviewer: { enabled: false },
         correctionObserver: { enabled: false },
-        empathyObserver: { enabled: false },
       },
     },
     ui: { diagnostics: { mode: 'simple' } },
@@ -807,3 +872,304 @@ describe('runRuleHostPipeline — outputLanguage reaches adapter.startRun messag
     expect(dreamer?.payload).toContain('dreamer-lang-zh-001');
   }, 60_000);
 });
+
+// ── Owner Decision Experience v1 Phase A — identity fix-forward (SPEC §9) ────
+//
+// §9.4 deterministic acceptance slice, exercised against the REAL production
+// path (real RuntimeStateManager, real SQLite, real ledger adapter):
+//   success / ledger missing / ambiguous / conflict / write failure / replay.
+// Failure slices must prove: NO approval enqueue, NO activation, NO duplicate
+// ledger — while the generated artifacts stay preserved for later replay.
+
+describe('runRuleHostPipeline — Phase A governance publication boundary (identity fix-forward)', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    if (tmpDir) { try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch { /* ignore */ } tmpDir = ''; }
+  });
+
+  function seedLedger(dir: string, id: string, candidateId: string): void {
+    addPrincipleToLedger(path.join(dir, '.state'), {
+      id, version: 1, text: `principle ${id}`, triggerPattern: '', action: '',
+      status: 'candidate', evaluability: 'weak_heuristic', priority: 'P1', scope: 'general',
+      valueScore: 0, adherenceRate: 0, painPreventedCount: 0, derivedFromPainIds: [candidateId],
+      ruleIds: [], conflictsWithPrincipleIds: [], createdAt: '2026-09-15T00:00:00.000Z', updatedAt: '2026-09-15T00:00:00.000Z',
+    });
+  }
+
+  async function countApprovalsForArtifact(dir: string, artifactId: string): Promise<number> {
+    const verify = new RuntimeStateManager({ workspaceDir: dir });
+    await verify.initialize();
+    try {
+      const rows = verify.connection.getDb()
+        .prepare('SELECT COUNT(*) AS n FROM approvals WHERE artifact_id = ?').all(artifactId);
+      const first = rows[0] as { n: number } | undefined;
+      return first?.n ?? 0;
+    } finally {
+      await verify.close();
+    }
+  }
+
+  async function countActivations(dir: string): Promise<number> {
+    const verify = new RuntimeStateManager({ workspaceDir: dir });
+    await verify.initialize();
+    try {
+      const rows = verify.connection.getDb().prepare('SELECT COUNT(*) AS n FROM activations').all();
+      const first = rows[0] as { n: number } | undefined;
+      return first?.n ?? 0;
+    } finally {
+      await verify.close();
+    }
+  }
+
+  async function ledgerPrincipleCount(dir: string): Promise<number> {
+    const ledgerPath = path.join(dir, '.state', 'principle_training_state.json');
+    if (!fs.existsSync(ledgerPath)) return 0; // no ledger file yet = zero principles
+    const parsed = JSON.parse(fs.readFileSync(ledgerPath, 'utf8')) as { _tree?: { principles?: Record<string, unknown> } };
+    return Object.keys(parsed._tree?.principles ?? {}).length;
+  }
+
+  it('ledger_missing: rule artifact preserved, but NO approval subject, NO activation, ledger untouched', async () => {
+    tmpDir = makeTmpDir();
+    const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await sm.initialize();
+    await seedDreamerWithId(sm, 'dreamer-id-missing', 'pain-id-missing', 'code_tool_hook', 'cand-no-ledger');
+    await sm.close();
+    // Deliberately NO ledger principle for cand-no-ledger.
+
+    const adapter = makeAdapter();
+    const result = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-id-missing', runtimeAdapter: adapter,
+      channel: 'code_tool_hook', pollIntervalMs: 5, timeoutMs: 1000,
+      codeRuleCapability: { enabled: true, artificerAdapter: adapter },
+      behaviorExamplePack: PIPE_PACK,
+      onStoreReady: (store) => { adapter.artifactStore = store; },
+    });
+
+    expect(result.decision, JSON.stringify(result)).toBe('candidate_ready_for_owner_review');
+    // The generation chain produced and PRESERVED its artifacts…
+    expect(result.ruleArtifactId).not.toBeNull();
+    // …but the publication boundary refused to create an Owner approval subject.
+    expect(result.approvalId).toBeNull();
+    expect(result.degradationReason ?? '').toContain('identity_binding_unverified');
+    expect(result.degradationReason ?? '').toContain('ledger_missing');
+    expect(await countApprovalsForArtifact(tmpDir, result.ruleArtifactId!)).toBe(0);
+    expect(await countActivations(tmpDir)).toBe(0);
+    expect(await ledgerPrincipleCount(tmpDir)).toBe(0);
+  }, 60_000);
+
+  it('ledger_ambiguous: two ledger targets for one candidate refuse publication and refuse a silent first-match binding', async () => {
+    tmpDir = makeTmpDir();
+    const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await sm.initialize();
+    await seedDreamerWithId(sm, 'dreamer-id-ambiguous', 'pain-id-ambiguous', 'code_tool_hook', 'cand-ambiguous');
+    await sm.close();
+    seedLedger(tmpDir, 'ledger-A', 'cand-ambiguous');
+    seedLedger(tmpDir, 'ledger-B', 'cand-ambiguous');
+
+    const adapter = makeAdapter();
+    const result = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-id-ambiguous', runtimeAdapter: adapter,
+      channel: 'code_tool_hook', pollIntervalMs: 5, timeoutMs: 1000,
+      codeRuleCapability: { enabled: true, artificerAdapter: adapter },
+      behaviorExamplePack: PIPE_PACK,
+      onStoreReady: (store) => { adapter.artifactStore = store; },
+    });
+
+    expect(result.decision).toBe('candidate_ready_for_owner_review');
+    expect(result.approvalId).toBeNull();
+    expect(result.degradationReason ?? '').toContain('ledger_ambiguous');
+    expect(await countApprovalsForArtifact(tmpDir, result.ruleArtifactId!)).toBe(0);
+    // The scribe artifact must NOT be silently bound to the first match.
+    const verify = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await verify.initialize();
+    try {
+      const scribeTaskId = result.stages.find((s) => s.name === 'scribe')!.taskId!;
+      const scribeArt = (await verify.piArtifactStore.listBySourceTaskId(scribeTaskId)).find((a) => a.artifactKind === 'principle');
+      expect(scribeArt?.sourcePrincipleId).toBeUndefined();
+    } finally {
+      await verify.close();
+    }
+  }, 60_000);
+
+  it('identity_conflict: an existing binding to a different ledger target is never overwritten (§9.1.7)', async () => {
+    tmpDir = makeTmpDir();
+    const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await sm.initialize();
+    await seedDreamerWithId(sm, 'dreamer-id-conflict', 'pain-id-conflict', 'code_tool_hook', 'cand-conflict');
+    await sm.close();
+    seedLedger(tmpDir, 'ledger-original', 'cand-conflict');
+
+    const adapter = makeAdapter();
+    const first = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-id-conflict', runtimeAdapter: adapter,
+      channel: 'code_tool_hook', pollIntervalMs: 5, timeoutMs: 1000,
+      codeRuleCapability: { enabled: true, artificerAdapter: adapter },
+      behaviorExamplePack: PIPE_PACK,
+      onStoreReady: (store) => { adapter.artifactStore = store; },
+    });
+    expect(first.approvalId).not.toBeNull();
+
+    // Repoint the candidate: detach it from the original principle so the
+    // chain now resolves to a DIFFERENT (still unique) target. Otherwise the
+    // plural lookup would correctly report ledger_ambiguous, not a conflict.
+    updatePrinciple(path.join(tmpDir, '.state'), 'ledger-original', { derivedFromPainIds: [] });
+    seedLedger(tmpDir, 'ledger-replacement', 'cand-conflict');
+    const verify = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await verify.initialize();
+    try {
+      const scribeTaskId = first.stages.find((s) => s.name === 'scribe')!.taskId!;
+      const binding = await backfillScribeIdentity({
+        stateManager: verify,
+        artifactStore: verify.piArtifactStore,
+        scribeTaskId,
+        dreamerTaskId: 'dreamer-id-conflict',
+        workspaceDir: tmpDir,
+        now: new Date().toISOString(),
+      });
+      expect(binding).toEqual({ status: 'identity_conflict', existingPrincipleId: 'ledger-original', resolvedPrincipleId: 'ledger-replacement' });
+      const scribeArt = (await verify.piArtifactStore.listBySourceTaskId(scribeTaskId)).find((a) => a.artifactKind === 'principle');
+      expect(scribeArt?.sourcePrincipleId).toBe('ledger-original');
+    } finally {
+      await verify.close();
+    }
+  }, 60_000);
+
+  it('binding_write_failed / binding_readback_failed: store failures are structured, never silently accepted', async () => {
+    tmpDir = makeTmpDir();
+    const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await sm.initialize();
+    await seedDreamerWithId(sm, 'dreamer-id-wf', 'pain-id-wf', 'code_tool_hook', 'cand-wf');
+    await sm.close();
+    seedLedger(tmpDir, 'ledger-wf', 'cand-wf');
+
+    // Run once through the real path so a REAL scribe artifact exists.
+    const adapter = makeAdapter();
+    const run = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-id-wf', runtimeAdapter: adapter,
+      channel: 'prompt', pollIntervalMs: 5, timeoutMs: 1000,
+      onStoreReady: (store) => { adapter.artifactStore = store; },
+    });
+    expect(run.decision).toBe('text_principle_only');
+
+    const verify = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await verify.initialize();
+    const scribeTaskId = run.stages.find((s) => s.name === 'scribe')!.taskId!;
+    try {
+      // The real run already bound + verified — replay must be idempotent.
+      const idempotent = await backfillScribeIdentity({
+        stateManager: verify, artifactStore: verify.piArtifactStore, scribeTaskId,
+        dreamerTaskId: 'dreamer-id-wf', workspaceDir: tmpDir, now: new Date().toISOString(),
+      });
+      expect(idempotent).toEqual({ status: 'already_bound', principleId: 'ledger-wf' });
+
+      // Write failure: upsert throws.
+      const throwingStore = new Proxy(verify.piArtifactStore, {
+        get(target, prop, receiver) {
+          if (prop === 'upsertArtifact') {
+            return async () => { throw new Error('sqlite locked (simulated)'); };
+          }
+          return Reflect.get(target, prop, receiver);
+        },
+      });
+      // For the write-failure slice we need an UNBOUND artifact: use a second,
+      // unbound scribe-shaped artifact created directly in the store.
+      const taskId2 = 'scribe-unbound-task';
+      await verify.createTask({ taskId: taskId2, taskKind: 'scribe', status: 'succeeded', attemptCount: 0, maxAttempts: 3, diagnosticJson: JSON.stringify({ pi_metadata: { channel: 'prompt', dependencyTaskIds: [], timeoutMs: 1000 } }) });
+      await verify.piArtifactStore.createArtifact({
+        artifactId: 'pi-art-unbound-1', artifactKind: 'principle', sourceTaskId: taskId2,
+        lineageArtifactIds: [], validationStatus: 'pending', contentJson: '{}',
+        createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(),
+      });
+      const failed = await backfillScribeIdentity({
+        stateManager: verify, artifactStore: throwingStore, scribeTaskId: taskId2,
+        dreamerTaskId: 'dreamer-id-wf', workspaceDir: tmpDir, now: new Date().toISOString(),
+      });
+      expect(failed.status).toBe('binding_write_failed');
+
+      // Read-back failure: upsert "succeeds" but the store returns a row without
+      // the binding (write lost / wrong row).
+      const staleStore = new Proxy(verify.piArtifactStore, {
+        get(target, prop, receiver) {
+          if (prop === 'getArtifactById') {
+            return async () => null;
+          }
+          return Reflect.get(target, prop, receiver);
+        },
+      });
+      const stale = await backfillScribeIdentity({
+        stateManager: verify, artifactStore: staleStore, scribeTaskId: taskId2,
+        dreamerTaskId: 'dreamer-id-wf', workspaceDir: tmpDir, now: new Date().toISOString(),
+      });
+      expect(stale.status).toBe('binding_readback_failed');
+    } finally {
+      await verify.close();
+    }
+  }, 60_000);
+
+  it('text path: unverified binding preserves the principle artifact but creates NO approval (candidate_unresolved)', async () => {
+    tmpDir = makeTmpDir();
+    const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await sm.initialize();
+    // No candidateId on the seed — candidate_unresolved.
+    await seedDreamerWithId(sm, 'dreamer-text-noid', 'pain-text-noid', 'prompt');
+    await sm.close();
+
+    const adapter = makeAdapter();
+    const result = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-text-noid', runtimeAdapter: adapter,
+      channel: 'prompt', pollIntervalMs: 5, timeoutMs: 1000,
+      onStoreReady: (store) => { adapter.artifactStore = store; },
+    });
+
+    expect(result.decision).toBe('text_principle_only');
+    expect(result.principleArtifactId).not.toBeNull();
+    expect(result.approvalId).toBeNull();
+    expect(result.degradationReason ?? '').toContain('identity_binding_unverified');
+    expect(result.degradationReason ?? '').toContain('candidate_unresolved');
+    expect(await countApprovalsForArtifact(tmpDir, result.principleArtifactId!)).toBe(0);
+    // The artifact is still marked validated — preserved, publishable later.
+    const verify = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await verify.initialize();
+    try {
+      const artifact = await verify.piArtifactStore.getArtifactById(result.principleArtifactId!);
+      expect(artifact?.validationStatus).toBe('validated');
+      expect(artifact?.sourcePrincipleId).toBeUndefined();
+    } finally {
+      await verify.close();
+    }
+  }, 60_000);
+
+  it('replay after identity repair publishes: seed ledger mid-flight is unnecessary — repair-then-rerun enqueues (§9.1.8)', async () => {
+    tmpDir = makeTmpDir();
+    const sm = new RuntimeStateManager({ workspaceDir: tmpDir });
+    await sm.initialize();
+    await seedDreamerWithId(sm, 'dreamer-repair', 'pain-repair', 'prompt', 'cand-repair');
+    await sm.close();
+
+    const adapter1 = makeAdapter();
+    const refused = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-repair', runtimeAdapter: adapter1,
+      channel: 'prompt', pollIntervalMs: 5, timeoutMs: 1000,
+      onStoreReady: (store) => { adapter1.artifactStore = store; },
+    });
+    expect(refused.approvalId).toBeNull();
+
+    // Identity repair: the ledger entry for the candidate appears (e.g. intake
+    // completed or the ledger was restored). Replay publishes.
+    seedLedger(tmpDir, 'ledger-repaired', 'cand-repair');
+    const adapter2 = makeAdapter();
+    // Run 2 RESUMES run 1's succeeded dreamer seed (no new dreamer startRun) —
+    // pre-register that call so the scripted philosopher can resolve its
+    // sourceDreamerArtifactId lineage from the shared store.
+    adapter2.startRunCalls.push({ taskId: 'dreamer-repair' });
+    const published = await runRuleHostPipeline({
+      workspaceDir: tmpDir, painId: 'pain-repair', runtimeAdapter: adapter2,
+      channel: 'prompt', pollIntervalMs: 5, timeoutMs: 1000,
+      onStoreReady: (store) => { adapter2.artifactStore = store; },
+    });
+    expect(published.approvalId, JSON.stringify(published, null, 1)).not.toBeNull();
+    expect(published.principleArtifactId).not.toBe(refused.principleArtifactId);
+    // Exactly one ledger principle exists — the pipeline never creates one.
+    expect(await ledgerPrincipleCount(tmpDir)).toBe(1);
+  }, 60_000);
+});