@principles/pd-cli 1.154.0 → 1.154.3

package/dist/commands/build-trajectory-evidence.d.ts

@@ -47,4 +47,25 @@ export type TrajectoryEvidenceAcquisition = {
  *  - `empty_trajectory`     — real session, no usable evidence rows.
  */
 export declare function acquireTrajectoryEvidenceFromDb(stateDir: string, sessionId: string | undefined, workspaceDir?: string): TrajectoryEvidenceAcquisition;
+/**
+ * PRI-941 Option A (Owner-approved) — Codex-scoped evidence acquisition for
+ * `pd pain record --host codex`.
+ *
+ * Boundary discipline (PRI-940/941 audits): this function reads ONLY the
+ * `tool_calls` failure rows (the already-authorized PRI-624 tool-governance
+ * evidence surface) for the caller-supplied Codex root session. Conversation
+ * tables (`user_turns` / `assistant_turns`) are NEVER queried here — they
+ * remain ingestion-exclusive behind the G2A consent boundary — and rollout
+ * transcript files are never opened. Binding authority stays with the
+ * caller-supplied PRI-743 lineage tuple: no sessions-table check runs, so an
+ * `unavailable` result never carries a binding claim.
+ *
+ * Outcomes:
+ *  - `available`            — ≥1 failure row → real behavior-trace entries;
+ *  - `trajectory_unavailable` — no trajectory.db in this workspace;
+ *  - `evidence_read_failed` — the DB exists but cannot be opened/read;
+ *  - `empty_trajectory`     — DB readable, zero failure rows for the session
+ *                             (detail: `codex_tool_calls_empty`).
+ */
+export declare function acquireCodexToolFailureEvidenceFromDb(stateDir: string, sessionId: string | undefined, workspaceDir?: string): TrajectoryEvidenceAcquisition;
 //# sourceMappingURL=build-trajectory-evidence.d.ts.map

package/dist/commands/build-trajectory-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-trajectory-evidence.d.ts","sourceRoot":"","sources":["../../src/commands/build-trajectory-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;CACpC,CAAC;AA6JN;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,YAAY,CAAC,EAAE,MAAM,GACpB,6BAA6B,CAgF/B"}
+{"version":3,"file":"build-trajectory-evidence.d.ts","sourceRoot":"","sources":["../../src/commands/build-trajectory-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,sBAAsB,CAAC;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,GAAG,YAAY,CAAC;CACpC,CAAC;AAqMN;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,YAAY,CAAC,EAAE,MAAM,GACpB,6BAA6B,CAgF/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,YAAY,CAAC,EAAE,MAAM,GACpB,6BAA6B,CAyD/B"}

package/dist/commands/build-trajectory-evidence.js

@@ -20,6 +20,51 @@ const PLACEHOLDER_SOURCE_REFS = new Set([
     'tool_call_failure:unavailable',
     'trajectory:empty',
 ]);
+/**
+ * PRI-941 Option A — the SINGLE reader of `tool_calls` failure rows, shared by
+ * the OpenClaw acquisition (collectEvidenceFromDb) and the Codex-scoped
+ * acquisition (acquireCodexToolFailureEvidenceFromDb) so the two hosts can
+ * never drift. Never throws: a missing/unreadable `tool_calls` table is
+ * reported through `readFailed` and the caller owns placeholder handling.
+ */
+function readToolFailureEvidence(db, sessionId, workspaceDir) {
+    const entries = [];
+    let readFailed = false;
+    try {
+        const failedToolCalls = db.prepare(`
+        SELECT tool_name, error_type, exit_code, result_preview, created_at
+        FROM (
+          SELECT tool_name, error_type, exit_code, result_preview, created_at
+          FROM tool_calls
+          WHERE session_id = ? AND outcome = 'failure'
+          ORDER BY created_at DESC
+          LIMIT 3
+        )
+        ORDER BY created_at ASC
+      `).all(sessionId);
+        for (const tc of failedToolCalls) {
+            const toolName = typeof tc.tool_name === 'string' ? tc.tool_name : 'unknown';
+            const errorType = typeof tc.error_type === 'string' ? tc.error_type : 'unknown';
+            const exitCode = tc.exit_code != null ? String(tc.exit_code) : 'N/A';
+            // Enhanced: append resultPreview when available. PRI-941 Owner review:
+            // the preview enters UNSLICED — every truncation (redact-then-bound)
+            // is owned by sanitizeString on the COMPLETE composed note. Pre-slicing
+            // here could cut a credential across the sanitizer's token-pattern
+            // threshold and let the fragment escape redaction.
+            const resultPreview = typeof tc.result_preview === 'string' ? tc.result_preview : null;
+            const previewSuffix = resultPreview ? ` | ${resultPreview}` : '';
+            const note = `Tool ${toolName} failed: ${errorType} (exitCode: ${exitCode})${previewSuffix}`;
+            entries.push({
+                sourceRef: `tool_call_failure:${String(tc.created_at ?? 'unknown')}`,
+                note: sanitizeString(note, workspaceDir),
+            });
+        }
+    }
+    catch {
+        readFailed = true;
+    }
+    return { entries, readFailed };
+}
 /**
  * Collect evidence entries from an open trajectory.db for one session.
  * Shared by the typed acquisition API and the legacy array wrapper so the
@@ -95,36 +140,26 @@ function collectEvidenceFromDb(db, sessionId, workspaceDir) {
     }
     // PRI-358: Try to read failed tool_calls (last 3 failures, chronological order)
     try {
-        const failedToolCalls = db.prepare(`
-        SELECT tool_name, error_type, exit_code, result_preview, created_at
-        FROM (
-          SELECT tool_name, error_type, exit_code, result_preview, created_at
-          FROM tool_calls
-          WHERE session_id = ? AND outcome = 'failure'
-          ORDER BY created_at DESC
-          LIMIT 3
-        )
-        ORDER BY created_at ASC
-      `).all(sessionId);
-        for (const tc of failedToolCalls) {
+        const toolFailure = readToolFailureEvidence(db, sessionId, workspaceDir);
+        for (const entry of toolFailure.entries) {
             if (evidence.length >= MAX_EVIDENCE_ENTRIES)
                 break;
-            const toolName = typeof tc.tool_name === 'string' ? tc.tool_name : 'unknown';
-            const errorType = typeof tc.error_type === 'string' ? tc.error_type : 'unknown';
-            const exitCode = tc.exit_code != null ? String(tc.exit_code) : 'N/A';
-            // Enhanced: append resultPreview when available
-            const resultPreview = typeof tc.result_preview === 'string' ? tc.result_preview : null;
-            const previewSuffix = resultPreview ? ` | ${resultPreview.slice(0, 200)}` : '';
-            const note = `Tool ${toolName} failed: ${errorType} (exitCode: ${exitCode})${previewSuffix}`;
-            evidence.push({
-                sourceRef: `tool_call_failure:${String(tc.created_at ?? 'unknown')}`,
-                note: sanitizeString(note.slice(0, MAX_EVIDENCE_NOTE_CHARS), workspaceDir),
-            });
+            evidence.push(entry);
+        }
+        if (toolFailure.readFailed) {
+            readFailed = true;
+            // tool_calls table may not exist — degrade gracefully (only when no other evidence)
+            if (evidence.length === 0) {
+                evidence.push({
+                    sourceRef: 'tool_call_failure:unavailable',
+                    note: 'trajectory_tool_calls_unavailable',
+                });
+            }
         }
     }
     catch {
+        // defensive: readToolFailureEvidence never throws (internally caught)
         readFailed = true;
-        // tool_calls table may not exist — degrade gracefully (only when no other evidence)
         if (evidence.length === 0) {
             evidence.push({
                 sourceRef: 'tool_call_failure:unavailable',
@@ -236,4 +271,81 @@ export function acquireTrajectoryEvidenceFromDb(stateDir, sessionId, workspaceDi
         db.close();
     }
 }
+/**
+ * PRI-941 Option A (Owner-approved) — Codex-scoped evidence acquisition for
+ * `pd pain record --host codex`.
+ *
+ * Boundary discipline (PRI-940/941 audits): this function reads ONLY the
+ * `tool_calls` failure rows (the already-authorized PRI-624 tool-governance
+ * evidence surface) for the caller-supplied Codex root session. Conversation
+ * tables (`user_turns` / `assistant_turns`) are NEVER queried here — they
+ * remain ingestion-exclusive behind the G2A consent boundary — and rollout
+ * transcript files are never opened. Binding authority stays with the
+ * caller-supplied PRI-743 lineage tuple: no sessions-table check runs, so an
+ * `unavailable` result never carries a binding claim.
+ *
+ * Outcomes:
+ *  - `available`            — ≥1 failure row → real behavior-trace entries;
+ *  - `trajectory_unavailable` — no trajectory.db in this workspace;
+ *  - `evidence_read_failed` — the DB exists but cannot be opened/read;
+ *  - `empty_trajectory`     — DB readable, zero failure rows for the session
+ *                             (detail: `codex_tool_calls_empty`).
+ */
+export function acquireCodexToolFailureEvidenceFromDb(stateDir, sessionId, workspaceDir) {
+    if (!sessionId || sessionId === 'cli' || sessionId === 'unknown') {
+        return {
+            status: 'unavailable',
+            reasonCode: 'session_not_found',
+            detail: sessionId ? `sentinel_session_id:${sessionId}` : 'missing_session_id',
+            binding: 'unverified',
+        };
+    }
+    const dbPath = path.join(stateDir, 'trajectory.db');
+    if (!fs.existsSync(dbPath)) {
+        return {
+            status: 'unavailable',
+            reasonCode: 'trajectory_unavailable',
+            detail: 'trajectory_db_missing',
+            binding: 'unverified',
+        };
+    }
+    let db;
+    try {
+        db = new Database(dbPath, { readonly: true });
+    }
+    catch (err) {
+        return {
+            status: 'unavailable',
+            reasonCode: 'evidence_read_failed',
+            detail: `trajectory_db_unreadable: ${err instanceof Error ? err.message : String(err)}`,
+            binding: 'unverified',
+        };
+    }
+    try {
+        const toolFailure = readToolFailureEvidence(db, sessionId, workspaceDir);
+        // PRI-941 review F2 (rc-9 precision): a missing/unreadable tool_calls
+        // table is a DIFFERENT fact from "zero failure rows" — report it as
+        // evidence_read_failed, mirroring the sibling OpenClaw acquisition.
+        if (toolFailure.readFailed) {
+            return {
+                status: 'unavailable',
+                reasonCode: 'evidence_read_failed',
+                detail: 'codex_tool_calls_unreadable',
+                binding: 'unverified',
+            };
+        }
+        if (toolFailure.entries.length === 0) {
+            return {
+                status: 'unavailable',
+                reasonCode: 'empty_trajectory',
+                detail: 'codex_tool_calls_empty',
+                binding: 'unverified',
+            };
+        }
+        return { status: 'available', entries: toolFailure.entries };
+    }
+    finally {
+        db.close();
+    }
+}
 //# sourceMappingURL=build-trajectory-evidence.js.map

package/dist/commands/build-trajectory-evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-trajectory-evidence.js","sourceRoot":"","sources":["../../src/commands/build-trajectory-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,GACf,MAAM,6BAA6B,CAAC;AA2BrC,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,oBAAoB;IACpB,2BAA2B;IAC3B,wBAAwB;IACxB,+BAA+B;IAC/B,kBAAkB;CACnB,CAAC,CAAC;AAQH;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,EAAqB,EACrB,SAAiB,EACjB,YAAqB;IAErB,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;OAK1B,CAAC,CAAC,GAAG,CAAC,SAAS,CAA8B,CAAC;QAEjD,MAAM,kBAAkB,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC9F,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,OAAO,kBAAkB,CAAC,WAAW,KAAK,QAAQ;gBACnE,CAAC,CAAC,kBAAkB,CAAC,WAAW;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,aAAa,GAAG,cAAc,CAClC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAC5C,YAAY,CACb,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,iBAAiB,MAAM,CAAC,kBAAkB,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;gBAChF,IAAI,EAAE,aAAa;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;QAClB,sDAAsD;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,mCAAmC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;OAK/B,CAAC,CAAC,GAAG,CAAC,SAAS,CAA8B,CAAC;QAEjD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAoB;gBAAE,MAAM;YACnD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;gBAC3D,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,aAAa,GAAG,cAAc,CAClC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAC/C,YAAY,CACb,CAAC;YACF,8DAA8D;YAC9D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAClF,MAAM,iBAAiB,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;gBAC/D,IAAI,EAAE,aAAa,GAAG,iBAAiB;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;QAClB,2DAA2D;QAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,wBAAwB;gBACnC,IAAI,EAAE,wCAAwC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;OAUhC,CAAC,CAAC,GAAG,CAAC,SAAS,CAA8B,CAAC;QAEjD,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAoB;gBAAE,MAAM;YACnD,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,gDAAgD;YAChD,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;YACvF,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,QAAQ,QAAQ,YAAY,SAAS,eAAe,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC7F,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,qBAAqB,MAAM,CAAC,EAAE,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;gBACpE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAAE,YAAY,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;QAClB,oFAAoF;QACpF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,+BAA+B;gBAC1C,IAAI,EAAE,mCAAmC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,kBAAkB;YAC7B,IAAI,EAAE,6EAA6E;SACpF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChF,CAAC,CACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,SAA6B,EAC7B,YAAqB;IAErB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC,CAAC,oBAAoB;YAC7E,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,wBAAwB;YACpC,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,EAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,sBAAsB;YAClC,MAAM,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACvF,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,sEAAsE;QACtE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrF,aAAa,GAAG,GAAG,KAAK,SAAS,CAAC;YAClC,eAAe,GAAG,aAAa,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,gEAAgE;YAChE,aAAa,GAAG,IAAI,CAAC;YACrB,eAAe,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,mBAAmB;gBAC/B,MAAM,EAAE,mCAAmC;gBAC3C,OAAO,EAAE,YAAY;aACtB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,UAAU,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,sBAAsB;gBAClC,MAAM,EAAE,8BAA8B;gBACtC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,kBAAkB;YAC9B,MAAM,EAAE,wCAAwC;YAChD,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;SACrD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"build-trajectory-evidence.js","sourceRoot":"","sources":["../../src/commands/build-trajectory-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,GACf,MAAM,6BAA6B,CAAC;AA2BrC,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,oBAAoB;IACpB,2BAA2B;IAC3B,wBAAwB;IACxB,+BAA+B;IAC/B,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,uBAAuB,CAC9B,EAAqB,EACrB,SAAiB,EACjB,YAAqB;IAErB,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;OAUhC,CAAC,CAAC,GAAG,CAAC,SAAS,CAA8B,CAAC;QAEjD,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,mDAAmD;YACnD,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;YACvF,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,QAAQ,QAAQ,YAAY,SAAS,eAAe,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,qBAAqB,MAAM,CAAC,EAAE,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;gBACpE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAQD;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,EAAqB,EACrB,SAAiB,EACjB,YAAqB;IAErB,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;OAK1B,CAAC,CAAC,GAAG,CAAC,SAAS,CAA8B,CAAC;QAEjD,MAAM,kBAAkB,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC9F,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,OAAO,kBAAkB,CAAC,WAAW,KAAK,QAAQ;gBACnE,CAAC,CAAC,kBAAkB,CAAC,WAAW;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,aAAa,GAAG,cAAc,CAClC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAC5C,YAAY,CACb,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,iBAAiB,MAAM,CAAC,kBAAkB,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;gBAChF,IAAI,EAAE,aAAa;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;QAClB,sDAAsD;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,2BAA2B;gBACtC,IAAI,EAAE,mCAAmC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;OAK/B,CAAC,CAAC,GAAG,CAAC,SAAS,CAA8B,CAAC;QAEjD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAoB;gBAAE,MAAM;YACnD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;gBAC3D,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,aAAa,GAAG,cAAc,CAClC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAC/C,YAAY,CACb,CAAC;YACF,8DAA8D;YAC9D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAClF,MAAM,iBAAiB,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,EAAE;gBAC/D,IAAI,EAAE,aAAa,GAAG,iBAAiB;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;QAClB,2DAA2D;QAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,wBAAwB;gBACnC,IAAI,EAAE,wCAAwC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,IAAI,oBAAoB;gBAAE,MAAM;YACnD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YAC3B,UAAU,GAAG,IAAI,CAAC;YAClB,oFAAoF;YACpF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,+BAA+B;oBAC1C,IAAI,EAAE,mCAAmC;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,+BAA+B;gBAC1C,IAAI,EAAE,mCAAmC;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,kBAAkB;YAC7B,IAAI,EAAE,6EAA6E;SACpF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CACnC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAChF,CAAC,CACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAC1D,CAAC;AAGD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgB,EAChB,SAA6B,EAC7B,YAAqB;IAErB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC,CAAC,oBAAoB;YAC7E,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,wBAAwB;YACpC,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,EAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,sBAAsB;YAClC,MAAM,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACvF,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,sEAAsE;QACtE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrF,aAAa,GAAG,GAAG,KAAK,SAAS,CAAC;YAClC,eAAe,GAAG,aAAa,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,gEAAgE;YAChE,aAAa,GAAG,IAAI,CAAC;YACrB,eAAe,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,mBAAmB;gBAC/B,MAAM,EAAE,mCAAmC;gBAC3C,OAAO,EAAE,YAAY;aACtB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,UAAU,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,sBAAsB;gBAClC,MAAM,EAAE,8BAA8B;gBACtC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,kBAAkB;YAC9B,MAAM,EAAE,wCAAwC;YAChD,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;SACrD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qCAAqC,CACnD,QAAgB,EAChB,SAA6B,EAC7B,YAAqB;IAErB,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,mBAAmB;YAC/B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC,CAAC,oBAAoB;YAC7E,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,wBAAwB;YACpC,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,EAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,sBAAsB;YAClC,MAAM,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACvF,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,sBAAsB;gBAClC,MAAM,EAAE,6BAA6B;gBACrC,OAAO,EAAE,YAAY;aACtB,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,kBAAkB;gBAC9B,MAAM,EAAE,wBAAwB;gBAChC,OAAO,EAAE,YAAY;aACtB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/commands/candidate.d.ts

@@ -95,10 +95,12 @@ export declare function handleCandidateReview(opts: CandidateReviewOptions): Pro
 /**
  * pd candidate audit --workspace <path> [--json]
  *
- * Reads workspace/.pd/state.db principle_candidates and
- * the workspace ledger (same file used by OpenClaw plugin).
- * Checks each consumed candidate has a ledger entry.
- * Exits non-zero if any consumed candidate is missing from ledger.
+ * Delegates the judgment to the core auditCandidateLedgerConsistency so every
+ * surface (pd candidate audit, pd health, operator health) applies the SAME
+ * reuse-aware rules (PRI-917 / R7): reuse resolutions and non-Principle-Ledger
+ * kinds are not "missing"; only a consumed principle-kind candidate with no
+ * resolution anywhere is true drift.
+ * Exits non-zero if any consumed candidate is truly missing from the ledger.
  */
 export declare function handleCandidateAudit(opts: CandidateAuditOptions): Promise<void>;
 /**

package/dist/commands/candidate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"candidate.d.ts","sourceRoot":"","sources":["../../src/commands/candidate.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EA0BpB,MAAM,6BAA6B,CAAC;AAYrC,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAgED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAgDD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF;AAID,UAAU,2BAA2B;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAaD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8JjG;AAID,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnF;AAoTD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6IvF;AAID,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkPvF;AAID;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkErF;AAID;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0GvF;AAID,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAiFD,wBAAsB,sCAAsC,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsR1G;AAID,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CrF"}
+{"version":3,"file":"candidate.d.ts","sourceRoot":"","sources":["../../src/commands/candidate.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EA0BpB,MAAM,6BAA6B,CAAC;AAcrC,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAoED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,mBAAmB,EACjC,SAAS,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAgDD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF;AAID,UAAU,2BAA2B;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAaD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8JjG;AAID,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDnF;AAwXD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgKvF;AAID,UAAU,sBAAsB;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqPvF;AAID;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDrF;AAID;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4HvF;AAID,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAiFD,wBAAsB,sCAAsC,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkT1G;AAID,UAAU,qBAAqB;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CrF"}

package/dist/commands/candidate.js

@@ -14,13 +14,15 @@
  */
 import { randomUUID } from 'crypto';
 import * as path from 'path';
-import { RuntimeStateManager, SqliteConnection, candidateList, candidateShow, CandidateIntakeService, CandidateIntakeError, INTAKE_ERROR_CODES, decideInternalizationRoute, buildDreamerSeedFromCandidate, findExistingDreamerTask, parseSeedSourcePainId, PrincipleTreeLedgerAdapter, 
+import { RuntimeStateManager, candidateList, candidateShow, CandidateIntakeService, CandidateIntakeError, INTAKE_ERROR_CODES, decideInternalizationRoute, buildDreamerSeedFromCandidate, findExistingDreamerTask, parseSeedSourcePainId, PrincipleTreeLedgerAdapter, 
 // PRI-917 PR3A: the review surface consumes the SAME proposal/semantics
 // machinery as the intake gate (audit C4 — one implementation, no drift).
-buildReuseProposal, buildReuseShortlist, extractIntakeRecommendation, isPrincipleLedgerEligibleKind, resolveOwnerIdentity, defaultOwnerIdentityHomeDir, ReuseEvaluationRunner, ReuseEvaluationError, storeEmitter, } from '@principles/core/runtime-v2';
+buildReuseProposal, buildReuseShortlist, extractIntakeRecommendation, isPrincipleLedgerEligibleKind, resolveOwnerIdentity, defaultOwnerIdentityHomeDir, ReuseEvaluationRunner, ReuseEvaluationError, createBridgeTelemetryEventEmitter, auditCandidateLedgerConsistency, } from '@principles/core/runtime-v2';
 import { loadLedger, getLedgerFilePathPublic } from '@principles/core/principle-tree-ledger';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
+import { createWorkspaceTelemetryEmitter } from '../services/workspace-telemetry.js';
 import { loadPdConfig } from '../services/pd-config-loader.js';
+import { createReuseGatedIntakeService } from '../services/reuse-gated-intake.js';
 import { resolveRuntimeAdapterFromConfig } from '../services/runtime-adapter-resolver.js';
 import { resolvePromptFullPipelineSeedMode } from '../services/pd-config-loader.js';
 import { createRemediationResult, remediationAction } from './remediation-output.js';
@@ -455,6 +457,60 @@ async function reportReuseResolution(opts) {
     console.log(`  Candidate Status:  ${consumedState === 'already_consumed' ? 'already consumed (INV-R07 replay)' : 'consumed'}`);
     console.log('  Evidence:          recorded on the Principle\'s reuseEvidence (append-only)\n');
 }
+// ── Shared park reporting (R7 gate-bypass fix, adhoc-20261007) ────────────────
+/**
+ * Emit the park observation (`reuse_gate_triggered`) on the durable
+ * workspace telemetry sink, mirroring the bridge / diagnose / pain-retry
+ * paths (PRI-939 Option A). A manual-command park must be observable in the
+ * same place the automatic ones are — telemetry is how parked candidates are
+ * audited (R7 Wave-2 gate audit).
+ */
+function emitReuseGateParkedTelemetry(workspaceDir, candidateId, recommended) {
+    createBridgeTelemetryEventEmitter(createWorkspaceTelemetryEmitter(workspaceDir)).emitTelemetry({
+        eventType: 'reuse_gate_triggered',
+        traceId: candidateId,
+        timestamp: new Date().toISOString(),
+        payload: {
+            candidateId,
+            ...(recommended?.selectedPrincipleId !== undefined ? { selectedPrincipleId: recommended.selectedPrincipleId } : {}),
+            ...(recommended ? { confidence: recommended.confidence, recommendation: recommended.recommendation } : {}),
+        },
+    });
+}
+/**
+ * Report a `reuse_pending_owner` intake result from the MANUAL paths
+ * (`pd candidate intake` / `pd candidate repair`): the gate suspects a
+ * semantic duplicate, so nothing was written and the candidate awaits the
+ * Owner. Exit code stays 0 — a park is the gate working, not a command
+ * failure (same posture as diagnose / pain-retry / the bridge: park is not
+ * counted as intake failure). cli-6: the result carries a structured reason
+ * and the executable next action (`pd candidate review --decide`).
+ */
+function reportReusePark(opts) {
+    const recommended = opts.result.reuseRecommendation?.status === 'recommended' ? opts.result.reuseRecommendation : undefined;
+    emitReuseGateParkedTelemetry(opts.workspaceDir, opts.candidateId, recommended);
+    const review = {
+        candidateId: opts.candidateId,
+        status: 'review_required',
+        reason: 'reuse_review_required',
+        reusedPrincipleId: recommended?.selectedPrincipleId,
+        ...(recommended ? { confidence: recommended.confidence } : {}),
+        message: opts.result.message,
+        nextAction: `pd candidate review --candidate-id ${opts.candidateId} --decide reuse|create --reason "..."`,
+    };
+    if (opts.json) {
+        console.log(JSON.stringify(review, null, 2));
+        return;
+    }
+    console.log(`\nPrinciple Candidate ${opts.commandLabel}: ${opts.candidateId} — reuse review required\n`);
+    console.log(`  Candidate:         ${opts.candidateId}`);
+    if (recommended?.selectedPrincipleId !== undefined) {
+        console.log(`  Suspected Duplicate Of: ${recommended.selectedPrincipleId} (confidence ${recommended.confidence})`);
+    }
+    console.log(`  Status:            review_required (no Principle was created)`);
+    console.log(`  Message:           ${review.message}`);
+    console.log(`  Next Action:       ${review.nextAction}\n`);
+}
 async function evaluateReuseProposal(workspaceDir, claim, entries) {
     const configLoad = loadPdConfig(workspaceDir);
     const effective = configLoad.ok ? configLoad.effective : configLoad.defaults;
@@ -639,7 +695,12 @@ export async function handleCandidateIntake(opts) {
     try {
         await stateManager.initialize();
         const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
-        const service = new CandidateIntakeService({ stateManager, ledgerAdapter });
+        // R7 gate-bypass fix (adhoc-20261007): construct through the shared gated
+        // assembly so the manual intake path runs the Reuse Review Gate exactly
+        // like diagnose / pain-retry / the bridge. A bare construction left
+        // reuseCheck='not_configured' and let semantic duplicates go straight to
+        // CREATE (R7 Wave-2 audit D-1, P0).
+        const service = createReuseGatedIntakeService({ stateManager, ledgerAdapter, workspaceDir });
         // Fetch candidate once for admission gate check and downstream paths.
         const candidate = await stateManager.getCandidate(opts.candidateId);
         if (!candidate) {
@@ -720,6 +781,20 @@ export async function handleCandidateIntake(opts) {
             await reportReuseResolution({ stateManager, candidateId: opts.candidateId, result: intakeResult, json: opts.json === true });
             return;
         }
+        if (intakeResult.outcome === 'refused' && intakeResult.reason === 'reuse_pending_owner') {
+            // R7 gate-bypass fix: the Reuse Review Gate parked this candidate as a
+            // suspected duplicate. No ledger entry was written and the candidate
+            // stays pending for the Owner — do NOT mark it consumed. cli-5: this
+            // path performs no state mutation at all.
+            reportReusePark({
+                workspaceDir,
+                candidateId: opts.candidateId,
+                result: intakeResult,
+                json: opts.json === true,
+                commandLabel: 'Intake',
+            });
+            return;
+        }
         if (intakeResult.outcome === 'refused') {
             throw new CandidateIntakeError(INTAKE_ERROR_CODES.INPUT_INVALID, `Principle Ledger write refused: ${intakeResult.message}`, { candidateId: opts.candidateId, reason: intakeResult.reason });
         }
@@ -906,10 +981,13 @@ export async function handleCandidateReview(opts) {
         // Owner's verdict lives exclusively in Principle.reuseEvidence[]) and
         // no intake outcome reads them. Emitted only when the capability
         // actually ran (disabled or nothing-to-evaluate emits nothing).
+        // PRI-939 Option A: persist allowlisted events (reuse_evaluation_unavailable)
+        // to the workspace sink instead of the unsubscribed singleton.
+        const workspaceTelemetry = createWorkspaceTelemetryEmitter(workspaceDir);
         if (evaluation !== null) {
             const timestamp = new Date().toISOString();
             if (evaluation.status === 'recommended') {
-                storeEmitter.emitTelemetry({
+                workspaceTelemetry.emitTelemetry({
                     eventType: 'reuse_evaluation_recommended',
                     traceId: opts.candidateId,
                     timestamp,
@@ -924,7 +1002,7 @@ export async function handleCandidateReview(opts) {
                 });
             }
             else {
-                storeEmitter.emitTelemetry({
+                workspaceTelemetry.emitTelemetry({
                     eventType: 'reuse_evaluation_unavailable',
                     traceId: opts.candidateId,
                     timestamp,
@@ -1024,35 +1102,32 @@ export async function handleCandidateReview(opts) {
 /**
  * pd candidate audit --workspace <path> [--json]
  *
- * Reads workspace/.pd/state.db principle_candidates and
- * the workspace ledger (same file used by OpenClaw plugin).
- * Checks each consumed candidate has a ledger entry.
- * Exits non-zero if any consumed candidate is missing from ledger.
+ * Delegates the judgment to the core auditCandidateLedgerConsistency so every
+ * surface (pd candidate audit, pd health, operator health) applies the SAME
+ * reuse-aware rules (PRI-917 / R7): reuse resolutions and non-Principle-Ledger
+ * kinds are not "missing"; only a consumed principle-kind candidate with no
+ * resolution anywhere is true drift.
+ * Exits non-zero if any consumed candidate is truly missing from the ledger.
  */
 export async function handleCandidateAudit(opts) {
     const workspaceDir = resolveWorkspaceDir(opts.workspace);
-    let conn;
     try {
         const dbPath = path.join(workspaceDir, '.pd', 'state.db');
         const ledgerStateDir = path.join(workspaceDir, '.state');
         const ledgerPath = getLedgerFilePathPublic(ledgerStateDir);
-        conn = new SqliteConnection({ workspaceDir, readonly: true });
-        const db = conn.getDb();
-        const consumedRows = db.prepare("SELECT candidate_id FROM principle_candidates WHERE status = 'consumed'").all();
-        const consumedIds = consumedRows.map(r => r.candidate_id);
-        const ledger = loadLedger(ledgerStateDir);
-        const ledgerPrinciples = ledger.tree.principles;
-        const missingLedgerEntryIds = [];
-        for (const candidateId of consumedIds) {
-            const found = Object.values(ledgerPrinciples).some((p) => p.derivedFromPainIds.includes(candidateId));
-            if (!found) {
-                missingLedgerEntryIds.push(candidateId);
-            }
+        const audit = await auditCandidateLedgerConsistency(workspaceDir);
+        if (audit.status === 'error') {
+            console.error(`Audit failed: ${audit.reason ?? 'could not read candidate/ledger state'}`);
+            console.error('Next action: open this workspace once with the PD runtime to create/migrate state.db, then retry the audit.');
+            process.exit(1);
+            return;
         }
         const result = {
-            status: missingLedgerEntryIds.length === 0 ? 'ok' : 'degraded',
-            consumedCount: consumedIds.length,
-            missingLedgerEntryIds,
+            status: audit.status,
+            consumedCount: audit.consumedCount,
+            missingLedgerEntryIds: audit.missingLedgerEntryIds ?? [],
+            reusedResolvedCount: audit.reusedResolvedCount ?? 0,
+            nonLedgerKindCount: audit.nonLedgerKindCount ?? 0,
             checkedLedgerPath: ledgerPath,
             checkedDbPath: dbPath,
         };
@@ -1062,6 +1137,8 @@ export async function handleCandidateAudit(opts) {
         else {
             console.log(`\nCandidate Audit Results\n`);
             console.log(`  consumedCount: ${result.consumedCount}`);
+            console.log(`  reusedResolvedCount: ${result.reusedResolvedCount}`);
+            console.log(`  nonLedgerKindCount: ${result.nonLedgerKindCount}`);
             console.log(`  checkedLedgerPath: ${result.checkedLedgerPath}`);
             console.log(`  checkedDbPath: ${result.checkedDbPath}`);
             console.log(`  status: ${result.status}`);
@@ -1070,7 +1147,7 @@ export async function handleCandidateAudit(opts) {
                 result.missingLedgerEntryIds.forEach(id => console.log(`    - ${id}`));
             }
             else {
-                console.log(`\n  All consumed candidates have ledger entries.`);
+                console.log(`\n  All consumed candidates have ledger resolutions.`);
             }
             console.log('');
         }
@@ -1082,12 +1159,6 @@ export async function handleCandidateAudit(opts) {
         console.error(`Audit failed: ${err instanceof Error ? err.message : String(err)}`);
         process.exit(1);
     }
-    finally {
-        try {
-            conn?.close();
-        }
-        catch { /* best-effort close */ }
-    }
 }
 // ── Repair ─────────────────────────────────────────────────────────────────────
 /**
@@ -1138,7 +1209,11 @@ export async function handleCandidateRepair(opts) {
             return;
         }
         const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
-        const service = new CandidateIntakeService({ stateManager, ledgerAdapter });
+        // R7 gate-bypass fix (adhoc-20261007): repair re-intakes through the same
+        // gated assembly — otherwise "restore the missing ledger entry" became an
+        // unconditional duplicate-CREATE for orphaned cleanup candidates (R7
+        // Wave-2 audit D-1 §3.3).
+        const service = createReuseGatedIntakeService({ stateManager, ledgerAdapter, workspaceDir });
         // Check if already in ledger
         const existing = ledgerAdapter.existsForCandidate(opts.candidateId);
         if (existing) {
@@ -1164,6 +1239,20 @@ export async function handleCandidateRepair(opts) {
         // a write-boundary refusal means the candidate is not principle-eligible —
         // fail loud rather than reporting a "repaired" entry that does not exist.
         const intakeResult = await service.intake(opts.candidateId);
+        if (intakeResult.outcome === 'refused' && intakeResult.reason === 'reuse_pending_owner') {
+            // R7 gate-bypass fix: the gate suspects a semantic duplicate — restoring
+            // the entry would recreate a near-duplicate Principle. No write happened;
+            // the Owner resolves it via the review channel. cli-5: no mutation on
+            // this path (candidate stays consumed, ledger untouched).
+            reportReusePark({
+                workspaceDir,
+                candidateId: opts.candidateId,
+                result: intakeResult,
+                json: opts.json === true,
+                commandLabel: 'Repair',
+            });
+            return;
+        }
         if (intakeResult.outcome === 'refused') {
             throw new CandidateIntakeError(INTAKE_ERROR_CODES.INPUT_INVALID, `Ledger repair refused: ${intakeResult.message}`, { candidateId: opts.candidateId, reason: intakeResult.reason });
         }
@@ -1353,7 +1442,11 @@ export async function handleCandidateInternalizationBackfill(opts) {
             }
         }
         const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
-        const intakeService = new CandidateIntakeService({ stateManager, ledgerAdapter });
+        // R7 gate-bypass fix (adhoc-20261007): --include-pending intakes parked
+        // (reuse_review_required) candidates too — the worst bypass, because it
+        // consumed the very state the gate created to await the Owner (R7 Wave-2
+        // audit D-1 §3.4). Same gated assembly as every other intake path.
+        const intakeService = createReuseGatedIntakeService({ stateManager, ledgerAdapter, workspaceDir });
         for (const row of pendingRows) {
             const candidateId = row.candidate_id;
             const candidate = await stateManager.getCandidate(candidateId);
@@ -1417,6 +1510,29 @@ export async function handleCandidateInternalizationBackfill(opts) {
             // Statuses are deliberately reused from the existing model (SPEC v2.1 §7
             // "禁止执行者自行创造新状态"): 'deferred' + 'skipped' rather than a new
             // status value.
+            //
+            // R7 gate-bypass fix: a park (reuse_pending_owner) is a DIFFERENT
+            // refusal — the candidate is a suspected duplicate awaiting the Owner.
+            // It must NOT be reported as "no action required" and must NOT be
+            // counted as an intake failure: the gate worked. The candidate stays
+            // pending; only `pd candidate review --decide` resolves it (cli-6).
+            if (intakeResult.outcome === 'refused' && intakeResult.reason === 'reuse_pending_owner') {
+                const recommended = intakeResult.reuseRecommendation?.status === 'recommended' ? intakeResult.reuseRecommendation : undefined;
+                emitReuseGateParkedTelemetry(workspaceDir, candidateId, recommended);
+                output.deferred++;
+                output.results.push({
+                    candidateId,
+                    route: decision.route,
+                    status: 'deferred',
+                    reason: `reuse_review_required: candidate is a suspected duplicate${recommended?.selectedPrincipleId !== undefined ? ` of Principle ${recommended.selectedPrincipleId}` : ''} — parked for Owner review`,
+                    statusBefore: 'pending',
+                    statusAfter: 'pending',
+                    intakeDecision: 'skipped',
+                    seedDecision: 'skipped',
+                    nextAction: `pd candidate review --candidate-id ${candidateId} --decide reuse|create --reason "..."`,
+                });
+                continue;
+            }
             if (intakeResult.outcome === 'refused') {
                 output.results.push({ candidateId, route: decision.route, status: 'deferred', reason: intakeResult.message, statusBefore: 'pending', statusAfter: 'pending', intakeDecision: 'skipped', seedDecision: 'skipped', nextAction: 'No action required: this candidate kind does not target the Principle Ledger.' });
                 continue;