create-principles-disciple 1.112.3 → 1.114.0

package/console/dist/server/routes/update.js

@@ -7,6 +7,24 @@ import { sendSuccess, sendError, sendMethodNotAllowed, sendBadRequest, sendNotFo
 import { appendUpdateHistory } from './update-history.js';
 import { checkOpenClawGateway, stopOpenClawGateway, restartOpenClawGateway, } from '../utils/gateway.js';
 import { migrateLegacyExtensionBackups, reservePdBackupDestination, resolvePdBackupsRoot, } from '../utils/pd-backups.js';
+import { ActivationCompatibilityReadModel } from '@principles/core/runtime-v2';
+/**
+ * Legacy rule contract preflight (2026-08-19): refuse to swap the runtime
+ * while an ACTIVE owner-approved rule still depends on a RuleHost contract
+ * symbol the new runtime removed (recentThinking, planStatus, hasPlanFile,
+ * ...). Executing such a rule against the new contract silently changes its
+ * semantics; refusing before any mutation leaves the installation untouched.
+ */
+function runLegacyRuleContractPreflight(workspaceDir) {
+    const scan = new ActivationCompatibilityReadModel({ workspaceDir }).scan();
+    if (scan.ok)
+        return { ok: true };
+    return {
+        ok: false,
+        reason: scan.reason ?? 'legacy_rule_contract_dependency',
+        nextAction: scan.nextAction ?? 'Migrate or deactivate the listed rules before updating.',
+    };
+}
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -418,6 +436,18 @@ async function doApplyUpdate(options, workspaceDir) {
     let appliedChanges = false;
     let gatewayWasStopped = false;
     const codexInstalled = detectCodexInstall();
+    // Legacy-contract preflight BEFORE the gateway stop and any file mutation:
+    // an active rule depending on a removed RuleHost contract symbol must
+    // block the update while the installation is still untouched.
+    const compat = runLegacyRuleContractPreflight(workspaceDir);
+    if (!compat.ok) {
+        return {
+            success: false,
+            message: compat.reason,
+            reason: 'legacy_rule_contract_dependency',
+            nextAction: compat.nextAction,
+        };
+    }
     // Fix 5: stop the OpenClaw gateway before file mutations to release file
     // locks on native modules. Best-effort — if `openclaw` is not in PATH or
     // the gateway isn't running, we proceed (dist/*.js files are not locked).
@@ -630,6 +660,19 @@ function depsMeaningfullyChanged(oldDeps, newDeps) {
 }
 async function doInlineFullUpdate(workspaceDir) {
     const extDir = resolvePluginDir(workspaceDir);
+    // Legacy-contract preflight BEFORE stopping the gateway or touching files:
+    // refuse while an active rule still uses a removed RuleHost contract
+    // symbol — the running installation stays exactly as it was.
+    const compat = runLegacyRuleContractPreflight(workspaceDir);
+    if (!compat.ok) {
+        return {
+            success: false,
+            message: compat.reason,
+            reason: 'legacy_rule_contract_dependency',
+            nextAction: compat.nextAction,
+            requiresRestart: false,
+        };
+    }
     // 1. Stop gateway (releases native module locks held by the gateway process)
     const gatewayStatus = await checkOpenClawGateway();
     let gatewayWasStopped = false;

package/core/dist/runtime-v2/__tests__/activation-compatibility-read-model.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=activation-compatibility-read-model.test.d.ts.map

package/core/dist/runtime-v2/__tests__/activation-compatibility-read-model.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation-compatibility-read-model.test.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/__tests__/activation-compatibility-read-model.test.ts"],"names":[],"mappings":""}

package/core/dist/runtime-v2/__tests__/activation-compatibility-read-model.test.js

@@ -0,0 +1,148 @@
+import { describe, it, expect } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { SqliteConnection } from '../store/sqlite-connection.js';
+import { ActivationCompatibilityReadModel } from '../activation-compatibility-read-model.js';
+import { createRuleArtifact, seedArtifactToDb } from '../activation/__tests__/helpers.js';
+/**
+ * Persisted-workspace regression fixture (P1-3): a workspace upgraded from an
+ * older PD may hold an ACTIVE owner-approved rule whose RuleCode reads
+ * `input.session.recentThinking` — a contract symbol the current runtime
+ * removed. The compatibility read model must detect it; it must NOT silently
+ * report clean (which would let an upgrade change the rule's semantics), and
+ * it must never mutate the workspace.
+ */
+function createBareWorkspace() {
+    // Local variant of the shared helper (avoids pulling the dispatcher deps
+    // we do not need here) — same real-SQLite production stores.
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-compat-scan-'));
+    fs.mkdirSync(path.join(tmpDir, '.pd'), { recursive: true });
+    const connection = new SqliteConnection({ workspaceDir: tmpDir });
+    connection.getDb();
+    return {
+        workspaceDir: tmpDir,
+        connection,
+        approvalStore: null,
+        stateStore: null,
+        artifactStore: null,
+        cleanup: () => {
+            connection.close();
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        },
+    };
+}
+const LEGACY_RECENT_THINKING_CODE = `function evaluate(input, helpers) {
+  var hasRecentDiagnosis = false;
+  if (input.session && input.session.recentThinking === true) { hasRecentDiagnosis = true; }
+  if (!hasRecentDiagnosis) {
+    return { decision: 'requireApproval', matched: true, reason: 'no recent diagnosis evidence' };
+  }
+  return { decision: 'allow', matched: false };
+}`;
+const CLEAN_V2_CODE = `function evaluate(input, helpers) {
+  var h = input.context && input.context.history;
+  if (h && h.status === 'available' && h.recentCalls.length > 0) {
+    return { decision: 'requireApproval', matched: true, reason: 'diagnosis evidence present' };
+  }
+  return { decision: 'allow', matched: false, reason: 'cannot verify: history unavailable' };
+}`;
+function seedActiveCodeToolHookRule(ws, spec) {
+    const { artifactId, ruleId, implementationCode, activationId } = spec;
+    const artifact = createRuleArtifact({
+        artifactId,
+        sourceRuleId: ruleId,
+        contentJson: JSON.stringify({
+            ruleId,
+            implementationCode,
+            ruleHostGateDecision: 'accepted_shadow',
+            affectedTools: ['write_file'],
+        }),
+    });
+    seedArtifactToDb(ws, artifact);
+    const db = ws.connection.getDb();
+    db.prepare(`
+    INSERT INTO activations (activation_id, idempotency_key, artifact_id, channel, action, target_ref, activated_at, promoted_at, deactivated_at)
+    VALUES (?, ?, ?, 'code_tool_hook', 'code_tool_hook_shadow_activate', ?, ?, NULL, NULL)
+  `).run(activationId, `idem-${activationId}`, artifactId, ruleId, new Date().toISOString());
+}
+describe('ActivationCompatibilityReadModel', () => {
+    it('detects an active rule that reads the retired recentThinking contract', () => {
+        const ws = createBareWorkspace();
+        try {
+            seedActiveCodeToolHookRule(ws, { artifactId: 'art-legacy-1', ruleId: 'rule-real-diagnosis-first', implementationCode: LEGACY_RECENT_THINKING_CODE, activationId: 'act-legacy-1' });
+            const result = new ActivationCompatibilityReadModel({ workspaceDir: ws.workspaceDir }).scan();
+            expect(result.ok).toBe(false);
+            expect(result.status).toBe('legacy_dependency');
+            expect(result.scannedActivations).toBe(1);
+            expect(result.findings).toHaveLength(1);
+            expect(result.findings[0]).toMatchObject({
+                symbol: 'recentThinking',
+                ruleId: 'rule-real-diagnosis-first',
+                activationId: 'act-legacy-1',
+                channel: 'code_tool_hook',
+            });
+            expect(result.reason).toBe('legacy_rule_contract_dependency');
+            expect(result.nextAction).toContain('Migrate or deactivate');
+        }
+        finally {
+            ws.cleanup();
+        }
+    });
+    it('passes a clean RuleContextV2-only active rule', () => {
+        const ws = createBareWorkspace();
+        try {
+            seedActiveCodeToolHookRule(ws, { artifactId: 'art-clean-1', ruleId: 'rule-clean-v2', implementationCode: CLEAN_V2_CODE, activationId: 'act-clean-1' });
+            const result = new ActivationCompatibilityReadModel({ workspaceDir: ws.workspaceDir }).scan();
+            expect(result.ok).toBe(true);
+            expect(result.status).toBe('clean');
+            expect(result.findings).toEqual([]);
+        }
+        finally {
+            ws.cleanup();
+        }
+    });
+    it('ignores deactivated rules (only active activations block upgrades)', () => {
+        const ws = createBareWorkspace();
+        try {
+            seedActiveCodeToolHookRule(ws, { artifactId: 'art-legacy-2', ruleId: 'rule-retired-old', implementationCode: LEGACY_RECENT_THINKING_CODE, activationId: 'act-legacy-2' });
+            ws.connection.getDb().prepare('UPDATE activations SET deactivated_at = ? WHERE activation_id = ?').run(new Date().toISOString(), 'act-legacy-2');
+            const result = new ActivationCompatibilityReadModel({ workspaceDir: ws.workspaceDir }).scan();
+            expect(result.status).toBe('clean');
+            expect(result.scannedActivations).toBe(0);
+        }
+        finally {
+            ws.cleanup();
+        }
+    });
+    it('treats a workspace without state.db as a clean pass (fresh install)', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-compat-empty-'));
+        try {
+            const result = new ActivationCompatibilityReadModel({ workspaceDir: tmpDir }).scan();
+            expect(result.ok).toBe(true);
+            expect(result.status).toBe('no_state_db');
+            // Side-effect-free: no state.db was created by the scan (EP-02).
+            expect(fs.existsSync(path.join(tmpDir, '.pd', 'state.db'))).toBe(false);
+        }
+        finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+    it('never mutates the scanned workspace (activations and artifacts intact)', () => {
+        const ws = createBareWorkspace();
+        try {
+            seedActiveCodeToolHookRule(ws, { artifactId: 'art-legacy-3', ruleId: 'rule-kept-3', implementationCode: LEGACY_RECENT_THINKING_CODE, activationId: 'act-legacy-3' });
+            const result = new ActivationCompatibilityReadModel({ workspaceDir: ws.workspaceDir }).scan();
+            expect(result.ok).toBe(false);
+            const db = ws.connection.getDb();
+            const activations = db.prepare('SELECT COUNT(*) AS n FROM activations').get();
+            const artifacts = db.prepare('SELECT COUNT(*) AS n FROM pi_artifacts').get();
+            expect(activations.n).toBe(1);
+            expect(artifacts.n).toBeGreaterThanOrEqual(1);
+        }
+        finally {
+            ws.cleanup();
+        }
+    });
+});
+//# sourceMappingURL=activation-compatibility-read-model.test.js.map

package/core/dist/runtime-v2/__tests__/activation-compatibility-read-model.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation-compatibility-read-model.test.js","sourceRoot":"","sources":["../../../src/runtime-v2/__tests__/activation-compatibility-read-model.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAsB,MAAM,oCAAoC,CAAC;AAE9G;;;;;;;GAOG;AAEH,SAAS,mBAAmB;IAC1B,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,UAAU;QACV,aAAa,EAAE,IAAa;QAC5B,UAAU,EAAE,IAAa;QACzB,aAAa,EAAE,IAAa;QAC5B,OAAO,EAAE,GAAG,EAAE;YACZ,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,2BAA2B,GAAG;;;;;;;EAOlC,CAAC;AAEH,MAAM,aAAa,GAAG;;;;;;EAMpB,CAAC;AAEH,SAAS,0BAA0B,CACjC,EAAiB,EACjB,IAA8F;IAE9F,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACtE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,UAAU;QACV,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;YAC1B,MAAM;YACN,kBAAkB;YAClB,oBAAoB,EAAE,iBAAiB;YACvC,aAAa,EAAE,CAAC,YAAY,CAAC;SAC9B,CAAC;KACH,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjC,EAAE,CAAC,OAAO,CAAC;;;GAGV,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,YAAY,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,0BAA0B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;YACnL,MAAM,MAAM,GAAG,IAAI,gCAAgC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBACvC,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,2BAA2B;gBACnC,YAAY,EAAE,cAAc;gBAC5B,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,OAAO,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,0BAA0B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;YACvJ,MAAM,MAAM,GAAG,IAAI,gCAAgC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,OAAO,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,0BAA0B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1K,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAC3B,mEAAmE,CACpE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,gCAAgC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,OAAO,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,gCAAgC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1C,iEAAiE;YACjE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,0BAA0B,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC;YACrK,MAAM,MAAM,GAAG,IAAI,gCAAgC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,EAAmB,CAAC;YAC/F,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAmB,CAAC;YAC9F,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,OAAO,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/core/dist/runtime-v2/__tests__/architecture-regression.test.js

@@ -303,8 +303,6 @@ const KNOWN_PLUGIN_CORE_FILES = new Set([
     'training-program.ts',
     'replay-engine.ts',
     'merge-gate-audit.ts',
-    'control-ui-db.ts',
-    'thinking-models.ts',
     'pd-task-reconciler.ts',
     'correction-cue-learner.ts',
     // MVP core-loop closure (P0-B/P0-D/E/F): live correction-cue store projection
@@ -406,7 +404,7 @@ describe('PRI-212 plugin core anti-growth guard', () => {
             expect.fail(msg);
         }
     });
-    it('known baseline count is self-consistent (98 files)', async () => {
+    it('known baseline count is self-consistent (96 files)', async () => {
         // Sanity check: if the baseline grows, update this number.
         // Prevents accidental baseline bloat from going unnoticed.
         // See docs/archive/reviews/plugin-core-inventory-2026-05.md §7
@@ -446,10 +444,13 @@ describe('PRI-212 plugin core anti-growth guard', () => {
         // PRI-530: Added principle-receipt-metadata.ts (94 → 95) — plugin I/O boundary
         // for principle receipt attribution reads (readonly state.db joins).
         // PRI-531: Added principle-application-ledger.ts (95 → 96) — receipt ledger writer.
+        // 2026-08-19 retirement: Removed control-ui-db.ts and thinking-models.ts
+        // (96 → 94) — zero production consumers after the Thinking Activity
+        // writer retirement (census in the PR description).
         // MVP core-loop closure (P0-B/P0-D): Added signal-keyword-store.ts +
-        // auto-consumer-governance-wiring.ts (96 → 98) — live correction-cue store
+        // auto-consumer-governance-wiring.ts (94 → 96) — live correction-cue store
         // projection + auto-consumer governance dispatcher/repair wiring (I/O boundary).
-        expect(KNOWN_PLUGIN_CORE_FILES.size).toBe(98);
+        expect(KNOWN_PLUGIN_CORE_FILES.size).toBe(96);
     });
 });
 const REQUIRED_TEST_FILES = [