create-principles-disciple 1.134.9 → 1.135.1

package/console/dist/server/routes/update.js

@@ -1827,7 +1827,9 @@ function releaseManagerFlagEnabled(workspaceDir) {
 }
 /**
  * PRI-698 Phase 1: gates routing /apply-full to the ReleaseManager write
- * orchestration. Default off — the legacy updater serves with an explicit
+ * orchestration. The registry default is ON (2026-09-07 graduation), so an
+ * install with no explicit config value IS served by the ReleaseManager; only
+ * an explicit `enabled: false` routes to the legacy updater, with the
  * `release_manager_write_disabled` fallback reason. Requires the shadow flag
  * too (the whole authority layer is gated on it first).
  */
@@ -2118,6 +2120,8 @@ async function syncReleaseManagerAuthority(workspaceDir) {
             updateMutationController.unregister(rmKind, RELEASE_MANAGER_AUTHORITY);
             // PRI-698 Phase 1: a structurally-ready apply-full with the write flag
             // off is a deliberate gate, not an unavailability — name it distinctly.
+            // PRI-729: the reason is annotated with the declared vocabulary type, so
+            // an undocumented fallback is a compile error — not a silent string.
             const reason = readiness.ready && rmKind === 'apply-full'
                 ? 'release_manager_write_disabled'
                 : `release_manager_unavailable:${readiness.reasons.join(',')}`;
@@ -2131,6 +2135,40 @@ const UPDATE_MUTATION_KINDS = new Map([
     ['/apply-full', 'apply-full'],
     ['/rollback', 'rollback'],
 ]);
+/** kind → wire path, for routing telemetry only. */
+const MUTATION_KIND_PATHS = new Map([...UPDATE_MUTATION_KINDS].map(([subPath, kind]) => [kind, `/api/update${subPath}`]));
+/**
+ * PRI-729 — fail-loud routing telemetry (ADR-0024 D-1).
+ *
+ * The compatibility fallback is a designed migration state, and a migration
+ * state nobody can see is indistinguishable from an accident. The
+ * `X-PD-Mutation-Fallback-Reason` response header is per-request; this emits
+ * ONE console line whenever a kind's resolved authority CHANGES, so an operator
+ * can see exactly which kinds are still served by the legacy updater and why —
+ * without the noise of the Companion's 6-hourly `/check` polling.
+ *
+ * Built from `describeGovernance()` rather than `resolveAuthority()`: the
+ * former reports `active: 'none'` instead of throwing, so the telemetry needs
+ * no alternate arm for the contract-impossible "no authority registered" state
+ * (ERR-099 — a defensive alternate for an unreachable state ships uncovered).
+ * The line is assembled branch-free from reachable-only parts.
+ */
+const lastLoggedRouting = new Map();
+function logMutationRouting() {
+    const governance = updateMutationController.describeGovernance();
+    for (const kind of MUTATION_KINDS) {
+        const info = governance[kind];
+        const detail = [
+            info.fallback ? 'compatibility fallback' : 'preferred authority',
+            info.fallbackReason ?? '',
+        ].filter((part) => part.length > 0).join(': ');
+        const line = `${info.active} (${detail})`;
+        if (lastLoggedRouting.get(kind) === line)
+            continue;
+        lastLoggedRouting.set(kind, line);
+        console.log(`[update] ${MUTATION_KIND_PATHS.get(kind) ?? kind} → ${line}`);
+    }
+}
 export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
     const kind = UPDATE_MUTATION_KINDS.get(subPath);
     if (kind === undefined) {
@@ -2141,5 +2179,7 @@ export async function handleUpdateRoute(req, res, workspaceDir, subPath) {
     // readiness state before the controller resolves the authority. Pure
     // routing/decision work — no runtime mutation happens here.
     await syncReleaseManagerAuthority(workspaceDir);
+    // PRI-729: make the routing decision observable (log on change only).
+    logMutationRouting();
     await updateMutationController.dispatch(req, res, { workspaceDir }, kind);
 }

package/console/dist/server/update/mutation-controller.d.ts

@@ -44,6 +44,40 @@ export declare const RELEASE_MANAGER_AUTHORITY: 'release-manager';
 export declare const PREFERRED_MUTATION_AUTHORITY: "release-manager";
 export type MutationKind = 'check' | 'apply' | 'apply-full' | 'rollback';
 export declare const MUTATION_KINDS: readonly MutationKind[];
+/**
+ * PRI-729 — the closed vocabulary of compatibility-fallback reasons (ADR-0024 D-1).
+ *
+ * The ReleaseManager is the PREFERRED authority for every mutation kind and is
+ * consulted for all of them on every request (`createReleaseManagerAuthority`
+ * reports per-kind readiness before the controller resolves anything). A
+ * mutation therefore reaches the legacy console updater ONLY through one of the
+ * reasons below: the compatibility fallback is a DESIGNED migration decision,
+ * not an accident of which authority happened to register.
+ *
+ * Keeping the vocabulary closed is what makes "only an explicitly designed
+ * compatibility fallback may exist" checkable rather than aspirational — an
+ * undeclared reason is a type error at every call site and is reported loud at
+ * runtime (see `setFallbackReason`), never served silently.
+ *
+ * The parameterised forms carry a machine-readable sub-code after `:`:
+ *   - `release_manager_unavailable:<readiness reasons>` — the authority module
+ *     reports the kind not-ready (metadata source, layout, journal, or a
+ *     capability the ReleaseManager does not implement).
+ *   - `release_manager_refused_pre_transaction:<reason>` — the authority was
+ *     ready but refused BEFORE opening a transaction (zero side effects), so
+ *     the compatibility fallback may serve the request.
+ */
+export type CompatFallbackReason = 'release_manager_shadow_disabled' | 'release_manager_write_disabled' | 'installer_missing' | 'authority_module_unavailable' | `release_manager_unavailable:${string}` | `release_manager_refused_pre_transaction:${string}`;
+/** Literal (non-parameterised) compatibility-fallback reasons. */
+export declare const COMPAT_FALLBACK_REASON_LITERALS: readonly ['release_manager_shadow_disabled', 'release_manager_write_disabled', 'installer_missing', 'authority_module_unavailable'];
+/** Parameterised compatibility-fallback reason prefixes (sub-code follows `:`). */
+export declare const COMPAT_FALLBACK_REASON_PREFIXES: readonly ['release_manager_unavailable:', 'release_manager_refused_pre_transaction:'];
+/**
+ * True when `reason` belongs to the declared compatibility-fallback vocabulary.
+ * The wiring's runtime guard uses this so an undeclared reason is reported loud
+ * instead of being served as an undocumented degradation.
+ */
+export declare function isDeclaredCompatFallbackReason(reason: string): boolean;
 export interface MutationContext {
     readonly workspaceDir: string;
 }
@@ -79,8 +113,14 @@ export declare class MutationController {
      * Emitted as the `X-PD-Mutation-Fallback-Reason` header whenever a dispatch
      * actually resolves to the fallback, and surfaced by describeGovernance().
      * Pass null to clear.
+     *
+     * PRI-729: the reason must be a member of the closed compatibility-fallback
+     * vocabulary. An undeclared reason is a programming error — a fallback was
+     * introduced without being designed — so it is reported loud (rc-9) while
+     * still being recorded, because refusing the Owner's mutation over a
+     * diagnostic string would be the worse failure.
      */
-    setFallbackReason(kind: MutationKind, reason: string | null): void;
+    setFallbackReason(kind: MutationKind, reason: CompatFallbackReason | null): void;
     getFallbackReason(kind: MutationKind): string | undefined;
     register(kind: MutationKind, authority: MutationAuthority): void;
     unregister(kind: MutationKind, name: string): boolean;

package/console/dist/server/update/mutation-controller.js

@@ -11,6 +11,28 @@ export const RELEASE_MANAGER_AUTHORITY = 'release-manager';
  */
 export const PREFERRED_MUTATION_AUTHORITY = RELEASE_MANAGER_AUTHORITY;
 export const MUTATION_KINDS = ['check', 'apply', 'apply-full', 'rollback'];
+/** Literal (non-parameterised) compatibility-fallback reasons. */
+export const COMPAT_FALLBACK_REASON_LITERALS = [
+    'release_manager_shadow_disabled',
+    'release_manager_write_disabled',
+    'installer_missing',
+    'authority_module_unavailable',
+];
+/** Parameterised compatibility-fallback reason prefixes (sub-code follows `:`). */
+export const COMPAT_FALLBACK_REASON_PREFIXES = [
+    'release_manager_unavailable:',
+    'release_manager_refused_pre_transaction:',
+];
+/**
+ * True when `reason` belongs to the declared compatibility-fallback vocabulary.
+ * The wiring's runtime guard uses this so an undeclared reason is reported loud
+ * instead of being served as an undocumented degradation.
+ */
+export function isDeclaredCompatFallbackReason(reason) {
+    if (COMPAT_FALLBACK_REASON_LITERALS.includes(reason))
+        return true;
+    return COMPAT_FALLBACK_REASON_PREFIXES.some((prefix) => reason.startsWith(prefix) && reason.length > prefix.length);
+}
 export class MutationController {
     authorities = new Map();
     /** PRI-672: per-kind reason the fallback is serving (machine-readable, rc-9). */
@@ -21,14 +43,24 @@ export class MutationController {
      * Emitted as the `X-PD-Mutation-Fallback-Reason` header whenever a dispatch
      * actually resolves to the fallback, and surfaced by describeGovernance().
      * Pass null to clear.
+     *
+     * PRI-729: the reason must be a member of the closed compatibility-fallback
+     * vocabulary. An undeclared reason is a programming error — a fallback was
+     * introduced without being designed — so it is reported loud (rc-9) while
+     * still being recorded, because refusing the Owner's mutation over a
+     * diagnostic string would be the worse failure.
      */
     setFallbackReason(kind, reason) {
         if (reason === null) {
             this.fallbackReasons.delete(kind);
+            return;
         }
-        else {
-            this.fallbackReasons.set(kind, reason);
+        if (!isDeclaredCompatFallbackReason(reason)) {
+            console.error(`[mutation-controller] undeclared compatibility-fallback reason for kind "${kind}": ${JSON.stringify(reason)}. `
+                + 'Every compatibility fallback must be declared in mutation-controller.ts '
+                + '(COMPAT_FALLBACK_REASON_LITERALS / COMPAT_FALLBACK_REASON_PREFIXES).');
         }
+        this.fallbackReasons.set(kind, reason);
     }
     getFallbackReason(kind) {
         return this.fallbackReasons.get(kind);

package/console/dist/ui/components/onboarding/slashCommands.js

@@ -18,6 +18,5 @@ export const ONBOARDING_SLASH_COMMANDS = [
     { name: '/pd-pain', descriptionKey: 'pages.welcome.step3.commandDescriptions.pdPain' },
     { name: '/pd-help', alias: '/pdh', descriptionKey: 'pages.welcome.step3.commandDescriptions.pdHelp' },
     { name: '/pd-context', descriptionKey: 'pages.welcome.step3.commandDescriptions.pdContext' },
-    { name: '/pd-evolution-status', descriptionKey: 'pages.welcome.step3.commandDescriptions.pdEvolutionStatus' },
     { name: '/pd-focus', descriptionKey: 'pages.welcome.step3.commandDescriptions.pdFocus' },
 ];

package/console/dist/ui/i18n/en.json

@@ -1609,7 +1609,6 @@
                     "pdPain": "Report pain from OpenClaw session",
                     "pdHelp": "Show all commands and usage guide",
                     "pdContext": "Control context injection",
-                    "pdEvolutionStatus": "Show evolution loop status",
                     "pdFocus": "Manage CURRENT_FOCUS.md"
                 },
                 "nextButton": "Next",

package/console/dist/ui/i18n/zh-CN.json

@@ -1609,7 +1609,6 @@
                     "pdPain": "从 OpenClaw 会话报告 pain",
                     "pdHelp": "显示所有命令和使用指南",
                     "pdContext": "控制上下文注入",
-                    "pdEvolutionStatus": "查看 evolution 闭环状态",
                     "pdFocus": "管理 CURRENT_FOCUS.md"
                 },
                 "nextButton": "下一步",