create-principles-disciple 1.144.13 → 1.144.15

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.2.0",
-  "sourceCommit": "04bd7eceea7c50a1c5e1dd7408ab1c92d0bf8c3e"
+  "sourceCommit": "aa4ccf19f76c862789bf3425c33e63c5847e6b01"
 }

package/console/dist/server/models/ApprovalsGroupedConsoleModel.d.ts

@@ -15,6 +15,15 @@ export interface ApprovalGroup {
      * (the client has no access to the escaped, serialized size).
      */
     fitsPromptBudget?: boolean;
+    /**
+     * PRI-940: the pinned artifact no longer exists in pi_artifacts (typically
+     * superseded by a newer scribe revision). There is no contentJson, so
+     * `candidateDescription` is unavailable and `principleTitle` degrades to the
+     * synthesized `unlinked:<artifactId>` grouping key — a machine id that must
+     * never be rendered as a title. Absent when the artifact is readable. rc-9:
+     * the UI shows a visible degradation note instead of going silently blank.
+     */
+    artifactUnavailable?: boolean;
     records: {
         id: string;
         artifactId: string;

package/console/dist/server/models/ApprovalsGroupedConsoleModel.js

@@ -170,6 +170,10 @@ export class ApprovalsGroupedConsoleModel {
             // the pre-approval badge never promises rotation for an entry that is
             // oversized (rotation cannot rescue a per-entry overflow).
             const artifactFitsBudgetMap = new Map();
+            // PRI-940: which approval artifacts are MISSING from the store (superseded
+            // or pruned) — those cards have no contentJson, so the UI must degrade
+            // visibly instead of rendering the `unlinked:` machine id as a title.
+            const artifactUnavailableMap = new Map();
             const stateDir = path.join(this.workspaceDir, '.state');
             const resolutionDeps = createArtifactPrincipleResolutionDeps(conn, artifactStore, this.workspaceDir);
             for (const approval of allApprovals) {
@@ -185,12 +189,14 @@ export class ApprovalsGroupedConsoleModel {
                             artifactDescriptionMap.set(approval.artifactId, null);
                         }
                         artifactFitsBudgetMap.set(approval.artifactId, candidateFitsPromptBudget(artifact));
+                        artifactUnavailableMap.set(approval.artifactId, artifact === null);
                     }
                     catch (err) {
                         if (isMissingTableError(err)) {
                             artifactPrincipleMap.set(approval.artifactId, null);
                             artifactDescriptionMap.set(approval.artifactId, null);
                             artifactFitsBudgetMap.set(approval.artifactId, false);
+                            artifactUnavailableMap.set(approval.artifactId, true);
                         }
                         else {
                             throw err;
@@ -258,6 +264,12 @@ export class ApprovalsGroupedConsoleModel {
                     ...(firstArtifactId !== undefined && artifactFitsBudgetMap.has(firstArtifactId)
                         ? { fitsPromptBudget: artifactFitsBudgetMap.get(firstArtifactId) === true }
                         : {}),
+                    // PRI-940: absent when the pinned artifact is readable — same
+                    // spread style as fitsPromptBudget so the wire contract stays
+                    // unchanged for healthy cards.
+                    ...(firstArtifactId !== undefined && artifactUnavailableMap.get(firstArtifactId) === true
+                        ? { artifactUnavailable: true }
+                        : {}),
                     records,
                 });
             }

package/console/dist/server/routes/update-history.d.ts

@@ -32,6 +32,20 @@ export declare function appendUpdateHistory(workspaceDir: string, entry: Omit<Up
  * executor, the initiating Console may be dead when an update reaches a
  * terminal state — the journal is the durable fact, and this derives any
  * missing history entries from it (idempotent by transactionId; append-only).
+ *
+ * PRI-926 truthfulness rules:
+ * - Only journals in the ReleaseManager update domain
+ *   (`isReleaseManagerTransactionId`) are Owner-facing update facts —
+ *   installer/test transactions sharing ~/.pd/transactions/ never synthesize
+ *   rows, and rows previously projected from outside the domain are dropped
+ *   (a wrongly-projected row of this read model, not Owner data).
+ * - A synthesized row carries the journal's own truth: fromVersion from the
+ *   planned line's `preUpdateProductVersion` (absence stays 'unknown' — the
+ *   honest gap for pre-PRI-926 journals, rc-9), and the timestamp of the
+ *   journal's first line, never the scan moment.
+ * - The synthesized id is deterministic (`reconciled-<transactionId>`), so a
+ *   row evicted by the 50-entry cap cannot resurrect under a fresh id; merged
+ *   rows are ordered by fact time.
  */
 export declare function reconcileUpdateHistoryFromJournals(workspaceDir: string, pdHome: string): void;
 export declare function handleUpdateHistoryRoute(req: IncomingMessage, res: ServerResponse, workspaceDir: string, _subPath: string): Promise<void>;

package/console/dist/server/routes/update-history.js

@@ -1,5 +1,6 @@
 import * as fs from 'fs';
 import * as path from 'path';
+import { isReleaseManagerTransactionId } from 'create-principles-disciple/update-console';
 import { sendSuccess, sendMethodNotAllowed } from '../utils/response.js';
 /** Historical authority values remain readable; only ReleaseManager writes new attempts. */
 export const UPDATE_HISTORY_AUTHORITIES = ['release-manager', 'legacy-console-updater'];
@@ -62,6 +63,17 @@ function parseHistoryEntry(value) {
 function getHistoryPath(workspaceDir) {
     return path.join(workspaceDir, '.pd', 'update-history.json');
 }
+/**
+ * PRI-926: sort key for fact-time ordering. History rows span eras and
+ * formats (legacy records, journal `at` values are loosely read), so string
+ * comparison would mis-order mixed shapes like '…00Z' vs '…00.000Z' or
+ * non-UTC offsets — compare parsed instants instead. Unparseable values take
+ * a stable epoch fallback (sort oldest); they are never dropped.
+ */
+function factTimeMs(timestamp) {
+    const ms = Date.parse(timestamp);
+    return Number.isNaN(ms) ? 0 : ms;
+}
 function loadHistory(historyPath) {
     if (fs.existsSync(historyPath)) {
         try {
@@ -106,13 +118,32 @@ export function appendUpdateHistory(workspaceDir, entry) {
  * executor, the initiating Console may be dead when an update reaches a
  * terminal state — the journal is the durable fact, and this derives any
  * missing history entries from it (idempotent by transactionId; append-only).
+ *
+ * PRI-926 truthfulness rules:
+ * - Only journals in the ReleaseManager update domain
+ *   (`isReleaseManagerTransactionId`) are Owner-facing update facts —
+ *   installer/test transactions sharing ~/.pd/transactions/ never synthesize
+ *   rows, and rows previously projected from outside the domain are dropped
+ *   (a wrongly-projected row of this read model, not Owner data).
+ * - A synthesized row carries the journal's own truth: fromVersion from the
+ *   planned line's `preUpdateProductVersion` (absence stays 'unknown' — the
+ *   honest gap for pre-PRI-926 journals, rc-9), and the timestamp of the
+ *   journal's first line, never the scan moment.
+ * - The synthesized id is deterministic (`reconciled-<transactionId>`), so a
+ *   row evicted by the 50-entry cap cannot resurrect under a fresh id; merged
+ *   rows are ordered by fact time.
  */
 export function reconcileUpdateHistoryFromJournals(workspaceDir, pdHome) {
     const transactionsDir = path.join(pdHome, 'transactions');
     if (!fs.existsSync(transactionsDir))
         return;
     const historyPath = getHistoryPath(workspaceDir);
-    const history = loadHistory(historyPath);
+    const loaded = loadHistory(historyPath);
+    // A row WITHOUT a transactionId has no domain evidence either way — realtime
+    // and legacy records stay untouched. A transactionId OUTSIDE the update
+    // domain proves the row was projected from a non-update journal.
+    const history = loaded.filter((entry) => entry.transactionId === undefined || isReleaseManagerTransactionId(entry.transactionId));
+    const changedByCleanup = history.length !== loaded.length;
     const journaledIds = new Set(history
         .filter((entry) => typeof entry.transactionId === 'string' && entry.transactionId.length > 0)
         .map((entry) => entry.transactionId));
@@ -122,47 +153,66 @@ export function reconcileUpdateHistoryFromJournals(workspaceDir, pdHome) {
         failed: { kind: 'failure', success: false, toVersion: 'failed' },
         refused: { kind: 'refusal', success: false, toVersion: '' },
     };
-    let changed = false;
+    let added = 0;
     for (const entry of fs.readdirSync(transactionsDir)) {
         if (!entry.endsWith('.jsonl'))
             continue;
         const transactionId = entry.slice(0, -'.jsonl'.length);
+        if (!isReleaseManagerTransactionId(transactionId))
+            continue;
         if (journaledIds.has(transactionId))
             continue;
         let lastState = null;
         let productVersion = null;
+        let fromVersion = null;
+        let firstAt = null;
         try {
             const raw = fs.readFileSync(path.join(transactionsDir, entry), 'utf-8');
             for (const line of raw.split('\n')) {
                 if (line.trim().length === 0)
                     continue;
-                const { to: transitionTo, productVersion: transitionProductVersion } = JSON.parse(line);
+                const parsed = JSON.parse(line);
+                const { to: transitionTo, productVersion: transitionProductVersion } = parsed;
                 if (typeof transitionTo === 'string')
                     lastState = transitionTo;
                 if (typeof transitionProductVersion === 'string')
                     productVersion = transitionProductVersion;
+                // First-line truth: the planned transition carries the transaction's
+                // moment and the version the update started FROM (PRI-926).
+                if (firstAt === null && typeof parsed.at === 'string' && parsed.at.length > 0)
+                    firstAt = parsed.at;
+                if (fromVersion === null && typeof parsed.preUpdateProductVersion === 'string' && parsed.preUpdateProductVersion.length > 0) {
+                    fromVersion = parsed.preUpdateProductVersion;
+                }
             }
         }
         catch {
             // unreadable journal — recovery diagnostics own that; skip for history
             continue;
         }
-        const mapping = lastState !== null ? terminalKind[lastState] : undefined;
+        // External input indexes a plain-object table — guard with Object.hasOwn
+        // before the lookup (ERR-013: '__proto__' must not resolve a mapping).
+        let mapping;
+        if (lastState !== null && Object.hasOwn(terminalKind, lastState)) {
+            mapping = terminalKind[lastState];
+        }
         if (mapping === undefined)
             continue;
         history.push({
-            fromVersion: 'unknown',
+            fromVersion: fromVersion ?? 'unknown',
             toVersion: mapping.toVersion === '' ? (productVersion ?? 'unknown') : mapping.toVersion,
             success: mapping.success,
             kind: mapping.kind,
             authority: 'release-manager',
             transactionId,
-            id: `update-${Date.now()}-${transactionId.slice(-8)}`,
-            timestamp: new Date().toISOString(),
+            id: `reconciled-${transactionId}`,
+            timestamp: firstAt ?? new Date().toISOString(),
         });
-        changed = true;
+        added += 1;
     }
-    if (changed) {
+    if (added > 0 || changedByCleanup) {
+        // Order by fact time (stable for equal instants), then keep the newest 50.
+        history.sort((a, b) => factTimeMs(a.timestamp) - factTimeMs(b.timestamp));
         if (history.length > 50) {
             history.splice(0, history.length - 50);
         }

package/console/dist/ui/i18n/en.json

@@ -96,6 +96,7 @@
             "deviationCount": "deviation(s)",
             "evidenceSummary": "Evidence: {{count}} record(s)",
             "untitledCandidate": "Untitled candidate principle",
+            "artifactUnavailableNote": "The draft artifact this approval points to is no longer in the artifact store (likely superseded by a newer revision), so its content cannot be shown. If in doubt, reject it; the raw artifact ID is shown in the edit section's current-artifact field.",
             "approveAction": "Approve",
             "rejectAction": "Reject",
             "editAction": "Edit",

package/console/dist/ui/i18n/zh-CN.json

@@ -96,6 +96,7 @@
             "deviationCount": "条偏差",
             "evidenceSummary": "证据：{{count}} 条记录",
             "untitledCandidate": "待命名候选原则",
+            "artifactUnavailableNote": "该审批指向的草稿原件已不在工件库中（可能已被新版本取代），内容无法显示。如无法判断，可选择拒绝；原始工件编号可点「编辑」后在「当前工件」一栏查看。",
             "approveAction": "批准",
             "rejectAction": "拒绝",
             "editAction": "编辑",

package/console/dist/ui/pages/focus/FocusPage.js

@@ -9,7 +9,7 @@ import { SectionTitle } from "../../components/layout/section-title.js";
 import { DailyThoughtCard } from "../../components/focus/daily-thought-card.js";
 import { ShinyText } from "../../components/ui/shiny-text.js";
 import { fetchGovernanceQueue, fetchApprovalsGrouped, approveApproval, rejectApproval, editApproval, fetchAllActivations, fetchOwnerDecisions, } from "../../api.js";
-import { validateApprovalsGroupedData } from "./focus-validation.js";
+import { selectApprovalGroupDisplayTitle, validateApprovalsGroupedData } from "./focus-validation.js";
 import { OwnerDecisionCard } from "./OwnerDecisionCard.js";
 import { localizeApprovalWarning, splitApprovalWarnings } from "../../utils/approval-warning-localization.js";
 /** PRI-908: how long the decided card stays visible before the pending list refresh removes it. */
@@ -178,8 +178,11 @@ function PendingReviewCard({ group, actionsLockedReason, onDecisionApplied, prom
     }
     // Display title: prefer candidateDescription (human-readable) over principleTitle
     // (which falls back to a fabricated principleId when the principle isn't in ledger).
-    const displayTitle = group.candidateDescription
-        ?? group.principleTitle
+    // PRI-940: the selection rule lives in focus-validation (contract-tested) —
+    // when the pinned artifact is missing, principleTitle IS the machine id
+    // (`unlinked:<artifactId>`) and must fall through to the untitled copy; the
+    // degradation note below explains why there is no content.
+    const displayTitle = selectApprovalGroupDisplayTitle(group)
         ?? t("pages.focus.untitledCandidate", { defaultValue: "待命名候选原则" });
     async function applyDecisionToAllRecords(action, reason) {
         // Only process pending records — skip already-approved/rejected to avoid
@@ -306,7 +309,7 @@ function PendingReviewCard({ group, actionsLockedReason, onDecisionApplied, prom
                     ? "border-green/40 bg-green/10 text-green"
                     : "border-line bg-surface/80 text-ink-3"}`, role: "status", "data-testid": `decided-banner-${group.principleId}`, children: decidedOutcome === "approved"
                     ? t("pages.focus.decidedApproved", { defaultValue: "已批准 ✓ 正在写入生效记录…" })
-                    : t("pages.focus.decidedRejected", { defaultValue: "已拒绝" }) })), _jsxs("div", { className: "flex items-center gap-2 flex-wrap", children: [_jsx("span", { className: "inline-flex items-center border border-line rounded-[2px] px-[7px] py-1 font-mono text-[11px] text-ink-3 bg-surface/80 uppercase", children: channelLabel }), isReversible && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: primaryChannel === "prompt" ? t("pages.focus.tagReversible") : t("pages.focus.tagLowRisk") }))] }), _jsx("div", { className: "mt-[14px] mb-2 font-semibold text-ink leading-snug", children: displayTitle }), _jsx("div", { className: "mt-2 px-3 py-2 bg-surface/60 border-l-2 border-gov text-ink-3 text-[13px] leading-snug", children: t("pages.focus.evidenceSummary", { count: group.records.length }) }), actionsLocked && (_jsxs("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 p-3", "data-testid": `pending-actions-locked-${group.principleId}`, children: [_jsx("p", { className: "text-ink-2 text-[12.5px] leading-relaxed", children: actionsLockedReason }), _jsx(Link, { to: "/settings", "data-testid": `pending-actions-locked-settings-${group.principleId}`, className: "mt-2 inline-flex items-center border border-line text-ink bg-surface rounded-[3px] px-[14px] py-[6px] text-[12.5px] hover:border-line-2 transition-colors", children: t("pages.focus.ownerDecision.goSettingsCta") })] })), decidedOutcome === null && primaryChannel === "prompt" && promptInjection?.truncated === true && (_jsx("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 px-3 py-2 text-[12.5px] text-amber", "data-testid": `approve-queue-badge-${group.principleId}`, children: promptInjection.productionRotates === true && group.fitsPromptBudget === true
+                    : t("pages.focus.decidedRejected", { defaultValue: "已拒绝" }) })), _jsxs("div", { className: "flex items-center gap-2 flex-wrap", children: [_jsx("span", { className: "inline-flex items-center border border-line rounded-[2px] px-[7px] py-1 font-mono text-[11px] text-ink-3 bg-surface/80 uppercase", children: channelLabel }), isReversible && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: primaryChannel === "prompt" ? t("pages.focus.tagReversible") : t("pages.focus.tagLowRisk") }))] }), _jsx("div", { className: "mt-[14px] mb-2 font-semibold text-ink leading-snug", children: displayTitle }), group.artifactUnavailable === true && (_jsx("div", { className: "mb-2 text-[12.5px] leading-relaxed text-amber", "data-testid": `artifact-unavailable-${group.principleId}`, children: t("pages.focus.artifactUnavailableNote") })), _jsx("div", { className: "mt-2 px-3 py-2 bg-surface/60 border-l-2 border-gov text-ink-3 text-[13px] leading-snug", children: t("pages.focus.evidenceSummary", { count: group.records.length }) }), actionsLocked && (_jsxs("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 p-3", "data-testid": `pending-actions-locked-${group.principleId}`, children: [_jsx("p", { className: "text-ink-2 text-[12.5px] leading-relaxed", children: actionsLockedReason }), _jsx(Link, { to: "/settings", "data-testid": `pending-actions-locked-settings-${group.principleId}`, className: "mt-2 inline-flex items-center border border-line text-ink bg-surface rounded-[3px] px-[14px] py-[6px] text-[12.5px] hover:border-line-2 transition-colors", children: t("pages.focus.ownerDecision.goSettingsCta") })] })), decidedOutcome === null && primaryChannel === "prompt" && promptInjection?.truncated === true && (_jsx("div", { className: "mt-3 rounded-[3px] border border-amber/40 bg-amber/5 px-3 py-2 text-[12.5px] text-amber", "data-testid": `approve-queue-badge-${group.principleId}`, children: promptInjection.productionRotates === true && group.fitsPromptBudget === true
                     ? t("pages.focus.approveQueueBadgeRotation", {
                         defaultValue: "批准后可能排队：提示词注入位已满（{{used}}/{{budget}} 字符）。当前按公平轮转选取，新原则会在后续轮次自行轮到，无需停用旧原则。",
                         used: promptInjection.usedChars,

package/console/dist/ui/pages/focus/focus-validation.d.ts

@@ -4,5 +4,16 @@
  * kept separate from ui/utils/validators.ts because the page additionally
  * enforces the pending/approved/rejected status whitelist it renders on.
  */
-import type { ApprovalsGroupedData } from "../../api.js";
+import type { ApprovalsGroupedData, ApprovalGroup } from "../../api.js";
 export declare function validateApprovalsGroupedData(raw: unknown): ApprovalsGroupedData | null;
+/**
+ * PRI-940: which string may the pending-review card render as its title.
+ *
+ * `principleTitle` degrades to the synthesized `unlinked:<artifactId>` grouping
+ * key when the pinned artifact is missing — a machine id that must never reach
+ * the Owner as a title (real case: an approval pinned to a superseded scribe
+ * revision rendered `unlinked:pi-art-scribe-…` on the card). Returns undefined
+ * for that case so the caller falls back to the localized untitled copy; the
+ * degradation itself is explained by the artifactUnavailable note, not here.
+ */
+export declare function selectApprovalGroupDisplayTitle(group: Pick<ApprovalGroup, "candidateDescription" | "principleTitle" | "artifactUnavailable">): string | undefined;

package/console/dist/ui/pages/focus/focus-validation.js

@@ -64,12 +64,23 @@ function validateApprovalGroup(raw) {
             return null;
         fitsPromptBudget = fits;
     }
+    // PRI-940: artifactUnavailable is optional. ERR-009 discipline — present but
+    // wrong type fails loud (return null); absent stays undefined, which keeps
+    // the card title rendering exactly as before.
+    let artifactUnavailable;
+    if (Object.hasOwn(raw, "artifactUnavailable")) {
+        const { artifactUnavailable: unavailable } = raw;
+        if (typeof unavailable !== "boolean")
+            return null;
+        artifactUnavailable = unavailable;
+    }
     return {
         principleId,
         principleTitle,
         candidateDescription,
         status,
         fitsPromptBudget,
+        artifactUnavailable,
         records: validRecords,
     };
 }
@@ -101,3 +112,21 @@ export function validateApprovalsGroupedData(raw) {
         promptInjection: validatePromptInjectionBudgetStatus(raw.promptInjection) ?? undefined,
     };
 }
+/**
+ * PRI-940: which string may the pending-review card render as its title.
+ *
+ * `principleTitle` degrades to the synthesized `unlinked:<artifactId>` grouping
+ * key when the pinned artifact is missing — a machine id that must never reach
+ * the Owner as a title (real case: an approval pinned to a superseded scribe
+ * revision rendered `unlinked:pi-art-scribe-…` on the card). Returns undefined
+ * for that case so the caller falls back to the localized untitled copy; the
+ * degradation itself is explained by the artifactUnavailable note, not here.
+ */
+export function selectApprovalGroupDisplayTitle(group) {
+    if (group.candidateDescription !== undefined && group.candidateDescription !== "") {
+        return group.candidateDescription;
+    }
+    if (group.artifactUnavailable === true)
+        return undefined;
+    return group.principleTitle;
+}

package/console/dist/ui/utils/validators.d.ts

@@ -642,6 +642,12 @@ export interface ApprovalGroupData {
      * "do not promise rotation".
      */
     fitsPromptBudget?: boolean;
+    /**
+     * PRI-940: the pinned artifact is missing from the store, so the card has no
+     * human-readable payload and `principleTitle` carries the synthesized
+     * `unlinked:<artifactId>` machine id, which must never render as a title.
+     */
+    artifactUnavailable?: boolean;
     status: string;
     records: ApprovalGroupRecordData[];
 }

package/console/dist/ui/utils/validators.js

@@ -1652,6 +1652,12 @@ function validateApprovalGroup(v) {
     if (Object.hasOwn(v, 'fitsPromptBudget') && typeof v.fitsPromptBudget === 'boolean') {
         result.fitsPromptBudget = v.fitsPromptBudget;
     }
+    // PRI-940: optional artifactUnavailable. Only a real boolean is propagated; a
+    // present-but-wrong value is dropped so the card keeps its plain untitled
+    // fallback rather than rendering an unverified claim.
+    if (Object.hasOwn(v, 'artifactUnavailable') && typeof v.artifactUnavailable === 'boolean') {
+        result.artifactUnavailable = v.artifactUnavailable;
+    }
     return result;
 }
 export function validatePromptInjectionBudgetStatus(v) {