create-principles-disciple 1.144.22 → 1.144.25

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.3.0",
-  "sourceCommit": "693e91ab726949844986dcbc2adaa27a5ef53a31"
+  "sourceCommit": "7e8635af81a5b43f1bd8c0a2305276805b6b22ab"
 }

package/codex-adapter/dist/pd-hook.js

@@ -365,14 +365,75 @@ export async function processHookInvocation(rawStdin, _env = process.env, cwd =
         return { stdout: {}, exitCode: 0, stderr: [diagnostic(reason, nextAction)] };
     }
 }
+// PRI-943: process-boundary fail-open belt. Every resolved path sets exitCode 0,
+// so nothing may let an unwritable stream, an unserializable result, or an
+// escaping rejection reach node's default handling, which terminates the hook
+// with exit 1. Three distinct failure modes, each reproduced from a spawned
+// process in tests/pd-hook-entry-belt.test.ts:
+//   * a write that THROWS synchronously — caught per write below;
+//   * a host closing the pipe, which raises an ASYNC 'error' event on the
+//     Socket. try/catch cannot reach that one, so a listener is required
+//     (armStreamBelts) or node aborts with "Unhandled 'error' event".
+//   * the stdout JSON object failing to SERIALIZE — guarded separately because
+//     the object is the contract (serializeStdout).
+// stdout must stay exactly one JSON object, so a belt diagnostic goes to stderr
+// only; when stderr itself is the dead stream nothing is reported rather than
+// written into the machine channel.
+let beltReported = false;
+let stdoutJsonDelivered = false;
+function writeBeltDiagnostic(reason, nextAction) {
+    if (beltReported)
+        return;
+    beltReported = true;
+    try {
+        process.stderr.write(`${diagnostic(reason, nextAction)}\n`);
+    }
+    catch {
+        // Both streams are gone: there is no channel left inside the fail-open
+        // contract, and adding I/O here would widen the belt itself.
+    }
+}
+function reportStreamFailure(error) {
+    writeBeltDiagnostic(`hook_stream_failed:${errorMessage(error)}`, 'The host closed the pipe; retry the tool call — the hook failed open.');
+}
+function writeStream(stream, line) {
+    try {
+        process[stream].write(`${line}\n`);
+        // Tracked here rather than at each call site so no future stdout write can
+        // make the entry belt believe nothing was delivered yet.
+        if (stream === 'stdout')
+            stdoutJsonDelivered = true;
+        return true;
+    }
+    catch (error) {
+        reportStreamFailure(error);
+        return false;
+    }
+}
+function armStreamBelts() {
+    process.stdout.on('error', reportStreamFailure);
+    process.stderr.on('error', reportStreamFailure);
+}
+/** rc-8: the stdout JSON object is the contract itself, so serializing it is a
+ * failure path of the belt rather than of the encoder — degrade to `{}` and
+ * report, never let the throw escape into the entry belt's last-resort branch. */
+function serializeStdout(value) {
+    try {
+        return JSON.stringify(value) ?? '{}';
+    }
+    catch (error) {
+        writeBeltDiagnostic(`hook_stdout_serialize_failed:${errorMessage(error)}`, 'Retry the tool call; the hook failed open with an empty JSON object.');
+        return '{}';
+    }
+}
 async function main() {
     let raw;
     try {
         raw = readFileSync(0, 'utf8');
     }
     catch (error) {
-        process.stderr.write(`${diagnostic(`stdin_read_failed:${errorMessage(error)}`, 'Run the hook from Codex with JSON stdin.')}\n`);
-        process.stdout.write('{}\n');
+        writeStream('stderr', diagnostic(`stdin_read_failed:${errorMessage(error)}`, 'Run the hook from Codex with JSON stdin.'));
+        writeStream('stdout', '{}');
         return;
     }
     let result;
@@ -383,12 +444,16 @@ async function main() {
         // Fail-open belt for an unexpected pre-dispatch throw (e.g. a workspace
         // resolution race): Codex must still receive exactly one JSON object on
         // stdout and a bounded diagnostic on stderr — never a bare crash.
-        process.stderr.write(`${diagnostic(`hook_pipeline_unexpected:${errorMessage(error)}`, 'Retry the tool call; if it repeats, inspect PD stderr and the Workspace .pd/config.yaml state.')}\n`);
+        writeStream('stderr', diagnostic(`hook_pipeline_unexpected:${errorMessage(error)}`, 'Retry the tool call; if it repeats, inspect PD stderr and the Workspace .pd/config.yaml state.'));
         result = { stdout: {}, exitCode: 0, stderr: [] };
     }
-    for (const line of result.stderr)
-        process.stderr.write(`${line}\n`);
-    process.stdout.write(`${JSON.stringify(result.stdout)}\n`);
+    // Each write is guarded on its own: with stderr dead the stdout JSON object
+    // is still what Codex needs to fail open, so one stream must not abort the other.
+    for (const line of result.stderr) {
+        if (!writeStream('stderr', line))
+            break;
+    }
+    writeStream('stdout', serializeStdout(result.stdout));
     process.exitCode = result.exitCode;
 }
 // PRI-892: Node resolves the main module through symlinks/junctions while
@@ -414,9 +479,19 @@ function isMainModuleEntry() {
         // satisfies it, because its argv[1] is the runner, not pd-hook.
         if (path.basename(entry) !== path.basename(fileURLToPath(import.meta.url)))
             return false;
-        process.stderr.write(`${diagnostic(`entry_identity_unverified:${errorMessage(error)}`, 'Reinstall the Codex adapter; if it repeats, report this line together with the command that invoked the hook.')}\n`);
+        writeStream('stderr', diagnostic(`entry_identity_unverified:${errorMessage(error)}`, 'Reinstall the Codex adapter; if it repeats, report this line together with the command that invoked the hook.'));
         return true;
     }
 }
-if (isMainModuleEntry())
-    void main();
+if (isMainModuleEntry()) {
+    armStreamBelts();
+    void main().catch((error) => {
+        // Last-resort belt: a rejection escaping main's own guards must still leave
+        // Codex with exit 0 and, when nothing reached stdout yet, an empty JSON
+        // object instead of a bare crash.
+        writeBeltDiagnostic(`hook_fatal:${errorMessage(error)}`, 'Retry the tool call; if it repeats, report this line together with the command that invoked the hook.');
+        if (!stdoutJsonDelivered)
+            writeStream('stdout', '{}');
+        process.exitCode = 0;
+    });
+}

package/codex-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/codex-adapter",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Codex CLI host adapter for Principles Disciple — implements HostAdapter interface for OpenAI Codex CLI's stdin/stdout JSON hook model (ADR-0020).",
   "type": "module",
   "main": "./dist/index.js",

package/console/dist/server/routes/update-transaction.js

@@ -5,8 +5,8 @@ import { sendSuccess, sendMethodNotAllowed, sendNotFound } from '../utils/respon
 /** Transaction ids are installer/console-generated (`<word>-<ts>-<hex>`); this
  * pattern doubles as the path-traversal guard for the journal file name (rc-1). */
 const TRANSACTION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-function readJournalFact(journal, journalPath, transactionId) {
-    const { transitions, tornTailDetected } = journal.readTransactionJournalForRecovery(journalPath);
+function factFromTransitions(journal, transactionId, read) {
+    const { transitions } = read;
     const last = transitions[transitions.length - 1];
     const [first] = transitions;
     return {
@@ -14,7 +14,7 @@ function readJournalFact(journal, journalPath, transactionId) {
         exists: true,
         lastState: last?.to ?? null,
         terminal: last !== undefined && journal.isTerminalTransactionState(last.to),
-        tornTailDetected,
+        tornTailDetected: read.tornTailDetected,
         startedAt: first?.at ?? null,
         lastAt: last?.at ?? null,
         productVersion: last?.productVersion ?? first?.productVersion ?? null,
@@ -26,6 +26,9 @@ function readJournalFact(journal, journalPath, transactionId) {
         })),
     };
 }
+function readJournalFact(journal, journalPath, transactionId) {
+    return factFromTransitions(journal, transactionId, journal.readTransactionJournalForRecovery(journalPath));
+}
 async function transactionStatus(res, transactionId) {
     if (!TRANSACTION_ID_PATTERN.test(transactionId)) {
         sendSuccess(res, { transactionId, exists: false, reason: 'invalid_transaction_id' });
@@ -78,22 +81,57 @@ async function recoveryStatus(res) {
             });
         }
         catch {
-            sendSuccess(res, { needsRecovery: false, unfinished: [], broken: [] });
+            sendSuccess(res, { needsRecovery: false, unfinished: [], superseded: [], broken: [] });
             return null;
         }
     })();
     if (entries === null)
         return;
     const unfinished = [];
+    const superseded = [];
     const broken = [];
+    // PRI-896: a non-terminal journal is only an ALARM if the product's own
+    // recovery decision cannot explain it away. The live release record is the
+    // evidence for that, so a missing/corrupt active record means NO evidence —
+    // the alarm then stays, which is the conservative direction.
+    //
+    // rc-9 (no silent fallback): "file absent" (readActiveRecord returns null) and
+    // "file present but unreadable/corrupt" are different facts. The conservative
+    // outcome is the same (null → keep the alarm), but collapsing them hides WHY
+    // the alarm persists. Track unreadability explicitly so the response can say
+    // the alarm is retained for lack of a readable active record.
+    let activeRecordUnreadable = false;
+    const activeRecord = (() => {
+        try {
+            return journal.readActiveRecord(paths.activeRecordPath);
+        }
+        catch {
+            activeRecordUnreadable = true;
+            return null;
+        }
+    })();
     for (const entry of entries) {
         const transactionId = entry.name.slice(0, -'.jsonl'.length);
         if (!TRANSACTION_ID_PATTERN.test(transactionId))
             continue;
         try {
-            const fact = readJournalFact(journal, path.join(paths.transactionsDir, entry.name), transactionId);
-            if (!fact.terminal)
-                unfinished.push(fact);
+            const read = journal.readTransactionJournalForRecovery(path.join(paths.transactionsDir, entry.name));
+            const fact = factFromTransitions(journal, transactionId, read);
+            if (fact.terminal)
+                continue;
+            const outcome = journal.recoverUnfinishedTransaction({
+                transitions: read.transitions,
+                activeRecord,
+                transactionId,
+            });
+            if (activeRecord !== null && outcome.kind === 'old_confirmed') {
+                // Benign residue a killed run left behind, already replaced by the
+                // live generation. Reported separately (rc-9: never a silent drop),
+                // but it must not hold the Owner's attention forever.
+                superseded.push({ transactionId, reason: outcome.reason });
+                continue;
+            }
+            unfinished.push(fact);
         }
         catch (error) {
             broken.push({ transactionId, reason: error instanceof Error ? error.message : String(error) });
@@ -103,10 +141,18 @@ async function recoveryStatus(res) {
     sendSuccess(res, {
         needsRecovery: unfinished.length > 0 || broken.length > 0,
         unfinished,
+        superseded,
         broken,
+        // rc-9: when the active record could not be read, the recovery decision had
+        // no live-release evidence, so every non-terminal journal is conservatively
+        // treated as an alarm. Surfacing this explains WHY the alarm persists and
+        // points the Owner at repairing active.json rather than the journals.
+        activeRecordUnreadable,
         // SPEC §12.1: exact next step, never a vague failure.
         nextAction: unfinished.length > 0 || broken.length > 0
-            ? 'An update transaction did not reach a terminal state. Review its phase, then continue, roll back, or repair through the official installer before starting a new update.'
+            ? activeRecordUnreadable
+                ? 'The active release record (active.json) could not be read, so no transaction can be proven superseded and every unfinished one is reported. Repair active.json (re-run the official installer recovery), then re-check recovery before starting a new update.'
+                : 'An update transaction did not reach a terminal state. Review its phase, then continue, roll back, or repair through the official installer before starting a new update.'
             : undefined,
     });
 }

package/console/dist/ui/i18n/en.json

@@ -745,6 +745,8 @@
                 "confirm": "Confirm",
                 "cancel": "Cancel",
                 "rejectReasonPlaceholder": "Please explain why you reject (required)",
+                "approveNoteLabel": "Approval note (optional)",
+                "approveNotePlaceholder": "Why you approve — recorded as the decision note (may be left blank)",
                 "editReasonLabel": "Edit reason (required)",
                 "editReasonPlaceholder": "Explain why the wording or scope needs to change",
                 "editNewArtifactPlaceholder": "Enter validated revision artifact ID",

package/console/dist/ui/i18n/zh-CN.json

@@ -745,6 +745,8 @@
                 "confirm": "确认",
                 "cancel": "取消",
                 "rejectReasonPlaceholder": "请说明拒绝原因（必填）",
+                "approveNoteLabel": "批准备注（可选）",
+                "approveNotePlaceholder": "写下批准的理由，将作为裁决记录保存（可留空）",
                 "editReasonLabel": "编辑原因（必填）",
                 "editReasonPlaceholder": "请说明为什么需要调整措辞或范围",
                 "editNewArtifactPlaceholder": "输入新的已验证工件 ID",

package/console/dist/ui/pages/principles/PrincipleDetailPage.js

@@ -212,6 +212,7 @@ export function PrincipleDetailPage() {
     const [pendingAction, setPendingAction] = useState(null);
     const [rejectReason, setRejectReason] = useState("");
     const [newArtifactId, setNewArtifactId] = useState("");
+    const [approveNote, setApproveNote] = useState("");
     const [actionLoading, setActionLoading] = useState(false);
     // Evidence ID copy state (Wave 6: stop showing raw UUIDs as primary content)
     const [evidenceCopied, setEvidenceCopied] = useState(false);
@@ -345,7 +346,7 @@ export function PrincipleDetailPage() {
     // The view's actions are advisory; every submission goes through the real
     // mutation service. On failure: show the service reason, invalidate stale
     // actions, re-GET the view. Never auto-retry a mutation.
-    const submitOwnerAction = async (action, reason) => {
+    const submitOwnerAction = async (action, reason, note) => {
         if (actionLoading)
             return;
         setActionLoading(true);
@@ -364,7 +365,7 @@ export function PrincipleDetailPage() {
                     toast.error(t("principles.detail.ownerDecision.invalidTarget", { defaultValue: "动作目标缺失，无法提交。" }));
                     return;
                 }
-                const approveResult = await approveApproval(approvalId);
+                const approveResult = await approveApproval(approvalId, note);
                 settle(approveResult);
                 // PRI-890: non-fatal server warnings (e.g. prompt injection budget
                 // exclusion) must reach the Owner on this path too, not vanish.
@@ -419,6 +420,7 @@ export function PrincipleDetailPage() {
             setPendingAction(null);
             setRejectReason("");
             setNewArtifactId("");
+            setApproveNote("");
             // Invalidate the stale action list and re-derive from a fresh GET.
             await loadData();
         }
@@ -460,13 +462,15 @@ export function PrincipleDetailPage() {
                                                 return (_jsxs("li", { children: [t(stateKey, { defaultValue: subject.state }), decidedAt !== undefined ? ` · ${decidedAt.slice(0, 10)}` : '', ' · ', t(`principles.detail.ownerDecision.channel.${subject.channel}`, { defaultValue: subject.channel })] }, `hist-${subject.key}`));
                                             }) })] })), _jsxs("div", { className: "mt-5 border-t border-line pt-4", "data-testid": "owner-decision-actions", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-ink-4", children: t("principles.detail.ownerDecision.decision", { defaultValue: "你的决定" }) }), ownerDecision.availableActions.length === 0 && (_jsx("p", { className: "mt-1 text-ink-3 text-[13px]", children: t("principles.detail.ownerDecision.noActions", { defaultValue: "当前没有可以执行的操作。" }) })), ownerDecision.decisionSubjects.filter((subject) => subject.state === 'pending').length > 0 && (_jsx("div", { className: "mt-3 space-y-3", "data-testid": "owner-decision-subject-materials", children: ownerDecision.decisionSubjects.filter((subject) => subject.state === 'pending').map((subject) => (_jsxs("div", { className: "rounded-[var(--radius-sm)] border border-line p-3", "data-subject-key": subject.key, children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-ink-4", children: t("principles.detail.ownerDecision.subjectMaterial", { defaultValue: "这项决定的材料" }) }), subject.decisionMaterial.learnedPrinciple.status === 'known' ? (subject.decisionMaterial.learnedPrinciple.value.map((item, index) => (_jsx("p", { className: "mt-1 text-ink-2 text-[13px] leading-relaxed", children: item.text }, `sm-${index}`)))) : (_jsx("p", { className: "mt-1 text-amber text-[13px]", children: subject.decisionMaterial.learnedPrinciple.reason.ownerText })), subject.decisionMaterial.consequence.status === 'known' && (_jsx("p", { className: "mt-1 text-ink-3 text-[12px] leading-relaxed", children: subject.decisionMaterial.consequence.value.map((item) => item.text).join(' ') }))] }, subject.key))) })), _jsx("div", { className: "mt-2 flex flex-wrap gap-3", children: ownerDecision.availableActions.map((action) => (_jsx(Button, { variant: action.semantic === 'reject' ? 'destructive' : action.semantic === 'disable' ? 'outline' : 'default', size: "sm", disabled: actionLoading, "data-action-semantic": action.semantic, onClick: () => {
                                                     setRejectReason("");
+                                                    setApproveNote("");
                                                     setPendingAction(action);
-                                                }, children: localizeActionLabel(action, t) }, action.key))) }), ownerDecision.blockers.length > 0 && (_jsx("ul", { className: "mt-3 space-y-1 text-[12px] text-ink-3", children: ownerDecision.blockers.map((blocker, index) => (_jsx("li", { "data-testid": "owner-decision-blocker", children: localizeAggregatedBlocker(blocker.reason, t) }, `blk-${index}`))) })), pendingAction !== null && (_jsxs("div", { className: "border-t border-line pt-6 mt-6", "data-testid": "owner-decision-confirm", children: [_jsx(SectionTitle, { children: pendingAction.label }), _jsxs("div", { className: "mt-2 p-3 bg-gov/5 border border-gov/20 rounded-[var(--radius-md)]", children: [pendingAction.expectedConsequence.status === 'known' && (_jsx("div", { className: "mb-3", children: pendingAction.expectedConsequence.value.map((item, index) => (_jsx("p", { className: "text-ink-2 text-[13px] leading-relaxed mb-1", children: item.text }, `exp-${index}`))) })), _jsx("p", { className: "text-ink-2 text-[13px] mb-3", children: pendingAction.confirmation.text }), pendingAction.requirements.some((req) => req.name === 'newArtifactId') && (_jsxs(_Fragment, { children: [_jsx("label", { className: "block font-mono text-[11px] uppercase tracking-[0.08em] text-ink-3 mb-2", children: t("principles.detail.editNewArtifactLabel", { defaultValue: "新的已验证工件 ID" }) }), _jsx("input", { type: "text", value: newArtifactId, onChange: (e) => setNewArtifactId(e.target.value), placeholder: t("principles.detail.editNewArtifactPlaceholder", { defaultValue: "输入新的已验证工件 ID" }), className: "w-full border border-line rounded-[var(--radius-md)] bg-surface text-ink px-3 py-2 text-[13px] mb-2 font-mono focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gov", "aria-label": t("principles.detail.editNewArtifactPlaceholder", { defaultValue: "输入新的已验证工件 ID" }) })] })), pendingAction.requirements.some((req) => req.name === 'reason') && (_jsxs(_Fragment, { children: [_jsx("label", { className: "block font-mono text-[11px] uppercase tracking-[0.08em] text-ink-3 mb-2", children: t("principles.detail.rejectReasonLabel", { defaultValue: "拒绝原因" }) }), _jsx("textarea", { value: rejectReason, onChange: (e) => setRejectReason(e.target.value), placeholder: t("principles.detail.rejectReasonPlaceholder"), className: "w-full border border-line rounded-[var(--radius-md)] bg-surface text-ink px-3 py-2 text-[13px] min-h-[80px] resize-y focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gov", "aria-label": t("principles.detail.rejectReasonPlaceholder") })] })), _jsxs("div", { className: "flex gap-2 mt-3", children: [_jsx(Button, { variant: pendingAction.semantic === 'reject' ? 'destructive' : 'default', size: "sm", disabled: actionLoading
+                                                }, children: localizeActionLabel(action, t) }, action.key))) }), ownerDecision.blockers.length > 0 && (_jsx("ul", { className: "mt-3 space-y-1 text-[12px] text-ink-3", children: ownerDecision.blockers.map((blocker, index) => (_jsx("li", { "data-testid": "owner-decision-blocker", children: localizeAggregatedBlocker(blocker.reason, t) }, `blk-${index}`))) })), pendingAction !== null && (_jsxs("div", { className: "border-t border-line pt-6 mt-6", "data-testid": "owner-decision-confirm", children: [_jsx(SectionTitle, { children: pendingAction.label }), _jsxs("div", { className: "mt-2 p-3 bg-gov/5 border border-gov/20 rounded-[var(--radius-md)]", children: [pendingAction.expectedConsequence.status === 'known' && (_jsx("div", { className: "mb-3", children: pendingAction.expectedConsequence.value.map((item, index) => (_jsx("p", { className: "text-ink-2 text-[13px] leading-relaxed mb-1", children: item.text }, `exp-${index}`))) })), _jsx("p", { className: "text-ink-2 text-[13px] mb-3", children: pendingAction.confirmation.text }), pendingAction.requirements.some((req) => req.name === 'newArtifactId') && (_jsxs(_Fragment, { children: [_jsx("label", { className: "block font-mono text-[11px] uppercase tracking-[0.08em] text-ink-3 mb-2", children: t("principles.detail.editNewArtifactLabel", { defaultValue: "新的已验证工件 ID" }) }), _jsx("input", { type: "text", value: newArtifactId, onChange: (e) => setNewArtifactId(e.target.value), placeholder: t("principles.detail.editNewArtifactPlaceholder", { defaultValue: "输入新的已验证工件 ID" }), className: "w-full border border-line rounded-[var(--radius-md)] bg-surface text-ink px-3 py-2 text-[13px] mb-2 font-mono focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gov", "aria-label": t("principles.detail.editNewArtifactPlaceholder", { defaultValue: "输入新的已验证工件 ID" }) })] })), pendingAction.requirements.some((req) => req.name === 'reason') && (_jsxs(_Fragment, { children: [_jsx("label", { className: "block font-mono text-[11px] uppercase tracking-[0.08em] text-ink-3 mb-2", children: t("principles.detail.rejectReasonLabel", { defaultValue: "拒绝原因" }) }), _jsx("textarea", { value: rejectReason, onChange: (e) => setRejectReason(e.target.value), placeholder: t("principles.detail.rejectReasonPlaceholder"), className: "w-full border border-line rounded-[var(--radius-md)] bg-surface text-ink px-3 py-2 text-[13px] min-h-[80px] resize-y focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gov", "aria-label": t("principles.detail.rejectReasonPlaceholder") })] })), pendingAction.requirements.some((req) => req.name === 'note') && (_jsxs(_Fragment, { children: [_jsx("label", { className: "block font-mono text-[11px] uppercase tracking-[0.08em] text-ink-3 mb-2", children: t("principles.detail.approveNoteLabel", { defaultValue: "批准备注（可选）" }) }), _jsx("textarea", { "data-testid": "owner-decision-note", value: approveNote, onChange: (e) => setApproveNote(e.target.value), placeholder: pendingAction.requirements.find((req) => req.name === 'note')?.ownerText
+                                                                        ?? t("principles.detail.approveNotePlaceholder", { defaultValue: "写下批准的理由（可留空）" }), className: "w-full border border-line rounded-[var(--radius-md)] bg-surface text-ink px-3 py-2 text-[13px] min-h-[80px] resize-y focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gov", "aria-label": t("principles.detail.approveNoteLabel", { defaultValue: "批准备注（可选）" }) })] })), _jsxs("div", { className: "flex gap-2 mt-3", children: [_jsx(Button, { variant: pendingAction.semantic === 'reject' ? 'destructive' : 'default', size: "sm", disabled: actionLoading
                                                                         || (pendingAction.requirements.some((req) => req.name === 'reason') && !rejectReason.trim())
                                                                         || (pendingAction.requirements.some((req) => req.name === 'newArtifactId') && !newArtifactId.trim()), onClick: () => {
                                                                         const action = pendingAction;
-                                                                        void submitOwnerAction(action, rejectReason.trim() === '' ? undefined : rejectReason.trim());
-                                                                    }, children: t("principles.detail.confirm", { defaultValue: "确认" }) }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => { setPendingAction(null); setRejectReason(""); setNewArtifactId(""); }, children: t("principles.detail.cancel") })] })] })] }))] })] })] })), ownerDecision === null && ownerDecisionUnavailable !== null && (_jsxs("section", { className: "mb-8", "data-testid": "owner-decision-unavailable", children: [_jsx(SectionTitle, { children: t("principles.detail.ownerDecision.title", { defaultValue: "这条原则的决策视图" }) }), _jsxs("div", { className: "rounded-[var(--radius-md)] border border-amber/30 bg-amber/5 p-4", role: "status", children: [_jsx("p", { className: "text-ink-2 text-[13px]", children: t("principles.detail.ownerDecision.unavailable", { defaultValue: "决策视图暂时不可用，无法据此做决定。" }) }), _jsx("p", { className: "mt-1 text-ink-4 text-[12px] font-mono", children: ownerDecisionUnavailable.reason })] })] })), (governance !== null || governanceUnavailable !== null) && (_jsxs("section", { className: "mb-8", "aria-labelledby": "governance-summary-title", children: [_jsx(SectionTitle, { children: t('principles.detail.governance.title') }), governance !== null ? (_jsxs("div", { "data-testid": "governance-summary", className: `rounded-[var(--radius-md)] border p-4 ${governance.dataQuality.degraded ? 'border-amber/30 bg-amber/5' : 'border-gov/25 bg-gov/5'}`, children: [_jsxs("div", { className: "flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between", children: [_jsxs("div", { children: [_jsx("h2", { id: "governance-summary-title", className: "text-[18px] font-semibold text-ink", children: t(`principles.detail.${governance.summary.headlineCode}`, { defaultValue: governance.summary.headlineCode }) }), _jsx("p", { className: "mt-1 text-[13px] leading-relaxed text-ink-2", children: t(`principles.detail.${governance.summary.reasonCode}`, { defaultValue: governance.summary.reasonCode }) })] }), _jsx("span", { className: "w-fit rounded-full border border-line px-2 py-1 font-mono text-[11px] text-ink-3", children: t(`principles.detail.governance.confidence.${governance.dataQuality.degraded ? 'degraded' : 'strong'}`) })] }), _jsxs("dl", { className: "mt-4 grid grid-cols-1 gap-3 sm:grid-cols-3", children: [_jsxs("div", { children: [_jsx("dt", { className: "font-mono text-[11px] text-ink-4", children: t('principles.detail.governance.principleState') }), _jsx("dd", { className: "text-[13px] text-ink-2", children: t(`principles.detail.governance.state.${governance.principleState.value}`) })] }), _jsxs("div", { children: [_jsx("dt", { className: "font-mono text-[11px] text-ink-4", children: t('principles.detail.governance.process') }), _jsx("dd", { className: "text-[13px] text-ink-2", children: governance.process.stage === undefined ? t('principles.detail.governance.none') : t(`principles.detail.governance.stage.${governance.process.stage}`) })] }), _jsxs("div", { children: [_jsx("dt", { className: "font-mono text-[11px] text-ink-4", children: t('principles.detail.governance.automation') }), _jsx("dd", { className: "text-[13px] text-ink-2", children: t(`principles.detail.governance.automationState.${governance.automation.state}`) })] })] }), _jsxs("div", { "data-testid": "governance-next-action", className: "mt-4 border-l-2 border-l-gov pl-3", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-ink-4", children: t('principles.detail.governance.nextAction') }), _jsx("p", { className: "text-[13px] text-ink-2", children: t(`principles.detail.${governance.summary.nextActionCode}`, { defaultValue: governance.summary.nextActionCode }) })] }), governance.attention.items.length > 0 && (_jsxs("div", { className: "mt-4", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-ink-4", children: t('principles.detail.governance.blockers') }), _jsx("ul", { className: "mt-1 space-y-1 text-[13px] text-ink-2", children: groupByReasonCode(governance.attention.items).map(group => _jsx("li", { children: formatGroupedReasonLine(t, 'principles.detail.governance.attention', group) }, group.reasonCode)) })] })), governance.dataQuality.degraded && (_jsxs("div", { "data-testid": "governance-data-quality", className: "mt-4 rounded-[var(--radius-sm)] border border-amber/20 p-3", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-amber", children: t('principles.detail.governance.uncertainty') }), _jsx("ul", { className: "mt-1 space-y-1 text-[12px] text-ink-3", children: groupByReasonCode(governance.dataQuality.issues).map(group => _jsx("li", { children: formatGroupedReasonLine(t, 'principles.detail.governance.issue', group) }, group.reasonCode)) })] }))] })) : (_jsxs("div", { "data-testid": "governance-data-quality", className: "rounded-[var(--radius-md)] border border-amber/30 bg-amber/5 p-4", role: "status", children: [_jsx("h2", { id: "governance-summary-title", className: "text-[16px] font-semibold text-ink", children: t('principles.detail.governance.unavailable') }), _jsx("p", { className: "mt-1 text-[13px] text-ink-2", children: t('principles.detail.governance.unavailableReason') }), _jsx("p", { className: "mt-2 text-[12px] text-ink-3", children: t('principles.detail.governance.unavailableNextAction') })] }))] })), receipts !== null && (_jsxs("section", { className: "mb-8", "aria-labelledby": "receipt-history-title", children: [_jsx(SectionTitle, { children: t('principles.detail.receipts.title') }), receipts.status === 'ok' ? (_jsxs("div", { "data-testid": "receipt-history", className: "rounded-[var(--radius-md)] border border-line p-4", children: [_jsxs("div", { className: "flex flex-wrap items-baseline justify-between gap-2", children: [_jsx("h2", { id: "receipt-history-title", className: "text-[15px] font-semibold text-ink", children: receiptPresentation?.headlineKey === 'principles.detail.receipts.headline'
+                                                                        void submitOwnerAction(action, rejectReason.trim() === '' ? undefined : rejectReason.trim(), approveNote.trim() === '' ? undefined : approveNote.trim());
+                                                                    }, children: t("principles.detail.confirm", { defaultValue: "确认" }) }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => { setPendingAction(null); setRejectReason(""); setNewArtifactId(""); setApproveNote(""); }, children: t("principles.detail.cancel") })] })] })] }))] })] })] })), ownerDecision === null && ownerDecisionUnavailable !== null && (_jsxs("section", { className: "mb-8", "data-testid": "owner-decision-unavailable", children: [_jsx(SectionTitle, { children: t("principles.detail.ownerDecision.title", { defaultValue: "这条原则的决策视图" }) }), _jsxs("div", { className: "rounded-[var(--radius-md)] border border-amber/30 bg-amber/5 p-4", role: "status", children: [_jsx("p", { className: "text-ink-2 text-[13px]", children: t("principles.detail.ownerDecision.unavailable", { defaultValue: "决策视图暂时不可用，无法据此做决定。" }) }), _jsx("p", { className: "mt-1 text-ink-4 text-[12px] font-mono", children: ownerDecisionUnavailable.reason })] })] })), (governance !== null || governanceUnavailable !== null) && (_jsxs("section", { className: "mb-8", "aria-labelledby": "governance-summary-title", children: [_jsx(SectionTitle, { children: t('principles.detail.governance.title') }), governance !== null ? (_jsxs("div", { "data-testid": "governance-summary", className: `rounded-[var(--radius-md)] border p-4 ${governance.dataQuality.degraded ? 'border-amber/30 bg-amber/5' : 'border-gov/25 bg-gov/5'}`, children: [_jsxs("div", { className: "flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between", children: [_jsxs("div", { children: [_jsx("h2", { id: "governance-summary-title", className: "text-[18px] font-semibold text-ink", children: t(`principles.detail.${governance.summary.headlineCode}`, { defaultValue: governance.summary.headlineCode }) }), _jsx("p", { className: "mt-1 text-[13px] leading-relaxed text-ink-2", children: t(`principles.detail.${governance.summary.reasonCode}`, { defaultValue: governance.summary.reasonCode }) })] }), _jsx("span", { className: "w-fit rounded-full border border-line px-2 py-1 font-mono text-[11px] text-ink-3", children: t(`principles.detail.governance.confidence.${governance.dataQuality.degraded ? 'degraded' : 'strong'}`) })] }), _jsxs("dl", { className: "mt-4 grid grid-cols-1 gap-3 sm:grid-cols-3", children: [_jsxs("div", { children: [_jsx("dt", { className: "font-mono text-[11px] text-ink-4", children: t('principles.detail.governance.principleState') }), _jsx("dd", { className: "text-[13px] text-ink-2", children: t(`principles.detail.governance.state.${governance.principleState.value}`) })] }), _jsxs("div", { children: [_jsx("dt", { className: "font-mono text-[11px] text-ink-4", children: t('principles.detail.governance.process') }), _jsx("dd", { className: "text-[13px] text-ink-2", children: governance.process.stage === undefined ? t('principles.detail.governance.none') : t(`principles.detail.governance.stage.${governance.process.stage}`) })] }), _jsxs("div", { children: [_jsx("dt", { className: "font-mono text-[11px] text-ink-4", children: t('principles.detail.governance.automation') }), _jsx("dd", { className: "text-[13px] text-ink-2", children: t(`principles.detail.governance.automationState.${governance.automation.state}`) })] })] }), _jsxs("div", { "data-testid": "governance-next-action", className: "mt-4 border-l-2 border-l-gov pl-3", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-ink-4", children: t('principles.detail.governance.nextAction') }), _jsx("p", { className: "text-[13px] text-ink-2", children: t(`principles.detail.${governance.summary.nextActionCode}`, { defaultValue: governance.summary.nextActionCode }) })] }), governance.attention.items.length > 0 && (_jsxs("div", { className: "mt-4", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-ink-4", children: t('principles.detail.governance.blockers') }), _jsx("ul", { className: "mt-1 space-y-1 text-[13px] text-ink-2", children: groupByReasonCode(governance.attention.items).map(group => _jsx("li", { children: formatGroupedReasonLine(t, 'principles.detail.governance.attention', group) }, group.reasonCode)) })] })), governance.dataQuality.degraded && (_jsxs("div", { "data-testid": "governance-data-quality", className: "mt-4 rounded-[var(--radius-sm)] border border-amber/20 p-3", children: [_jsx("p", { className: "font-mono text-[11px] uppercase tracking-[0.08em] text-amber", children: t('principles.detail.governance.uncertainty') }), _jsx("ul", { className: "mt-1 space-y-1 text-[12px] text-ink-3", children: groupByReasonCode(governance.dataQuality.issues).map(group => _jsx("li", { children: formatGroupedReasonLine(t, 'principles.detail.governance.issue', group) }, group.reasonCode)) })] }))] })) : (_jsxs("div", { "data-testid": "governance-data-quality", className: "rounded-[var(--radius-md)] border border-amber/30 bg-amber/5 p-4", role: "status", children: [_jsx("h2", { id: "governance-summary-title", className: "text-[16px] font-semibold text-ink", children: t('principles.detail.governance.unavailable') }), _jsx("p", { className: "mt-1 text-[13px] text-ink-2", children: t('principles.detail.governance.unavailableReason') }), _jsx("p", { className: "mt-2 text-[12px] text-ink-3", children: t('principles.detail.governance.unavailableNextAction') })] }))] })), receipts !== null && (_jsxs("section", { className: "mb-8", "aria-labelledby": "receipt-history-title", children: [_jsx(SectionTitle, { children: t('principles.detail.receipts.title') }), receipts.status === 'ok' ? (_jsxs("div", { "data-testid": "receipt-history", className: "rounded-[var(--radius-md)] border border-line p-4", children: [_jsxs("div", { className: "flex flex-wrap items-baseline justify-between gap-2", children: [_jsx("h2", { id: "receipt-history-title", className: "text-[15px] font-semibold text-ink", children: receiptPresentation?.headlineKey === 'principles.detail.receipts.headline'
                                                 ? t(receiptPresentation.headlineKey, {
                                                     defaultValue: '',
                                                     effectCount: receipts.effectCount,

package/console/dist/ui/utils/validators.d.ts

@@ -874,6 +874,10 @@ export interface UpdateRecoveryItem {
     productVersion: string | null;
     tornTailDetected: boolean;
 }
+export interface UpdateRecoverySuperseded {
+    transactionId: string;
+    reason: string;
+}
 export interface UpdateRecoveryData {
     needsRecovery: boolean;
     unfinished: UpdateRecoveryItem[];
@@ -881,6 +885,18 @@ export interface UpdateRecoveryData {
         transactionId: string;
         reason: string;
     }[];
+    /**
+     * PRI-896: non-terminal journals the live release has already superseded.
+     * Reported separately (rc-9: never a silent drop) but never hold the alarm.
+     */
+    superseded: UpdateRecoverySuperseded[];
+    /**
+     * rc-9 (PRI-896/CR-2): active.json could not be read, so recovery had no
+     * live-release evidence and every non-terminal journal is conservatively an
+     * alarm. When true the alarm is retained for lack of a readable active
+     * record — repair active.json rather than the journals.
+     */
+    activeRecordUnreadable?: boolean;
     nextAction?: string;
 }
 export declare function validateUpdateRecovery(v: unknown): UpdateRecoveryData | null;

package/console/dist/ui/utils/validators.js

@@ -2414,7 +2414,20 @@ export function validateUpdateRecovery(v) {
             broken.push({ transactionId: item.transactionId, reason: item.reason });
         }
     }
-    const result = { needsRecovery: v.needsRecovery, unfinished, broken };
+    const superseded = [];
+    if (Object.hasOwn(v, 'superseded') && Array.isArray(v.superseded)) {
+        for (const item of v.superseded) {
+            if (!isObject(item) || !Object.hasOwn(item, 'transactionId') || !isString(item.transactionId))
+                continue;
+            if (!Object.hasOwn(item, 'reason') || !isString(item.reason))
+                continue;
+            superseded.push({ transactionId: item.transactionId, reason: item.reason });
+        }
+    }
+    const result = { needsRecovery: v.needsRecovery, unfinished, broken, superseded };
+    if (Object.hasOwn(v, 'activeRecordUnreadable') && typeof v.activeRecordUnreadable === 'boolean') {
+        result.activeRecordUnreadable = v.activeRecordUnreadable;
+    }
     if (Object.hasOwn(v, 'nextAction') && isString(v.nextAction))
         result.nextAction = v.nextAction;
     return result;