create-principles-disciple 1.145.25 → 1.145.27

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
   "productVersion": "2.3.13",
-  "sourceCommit": "8699502b4558837c908be45d3b71190335645a54"
+  "sourceCommit": "0abb21264600cd66a57c7960cd089cf854f0768b"
 }

package/console/dist/server/config/pd-config-store.d.ts

@@ -247,6 +247,7 @@ export declare function createRuntimeProfile(workspaceDir: string, profileId: st
  * Update an existing runtime profile in .pd/config.yaml.
  *
  * - Rejects non-existent profile (404 not_found)
+ * - Rejects retired legacy profiles (400 retired_profile_type — read-only per ADR-0029)
  * - Rejects type changes (400 bad_request — type change = delete + create)
  * - Merges patch into existing profile, only known fields are persisted
  * - Persists atomically, preserving unknown config sections

package/console/dist/server/config/pd-config-store.js

@@ -1083,6 +1083,17 @@ export function createRuntimeProfile(workspaceDir, profileId, payload) {
     if (!structResult.ok) {
         return { ok: false, statusCode: 400, error: structResult.error, message: structResult.message };
     }
+    // ADR-0029: the 'openclaw' profile type is read-only legacy. Existing legacy
+    // profiles keep parsing and stay listed, but PD must never write a new one.
+    if (structResult.type === 'openclaw') {
+        return {
+            ok: false,
+            statusCode: 400,
+            error: 'retired_profile_type',
+            message: `Runtime profile type 'openclaw' is retired (ADR-0029) and cannot be created.`,
+            nextAction: 'Create a pi-ai profile instead (provider + model + apiKeyEnv).',
+        };
+    }
     // 3. Load existing config — refuse to write on malformed (rc-9)
     const loadResult = loadPdConfig(workspaceDir);
     if (!loadResult.ok) {
@@ -1151,6 +1162,7 @@ export function createRuntimeProfile(workspaceDir, profileId, payload) {
  * Update an existing runtime profile in .pd/config.yaml.
  *
  * - Rejects non-existent profile (404 not_found)
+ * - Rejects retired legacy profiles (400 retired_profile_type — read-only per ADR-0029)
  * - Rejects type changes (400 bad_request — type change = delete + create)
  * - Merges patch into existing profile, only known fields are persisted
  * - Persists atomically, preserving unknown config sections
@@ -1194,7 +1206,17 @@ export function updateRuntimeProfile(workspaceDir, profileId, patch) {
             message: `Profile '${profileId}' existence check passed but value is undefined.`,
             nextAction: 'This is a bug in PD config resolution. Please report it.' };
     }
-    // 5. Reject type change (type change = delete + create)
+    // 5. Reject retired legacy profiles — ADR-0029: accepted on read, never written by PD
+    if (existingProfile.type === 'openclaw') {
+        return {
+            ok: false,
+            statusCode: 400,
+            error: 'retired_profile_type',
+            message: `Runtime profile type 'openclaw' is retired (ADR-0029) and cannot be updated. The profile stays readable for legacy compatibility only.`,
+            nextAction: `DELETE /api/v1/config/profiles/${encodeURIComponent(profileId)} and create a pi-ai profile instead (provider + model + apiKeyEnv)`,
+        };
+    }
+    // 6. Reject type change (type change = delete + create)
     if (Object.hasOwn(patch, 'type')) {
         const patchType = patch.type;
         if (typeof patchType !== 'string' || patchType !== existingProfile.type) {
@@ -1207,10 +1229,10 @@ export function updateRuntimeProfile(workspaceDir, profileId, patch) {
             };
         }
     }
-    // 6. Merge patch into existing profile, then extract only known fields
+    // 7. Merge patch into existing profile, then extract only known fields
     const mergedSource = { ...existingProfile, ...patch };
     const mergedRecord = extractProfileFields(mergedSource, existingProfile.type);
-    // 7. Read raw config to preserve unknown sections, update the profile
+    // 8. Read raw config to preserve unknown sections, update the profile
     const configPath = getPdConfigPath(workspaceDir);
     const rawConfig = readRawConfig(configPath);
     const profilesMap = isRecord(rawConfig.runtimeProfiles)
@@ -1218,7 +1240,7 @@ export function updateRuntimeProfile(workspaceDir, profileId, patch) {
         : { ...effective.config.runtimeProfiles };
     profilesMap[profileId] = mergedRecord;
     rawConfig.runtimeProfiles = profilesMap;
-    // 8. Validate the full updated config
+    // 9. Validate the full updated config
     const validation = validatePdConfig(rawConfig);
     if (!validation.ok) {
         return {
@@ -1229,7 +1251,7 @@ export function updateRuntimeProfile(workspaceDir, profileId, patch) {
             nextAction: 'Fix profile fields and retry',
         };
     }
-    // 9. Atomic write
+    // 10. Atomic write
     try {
         writeConfigAtomic(configPath, rawConfig);
     }
@@ -1237,7 +1259,7 @@ export function updateRuntimeProfile(workspaceDir, profileId, patch) {
         const message = err instanceof Error ? err.message : String(err);
         return { ok: false, statusCode: 500, error: 'write_error', message: `Failed to write config: ${message}`, nextAction: 'Check disk space and file permissions for .pd/config.yaml' };
     }
-    // 10. Return the validated updated profile
+    // 11. Return the validated updated profile
     // Defensive guard: Object.hasOwn() doesn't narrow TS type.
     const updatedProfile = validation.value.runtimeProfiles[profileId];
     if (!updatedProfile) {

package/console/dist/server/models/RuleCandidateBindingConsoleModel.d.ts

@@ -7,6 +7,19 @@ export declare class RuleCandidateBindingConsoleModel {
     private readonly workspaceDir;
     constructor(workspaceDir: string);
     private ledger;
+    /** One bounded readonly batch read of the pain events behind the queue.
+     * `degraded` names an unreadable trajectory store so lookups that found
+     * nothing are labeled 不可读 rather than 未记录 (rc-9 — never misattribute). */
+    private painSources;
+    /** Identity stays with the ledger adapter (the identity authority); the
+     * principle entry / decidedAt come from the caller's single file snapshot.
+     * bindingRevision rides along so the source-correction preview can anchor
+     * its eligibility to the CURRENT binding (PRI-1048 R6 #4). */
+    private queueBinding;
+    /** PRI-1048 R6 #4: read-only eligibility preview for source-correct-once.
+     * Only the bound+blocked shape can offer it; the click-time authority
+     * (reviseRuleSourceOnce) re-checks everything server-side. */
+    private sourceCorrectionPreview;
     list(): Promise<RuleBindingQueueView>;
     review(candidateId: string, search: string): Promise<{
         ok: true;
@@ -37,4 +50,17 @@ export declare class RuleCandidateBindingConsoleModel {
         scribeTaskId: string;
         taskRevisionEpoch: number;
     }>;
+    /**
+     * SPEC-PRI-1047 修复 B: 认证入口的一次 Owner source-correction。区别于
+     * revise（binding 修订预算）：这是「修正上游材料」的独立一次预算，回执
+     * 绑定真实 Owner actor/request。调用侧（路由）负责 ownerIdentity 门。
+     */
+    correctSource(candidateId: string, input: {
+        expectedBindingRevision: number;
+        expectedScribeTaskId: string;
+        expectedArtificerTaskId: string;
+        expectedScribeArtifactDigest: string;
+        reason: string;
+        requestId: string;
+    }, actorId: string): Promise<import("@principles/core/runtime-v2").ReviseRuleSourceOnceResult>;
 }

package/console/dist/server/models/RuleCandidateBindingConsoleModel.js

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import { existsSync } from 'node:fs';
-import { createRuntimeStateHandle, PrincipleTreeLedgerAdapter, reviseRuleBindingOnce, } from '@principles/core/runtime-v2';
+import Database from 'better-sqlite3';
+import { createRuntimeStateHandle, PrincipleTreeLedgerAdapter, reviseRuleBindingOnce, resolveRuleBindingRevisionTarget, reviseRuleSourceOnce, previewRuleSourceCorrection, hydratePITaskRecord, candidateIdFromDreamerSeed, } from '@principles/core/runtime-v2';
+import { readLedgerFileState } from '@principles/core/principle-tree-ledger';
 import { ActivationsConsoleModel } from './ActivationsConsoleModel.js';
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -8,6 +10,108 @@ function record(value) {
 function stringField(value, key) {
     return record(value) && typeof value[key] === 'string' ? value[key] : '';
 }
+/** Internalization chain order; the queue projection walks it read-only. */
+const CHAIN_KINDS = ['dreamer', 'philosopher', 'scribe', 'artificer', 'evaluator', 'rollout_reviewer'];
+/** PRI-1048: bounded queue — a governance workspace carries tens of candidates;
+ * the cap keeps the derived scan bounded and the response honest via `truncated`. */
+const MAX_QUEUE_ITEMS = 200;
+function buildChainContext(allTasks) {
+    const byId = new Map(allTasks.map(task => [task.taskId, task]));
+    const dreamersByCandidate = new Map();
+    const dependentsByTaskId = new Map();
+    for (const task of allTasks) {
+        if (task.taskKind === 'dreamer') {
+            const seed = candidateIdFromDreamerSeed(task.diagnosticJson ?? null);
+            if (seed) {
+                const list = dreamersByCandidate.get(seed) ?? [];
+                list.push(task);
+                dreamersByCandidate.set(seed, list);
+            }
+        }
+        const pi = hydratePITaskRecord(task);
+        if (!pi)
+            continue;
+        for (const dependencyId of pi.dependencyTaskIds) {
+            const list = dependentsByTaskId.get(dependencyId) ?? [];
+            list.push(task);
+            dependentsByTaskId.set(dependencyId, list);
+        }
+    }
+    return { byId, dreamersByCandidate, dependentsByTaskId };
+}
+function walkChain(dreamer, context) {
+    let current = dreamer;
+    let kind = 'dreamer';
+    for (;;) {
+        if (!current)
+            return { stage: 'advanced', stageKind: kind, reasonCode: null, detail: null };
+        if (current.status === 'needs_human_review' || current.status === 'failed') {
+            const pi = hydratePITaskRecord(current);
+            const review = pi?.humanReviewContext;
+            return {
+                stage: 'blocked', stageKind: kind,
+                reasonCode: review && typeof review.reasonCode === 'string' ? review.reasonCode : null,
+                detail: review && typeof review.detail === 'string' ? review.detail : (current.lastError ?? null),
+            };
+        }
+        if (current.status !== 'succeeded')
+            return { stage: 'in_progress', stageKind: kind, reasonCode: null, detail: null };
+        const nextIndex = CHAIN_KINDS.indexOf(kind) + 1;
+        const nextKind = nextIndex < CHAIN_KINDS.length ? CHAIN_KINDS[nextIndex] : undefined;
+        if (!nextKind)
+            return { stage: 'advanced', stageKind: kind, reasonCode: null, detail: null };
+        const next = (context.dependentsByTaskId.get(current.taskId) ?? []).find(task => task.taskKind === nextKind);
+        if (!next)
+            return { stage: 'advanced', stageKind: kind, reasonCode: null, detail: null };
+        current = next;
+        kind = nextKind;
+    }
+}
+function deriveGeneration(candidateId, context) {
+    const dreamers = context.dreamersByCandidate.get(candidateId) ?? [];
+    if (dreamers.length === 0)
+        return { stage: 'not_built', stageKind: null, reasonCode: null, detail: null };
+    const walks = dreamers.map(dreamer => walkChain(dreamer, context));
+    const [first] = walks;
+    if (!first)
+        return { stage: 'ambiguous', stageKind: null, reasonCode: null, detail: null };
+    const sameWalk = (a, b) => a.stage === b.stage && a.stageKind === b.stageKind && a.reasonCode === b.reasonCode;
+    if (walks.every(walk => sameWalk(walk, first)))
+        return first;
+    return { stage: 'ambiguous', stageKind: null, reasonCode: null, detail: null };
+}
+/**
+ * Real backend eligibility only: the production resolver plus the exact
+ * budget rule reviseRuleBindingOnce enforces on the same scribe task. The
+ * revise-once route still authoritatively re-checks at click time.
+ */
+async function deriveResume(stateManager, candidateId) {
+    const target = await resolveRuleBindingRevisionTarget(stateManager, candidateId);
+    if (target.status !== 'ready')
+        return { status: 'refused', reason: target.reason, scribeTaskId: null, taskRevisionEpoch: null };
+    const scribe = await stateManager.getTask(target.scribeTaskId);
+    const pi = scribe ? hydratePITaskRecord(scribe) : null;
+    if (!scribe || !pi)
+        return { status: 'refused', reason: 'scribe_missing', scribeTaskId: target.scribeTaskId, taskRevisionEpoch: target.taskRevisionEpoch };
+    if (pi.ruleBindingRevisionCauseId || pi.revisionCauseId?.startsWith('rule-binding:')) {
+        return { status: 'refused', reason: 'revision_budget_exhausted', scribeTaskId: target.scribeTaskId, taskRevisionEpoch: target.taskRevisionEpoch };
+    }
+    return { status: 'ready', reason: null, scribeTaskId: target.scribeTaskId, taskRevisionEpoch: target.taskRevisionEpoch };
+}
+/** Uses the caller's ONE ledger snapshot: decidedAt + principle entry, no extra file read. */
+function boundPrincipleView(state, lookup) {
+    if (state.availability.status === 'unreadable')
+        return null;
+    const principle = Object.hasOwn(state.ledger.tree.principles, lookup.principleId) ? state.ledger.tree.principles[lookup.principleId] : undefined;
+    if (!principle)
+        return null;
+    const binding = Object.hasOwn(state.ledger.tree.ruleCandidateBindings ?? {}, lookup.candidateId)
+        ? state.ledger.tree.ruleCandidateBindings?.[lookup.candidateId]?.revisions.at(-1) : undefined;
+    return {
+        principleId: lookup.principleId, text: principle.text, status: principle.status,
+        version: principle.version, revision: lookup.revision, decidedAt: binding?.decidedAt ?? '',
+    };
+}
 /** Derived review only. Binding authority stays inside the locked core Ledger writer. */
 export class RuleCandidateBindingConsoleModel {
     workspaceDir;
@@ -32,31 +136,172 @@ export class RuleCandidateBindingConsoleModel {
             },
         });
     }
+    /** One bounded readonly batch read of the pain events behind the queue.
+     * `degraded` names an unreadable trajectory store so lookups that found
+     * nothing are labeled 不可读 rather than 未记录 (rc-9 — never misattribute). */
+    painSources(painIds) {
+        const result = new Map();
+        const distinct = [...new Set(painIds.filter(id => id !== ''))];
+        if (distinct.length === 0)
+            return { sources: result, degraded: null };
+        const dbPath = path.join(this.workspaceDir, '.state', 'trajectory.db');
+        if (!existsSync(dbPath))
+            return { sources: result, degraded: null };
+        let db = null;
+        try {
+            db = new Database(dbPath, { readonly: true });
+            const placeholders = distinct.map(() => '?').join(',');
+            const rows = db.prepare(`SELECT canonical_pain_id AS painId, source, text, created_at AS createdAt
+         FROM pain_events WHERE canonical_pain_id IN (${placeholders})`).all(...distinct);
+            // Multiple events may share a canonical id; keep the newest (same policy
+            // as the pain list ordering — newest first).
+            for (const row of rows) {
+                if (!record(row))
+                    continue;
+                const painId = typeof row.painId === 'string' ? row.painId : '';
+                if (painId === '')
+                    continue;
+                const existing = result.get(painId);
+                const createdAt = typeof row.createdAt === 'string' ? row.createdAt : null;
+                if (existing && existing.createdAt && createdAt && existing.createdAt >= createdAt)
+                    continue;
+                result.set(painId, {
+                    painId,
+                    text: typeof row.text === 'string' && row.text.trim() !== '' ? row.text : null,
+                    source: typeof row.source === 'string' ? row.source : 'unknown',
+                    createdAt,
+                });
+            }
+        }
+        catch {
+            // Read failure must not masquerade as never-recorded: the degraded flag
+            // turns missing lookups into 记录暂不可读 (rc-9 observable degradation).
+            return { sources: new Map(), degraded: 'trajectory_unreadable' };
+        }
+        finally {
+            db?.close();
+        }
+        return { sources: result, degraded: null };
+    }
+    /** Identity stays with the ledger adapter (the identity authority); the
+     * principle entry / decidedAt come from the caller's single file snapshot.
+     * bindingRevision rides along so the source-correction preview can anchor
+     * its eligibility to the CURRENT binding (PRI-1048 R6 #4). */
+    queueBinding(stateManager, ledgerState, candidateId) {
+        const identity = this.ledger(stateManager).resolveCandidatePrincipleIdentity(candidateId, 'rule');
+        if (identity.status === 'resolved') {
+            const view = boundPrincipleView(ledgerState, { candidateId, principleId: identity.principleId, revision: identity.bindingRevision ?? 0 });
+            if (view)
+                return { view: { status: 'bound', principle: view }, bindingRevision: identity.bindingRevision ?? null };
+            // Bound in the ledger but the principle entry itself is unreadable or
+            // gone — surface as attention, never silently unlinked.
+            return { view: { status: 'attention', reason: 'bound_principle_unreadable' }, bindingRevision: identity.bindingRevision ?? null };
+        }
+        if (identity.reason === 'missing')
+            return { view: { status: 'unlinked' }, bindingRevision: null };
+        if (identity.reason === 'binding_revoked')
+            return { view: { status: 'binding_revoked' }, bindingRevision: null };
+        return { view: { status: 'attention', reason: identity.reason }, bindingRevision: null };
+    }
+    /** PRI-1048 R6 #4: read-only eligibility preview for source-correct-once.
+     * Only the bound+blocked shape can offer it; the click-time authority
+     * (reviseRuleSourceOnce) re-checks everything server-side. */
+    async sourceCorrectionPreview(stateManager, candidateId, bindingRevision) {
+        const ledger = this.ledger(stateManager);
+        const preview = await previewRuleSourceCorrection({
+            stateManager,
+            ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule') },
+            candidateId,
+            expectedBindingRevision: bindingRevision,
+        });
+        return preview.status === 'ready'
+            ? {
+                status: 'ready', reason: null,
+                scribeTaskId: preview.scribeTaskId, artificerTaskId: preview.artificerTaskId,
+                scribeArtifactDigest: preview.scribeArtifactDigest, expectedBindingRevision: preview.expectedBindingRevision,
+            }
+            : { status: 'unavailable', reason: preview.reason, scribeTaskId: null, artificerTaskId: null, scribeArtifactDigest: null, expectedBindingRevision: null };
+    }
     async list() {
         // A fresh workspace with no state.db simply has no binding queue yet;
         // any other storage problem still surfaces as an error (503 at the route).
-        if (!existsSync(path.join(this.workspaceDir, '.pd', 'state.db')))
-            return { items: [] };
+        if (!existsSync(path.join(this.workspaceDir, '.pd', 'state.db'))) {
+            return { items: [], summary: { painGroups: 0, candidates: 0, bound: 0, unlinked: 0, blocked: 0 }, truncated: false };
+        }
         const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
         try {
-            const ledger = this.ledger(handle.stateManager);
+            const { stateManager } = handle;
+            const allTasks = await stateManager.listTasks();
+            const taskById = new Map(allTasks.map(task => [task.taskId, task]));
             // Split diagnoses commit their rule candidates on diag_router sub-tasks;
-            // the queue must surface both provenance shapes, not only direct
-            // diagnostician commits.
-            const tasks = [
-                ...await handle.stateManager.listTasks({ taskKind: 'diagnostician' }),
-                ...await handle.stateManager.listTasks({ taskKind: 'diag_router' }),
-            ];
-            const items = [];
-            for (const task of tasks) {
-                for (const candidate of await handle.stateManager.getCandidatesByTaskId(task.taskId)) {
+            // getCandidatesByTaskId already spans "own + child" tasks, so traversing
+            // BOTH task lists surfaces router-committed candidates twice. The queue
+            // aggregation owner (this model) dedupes by canonical candidateId; the
+            // shared store query keeps its semantics for every other consumer.
+            const diagnosisTasks = allTasks.filter(task => task.taskKind === 'diagnostician' || task.taskKind === 'diag_router');
+            const collected = new Map();
+            for (const task of diagnosisTasks) {
+                for (const candidate of await stateManager.getCandidatesByTaskId(task.taskId)) {
                     if (candidate.rawRecommendationKind !== 'rule')
                         continue;
-                    const identity = ledger.resolveCandidatePrincipleIdentity(candidate.candidateId, 'rule');
-                    items.push({ candidateId: candidate.candidateId, text: candidate.description || candidate.title, reason: identity.status === 'unresolved' ? identity.reason : 'bound' });
+                    if (collected.has(candidate.candidateId))
+                        continue;
+                    // Source pain: a router candidate resolves through its parent
+                    // diagnostician; a direct candidate reads its own inputRef.
+                    const candidateTask = taskById.get(candidate.taskId) ?? task;
+                    const parentTask = candidateTask.taskKind === 'diag_router' && candidateTask.inputRef
+                        ? taskById.get(candidateTask.inputRef) : undefined;
+                    const diagnosisTaskId = parentTask?.taskId ?? candidateTask.taskId;
+                    const painId = (parentTask?.inputRef ?? candidateTask.inputRef) ?? '';
+                    collected.set(candidate.candidateId, {
+                        candidateId: candidate.candidateId,
+                        text: candidate.description || candidate.title,
+                        painId, diagnosisTaskId,
+                    });
                 }
             }
-            return { items };
+            const truncated = collected.size > MAX_QUEUE_ITEMS;
+            const entries = [...collected.values()].slice(0, MAX_QUEUE_ITEMS);
+            const painLookup = this.painSources(entries.map(entry => entry.painId));
+            const chainContext = buildChainContext(allTasks);
+            const ledgerState = readLedgerFileState(path.join(this.workspaceDir, '.state'));
+            const items = [];
+            for (const entry of entries) {
+                const diagnosisTask = chainContext.byId.get(entry.diagnosisTaskId) ?? null;
+                const { view: binding, bindingRevision } = this.queueBinding(stateManager, ledgerState, entry.candidateId);
+                const generation = binding.status === 'unlinked' ? null : deriveGeneration(entry.candidateId, chainContext);
+                const resume = binding.status === 'bound' ? await deriveResume(stateManager, entry.candidateId) : null;
+                // PRI-1048 R6 #4: the source-correction entry applies to the bound+blocked
+                // shape only (the binding revision budget is typically already spent there).
+                const sourceCorrection = binding.status === 'bound' && generation?.stage === 'blocked' && bindingRevision !== null
+                    ? await this.sourceCorrectionPreview(stateManager, entry.candidateId, bindingRevision)
+                    : null;
+                items.push({
+                    candidateId: entry.candidateId,
+                    text: entry.text,
+                    pain: painLookup.sources.get(entry.painId) ?? {
+                        painId: entry.painId, text: null,
+                        source: painLookup.degraded === 'trajectory_unreadable' && entry.painId !== '' ? 'unreadable' : 'unknown',
+                        createdAt: null,
+                    },
+                    diagnosisStatus: diagnosisTask?.status ?? 'unknown',
+                    binding,
+                    generation,
+                    resume,
+                    sourceCorrection,
+                });
+            }
+            return {
+                items,
+                summary: {
+                    painGroups: new Set(items.map(item => item.pain.painId === '' ? `candidate:${item.candidateId}` : item.pain.painId)).size,
+                    candidates: items.length,
+                    bound: items.filter(item => item.binding.status === 'bound').length,
+                    unlinked: items.filter(item => item.binding.status === 'unlinked').length,
+                    blocked: items.filter(item => item.generation?.stage === 'blocked').length,
+                },
+                truncated,
+            };
         }
         finally {
             await handle.close();
@@ -65,20 +310,44 @@ export class RuleCandidateBindingConsoleModel {
     async review(candidateId, search) {
         const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
         try {
-            const result = await this.ledger(handle.stateManager).createRuleCandidateBindingReview(candidateId, { search, limit: 20 });
+            const { stateManager } = handle;
+            const result = await this.ledger(stateManager).createRuleCandidateBindingReview(candidateId, { search, limit: 20 });
             if (!result.ok)
                 return result;
             const { candidateMaterial: material } = result;
+            const parentTaskInputRef = stringField(Reflect.get(material, 'parentTask'), 'inputRef');
+            const painId = parentTaskInputRef || stringField(material.task, 'inputRef');
+            const painLookup = this.painSources([painId]);
+            const pain = painLookup.sources.get(painId) ?? {
+                painId, text: null,
+                source: painLookup.degraded === 'trajectory_unreadable' && painId !== '' ? 'unreadable' : 'unknown',
+                createdAt: null,
+            };
+            const { currentBinding } = result;
+            const isBound = currentBinding?.action === 'bind';
+            const boundPrinciple = isBound && currentBinding
+                ? boundPrincipleView(readLedgerFileState(path.join(this.workspaceDir, '.state')), { candidateId, principleId: currentBinding.principleId, revision: currentBinding.revision })
+                : null;
+            const chainContext = buildChainContext(await stateManager.listTasks());
+            const generation = isBound ? deriveGeneration(candidateId, chainContext) : null;
+            const resume = isBound ? await deriveResume(stateManager, candidateId) : null;
+            const sourceCorrection = isBound && generation?.stage === 'blocked' && currentBinding
+                ? await this.sourceCorrectionPreview(stateManager, candidateId, currentBinding.revision)
+                : null;
             return { ok: true, review: {
                     candidateId, candidateText: stringField(material.candidate, 'description') || stringField(material.candidate, 'title'),
-                    sourcePainId: stringField(Reflect.get(material, 'parentTask'), 'inputRef') || stringField(material.task, 'inputRef'),
+                    sourcePain: pain,
                     evidence: stringField(material.artifact, 'contentJson') || stringField(material.candidate, 'sourceRecommendationJson'),
                     candidateDigest: result.reviewedCandidateDigest,
                     currentRevision: result.currentRevision,
-                    currentBinding: result.currentBinding,
+                    currentBinding,
+                    boundPrinciple,
                     eligibleTargets: result.eligibleTargets.map(({ principle, reviewedPrincipleDigest }) => ({
                         principleId: principle.id, text: principle.text, status: principle.status, version: principle.version, digest: reviewedPrincipleDigest,
                     })),
+                    generation,
+                    resume,
+                    sourceCorrection,
                     resumeNotice: '关联后自动启动一次现有配置的正文修订与代码生成、验证；沿用现有调用预算和超时。失败会保留关联与旧工件，不会自动循环，也不会批准或启用规则。',
                 } };
         }
@@ -127,4 +396,25 @@ export class RuleCandidateBindingConsoleModel {
             await handle.close();
         }
     }
+    /**
+     * SPEC-PRI-1047 修复 B: 认证入口的一次 Owner source-correction。区别于
+     * revise（binding 修订预算）：这是「修正上游材料」的独立一次预算，回执
+     * 绑定真实 Owner actor/request。调用侧（路由）负责 ownerIdentity 门。
+     */
+    async correctSource(candidateId, input, actorId) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir });
+        try {
+            const ledger = this.ledger(handle.stateManager);
+            return await reviseRuleSourceOnce({
+                stateManager: handle.stateManager,
+                ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule') },
+                candidateId,
+                ...input,
+                actor: actorId,
+            });
+        }
+        finally {
+            await handle.close();
+        }
+    }
 }

package/console/dist/server/routes/config.js

@@ -53,6 +53,10 @@ function safeParseBody(text) {
 function isObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/** Runtime-profile CRUD errors carry an operator next action — never drop it (rc-9). */
+function sendProfileCrudError(res, result) {
+    sendError(res, result.statusCode, result.error, result.message, result.nextAction ? { nextAction: result.nextAction } : undefined);
+}
 // ── Route Handler ────────────────────────────────────────────────────────────
 export async function handleConfigRoute(req, res, ctx) {
     const { workspaceDir, subPath } = ctx;
@@ -301,7 +305,7 @@ export async function handleConfigRoute(req, res, ctx) {
         }
         const result = createRuntimeProfile(workspaceDir, body.id, body.profile);
         if (!result.ok) {
-            sendError(res, result.statusCode, result.error, result.message);
+            sendProfileCrudError(res, result);
             return;
         }
         // 201 Created for new resource
@@ -335,7 +339,7 @@ export async function handleConfigRoute(req, res, ctx) {
             }
             const result = updateRuntimeProfile(workspaceDir, profileId, body);
             if (!result.ok) {
-                sendError(res, result.statusCode, result.error, result.message);
+                sendProfileCrudError(res, result);
                 return;
             }
             sendSuccess(res, { profileId: result.profileId, profile: result.profile });
@@ -344,7 +348,7 @@ export async function handleConfigRoute(req, res, ctx) {
         if (method === 'DELETE') {
             const result = deleteRuntimeProfile(workspaceDir, profileId);
             if (!result.ok) {
-                sendError(res, result.statusCode, result.error, result.message);
+                sendProfileCrudError(res, result);
                 return;
             }
             sendSuccess(res, { profileId: result.profileId, profile: result.profile });

package/console/dist/server/routes/rule-candidate-bindings.js

@@ -43,7 +43,7 @@ export async function handleRuleCandidateBindingsRoute(req, res, ctx) {
         return;
     }
     const model = new RuleCandidateBindingConsoleModel(ctx.workspaceDir);
-    const match = /^\/([^/]+)(?:\/(review|revise-once))?$/.exec(ctx.subPath);
+    const match = /^\/([^/]+)(?:\/(review|revise-once|source-correct-once))?$/.exec(ctx.subPath);
     const url = new URL(req.url ?? '/', 'http://localhost');
     try {
         if ((ctx.subPath === '' || ctx.subPath === '/') && req.method === 'GET') {
@@ -84,6 +84,31 @@ export async function handleRuleCandidateBindingsRoute(req, res, ctx) {
             sendBadRequest(res, '请求必须是有效的 JSON。');
             return;
         }
+        if (match[2] === 'source-correct-once') {
+            // SPEC-PRI-1047: one bounded Owner source-correction per candidate. Closed
+            // field set: chain identity + digest precondition + reason/requestId —
+            // never identity-fabrication or approval fields.
+            if (!closed(raw, ['expectedBindingRevision', 'expectedScribeTaskId', 'expectedArtificerTaskId', 'expectedScribeArtifactDigest', 'reason', 'requestId'])
+                || !revision(raw.expectedBindingRevision) || raw.expectedBindingRevision < 1
+                || !text(raw.expectedScribeTaskId, 512) || !text(raw.expectedArtificerTaskId, 512)
+                || !digest(raw.expectedScribeArtifactDigest) || !text(raw.reason, 2000) || !text(raw.requestId, 200)) {
+                sendBadRequest(res, '请提交当前关联、原候选链任务与工件摘要；不接受身份或批准字段。');
+                return;
+            }
+            const result = await model.correctSource(candidateId, {
+                expectedBindingRevision: raw.expectedBindingRevision,
+                expectedScribeTaskId: raw.expectedScribeTaskId,
+                expectedArtificerTaskId: raw.expectedArtificerTaskId,
+                expectedScribeArtifactDigest: raw.expectedScribeArtifactDigest,
+                reason: raw.reason,
+                requestId: raw.requestId,
+            }, ctx.ownerIdentity.ownerId);
+            if (result.status === 'refused')
+                failure(res, result);
+            else
+                sendSuccess(res, result);
+            return;
+        }
         if (match[2] === 'revise-once') {
             if (!closed(raw, ['expectedBindingRevision', 'expectedScribeTaskId', 'expectedTaskRevisionEpoch', 'requestId'])
                 || !revision(raw.expectedBindingRevision) || raw.expectedBindingRevision < 1