create-principles-disciple 1.146.1 → 1.146.3

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
-  "productVersion": "2.7.0",
-  "sourceCommit": "028bd1d8197cd5e6cd3187d3e6c0944848a95b9b"
+  "productVersion": "2.8.0",
+  "sourceCommit": "fd8fe301fb9ea4223b153e022022eefb0938ae21"
 }

package/console/dist/server/models/ActivationsConsoleModel.d.ts

@@ -2,6 +2,7 @@ import type { ActivationStatusRecord, PromotionReadinessResult, ActivationContro
 import { type PromptInjectionTargetHost } from '@principles/host-runtime';
 import type { PromptActivationInjectionStatusWire, PromptInjectionRouteSummaryWire } from '../../shared/prompt-injection-contract.js';
 import { type GovernanceAuditWriter } from 'principles-disciple/governance-audit';
+import type { ApprovedRuleRevisionRequest } from '../../shared/approved-rule-revision-contract.js';
 /**
  * PRI-491 — owner-observable activation record.
  *
@@ -151,6 +152,8 @@ export declare class ActivationsConsoleModel {
     private readonly workspaceDir;
     private readonly governanceAuditWriter;
     constructor(workspaceDir: string, governanceAuditWriter?: GovernanceAuditWriter);
+    previewApprovedRuleRevision(activationId: string): Promise<import("@principles/core/runtime-v2").ApprovedRuleRevisionPreview>;
+    reviseApprovedRuleOnce(activationId: string, input: ApprovedRuleRevisionRequest, actor: OwnerPromotionActor): Promise<import("@principles/core/runtime-v2").ApprovedRuleRevisionResult>;
     getActivations(targetHost?: PromptInjectionTargetHost): Promise<ActivationsResponse>;
     getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean, options?: {
         ownerActor?: OwnerPromotionActor;

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -1,4 +1,4 @@
-import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, buildPromotionEvidenceSnapshot, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, buildPromotionEvidenceSnapshot, createRuntimeStateHandle, PrincipleTreeLedgerAdapter, previewApprovedRuleRevision, reviseApprovedRuleOnce, } from '@principles/core/runtime-v2';
 import { resolvePromotionHostLiveness, resolveWorkspaceHostToolSemantics, readPromptActivationInjectionStatuses, operatorDeclaredBudgetResolution, runtimeBudgetObservationToResolution, selectConsoleRuntimeBudgetFacts, RUNTIME_BUDGET_OBSERVATION_STALE_REASON, RUNTIME_V2_EVENT_LOG_CANDIDATE_DIRS } from '@principles/host-runtime';
 import { PROMPT_BUDGET_HOST_KINDS } from '@principles/core/runtime-v2';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
@@ -168,6 +168,30 @@ export class ActivationsConsoleModel {
         this.workspaceDir = workspaceDir;
         this.governanceAuditWriter = governanceAuditWriter;
     }
+    async previewApprovedRuleRevision(activationId) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
+        try {
+            const ledger = new PrincipleTreeLedgerAdapter({ stateDir: path.join(this.workspaceDir, '.state') });
+            return await previewApprovedRuleRevision({ stateManager: handle.stateManager,
+                ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule'),
+                    withLockedRuleCandidateIdentity: (id, operation) => ledger.withLockedRuleCandidateIdentity(id, operation) }, activationId });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async reviseApprovedRuleOnce(activationId, input, actor) {
+        const handle = await createRuntimeStateHandle({ workspaceDir: this.workspaceDir, bootstrapIfMissing: false });
+        try {
+            const ledger = new PrincipleTreeLedgerAdapter({ stateDir: path.join(this.workspaceDir, '.state') });
+            return await reviseApprovedRuleOnce({ stateManager: handle.stateManager,
+                ledger: { resolveForCandidate: async (id) => ledger.resolveCandidatePrincipleIdentity(id, 'rule'),
+                    withLockedRuleCandidateIdentity: (id, operation) => ledger.withLockedRuleCandidateIdentity(id, operation) }, activationId, ...input, actor });
+        }
+        finally {
+            await handle.close();
+        }
+    }
     async getActivations(targetHost) {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
         if (!fs.existsSync(stateDbPath)) {

package/console/dist/server/models/ApprovalsConsoleModel.d.ts

@@ -71,6 +71,11 @@ export type ApproveWithActivationResult = {
     error: 'prompt_replacement_refused';
     reason: string;
     nextAction: string;
+} | {
+    ok: false;
+    error: 'rule_replacement_refused';
+    reason: string;
+    nextAction: string;
 }
 /**
  * PD_PROMPT_CAPACITY_V1 R-B2: the prompt-channel write gate refused BEFORE

package/console/dist/server/models/ApprovalsConsoleModel.js

@@ -2,7 +2,7 @@ import { Value } from '@sinclair/typebox/value';
 import { approvalReviewMaterial } from './approval-review-material.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { SqliteConnection, SqliteApprovalQueueStore, SqliteActivationStateStore, SqlitePIArtifactStore, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, createProductionGateDeps, ApprovalCompletionService, ApprovalQueue, mapConfidenceToLabel, isArtifactRevisionOf, detectPromptReplacementTarget, buildOwnerRevisionArtifact, PrincipleTreeLedgerAdapter, MVP_CHANNELS, computeArtifactDigest, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteApprovalQueueStore, SqliteActivationStateStore, SqlitePIArtifactStore, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, createProductionGateDeps, ApprovalCompletionService, ApprovalQueue, mapConfidenceToLabel, isArtifactRevisionOf, detectPromptReplacementTarget, detectRuleReplacementTarget, buildOwnerRevisionArtifact, PrincipleTreeLedgerAdapter, MVP_CHANNELS, computeArtifactDigest, } from '@principles/core/runtime-v2';
 import { resolveLedgerPrincipleId } from './principle-id-resolution.js';
 import { createArtifactPrincipleResolutionDeps } from './artifact-principle-resolver.js';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
@@ -191,6 +191,39 @@ export class ApprovalsConsoleModel {
                 catch { /* best-effort */ }
             }
         }
+        // SPEC-RULECODE-APPROVED-REVISION-001 §B: approving a revised RuleCode
+        // artifact replaces its superseded shadow in the SAME transaction as the
+        // new activation (no stop-old-then-start-new window). Detection is
+        // fail-closed on ambiguity and refuses to shadow an already-live rule.
+        if (existing.channel === 'code_tool_hook' && (existing.status === 'pending' || (existing.status === 'approved' && options?.retryActivation === true))) {
+            const { connection } = this.createReadContext();
+            try {
+                const ruleArtifactStore = new SqlitePIArtifactStore(connection);
+                const detection = await detectRuleReplacementTarget({
+                    approvalArtifactId: existing.artifactId,
+                    getArtifactById: async (id) => ruleArtifactStore.getArtifactById(id),
+                    listRuleActivations: async () => new SqliteActivationStateStore(connection).listCodeToolHookActivations(),
+                });
+                if (!detection.ok) {
+                    // An unreadable NEW artifact is not a replacement decision: the
+                    // activation path already reports it with a precise reason and the
+                    // established status code. Only replacement-specific refusals stop here.
+                    if (!detection.error.startsWith('rule_replacement_artifact_unreadable')) {
+                        return { ok: false, error: 'rule_replacement_refused', reason: detection.error, nextAction: detection.nextAction };
+                    }
+                }
+                else {
+                    supersedeActivationId = detection.target?.supersededActivationId;
+                    supersedeArtifactId = detection.target?.supersededArtifactId;
+                }
+            }
+            finally {
+                try {
+                    connection.close();
+                }
+                catch { /* best-effort */ }
+            }
+        }
         const { queue: writeQueue, connection: writeConnection } = this.createWriteContext();
         let approvalResult;
         try {
@@ -236,7 +269,12 @@ export class ApprovalsConsoleModel {
                 }
             }
             catch { /* best-effort rollback */ }
-            return { ok: false, error: 'activation_failed', reason: detail, approvalRolledBack };
+            // Carry the dispatcher's nextAction (it names the concrete cause for a
+            // replacement failure); without it the Owner only sees a stable code.
+            const activationNextAction = 'nextAction' in activation && typeof activation.nextAction === 'string'
+                ? activation.nextAction : undefined;
+            return { ok: false, error: 'activation_failed', reason: detail, approvalRolledBack,
+                ...(activationNextAction !== undefined ? { nextAction: activationNextAction } : {}) };
         }
         // P1 #4 fix: when activation is skipped (feature flag disabled), surface
         // a clear warning so the owner knows behavior did NOT change. The approval

package/console/dist/server/routes/activations.js

@@ -1,6 +1,7 @@
 import { ActivationsConsoleModel } from '../models/ActivationsConsoleModel.js';
 import { ApprovalsConsoleModel } from '../models/ApprovalsConsoleModel.js';
 import { sendSuccess, sendError, sendNotFound } from '../utils/response.js';
+import { validateApprovedRuleRevisionRequest } from '../../shared/approved-rule-revision-contract.js';
 const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
 const models = new Map();
 const approvalsModels = new Map();
@@ -116,6 +117,52 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath, au
         }
         return;
     }
+    const revisionMatch = /^\/([^/]+)\/(rule-revision-preview|revise-rule-once)$/.exec(subPath);
+    if (revisionMatch && ((req.method === 'GET' && revisionMatch[2] === 'rule-revision-preview')
+        || (req.method === 'POST' && revisionMatch[2] === 'revise-rule-once'))) {
+        const actor = authority?.ownerActor;
+        if (!actor) {
+            sendError(res, 403, 'owner_authentication_required', 'This revision requires the configured Owner identity.', { nextAction: 'Authenticate as the configured Owner in the Console.' });
+            return;
+        }
+        const [, rawId] = revisionMatch;
+        if (!rawId) {
+            sendError(res, 400, 'invalid_id', 'Activation ID is missing');
+            return;
+        }
+        let activationId;
+        try {
+            activationId = decodeURIComponent(rawId);
+        }
+        catch {
+            sendError(res, 400, 'invalid_id', 'Activation ID contains invalid URI encoding');
+            return;
+        }
+        let input;
+        if (req.method === 'POST') {
+            try {
+                input = validateApprovedRuleRevisionRequest(await readJson(req));
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                sendError(res, message === 'payload_too_large' ? 413 : 400, 'validation_error', message);
+                return;
+            }
+            if (!input) {
+                sendError(res, 400, 'validation_error', 'Revision requires the reviewed artifact, digest, binding/control/task versions, requestId and 1–4000 characters of directed feedback.', { nextAction: 'Refresh the revision preview and describe the required correction.' });
+                return;
+            }
+        }
+        try {
+            const model = getModel(workspaceDir);
+            sendSuccess(res, input ? await model.reviseApprovedRuleOnce(activationId, input, actor) : await model.previewApprovedRuleRevision(activationId));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            sendError(res, 500, 'rule_revision_unavailable', message, { nextAction: 'Refresh the revision preview; keep the current rule in shadow.' });
+        }
+        return;
+    }
     const mutationMatch = /^\/([^/]+)\/(continue-observing|promote|reject-after-shadow|emergency-deactivate|recover-to-shadow)$/.exec(subPath);
     const pauseMatch = subPath === '/emergency-pause';
     const releaseMatch = /^\/emergency-pause\/([^/]+)\/release$/.exec(subPath);

package/console/dist/server/routes/approvals.js

@@ -175,7 +175,7 @@ export async function handleApprovalsRoute(req, res, workspaceDir, subPath) {
                 else if (result.error === 'unsupported_channel') {
                     sendError(res, 403, 'unsupported_channel', `Cannot approve unsupported channel. Only MVP proven channels (${MVP_CHANNEL_LIST}) can be approved.`);
                 }
-                else if (result.error === 'prompt_replacement_refused') {
+                else if (result.error === 'prompt_replacement_refused' || result.error === 'rule_replacement_refused') {
                     sendError(res, 409, result.error, result.reason, { nextAction: result.nextAction });
                 }
                 else if (result.error === 'activation_failed') {

package/console/dist/server/routes/health.js

@@ -2,6 +2,16 @@ import { HealthCheckModel } from '../models/HealthCheckModel.js';
 import { CodexGovernanceHealthModel } from '../models/CodexGovernanceHealthModel.js';
 import { sendSuccess, sendError } from '../utils/response.js';
 const MODEL_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * PRI-1069/G1 P0-1 (SPEC v1.2 §14): one-shot launcher nonce, read once at
+ * process start. The installer spawns this server with
+ * PD_CONSOLE_VERIFY_NONCE in the child env; the health response echoes it so
+ * the probe can bind the answer to THIS child instance. Absent on normal
+ * (user-launched) consoles. Never logged.
+ */
+const VERIFY_NONCE = process.env.PD_CONSOLE_VERIFY_NONCE && process.env.PD_CONSOLE_VERIFY_NONCE.length > 0
+    ? process.env.PD_CONSOLE_VERIFY_NONCE
+    : null;
 const models = new Map();
 function getModel(workspaceDir) {
     const cached = models.get(workspaceDir);
@@ -69,6 +79,13 @@ export async function handleHealthRoute(req, res, options) {
             ...health,
             authenticationMode: options.authenticationMode,
             codexGovernance,
+            // PRI-1069/G1 P0-1: installer identity binding. When the launching
+            // installer passes a one-shot nonce via env, echo it back so the probe
+            // can prove THIS child answered — an old console, another local service,
+            // or a proxy 502 cannot know the value. The nonce is short-lived,
+            // machine-local, never logged here, and absent entirely for consoles
+            // launched without it (normal user launches), keeping the legacy shape.
+            ...(VERIFY_NONCE !== null ? { verifyNonce: VERIFY_NONCE } : {}),
         });
     }
     catch (error) {

package/console/dist/server/routes/update-transaction.js

@@ -90,6 +90,10 @@ async function recoveryStatus(res) {
     const unfinished = [];
     const superseded = [];
     const broken = [];
+    // P0-4: terminal `failed` transactions whose detail carries a restore
+    // inconsistency marker — the install on disk is NOT what the terminal state
+    // implies. They must stay visible in the recovery list.
+    const recoveryRequired = [];
     // PRI-896: a non-terminal journal is only an ALARM if the product's own
     // recovery decision cannot explain it away. The live release record is the
     // evidence for that, so a missing/corrupt active record means NO evidence —
@@ -117,8 +121,26 @@ async function recoveryStatus(res) {
         try {
             const read = journal.readTransactionJournalForRecovery(path.join(paths.transactionsDir, entry.name));
             const fact = factFromTransitions(journal, transactionId, read);
-            if (fact.terminal)
+            if (fact.terminal) {
+                // P0-4: terminal facts are normally closed history — EXCEPT a
+                // `failed` whose detail says the physical restore did not (or could
+                // not) complete. That combination is a live recovery need hiding
+                // behind a terminal state; skipping it is how PRI-1069 stayed
+                // invisible. rc-9: reported with its own bucket, never dropped.
+                const lastDetail = fact.transitions.length > 0
+                    ? (fact.transitions[fact.transitions.length - 1]?.detail ?? '')
+                    : '';
+                if (fact.lastState === 'failed' && journal.RESTORE_INCONSISTENCY_MARKER.test(lastDetail)) {
+                    // A later completed install records a `<txid>.recovered.json`
+                    // resolution (journal module authority); until then the alarm
+                    // stays. Skip only on real resolution evidence (review 2026-11-02:
+                    // never clear the alarm just because time passed).
+                    if (!journal.hasRecoveryResolution(paths.transactionsDir, transactionId)) {
+                        recoveryRequired.push({ transactionId, reason: lastDetail.slice(0, 400) });
+                    }
+                }
                 continue;
+            }
             const outcome = journal.recoverUnfinishedTransaction({
                 transitions: read.transitions,
                 activeRecord,
@@ -139,10 +161,11 @@ async function recoveryStatus(res) {
     }
     unfinished.sort((a, b) => (b.lastAt ?? '').localeCompare(a.lastAt ?? ''));
     sendSuccess(res, {
-        needsRecovery: unfinished.length > 0 || broken.length > 0,
+        needsRecovery: unfinished.length > 0 || broken.length > 0 || recoveryRequired.length > 0,
         unfinished,
         superseded,
         broken,
+        recoveryRequired,
         // rc-9: when the active record could not be read, the recovery decision had
         // no live-release evidence, so every non-terminal journal is conservatively
         // treated as an alarm. Surfacing this explains WHY the alarm persists and
@@ -153,7 +176,9 @@ async function recoveryStatus(res) {
             ? activeRecordUnreadable
                 ? 'The active release record (active.json) could not be read, so no transaction can be proven superseded and every unfinished one is reported. Repair active.json (re-run the official installer recovery), then re-check recovery before starting a new update.'
                 : 'An update transaction did not reach a terminal state. Review its phase, then continue, roll back, or repair through the official installer before starting a new update.'
-            : undefined,
+            : recoveryRequired.length > 0
+                ? 'A completed-but-failed update left the physical installation inconsistent (restore incomplete or deferred). Close any running PD processes, then re-run the official installer to retry recovery before starting a new update.'
+                : undefined,
     });
 }
 /**
@@ -192,6 +217,41 @@ async function recoveryResolve(res, req) {
     }
     try {
         const read = journal.readTransactionJournalForRecovery(journalPath);
+        // Review 2026-11-02 (consistency): a terminal `failed` carrying a restore
+        // inconsistency marker must get the SAME verdict from both recovery
+        // surfaces. The generic decision below would answer `old_confirmed`
+        // ("previously confirmed release remains active") with no nextAction —
+        // read as "nothing to do" while the status endpoint demands repair. The
+        // generic decision cannot see physical state; refuse explicitly instead.
+        const last = read.transitions[read.transitions.length - 1];
+        if (last !== undefined && last.to === 'failed'
+            && typeof last.detail === 'string' && journal.RESTORE_INCONSISTENCY_MARKER.test(last.detail)) {
+            if (journal.hasRecoveryResolution(paths.transactionsDir, transactionId)) {
+                // Resolved by a later completed install — report that instead of the
+                // stale refusal.
+                sendSuccess(res, {
+                    ok: true,
+                    transactionId,
+                    outcome: {
+                        kind: 'old_confirmed',
+                        releaseId: null,
+                        generation: null,
+                        reason: `transaction ended in failed with a restore-inconsistency marker but a later install recorded its recovery; the previously confirmed release remains active`,
+                    },
+                });
+                return;
+            }
+            sendSuccess(res, {
+                ok: true,
+                transactionId,
+                outcome: {
+                    kind: 'explicit_refusal',
+                    reason: last.detail.slice(0, 400),
+                    nextAction: 'A completed-but-failed update left the physical installation inconsistent (restore incomplete or deferred). Close any running PD processes, then re-run the official installer to retry recovery before starting a new update.',
+                },
+            });
+            return;
+        }
         const activeRecord = journal.readActiveRecord(paths.activeRecordPath);
         const outcome = journal.recoverUnfinishedTransaction({
             transitions: read.transitions,

package/console/dist/shared/approved-rule-revision-contract.d.ts

@@ -0,0 +1,8 @@
+import type { previewApprovedRuleRevision, reviseApprovedRuleOnce } from '@principles/core/runtime-v2';
+/** Wire projections of the core authority; no independent revision state. */
+export type ApprovedRuleRevisionPreview = Awaited<ReturnType<typeof previewApprovedRuleRevision>>;
+export type ApprovedRuleRevisionResult = Awaited<ReturnType<typeof reviseApprovedRuleOnce>>;
+export type ApprovedRuleRevisionRequest = Pick<Parameters<typeof reviseApprovedRuleOnce>[0], 'expectedArtifactId' | 'expectedArtifactDigest' | 'expectedBindingRevision' | 'expectedControlVersion' | 'expectedTaskRevisionEpoch' | 'requestId' | 'feedback'>;
+export declare function validateApprovedRuleRevisionRequest(value: unknown): ApprovedRuleRevisionRequest | null;
+export declare function validateApprovedRuleRevisionPreview(value: unknown): ApprovedRuleRevisionPreview | null;
+export declare function validateApprovedRuleRevisionResult(value: unknown): ApprovedRuleRevisionResult | null;

package/console/dist/shared/approved-rule-revision-contract.js

@@ -0,0 +1,48 @@
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function text(value) { return typeof value === 'string' && value.trim().length > 0; }
+function version(value) { return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0; }
+export function validateApprovedRuleRevisionRequest(value) {
+    if (!record(value) || !text(value.expectedArtifactId) || !text(value.expectedArtifactDigest)
+        || !/^sha256:[a-f0-9]{64}$/.test(value.expectedArtifactDigest)
+        || !version(value.expectedBindingRevision) || !version(value.expectedControlVersion)
+        || !version(value.expectedTaskRevisionEpoch) || !text(value.requestId) || value.requestId.length > 200
+        || !text(value.feedback) || value.feedback.length > 4000)
+        return null;
+    return { expectedArtifactId: value.expectedArtifactId, expectedArtifactDigest: value.expectedArtifactDigest,
+        expectedBindingRevision: value.expectedBindingRevision, expectedControlVersion: value.expectedControlVersion,
+        expectedTaskRevisionEpoch: value.expectedTaskRevisionEpoch, requestId: value.requestId, feedback: value.feedback.trim() };
+}
+function refused(value) {
+    return value.status === 'refused' && text(value.reason) && text(value.nextAction)
+        ? { status: 'refused', reason: value.reason, nextAction: value.nextAction } : null;
+}
+export function validateApprovedRuleRevisionPreview(value) {
+    if (!record(value))
+        return null;
+    if (value.status === 'refused')
+        return refused(value);
+    if (value.status !== 'ready' || !text(value.activationId) || !text(value.candidateId)
+        || !text(value.principleId) || !text(value.artificerTaskId) || !text(value.expectedArtifactId)
+        || !text(value.expectedArtifactDigest) || !/^sha256:[a-f0-9]{64}$/.test(value.expectedArtifactDigest)
+        || !version(value.expectedBindingRevision) || !version(value.expectedControlVersion)
+        || !version(value.expectedTaskRevisionEpoch))
+        return null;
+    return { status: 'ready', activationId: value.activationId, candidateId: value.candidateId,
+        principleId: value.principleId, artificerTaskId: value.artificerTaskId,
+        expectedArtifactId: value.expectedArtifactId, expectedArtifactDigest: value.expectedArtifactDigest,
+        expectedBindingRevision: value.expectedBindingRevision, expectedControlVersion: value.expectedControlVersion,
+        expectedTaskRevisionEpoch: value.expectedTaskRevisionEpoch };
+}
+export function validateApprovedRuleRevisionResult(value) {
+    if (!record(value))
+        return null;
+    if (value.status === 'refused')
+        return refused(value);
+    if ((value.status !== 'started' && value.status !== 'already_started') || !text(value.artificerTaskId)
+        || !text(value.causeId) || !version(value.taskRevisionEpoch))
+        return null;
+    return { status: value.status, artificerTaskId: value.artificerTaskId,
+        causeId: value.causeId, taskRevisionEpoch: value.taskRevisionEpoch };
+}

package/console/dist/ui/api.d.ts

@@ -4,6 +4,7 @@ import type { OwnerDecisionsData, OwnerResolutionResultData, OwnerDecisionInboxD
 import type { DesignGateAction, DesignGateDecision, DesignGateDeclaration, DesignGateScope } from "@principles/core/runtime-v2/internalization/design-gate-facts";
 import type { RuleBindingReviewView, RuleBindingQueueView } from '../shared/rule-candidate-binding-contract.js';
 import type { RuleCandidateBindingRequest } from '@principles/core/runtime-v2';
+import type { ApprovedRuleRevisionPreview, ApprovedRuleRevisionRequest, ApprovedRuleRevisionResult } from '../shared/approved-rule-revision-contract.js';
 import type { GovernanceExperienceSnapshot, OwnerGovernanceView, OwnerDecisionViewCore } from '@principles/core/runtime-v2';
 import type { OwnerIdentityViewData, OwnerIdentityRegisterData, OwnerIdentityUnregisterData } from "./utils/validators.js";
 import type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, FailedTaskDetailData, ActivationsData, DisableActivationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, UpdateRecoveryData, UpdateTransactionData, ApprovalRecordData, PrinciplesListData, CorePrinciplesData, ApprovalsGroupedData, EvidenceChainData, TrajectoryData, IntentSummaryData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, IntentInitResultData, IntentSaveResultData, IntentRawContentData, IntentVersionData, RuleCodeOwnerReviewData, RuleCodeMutationData } from "./utils/validators.js";
@@ -311,6 +312,8 @@ declare function fetchApprovalsGrouped(targetHost?: 'openclaw' | 'codex' | 'work
 declare function fetchAllActivations(targetHost?: 'openclaw' | 'codex' | 'workbuddy'): Promise<ApiResponse<ActivationsData>>;
 declare function disableActivation(activationId: string): Promise<ApiResponse<DisableActivationData>>;
 declare function fetchRuleCodeOwnerReview(activationId: string): Promise<ApiResponse<RuleCodeOwnerReviewData>>;
+export declare function fetchApprovedRuleRevisionPreview(activationId: string): Promise<ApiResponse<ApprovedRuleRevisionPreview>>;
+export declare function reviseApprovedRuleOnce(activationId: string, input: ApprovedRuleRevisionRequest): Promise<ApiResponse<ApprovedRuleRevisionResult>>;
 export interface ProposeRevisionData {
     ok: boolean;
     alreadyPending?: boolean;

package/console/dist/ui/api.js

@@ -1,5 +1,6 @@
 import { validateApprovalReview } from './utils/approval-review.js';
 import { clearStoredToken, loadStoredToken, storeToken } from "./utils/token-storage.js";
+import { validateApprovedRuleRevisionPreview, validateApprovedRuleRevisionResult } from '../shared/approved-rule-revision-contract.js';
 import { validateBindingReview, validateBindingQueue, validateBindingMutation, validateBindingRevise } from './utils/rule-binding-validators.js';
 import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateRecoveryResult, validateFailedTaskDetail, validateOwnerDecisionsData, validateOwnerResolutionResult, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateUpdateRecovery, validateUpdateTransaction, validateApprovalRecordDirect, validatePrinciplesList, validateCorePrinciples, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateOwnerDecisionViewCore, validateOwnerDecisionInbox, validateOwnerDecisionLibrary, validateGovernanceExperienceSnapshot, validateRuleCodeOwnerReview, validateRuleCodeMutation, validateOwnerIdentityView, validateOwnerIdentityRegister, validateOwnerIdentityUnregister, } from "./utils/validators.js";
 // ── Auth ──────────────────────────────────────────────────────────────────────
@@ -793,6 +794,14 @@ async function disableActivation(activationId) {
 async function fetchRuleCodeOwnerReview(activationId) {
     return request(`/api/v1/activations/${encodeURIComponent(activationId)}/owner-review`, undefined, validateRuleCodeOwnerReview);
 }
+export async function fetchApprovedRuleRevisionPreview(activationId) {
+    return request(`/api/v1/activations/${encodeURIComponent(activationId)}/rule-revision-preview`, undefined, validateApprovedRuleRevisionPreview);
+}
+export async function reviseApprovedRuleOnce(activationId, input) {
+    return request(`/api/v1/activations/${encodeURIComponent(activationId)}/revise-rule-once`, {
+        method: 'POST', body: JSON.stringify(input),
+    }, validateApprovedRuleRevisionResult);
+}
 async function proposePromptRevision(activationId, statement, targetHost) {
     return request(`/api/v1/activations/${encodeURIComponent(activationId)}/propose-revision`, {
         method: 'POST',

package/console/dist/ui/i18n/en.json

@@ -1371,6 +1371,13 @@
             "evaluationErrors": "Errors",
             "notCollected": "Not collected",
             "scopeArtifactCode": "Scope, artifact and implementation",
+            "ruleRevisionTitle": "Revise this rule for a new review",
+            "ruleRevisionReviewQueue": "View review queue",
+            "ruleRevisionBoundary": "Revise once using this feedback. Existing code and approvals are preserved. New code requires fresh approval and will not activate automatically.",
+            "ruleRevisionFeedback": "Required correction (up to 4000 characters)",
+            "ruleRevisionOnce": "Revise once with feedback",
+            "ruleRevisionStarted": "Revision queued. The result will appear for review; the current rule stays in shadow.",
+            "ruleRevisionAlreadyExists": "This artifact already has a revision; this request did not start a new one.",
             "ownerReviewNote": "Owner review note",
             "continueObserving": "Continue observing",
             "rejectAfterShadow": "Reject and deactivate",
@@ -1819,6 +1826,8 @@
             "reasonLabel": "Reason: ",
             "recoveryBanner": "An unfinished update transaction was found",
             "recoveryItem": "Transaction {{id}} stopped at phase \"{{phase}}\"",
+            "recoveryRequiredBanner": "A failed update left the installation inconsistent (recovery required)",
+            "recoveryRequiredItem": "Failed transaction {{id}} needs recovery — re-run the official installer",
             "inProgressToast": "Update transaction accepted and running in the background; do not click again.",
             "inProgressPanel": "Update in progress",
             "inProgressPhase": "Current phase: {{phase}}",

package/console/dist/ui/i18n/zh-CN.json

@@ -1371,6 +1371,13 @@
             "evaluationErrors": "异常",
             "notCollected": "未采集",
             "scopeArtifactCode": "范围、产物与实现代码",
+            "ruleRevisionTitle": "修正规则后重新审阅",
+            "ruleRevisionReviewQueue": "查看待审列表",
+            "ruleRevisionBoundary": "只按本次反馈修订一次，保留旧规则和审批记录。新代码需重新审阅批准，不会自动启用。",
+            "ruleRevisionFeedback": "需要修正什么（最多4000字）",
+            "ruleRevisionOnce": "按反馈修订一次",
+            "ruleRevisionStarted": "修订已排队。完成后将在待审列表出现；当前规则保持影子状态。",
+            "ruleRevisionAlreadyExists": "该工件已有修订，本次请求未启动新的修订。",
             "ownerReviewNote": "拥有者评审备注",
             "continueObserving": "继续观察",
             "rejectAfterShadow": "拒绝并停用",
@@ -1819,6 +1826,8 @@
             "reasonLabel": "原因：",
             "recoveryBanner": "检测到未完成的更新事务",
             "recoveryItem": "事务 {{id}} 停留在阶段「{{phase}}」",
+            "recoveryRequiredBanner": "一次失败的更新使安装处于不一致状态（需要恢复）",
+            "recoveryRequiredItem": "失败事务 {{id}} 需要恢复——请重新运行官方安装器",
             "inProgressToast": "更新事务已受理，正在后台执行；请勿重复点击。",
             "inProgressPanel": "更新进行中",
             "inProgressPhase": "当前阶段：{{phase}}",