create-principles-disciple 1.146.2 → 1.146.3

package/_release/product-identity.json

@@ -1,5 +1,5 @@
 {
   "schemaVersion": 1,
-  "productVersion": "2.7.0",
-  "sourceCommit": "0a1891dc148e850c30d4fb823ae0a816ec8e4cf8"
+  "productVersion": "2.8.0",
+  "sourceCommit": "fd8fe301fb9ea4223b153e022022eefb0938ae21"
 }

package/console/dist/server/routes/health.js

@@ -2,6 +2,16 @@ import { HealthCheckModel } from '../models/HealthCheckModel.js';
 import { CodexGovernanceHealthModel } from '../models/CodexGovernanceHealthModel.js';
 import { sendSuccess, sendError } from '../utils/response.js';
 const MODEL_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * PRI-1069/G1 P0-1 (SPEC v1.2 §14): one-shot launcher nonce, read once at
+ * process start. The installer spawns this server with
+ * PD_CONSOLE_VERIFY_NONCE in the child env; the health response echoes it so
+ * the probe can bind the answer to THIS child instance. Absent on normal
+ * (user-launched) consoles. Never logged.
+ */
+const VERIFY_NONCE = process.env.PD_CONSOLE_VERIFY_NONCE && process.env.PD_CONSOLE_VERIFY_NONCE.length > 0
+    ? process.env.PD_CONSOLE_VERIFY_NONCE
+    : null;
 const models = new Map();
 function getModel(workspaceDir) {
     const cached = models.get(workspaceDir);
@@ -69,6 +79,13 @@ export async function handleHealthRoute(req, res, options) {
             ...health,
             authenticationMode: options.authenticationMode,
             codexGovernance,
+            // PRI-1069/G1 P0-1: installer identity binding. When the launching
+            // installer passes a one-shot nonce via env, echo it back so the probe
+            // can prove THIS child answered — an old console, another local service,
+            // or a proxy 502 cannot know the value. The nonce is short-lived,
+            // machine-local, never logged here, and absent entirely for consoles
+            // launched without it (normal user launches), keeping the legacy shape.
+            ...(VERIFY_NONCE !== null ? { verifyNonce: VERIFY_NONCE } : {}),
         });
     }
     catch (error) {

package/console/dist/server/routes/update-transaction.js

@@ -90,6 +90,10 @@ async function recoveryStatus(res) {
     const unfinished = [];
     const superseded = [];
     const broken = [];
+    // P0-4: terminal `failed` transactions whose detail carries a restore
+    // inconsistency marker — the install on disk is NOT what the terminal state
+    // implies. They must stay visible in the recovery list.
+    const recoveryRequired = [];
     // PRI-896: a non-terminal journal is only an ALARM if the product's own
     // recovery decision cannot explain it away. The live release record is the
     // evidence for that, so a missing/corrupt active record means NO evidence —
@@ -117,8 +121,26 @@ async function recoveryStatus(res) {
         try {
             const read = journal.readTransactionJournalForRecovery(path.join(paths.transactionsDir, entry.name));
             const fact = factFromTransitions(journal, transactionId, read);
-            if (fact.terminal)
+            if (fact.terminal) {
+                // P0-4: terminal facts are normally closed history — EXCEPT a
+                // `failed` whose detail says the physical restore did not (or could
+                // not) complete. That combination is a live recovery need hiding
+                // behind a terminal state; skipping it is how PRI-1069 stayed
+                // invisible. rc-9: reported with its own bucket, never dropped.
+                const lastDetail = fact.transitions.length > 0
+                    ? (fact.transitions[fact.transitions.length - 1]?.detail ?? '')
+                    : '';
+                if (fact.lastState === 'failed' && journal.RESTORE_INCONSISTENCY_MARKER.test(lastDetail)) {
+                    // A later completed install records a `<txid>.recovered.json`
+                    // resolution (journal module authority); until then the alarm
+                    // stays. Skip only on real resolution evidence (review 2026-11-02:
+                    // never clear the alarm just because time passed).
+                    if (!journal.hasRecoveryResolution(paths.transactionsDir, transactionId)) {
+                        recoveryRequired.push({ transactionId, reason: lastDetail.slice(0, 400) });
+                    }
+                }
                 continue;
+            }
             const outcome = journal.recoverUnfinishedTransaction({
                 transitions: read.transitions,
                 activeRecord,
@@ -139,10 +161,11 @@ async function recoveryStatus(res) {
     }
     unfinished.sort((a, b) => (b.lastAt ?? '').localeCompare(a.lastAt ?? ''));
     sendSuccess(res, {
-        needsRecovery: unfinished.length > 0 || broken.length > 0,
+        needsRecovery: unfinished.length > 0 || broken.length > 0 || recoveryRequired.length > 0,
         unfinished,
         superseded,
         broken,
+        recoveryRequired,
         // rc-9: when the active record could not be read, the recovery decision had
         // no live-release evidence, so every non-terminal journal is conservatively
         // treated as an alarm. Surfacing this explains WHY the alarm persists and
@@ -153,7 +176,9 @@ async function recoveryStatus(res) {
             ? activeRecordUnreadable
                 ? 'The active release record (active.json) could not be read, so no transaction can be proven superseded and every unfinished one is reported. Repair active.json (re-run the official installer recovery), then re-check recovery before starting a new update.'
                 : 'An update transaction did not reach a terminal state. Review its phase, then continue, roll back, or repair through the official installer before starting a new update.'
-            : undefined,
+            : recoveryRequired.length > 0
+                ? 'A completed-but-failed update left the physical installation inconsistent (restore incomplete or deferred). Close any running PD processes, then re-run the official installer to retry recovery before starting a new update.'
+                : undefined,
     });
 }
 /**
@@ -192,6 +217,41 @@ async function recoveryResolve(res, req) {
     }
     try {
         const read = journal.readTransactionJournalForRecovery(journalPath);
+        // Review 2026-11-02 (consistency): a terminal `failed` carrying a restore
+        // inconsistency marker must get the SAME verdict from both recovery
+        // surfaces. The generic decision below would answer `old_confirmed`
+        // ("previously confirmed release remains active") with no nextAction —
+        // read as "nothing to do" while the status endpoint demands repair. The
+        // generic decision cannot see physical state; refuse explicitly instead.
+        const last = read.transitions[read.transitions.length - 1];
+        if (last !== undefined && last.to === 'failed'
+            && typeof last.detail === 'string' && journal.RESTORE_INCONSISTENCY_MARKER.test(last.detail)) {
+            if (journal.hasRecoveryResolution(paths.transactionsDir, transactionId)) {
+                // Resolved by a later completed install — report that instead of the
+                // stale refusal.
+                sendSuccess(res, {
+                    ok: true,
+                    transactionId,
+                    outcome: {
+                        kind: 'old_confirmed',
+                        releaseId: null,
+                        generation: null,
+                        reason: `transaction ended in failed with a restore-inconsistency marker but a later install recorded its recovery; the previously confirmed release remains active`,
+                    },
+                });
+                return;
+            }
+            sendSuccess(res, {
+                ok: true,
+                transactionId,
+                outcome: {
+                    kind: 'explicit_refusal',
+                    reason: last.detail.slice(0, 400),
+                    nextAction: 'A completed-but-failed update left the physical installation inconsistent (restore incomplete or deferred). Close any running PD processes, then re-run the official installer to retry recovery before starting a new update.',
+                },
+            });
+            return;
+        }
         const activeRecord = journal.readActiveRecord(paths.activeRecordPath);
         const outcome = journal.recoverUnfinishedTransaction({
             transitions: read.transitions,

package/console/dist/ui/i18n/en.json

@@ -1826,6 +1826,8 @@
             "reasonLabel": "Reason: ",
             "recoveryBanner": "An unfinished update transaction was found",
             "recoveryItem": "Transaction {{id}} stopped at phase \"{{phase}}\"",
+            "recoveryRequiredBanner": "A failed update left the installation inconsistent (recovery required)",
+            "recoveryRequiredItem": "Failed transaction {{id}} needs recovery — re-run the official installer",
             "inProgressToast": "Update transaction accepted and running in the background; do not click again.",
             "inProgressPanel": "Update in progress",
             "inProgressPhase": "Current phase: {{phase}}",

package/console/dist/ui/i18n/zh-CN.json

@@ -1826,6 +1826,8 @@
             "reasonLabel": "原因：",
             "recoveryBanner": "检测到未完成的更新事务",
             "recoveryItem": "事务 {{id}} 停留在阶段「{{phase}}」",
+            "recoveryRequiredBanner": "一次失败的更新使安装处于不一致状态（需要恢复）",
+            "recoveryRequiredItem": "失败事务 {{id}} 需要恢复——请重新运行官方安装器",
             "inProgressToast": "更新事务已受理，正在后台执行；请勿重复点击。",
             "inProgressPanel": "更新进行中",
             "inProgressPhase": "当前阶段：{{phase}}",

package/console/dist/ui/pages/settings/UpdatePage.js

@@ -202,7 +202,7 @@ export function UpdatePage() {
     return (_jsxs(PageShell, { children: [_jsxs("div", { className: "animate-[pdFadeIn_400ms_ease-out]", children: [recoveryData?.needsRecovery && recoveryData.unfinished.length > 0 && (_jsxs("div", { className: "mb-6 p-4 bg-amber/5 border border-amber/35 rounded-[6px] text-[13px] leading-relaxed text-ink-2", role: "alert", children: [_jsx("p", { className: "font-medium text-amber", children: t("pages.update.recoveryBanner") }), recoveryData.unfinished.slice(0, 3).map((item) => (_jsx("p", { className: "mt-1 font-mono text-[12px] text-ink-3", children: t("pages.update.recoveryItem", {
                                     id: item.transactionId,
                                     phase: item.lastState ?? "—",
-                                }) }, item.transactionId))), recoveryData.nextAction && (_jsx("p", { className: "mt-2 text-[12px] text-ink-3", children: recoveryData.nextAction }))] })), _jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.update.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.update.title") }), _jsx("p", { className: "text-ink-3 text-[14px] max-w-[760px] leading-relaxed mb-7", children: t("pages.update.subtitle") }), _jsxs("section", { className: "mb-8", "aria-labelledby": "section-update-status", children: [_jsx(SectionTitle, { id: "section-update-status", children: t("pages.update.currentVersion") }), _jsxs("div", { className: "bg-panel border border-line rounded-[6px] p-5", children: [_jsxs("div", { className: "space-y-4", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-ink-3 text-[13px]", children: t("pages.update.currentVersion") }), _jsx("span", { className: "font-mono text-[13px] text-ink", children: statusData?.currentVersion ?? "—" })] }), statusData?.identityDivergence && (_jsx("div", { className: "border border-amber/35 rounded-[4px] px-3 py-2 text-[12px] leading-relaxed text-ink-2", children: t("pages.update.identityDivergence", {
+                                }) }, item.transactionId))), recoveryData.nextAction && (_jsx("p", { className: "mt-2 text-[12px] text-ink-3", children: recoveryData.nextAction }))] })), recoveryData?.needsRecovery && recoveryData.recoveryRequired.length > 0 && (_jsxs("div", { className: "mb-6 p-4 bg-amber/5 border border-amber/35 rounded-[6px] text-[13px] leading-relaxed text-ink-2", role: "alert", children: [_jsx("p", { className: "font-medium text-amber", children: t("pages.update.recoveryRequiredBanner") }), recoveryData.recoveryRequired.slice(0, 3).map((item) => (_jsx("p", { className: "mt-1 font-mono text-[12px] text-ink-3", children: t("pages.update.recoveryRequiredItem", { id: item.transactionId }) }, item.transactionId))), recoveryData.nextAction && (_jsx("p", { className: "mt-2 text-[12px] text-ink-3", children: recoveryData.nextAction }))] })), _jsx("div", { className: "font-mono text-[12px] tracking-[0.14em] text-ink-3 uppercase mb-3", children: t("pages.update.eyebrow") }), _jsx("h1", { className: "text-[29px] font-semibold tracking-tight text-ink mb-2", children: t("pages.update.title") }), _jsx("p", { className: "text-ink-3 text-[14px] max-w-[760px] leading-relaxed mb-7", children: t("pages.update.subtitle") }), _jsxs("section", { className: "mb-8", "aria-labelledby": "section-update-status", children: [_jsx(SectionTitle, { id: "section-update-status", children: t("pages.update.currentVersion") }), _jsxs("div", { className: "bg-panel border border-line rounded-[6px] p-5", children: [_jsxs("div", { className: "space-y-4", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-ink-3 text-[13px]", children: t("pages.update.currentVersion") }), _jsx("span", { className: "font-mono text-[13px] text-ink", children: statusData?.currentVersion ?? "—" })] }), statusData?.identityDivergence && (_jsx("div", { className: "border border-amber/35 rounded-[4px] px-3 py-2 text-[12px] leading-relaxed text-ink-2", children: t("pages.update.identityDivergence", {
                                                     active: statusData.identityDivergence.activeVersion,
                                                     plugin: statusData.identityDivergence.pluginVersion,
                                                 }) })), _jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-ink-3 text-[13px]", children: t("pages.update.latestVersion") }), _jsxs("div", { className: "flex items-center gap-2", children: [_jsx("span", { className: "font-mono text-[13px] text-ink", children: updateState === 'check_failed' ? "—" : (statusData?.latestVersion || "—") }), updateState === 'check_failed' && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: t("pages.update.checkFailed") })), updateState === 'update_blocked' && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: t("pages.update.blockedBadge") })), updateState === 'up_to_date' && (_jsx("span", { className: "inline-flex items-center border border-green/35 text-green rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: t("pages.update.upToDate") })), updateState === 'update_available' && (_jsx("span", { className: "inline-flex items-center border border-amber/35 text-amber rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: t("pages.update.updateAvailable") }))] })] })] }), (updateState === 'update_blocked' || updateState === 'check_failed') && (_jsxs("div", { className: "mt-4 pt-3 border-t border-line text-[12px] leading-relaxed", children: [blockedReason && (_jsxs("p", { className: "text-ink-2", children: [t("pages.update.reasonLabel"), blockedReason] })), statusData?.message && updateState === 'update_blocked' && (_jsx("p", { className: "mt-1 text-ink-3", children: statusData.message })), statusData?.nextAction && (_jsx("p", { className: "mt-1 text-ink-3 font-mono", children: statusData.nextAction }))] })), statusData?.error && (_jsxs("div", { className: "mt-4 pt-3 border-t border-line text-[12px] text-ink-4 font-mono", children: [t("pages.update.checkError"), ": ", statusData.error] })), inProgress && (_jsxs("div", { className: "mt-4 p-4 rounded-[6px] border border-gov/30 bg-surface text-[13px] leading-relaxed", role: "status", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx(Loader2, { className: "h-4 w-4 animate-spin text-gov" }), _jsx("span", { className: "font-medium text-ink", children: t("pages.update.inProgressPanel") })] }), _jsx("p", { className: "mt-1 font-mono text-[12px] text-ink-3", children: t("pages.update.inProgressPhase", { phase: inProgress.phase ?? "…" }) }), _jsx("p", { className: "mt-1 font-mono text-[12px] text-ink-4", children: inProgress.transactionId })] })), _jsxs("div", { className: "mt-5 pt-4 border-t border-line flex items-center gap-3 flex-wrap", children: [_jsx("button", { type: "button", onClick: handleCheckForUpdates, disabled: checking || fullUpdating || inProgress !== null, className: "border border-line bg-surface text-ink rounded-[3px] px-[14px] py-[6px] text-[12.5px] hover:border-line-2 transition-colors disabled:opacity-50 disabled:cursor-not-allowed focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: checking ? t("pages.update.checking") : t("pages.update.checkForUpdates") }), !isUpToDate && updateState === 'update_available' && (_jsx("button", { type: "button", onClick: () => setShowFullUpdateDialog(true), disabled: checking || fullUpdating || inProgress !== null, className: "bg-gov text-white rounded-[3px] px-[14px] py-[6px] text-[12.5px] hover:bg-gov/90 transition-colors disabled:opacity-50 disabled:cursor-not-allowed focus-visible:outline-2 focus-visible:outline-gov focus-visible:outline-offset-2", children: fullUpdating ? (_jsxs("span", { className: "flex items-center gap-1.5", children: [_jsx(Loader2, { className: "h-3.5 w-3.5 animate-spin" }), t("pages.update.updating")] })) : (t("pages.update.applyUpdate")) }))] }), updateResult && (_jsx("div", { className: `mt-4 p-4 rounded-[6px] border animate-[pdFadeIn_400ms_ease-out] ${updateResult.success ? 'bg-green/5 border-green/20' : updateResult.refusal ? 'bg-amber/5 border-amber/25' : 'bg-danger/5 border-danger/20'}`, children: _jsxs("div", { className: "flex items-start gap-3", children: [updateResult.success ? (_jsx(CheckCircle2, { className: "h-6 w-6 text-green shrink-0 mt-0.5 animate-[pdFadeIn_600ms_ease-out]", style: { transform: 'scale(1)', animationFillMode: 'both' } })) : updateResult.refusal ? (_jsx(AlertTriangle, { className: "h-6 w-6 text-amber shrink-0 mt-0.5" })) : (_jsx(XCircle, { className: "h-6 w-6 text-danger shrink-0 mt-0.5" })), _jsxs("div", { className: "flex-1 min-w-0", children: [updateResult.refusal && (_jsx("p", { className: "text-[12px] font-mono uppercase text-amber mb-1", children: t("pages.update.blockedBadge") })), updateResult.success && updateResult.fromVersion && updateResult.newVersion && (_jsxs("div", { className: "flex items-center gap-2 mb-1.5", children: [_jsx("span", { className: "font-mono text-[13px] text-ink-3 line-through", children: updateResult.fromVersion }), _jsx(ArrowRight, { className: "h-3.5 w-3.5 text-green" }), _jsx("span", { className: "font-mono text-[13px] text-green font-medium", children: updateResult.newVersion })] })), _jsx("p", { className: `text-[13px] ${updateResult.success ? 'text-green' : updateResult.refusal ? 'text-ink-2' : 'text-danger'}`, children: updateResult.message }), updateResult.success && updateResult.requiresRestart && (_jsx("p", { className: "mt-2 p-2 rounded-[3px] bg-amber/5 border border-amber/20 text-[12px] text-amber leading-relaxed", children: t("pages.update.fullUpdateRestartPrompt") })), updateResult.gatewayNotice && (_jsx("p", { className: "mt-2 p-2 rounded-[3px] bg-amber/5 border border-amber/20 text-[12px] text-amber leading-relaxed font-mono", children: updateResult.gatewayNotice })), !updateResult.success && updateResult.nextAction && (_jsx("p", { className: "mt-1 text-[12px] text-ink-4 font-mono leading-relaxed", children: updateResult.nextAction })), !updateResult.success && (_jsxs("div", { className: "mt-2 flex items-center gap-2", children: [/network|fetch|timeout|ECONNREFUSED|ENOTFOUND/i.test(updateResult.message) && (_jsx("p", { className: "text-[12px] text-ink-4 font-mono", children: t("pages.update.networkErrorHint") })), _jsx("button", { type: "button", onClick: () => setShowFullUpdateDialog(true), disabled: fullUpdating, className: "text-[12px] text-danger underline hover:text-danger/80 disabled:opacity-50", children: t("pages.update.retry") })] }))] })] }) }))] })] }), _jsxs("section", { "aria-labelledby": "section-update-history", children: [_jsx(SectionTitle, { id: "section-update-history", children: t("pages.update.history") }), historyErrorReason ? (_jsxs("div", { className: "text-ink-3 text-[13px] leading-relaxed py-3", children: [t("pages.update.loadError"), " (", historyErrorReason, ")"] })) : historyData && historyData.updates.length > 0 ? (_jsx("div", { className: "space-y-[10px]", children: historyData.updates.map((entry) => (_jsxs("article", { className: "bg-panel border border-line rounded-[6px] px-5 py-4", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("span", { className: "inline-flex items-center border border-line rounded-[2px] px-[7px] py-1 font-mono text-[11px] text-ink-3 bg-surface/80 uppercase", children: t("pages.update.version") }), _jsxs("span", { className: "font-mono text-[13px] text-ink", children: [entry.fromVersion, " \u2192 ", entry.toVersion === "failed" ? "—" : entry.toVersion] }), entry.kind !== "failure" && (_jsx("span", { className: "inline-flex items-center border border-line rounded-[2px] px-[7px] py-1 font-mono text-[11px] text-ink-3 bg-surface/80 uppercase", children: t(`pages.update.historyKind.${entry.kind}`) })), !entry.success && entry.kind !== 'refusal' && (_jsx("span", { className: "inline-flex items-center border border-danger/35 text-danger rounded-[2px] px-[7px] py-1 font-mono text-[11px] uppercase", children: t("pages.update.failed") }))] }), _jsx("div", { className: "flex items-center gap-3", children: _jsx("span", { className: "text-ink-3 text-[13px]", children: formatDate(entry.timestamp, i18n.language, {

package/console/dist/ui/utils/validators.d.ts

@@ -904,6 +904,16 @@ export interface UpdateRecoveryData {
      * Reported separately (rc-9: never a silent drop) but never hold the alarm.
      */
     superseded: UpdateRecoverySuperseded[];
+    /**
+     * PRI-1069/1070 (G1 P0-4): terminal `failed` transactions whose detail
+     * carries a restore-inconsistency marker — the physical install is NOT what
+     * the terminal state implies. They stay alarmed until a later completed
+     * install records their recovery.
+     */
+    recoveryRequired: {
+        transactionId: string;
+        reason: string;
+    }[];
     /**
      * rc-9 (PRI-896/CR-2): active.json could not be read, so recovery had no
      * live-release evidence and every non-terminal journal is conservatively an

package/console/dist/ui/utils/validators.js

@@ -2536,7 +2536,17 @@ export function validateUpdateRecovery(v) {
             superseded.push({ transactionId: item.transactionId, reason: item.reason });
         }
     }
-    const result = { needsRecovery: v.needsRecovery, unfinished, broken, superseded };
+    const recoveryRequired = [];
+    if (Object.hasOwn(v, 'recoveryRequired') && Array.isArray(v.recoveryRequired)) {
+        for (const item of v.recoveryRequired) {
+            if (!isObject(item) || !Object.hasOwn(item, 'transactionId') || !isString(item.transactionId))
+                continue;
+            if (!Object.hasOwn(item, 'reason') || !isString(item.reason))
+                continue;
+            recoveryRequired.push({ transactionId: item.transactionId, reason: item.reason });
+        }
+    }
+    const result = { needsRecovery: v.needsRecovery, unfinished, broken, superseded, recoveryRequired };
     if (Object.hasOwn(v, 'activeRecordUnreadable') && typeof v.activeRecordUnreadable === 'boolean') {
         result.activeRecordUnreadable = v.activeRecordUnreadable;
     }