create-principles-disciple 1.146.9 → 1.147.0

package/host-runtime/dist/governance-signal-admission.js

@@ -33,8 +33,9 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { randomUUID } from 'node:crypto';
 import Database from 'better-sqlite3';
-import { collectSync, computeFeatureFlagsFromConfig, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, } from '@principles/core/runtime-v2';
+import { collectSync, computeFeatureFlagsFromConfig, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, evaluateStage2ConfidenceGate, evaluatePainIngress, STAGE2_MAX_ATTEMPTS, PENDING_CANDIDATE_TTL_MS, } from '@principles/core/runtime-v2';
 import { deriveProductionCorrectionPainIdentity, deriveProductionToolPainIdentity, hasProductionPainSchema, PRODUCTION_WRITE_TOOLS, } from './production-pain-evidence.js';
 import { promoteGovernanceEvidence, ensureGovernanceSchema } from './governance-observation-store.js';
 import { loadPdConfigForPlugin } from './pd-config.js';
@@ -67,18 +68,22 @@ function rowField(row, key) {
 const KEYWORD_STORE_FILE = 'correction_keywords.json';
 /** seed/owner_promoted 词进入高精度 deterministic path 的权重阈值 */
 export const HIGH_PRECISION_LEARNED_WEIGHT = 0.7;
-/** PRI-788 G3: llm 学习词 earned precision 的 TP 门槛（且要求零 FP） */
-export const EARNED_PRECISION_MIN_TP = 3;
 /** 高精度纠正短语 overlay(已验证的确定性 STRONG 路径,不属于 learner seed 集) */
 export const HIGH_PRECISION_CORRECTION_OVERLAY = [
     ['这是错的', 0.9],
     ['不要自作主张', 0.9],
     ['不应该这么做', 0.9],
     // PRI-788 G3(Owner 批准清单):中文高精度纠正句式
-    ['我说的是', 0.9],
     ['不是让你', 0.85],
     ['谁让你', 0.85],
     ['又搞错', 0.8],
+];
+/**
+ * SPEC v0.3 §3.2.1 降级词：口语高频、可被嵌入引用或否定句，不构成 high。
+ * 它们仍是候选（进入 Stage 2），但永不直达 STRONG。
+ */
+export const AMBIGUOUS_CORRECTION_OVERLAY = [
+    ['我说的是', 0.9],
     ['都说了', 0.8],
 ];
 /** empathy seed overlay(检测行为不变) */
@@ -111,17 +116,18 @@ function mapLearnedSource(source) {
     return 'seed';
 }
 /**
- * PRI-788 G3 earned precision：llm 学习词不再恒为 ambiguous——确认证据达标
- * （TP ≥ 3 且零 FP）时升 high，出现任一 FP 即降回 ambiguous。安全姿态不变：
- * LLM 单次建议无法自升 STRONG，必须积累 LLM 确认的正例。owner_promoted 仍按
- * 权重判定（Owner 显式决策不受证据门槛约束）。
+ * SPEC v0.3 §3.2.3（D5）：llm 学习词永不自升 high。历史 TP/FP 计数可以保留为
+ * 学习证据，但「TP≥3 且零 FP → 直通」的 PRI-788 G3 行为被显式逆转：学习词
+ * 只能作为 Stage 2 优先候选，由 LLM 分类 + 统一准入判断。
+ * owner_promoted（Owner 显式决策）一般按权重判定，但降级词例外。
  */
-function precisionFor(source, weight, stats) {
-    if (source === 'llm') {
-        const tp = stats?.truePositiveCount ?? 0;
-        const fp = stats?.falsePositiveCount ?? 0;
-        return tp >= EARNED_PRECISION_MIN_TP && fp === 0 ? 'high' : 'ambiguous';
-    }
+const ALWAYS_AMBIGUOUS_TERMS = new Set(AMBIGUOUS_CORRECTION_OVERLAY.map(([term]) => term));
+function precisionFor(source, term, weight) {
+    // SPEC v0.3 §3.2.1: 降级词无论来源（含 owner_promoted）都只能作候选。
+    if (ALWAYS_AMBIGUOUS_TERMS.has(term))
+        return 'ambiguous';
+    if (source === 'llm')
+        return 'ambiguous';
     return weight >= HIGH_PRECISION_LEARNED_WEIGHT ? 'high' : 'ambiguous';
 }
 function projectLearnedStore(raw) {
@@ -143,7 +149,7 @@ function projectLearnedStore(raw) {
             term,
             category: 'correction',
             weight,
-            precision: precisionFor(kw.source, weight, kw),
+            precision: precisionFor(kw.source, term, weight),
             source: mapLearnedSource(kw.source),
         };
         if (kw.source === 'llm')
@@ -159,6 +165,11 @@ export function buildSharedSeedKeywordStore() {
     for (const [term, weight] of EMPATHY_SEED_OVERLAY) {
         terms[term] = { term, category: 'empathy', weight, precision: 'ambiguous', source: 'seed' };
     }
+    for (const [term, weight] of AMBIGUOUS_CORRECTION_OVERLAY) {
+        if (Object.hasOwn(terms, term))
+            continue;
+        terms[term] = { term, category: 'correction', weight, precision: 'ambiguous', source: 'seed' };
+    }
     for (const kw of CORRECTION_SEED_KEYWORDS) {
         if (Object.hasOwn(terms, kw.term))
             continue;
@@ -403,14 +414,18 @@ function tryConsumeRateLimit({ db, rootSessionId, ruleVersion, now }) {
         .run(rootSessionId, ruleVersion, new Date(windowStartMs).toISOString(), count + 1, now.toISOString());
     return true;
 }
-function insertCorrectionPain({ db, candidate, workspaceDir, painId, detection, nowIso }) {
-    const reason = candidate.explicitOwnerStatement === true
-        ? candidate.explicitChannel === 'codex_explicit_agent'
+/** ONE reason builder for inline admission and the pending→admitted transition. */
+function correctionReason(candidate, matchedTerms) {
+    if (candidate.explicitOwnerStatement === true) {
+        return candidate.explicitChannel === 'codex_explicit_agent'
             ? 'Codex explicit owner statement (agent-assisted, no prefix)'
-            : `${candidate.hostKind === 'workbuddy' ? 'WorkBuddy' : 'Codex'} explicit owner statement (PD记录痛苦 prefix)`
-        : detection !== undefined && detection.matchedTerms.length > 0
-            ? `User correction detected: ${detection.matchedTerms.join(', ')}`
-            : 'User correction detected';
+            : `${candidate.hostKind === 'workbuddy' ? 'WorkBuddy' : 'Codex'} explicit owner statement (PD记录痛苦 prefix)`;
+    }
+    return matchedTerms.length > 0
+        ? `User correction detected: ${matchedTerms.join(', ')}`
+        : 'User correction detected';
+}
+function insertCorrectionPain({ db, candidate, workspaceDir, painId, reason, nowIso }) {
     // P1-1 privacy (review round 2): the FULL raw text must pass through the
     // sanitizer BEFORE any truncation — sanitizeString's own contract is
     // redact → path-replace → bound. Slicing first would split a token that
@@ -429,7 +444,7 @@ function insertCorrectionPain({ db, candidate, workspaceDir, painId, detection,
  * admission path and the WorkBuddy bare-pain sweep must produce the SAME
  * shape, differing only in the attributed host and the pain facts.
  */
-function toolFailureTaskPayload(fields) {
+function buildToolFailureTaskPayload(fields) {
     // P1-1 privacy (review round 2): sanitize the FULL text before any
     // truncation — a token crossing the 200-char boundary must be redacted, not
     // split into a fragment that survives verbatim. sanitizeString bounds itself.
@@ -442,10 +457,35 @@ function toolFailureTaskPayload(fields) {
         hostKind: fields.hostKind,
         evidence: [{ sourceRef: `governance_observation:${fields.logicalObservationKey}`, note: sanitizeString(fields.reason || fields.toolName, fields.workspaceDir) }],
     };
-    return JSON.stringify(payload);
+    return payload;
 }
-function taskSubmissionPayload(candidate, workspaceDir, details) {
-    const { reason, canonicalPainId } = details;
+function toolFailureTaskPayload(fields) {
+    return JSON.stringify(buildToolFailureTaskPayload(fields));
+}
+/**
+ * P1 (review round 3): a `behavior_trace` may only name a row that EXISTS in
+ * trajectory.db with the SAME lineage tuple. WorkBuddy currently has no
+ * observation writer, so an automatic WorkBuddy correction usually has no
+ * persisted behavior evidence and evaluates to `observation_only`. Never
+ * synthesize a trace from the Pain id, prompt text, session id, or logical key.
+ */
+function persistedBehaviorTraceEvidence(args) {
+    const row = args.db.prepare(`SELECT visible_text FROM governance_observations
+    WHERE logical_key = ? AND host_kind = ? AND rollout_identity = ? AND root_session_id = ? AND host_turn_id = ?`)
+        .get(args.logicalObservationKey, args.hostKind, args.rolloutIdentity, args.rootSessionId, args.hostTurnId);
+    if (!isRecord(row))
+        return [];
+    // The durable observation is the authority for the note: it was sanitized at
+    // ingestion. Only when it carries no text do we sanitize the caller's copy.
+    const storedText = rowField(row, 'visible_text');
+    return [{
+            kind: 'behavior_trace',
+            sourceRef: `governance_observation:${args.logicalObservationKey}`,
+            note: typeof storedText === 'string' ? storedText : sanitizeString(args.text, args.workspaceDir),
+        }];
+}
+function buildTaskSubmissionPayload(candidate, workspaceDir, details) {
+    const { reason, db } = details;
     if (candidate.kind === 'user_correction') {
         // P1-1 privacy (review round 2): sanitize the FULL text before any
         // truncation — a token crossing the 200-char boundary must be redacted, not
@@ -457,16 +497,16 @@ function taskSubmissionPayload(candidate, workspaceDir, details) {
             score: GOVERNANCE_STRONG_PAIN_SCORE,
             sessionId: candidate.rootSessionId,
             hostKind: candidate.hostKind,
-            // WorkBuddy explicit intake has no transcript observation to promote.
-            // The classified Owner statement is its input basis, not a pseudo-trace.
-            evidence: candidate.hostKind === 'workbuddy'
-                ? candidate.explicitOwnerStatement === true ? [] : [{
-                        // WorkBuddy has no governance_observation, anchor to the canonical
-                        // Pain persisted in this same trajectory.db transaction.
-                        sourceRef: 'pain_event:' + (canonicalPainId ?? ''),
-                        note: sanitizeString(candidate.text, workspaceDir),
-                    }]
-                : [{ sourceRef: 'governance_observation:' + candidate.logicalObservationKey, note: sanitizeString(candidate.text, workspaceDir) }],
+            evidence: persistedBehaviorTraceEvidence({
+                db,
+                hostKind: candidate.hostKind,
+                logicalObservationKey: candidate.logicalObservationKey,
+                rolloutIdentity: candidate.rolloutIdentity,
+                rootSessionId: candidate.rootSessionId,
+                hostTurnId: candidate.hostTurnId,
+                text: candidate.text,
+                workspaceDir,
+            }),
             // SPEC-CODEX-PAIN-CLOSURE-001 CR-02 (merged from main): an explicit
             // Owner statement rides as classified correction evidence — never
             // summarized by an AI, never inside evidence[] pseudo-trace entries.
@@ -476,9 +516,9 @@ function taskSubmissionPayload(candidate, workspaceDir, details) {
                         : { text: sanitizeString(candidate.text, workspaceDir), classification: 'owner_statement', channel: candidate.explicitChannel === 'codex_explicit_agent' ? 'codex_explicit_agent' : 'codex_explicit_prefix' } }
                 : {}),
         };
-        return JSON.stringify(payload);
+        return payload;
     }
-    return toolFailureTaskPayload({
+    return buildToolFailureTaskPayload({
         hostKind: candidate.hostKind,
         logicalObservationKey: candidate.logicalObservationKey,
         sessionId: candidate.rootSessionId,
@@ -488,12 +528,265 @@ function taskSubmissionPayload(candidate, workspaceDir, details) {
         workspaceDir,
     });
 }
+function taskSubmissionPayload(candidate, workspaceDir, details) {
+    return JSON.stringify(buildTaskSubmissionPayload(candidate, workspaceDir, details));
+}
 function insertAdmissionMarker({ db, identity, canonicalPainId, ruleVersion, reason, payloadJson, nowIso }) {
     db.prepare(`INSERT INTO governance_signal_admissions
     (host_kind, logical_observation_key, rollout_identity, root_session_id, signal_kind, decision, canonical_pain_id, diagnostician_task_id, rule_version, reason, task_payload_json, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, 'admitted', ?, NULL, ?, ?, ?, ?, ?)`)
         .run(identity.hostKind, identity.logicalObservationKey, identity.rolloutIdentity, identity.rootSessionId, identity.signalKind, canonicalPainId, ruleVersion, reason.slice(0, MAX_REASON_BOUND) || null, payloadJson, nowIso, nowIso);
 }
+// ─── Pending LLM review state machine (SPEC v0.3 §4.4 / §4.4.8) ─────────────
+//
+// Ambiguous Stage-1 candidates are no longer silently dropped: they get a
+// `pending_llm_review` marker in the SAME table (zero DDL). The marker's
+// `task_payload_json` carries two lifecycle shapes:
+//  - pending:   { kind:'pending_llm_review', task_payload, review, trigger }
+//  - terminal:  { kind:'pending_review_terminal', decision, reason, ... }
+// `isGovernanceTaskPayload` rejects both shapes, so a pending/terminal row can
+// never be mistaken for an admitted task payload (fail-loud at ensure time).
+/** A claim older than this may be re-claimed (worker crashed mid-review). */
+const PENDING_REVIEW_CLAIM_TTL_MS = 10 * 60 * 1000;
+/** Internal control-flow signal for a lost pending CAS race. */
+class PendingCasLost extends Error {
+    constructor() {
+        super('pending_cas_lost');
+        this.name = 'PendingCasLost';
+    }
+}
+function parsePendingReviewMeta(value) {
+    if (!isRecord(value))
+        return null;
+    const attempts = own(value, 'attempts');
+    if (typeof attempts !== 'number' || !Number.isSafeInteger(attempts) || attempts < 0)
+        return null;
+    const ruleVersion = own(value, 'ruleVersion');
+    if (ruleVersion !== null && ruleVersion !== undefined && (typeof ruleVersion !== 'number' || !Number.isSafeInteger(ruleVersion)))
+        return null;
+    const claimedAt = own(value, 'claimedAt');
+    if (claimedAt !== undefined && typeof claimedAt !== 'string')
+        return null;
+    const claimToken = own(value, 'claimToken');
+    if (claimToken !== undefined && typeof claimToken !== 'string')
+        return null;
+    const lastAttemptAt = own(value, 'lastAttemptAt');
+    if (lastAttemptAt !== undefined && typeof lastAttemptAt !== 'string')
+        return null;
+    const lastReason = own(value, 'lastReason');
+    if (lastReason !== undefined && typeof lastReason !== 'string')
+        return null;
+    const reviewRaw = own(value, 'reviewResult');
+    let reviewResult;
+    if (reviewRaw !== undefined) {
+        if (!isRecord(reviewRaw))
+            return null;
+        const verdict = own(reviewRaw, 'verdict');
+        if (verdict !== 'correction' && verdict !== 'none' && verdict !== 'unclassified_empathy'
+            && verdict !== 'pending_low_confidence' && verdict !== 'pending_llm_error')
+            return null;
+        const confidence = own(reviewRaw, 'confidence');
+        if (confidence !== null && (typeof confidence !== 'number' || !Number.isFinite(confidence)))
+            return null;
+        const normalizedConfidence = typeof confidence === 'number' ? confidence : null;
+        const reason = own(reviewRaw, 'reason');
+        if (typeof reason !== 'string')
+            return null;
+        reviewResult = { verdict, confidence: normalizedConfidence, reason };
+    }
+    return {
+        attempts,
+        ruleVersion: typeof ruleVersion === 'number' ? ruleVersion : null,
+        ...(typeof claimedAt === 'string' ? { claimedAt } : {}),
+        ...(typeof claimToken === 'string' ? { claimToken } : {}),
+        ...(typeof lastAttemptAt === 'string' ? { lastAttemptAt } : {}),
+        ...(typeof lastReason === 'string' ? { lastReason } : {}),
+        ...(reviewResult !== undefined ? { reviewResult } : {}),
+    };
+}
+function parsePendingReviewPayload(raw) {
+    if (!isRecord(raw))
+        return null;
+    if (own(raw, 'kind') !== 'pending_llm_review')
+        return null;
+    const painId = own(raw, 'pain_id');
+    if (typeof painId !== 'string' || painId.length === 0)
+        return null;
+    const taskPayload = own(raw, 'task_payload');
+    // Declared later in this module (function declaration, hoisted); the shape
+    // guard is the single validator shared with ensureGovernanceDiagnosticianTask.
+    // eslint-disable-next-line @typescript-eslint/no-use-before-define
+    if (!isGovernanceTaskPayload(taskPayload))
+        return null;
+    const review = parsePendingReviewMeta(own(raw, 'review'));
+    if (review === null)
+        return null;
+    const trigger = own(raw, 'trigger');
+    if (!isRecord(trigger))
+        return null;
+    const text = own(trigger, 'text');
+    const hostTurnId = own(trigger, 'hostTurnId');
+    const matchedTerms = own(trigger, 'matchedTerms');
+    if (typeof text !== 'string' || typeof hostTurnId !== 'string' || !Array.isArray(matchedTerms))
+        return null;
+    const normalizedTerms = [];
+    for (const term of matchedTerms) {
+        if (typeof term !== 'string')
+            return null;
+        normalizedTerms.push(term);
+    }
+    return {
+        kind: 'pending_llm_review',
+        pain_id: painId,
+        task_payload: taskPayload,
+        review,
+        trigger: { text, matchedTerms: normalizedTerms, hostTurnId },
+    };
+}
+function buildPendingReviewPayload(args) {
+    const { candidate, workspaceDir, db, painId, matchedTerms, ruleVersion } = args;
+    const reason = correctionReason(candidate, matchedTerms);
+    return {
+        kind: 'pending_llm_review',
+        pain_id: painId,
+        task_payload: buildTaskSubmissionPayload(candidate, workspaceDir, { reason, db }),
+        review: { attempts: 0, ruleVersion, lastReason: 'ambiguous_candidate' },
+        trigger: {
+            text: sanitizeString(candidate.text, workspaceDir),
+            matchedTerms: [...matchedTerms],
+            hostTurnId: candidate.hostTurnId,
+        },
+    };
+}
+/**
+ * @deprecated SPEC v0.3 §3.2.3 (D5) retired earned precision: learned keywords
+ * are Stage-2 candidates only. This constant is retained ONLY for public API
+ * compatibility; no admission code consults it.
+ */
+export const EARNED_PRECISION_MIN_TP = 3;
+function pendingTerminalPayload(args) {
+    // D6: the Owner-approved minimal terminal field set. No trigger text,
+    // matchedTerms, reviewResult, or other classification detail survives.
+    return JSON.stringify({
+        decision: args.decision,
+        reason: args.reason,
+        confidence: args.confidence,
+        attempts: args.attempts,
+        settledAt: args.nowIso,
+    });
+}
+/**
+ * Build the ONE PainIngressReport for an automatic keyword/Stage-2 correction.
+ * Evidence is always present (the trigger text), so a bound automatic signal
+ * evaluates to `submit` — the mapping must never degrade it to
+ * observation_only (SPEC §5 hard requirement).
+ */
+function buildCorrectionIngressReport(facts) {
+    const [first, ...rest] = facts.evidence;
+    const bundle = first === undefined
+        ? { status: 'unavailable', reason: 'evidence_invalid' }
+        : { status: 'available', entries: [first, ...rest] };
+    const correlation = facts.hostKind === 'codex'
+        ? {
+            status: 'bound',
+            hostKind: 'codex',
+            rootSessionId: facts.rootSessionId,
+            rolloutIdentity: facts.rolloutIdentity,
+            logicalObservationKey: facts.logicalObservationKey,
+            hostTurnId: facts.hostTurnId,
+        }
+        : {
+            status: 'bound',
+            hostKind: 'workbuddy',
+            sessionId: facts.rootSessionId,
+            logicalObservationKey: facts.logicalObservationKey,
+        };
+    return {
+        identity: { kind: 'host_observation', observationId: facts.painId },
+        painType: 'user_frustration',
+        source: 'user_correction',
+        reason: facts.reason,
+        score: GOVERNANCE_STRONG_PAIN_SCORE,
+        origin: {
+            kind: 'automatic_hook',
+            source: facts.hostKind === 'codex' ? 'codex:user_prompt' : 'workbuddy:user_prompt_submit',
+        },
+        correlation,
+        evidence: bundle,
+    };
+}
+/**
+ * SPEC v0.3 §5: an explicit Owner statement is `owner_manual`, keeps its
+ * correctionEvidence channel, and uses `manual_pain_id` identity — it must
+ * never be rebuilt as an automatic hook. Bound owner reports with no transcript
+ * evidence legitimately evaluate to `degrade`, never `observation_only`.
+ */
+function buildOwnerCorrectionIngressReport(facts) {
+    const [first, ...rest] = facts.evidence;
+    const bundle = first === undefined
+        ? { status: 'unavailable', reason: 'trajectory_unavailable' }
+        : { status: 'available', entries: [first, ...rest] };
+    const correlation = facts.hostKind === 'codex'
+        ? {
+            status: 'bound',
+            hostKind: 'codex',
+            rootSessionId: facts.rootSessionId,
+            rolloutIdentity: facts.rolloutIdentity,
+            logicalObservationKey: facts.logicalObservationKey,
+            hostTurnId: facts.hostTurnId,
+        }
+        : {
+            status: 'bound',
+            hostKind: 'workbuddy',
+            sessionId: facts.rootSessionId,
+            logicalObservationKey: facts.logicalObservationKey,
+        };
+    return {
+        identity: { kind: 'manual_pain_id', painId: facts.painId },
+        painType: 'user_frustration',
+        source: 'user_correction',
+        reason: facts.reason,
+        score: GOVERNANCE_STRONG_PAIN_SCORE,
+        origin: { kind: 'owner_manual', channel: facts.channel },
+        correlation,
+        evidence: bundle,
+    };
+}
+function ownerExplicitChannel(candidate) {
+    if (candidate.explicitChannel !== undefined)
+        return candidate.explicitChannel;
+    return candidate.hostKind === 'workbuddy' ? 'workbuddy_explicit_prefix' : 'codex_explicit_prefix';
+}
+function correctionIngressEvidence(args) {
+    // Real persisted behavior evidence only (P1 review round 3). No Pain-id /
+    // logical-key / session-id pseudo-traces — WorkBuddy yields no evidence here.
+    return persistedBehaviorTraceEvidence(args);
+}
+/**
+ * Run the shared ingress semantics BEFORE any Pain/limit/marker side effect
+ * (v0.3.1 §1.2). A refusal/observation-only signal becomes a terminal
+ * `abandoned(reasonCode)` marker with zero Pain, zero quota.
+ */
+function ingressTerminalReason(facts) {
+    const decision = evaluatePainIngress(buildCorrectionIngressReport(facts));
+    if (decision.action === 'refuse' || decision.action === 'observation_only') {
+        return decision.reasonCode;
+    }
+    return null;
+}
+function insertTerminalCorrectionMarker(args) {
+    args.db.prepare(`INSERT INTO governance_signal_admissions
+    (host_kind, logical_observation_key, rollout_identity, root_session_id, signal_kind, decision, canonical_pain_id, diagnostician_task_id, rule_version, reason, task_payload_json, created_at, updated_at)
+    VALUES (?, ?, ?, ?, 'user_correction', 'abandoned', NULL, NULL, ?, ?, ?, ?, ?)`)
+        .run(args.candidate.hostKind, args.candidate.logicalObservationKey, args.candidate.rolloutIdentity, args.candidate.rootSessionId, args.ruleVersion, args.reason.slice(0, MAX_REASON_BOUND), pendingTerminalPayload({ decision: 'abandoned', reason: args.reason, attempts: 0, confidence: null, nowIso: args.nowIso }), args.nowIso, args.nowIso);
+}
+/** Insert the pending marker. UNIQUE-violation races are resolved by the caller. */
+function insertPendingCorrectionMarker(args) {
+    args.db.prepare(`INSERT INTO governance_signal_admissions
+    (host_kind, logical_observation_key, rollout_identity, root_session_id, signal_kind, decision, canonical_pain_id, diagnostician_task_id, rule_version, reason, task_payload_json, created_at, updated_at)
+    VALUES (?, ?, ?, ?, 'user_correction', 'pending_llm_review', NULL, NULL, ?, ?, ?, ?, ?)`)
+        .run(args.candidate.hostKind, args.candidate.logicalObservationKey, args.candidate.rolloutIdentity, args.candidate.rootSessionId, args.ruleVersion, 'ambiguous correction candidate awaiting Stage 2 review', args.payloadJson, args.nowIso, args.nowIso);
+}
 /**
  * Convergence probe for the concurrent-redelivery race: two admission
  * processes passed the pre-transaction marker probe before either committed,
@@ -548,11 +841,154 @@ function admitCorrection({ db, candidate, workspaceDir, now, nowIso, keywordStor
             && detection.output.isSignal
             && detection.output.strength === 'STRONG'
             && detection.output.matchedPrecision === 'high');
-    if (!isStrongHighPrecision) {
-        // Ordinary conversation / weak negation / ambiguous candidates: no pain,
-        // no task, no quota, and no marker (SPEC §18 scenario 6 — silence).
+    // Ordinary conversation / zero-hit discovery is decided BEFORE the ingress
+    // gate: it has no Pain, no task, no quota, and no marker (SPEC §18 scenario
+    // 6). Ingress evidence only governs actual signals — running it first would
+    // turn silence into an audit row and mask `not_a_signal`.
+    const ambiguousTerms = detection?.output.matchedTerms ?? [];
+    const isAmbiguousCandidate = detection !== undefined
+        && detection.output.matchedPrecision === 'ambiguous'
+        && ambiguousTerms.length > 0;
+    if (!isStrongHighPrecision && !isAmbiguousCandidate) {
         return { disposition: 'not_a_signal', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey };
     }
+    // v0.3.1 §1.2: shared ingress semantics run BEFORE any Pain/limit/marker
+    // side effect — for explicit Owner statements AND automatic hooks. The
+    // origin/channel are derived from the signal's real source.
+    {
+        const { painId } = deriveProductionCorrectionPainIdentity({
+            workspaceDir,
+            sessionId: candidate.rootSessionId,
+            occurrenceId: candidate.hostTurnId,
+            text: candidate.text,
+        });
+        const ingressReasonValue = correctionReason(candidate, detection?.output.matchedTerms ?? []);
+        const ingressDecision = isExplicit
+            ? evaluatePainIngress(buildOwnerCorrectionIngressReport({
+                hostKind: candidate.hostKind,
+                channel: ownerExplicitChannel(candidate),
+                logicalObservationKey: candidate.logicalObservationKey,
+                rolloutIdentity: candidate.rolloutIdentity,
+                rootSessionId: candidate.rootSessionId,
+                hostTurnId: candidate.hostTurnId,
+                painId,
+                reason: ingressReasonValue,
+                // Codex has a real governance observation anchor when ingestion
+                // persisted one; otherwise (ingestion disabled) the statement degrades
+                // to the Owner Manual path instead of fabricating a trace. WorkBuddy
+                // explicit intake has no transcript evidence and degrades honestly.
+                evidence: correctionIngressEvidence({
+                    db,
+                    hostKind: candidate.hostKind,
+                    logicalObservationKey: candidate.logicalObservationKey,
+                    rolloutIdentity: candidate.rolloutIdentity,
+                    rootSessionId: candidate.rootSessionId,
+                    hostTurnId: candidate.hostTurnId,
+                    text: candidate.text,
+                    workspaceDir,
+                }),
+            }))
+            : evaluatePainIngress(buildCorrectionIngressReport({
+                hostKind: candidate.hostKind,
+                logicalObservationKey: candidate.logicalObservationKey,
+                rolloutIdentity: candidate.rolloutIdentity,
+                rootSessionId: candidate.rootSessionId,
+                hostTurnId: candidate.hostTurnId,
+                painId,
+                reason: ingressReasonValue,
+                evidence: correctionIngressEvidence({
+                    db,
+                    hostKind: candidate.hostKind,
+                    logicalObservationKey: candidate.logicalObservationKey,
+                    rolloutIdentity: candidate.rolloutIdentity,
+                    rootSessionId: candidate.rootSessionId,
+                    hostTurnId: candidate.hostTurnId,
+                    text: candidate.text,
+                    workspaceDir,
+                }),
+            }));
+        const ingressReason = ingressDecision.action === 'refuse' || ingressDecision.action === 'observation_only'
+            ? ingressDecision.reasonCode
+            : null;
+        if (ingressReason !== null) {
+            try {
+                insertTerminalCorrectionMarker({
+                    db,
+                    candidate,
+                    decision: 'abandoned',
+                    reason: ingressReason,
+                    ruleVersion: detection?.ruleVersion ?? null,
+                    nowIso,
+                });
+            }
+            catch (error) {
+                const existing = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ?').get(candidate.logicalObservationKey);
+                if (isRecord(existing)) {
+                    const existingReason = rowField(existing, 'reason');
+                    return {
+                        disposition: 'abandoned',
+                        kind: 'user_correction',
+                        logicalObservationKey: candidate.logicalObservationKey,
+                        reason: typeof existingReason === 'string' ? existingReason : ingressReason,
+                    };
+                }
+                throw error;
+            }
+            return { disposition: 'abandoned', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, reason: ingressReason };
+        }
+    }
+    if (!isStrongHighPrecision) {
+        // SPEC §4.4.8: ambiguous candidates become auditable pending rows (the
+        // explicit change from the old "silence" contract). The canonical id is
+        // derived from host identity facts — identical before and after review.
+        const { painId } = deriveProductionCorrectionPainIdentity({
+            workspaceDir,
+            sessionId: candidate.rootSessionId,
+            occurrenceId: candidate.hostTurnId,
+            text: candidate.text,
+        });
+        const ruleVersion = detection?.ruleVersion ?? null;
+        try {
+            insertPendingCorrectionMarker({
+                db,
+                candidate,
+                ruleVersion,
+                payloadJson: JSON.stringify(buildPendingReviewPayload({
+                    candidate,
+                    workspaceDir,
+                    db,
+                    painId,
+                    matchedTerms: ambiguousTerms,
+                    ruleVersion,
+                })),
+                nowIso,
+            });
+        }
+        catch (error) {
+            // Concurrent redelivery hit UNIQUE: converge on the durable row instead
+            // of surfacing a governance failure (rc-7 fresh re-read).
+            const existing = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ?').get(candidate.logicalObservationKey);
+            if (isRecord(existing)) {
+                const decision = rowField(existing, 'decision');
+                if (decision === 'pending_llm_review') {
+                    return { disposition: 'pending_llm_review', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, duplicate: true };
+                }
+                if (decision === 'resolved_none' || decision === 'abandoned') {
+                    const reason = rowField(existing, 'reason');
+                    return { disposition: decision, kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, reason: typeof reason === 'string' ? reason : null };
+                }
+                if (decision === 'admitted') {
+                    const canonicalPainId = rowField(existing, 'canonical_pain_id');
+                    const taskId = rowField(existing, 'diagnostician_task_id');
+                    if (typeof canonicalPainId === 'string') {
+                        return { disposition: 'already_admitted', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, canonicalPainId, diagnosticianTaskId: typeof taskId === 'string' ? taskId : null };
+                    }
+                }
+            }
+            throw error;
+        }
+        return { disposition: 'pending_llm_review', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, duplicate: false };
+    }
     const { painId } = deriveProductionCorrectionPainIdentity({
         workspaceDir,
         sessionId: candidate.rootSessionId,
@@ -581,7 +1017,7 @@ function admitCorrection({ db, candidate, workspaceDir, now, nowIso, keywordStor
                 if (!tryConsumeRateLimit({ db, rootSessionId: candidate.rootSessionId, ruleVersion: rateLimitRuleVersion, now })) {
                     throw new RateLimitedSignal();
                 }
-                reason = insertCorrectionPain({ db, candidate, workspaceDir, painId, detection: detection?.output, nowIso });
+                reason = insertCorrectionPain({ db, candidate, workspaceDir, painId, reason: correctionReason(candidate, detection?.output.matchedTerms ?? []), nowIso });
             }
             insertAdmissionMarker({
                 db,
@@ -591,7 +1027,7 @@ function admitCorrection({ db, candidate, workspaceDir, now, nowIso, keywordStor
                 // detection, so `detection` is optional — no ruleVersion exists for them.
                 ruleVersion: detection?.ruleVersion ?? null,
                 reason,
-                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason, canonicalPainId: painId }),
+                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason, db }),
                 nowIso,
             });
         })();
@@ -691,7 +1127,7 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
                 canonicalPainId: painId,
                 ruleVersion: null,
                 reason: sanitizeString(reason, workspaceDir),
-                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason }),
+                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason, db }),
                 nowIso,
             });
         }
@@ -710,13 +1146,27 @@ function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDe
     }
     const marker = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ?').get(candidate.logicalObservationKey);
     if (isRecord(marker)) {
+        // SPEC v0.3 §4.4.3 pending guard: a redelivered candidate whose marker is
+        // pending/terminal must return that semantic — never a bogus
+        // `already_admitted` with an empty canonical id.
+        const decision = rowField(marker, 'decision');
+        if (decision === 'pending_llm_review') {
+            return { disposition: 'pending_llm_review', kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, duplicate: true };
+        }
+        if (decision === 'resolved_none' || decision === 'abandoned') {
+            const reason = rowField(marker, 'reason');
+            return { disposition: decision, kind: 'user_correction', logicalObservationKey: candidate.logicalObservationKey, reason: typeof reason === 'string' ? reason : null };
+        }
         const canonicalPainId = rowField(marker, 'canonical_pain_id');
         const taskId = rowField(marker, 'diagnostician_task_id');
+        if (typeof canonicalPainId !== 'string' || canonicalPainId.length === 0) {
+            return { ok: false, reason: 'admission_marker_corrupt', nextAction: 'Inspect governance_signal_admissions for an admitted row with a missing canonical_pain_id; do not re-admit into a corrupt marker.' };
+        }
         return {
             disposition: 'already_admitted',
             kind: candidate.kind,
             logicalObservationKey: candidate.logicalObservationKey,
-            canonicalPainId: typeof canonicalPainId === 'string' ? canonicalPainId : '',
+            canonicalPainId,
             diagnosticianTaskId: typeof taskId === 'string' ? taskId : null,
         };
     }
@@ -774,6 +1224,443 @@ function admitGovernanceSignalsInternal(input, trustedWorkbuddyLive = false) {
 export function admitGovernanceSignals(input) {
     return admitGovernanceSignalsInternal(input);
 }
+function pendingReviewMarkerRow(db, key) {
+    const row = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ?').get(key);
+    return isRecord(row) ? row : null;
+}
+function parsePendingRow(row) {
+    const payloadText = rowField(row, 'task_payload_json');
+    const createdAt = rowField(row, 'created_at');
+    const hostKind = rowField(row, 'host_kind');
+    const rolloutIdentity = rowField(row, 'rollout_identity');
+    const rootSessionId = rowField(row, 'root_session_id');
+    if (typeof payloadText !== 'string' || typeof createdAt !== 'string' || typeof hostKind !== 'string'
+        || typeof rolloutIdentity !== 'string' || typeof rootSessionId !== 'string')
+        return null;
+    if (hostKind !== 'codex' && hostKind !== 'workbuddy')
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(payloadText);
+    }
+    catch {
+        return null;
+    }
+    const payload = parsePendingReviewPayload(parsed);
+    if (payload === null)
+        return null;
+    return { payloadText, payload, createdAt, hostKind, rolloutIdentity, rootSessionId };
+}
+/**
+ * Claim bounded pending candidates with an optimistic CAS on the exact payload
+ * text. Rows whose claim is younger than PENDING_REVIEW_CLAIM_TTL_MS are
+ * skipped (another worker is reviewing them); TTL-expired rows become
+ * `abandoned(ttl_expired)` here, before any LLM work.
+ */
+export function claimPendingCorrectionCandidates(input) {
+    const opened = openAdmissionStore(input.workspaceDir, input.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    const limit = Math.min(Math.max(input.limit ?? 2, 1), 8);
+    const candidates = [];
+    let expired = 0;
+    try {
+        const rows = db.prepare(`SELECT * FROM governance_signal_admissions
+      WHERE decision = 'pending_llm_review' ORDER BY id LIMIT ?`).all(limit * 3);
+        for (const row of rows) {
+            if (candidates.length >= limit)
+                break;
+            if (!isRecord(row))
+                continue;
+            const key = rowField(row, 'logical_observation_key');
+            if (typeof key !== 'string')
+                continue;
+            const parsed = parsePendingRow(row);
+            if (parsed === null) {
+                // Corrupt pending payload: fail loud into a terminal row so it cannot
+                // poison every future batch (rc-3), with no Pain and no task.
+                db.prepare(`UPDATE governance_signal_admissions
+          SET decision = 'abandoned', reason = ?, task_payload_json = ?, updated_at = ?
+          WHERE logical_observation_key = ? AND decision = 'pending_llm_review'`)
+                    .run('invalid_pending_payload', pendingTerminalPayload({ decision: 'abandoned', reason: 'invalid_pending_payload', attempts: 0, confidence: null, nowIso }), nowIso, key);
+                expired += 1;
+                continue;
+            }
+            const ageMs = Date.parse(parsed.createdAt);
+            if (!Number.isFinite(ageMs) || now.getTime() - ageMs >= PENDING_CANDIDATE_TTL_MS) {
+                db.prepare(`UPDATE governance_signal_admissions
+          SET decision = 'abandoned', reason = ?, task_payload_json = ?, updated_at = ?
+          WHERE logical_observation_key = ? AND decision = 'pending_llm_review'`)
+                    .run('ttl_expired', pendingTerminalPayload({ decision: 'abandoned', reason: 'ttl_expired', attempts: parsed.payload.review.attempts, confidence: null, nowIso }), nowIso, key);
+                expired += 1;
+                continue;
+            }
+            const { claimedAt } = parsed.payload.review;
+            const hasReviewResult = parsed.payload.review.reviewResult !== undefined;
+            if (!hasReviewResult && typeof claimedAt === 'string') {
+                const claimedMs = Date.parse(claimedAt);
+                if (Number.isFinite(claimedMs) && now.getTime() - claimedMs < PENDING_REVIEW_CLAIM_TTL_MS)
+                    continue;
+            }
+            let claimToken = null;
+            if (!hasReviewResult) {
+                // `claimedAt` is the TTL clock; the random token is the fencing identity.
+                claimToken = randomUUID();
+                const nextPayload = { ...parsed.payload, review: { ...parsed.payload.review, claimedAt: nowIso, claimToken } };
+                const { changes } = db.prepare(`UPDATE governance_signal_admissions SET task_payload_json = ?, updated_at = ?
+          WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+                    .run(JSON.stringify(nextPayload), nowIso, key, parsed.payloadText);
+                if (changes !== 1)
+                    continue; // another worker won the claim
+            }
+            candidates.push({
+                logicalObservationKey: key,
+                hostKind: parsed.hostKind === 'workbuddy' ? 'workbuddy' : 'codex',
+                rolloutIdentity: parsed.rolloutIdentity,
+                rootSessionId: parsed.rootSessionId,
+                hostTurnId: parsed.payload.trigger.hostTurnId,
+                text: parsed.payload.trigger.text,
+                matchedTerms: parsed.payload.trigger.matchedTerms,
+                attempts: parsed.payload.review.attempts,
+                claimedAt: hasReviewResult ? null : nowIso,
+                claimToken,
+                reviewResult: parsed.payload.review.reviewResult ?? null,
+                createdAt: parsed.createdAt,
+            });
+        }
+        return { ok: true, candidates, expired };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200);
+        return { ok: false, reason: `pending_claim_failed:${detail}`, nextAction: 'inspect the workspace trajectory database; pending rows remain durable' };
+    }
+    finally {
+        close();
+    }
+}
+/**
+ * Release THIS worker's claim when no classification started (budget exhausted
+ * or classifier unavailable), so the next cycle can re-claim immediately.
+ *
+ * Guard rails:
+ * - only `pending_llm_review` rows;
+ * - never when a durable reviewResult exists (that outcome must be consumed by
+ *   settle, not thrown away);
+ * - the persisted claim token must still be the one this worker took;
+ * - CAS on the exact payload text, so a concurrent worker's state is untouched.
+ */
+export function releasePendingCorrectionClaim(input) {
+    const opened = openAdmissionStore(input.workspaceDir, input.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    try {
+        const row = pendingReviewMarkerRow(db, input.logicalObservationKey);
+        if (row === null)
+            return { ok: true, released: false, reason: 'not_pending' };
+        if (rowField(row, 'decision') !== 'pending_llm_review') {
+            return { ok: true, released: false, reason: 'not_pending' };
+        }
+        const parsed = parsePendingRow(row);
+        if (parsed === null)
+            return { ok: true, released: false, reason: 'claim_changed' };
+        if (parsed.payload.review.reviewResult !== undefined) {
+            return { ok: true, released: false, reason: 'review_already_persisted' };
+        }
+        const currentClaim = parsed.payload.review.claimToken;
+        if (currentClaim === undefined)
+            return { ok: true, released: false, reason: 'claim_absent' };
+        if (currentClaim !== input.claimToken)
+            return { ok: true, released: false, reason: 'claim_not_owned' };
+        const { claimedAt: _consumedClaim, claimToken: _consumedToken, ...reviewWithoutClaim } = parsed.payload.review;
+        void _consumedClaim;
+        void _consumedToken;
+        const nextPayload = { ...parsed.payload, review: reviewWithoutClaim };
+        const { changes } = db.prepare(`UPDATE governance_signal_admissions SET task_payload_json = ?, updated_at = ?
+      WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+            .run(JSON.stringify(nextPayload), new Date().toISOString(), input.logicalObservationKey, parsed.payloadText);
+        if (changes !== 1)
+            return { ok: true, released: false, reason: 'claim_changed' };
+        return { ok: true, released: true, reason: 'released' };
+    }
+    finally {
+        close();
+    }
+}
+/**
+ * Durable Phase 1: persist the Stage-2 verdict + attempts into the pending
+ * payload (CAS on the payload text). A crash after this commit loses no LLM
+ * result; `settlePendingCorrection` finishes the transition without re-calling.
+ */
+export function recordPendingCorrectionReview(input) {
+    const opened = openAdmissionStore(input.workspaceDir, input.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    try {
+        const row = pendingReviewMarkerRow(db, input.logicalObservationKey);
+        if (row === null)
+            return { ok: true, disposition: 'not_pending', logicalObservationKey: input.logicalObservationKey, attempts: 0, reason: 'marker_missing' };
+        if (rowField(row, 'decision') !== 'pending_llm_review') {
+            return { ok: true, disposition: 'not_pending', logicalObservationKey: input.logicalObservationKey, attempts: 0, reason: 'marker_not_pending' };
+        }
+        const parsed = parsePendingRow(row);
+        if (parsed === null) {
+            return { ok: false, reason: 'pending_payload_invalid', nextAction: 'inspect the pending marker payload; the row stays pending until repaired' };
+        }
+        // Fencing: if another worker re-claimed this row (our claim exceeded the
+        // 10-minute TTL and was taken over), our verdict must NOT overwrite the
+        // new owner's state. Compare the fencing token, not only the payload text.
+        const currentClaimToken = parsed.payload.review.claimToken;
+        if (currentClaimToken === undefined || currentClaimToken !== input.claimToken) {
+            return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: parsed.payload.review.attempts, reason: 'claim_not_owned' };
+        }
+        const gate = evaluateStage2ConfidenceGate(input.llmResult);
+        const attempts = parsed.payload.review.attempts + 1;
+        const reviewResult = { verdict: gate.verdict, confidence: gate.confidence, reason: gate.reason };
+        const nextPayload = {
+            ...parsed.payload,
+            review: {
+                ...parsed.payload.review,
+                attempts,
+                reviewResult,
+                lastAttemptAt: nowIso,
+                lastReason: gate.verdict,
+                // Keep the SAME claim stamp/token so a parallel worker skips this row;
+                // a crash after this commit is handled by the reviewResult-present path.
+            },
+        };
+        const { changes } = db.prepare(`UPDATE governance_signal_admissions SET task_payload_json = ?, updated_at = ?
+      WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+            .run(JSON.stringify(nextPayload), nowIso, input.logicalObservationKey, parsed.payloadText);
+        if (changes !== 1) {
+            return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: parsed.payload.review.attempts, reason: 'payload_changed' };
+        }
+        return {
+            ok: true,
+            disposition: 'pending',
+            logicalObservationKey: input.logicalObservationKey,
+            attempts,
+            reason: gate.reason,
+        };
+    }
+    finally {
+        close();
+    }
+}
+/**
+ * Durable Phase 2: apply the persisted verdict. Correction → admitted (CAS,
+ * pain dedup, rate limit, marker swap); confident none → resolved_none;
+ * low-confidence/error/empathy → pending until MAX_ATTEMPTS or TTL; rate
+ * limiting rolls the transaction back and leaves the row pending without
+ * consuming another attempt (no LLM happened here).
+ */
+export async function settlePendingCorrection(input) {
+    const workspaceDir = path.resolve(input.workspaceDir);
+    const opened = openAdmissionStore(input.workspaceDir, input.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    const now = input.now ?? new Date();
+    const nowIso = now.toISOString();
+    try {
+        const row = pendingReviewMarkerRow(db, input.logicalObservationKey);
+        if (row === null)
+            return { ok: true, disposition: 'not_pending', logicalObservationKey: input.logicalObservationKey, attempts: 0, reason: 'marker_missing' };
+        const decision = rowField(row, 'decision');
+        if (decision === 'admitted') {
+            const canonicalPainId = rowField(row, 'canonical_pain_id');
+            const taskId = rowField(row, 'diagnostician_task_id');
+            return { ok: true, disposition: 'admitted', logicalObservationKey: input.logicalObservationKey, ...(typeof canonicalPainId === 'string' ? { canonicalPainId } : {}), ...(typeof taskId === 'string' ? { taskId } : {}), attempts: 0, reason: null };
+        }
+        if (decision !== 'pending_llm_review') {
+            const reason = rowField(row, 'reason');
+            return { ok: true, disposition: 'not_pending', logicalObservationKey: input.logicalObservationKey, attempts: 0, reason: typeof reason === 'string' ? reason : null };
+        }
+        const parsed = parsePendingRow(row);
+        if (parsed === null) {
+            return { ok: false, reason: 'pending_payload_invalid', nextAction: 'inspect the pending marker payload; the row stays pending until repaired' };
+        }
+        const { payload, payloadText, createdAt, rootSessionId, rolloutIdentity, hostKind } = parsed;
+        // Fencing: a settlement that depends on this worker's claim must still hold
+        // that claim. Omitted token = crash recovery of an already durable result,
+        // which any successor may finish (reviewResult is the durable evidence).
+        if (input.claimToken !== undefined) {
+            const currentClaimToken = payload.review.claimToken;
+            if (currentClaimToken === undefined || currentClaimToken !== input.claimToken) {
+                return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'claim_not_owned' };
+            }
+        }
+        const review = payload.review.reviewResult;
+        if (review === undefined) {
+            return { ok: true, disposition: 'pending', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'review_not_recorded' };
+        }
+        const ageMs = Date.parse(createdAt);
+        const ttlExpired = Number.isFinite(ageMs) && now.getTime() - ageMs >= PENDING_CANDIDATE_TTL_MS;
+        // TTL bounds EVERY pending verdict, including a late correction: a candidate
+        // that sat past the window is no longer trustworthy evidence.
+        if (ttlExpired) {
+            const { changes } = db.prepare(`UPDATE governance_signal_admissions SET decision = 'abandoned', reason = ?, task_payload_json = ?, updated_at = ?
+        WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+                .run('ttl_expired', pendingTerminalPayload({ decision: 'abandoned', reason: 'ttl_expired', attempts: payload.review.attempts, confidence: review.confidence, nowIso }), nowIso, input.logicalObservationKey, payloadText);
+            if (changes !== 1) {
+                return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'cas_lost' };
+            }
+            return { ok: true, disposition: 'abandoned', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'ttl_expired' };
+        }
+        if (review.verdict !== 'correction' && review.verdict !== 'none') {
+            if (payload.review.attempts >= STAGE2_MAX_ATTEMPTS) {
+                const reason = review.verdict === 'pending_llm_error' ? 'llm_error' : 'low_confidence';
+                const { changes } = db.prepare(`UPDATE governance_signal_admissions SET decision = 'abandoned', reason = ?, task_payload_json = ?, updated_at = ?
+          WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+                    .run(reason, pendingTerminalPayload({ decision: 'abandoned', reason, attempts: payload.review.attempts, confidence: review.confidence, nowIso }), nowIso, input.logicalObservationKey, payloadText);
+                if (changes !== 1) {
+                    return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'cas_lost' };
+                }
+                return { ok: true, disposition: 'abandoned', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason };
+            }
+            // Retryable verdict: consume the review result and release the claim so
+            // the next worker cycle re-claims and calls the LLM again. Both claim
+            // properties must be ABSENT (claim logic tests `reviewResult !==
+            // undefined` / `claimToken`), and the CAS must use the exact payload we
+            // read (concurrent-settle guard).
+            const { reviewResult: _consumedReview, claimedAt: _consumedClaim, claimToken: _consumedToken, ...retainedReview } = payload.review;
+            void _consumedReview;
+            void _consumedClaim;
+            void _consumedToken;
+            const nextPayload = {
+                ...payload,
+                review: { ...retainedReview, lastAttemptAt: nowIso, lastReason: review.verdict },
+            };
+            const { changes } = db.prepare(`UPDATE governance_signal_admissions SET task_payload_json = ?, updated_at = ?
+        WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+                .run(JSON.stringify(nextPayload), nowIso, input.logicalObservationKey, payloadText);
+            if (changes !== 1) {
+                return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'cas_lost' };
+            }
+            return { ok: true, disposition: 'pending', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: review.verdict };
+        }
+        if (review.verdict === 'none') {
+            const { changes } = db.prepare(`UPDATE governance_signal_admissions SET decision = 'resolved_none', reason = ?, task_payload_json = ?, updated_at = ?
+        WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+                .run(review.reason.slice(0, MAX_REASON_BOUND) || 'stage2_none', pendingTerminalPayload({ decision: 'resolved_none', reason: review.reason, attempts: payload.review.attempts, confidence: review.confidence, nowIso }), nowIso, input.logicalObservationKey, payloadText);
+            if (changes !== 1) {
+                return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'cas_lost' };
+            }
+            return { ok: true, disposition: 'resolved_none', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: review.reason };
+        }
+        // Correction → Pain Admission. The canonical id was derived pre-review from
+        // host identity facts; recompute it here from the same facts so the two
+        // stages cannot drift (rc-6).
+        const candidate = {
+            kind: 'user_correction',
+            hostKind: hostKind === 'workbuddy' ? 'workbuddy' : 'codex',
+            logicalObservationKey: input.logicalObservationKey,
+            rolloutIdentity,
+            rootSessionId,
+            hostTurnId: payload.trigger.hostTurnId,
+            text: payload.trigger.text,
+            observedAt: createdAt,
+        };
+        // rc-6: reuse the id derived BEFORE review (the persisted trigger text may
+        // be sanitized/truncated, so re-deriving from it would change the hash).
+        const painId = payload.pain_id;
+        const reason = correctionReason(candidate, payload.trigger.matchedTerms);
+        // v0.3.1 §1.2: the shared ingress decision precedes the admitted CAS.
+        // P1 review round 3: re-derive evidence from trajectory.db instead of
+        // trusting whatever the pending payload recorded. A pending candidate with
+        // no real persisted observation (e.g. WorkBuddy automatic) cannot be
+        // admitted — it settles as observation_only with zero Pain/quota.
+        const ingressReason = ingressTerminalReason({
+            hostKind: candidate.hostKind,
+            logicalObservationKey: input.logicalObservationKey,
+            rolloutIdentity,
+            rootSessionId,
+            hostTurnId: candidate.hostTurnId,
+            painId,
+            reason,
+            evidence: correctionIngressEvidence({
+                db,
+                hostKind: candidate.hostKind,
+                logicalObservationKey: input.logicalObservationKey,
+                rolloutIdentity,
+                rootSessionId,
+                hostTurnId: candidate.hostTurnId,
+                text: payload.trigger.text,
+                workspaceDir,
+            }),
+        });
+        if (ingressReason !== null) {
+            const { changes } = db.prepare(`UPDATE governance_signal_admissions SET decision = 'abandoned', reason = ?, task_payload_json = ?, updated_at = ?
+        WHERE logical_observation_key = ? AND decision = 'pending_llm_review' AND task_payload_json = ?`)
+                .run(ingressReason, pendingTerminalPayload({ decision: 'abandoned', reason: ingressReason, attempts: payload.review.attempts, confidence: review.confidence, nowIso }), nowIso, input.logicalObservationKey, payloadText);
+            if (changes !== 1) {
+                return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'cas_lost' };
+            }
+            return { ok: true, disposition: 'abandoned', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: ingressReason };
+        }
+        let duplicate = false;
+        try {
+            db.transaction(() => {
+                const { changes } = db.prepare(`UPDATE governance_signal_admissions
+          SET decision = 'admitted', canonical_pain_id = ?, rule_version = ?, reason = ?, task_payload_json = ?, updated_at = ?
+          WHERE logical_observation_key = ? AND decision = 'pending_llm_review'`)
+                    .run(painId, payload.review.ruleVersion, reason.slice(0, MAX_REASON_BOUND), JSON.stringify(payload.task_payload), nowIso, input.logicalObservationKey);
+                if (changes !== 1)
+                    throw new PendingCasLost();
+                if (db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?').get(painId) !== undefined) {
+                    duplicate = true;
+                    db.prepare('UPDATE pain_events SET host_kind = ? WHERE canonical_pain_id = ? AND host_kind IS NULL').run(candidate.hostKind, painId);
+                }
+                else {
+                    const ruleVersion = payload.review.ruleVersion ?? EXPLICIT_OWNER_STATEMENT_RULE_VERSION;
+                    if (!tryConsumeRateLimit({ db, rootSessionId: candidate.rootSessionId, ruleVersion, now }))
+                        throw new RateLimitedSignal();
+                    insertCorrectionPain({ db, candidate, workspaceDir, painId, reason, nowIso });
+                }
+            })();
+        }
+        catch (error) {
+            if (error instanceof PendingCasLost) {
+                return { ok: true, disposition: 'concurrent_loss', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'cas_lost' };
+            }
+            if (error instanceof RateLimitedSignal) {
+                // Non-LLM failure: the row stays pending with its attempts unchanged
+                // (the review result is already durable). TTL eventually bounds it.
+                return { ok: true, disposition: 'pending', logicalObservationKey: input.logicalObservationKey, attempts: payload.review.attempts, reason: 'rate_limited' };
+            }
+            throw error;
+        }
+        // eslint-disable-next-line @typescript-eslint/no-use-before-define -- declared below; function declarations are hoisted
+        const ensured = await ensureGovernanceDiagnosticianTask({
+            workspaceDir,
+            logicalObservationKey: input.logicalObservationKey,
+            canonicalPainId: painId,
+            ...(input.databaseFactory ? { databaseFactory: input.databaseFactory } : {}),
+        });
+        return {
+            ok: true,
+            disposition: 'admitted',
+            logicalObservationKey: input.logicalObservationKey,
+            canonicalPainId: painId,
+            attempts: payload.review.attempts,
+            reason: duplicate ? 'duplicate_pain' : reason,
+            ...(ensured.ok ? { taskId: ensured.taskId } : {}),
+        };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200);
+        return { ok: false, reason: `pending_settle_failed:${detail}`, nextAction: 'inspect the workspace trajectory database; admitted rows are durably recoverable via reconcile' };
+    }
+    finally {
+        close();
+    }
+}
 /** P0: a four-term projection of existing canonical high-precision seeds. */
 const WORKBUDDY_AUTO_TERMS = new Set(['这是错的', '不要自作主张', '不应该这么做', '又搞错']);
 const WORKBUDDY_MAX_PROMPT_BYTES = 16 * 1024;
@@ -800,23 +1687,37 @@ export function resolveSharedCorrectionKeywordStoreForDetection(workspaceDir) {
     return createSharedCorrectionKeywordStore({ workspaceDir }).resolve();
 }
 /**
- * Pure check: no DB, no classifier, no historical transcript. The optional
- * store parameter is how the shared live vocabulary enters (AUDIT-P3-01);
- * omitted, the check keeps the P0 four-term projection (backward compatible).
+ * Shared WorkBuddy Stage-1 assessment. `strong` may admit inline (no LLM);
+ * `ambiguous` persists a pending Stage-2 candidate (zero LLM in the hook);
+ * `none` writes nothing. The startsWith pre-filter (SPEC P-5) is retained
+ * until the cross-host negative matrix authorizes its retirement.
  */
-export function assessWorkbuddyLiveKeyword(text, sessionId, store) {
+export function assessWorkbuddyCorrectionCandidate(text, sessionId, store) {
     if (Buffer.byteLength(text, 'utf8') > WORKBUDDY_MAX_PROMPT_BYTES) {
-        return { matched: false, reason: 'prompt_too_large' };
+        return { kind: 'none', reason: 'prompt_too_large' };
     }
     const resolved = store ?? workbuddyP0KeywordStore();
     // Prefer precision to recall: reject quoted/embedded/reported phrases.
     if (!Object.keys(resolved.terms).some(term => text.trimStart().toLowerCase().startsWith(term.toLowerCase()))) {
-        return { matched: false, reason: 'not_a_signal' };
+        return { kind: 'none', reason: 'not_a_signal' };
     }
     const out = collectSync(text, sessionId, resolved, SYNC_DETECTION_CONFIG, new Date().toISOString());
-    const matched = out.isSignal && out.strength === 'STRONG' &&
+    const strong = out.isSignal && out.strength === 'STRONG' &&
         out.type === 'correction' && out.matchedPrecision === 'high';
-    return { matched, reason: matched ? 'matched' : 'not_a_signal' };
+    if (strong)
+        return { kind: 'strong', reason: 'matched' };
+    if (out.matchedPrecision === 'ambiguous' && out.matchedTerms.length > 0) {
+        return { kind: 'ambiguous', reason: 'matched' };
+    }
+    return { kind: 'none', reason: 'not_a_signal' };
+}
+/** Backward-compatible boolean view: only `strong` counts as matched. */
+export function assessWorkbuddyLiveKeyword(text, sessionId, store) {
+    const assessment = assessWorkbuddyCorrectionCandidate(text, sessionId, store);
+    return {
+        matched: assessment.kind === 'strong',
+        reason: assessment.kind === 'strong' ? 'matched' : assessment.reason,
+    };
 }
 /**
  * Narrow native event gateway: validate true current user origin and flags.
@@ -850,7 +1751,8 @@ export function admitTrustedWorkbuddyLiveCorrection(input) {
     // 词与 admitOne 的检测判定不会漂移。自动 Pain 仍只允许 high 精度 correction
     // 词（两道门各自强制），无 LLM、无 transcript 读取。
     const sharedStore = resolveSharedCorrectionKeywordStoreForDetection(input.workspaceDir);
-    if (!assessWorkbuddyLiveKeyword(prompt, sessionId, sharedStore).matched) {
+    const assessment = assessWorkbuddyCorrectionCandidate(prompt, sessionId, sharedStore);
+    if (assessment.kind === 'none') {
         return { ok: true, outcomes: [] };
     }
     const nativeIdentity = JSON.stringify(['workbuddy', sessionId, generationId]);
@@ -943,13 +1845,18 @@ export async function ensureGovernanceDiagnosticianTask(input) {
     try {
         const marker = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ? AND canonical_pain_id = ?').get(input.logicalObservationKey, input.canonicalPainId);
         const existingTaskId = rowField(marker, 'diagnostician_task_id');
-        if (isRecord(marker) && typeof existingTaskId === 'string' && existingTaskId.length > 0) {
-            return { ok: true, taskId: existingTaskId, created: false, duplicate: true, linkRepaired: false };
-        }
         if (!isRecord(marker)) {
             return { ok: false, reason: 'admission_marker_not_found', nextAction: 'admit the signal before ensuring its Diagnostician continuation' };
         }
         const payloadRaw = rowField(marker, 'task_payload_json');
+        // Legacy linked marker: an old admitted row may carry no payload at all.
+        // The task already exists, there is no ingress fact to rebuild, and
+        // demanding a payload here would starve reconciliation forever. A PRESENT
+        // but inconsistent payload still fails closed below.
+        if (typeof existingTaskId === 'string' && existingTaskId.length > 0
+            && (payloadRaw === null || payloadRaw === undefined)) {
+            return { ok: true, taskId: existingTaskId, created: false, duplicate: true, linkRepaired: false };
+        }
         let payloadParsed;
         try {
             payloadParsed = typeof payloadRaw === 'string' ? JSON.parse(payloadRaw) : null;
@@ -960,6 +1867,103 @@ export async function ensureGovernanceDiagnosticianTask(input) {
         if (!isGovernanceTaskPayload(payloadParsed)) {
             return { ok: false, reason: 'admission_task_payload_invalid', nextAction: 're-admit the signal or run reconciliation after repairing the workspace state' };
         }
+        // SPEC v0.3.1 §1.2: provenance is DERIVED from the marker's ingress facts,
+        // never hardcoded. The marker is host-context-bound by construction, and
+        // its payload carries the evidence entries that make this a `submit`.
+        const rolloutIdentity = rowField(marker, 'rollout_identity');
+        const markerKey = input.logicalObservationKey;
+        const hostTurnId = payloadParsed.hostKind === 'codex'
+            ? (markerKey.split('|')[2] ?? markerKey)
+            : (markerKey.lastIndexOf('|') > 0 ? markerKey.slice(0, markerKey.lastIndexOf('|')) : markerKey);
+        const markerHostKind = payloadParsed.hostKind;
+        // P1 review round 3: never trust the payload's evidence list — re-derive it
+        // from trajectory.db with the full lineage tuple. A marker that references a
+        // non-existent observation (or a WorkBuddy automatic correction) evaluates
+        // to observation_only and fails closed below.
+        // A tool_failure pain is its own persisted evidence (the pain row), not a
+        // correction claim about behavior — the correction re-derivation must not
+        // run for it. Only corrections are gated on a real observation.
+        const isCorrectionPayload = payloadParsed.painType !== 'tool_failure';
+        const ingressEvidence = isCorrectionPayload && (markerHostKind === 'codex' || markerHostKind === 'workbuddy')
+            ? correctionIngressEvidence({
+                db,
+                hostKind: markerHostKind,
+                logicalObservationKey: markerKey,
+                rolloutIdentity: typeof rolloutIdentity === 'string' ? rolloutIdentity : '',
+                rootSessionId: payloadParsed.sessionId,
+                hostTurnId,
+                text: payloadParsed.reason,
+                workspaceDir,
+            })
+            : payloadParsed.evidence.map((entry) => ({
+                kind: 'behavior_trace',
+                sourceRef: entry.sourceRef,
+                note: entry.note,
+            }));
+        let provenance;
+        let ingressWarning;
+        if (isCorrectionPayload && (markerHostKind === 'codex' || markerHostKind === 'workbuddy')) {
+            // SPEC v0.3 §5 / v0.3.1 §1.2: rebuild the report from the marker's REAL
+            // source. An explicit Owner statement is owner_manual (manual_pain_id,
+            // correctionEvidence channel); everything else is the automatic hook.
+            const ownerChannel = payloadParsed.correctionEvidence?.channel;
+            const ingressDecision = ownerChannel !== undefined
+                ? evaluatePainIngress(buildOwnerCorrectionIngressReport({
+                    hostKind: markerHostKind,
+                    channel: ownerChannel,
+                    logicalObservationKey: markerKey,
+                    rolloutIdentity: typeof rolloutIdentity === 'string' ? rolloutIdentity : '',
+                    rootSessionId: payloadParsed.sessionId,
+                    hostTurnId,
+                    painId: input.canonicalPainId,
+                    reason: payloadParsed.reason,
+                    // CR-02: never fabricate transcript evidence for an Owner statement;
+                    // an empty list is the honest basis and bound explicit reports
+                    // legitimately degrade.
+                    evidence: ingressEvidence,
+                }))
+                : evaluatePainIngress(buildCorrectionIngressReport({
+                    hostKind: markerHostKind,
+                    logicalObservationKey: markerKey,
+                    rolloutIdentity: typeof rolloutIdentity === 'string' ? rolloutIdentity : '',
+                    rootSessionId: payloadParsed.sessionId,
+                    hostTurnId,
+                    painId: input.canonicalPainId,
+                    reason: payloadParsed.reason,
+                    evidence: ingressEvidence,
+                }));
+            if (ingressDecision.action === 'refuse' || ingressDecision.action === 'observation_only') {
+                // Fail closed: an inconsistent/evidence-less admitted marker must not
+                // silently become a task (and must never be relabelled automatic_hook).
+                return {
+                    ok: false,
+                    reason: `pain_ingress_${ingressDecision.reasonCode}`,
+                    nextAction: ingressDecision.action === 'refuse' ? ingressDecision.nextAction : ingressDecision.note,
+                };
+            }
+            const { legacy: { provenance: decidedProvenance } } = ingressDecision;
+            provenance = decidedProvenance;
+            if (ingressDecision.action === 'degrade')
+                ingressWarning = ingressDecision.warning;
+        }
+        else {
+            // OpenClaw markers do not flow through this governance seam today; keep
+            // the historical provenance rather than inventing an ingress report.
+            provenance = 'host_context_bound';
+        }
+        // Recovery path: a task link already exists. The ingress decision above
+        // still ran, so an inconsistent admitted marker fails closed instead of
+        // being reported as a healthy duplicate.
+        if (typeof existingTaskId === 'string' && existingTaskId.length > 0) {
+            return {
+                ok: true,
+                taskId: existingTaskId,
+                created: false,
+                duplicate: true,
+                linkRepaired: false,
+                ...(ingressWarning !== undefined ? { ingressWarning } : {}),
+            };
+        }
         const taskId = createDiagnosticianTaskId(input.canonicalPainId);
         // Cross-store crash recovery (SPEC §13): a task may already exist from a
         // crashed prior attempt (crash-after-create, before the link write).
@@ -992,12 +1996,12 @@ export async function ensureGovernanceDiagnosticianTask(input) {
                     reason: payloadParsed.reason,
                     score: payloadParsed.score,
                     sessionId: payloadParsed.sessionId,
-                    provenance: 'host_context_bound',
+                    provenance,
                     // The admitting host comes from the marker's own payload — the ONE
                     // durable attribution fact (existing codex markers keep 'codex',
                     // workbuddy markers attribute 'workbuddy').
                     hostKind: payloadParsed.hostKind,
-                    evidence: [...payloadParsed.evidence],
+                    evidence: [...ingressEvidence],
                     // CR-02: replay the explicit Owner statement verbatim (classified,
                     // channel-disclosed) so re-created tasks keep the same input basis.
                     ...(payloadParsed.correctionEvidence !== undefined
@@ -1032,6 +2036,7 @@ export async function ensureGovernanceDiagnosticianTask(input) {
                 // The link was just written because the task already existed → a real
                 // Case B repair (not a no-op on an already-linked marker).
                 linkRepaired: existing !== null,
+                ...(ingressWarning !== undefined ? { ingressWarning } : {}),
             };
         }
         finally {
@@ -1379,7 +2384,7 @@ export function readGovernanceAdmissionCounts(args) {
         const admissions = db.prepare(`SELECT
         SUM(CASE WHEN decision = 'admitted' THEN 1 ELSE 0 END) AS admitted,
         SUM(CASE WHEN decision = 'admitted' AND diagnostician_task_id IS NULL THEN 1 ELSE 0 END) AS admitted_without_task,
-        MAX(created_at) AS last_admission
+        MAX(CASE WHEN decision = 'admitted' THEN created_at END) AS last_admission
       FROM governance_signal_admissions`).get();
         if (!isRecord(admissions)) {
             return { ok: false, reason: 'governance_admission_counts_unavailable', nextAction: 'Inspect the governance_signal_admissions table in the workspace trajectory.db.' };