fix(api+frontend): codex review 六件——死因空白strip/终态422防500/落盘回读断言/validator精确断言/promoted确认路径/文案不越权承诺 [vps]

sanguo_api/routes_pipeline.py

@@ -606,7 +606,7 @@ def factor_verdict(name: str, body: dict) -> dict:
     from sanguo_portfolio.strategy_registry import ensure_runtime_registry
     verdict = body.get("verdict")
     answers = body.get("answers") or []
-    note = body.get("note") or ""
+    note = str(body.get("note") or "").strip()   # codex review:纯空白死因不可过(必填语义)
     if verdict not in ("promote", "revise", "graveyard"):
         raise HTTPException(422, "verdict 须为 promote/revise/graveyard")
     reg_path = ensure_runtime_registry(
@@ -621,18 +621,22 @@ def factor_verdict(name: str, body: dict) -> dict:
     old = reg["factors"][name]["status"]
     extra: dict[str, Any] = {"answers": answers, "note": note,
                              "reviewed_via": "console"}
-    if verdict == "promote":
-        extra["promoted_at"] = date.today().isoformat()
-        entry = vr.transition(reg, name, "promoted", **extra)
-        action = "promoted"
-    elif verdict == "graveyard":
-        if not note:
-            raise HTTPException(422, "入墓园必须带 note(死因,可检索防重复造轮)")
-        entry = vr.transition(reg, name, "graveyard", cause=note, **extra)
-        action = "graveyard"
-    else:  # revise=留观:五问留痕,状态不动
-        entry = reg["factors"][name]
-        action = "revise(留观)"
+    try:
+        if verdict == "promote":
+            extra["promoted_at"] = date.today().isoformat()
+            entry = vr.transition(reg, name, "promoted", **extra)
+            action = "promoted"
+        elif verdict == "graveyard":
+            if not note:
+                raise HTTPException(422, "入墓园必须带 note(死因,可检索防重复造轮)")
+            entry = vr.transition(reg, name, "graveyard", cause=note, **extra)
+            action = "graveyard"
+        else:  # revise=留观:五问留痕,状态不动
+            entry = reg["factors"][name]
+            action = "revise(留观)"
+    except ValueError as exc:
+        # codex review:状态机拒绝(墓园终态重复判死/非法迁移)→422 中文原因,不再裸 500
+        raise HTTPException(422, str(exc)) from exc
     vr.save_registry(reg_path, reg)
     vr.append_event(events_path, entry, old, action, **extra)
     if verdict == "graveyard":