@pareto4/pp-core 1.11.1 → 1.12.1

package/pp-core/bin/lib/check-command-router.cjs

@@ -19,8 +19,8 @@ const { output, error, ERROR_REASON } = io;
 const planningWorkspaceMod = require("./planning-workspace.cjs");
 const { planningDir } = planningWorkspaceMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const phaseLocatorMod = require("./phase-locator.cjs");
-const { findPhaseInternal } = phaseLocatorMod;
+const phaseScopeMod = require("./phase-scope.cjs");
+const { resolvePhaseForRead } = phaseScopeMod;
 const decisions_cjs_1 = require("./decisions.cjs");
 const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
 const semver_compare_cjs_1 = require("./semver-compare.cjs");
@@ -39,7 +39,7 @@ const { runGapAnalysis } = gapCheckerModule;
 const prohibition_enforcement_cjs_1 = require("./prohibition-enforcement.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const vaultModule = require("./vault.cjs");
-const { vaultStatus, readManifest } = vaultModule;
+const { vaultStatus, readManifest, computeVaultVerdict, verdictFields, renderVaultCard, VAULT_GATE_POINTS } = vaultModule;
 const git_base_branch_cjs_1 = require("./git-base-branch.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -371,7 +371,7 @@ function cmdDecisionCoverageVerify(projectDir, args, raw) {
  * Invocable as: pp_run check ui-plan-gate <phase>
  *
  * Uses checkUiPresence from ui-safety-gate.cjs — does NOT reimplement frontend detection.
- * Uses getRoadmapPhaseWithFallback + findPhaseInternal from leaf modules for phase data.
+ * Uses getRoadmapPhaseWithFallback + the phase-scope owner's reader answer for phase data.
  */
 function findUiSpecInDir(phaseDir) {
     if (!phaseDir || !node_fs_1.default.existsSync(phaseDir))
@@ -398,7 +398,7 @@ function findUiSpecInDir(phaseDir) {
  *       surface the miss — we do NOT silently degrade to frontend:false if the roadmap
  *       exists but the phase header is absent.
  *   (b) Runs checkUiPresence (frontend detection) — no reimplementation.
- *   (c) Resolves the phase directory via findPhaseInternal (phase-locator.cjs); checks for *-UI-SPEC.md.
+ *   (c) Resolves the phase directory via resolvePhaseForRead (phase-scope.cjs); checks for *-UI-SPEC.md.
  *
  * Returns: { frontend, hasUiSpec, block, uiSpecPath, phaseLookupFailed }
  *   block = frontend && !hasUiSpec
@@ -432,12 +432,12 @@ function computeUiPlanGate(projectDir, phase) {
     // (b) Run checkUiPresence (frontend detection) — reuse existing helper; no reimplementation
     const presenceResult = (0, ui_safety_gate_cjs_1.checkUiPresence)(phaseSection);
     const frontend = presenceResult.hasUI;
-    // (c) Resolve phase directory via findPhaseInternal and check for *-UI-SPEC.md
+    // (c) Resolve phase directory via the phase-scope owner and check for *-UI-SPEC.md
     let phaseDir = '';
     try {
-        const result = findPhaseInternal(projectDir, phase);
+        const result = resolvePhaseForRead(projectDir, phase);
         if (result && typeof result === 'object') {
-            // findPhaseInternal returns { directory: '<relative-posix-path>', ... }
+            // the owner returns the raw locator's { directory: '<relative-posix-path>', ... }
             // directory is relative to cwd — resolve it to absolute.
             const relDir = typeof result['directory'] === 'string' ? result['directory'] : '';
             if (relDir) {
@@ -499,7 +499,7 @@ const UI_PATH_PATTERNS_RE = /\/(components|pages|views|screens|layouts|ui|fronte
  *       same lookup as computeUiPlanGate — to determine if this is a frontend phase.
  *   (b) Runs checkUiPresence (frontend detection) — no reimplementation.
  *   (c) Checks git diff HEAD~1..HEAD for UI file changes in the current worktree.
- *   (d) Resolves the phase directory via findPhaseInternal (phase-locator.cjs); checks for *-UI-SPEC.md.
+ *   (d) Resolves the phase directory via resolvePhaseForRead (phase-scope.cjs); checks for *-UI-SPEC.md.
  *
  * Returns: { frontend, hasUiFiles, hasUiSpec, block, message?, phaseLookupFailed? }
  *   block = frontend && hasUiFiles && !hasUiSpec
@@ -543,7 +543,7 @@ function computeUiSafetyGate(projectDir, phase) {
     // (d) Resolve phase directory and check for *-UI-SPEC.md (same as computeUiPlanGate)
     let phaseDir = '';
     try {
-        const result = findPhaseInternal(projectDir, phase);
+        const result = resolvePhaseForRead(projectDir, phase);
         if (result && typeof result === 'object') {
             const relDir = typeof result['directory'] === 'string' ? result['directory'] : '';
             if (relDir) {
@@ -587,7 +587,7 @@ function cmdTddReviewCheckpoint(projectDir, args, raw) {
     // Resolve phase directory
     let phaseDir = '';
     try {
-        const result = findPhaseInternal(projectDir, phase);
+        const result = resolvePhaseForRead(projectDir, phase);
         if (result && typeof result === 'object') {
             const relDir = typeof result['directory'] === 'string' ? result['directory'] : '';
             if (relDir)
@@ -921,23 +921,28 @@ function cmdShipPlatformDrift(cwd, args, raw) {
     output({ status, block: status === 'block', severity, pinned, latest, present: true }, raw, undefined);
 }
 /**
- * cmdVaultStatus — advisory gate-query handler for `check vault.status` / `check vault-status`.
+ * cmdVaultStatus — gate-query handler for `check vault.status` / `check vault-status`.
  *
- * Contract (D-01/D-02 from 13-CONTEXT.md):
- *   - PURE manifest read: never fetches, never spawns, never throws, always exits 0.
- *   - `block` is ALWAYS `false` (advisory only — never computes block:true).
- *   - Inert when `.platform-bindings.json` is absent (same boundary as cmdShipPlatformDrift).
- *   - Reuses `vaultStatus` + `readManifest` (no bespoke manifest parsing).
+ * Contract:
+ *   - PURE read: never fetches, never spawns, never throws, exits 0 on every
+ *     verdict (a usage error — an unknown `--point` — is the only non-zero exit).
+ *   - Pack 6 D-01: the verdict is decided by ONE owner, `computeVaultVerdict`
+ *     (src/vault.cts). This handler spreads the owner's `VAULT_VERDICT_FIELDS`
+ *     over the legacy envelope; it decides nothing itself.
+ *   - Legacy envelope (§8 of v1.7.0-DESIGN), kept key for key:
+ *       { status, block, present, tier, source, fallbackReason, repo, ref,
+ *         resolvedSha, fileCount, stale, fetchedAt }
+ *     `block` now comes from the owner: `enabled && required && verdict !==
+ *     'loaded'` (D-03) — false whenever `vault.required` is false, as before.
+ *     `repo` is display-safe (D-07).
+ *   - `--card --point plan|execute` (D-04) prints the human card the workflow
+ *     relays verbatim; it prints nothing when the vault is inert (D-06).
  *
- * Verdict envelope (§8 of v1.7.0-DESIGN):
- *   { status, block: false, present, tier, source, fallbackReason, repo, ref,
- *     resolvedSha, fileCount, stale }
- *
- * Invocable as: pp_run check vault.status [--raw]
+ * Invocable as: pp_run check vault.status [--raw] [--card --point plan|execute]
  * The dot→hyphen normalization in routeCheckCommand maps "vault.status" to
  * the "vault-status" branch.
  */
-function cmdVaultStatus(cwd, raw) {
+function cmdVaultStatus(cwd, args, raw) {
     // Step 1: Resolve project root (same approach as cmdShipPlatformDrift).
     let root;
     try {
@@ -946,31 +951,42 @@ function cmdVaultStatus(cwd, raw) {
     catch {
         root = cwd;
     }
-    // Step 2: Inert guard — absent .platform-bindings.json → inert (opt-in default).
-    // This mirrors the cmdShipPlatformDrift 939–943 inert path exactly.
+    const verdict = computeVaultVerdict(root);
+    if (args.includes('--card')) {
+        const pointIdx = args.indexOf('--point');
+        const point = pointIdx === -1 ? undefined : args[pointIdx + 1];
+        if (point === undefined || !VAULT_GATE_POINTS.includes(point)) {
+            error(`check vault.status --card needs --point ${VAULT_GATE_POINTS.join('|')} (got ${point === undefined ? 'none' : JSON.stringify(point)}).`, ERROR_REASON.SDK_MISSING_ARG);
+            return;
+        }
+        const card = renderVaultCard(verdict, point);
+        output({ ...verdictFields(verdict), card }, true, card);
+        return;
+    }
+    const fields = verdictFields(verdict);
+    // Step 2: Legacy inert envelope — absent .platform-bindings.json (unchanged keys and values).
     const bindingsPath = node_path_1.default.join(root, '.platform-bindings.json');
     if (!node_fs_1.default.existsSync(bindingsPath)) {
-        output({ status: 'inert', block: false, present: false }, raw, undefined);
+        output({ status: 'inert', block: verdict.block, present: false, ...fields }, raw, undefined);
         return;
     }
-    // Step 3: Call vaultStatus(cwd). present:false → miss, advisory, no error.
-    const vs = vaultStatus(cwd);
+    // Step 3: Call vaultStatus(root). present:false → miss.
+    const vs = vaultStatus(root);
     if (!vs.present) {
-        output({ status: 'miss', block: false, present: false }, raw, undefined);
+        output({ status: 'miss', block: verdict.block, present: false, ...fields }, raw, undefined);
         return;
     }
-    // Step 4: Resolve fallbackReason + repo via readManifest (fills the vaultStatus gap).
-    const vaultDirPath = node_path_1.default.join(cwd, '.planning', 'vault');
-    const manifest = readManifest(vaultDirPath);
+    // Step 4: fallbackReason + repo via readManifest (display-safe since Pack 6 D-07).
+    const manifest = readManifest(node_path_1.default.join(root, '.planning', 'vault'));
     const fallbackReason = manifest?.fallbackReason ?? null;
     const repo = manifest?.repo ?? null;
     // Step 5: Derive status from manifest source.
     const src = vs.source ?? 'miss';
     const status = (src === 'fetched' || src === 'cache' || src === 'miss') ? src : 'miss';
-    // Step 6: Emit uniform advisory verdict. block is ALWAYS false (advisory only, D-02).
+    // Step 6: Legacy envelope + the owner's verdict fields (block among them).
     output({
         status,
-        block: false,
+        block: verdict.block,
         present: true,
         tier: vs.tier ?? null,
         source: vs.source ?? null,
@@ -981,6 +997,7 @@ function cmdVaultStatus(cwd, raw) {
         fileCount: vs.fileCount ?? 0,
         stale: vs.stale ?? true,
         fetchedAt: vs.fetchedAt ?? null,
+        ...fields,
     }, raw, undefined);
 }
 // ─── ship.practices query handler (INJ-03, Phase 28) ──────────────────────────
@@ -1084,7 +1101,7 @@ function chooseShipReviewFile(dir) {
 /**
  * Build the trailing "what did the code review record" pointer line
  * (D-08/D-09). Reads `.planning/STATE.md`'s `current_phase`, resolves the
- * phase directory via `findPhaseInternal` (never a hand-built
+ * phase directory via `resolvePhaseForRead` (never a hand-built
  * `.planning/phases/` path, never a directory glob outside the chosen phase
  * directory), chooses the right REVIEW.md file via `chooseShipReviewFile`,
  * and reads its `practices.total` count. Every step degrades to the soft
@@ -1102,7 +1119,7 @@ function buildShipReviewPointerLine(root) {
         if (currentPhase === undefined || currentPhase === null || currentPhase === '') {
             return SHIP_REVIEW_SOFT_NOTE;
         }
-        const phaseResult = findPhaseInternal(root, currentPhase);
+        const phaseResult = resolvePhaseForRead(root, currentPhase);
         if (!phaseResult)
             return SHIP_REVIEW_SOFT_NOTE;
         const phaseDir = node_path_1.default.join(root, phaseResult.directory);
@@ -1415,6 +1432,29 @@ function cmdCheckPracticesReview({ args }, _check, _core) {
     const text = renderedLines.length > 0 ? renderedLines.join('\n') + '\n' : '';
     c.output(text, true, text);
 }
+/**
+ * Pack 6 D-01: the check router's subcommand table — every subcommand
+ * `routeCheckCommand` dispatches, in its hyphen form. `readsVerdict` marks the
+ * ones that report the vault load verdict; each must spread the owner's
+ * `VAULT_VERDICT_FIELDS` verbatim (tests/vault-status-check.test.cjs
+ * enumerates this table and compares every reader against the owner).
+ */
+const CHECK_SUBCOMMANDS = Object.freeze([
+    { name: 'auto-mode', readsVerdict: false },
+    { name: 'decision-coverage-plan', readsVerdict: false },
+    { name: 'decision-coverage-verify', readsVerdict: false },
+    { name: 'gap-analysis-plan-post', readsVerdict: false },
+    { name: 'practices-review', readsVerdict: false },
+    { name: 'prohibition-enforcement', readsVerdict: false },
+    { name: 'ship-platform-drift', readsVerdict: false },
+    { name: 'ship-practices', readsVerdict: false },
+    { name: 'tdd-review-checkpoint', readsVerdict: false },
+    { name: 'ui-plan-gate', readsVerdict: false },
+    { name: 'ui-safety-gate', readsVerdict: false },
+    { name: 'vault-status', readsVerdict: true },
+    { name: 'verify-schema-drift', readsVerdict: false },
+    { name: 'verify-codebase-drift', readsVerdict: false },
+]);
 function routeCheckCommand({ args, cwd, raw, _check, _core }) {
     // Normalize dots to hyphens in the subcommand so both forms are accepted.
     // This makes `check.query = "ui.plan-gate"` (dotted form in capability.json gates)
@@ -1469,7 +1509,7 @@ function routeCheckCommand({ args, cwd, raw, _check, _core }) {
         // vault.status — advisory vault cache state query (Phase 13, D-01/D-02).
         // Dot-to-hyphen normalization means query "vault.status" routes here.
         // Pure manifest read; block is ALWAYS false; inert when bindings absent.
-        cmdVaultStatus(cwd, raw);
+        cmdVaultStatus(cwd, args, raw);
         return;
     }
     if (subcommand === 'verify-schema-drift') {
@@ -1509,7 +1549,7 @@ function routeCheckCommand({ args, cwd, raw, _check, _core }) {
         (0, prohibition_enforcement_cjs_1.routeProhibitionEnforcement)(args, raw);
         return;
     }
-    error('Unknown check subcommand. Available: auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, practices-review, prohibition-enforcement, ship-platform-drift, ship-practices, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, vault-status, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    error(`Unknown check subcommand. Available: ${CHECK_SUBCOMMANDS.map((c) => c.name).join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
 }
 module.exports = {
     routeCheckCommand,
@@ -1523,4 +1563,5 @@ module.exports = {
     cmdShipPractices,
     cmdVaultStatus,
     cmdCheckPracticesReview,
+    CHECK_SUBCOMMANDS,
 };

package/pp-core/bin/lib/clusters.cjs

@@ -23,10 +23,9 @@ exports.CLUSTERS = Object.freeze({
         'init',
         'new-project',
         'discovery',
-        // Discovery→build handoff: canonical + retained alias, grouped with the
-        // other project-lifecycle entrypoints (routed via pp-ns-project).
+        // Discovery→build handoff, grouped with the other project-lifecycle
+        // entrypoints (routed via pp-ns-project).
         'discovery-to-build',
-        'build-handoff',
         'discuss-phase',
         'plan-phase',
         'execute-phase',

package/pp-core/bin/lib/command-aliases.cjs

@@ -470,6 +470,14 @@ exports.PHASES_COMMAND_ALIASES = [
         ],
         "subcommand": "archive",
         "mutation": true
+    },
+    {
+        "canonical": "phases.archive-closed",
+        "aliases": [
+            "phases archive-closed"
+        ],
+        "subcommand": "archive-closed",
+        "mutation": true
     }
 ];
 exports.VALIDATE_COMMAND_ALIASES = [
@@ -690,6 +698,20 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": true
     },
+    {
+        "canonical": "phase.dispatch-plan",
+        "aliases": [
+            "phase dispatch-plan"
+        ],
+        "mutation": false
+    },
+    {
+        "canonical": "phase.install-run",
+        "aliases": [
+            "phase install-run"
+        ],
+        "mutation": true
+    },
     {
         "canonical": "phase.mvp-mode",
         "aliases": [
@@ -697,6 +719,20 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": false
     },
+    {
+        "canonical": "phase.tier",
+        "aliases": [
+            "phase tier"
+        ],
+        "mutation": false
+    },
+    {
+        "canonical": "phase.tier-propose",
+        "aliases": [
+            "phase tier-propose"
+        ],
+        "mutation": true
+    },
     {
         "canonical": "progress.bar",
         "aliases": [

package/pp-core/bin/lib/command-arg-projection.cjs

@@ -6,11 +6,13 @@
  * hand-written .cjs; only types are added.
  *
  * Shared helpers for command-family adapters to project argv tokens into
- * typed named values and multi-word segments.
+ * typed named values and multi-word segments, and (261008-mwk) to refuse the
+ * tokens a verb would not read — `validateVerbArgs`, the one owner of that rule.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseNamedArgs = parseNamedArgs;
 exports.parseMultiwordArg = parseMultiwordArg;
+exports.validateVerbArgs = validateVerbArgs;
 /**
  * Extract named --flag <value> pairs from an args array.
  * Returns an object mapping flag names to their values (null if absent).
@@ -53,3 +55,99 @@ function parseMultiwordArg(args, flag) {
     }
     return tokens.length > 0 ? tokens.join(' ') : null;
 }
+// T-mwk-02: refused tokens are echoed to stderr; cap each one.
+const ECHO_LIMIT = 80;
+function echoToken(token) {
+    const cut = token.length > ECHO_LIMIT ? token.slice(0, ECHO_LIMIT) : token;
+    return cut === '' || /\s/.test(cut) ? JSON.stringify(cut) : cut;
+}
+/**
+ * Refuse every argument a verb would not read (261008-mwk D-1, D-5, D-7).
+ *
+ * `parseNamedArgs` indexes argv for whole `--flag` tokens and looks at nothing
+ * else, so before this owner existed a stray positional, an unknown flag, a
+ * `--flag=value` token, a value flag with no value after it, and the second of
+ * a repeated flag were all dropped while the verb reported success. This walk
+ * reads the tokens exactly as the parser does and names each one it would drop:
+ *
+ * - `positional` — a non-flag token beyond the verb's positional allowance;
+ * - `unknown flag` — a `--name` the spec does not declare;
+ * - `use --name <value>` (or `use --name`) — a `--name=value` token;
+ * - `no value follows` — a value flag that is last or followed by a `--` token;
+ * - `given twice; only the first is read` — a repeated declared flag.
+ *
+ * Pure: no I/O, no environment. The caller turns a refusal into its own error
+ * (the state router uses `ERROR_REASON.USAGE`).
+ *
+ * @param tokens argv after the verb (global flags already stripped by pp-tools main()).
+ * @param spec the verb's declared shape.
+ * @param verb optional label for the message, e.g. `state record-session`.
+ * @returns `{ ok: true }`, or the refused tokens with kinds and a D-7 message.
+ */
+function validateVerbArgs(tokens, spec, verb) {
+    if (spec.free)
+        return { ok: true };
+    const valueFlags = spec.valueFlags ?? [];
+    const booleanFlags = spec.booleanFlags ?? [];
+    const refused = [];
+    const positionals = [];
+    const seen = new Set();
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (spec.verbatimPositionals || !token.startsWith('--')) {
+            positionals.push(token);
+            continue;
+        }
+        const name = token.slice(2);
+        const eq = name.indexOf('=');
+        if (eq !== -1) {
+            const bare = name.slice(0, eq);
+            if (valueFlags.includes(bare))
+                refused.push({ token, kind: `use --${bare} <value>` });
+            else if (booleanFlags.includes(bare))
+                refused.push({ token, kind: `use --${bare}` });
+            else
+                refused.push({ token, kind: 'unknown flag' });
+            continue;
+        }
+        const isValue = valueFlags.includes(name);
+        if (!isValue && !booleanFlags.includes(name)) {
+            refused.push({ token, kind: 'unknown flag' });
+            continue;
+        }
+        const hasValue = isValue && i + 1 < tokens.length && !tokens[i + 1].startsWith('--');
+        if (seen.has(name)) {
+            refused.push({ token, kind: 'given twice; only the first is read' });
+        }
+        else {
+            seen.add(name);
+            if (isValue && !hasValue)
+                refused.push({ token, kind: 'no value follows' });
+        }
+        if (hasValue)
+            i++;
+    }
+    const allowance = spec.positionalExcludedBy && seen.has(spec.positionalExcludedBy)
+        ? 0
+        : (spec.maxPositionals ?? 0);
+    for (const token of positionals.slice(allowance))
+        refused.push({ token, kind: 'positional' });
+    if (refused.length === 0)
+        return { ok: true };
+    return { ok: false, refused, reason: refusalReason(refused, spec, verb) };
+}
+function refusalReason(refused, spec, verb) {
+    const prefix = verb ? `${verb} does not read:` : 'does not read:';
+    const list = refused.map((r) => `${echoToken(r.token)} (${r.kind})`).join(', ');
+    const accepts = spec.positionalLabel ?? acceptedShape(spec);
+    return `${prefix} ${list}. It accepts: ${accepts}. Nothing was written.`;
+}
+function acceptedShape(spec) {
+    const max = spec.maxPositionals ?? 0;
+    const parts = [
+        ...(spec.valueFlags ?? []).map((f) => `--${f} <value>`),
+        ...(spec.booleanFlags ?? []).map((f) => `--${f}`),
+        ...(max > 0 ? [`at most ${max} positional${max === 1 ? '' : 's'}`] : []),
+    ];
+    return parts.length ? parts.join(', ') : 'no arguments';
+}

package/pp-core/bin/lib/commands.cjs

@@ -26,7 +26,10 @@ const phaseIdMod = require("./phase-id.cjs");
 const { normalizePhaseName, comparePhaseNum, extractPhaseToken } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseLocatorMod = require("./phase-locator.cjs");
-const { getArchivedPhaseDirs, findPhaseInternal } = phaseLocatorMod;
+const { getArchivedPhaseDirs } = phaseLocatorMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const phaseScopeMod = require("./phase-scope.cjs");
+const { resolvePhaseForRead, resolvePhaseForWrite } = phaseScopeMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParserMod = require("./roadmap-parser.cjs");
 const { extractCurrentMilestone, stripShippedMilestones: _stripShippedMilestones, getMilestoneInfo, getMilestonePhaseFilter, getRoadmapPhaseInternal } = roadmapParserMod;
@@ -455,7 +458,9 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
             const phaseMatch = (files || []).join(' ').match(/(\d+(?:\.\d+)*)-/);
             if (phaseMatch) {
                 const phaseNum = phaseMatch[1];
-                const phaseInfo = findPhaseInternal(cwd, phaseNum);
+                // D-03: a prior milestone's archived phase whose number the current
+                // ROADMAP reuses names no branch (the phase-scope owner drops it).
+                const phaseInfo = resolvePhaseForRead(cwd, phaseNum);
                 if (phaseInfo) {
                     branchName = config['phase_branch_template']
                         .replace('{phase}', normalizePhaseName(phaseInfo['phase_number']))
@@ -902,8 +907,9 @@ function cmdTodoMatchPhase(cwd, phase, raw) {
     const phaseKeywords = new Set(phaseText.split(/[\s\-_/.,;:()\[\]{}|]+/)
         .map(w => w.replace(/[^a-z0-9]/g, ''))
         .filter(w => w.length > 2 && !stopWords.has(w)));
-    // Find phase directory to get expected file paths
-    const phaseInfoDisk = findPhaseInternal(cwd, phase);
+    // Find phase directory to get expected file paths (D-03: through the
+    // phase-scope owner, so a prior milestone's archive never lends this phase its plans)
+    const phaseInfoDisk = resolvePhaseForRead(cwd, phase);
     const phasePlans = [];
     if (phaseInfoDisk && phaseInfoDisk['found']) {
         try {
@@ -987,10 +993,19 @@ function cmdScaffold(cwd, type, options, raw) {
     const { phase, name } = options;
     const padded = phase ? normalizePhaseName(phase) : '00';
     const today = new Date().toISOString().split('T')[0];
-    // Find phase directory
-    const phaseInfo = phase ? findPhaseInternal(cwd, phase) : null;
+    // Find phase directory. D-02 (todo "template-fill-writes-
+    // into-an-archived-phase-directory"): context / uat / verification never write into a
+    // closed milestone's archive. The phase-scope owner hands back a live match only; an
+    // archive this phase still names is refused naming it, and a prior milestone's archive
+    // whose number the current ROADMAP reuses takes the not-found line. phase-dir never reads
+    // the match (it always creates phases/<padded>-<slug of --name>), so it is unchanged.
+    const writeVerdict = phase ? resolvePhaseForWrite(cwd, phase) : null;
+    const phaseInfo = writeVerdict && writeVerdict.ok ? writeVerdict.match : null;
     const phaseDir = phaseInfo ? node_path_1.default.join(cwd, phaseInfo['directory']) : null;
     if (phase && !phaseDir && type !== 'phase-dir') {
+        if (writeVerdict && !writeVerdict.ok && writeVerdict.reason === 'archived') {
+            error(`Phase ${phase} is archived in ${writeVerdict.directory} (milestone ${writeVerdict.version}): refusing to write into a closed milestone's record`);
+        }
         error(`Phase ${phase} directory not found`);
     }
     let filePath, content;

package/pp-core/bin/lib/compose-bindings.cjs

@@ -47,7 +47,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMPOSE_BINDINGS_FLAGS = exports.SEED_VALUE_MAX_LENGTH = void 0;
 exports._resetPlatformTagMemoForTests = _resetPlatformTagMemoForTests;
+exports.resolveCreatedWithFrom = resolveCreatedWithFrom;
 exports.composeBindings = composeBindings;
+exports.redactComposeResultForEmission = redactComposeResultForEmission;
 exports.cmdComposeBindings = cmdComposeBindings;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -436,12 +438,34 @@ function resolveLatestPlatformTag(cwd, repo, provider, opts) {
     return result;
 }
 /**
- * Read the first readable, semver-shaped `VERSION` file among the installed
- * `pp-core/VERSION` location and this repo's own root `VERSION`, returning
- * `<binName>@<version>`; when neither is readable, `binName` alone.
+ * Read the first readable, semver-shaped `VERSION` file among the candidate
+ * locations resolved against `baseDir`, returning `<binName>@<version>`.
+ *
+ * The candidate list is `baseDir`-relative rather than `__dirname`-relative so
+ * the layout under test is CHOSEN by the caller instead of inherited from
+ * wherever the compiled module happens to sit — an installed tree and this
+ * repo's own tree put `VERSION` in different places, and a test that cannot
+ * pick a layout cannot tell those two cases apart.
+ *
+ * Three locations are probed, in order: the `VERSION` sitting beside the bin
+ * directory; then the installed `pp-core/VERSION` that the installer writes
+ * into a project's runtime home; then this repo's own root `VERSION`. The
+ * installed location is consulted BEFORE the repo root so an installed tree
+ * reports the version it was actually installed from. In this repo that middle
+ * candidate is absent, so resolution falls through to the root file.
+ *
+ * @param baseDir - directory the candidates are resolved against. Production
+ *   passes this module's own `__dirname`; a test passes a fixture directory
+ *   shaped like `pp-core/bin/lib`.
+ * @returns `<binName>@<version>` for the first readable, semver-shaped
+ *   candidate; when no candidate is readable, `binName` alone.
  */
-function resolveCreatedWith() {
-    const candidates = [node_path_1.default.join(__dirname, '..', 'VERSION'), node_path_1.default.join(__dirname, '..', '..', '..', 'VERSION')];
+function resolveCreatedWithFrom(baseDir) {
+    const candidates = [
+        node_path_1.default.join(baseDir, '..', 'VERSION'),
+        node_path_1.default.join(baseDir, '..', '..', 'VERSION'),
+        node_path_1.default.join(baseDir, '..', '..', '..', 'VERSION'),
+    ];
     for (const candidate of candidates) {
         try {
             const raw = node_fs_1.default.readFileSync(candidate, 'utf-8').trim();
@@ -455,6 +479,13 @@ function resolveCreatedWith() {
     }
     return package_identity_cjs_1.binName;
 }
+/**
+ * Resolve `project.createdWith` for the running installation by probing the
+ * candidate layout against this module's own directory.
+ */
+function resolveCreatedWith() {
+    return resolveCreatedWithFrom(__dirname);
+}
 /**
  * Build the composed candidate object from the seed, the project answers
  * `/pp-init` already captured, the resolved platform host, the D-04 tag pin,
@@ -772,6 +803,39 @@ function composeBindings(cwd, opts = {}) {
  * does, then calls `composeBindings` and emits the result as data — a
  * verdict is never a process error.
  */
+/**
+ * Pack 6 D-07: the display-safe copy of a compose result, for EMISSION only.
+ * Every remote coordinate field (`platform.repo`, `client.vaultRepo`) in
+ * `composed`, `seed`, `provenance` and `drift` goes through the one owner
+ * (`redactCloneTarget`, src/vault.cts); warnings go through the prose
+ * redactor. `composeBindings` itself, its drift/action comparison and every
+ * write keep the RAW values — never write or compare the result of this.
+ */
+function redactComposeResultForEmission(result) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const v = require('./vault.cjs');
+    const COORD = new Set(['platform.repo', 'client.vaultRepo']);
+    const safe = (x) => (typeof x === 'string' ? v.redactCloneTarget(x) : x);
+    const out = JSON.parse(JSON.stringify(result));
+    if (out.composed && typeof out.composed === 'object') {
+        for (const field of COORD) {
+            const [ns, key] = field.split('.');
+            const parent = out.composed[ns];
+            if (parent && typeof parent === 'object' && typeof parent[key] === 'string')
+                parent[key] = safe(parent[key]);
+        }
+    }
+    if (out.seed) {
+        if (typeof out.seed.platformRepo === 'string')
+            out.seed.platformRepo = safe(out.seed.platformRepo);
+        if (typeof out.seed.clientVaultRepo === 'string')
+            out.seed.clientVaultRepo = safe(out.seed.clientVaultRepo);
+    }
+    out.provenance = (out.provenance ?? []).map((p) => (COORD.has(p.field) ? { ...p, value: safe(p.value) } : p));
+    out.drift = (out.drift ?? []).map((d) => COORD.has(d.key) ? { ...d, profileValue: safe(d.profileValue), effectiveValue: safe(d.effectiveValue) } : d);
+    out.warnings = (out.warnings ?? []).map((w) => (typeof w === 'string' ? v.redactRemoteText(w) : w));
+    return out;
+}
 function cmdComposeBindings(cwd, options, raw) {
     let root;
     try {
@@ -781,5 +845,5 @@ function cmdComposeBindings(cwd, options, raw) {
         root = cwd;
     }
     const result = composeBindings(root, { write: options.write === true, offline: options.offline === true });
-    output(result, raw);
+    output(redactComposeResultForEmission(result), raw);
 }