@pareto4/pp-core 1.12.0 → 1.13.0

package/pp-core/bin/lib/vault-practices.cjs

@@ -9,18 +9,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *
  * Responsibility (Phase 24-01 — parse + discover half of the module):
  *   `parsePracticeFile(filePath, raw)` validates a single practice `.md` file's
- *   frontmatter (id/scope/severity/applies-to/schemaVersion) against the D-03/
- *   D-06/D-08/D-14 rules from 24-CONTEXT.md, returning skip-with-warning
- *   results — it NEVER throws. `discoverPracticeFiles(cwd)` lists `.md` files
+ *   frontmatter (id/scope/severity/applies-to/schemaVersion/check) against the
+ *   D-03/D-06/D-08/D-14 rules from 24-CONTEXT.md, returning parsed,
+ *   DEGRADED-with-warnings, or skip-with-warning results (CHECK-02, 05-01) —
+ *   it NEVER throws. `discoverPracticeFiles(cwd)` lists `.md` files
  *   under the cached vault tier's `practices/` directory, excludes secret-named
  *   files, and parses each survivor, degrading to an empty/benign result when
  *   no vault cache is present.
  *
  * Responsibility (Phase 24-02 — matcher + global-bucket + formatter half):
- *   `globMatch`/`fallbackGlobToRegex` provide deterministic glob matching,
- *   feature-detecting `path.posix.matchesGlob` (Node >=22.5.0) with a hand-
- *   rolled, linear-time regex fallback for the 22.0–22.4 gap (engines floor
- *   is >=22.0.0). `matchPractices` partitions discovered practices into a
+ *   `globMatch`/`fallbackGlobToRegex` provide deterministic glob matching
+ *   through ONE hand-rolled, polynomial-time matcher on every runtime (the
+ *   native `path.posix.matchesGlob` backtracks on many-star segments and is
+ *   used only as the tests' oracle). `matchPractices` partitions discovered practices into a
  *   glob-matched `matched` bucket and an always-surfaced `global` bucket (a
  *   bounded, fenced excerpt per global practice — the matcher itself makes
  *   ZERO calls to any hosted model or scoring service; relevance of globals
@@ -34,8 +35,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *   - `./vault.cjs` (`usableFiles`, `isSecretFile`, `readManifest`,
  *     `readHeadBounded`) — the existing vault-tier discovery/secret/manifest/
  *     bounded-read helpers.
- *   - `node:path`'s `path.posix.matchesGlob` (feature-detected) — no
- *     `minimatch`/`picomatch` dependency (RESEARCH STACK.md).
+ *   - no `minimatch`/`picomatch` dependency (RESEARCH STACK.md), and no
+ *     native `path.posix.matchesGlob` on the matching path (see `globMatch`).
  *
  * Out of scope here (later plans): the CLI `practices match` router wiring
  * and cross-tier client-beats-shared id dedup (explicitly DEFERRED to
@@ -58,6 +59,14 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const fmMod = require("./frontmatter.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const vaultMod = require("./vault.cjs");
+// FIX-3: the ONE version resolver — the same function and
+// candidate ladder `project.createdWith` is written from — so the block's
+// status stamp and the bindings can never name different engine versions.
+// compose-bindings imports nothing from vault-practices, so no cycle.
+const compose_bindings_cjs_1 = require("./compose-bindings.cjs");
+// The one source/non-source predicate (plan graph). A leaf with no imports of
+// its own, so no cycle.
+const plan_graph_cjs_1 = require("./plan-graph.cjs");
 const { extractFrontmatter } = fmMod;
 // ─── Constants ─────────────────────────────────────────────────────────────────
 // DoS-guard cap (T-24-04) mirroring vault.cts's SUMMARY_FILE_CAP discipline —
@@ -68,9 +77,36 @@ const VALID_SEVERITIES = ['critical', 'warning', 'info'];
 const VALID_SCOPES = ['scoped', 'global'];
 const PRACTICE_SCHEMA_VERSION = 1;
 const PRACTICES_SUBDIR = 'practices/';
-// The exactly-five documented frontmatter keys (README "five frontmatter
-// keys" table) — any other key present is rejected at parse time (IN-05).
-const DOCUMENTED_FRONTMATTER_KEYS = new Set(['id', 'scope', 'severity', 'applies-to', 'schemaVersion']);
+// The exactly-seven documented frontmatter keys — any other key present
+// DEGRADES the practice at parse time (IN-05 as inverted by CHECK-02, 05-01:
+// retained + warned, never dropped).
+//
+// `check` joined the set in 05-01 and `enforced-by` in 10-03 (MECH-03,
+// D-10-04). Both are step 1 of the degrade-loudly rule's fixed rollout order (engine
+// release → verified rollout → vault-repo merge): the engine admits the key
+// first, the rollout is verified, and only then does the vault repo merge
+// practices that use it. Neither addition bumped PRACTICE_SCHEMA_VERSION
+// (D-10-17) — an optional key an older engine still retains-and-warns on is
+// not a breaking schema change, and bumping would make every older engine
+// shout about a practice it can read correctly.
+//
+// EXPORTED deliberately: this set has two consumers (`parsePracticeFile` and
+// the promote preflight in src/vault-write-back.cts) and a conformance test
+// that must DERIVE its iteration set from the shipped constant rather than
+// hand-list it (T-4-42 — a hand-listed guard cannot notice the set changing
+// underneath it). BOTH CONSUMERS MOVE IN THE ONE CHANGE THAT WIDENS THIS SET
+// (T-4-49, restated by D-10-14): the promote preflight refuses on any non-empty
+// `degradedWarnings`, so widening the reader alone would quietly make a
+// previously-refused key promotable into the fleet-wide vault.
+const DOCUMENTED_FRONTMATTER_KEYS = new Set([
+    'id',
+    'scope',
+    'severity',
+    'applies-to',
+    'schemaVersion',
+    'check',
+    'enforced-by',
+]);
 // Glob-pattern length guard (T-24-04 DoS mitigation) — a client-authored
 // applies-to glob longer than this is rejected by fallbackGlobToRegex (never
 // matches) rather than compiled, bounding worst-case compile+match cost.
@@ -78,9 +114,22 @@ const GLOB_PATTERN_MAX = 200;
 // Bounded markdown-body excerpt size for scope:global practices (D-15) —
 // mirrors vault.cts's SUMMARY_READ_BYTES bounded-read discipline.
 const PRACTICE_EXCERPT_BYTES = 1024;
+// Over-read factor for the excerpt's bounded read (FIX-1).
+// The excerpt is normalised to LF before it is capped, and every carriage
+// return that normalisation removes consumed a raw byte as half of a CRLF pair.
+// Reading `PRACTICE_EXCERPT_BYTES * 2` body bytes therefore guarantees the cap
+// can be filled from normalised text even when every line is CRLF-terminated.
+// The read stays bounded — the whole file is still never read.
+const EXCERPT_CRLF_OVERREAD_FACTOR = 2;
 // Matched-file list cap per practice (T-24-04) — matchedCount still carries
 // the true total so callers know the cap was hit.
 const MATCHED_FILES_CAP = 20;
+// The unmatched-source-file note's candidate set (FIX-2, QD-2) is the plan
+// graph's own source predicate (`isSourceFile`, src/plan-graph.cts) — the one
+// owner of "is this a source file" — not a second list of extensions. When a
+// source file matched no scoped practice the block says so in one plain line,
+// because a vault laid out for a different folder structure otherwise drops its
+// scoped practices with no word at all.
 // Bounded prefix read for practice files during DISCOVERY (CR-03) — frontmatter
 // + bodyOffset comfortably fit well inside this; the whole file is NEVER read.
 // Mirrors vault.cts's SUMMARY_READ_BYTES bounded-read discipline.
@@ -90,6 +139,188 @@ const PRACTICE_FILE_READ_BYTES = 8192;
 // bounds worst-case warning size and prevents multi-line injection into a
 // human/agent-visible report.
 const WARNING_TOKEN_MAX = 80;
+// ─── Matching cost bound (CHECK-04 / T-5-10, T-5-11, 05-04) ──────────────────
+//
+// `matchPractices` walks (scoped practices × their globs × candidate files).
+// The complexity class is polynomial and the pattern language compiles no
+// `RegExp` — both true, and both irrelevant to wall clock.
+//
+// MEASURED, and REPRODUCIBLE by running tests/vault-practices.slow.test.cjs,
+// on the six-axis worst-case corpus at the shipped caps (100 practices × 39
+// globs derived from PRACTICE_FILE_READ_BYTES × a POSIX-maximal subject path
+// = 3,900 pairs) — Apple M5 Pro, macOS 26.5.2, **Node v25.9.0**, 2026-09-01:
+//
+//   native `path.posix.matchesGlob`  1.76 ms / (glob, file) pair
+//   pre-22.5 fallback matcher       0.098 ms / pair  (same corpus, feature
+//                                   detect deleted before require)
+//
+// (The fallback matcher is now the only shipped engine — see `globMatch`.
+// The native figure is kept as the measurement the caps below were sized on.)
+//
+// 05-RESEARCH § OQ1 measured 1.47 ms/pair native over three points that were
+// linear in pair count, so `cost ≈ pairs × rate` is a measured model rather
+// than a hoped-for one. Its 5.0 ms/pair fallback figure did NOT reproduce on
+// this corpus; nothing here is derived from it (the slow suite records the
+// discrepancy rather than dropping it).
+//
+// That makes the SHIPPED bound a multi-hour hang: 100 practices ×
+// 39 globs × `SHIP_DIFF_FILE_CAP` (2000) = 7,800,000 pairs ⇒ ≈3.8 h at the
+// native rate above (a projection from a measured rate, labelled as such).
+// Both already-shipped call sites — `vault practices match` at plan:pre and
+// `check ship.practices` at ship:pre — reach this function with no budget of
+// any kind, which is why the bound lives HERE and not only in a later
+// evaluator: a bound placed downstream would ship the gate and leave the hole.
+//
+// A number recorded without the machine it was measured on is the warning
+// sign this project has learned to distrust, so every figure above names its
+// runtime. Node-25 numbers are never recorded as Node-22 numbers; the Node-22
+// confirmation is carried separately (05-09) and appends its own numbers to
+// the slow suite's record.
+// PRIMARY, DETERMINISTIC guard. Evaluated BEFORE the loop, so exhaustion is
+// the same verdict on a laptop and on a CI runner (T-5-11 — a time-only budget
+// makes the verdict machine-dependent, which is exactly the non-determinism
+// VERIFY-03 bars from a deterministic gate).
+//
+// Sized above the legitimate ceiling and well below the hostile one: a
+// measured production vault's 92 globs against the 2000-file ship diff cap is 184,000
+// pairs, so this leaves ~5× headroom over any honest corpus while sitting
+// ~7.8× below the 7,800,000-pair hostile saturation bound.
+//
+// BE CLEAR ABOUT WHAT THIS DOES AND DOES NOT BOUND. At the worst-case rate
+// above, 1,000,000 pairs still extrapolates to ~1,760 s. This cap is NOT a
+// wall-clock bound; it is the deterministic, machine-independent refusal of
+// the pathological fan-out, and it is the arm a reproducible gate can rest on.
+// Wall clock is bounded by MATCH_BUDGET_MS below.
+const MATCH_PAIR_CAP = 1000000;
+// SECONDARY guard, and the one that actually bounds wall clock. Machine-
+// dependent by nature, which is precisely why the pair cap is primary and this
+// one can only ever NARROW what the pair cap already permitted.
+//
+// Derivation: the real client vault's plain `**/…` globs cost microseconds per
+// pair (05-RESEARCH § OQ2), so its 184,000-pair worst case runs in well under
+// a second — this sits more than an order of magnitude above that legitimate
+// ceiling, while turning the pathological corpus from hours into ten seconds.
+const MATCH_BUDGET_MS = 10000;
+// Every note this bound emits carries this marker, so a consumer channel can
+// forward exactly those notes without re-composing the wording and without
+// matching on prose (one emission, N channels — T-4-49).
+const MATCH_BUDGET_NOTE_PREFIX = 'practice matching bounded: ';
+/**
+ * The single sentence every executor-facing channel states when the client
+ * vault itself could not be READ (05-13, G-4).
+ *
+ * ONE constant, two channels, EXPORTED so their pins harvest it rather than
+ * copy it — the same discipline `AUDIT_VAULT_REPAIR_SENTENCE` follows in
+ * src/vault-audit.cts. A refusal whose wording drifts between the block a
+ * code-writing agent reads and the message an operator reads is how one fact
+ * ends up meaning two things (T-4-49), and this pair of channels is exactly
+ * where that already happened once.
+ *
+ * It names no path and no errno: the counted note beside it carries the
+ * diagnostic, already bounded to an errno code by discovery (T-5-36).
+ */
+const PRACTICES_VAULT_UNREADABLE_SENTENCE = 'Practices were NOT checked — the client vault could not be read.';
+/**
+ * The THIRD member of the family (CR-01), and the one a fresh checkout hits.
+ *
+ * `vaultPresent: false` and `readFailed: true` are different facts and have been
+ * since 05-10, but only `readFailed` was carried past the matcher. An absent
+ * vault therefore fell through to `practicesProcessed === 0` and was answered
+ * with "none found in the vault" — a statement about a vault that WAS read,
+ * made about one that was never fetched.
+ *
+ * `.planning/` is gitignored on this fork, so "never fetched" is the ordinary
+ * state of a fresh clone rather than an exotic one. Told the client documented
+ * no standards, a planner writes a plan governed by nothing, and `check
+ * vault.audit` then halts the build for the vault that was never there.
+ *
+ * Names the remedy, because unlike an unreadable vault this one has a single
+ * obvious repair. Names no path: the same T-5-36 discipline as its sibling.
+ */
+const PRACTICES_VAULT_ABSENT_SENTENCE = 'Practices were NOT checked — no client vault has been fetched. Run the vault fetch first.';
+/**
+ * The FOURTH member of the family (FIX-4, QD-5).
+ *
+ * A fetch that failed every tier with no prior copy leaves a manifest recording
+ * a miss: no tier, no sha, no files. The vault directory is present, nothing
+ * failed to READ, and discovery yields zero practices — so the ladder fell
+ * through to "none found in the vault", telling a code-writing agent its client
+ * documented no standards about a fetch that reached nothing.
+ *
+ * The documented "could not be checked: <reason>." form, with the reason
+ * phrase copied from the practice trace's own miss reason (`resolvePin` in
+ * src/vault-trace.cts) so the two surfaces say the same thing.
+ */
+const PRACTICES_VAULT_MISS_SENTENCE = 'Practices could not be checked: the vault manifest records a miss — no vault content was reached.';
+/**
+ * The status stamp's fixed opening (FIX-3, QD-4).
+ *
+ * Every rendered `<vault_practices>` block carries ONE HTML comment as its
+ * first inner line, written by this module, naming the vault ref, short sha,
+ * either the number of fenced practice entries or a degraded-state token, and
+ * the engine version. A distinct prefix — not `vault:external-content` — so no
+ * fence parser can mistake it for a marker, and it never begins with `id:`.
+ */
+const PRACTICES_STAMP_PREFIX = '<!-- vault-practices-stamp:';
+/**
+ * The stamp's degraded-state vocabulary: exactly one token per sentence the
+ * block can state instead of rendering entries (FIX-3). A new rung cannot ship
+ * without a token — the stamp test harvests this map and pins its size.
+ */
+const PRACTICES_STAMP_STATES = Object.freeze({
+    COULD_NOT_BE_CHECKED: 'could-not-be-checked',
+    NOT_CHECKED_PAIR_CAP: 'not-checked-pair-cap',
+    VAULT_UNREADABLE: 'vault-unreadable',
+    VAULT_ABSENT: 'vault-absent',
+    VAULT_MISS: 'vault-miss',
+    ALL_REFUSED: 'all-refused',
+    NONE_FOUND: 'none-found',
+    NONE_APPLY: 'none-apply',
+});
+// ─── check: block caps (T-5-05, CHECK-02 / D-05-05) ──────────────────────────
+//
+// Each cap below copies the PRACTICE_COUNT_CAP discipline exactly: it bounds a
+// client-authored fan-out BEFORE any work is done with it, and exhaustion is a
+// COUNTED REFUSAL — the block is dropped whole and `checkInvalid` says so —
+// never a silent truncation that would leave a check quietly asserting less
+// than its author wrote.
+// Max path globs one check block may declare. The largest applies-to fan-out
+// observed in the real client vault is 4; this doubles it, so a legitimate
+// block never meets the cap and a padded one is refused before matching.
+const CHECK_FILES_CAP = 8;
+// Max literal content tokens across `require` and `forbid` COMBINED. Bounds the
+// per-file substring work the evaluator does, which is the product of this and
+// the matched-file count.
+const CHECK_TOKEN_COUNT_CAP = 16;
+// Max length (chars) of a single literal content token. Mirrors
+// GLOB_PATTERN_MAX deliberately: the two assertion kinds bound their
+// client-authored payload at the same size, so neither becomes the cheap way
+// to smuggle a large one past the other.
+const CHECK_TOKEN_MAX = 200;
+// ─── enforced-by: cap (T-10-11, MECH-03 / D-10-04) ───────────────────────────
+//
+// Max analyzer rules one practice may name. Set to 8 to MATCH CHECK_FILES_CAP —
+// the number is chosen to match rather than invented, because there is no
+// observed fan-out to double here (the key is new and the client vault carries
+// zero occurrences of it) and a second, differently-sized bound on the same
+// file would be a number a reader has to justify twice.
+//
+// The treatment DIFFERS from the check caps above and the difference is
+// deliberate: a check cap is a counted REFUSAL because truncating an assertion
+// would leave it quietly asserting less than its author wrote. `enforced-by:`
+// asserts nothing and governs nothing — it is provenance data — so exhaustion
+// TRUNCATES to the first ENFORCED_BY_COUNT_CAP entries and STATES the cap in
+// one degraded warning. Nothing is lost silently: the warning is loud on the
+// read side and, because the promote preflight refuses on any degraded parse,
+// an over-cap practice cannot be promoted at all.
+//
+// EXPORTED for the same reason the check caps are: tests HARVEST the shipped
+// value and size their boundary fixtures from it, never copying the number.
+const ENFORCED_BY_COUNT_CAP = 8;
+// The exactly-four keys a `check:` mapping may carry. Anything else invalidates
+// the block — the same closed-vocabulary posture the frontmatter allowlist
+// takes, for the same reason (a typo must be loud, never silently ignored).
+const CHECK_BLOCK_KEYS = new Set(['files', 'require', 'forbid', 'forbidMatch']);
 /**
  * Safe stringify for warning messages — `extractFrontmatter` can yield
  * string | string[] | Record<string, unknown> for any key, and a bare
@@ -127,12 +358,6 @@ function boundedToken(v) {
     const s = safeStringify(v).replace(/[\r\n]+/g, ' ');
     return s.length > WARNING_TOKEN_MAX ? `${s.slice(0, WARNING_TOKEN_MAX)}…` : s;
 }
-// ─── Glob matching (PRAC-02) ───────────────────────────────────────────────────
-// Feature-detect once at module scope: `path.posix.matchesGlob` landed in
-// Node 22.5.0 and stabilized in 22.20.0 (RESEARCH STACK.md), but this repo's
-// engines floor is >=22.0.0 — the 22.0–22.4 gap must fall back to the
-// hand-rolled matcher below rather than throwing `TypeError: not a function`.
-const hasMatchesGlob = typeof node_path_1.default.posix?.matchesGlob === 'function';
 const NEVER_MATCHES = { test: () => false };
 // Bounds the total number of concrete patterns a `{a,b,c}` expansion can
 // produce (T-24-04) — client-authored globs never legitimately need more.
@@ -270,6 +495,15 @@ function globSegmentsMatch(patternSegs, subjectSegs) {
  * two-pointer algorithm (`globSegmentsMatch` + `segmentMatches`) — a
  * `.test()`-shaped duck type keeps `globMatch`'s call site unchanged.
  * Patterns over `GLOB_PATTERN_MAX` are rejected outright (never matches).
+ *
+ * ON THE NAME (05-04). Despite it, this function constructs NO `RegExp` — it
+ * returns an object literal whose `test` runs the two-pointer matcher above.
+ * the declarative-data rule says the same thing ("despite its name") and the confusion has
+ * now cost more than one verification pass, so it is stated here at the
+ * definition rather than only in the ADR. A rename to `compileGlobMatcher`
+ * was considered and REJECTED: the rename guard's 2331-file baseline is not
+ * re-cut for a readability win, and this note delivers the same correction at
+ * zero churn. Recorded so the option is not silently re-opened.
  */
 function fallbackGlobToRegex(pattern) {
     if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > GLOB_PATTERN_MAX) {
@@ -287,23 +521,18 @@ function fallbackGlobToRegex(pattern) {
 }
 /**
  * True when `filePath` matches `pattern`. Normalizes `\` → `/` (Windows path
- * input) before matching. Uses `path.posix.matchesGlob` when the runtime
- * supports it (feature-detected once at module scope), else the linear/
- * polynomial-time `fallbackGlobToRegex` matcher. Deterministic: identical
- * inputs always yield the identical boolean (PRAC-02).
+ * input) before matching, then runs the polynomial-time `fallbackGlobToRegex`
+ * matcher on every runtime (see the note above `CompiledGlob` for why the
+ * native engine is not used). Deterministic: identical inputs always yield the
+ * identical boolean (PRAC-02).
  */
 function globMatch(filePath, pattern) {
-    // Pre-dispatch length guard (T-24-04, gap #1 verifier ask b): apply
-    // GLOB_PATTERN_MAX BEFORE choosing an engine so the cap holds for the
-    // native `path.posix.matchesGlob` path too, not only the fallback
-    // compiler's internal check.
+    // Length guard (T-24-04): GLOB_PATTERN_MAX holds here as well as inside the
+    // compiler, so an over-long pattern never matches on any path.
     if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > GLOB_PATTERN_MAX) {
         return false;
     }
     const normalized = filePath.replace(/\\/g, '/');
-    if (hasMatchesGlob) {
-        return node_path_1.default.posix.matchesGlob(normalized, pattern);
-    }
     return fallbackGlobToRegex(pattern).test(normalized);
 }
 // Unsupported glob metacharacters (gap #1 closure option a, D-14/D-07):
@@ -380,6 +609,174 @@ function isSupportedGlob(pattern) {
         return false;
     return bracesSupported(pattern);
 }
+/**
+ * Normalize a frontmatter value that must be a list of non-empty strings.
+ * `extractFrontmatter` yields `string | string[] | Record<string, unknown>` for
+ * any key; a lone scalar is normalized to a one-element list exactly as
+ * `applies-to` already is, so both assertion kinds read the same way for an
+ * author. Returns `null` when the value is present but is not a usable string
+ * list — the caller turns that into a stated defect, never a silent drop.
+ */
+function normalizeStringList(v) {
+    if (Array.isArray(v)) {
+        return v.every((e) => typeof e === 'string' && e.length > 0) ? v : null;
+    }
+    if (typeof v === 'string' && v.trim())
+        return [v.trim()];
+    return null;
+}
+/**
+ * Normalize a frontmatter boolean. The shared frontmatter parser is line-based
+ * and yields the STRING `'true'`, not a boolean, so both forms are accepted and
+ * anything else is a stated defect (a `forbidMatch: yes` must not silently read
+ * as false).
+ */
+function normalizeCheckBoolean(v) {
+    if (typeof v === 'boolean')
+        return v;
+    if (v === 'true')
+        return true;
+    if (v === 'false')
+        return false;
+    return null;
+}
+/**
+ * Parse and validate a practice's `check:` block. THE ONLY parser for this
+ * shape (the one-parser rule): 05-05's evaluator receives a validated record and
+ * validates nothing itself, so a rule that is not enforced here is not
+ * enforced anywhere.
+ *
+ * A violation never skips the practice. The block is dropped whole — never
+ * half-built — and one bounded, single-line `checkInvalid` records the defect,
+ * because the practice's prose still applies (the degrade-loudly rule). 05-05 maps
+ * `checkInvalid` to a fail-closed FAIL so a broken block can never read as a
+ * pass, nor be mistaken for "this practice was never checkable".
+ *
+ * The glob half is gated by `isSupportedGlob` BY REFERENCE — the grammar is
+ * never restated here and there is never a second parser, which is what stops
+ * the evaluator and the reader drifting apart. The literal half is bounded by
+ * CHECK_TOKEN_COUNT_CAP and CHECK_TOKEN_MAX, and is compared only by plain
+ * substring containment: no client-authored byte reaches a RegExp constructor
+ * or any other pattern compiler (the declarative-data rule, T-5-05).
+ */
+function parseCheckBlock(id, rawCheck) {
+    const invalid = (defect) => ({
+        checkInvalid: `check block on practice "${boundedToken(id)}" was dropped: ${defect}. ` +
+            `The practice itself still applies; fix the block to make it mechanically checkable again.`,
+    });
+    if (typeof rawCheck !== 'object' || rawCheck === null || Array.isArray(rawCheck)) {
+        return invalid('check must be a mapping of files/require/forbid/forbidMatch');
+    }
+    const block = rawCheck;
+    const unknownKey = Object.keys(block).find((k) => !CHECK_BLOCK_KEYS.has(k));
+    if (unknownKey !== undefined) {
+        return invalid(`unrecognized key "${boundedToken(unknownKey)}" inside check ` +
+            `(expected only: ${Array.from(CHECK_BLOCK_KEYS).join(', ')})`);
+    }
+    const files = normalizeStringList(block.files);
+    if (files === null || files.length === 0) {
+        return invalid('files is required and must be a non-empty list of path globs');
+    }
+    // Count-before-work: refuse an over-wide fan-out BEFORE any glob is examined.
+    if (files.length > CHECK_FILES_CAP) {
+        return invalid(`files declares ${files.length} globs, over the cap of ${CHECK_FILES_CAP}`);
+    }
+    const unsupportedGlob = files.find((g) => !isSupportedGlob(g));
+    if (unsupportedGlob !== undefined) {
+        return invalid(`files glob "${boundedToken(unsupportedGlob)}" uses unsupported syntax ` +
+            `(see the practices README "Supported glob syntax" table)`);
+    }
+    // `globMatch` already refuses an over-long pattern by never matching. Refusing
+    // it here too turns a silent never-matches into a stated defect, so an author
+    // is told rather than left with a check that looks live and is not.
+    if (files.some((g) => g.length > GLOB_PATTERN_MAX)) {
+        return invalid(`a files glob is longer than the ${GLOB_PATTERN_MAX}-character pattern cap`);
+    }
+    const requireTokens = block.require === undefined ? undefined : normalizeStringList(block.require);
+    if (requireTokens !== undefined && (requireTokens === null || requireTokens.length === 0)) {
+        return invalid('require must be a non-empty list of literal content tokens');
+    }
+    const forbidTokens = block.forbid === undefined ? undefined : normalizeStringList(block.forbid);
+    if (forbidTokens !== undefined && (forbidTokens === null || forbidTokens.length === 0)) {
+        return invalid('forbid must be a non-empty list of literal content tokens');
+    }
+    const forbidMatch = block.forbidMatch === undefined ? undefined : normalizeCheckBoolean(block.forbidMatch);
+    if (block.forbidMatch !== undefined && forbidMatch === null) {
+        return invalid('forbidMatch must be true or false');
+    }
+    if (forbidMatch !== undefined && forbidMatch !== null && (requireTokens || forbidTokens)) {
+        return invalid('forbidMatch cannot combine with require or forbid — a forbidden match has no content to inspect');
+    }
+    if (requireTokens === undefined && forbidTokens === undefined && forbidMatch === undefined) {
+        return invalid('a check block must declare at least one of require, forbid or forbidMatch');
+    }
+    const tokens = [...(requireTokens ?? []), ...(forbidTokens ?? [])];
+    if (tokens.length > CHECK_TOKEN_COUNT_CAP) {
+        return invalid(`require and forbid declare ${tokens.length} tokens combined, over the cap of ${CHECK_TOKEN_COUNT_CAP}`);
+    }
+    // The offending token is deliberately NOT echoed: it is client-authored and
+    // over-long by definition, and the cap is what the author needs to be told.
+    if (tokens.some((t) => t.length > CHECK_TOKEN_MAX)) {
+        return invalid(`a content token is longer than the ${CHECK_TOKEN_MAX}-character cap`);
+    }
+    const check = { files };
+    if (requireTokens !== undefined && requireTokens !== null)
+        check.require = requireTokens;
+    if (forbidTokens !== undefined && forbidTokens !== null)
+        check.forbid = forbidTokens;
+    if (forbidMatch !== undefined && forbidMatch !== null)
+        check.forbidMatch = forbidMatch;
+    return { check };
+}
+/**
+ * Read a practice's `enforced-by:` value. Never throws; never drops a practice.
+ *
+ * `enforced-by:` names stock analyzer rules whose authors already enforce this
+ * practice. pp-core RECORDS the claim and runs nothing (D-10-05) — so this
+ * parser's whole job is to turn a client-authored value into a bounded, capped
+ * list of tokens, or into a stated defect.
+ *
+ * Both authored shapes are accepted through the shipped `normalizeStringList`,
+ * which turns a lone scalar into a one-element list exactly as `applies-to` is
+ * handled, and returns `null` when the value is present but not a usable string
+ * list. That `null` becomes a STATED defect here — never a silent drop, which
+ * would let a typo'd value read as "this practice names no analyzer".
+ *
+ * @param safePath The already-bounded path prefix every warning interpolates.
+ * @param rawValue The frontmatter value; callers pass only a defined value.
+ */
+function parseEnforcedBy(safePath, rawValue) {
+    const entries = normalizeStringList(rawValue);
+    if (entries === null || entries.length === 0) {
+        // The offending value is deliberately NOT echoed: it is client-authored and
+        // by definition not a string list, so what the author needs to be told is
+        // the shape, not their own bytes back.
+        return {
+            warning: `${safePath} degraded: enforced-by is present but unusable — ` +
+                `expected an analyzer rule name or a list of them (e.g. "enforced-by: VSTHRD002") — ` +
+                `the practice still applies; the enforced-by claim was dropped (D-10-04)`,
+        };
+    }
+    // Count-before-work, and ONE warning whose length is independent of the
+    // input (T-10-11): the entries themselves are never enumerated into it, so a
+    // giant list cannot grow a human/agent-visible line with attacker-chosen
+    // bytes. The PRACTICE_FILE_READ_BYTES bounded prefix read stays the primary
+    // bound on how much of that input is ever seen at all.
+    const overCap = entries.length > ENFORCED_BY_COUNT_CAP;
+    const kept = overCap ? entries.slice(0, ENFORCED_BY_COUNT_CAP) : entries;
+    // boundedToken on EVERY retained entry (T-10-10 / T-24-07): the value reaches
+    // an agent-visible surface in 10-06 and 10-08, and a CR/LF in it would forge a
+    // line there. Bounding at parse time means no renderer has to remember to.
+    const enforcedBy = kept.map((e) => boundedToken(e));
+    return overCap
+        ? {
+            enforcedBy,
+            warning: `${safePath} degraded: enforced-by names ${entries.length} rules, over the cap of ` +
+                `${ENFORCED_BY_COUNT_CAP} — the practice still applies and the first ` +
+                `${ENFORCED_BY_COUNT_CAP} are recorded; the rest were dropped (D-10-04)`,
+        }
+        : { enforcedBy };
+}
 // ─── Parsing + validation ───────────────────────────────────────────────────────
 /**
  * Parse and validate a single practice file's frontmatter. Never throws —
@@ -387,14 +784,24 @@ function isSupportedGlob(pattern) {
  * never-throws discipline modeled by `vaultSummary`/`readHeadBounded` in
  * src/vault.cts).
  *
- * Validation order (each rule its own warning string, D-03/D-06/D-08/D-14):
- *   1. null byte in filePath → invalid path (path-traversal guard)
- *   2. missing string `id` in frontmatter
- *   3. `id` must equal the file's basename (sans `.md`)
- *   4. `severity` must be one of VALID_SEVERITIES (case-insensitive, normalized)
- *   5. `scope` must be exactly 'scoped' or 'global'
- *   6. scope↔applies-to consistency (scoped needs non-empty globs; global needs none)
- *   7. `schemaVersion`: absent → 1; a value > 1 is "authored for a newer pp-core"
+ * Validation order (each rule its own warning string, D-03/D-06/D-08/D-14).
+ * The order is LOAD-BEARING: the two degrade rules must not short-circuit any
+ * hard rule below them, or a practice with an unrecognized key would bypass the
+ * id/basename check that neutralizes the CRLF-poisoned-id shape (T-5-02).
+ *   1. null byte in filePath → SKIP (path-traversal guard)
+ *   2. a frontmatter key outside DOCUMENTED_FRONTMATTER_KEYS → DEGRADE (IN-05)
+ *   3. missing string `id` in frontmatter → SKIP
+ *   4. `id` must equal the file's basename (sans `.md`) → SKIP
+ *   5. `severity` must be one of VALID_SEVERITIES (case-insensitive, normalized) → SKIP
+ *   6. `scope` must be exactly 'scoped' or 'global' → SKIP
+ *   7. scope↔applies-to consistency (scoped needs non-empty globs; global needs none) → SKIP
+ *   8. every applies-to glob must pass `isSupportedGlob` → SKIP
+ *   9. `schemaVersion`: absent → 1; malformed (`< 1` / non-integer) → SKIP;
+ *      a well-formed value > 1 → DEGRADE ("authored for a newer pp-core")
+ *  10. `check:` and `enforced-by:` are read LAST, below every hard rule above.
+ *      Neither can skip a practice: an unusable value is stated (on
+ *      `checkInvalid` and on `degradedWarnings` respectively) and the prose
+ *      still applies.
  *
  * @param filePath Repo-relative (or synthetic, in unit tests) path — used only
  *   for the id/basename check and to stamp `PracticeRecord.filePath`. Never
@@ -413,18 +820,40 @@ function parsePracticeFile(filePath, raw) {
             return { ok: false, warning: `${safePath} skipped: invalid path (contains null byte)` };
         }
         const fm = extractFrontmatter(raw);
-        // Unknown-key rejection (IN-05): a practice frontmatter carrying a key
-        // outside the documented five is skipped-with-warning rather than
-        // silently ignored — this both catches author typos (a misspelled
-        // `applies_to`) and closes off a giant-frontmatter DoS surface (T-24-04)
-        // where extra keys could otherwise be padded arbitrarily.
+        // Collects the warnings that DEGRADE this practice without discarding it.
+        // Populated below; attached to the success result at the very end, so a
+        // practice that later fails a hard rule discards these along with itself.
+        const degradedWarnings = [];
+        // Unknown-key DEGRADE (IN-05, inverted by CHECK-02 in 05-01).
+        //
+        // This branch used to `return { ok: false }`, dropping the whole practice.
+        // the degrade-loudly rule requires the opposite: an engine that meets a key it does
+        // not recognize must degrade LOUDLY — retain the practice, apply its prose
+        // through the normal path, and warn naming the key. Dropping it meant the
+        // practice silently governed nothing, which is the "governance check that
+        // quietly does nothing" the ADR calls worse than no check at all.
+        //
+        // The typo case (a misspelled `applies_to`) takes this SAME path
+        // deliberately. A typo'd key silently dropping the whole practice is
+        // exactly the governance loss CHECK-02 removes; the warning is what makes
+        // the typo loud, and the practice's prose is still worth applying.
+        //
+        // Only the FIRST unknown key is named (T-5-03). Naming every key would
+        // re-open the giant-frontmatter surface the original IN-05 comment cites
+        // (T-24-04) by making the warning grow with attacker-chosen input; the
+        // PRACTICE_FILE_READ_BYTES bounded prefix read stays the primary bound.
+        //
+        // VALIDATION ORDER IS LOAD-BEARING: this degrade must not short-circuit
+        // anything below it. id-equals-basename, the severity and scope
+        // vocabularies, the scope↔applies-to rules, glob support and a malformed
+        // schemaVersion all still hard-skip exactly as before — which is what keeps
+        // the CRLF-poisoned-id shape neutralized (T-5-02) now that IN-05 no longer
+        // discards it.
         const unexpectedKey = Object.keys(fm).find((k) => !DOCUMENTED_FRONTMATTER_KEYS.has(k));
         if (unexpectedKey !== undefined) {
-            return {
-                ok: false,
-                warning: `${safePath} skipped: unexpected frontmatter key "${boundedToken(unexpectedKey)}" ` +
-                    `(expected only: ${Array.from(DOCUMENTED_FRONTMATTER_KEYS).join(', ')}) (IN-05)`,
-            };
+            degradedWarnings.push(`${safePath} degraded: unexpected frontmatter key "${boundedToken(unexpectedKey)}" ` +
+                `(expected only: ${Array.from(DOCUMENTED_FRONTMATTER_KEYS).join(', ')}) — ` +
+                `the practice still applies; this key was not understood (IN-05)`);
         }
         const id = typeof fm.id === 'string' && fm.id.trim() ? fm.id.trim() : null;
         if (!id) {
@@ -506,31 +935,57 @@ function parsePracticeFile(filePath, raw) {
                     warning: `${safePath} skipped: malformed schemaVersion "${boundedToken(schemaVersionRaw)}"`,
                 };
             }
+            // Forward-compatibility DEGRADE (D-08, inverted by CHECK-02 in 05-01).
+            // Note the asymmetry with the `< 1` / non-integer arm just above, which
+            // stays a HARD skip: a malformed value is not a forward-compat signal,
+            // it is a broken file. Only a well-formed version this engine is too old
+            // to understand degrades — that is the case the degrade-loudly rule's rollout order
+            // exists to make legible rather than silent.
             if (parsed > PRACTICE_SCHEMA_VERSION) {
-                return {
-                    ok: false,
-                    warning: `${safePath} skipped: schemaVersion ${parsed} is newer than this pp-core supports ` +
-                        `(max ${PRACTICE_SCHEMA_VERSION}) — authored for a newer pp-core (D-08)`,
-                };
+                degradedWarnings.push(`${safePath} degraded: schemaVersion ${parsed} is newer than this pp-core supports ` +
+                    `(max ${PRACTICE_SCHEMA_VERSION}) — authored for a newer pp-core (D-08)`);
             }
             schemaVersion = parsed;
         }
         // bodyOffset: byte index right after the closing `---` frontmatter fence.
         const fmMatch = raw.match(/^---\r?\n[\s\S]+?\r?\n---/);
         const bodyOffset = fmMatch ? fmMatch[0].length : 0;
-        return {
-            ok: true,
-            practice: {
-                id,
-                scope,
-                severity,
-                appliesTo,
-                schemaVersion,
-                tier: null, // stamped by discoverPracticeFiles from the manifest
-                filePath,
-                bodyOffset,
-            },
+        // The check: block is validated HERE, alongside every other parse-time
+        // rule, so there is exactly one parser for it (the one-parser rule). An invalid
+        // block never skips the practice — see `parseCheckBlock`.
+        const checkOutcome = fm.check === undefined ? null : parseCheckBlock(id, fm.check);
+        // `enforced-by:` is read HERE, in the position parseCheckBlock occupies —
+        // BELOW every hard-skip rule above (10-03, MECH-03). The placement is the
+        // same load-bearing constraint the validation-order comment states: this
+        // key's own validation must not short-circuit id-equals-basename, the
+        // severity and scope vocabularies, the scope↔applies-to rules, glob support
+        // or a malformed schemaVersion, all of which still hard-skip exactly as
+        // before.
+        const enforcedByRaw = fm['enforced-by'];
+        const enforcedByOutcome = enforcedByRaw === undefined ? null : parseEnforcedBy(safePath, enforcedByRaw);
+        if (enforcedByOutcome?.warning !== undefined)
+            degradedWarnings.push(enforcedByOutcome.warning);
+        const practice = {
+            id,
+            scope,
+            severity,
+            appliesTo,
+            schemaVersion,
+            tier: null, // stamped by discoverPracticeFiles from the manifest
+            filePath,
+            bodyOffset,
         };
+        if (checkOutcome !== null && 'check' in checkOutcome)
+            practice.check = checkOutcome.check;
+        if (checkOutcome !== null && 'checkInvalid' in checkOutcome)
+            practice.checkInvalid = checkOutcome.checkInvalid;
+        if (enforcedByOutcome?.enforcedBy !== undefined)
+            practice.enforcedBy = enforcedByOutcome.enforcedBy;
+        // The degraded warnings ride on the SUCCESS result — the practice is
+        // returned, its prose applies, and the caller decides how to surface the
+        // warning. The key is omitted entirely when there is nothing to say, so a
+        // healthy practice's result shape is unchanged from before this plan.
+        return degradedWarnings.length > 0 ? { ok: true, practice, degradedWarnings } : { ok: true, practice };
     }
     catch (e) {
         return {
@@ -540,6 +995,49 @@ function parsePracticeFile(filePath, raw) {
     }
 }
 // ─── Discovery ───────────────────────────────────────────────────────────────────
+/**
+ * The ERRNO code of a caught filesystem error, never its message.
+ *
+ * A Node fs error message interpolates the absolute path it failed on
+ * (`EACCES: permission denied, scandir '/home/u/proj/.planning/vault/practices'`).
+ * 05-10 routes discovery's `notes[]` into the audit's `message`, which
+ * `check-query-gate.md` prints verbatim into an orchestrating agent's context
+ * on EVERY run including passes — so these notes reach an agent-read channel
+ * for the first time. CLAUDE.md § Logging forbids surfacing user file paths
+ * unredacted and records that there is no shared redactor: a call site that
+ * would surface one redacts locally. The errno is the whole diagnostic value
+ * of the message anyway; the path is the part the reader already knows.
+ */
+function errnoOf(e) {
+    const code = e?.code;
+    return typeof code === 'string' && code.length > 0 ? boundedToken(code) : 'unknown error';
+}
+/**
+ * Probe the `practices/` directory's own readability, reporting its refusal as
+ * a BOOLEAN alongside the note (T-24-08a; typed for 05-10).
+ *
+ * The probe runs BEFORE `usableFiles()` because that function's internal
+ * `walk()` (src/vault.cts) catches a `readdirSync` failure itself and returns
+ * an empty list with no throw — so wrapping the `usableFiles` call in a
+ * try/catch could never detect an unreadable directory (it would look
+ * identical to a genuinely empty vault).
+ *
+ * An ABSENT `practices/` directory is a genuinely empty vault and stays silent
+ * (`failed: false`, no note). A failure does NOT short-circuit discovery: any
+ * practices that ARE independently readable still surface, because the signal
+ * is a signal and not a data replacement.
+ */
+function probePracticesDir(practicesDirPath) {
+    if (!node_fs_1.default.existsSync(practicesDirPath))
+        return { failed: false, note: null };
+    try {
+        node_fs_1.default.readdirSync(practicesDirPath);
+        return { failed: false, note: null };
+    }
+    catch (e) {
+        return { failed: true, note: `practices directory unreadable: ${errnoOf(e)}` };
+    }
+}
 /**
  * Discover and parse practice files from the single cached vault tier.
  *
@@ -563,32 +1061,28 @@ function parsePracticeFile(filePath, raw) {
  * degrades to an empty result, a `skipped` entry, or a bounded `notes` entry.
  *
  * @param cwd Project root (parent of `.planning/`).
+ * @param vaultDir Optional cache directory to read instead of
+ *   `<cwd>/.planning/vault` (worktree executors). Defaults to the cwd
+ *   join, so the absent-versus-unreadable distinction below is unchanged for
+ *   every caller that does not pass it.
  */
-function discoverPracticeFiles(cwd) {
+function discoverPracticeFiles(cwd, vaultDir) {
     try {
-        const vaultDirPath = node_path_1.default.join(cwd, '.planning', 'vault');
+        const vaultDirPath = typeof vaultDir === 'string' && vaultDir !== ''
+            ? vaultDir
+            : node_path_1.default.join(cwd, '.planning', 'vault');
         if (!node_fs_1.default.existsSync(vaultDirPath)) {
-            return { practices: [], skipped: [], tier: null, notes: [] };
-        }
-        // T-24-08a: probe the practices/ directory's own readability BEFORE
-        // calling usableFiles() — usableFiles's internal walk() (src/vault.cts)
-        // catches a readdirSync failure itself and returns an empty list with no
-        // throw, so wrapping the usableFiles call below in try/catch can never
-        // detect an unreadable directory (it would look identical to a genuinely
-        // empty vault). An ABSENT practices/ directory is a genuinely empty vault
-        // and stays silent (pushes nothing). The probe does NOT short-circuit
-        // discovery on failure — any practices that ARE independently readable
-        // still surface below; the note is the signal, not a data replacement.
-        const notes = [];
-        const practicesDirPath = node_path_1.default.join(vaultDirPath, PRACTICES_SUBDIR.slice(0, -1));
-        if (node_fs_1.default.existsSync(practicesDirPath)) {
-            try {
-                node_fs_1.default.readdirSync(practicesDirPath);
-            }
-            catch (e) {
-                notes.push(`practices directory unreadable: ${boundedToken(e.message)}`);
-            }
+            // ABSENT is its own fact: nothing refused to be read, there was simply
+            // nothing there. `runVaultAudit` blocks on it all the same (05-10) — a
+            // gate that was never given a vault verified nothing — but the two
+            // grounds stay separable for whoever has to repair it.
+            return {
+                practices: [], skipped: [], degraded: [], tier: null, notes: [], vaultPresent: false, readFailed: false,
+                vaultRef: null, vaultSha: null, vaultMiss: false,
+            };
         }
+        const probe = probePracticesDir(node_path_1.default.join(vaultDirPath, PRACTICES_SUBDIR.slice(0, -1)));
+        const notes = probe.note ? [probe.note] : [];
         const allFiles = vaultMod.usableFiles(vaultDirPath);
         const practiceFiles = allFiles
             .filter((rel) => rel.startsWith(PRACTICES_SUBDIR) && rel.toLowerCase().endsWith('.md'))
@@ -601,8 +1095,15 @@ function discoverPracticeFiles(cwd) {
         }
         const manifest = vaultMod.readManifest(vaultDirPath);
         const tier = manifest && manifest.tier ? manifest.tier : null;
+        // FIX-3/FIX-4: the coordinates the status stamp carries,
+        // and the recorded-miss fact the sentence ladder states. Typed facts on the
+        // result, never sniffed out of notes prose.
+        const vaultRef = manifest && typeof manifest.ref === 'string' ? manifest.ref : null;
+        const vaultSha = manifest && typeof manifest.resolvedSha === 'string' ? manifest.resolvedSha : null;
+        const vaultMiss = vaultMod.manifestRecordsMiss(manifest);
         const practices = [];
         const skipped = [];
+        const degraded = [];
         for (const rel of shown) {
             // Bounded prefix read (CR-03) — the whole file is NEVER read here;
             // frontmatter + bodyOffset comfortably fit inside PRACTICE_FILE_READ_BYTES.
@@ -620,24 +1121,53 @@ function discoverPracticeFiles(cwd) {
             }
             const result = parsePracticeFile(rel, raw);
             if (result.ok) {
+                // A degraded practice stays in `practices[]` — that is the whole point
+                // of the degrade (its prose still applies). Its warnings ALSO land in
+                // `degraded[]` so the rendered channels can surface them; a warning
+                // recorded on a result nobody renders is the T-4-64 defect.
                 practices.push({ ...result.practice, tier });
+                const warnings = [...(result.degradedWarnings ?? [])];
+                // An invalid `check:` block is a degradation of the same class: the
+                // practice applies, one thing about it was not usable. It travels the
+                // same channel so an author learns the block was dropped without having
+                // to read a different surface.
+                if (result.practice.checkInvalid)
+                    warnings.push(result.practice.checkInvalid);
+                if (warnings.length > 0)
+                    degraded.push({ id: result.practice.id, path: rel, warnings });
             }
             else {
                 skipped.push({ path: rel, warning: result.warning });
             }
         }
-        return { practices, skipped, tier, notes };
+        return {
+            practices, skipped, degraded, tier, notes, vaultPresent: true, readFailed: probe.failed,
+            vaultRef, vaultSha, vaultMiss,
+        };
     }
     catch (e) {
         // T-24-08a: bind and bound the caught error rather than discarding it —
         // the bare `catch {}` this replaced is exactly the shape
         // pp-core/templates/practices/error-handling.md forbids ("never an empty
         // catch block that hides the failure").
+        //
+        // On every fs path below, the vault directory was proved to exist before
+        // anything could throw (the `existsSync` guard returns early), so reaching
+        // here means it was there and something about READING it failed:
+        // vaultPresent stays true and readFailed goes true. The two fields drive
+        // the same blocking outcome in `runVaultAudit` either way — they differ
+        // only in which repair they point an operator at.
         return {
             practices: [],
             skipped: [],
+            degraded: [],
             tier: null,
-            notes: [`practice discovery failed: ${boundedToken(e.message)}`],
+            notes: [`practice discovery failed: ${errnoOf(e)}`],
+            vaultPresent: true,
+            readFailed: true,
+            vaultRef: null,
+            vaultSha: null,
+            vaultMiss: false,
         };
     }
 }
@@ -654,18 +1184,32 @@ const { EXTERNAL_CONTENT_FENCE_START, EXTERNAL_CONTENT_FENCE_END, defangFenceMar
  * reference preamble (T-24-05: the excerpt is the exact untrusted payload a
  * later phase injects into a code-writing agent's context). Uses
  * `vaultMod.readHeadBounded` — a single bounded read of `bodyOffset +
- * PRACTICE_EXCERPT_BYTES` bytes — the whole file is NEVER read. The bounded
- * body has any planted fence-marker strings neutralized via
- * `defangFenceMarkers` BEFORE being placed between the real markers (CR-01),
- * so an untrusted body can never spoof an early fence closer.
+ * PRACTICE_EXCERPT_BYTES * EXCERPT_CRLF_OVERREAD_FACTOR` bytes — the whole file
+ * is NEVER read. The bounded body has any planted fence-marker strings
+ * neutralized via `defangFenceMarkers` BEFORE being placed between the real
+ * markers (CR-01), so an untrusted body can never spoof an early fence closer.
+ *
+ * LINE ENDINGS (FIX-1). The body is sliced at `bodyOffset`
+ * FIRST — it is an index into the raw text, computed by `parsePracticeFile` on
+ * the same bytes — and THEN normalised by deleting every carriage return, which
+ * turns each CRLF pair into LF and drops any lone carriage return (a control
+ * character that must not reach an agent context). Only then is it trimmed and capped, so the
+ * `PRACTICE_EXCERPT_BYTES` cap is measured on normalised text and a CRLF
+ * checkout renders the same excerpt as its LF twin. Before this, the cap was
+ * applied to raw text: a `core.autocrlf=true` checkout was measured losing
+ * 3–18 chars from 8 of 55 practices, with 610 carriage returns reaching the
+ * executor-facing block.
  *
  * @param filePath Absolute path to the practice `.md` file on disk.
  * @param bodyOffset Byte index where the markdown body begins (from the
  *   practice's `PracticeRecord.bodyOffset`, set by `parsePracticeFile`).
  */
 function boundedFencedExcerpt(filePath, bodyOffset) {
-    const raw = vaultMod.readHeadBounded(filePath, bodyOffset + PRACTICE_EXCERPT_BYTES);
-    const body = raw.slice(bodyOffset).trim();
+    const raw = vaultMod.readHeadBounded(filePath, bodyOffset + PRACTICE_EXCERPT_BYTES * EXCERPT_CRLF_OVERREAD_FACTOR);
+    // ONE replace, not two: deleting every carriage return turns each CRLF pair
+    // into LF AND drops any lone carriage return, so a separate CRLF→LF pass
+    // would be a step no test could tell apart from its absence.
+    const body = raw.slice(bodyOffset).replace(/\r/g, '').trim();
     const bounded = body.length > PRACTICE_EXCERPT_BYTES ? body.slice(0, PRACTICE_EXCERPT_BYTES) : body;
     const defanged = defangFenceMarkers(bounded);
     return [
@@ -679,6 +1223,19 @@ function boundedFencedExcerpt(filePath, bodyOffset) {
         EXTERNAL_CONTENT_FENCE_END,
     ].join('\n');
 }
+/**
+ * Is this file one the unmatched-source-file note reports when no scoped
+ * practice matched it? (FIX-2, QD-2.)
+ *
+ * Exactly the plan graph's source predicate: tests, docs, baselines,
+ * changesets and `.planning/` files are never reported, and everything else
+ * is. Windows separators are normalised first.
+ *
+ * @param filePath A project-relative file path, either separator.
+ */
+function isUnmatchedNoteCandidate(filePath) {
+    return (0, plan_graph_cjs_1.isSourceFile)(String(filePath).replace(/\\/g, '/'));
+}
 /**
  * Match discovered practices against a candidate file list, partitioning
  * results into two buckets (D-13):
@@ -702,12 +1259,84 @@ function boundedFencedExcerpt(filePath, bodyOffset) {
  */
 function matchPractices(opts) {
     const { cwd, files } = opts;
-    const discovery = discoverPracticeFiles(cwd);
-    const vaultDirPath = node_path_1.default.join(cwd, '.planning', 'vault');
+    const clock = opts.now ?? (() => Number(process.hrtime.bigint()) / 1e6);
+    const vaultDirPath = typeof opts.vaultDir === 'string' && opts.vaultDir !== ''
+        ? opts.vaultDir
+        : node_path_1.default.join(cwd, '.planning', 'vault');
+    const discovery = discoverPracticeFiles(cwd, vaultDirPath);
     const normalizedFiles = files.map((f) => f.replace(/\\/g, '/'));
+    // COST BOUND, PRIMARY ARM (CHECK-04 / T-5-10). Counted BEFORE any matching,
+    // so the refusal is arithmetic rather than a race: identical inputs refuse
+    // identically on every machine (T-5-11). Global practices carry no globs and
+    // so contribute no pairs.
+    const scopedGlobCount = discovery.practices.reduce((n, p) => (p.scope === 'scoped' ? n + p.appliesTo.length : n), 0);
+    const pairs = scopedGlobCount * normalizedFiles.length;
+    if (pairs > MATCH_PAIR_CAP) {
+        // A COUNTED refusal, never a silent empty result — the discipline
+        // `PRACTICE_COUNT_CAP` and `MATCHED_FILES_CAP` already keep. An empty
+        // `matched` with no note would read as "nothing applies", which is
+        // compliance claimed for work that was never done (T-5-12). The note
+        // states what was measured and asks for nothing destructive.
+        return {
+            matched: [],
+            global: [],
+            skipped: discovery.skipped,
+            degraded: discovery.degraded,
+            notes: [
+                ...discovery.notes,
+                `${MATCH_BUDGET_NOTE_PREFIX}this vault and change set produce ${pairs} (glob, file) pair(s), over the ${MATCH_PAIR_CAP}-pair matching cap — no practice was evaluated against these files`,
+            ],
+            // `practicesProcessed` keeps its established meaning (how many practices
+            // discovery yielded), so a renderer can still tell "the vault holds no
+            // practices" from "the vault holds practices that were not evaluated".
+            practicesProcessed: discovery.practices.length,
+            filesConsidered: files.length,
+            // Threaded on BOTH return sites (05-13): a refusal here does not stop
+            // the vault-read fact from being the one an unreadable vault needs
+            // stated, and a field set on one path only is a field a reader cannot
+            // trust on either.
+            vaultReadFailed: discovery.readFailed === true,
+            // Threaded on BOTH return sites for the same reason (CR-01): a field set
+            // on one path only is a field a reader cannot trust on either.
+            vaultAbsent: discovery.vaultPresent === false,
+            // Nothing was evaluated, so no file can be said to have matched nothing
+            // (QD-3) — the refusal note above states what happened instead.
+            unmatchedSourceFiles: [],
+            // Threaded on BOTH return sites (05-13 rule).
+            vaultRef: discovery.vaultRef,
+            vaultSha: discovery.vaultSha,
+            vaultMiss: discovery.vaultMiss,
+            pairBudget: {
+                pairs,
+                cap: MATCH_PAIR_CAP,
+                exceeded: true,
+                budgetMs: MATCH_BUDGET_MS,
+                // The loop never started, so the wall-clock arm never had a chance to
+                // fire. Reporting it as exhausted too would name a guard that did not
+                // act.
+                budgetExceeded: false,
+            },
+        };
+    }
     const matched = [];
     const global = [];
-    for (const practice of discovery.practices) {
+    // Every normalised file ANY scoped practice matched — uncapped, unlike each
+    // entry's `matchedFiles` slice — for the unmatched-source-file note (FIX-2).
+    const anyScopedMatch = new Set();
+    const startedAt = clock();
+    let practicesUnprocessed = 0;
+    let budgetExceeded = false;
+    for (const [index, practice] of discovery.practices.entries()) {
+        // COST BOUND, SECONDARY ARM. Checked between whole practices: the unit
+        // skipped over is one practice's full glob × file scan, which the pair cap
+        // above has already bounded, so the granularity is bounded too. Verdicts
+        // already computed are KEPT — but the omission is counted, so a partial
+        // result can never be read as a complete one.
+        if (clock() - startedAt > MATCH_BUDGET_MS) {
+            budgetExceeded = true;
+            practicesUnprocessed = discovery.practices.length - index;
+            break;
+        }
         if (practice.scope === 'scoped') {
             const winningGlobs = new Set();
             const matchedFilesSet = new Set();
@@ -716,6 +1345,7 @@ function matchPractices(opts) {
                     if (globMatch(file, glob)) {
                         winningGlobs.add(glob);
                         matchedFilesSet.add(file);
+                        anyScopedMatch.add(file);
                     }
                 }
             }
@@ -749,15 +1379,135 @@ function matchPractices(opts) {
     }
     matched.sort((a, b) => a.id.localeCompare(b.id));
     global.sort((a, b) => a.id.localeCompare(b.id));
+    const notes = budgetExceeded
+        ? [
+            ...discovery.notes,
+            `${MATCH_BUDGET_NOTE_PREFIX}${practicesUnprocessed} of ${discovery.practices.length} practice(s) were not matched because the ${MATCH_BUDGET_MS}ms matching budget was exhausted — the practices reported were evaluated, the rest were not`,
+        ]
+        : discovery.notes;
+    // QD-3: only a claim about practices that WERE evaluated. With no practice
+    // discovered (absent, unreadable, missed or empty vault) or the wall-clock
+    // budget exhausted part-way, "matched no scoped practice" would state
+    // something nobody measured; the sentence ladder and the budget note already
+    // say what happened there.
+    const unmatchedSourceFiles = discovery.practices.length > 0 && !budgetExceeded
+        ? Array.from(new Set(normalizedFiles))
+            .filter((f) => isUnmatchedNoteCandidate(f) && !anyScopedMatch.has(f))
+            .sort()
+        : [];
     return {
         matched,
         global,
         skipped: discovery.skipped,
-        notes: discovery.notes,
+        // Passed straight through — the matcher makes no judgement about a
+        // degradation, it only carries it to the renderers (CHECK-02d).
+        degraded: discovery.degraded,
+        notes,
         practicesProcessed: discovery.practices.length,
         filesConsidered: files.length,
+        // The typed vault-read fact, carried verbatim from discovery — never
+        // re-derived here and never sniffed out of `notes[]` prose (05-13).
+        vaultReadFailed: discovery.readFailed === true,
+        // The typed vault-absence fact, carried verbatim from discovery (CR-01).
+        vaultAbsent: discovery.vaultPresent === false,
+        unmatchedSourceFiles,
+        // The manifest coordinates and recorded-miss fact, carried verbatim from
+        // discovery (FIX-3/FIX-4).
+        vaultRef: discovery.vaultRef,
+        vaultSha: discovery.vaultSha,
+        vaultMiss: discovery.vaultMiss,
+        pairBudget: {
+            pairs,
+            cap: MATCH_PAIR_CAP,
+            exceeded: false,
+            budgetMs: MATCH_BUDGET_MS,
+            budgetExceeded,
+        },
     };
 }
+/**
+ * The cost bound's notes, selected out of a result's `notes[]` by the marker
+ * the matcher stamped on them.
+ *
+ * NO LONGER THE SLOT FILTER FOR THE TWO RENDERED CHANNELS (05-13, G-4). The
+ * `<vault_practices>` block and the ship gate's message now forward EVERY note
+ * the matcher counted, because this filter's prefix test also dropped the
+ * discovery-failure and cap-omission notes, and a note computed and rendered
+ * nowhere governs nothing. What survives from the original rationale is the
+ * part that was always the point: whatever a channel forwards, it forwards the
+ * sentence the matcher COMPOSED, never one re-composed from `pairBudget`'s
+ * numbers (one emission, N channels — T-4-49).
+ *
+ * Retained and exported as the SELECTOR for a caller that wants exactly the
+ * cost bound's subset — the slow corpus counts refusals with it, and a test
+ * uses it to prove which notes the old filter would have dropped.
+ */
+function matchBudgetNotes(notes) {
+    return notes.filter((n) => n.startsWith(MATCH_BUDGET_NOTE_PREFIX));
+}
+/**
+ * Bound the text of a degradation warning before it is rendered (T-5-02).
+ *
+ * The warning is ENGINE-composed around tokens `parsePracticeFile` already put
+ * through `boundedToken`, so it is not truncated again here — truncating a
+ * composed sentence would cut the defect off mid-word. What it still does is
+ * collapse any CR/LF (so a warning can never become two rendered lines) and
+ * defang planted fence markers (so a client-authored filename carrying the
+ * marker string cannot open or close a fence in a rendered channel).
+ */
+function boundedDegradationText(warning) {
+    return defangFenceMarkers(String(warning).replace(/[\r\n]+/g, ' '));
+}
+/**
+ * The per-practice degradation lines, shared VERBATIM by both rendered
+ * channels. One warning renders exactly one line, and every client-derived
+ * token on it is bounded: the practice `id` is vault-authored, and the warning
+ * is engine-composed around bounded tokens.
+ */
+function renderDegradationLines(degraded) {
+    return degraded.flatMap((d) => d.warnings.map((w) => `- **${defangFenceMarkers(boundedToken(d.id))}** — ${boundedDegradationText(w)}`));
+}
+/**
+ * The per-REFUSED-file lines, shared VERBATIM by both executor-facing channels
+ * (05-REVIEW WR-02).
+ *
+ * `skipped[]` is a structurally different fact from `degraded[]`: a degraded
+ * practice still applies with one part not understood, a skipped one was
+ * REFUSED WHOLE and nothing in it applies. Discovery has always carried both,
+ * `renderPracticesReport` has always rendered both, and the two channels an
+ * executor actually reads rendered only the degraded half — so a vault whose
+ * practice file the parser rejected looked, to a planner and to the ship gate,
+ * exactly like a vault that never held it. `vault.audit` meanwhile emits
+ * `FAIL(practice_unloadable)` and blocks on that identical state, so the three
+ * channels disagreed about one vault.
+ *
+ * Each warning already embeds its own path and is composed by the engine, but
+ * it interpolates vault-authored tokens, so it goes through the same
+ * bounding/defanging as a degradation line and renders inside the fence.
+ */
+function renderSkippedLines(skipped) {
+    return skipped.map((s) => `- ${boundedDegradationText(s.warning)}`);
+}
+/**
+ * The one-line note naming candidate files that matched no scoped practice
+ * (FIX-2). `null` when there are none.
+ *
+ * The paths are project-authored — the plan's `files_modified` or the
+ * operator's argv, the same trust class `matched_files` already renders — so
+ * the line may sit outside a fence, but each path is still bounded and
+ * defanged so none can open or close one. The list is capped at
+ * `MATCHED_FILES_CAP`; the raw array carries every file.
+ *
+ * @param files `PracticeMatchResult.unmatchedSourceFiles`.
+ */
+function renderUnmatchedSourceNote(files) {
+    const all = Array.isArray(files) ? files : [];
+    if (all.length === 0)
+        return null;
+    const shown = all.slice(0, MATCHED_FILES_CAP).map((p) => defangFenceMarkers(boundedToken(p)));
+    const capped = all.length > MATCHED_FILES_CAP ? ` (showing ${MATCHED_FILES_CAP} of ${all.length})` : '';
+    return `Note: ${all.length} file(s) matched no scoped practice: ${shown.join(', ')}${capped} — check the practices' applies-to globs against this layout.`;
+}
 /**
  * Format a `PracticeMatchResult` as plain English (COMM-01 / D-12) — the
  * default human-readable output (a later CLI wiring emits `--raw` JSON from
@@ -807,6 +1557,31 @@ function renderPracticesReport(result) {
             lines.push(`- ${s.warning}`);
         lines.push('');
     }
+    // CHECK-02d — the report's half of the degradation channel, carrying the SAME
+    // lines the block carries (T-4-49: both rendered channels move together, or a
+    // reader of one is told something a reader of the other never learns).
+    // Deliberately a section of its own, beside "Skipped" rather than inside it:
+    // a skipped practice did not apply, a degraded one DID.
+    //
+    // Unfenced here, fenced in the block, and that asymmetry is deliberate: this
+    // report is human-facing and its neighbouring `Skipped` section already
+    // prints bounded warnings unfenced, whereas the block is read by a
+    // code-WRITING agent and holds the stricter invariant that nothing
+    // vault-authored appears outside a fence.
+    const degraded = result.degraded ?? [];
+    if (degraded.length > 0) {
+        lines.push(`## Degraded practices (${degraded.length})`);
+        lines.push('_These practices still applied — each line names what this pp-core did not understand._');
+        for (const line of renderDegradationLines(degraded))
+            lines.push(line);
+        lines.push('');
+    }
+    // FIX-2: the same line the block carries, as its own paragraph.
+    const unmatchedNote = renderUnmatchedSourceNote(result.unmatchedSourceFiles);
+    if (unmatchedNote !== null) {
+        lines.push(unmatchedNote);
+        lines.push('');
+    }
     if (result.notes.length > 0) {
         lines.push('## Notes');
         for (const n of result.notes)
@@ -885,6 +1660,86 @@ function renderPracticeEntry(entry) {
     lines.push(EXTERNAL_CONTENT_FENCE_END);
     return lines.join('\n');
 }
+/** Stamp `ref`: charset-and-length bounded like the load gate's ref (T-08-39). */
+function stampRef(ref) {
+    const kept = typeof ref === 'string' ? ref.replace(/[^A-Za-z0-9._/@+~-]/g, '').slice(0, 100) : '';
+    return kept === '' ? '(none)' : kept;
+}
+/** Stamp `sha`: lowercase hex only, first 8; `(none)` when fewer than 8 remain. */
+function stampSha(sha) {
+    const hex = typeof sha === 'string' ? sha.toLowerCase().replace(/[^0-9a-f]/g, '') : '';
+    return hex.length >= 8 ? hex.slice(0, 8) : '(none)';
+}
+/**
+ * Render the block's status stamp — ONE line, an HTML comment (FIX-3, QD-4).
+ *
+ * `ref=` and `sha=` name the vault read, `entries=<n>` counts the fenced
+ * practice entries rendered OR `state=<token>` names the degraded state —
+ * never both — and `engine=` is the `createdWith` string. Every value is
+ * charset-bounded so no `<` or `>` survives: the comment cannot be closed early
+ * and nothing in it can read as a fence marker or an `id:` line (T-jby-04/05).
+ *
+ * @param parts.ref    Manifest ref (project-configured; bounded here).
+ * @param parts.sha    Manifest resolvedSha (bounded to 8 lowercase hex).
+ * @param parts.entries Number of fenced entries, when the block renders entries.
+ * @param parts.state  A `PRACTICES_STAMP_STATES` token, when it renders a sentence.
+ * @param parts.engine Override for the engine string (tests); defaults to
+ *   `resolveCreatedWithFrom(__dirname)`.
+ */
+function renderPracticesStamp(parts) {
+    const engineRaw = typeof parts.engine === 'string' ? parts.engine : (0, compose_bindings_cjs_1.resolveCreatedWithFrom)(__dirname);
+    const engine = engineRaw.replace(/[^A-Za-z0-9.@_-]/g, '') || '(none)';
+    const tail = typeof parts.state === 'string'
+        ? `state=${parts.state.replace(/[^a-z-]/g, '')}`
+        : `entries=${Math.max(0, Math.trunc(Number(parts.entries) || 0))}`;
+    return `${PRACTICES_STAMP_PREFIX} ref=${stampRef(parts.ref)} sha=${stampSha(parts.sha)} ${tail} engine=${engine} -->`;
+}
+/**
+ * Choose the sentence an entry-less block states AND its stamp token, in ONE
+ * place so the two cannot drift (FIX-3/FIX-4).
+ *
+ * ORDER IS LOAD-BEARING and pinned rung by rung. The pair-cap refusal stays
+ * FIRST: it is a statement about work this engine declined to do. Read
+ * failure, absence and a recorded miss follow — each is a fact about a vault
+ * nothing could be read from, and each sits above the all-refused and
+ * none-found rungs, which are facts about a vault that WAS read. The miss rung
+ * (FIX-4) sits after absence (an absent directory has no manifest to record a
+ * miss in, so absence is the more basic fact) and before all-refused.
+ */
+function selectEmptyBlockSentence(result, skippedCount) {
+    if (result?.pairBudget?.exceeded === true) {
+        return { sentence: "Practices were NOT checked against this plan's files.", state: PRACTICES_STAMP_STATES.NOT_CHECKED_PAIR_CAP };
+    }
+    // THE THIRD RUNG (05-13, G-4). `practicesProcessed === 0` is true of a vault
+    // that holds no practices AND of one nothing could read; the none-found
+    // sentence is a fact about a vault that WAS read. Reads the typed boolean,
+    // never `notes[]` prose.
+    if (result?.vaultReadFailed === true) {
+        return { sentence: PRACTICES_VAULT_UNREADABLE_SENTENCE, state: PRACTICES_STAMP_STATES.VAULT_UNREADABLE };
+    }
+    if (result?.vaultAbsent === true) {
+        return { sentence: PRACTICES_VAULT_ABSENT_SENTENCE, state: PRACTICES_STAMP_STATES.VAULT_ABSENT };
+    }
+    // FIX-4: a manifest that records a miss — the fetch ran
+    // and reached nothing.
+    if (result?.vaultMiss === true) {
+        return { sentence: PRACTICES_VAULT_MISS_SENTENCE, state: PRACTICES_STAMP_STATES.VAULT_MISS };
+    }
+    if (result && result.practicesProcessed === 0 && skippedCount > 0) {
+        // 05-REVIEW WR-02, the fifth rung. `practicesProcessed === 0` is true of a
+        // THIRD kind of vault as well: one that holds practice files and had every
+        // one of them refused. "None found" is false here — the files were found,
+        // read, and rejected.
+        return {
+            sentence: 'Practices were NOT applied — every practice file found in the vault was refused. See “Refused practices”.',
+            state: PRACTICES_STAMP_STATES.ALL_REFUSED,
+        };
+    }
+    if (result && result.practicesProcessed === 0) {
+        return { sentence: 'Practices checked — none found in the vault.', state: PRACTICES_STAMP_STATES.NONE_FOUND };
+    }
+    return { sentence: "Practices checked — none apply to this plan's files.", state: PRACTICES_STAMP_STATES.NONE_APPLY };
+}
 /**
  * Render the complete `<vault_practices>` block for a plan, ready to embed
  * VERBATIM — no renaming, reshaping or re-fencing by the caller.
@@ -904,18 +1759,130 @@ function renderPracticeEntry(entry) {
 function renderPracticesBlock(result, reason) {
     const open = '<vault_practices>';
     const close = '</vault_practices>';
-    const head = [open, '', BLOCK_PREAMBLE, ''];
+    // FIX-3: the status stamp is the first line inside the
+    // block on all three return paths, then the blank line, then the preamble.
+    const engine = (0, compose_bindings_cjs_1.resolveCreatedWithFrom)(__dirname);
+    const headWith = (stamp) => [
+        open,
+        renderPracticesStamp({ ref: result?.vaultRef, sha: result?.vaultSha, engine, ...stamp }),
+        '',
+        BLOCK_PREAMBLE,
+        '',
+    ];
+    // CHECK-02d — the executor-facing degradation slot.
+    //
+    // This is the channel the code-writing agent actually reads, so it is the
+    // channel the warning has to reach. A degradation recorded on a parse result
+    // and rendered nowhere repeats T-4-64 exactly: the record exists, nobody sees
+    // it, and the practice governs nothing while appearing to govern.
+    //
+    // FENCED, because this block's standing invariant is that nothing
+    // vault-authored is emitted outside an external-content fence — the practice
+    // `id` on each line is vault-authored. The lines are defanged first, so a
+    // planted marker cannot close the fence early and smuggle text out.
+    //
+    // The slot ADDS to the rendering, never replaces: degraded means "applies
+    // with a warning", so the practice's own entry below is untouched. When
+    // nothing is degraded the slot contributes zero bytes, leaving every healthy
+    // vault's block byte-identical to its pre-plan output.
+    const degraded = result?.degraded ?? [];
+    const degradedSection = degraded.length > 0
+        ? [
+            '## Degraded practices',
+            '',
+            'These practices still apply. Each line below names something in the practice file that this pp-core did not understand.',
+            '',
+            EXTERNAL_CONTENT_FENCE_START,
+            ...FENCE_NOTICE,
+            '',
+            ...renderDegradationLines(degraded),
+            EXTERNAL_CONTENT_FENCE_END,
+            '',
+        ]
+        : [];
+    // CHECK-04 / T-5-12 — the cost bound's slot (05-04).
+    //
+    // Before this the block rendered no `notes[]` at all, so a refusal computed
+    // by the matcher reached the human report and the --raw JSON and STOPPED —
+    // the one channel a code-writing agent actually reads stayed silent and, on
+    // a total refusal, went on to print "none apply to this plan's files" about
+    // files nothing had been evaluated against. That is T-4-64 with a worse
+    // consequence: not an invisible note, an actively false one.
+    //
+    // UNFENCED, unlike the degradation slot beside it: every byte here is
+    // engine-composed. That was argued for the cost bound's two sentences and
+    // it holds for the WHOLE set (05-13) — the cap-omission note is an integer
+    // and a fixed phrase, and the discovery-failure notes were bounded to an
+    // errno code by 05-10 precisely so no path text could ride one into an
+    // agent-read channel. No vault-authored token reaches this section on any
+    // path, so the block's nothing-vault-authored-outside-a-fence invariant is
+    // untouched.
+    //
+    // WIDENED from `matchBudgetNotes` (05-13, G-4). That prefix filter admitted
+    // the cost bound's notes and silently dropped every other note the matcher
+    // counted — the discovery failure and the cap omission among them. A note
+    // computed and rendered nowhere is T-4-64, and here it was worse than
+    // invisible: the sentence chosen below claimed a clean, empty vault while
+    // the note explaining that nothing could be read was being discarded one
+    // line above it. Every note is still forwarded VERBATIM as the matcher
+    // composed it, never re-composed from `pairBudget`'s numbers, so this
+    // channel and the ship gate's message cannot drift apart (T-4-49).
+    const resultNotes = result?.notes ?? [];
+    const notesSection = resultNotes.length > 0
+        ? ['## Practices not checked', '', ...resultNotes.map((n) => `- ${n}`), '']
+        : [];
+    // 05-REVIEW WR-02 — the refused half of discovery, which this channel dropped.
+    // FENCED like the degradation slot beside it and for the same reason: the
+    // warnings interpolate vault-authored tokens. Rendered on BOTH returns below,
+    // because the all-refused vault lands on the early one.
+    const skipped = result?.skipped ?? [];
+    const refusedSection = skipped.length > 0
+        ? [
+            '## Refused practices',
+            '',
+            'These practice files were found in the vault and refused whole — nothing in them was applied. Each line names why.',
+            '',
+            EXTERNAL_CONTENT_FENCE_START,
+            ...FENCE_NOTICE,
+            '',
+            ...renderSkippedLines(skipped),
+            EXTERNAL_CONTENT_FENCE_END,
+            '',
+        ]
+        : [];
+    // FIX-2: candidate files no scoped practice matched. The
+    // matcher owns the gating (QD-3); the renderer renders whenever the array is
+    // non-empty. Engine-composed text around project-authored, bounded and
+    // defanged paths — nothing vault-authored — so it sits outside a fence.
+    const unmatchedNote = renderUnmatchedSourceNote(result?.unmatchedSourceFiles);
+    const noteSection = unmatchedNote !== null ? [unmatchedNote, ''] : [];
     if (reason) {
+        const head = headWith({ state: PRACTICES_STAMP_STATES.COULD_NOT_BE_CHECKED });
         return [...head, `Practices could not be checked: ${boundedToken(reason)}.`, '', close].join('\n');
     }
     if (!result || (result.matched.length === 0 && result.global.length === 0)) {
         // D-14 (vault holds no practices at all) vs D-13 (checked, none applied).
-        const sentence = result && result.practicesProcessed === 0
-            ? 'Practices checked — none found in the vault.'
-            : "Practices checked — none apply to this plan's files.";
-        return [...head, sentence, '', close].join('\n');
+        //
+        // A degraded SCOPED practice whose globs matched nothing lands in neither
+        // bucket and reaches this early return — which is precisely where a warning
+        // would otherwise vanish, so the slot is rendered here too.
+        //
+        // A TOTAL refusal (the pair cap fired before the loop) lands here too, and
+        // neither of the two pre-existing sentences is true of it: nothing was
+        // checked, so "checked — none apply" claims a result that was never
+        // computed. A partial refusal (the wall-clock budget) keeps its sentence,
+        // because the practices that WERE evaluated genuinely did not apply — the
+        // note above states how many were not reached.
+        //
+        // The rungs themselves — and their order — live in
+        // `selectEmptyBlockSentence`, which picks the sentence and the stamp token
+        // together so the two cannot drift.
+        const { sentence, state } = selectEmptyBlockSentence(result, skipped.length);
+        const head = headWith({ state });
+        return [...head, ...notesSection, ...degradedSection, ...refusedSection, ...noteSection, sentence, '', close].join('\n');
     }
-    const body = [];
+    const head = headWith({ entries: result.matched.length + result.global.length });
+    const body = [...notesSection, ...degradedSection, ...refusedSection, ...noteSection];
     if (result.matched.length > 0) {
         body.push('## Scoped practices', '');
         for (const m of result.matched)
@@ -937,6 +1904,19 @@ module.exports = {
     matchPractices,
     renderPracticesReport,
     renderPracticesBlock,
+    // 06-04 (VERIFY-02, CR-02): exported so the retroactive review arm hands the
+    // agent EXACTLY the entries `renderPracticesBlock` hands a planner — one
+    // fencing idiom, one defang, one reference-data preamble. The alternative was
+    // for that arm to render a per-practice entry of its own, which is how CR-02's
+    // class comes back: a second renderer is a second place a client-authored byte
+    // can reach an agent context unfenced. Purely additive; no call site changed.
+    renderPracticeEntry,
+    // D-05-07: exported so the trace scaffold digests the SAME
+    // text `renderPracticeEntry` places under `ask:`/`excerpt:` — one unwrap, two
+    // readers. A second unwrap in src/vault-trace.cts would be a second place the
+    // fence-stripping rule could drift, and the digest would then disagree with
+    // the block it was written to verify.
+    unwrapFencedExcerpt,
     boundedFencedExcerpt,
     PRACTICE_COUNT_CAP,
     VALID_SEVERITIES,
@@ -949,4 +1929,62 @@ module.exports = {
     boundedToken,
     PRACTICE_FILE_READ_BYTES,
     WARNING_TOKEN_MAX,
+    // 05-01 (CHECK-02, T-4-42): exported so the allowlist's conformance test can
+    // DERIVE its iteration set from the shipped constant instead of hand-listing
+    // it, and so the promote path's mirror can be checked against the same set.
+    DOCUMENTED_FRONTMATTER_KEYS,
+    // 05-01 (D-05-05): the check block's three caps. Exported so tests HARVEST
+    // them at run time and size their boundary fixtures from the shipped values —
+    // never copying the numbers, which is how a fixture rots into asserting a cap
+    // the code no longer has.
+    CHECK_FILES_CAP,
+    CHECK_TOKEN_COUNT_CAP,
+    CHECK_TOKEN_MAX,
+    // 10-03 (MECH-03 / D-10-04): the enforced-by list cap, exported for the same
+    // harvest-never-copy reason as the three check caps above.
+    ENFORCED_BY_COUNT_CAP,
+    // 05-04 (CHECK-04, T-5-10): the matching cost bound. Exported so the slow
+    // corpus can extrapolate its measured per-pair rate to the cap the running
+    // code actually holds, and so a consumer channel can name the cap it hit.
+    MATCH_PAIR_CAP,
+    MATCH_BUDGET_MS,
+    matchBudgetNotes,
+    // 05-13 (CHECK-02, G-4): the read-failure sentence both executor-facing
+    // channels state. Exported so `cmdShipPractices` and every pin HARVEST the
+    // wording instead of copying it — a copy is a wording free to drift.
+    PRACTICES_VAULT_UNREADABLE_SENTENCE,
+    PRACTICES_VAULT_ABSENT_SENTENCE,
+    // 05-REVIEW CR-02: exported so the audit's gate message fences its
+    // vault-authored fail items with the SAME idiom this module already uses —
+    // one marker pair, one defang, one reference-data notice. Authoring a second
+    // fence or preamble in the audit module is how CR-02's class returns (same
+    // argument as the renderPracticeEntry export above).
+    defangFenceMarkers,
+    EXTERNAL_CONTENT_FENCE_START,
+    EXTERNAL_CONTENT_FENCE_END,
+    FENCE_NOTICE,
+    // 05-REVIEW WR-02: the refused-file lines, exported for the SAME reason
+    // `renderPracticeEntry` is — the ship gate renders the identical lines from
+    // this one composer, so the two executor-facing channels cannot describe one
+    // refused practice differently (T-4-49).
+    renderSkippedLines,
+    // 05-REVIEW CR-03: exported so the audit's bounded reader reports a caught
+    // filesystem error by ERRNO only, through the one redactor written for this
+    // exact hazard (see its doc comment) — never a raw Node error message, which
+    // interpolates the absolute path CLAUDE.md § Logging forbids surfacing.
+    errnoOf,
+    // FIX-1: the excerpt's CRLF over-read factor, exported so
+    // the bounded-read test and the contract page HARVEST it.
+    EXCERPT_CRLF_OVERREAD_FACTOR,
+    // FIX-2: the unmatched-source-file note's predicate and one-line composer —
+    // exported so tests and both rendered channels compose the line in one place.
+    isUnmatchedNoteCandidate,
+    renderUnmatchedSourceNote,
+    // FIX-3/FIX-4: the status stamp's prefix, state vocabulary
+    // and renderer, and the recorded-miss sentence — exported so tests and the
+    // contract page harvest them rather than copy them.
+    PRACTICES_VAULT_MISS_SENTENCE,
+    PRACTICES_STAMP_PREFIX,
+    PRACTICES_STAMP_STATES,
+    renderPracticesStamp,
 };