@pareto4/pp-core 1.12.1 → 1.17.1

package/pp-core/bin/lib/init-interactive.cjs

@@ -118,15 +118,88 @@ function renderComposeConfirm(prompter, info) {
 async function runInitInteractive(cwd, prompter, opts = {}) {
     const sessionOpts = { offline: opts.offline === true, _globalRoot: opts._globalRoot };
     let wroteBinding = false;
+    // PBI 74299: answers the session filled in itself are shown once each, as
+    // soon as they are decided, so the operator sees every value before the
+    // compose confirmation.
+    const shownAutoAnswers = new Set();
     for (let steps = 1; steps <= MAX_SESSION_STEPS; steps++) {
         const state = (0, init_contract_cjs_1.initSessionNext)(cwd, sessionOpts);
         if (state.error !== undefined) {
             prompter.print(`Error: ${state.message ?? state.error}`);
             return { ok: false, wroteBinding, steps, violations: [] };
         }
+        for (const auto of state.autoAnswered ?? []) {
+            if (shownAutoAnswers.has(auto.id))
+                continue;
+            shownAutoAnswers.add(auto.id);
+            const why = auto.source === 'derived' ? 'derived' : 'set by the org profile';
+            prompter.print(`  ${auto.id} = ${auto.value} (${why})`);
+        }
         if (state.done) {
             if (wroteBinding) {
-                prompter.print('Done — .platform-bindings.json was composed and written.');
+                // OD-1: the done line names the capability the session just armed and
+                // the step that is now live, so an operator is not left to discover
+                // either from the config file.
+                //
+                // 07-09 (WR-07): a READING, not a claim. The arming write happens
+                // only on an ABSENT key, so an operator's explicit `false` — and a
+                // hand-edited non-boolean — are still there when the session ends.
+                // Printing the armed line over either of those would make the last
+                // line `pp-tools init` prints contradict the config file it just
+                // finished writing, which is precisely the
+                // tool-reports-a-state-that-isn't-real failure this phase exists to
+                // end.
+                const vaultState = (0, init_contract_cjs_1.readVaultEnabledState)(cwd).state;
+                if (vaultState === 'off') {
+                    prompter.print('Done — .platform-bindings.json was composed and written; vault.enabled was left at false ' +
+                        'as this project set it, so the vault capability stays off and /pp-init Step 2.6 stays ' +
+                        'inert (arm it with pp-tools config-set vault.enabled true).');
+                }
+                else if (vaultState === 'malformed') {
+                    prompter.print('Done — .platform-bindings.json was composed and written; vault.enabled holds a non-boolean ' +
+                        'value and was left untouched — pp-tools query init-contract --verify reports it as ' +
+                        'INIT_VAULT_ENABLED_MALFORMED; store the boolean with pp-tools config-set vault.enabled true.');
+                }
+                else if (vaultState === 'armed') {
+                    // Quick 260915-lmc: vault.practices_enabled is armed beside it under
+                    // the same absent-only rule, so the line names it only when the
+                    // READING says true — an explicit false is the project's choice and
+                    // is not contradicted here.
+                    const practicesArmed = (0, init_contract_cjs_1.readVaultPracticesEnabledState)(cwd).state === 'armed';
+                    // Quick 260916-s5n: vault.required is named only when the READING
+                    // says armed, by the same rule — an explicit false is the project's
+                    // choice and the last line printed must not contradict it.
+                    const requiredArmed = (0, init_contract_cjs_1.readVaultRequiredState)(cwd).state === 'armed';
+                    // Built as a head plus two OPTIONAL clauses carrying no terminator
+                    // of their own, with exactly one full stop appended at the end. The
+                    // stop used to live inside the practices branch, which made every
+                    // further clause a sentence continuing past its own period.
+                    const head = 'Done — .platform-bindings.json was composed and written; vault.enabled is now true ' +
+                        '(the vault capability is armed — /pp-init Step 2.6 probes reachability next)';
+                    // 15-REVIEW WR-09: in standards mode no phase records practices (the
+                    // practices planner fragment and trace gates are filtered out), so the
+                    // clause names what IS recorded and checked there, whatever the
+                    // practices switch reads.
+                    const practicesClause = (0, init_contract_cjs_1.readVaultStandardsModeActive)(cwd)
+                        ? '; vault.mode is standards, so each plan records which client standards documents governed it ' +
+                            '(<vault_standards>), checked by the vault.trace gate'
+                        : practicesArmed
+                            ? '; vault.practices_enabled is true, so each phase records which client vault practices it applied'
+                            : '';
+                    const requiredClause = requiredArmed
+                        ? '; vault.required is true, so a client vault miss, a failed fetch or an unwritable vault summary ' +
+                            'stops the build at plan:pre and execute:pre'
+                        : '';
+                    prompter.print(head + practicesClause + requiredClause + '.');
+                }
+                else {
+                    // 'absent' — unreachable after an approved compose (the arming
+                    // write fires on exactly this state), kept defensive for the case
+                    // where that write itself failed. It says only what is certain:
+                    // the binding was written, and it does NOT claim the capability is
+                    // on, because the key is not there to say so.
+                    prompter.print('Done — .platform-bindings.json was composed and written.');
+                }
             }
             else if (typeof state.info === 'string') {
                 prompter.print(state.info);
@@ -168,26 +241,9 @@ async function runInitInteractive(cwd, prompter, opts = {}) {
                 preselectedLabel: state.preselectedLabel,
                 optionalAnswer: state.optionalAnswer,
             });
-            // INIT-PATCH-C: Enter accepts a carried default, "none" clears it.
-            // Scoped to an OPTIONAL step carrying a usable `preselected` — today
-            // that is only `org_profile` when exactly one org-profile-shaped
-            // package was detected. `provider` also carries a `preselected` but is
-            // NOT `optionalAnswer`, so the `state.optionalAnswer === true` guard
-            // below leaves it untouched: a blank answer there still falls through
-            // to `initSessionAnswer` verbatim, which still rejects it and re-asks
-            // exactly as today.
-            const hasUsableDefault = state.optionalAnswer === true && typeof state.preselected === 'string' && state.preselected.trim() !== '';
-            let submittedAnswer = answer;
-            if (hasUsableDefault) {
-                const trimmedLower = answer.trim().toLowerCase();
-                if (answer.trim() === '') {
-                    submittedAnswer = state.preselected;
-                }
-                else if (trimmedLower === 'none') {
-                    submittedAnswer = '';
-                }
-            }
-            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, submittedAnswer, sessionOpts);
+            // UAT-13-F2: the driver has no default-acceptance path, on purpose — the
+            // answer goes to initSessionAnswer verbatim, which owns the none/blank decline.
+            const result = (0, init_contract_cjs_1.initSessionAnswer)(cwd, stepId, answer, sessionOpts);
             if (result.ok) {
                 if (stepId === 'compose_confirm') {
                     wroteBinding = readBindingsContent(cwd) !== preBindings;

package/pp-core/bin/lib/init.cjs

@@ -32,7 +32,6 @@ const worktreeSafety = require("./worktree-safety.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- planning-workspace.cjs is an export= CommonJS module
 const planningWorkspace = require("./planning-workspace.cjs");
 const secrets_cjs_1 = require("./secrets.cjs");
-const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- plan-scan.cjs is an export= CommonJS module
 const scanPhasePlans = require("./plan-scan.cjs");
 const state_document_cjs_1 = require("./state-document.cjs");
@@ -189,7 +188,8 @@ function getInitGitState(cwd) {
  * Quick 261007-jkl, D2 (todo "init execute-phase returns null phase_dir for an
  * archived phase") put the "is this archived match the current milestone's?"
  * compare HERE, for these four verbs only; every other consumer of the raw
- * locator kept the archive fall-through with no compare. The decision now lives in ONE owner, src/phase-scope.cts, which
+ * locator kept the archive fall-through with no compare (PBI 75323, quick
+ * 261009-gvf). The decision now lives in ONE owner, src/phase-scope.cts, which
  * every consumer shares: a phase archived in the CURRENT milestone keeps its
  * match, directory and artifacts; a PRIOR milestone's archived phase whose
  * number the current ROADMAP reuses is dropped (the pins in tests/init.test.cjs
@@ -222,26 +222,6 @@ function resolvePhaseForInit(cwd, phase) {
     }
     return { phaseInfo, roadmapPhase };
 }
-/**
- * The phase's resolved ceremony tier for an init payload (src/phase-tier.cts).
- * Init's gate booleans (`research_enabled`, `plan_checker_enabled`,
- * `verifier_enabled`, …) are read from this, never from raw config, so a
- * workflow that reads init reads the tier-resolved set.
- */
-function initPhaseTier(cwd, phase, options) {
-    const flag = options['tier'];
-    let cli = null;
-    if (typeof flag === 'string') {
-        const v = flag.trim().toLowerCase();
-        if (!(0, phase_tier_cjs_1.isPhaseTier)(v))
-            error(`--tier needs one of ${phase_tier_cjs_1.PHASE_TIERS.join(', ')}`);
-        cli = v;
-    }
-    return (0, phase_tier_cjs_1.resolvePhaseTierForProject)(cwd, phase, cli);
-}
-function phaseTierSummary(t) {
-    return { tier: t.tier, source: t.source, gates: t.gates, suppressed: t.suppressed };
-}
 function cmdInitExecutePhase(cwd, phase, raw, options = {}) {
     if (!phase) {
         error('phase required for init execute-phase');
@@ -255,7 +235,6 @@ function cmdInitExecutePhase(cwd, phase, raw, options = {}) {
         : null;
     const phase_req_ids = reqExtracted && reqExtracted !== 'TBD' ? reqExtracted : null;
     const wf = (config.workflow ?? {});
-    const tier = initPhaseTier(cwd, phase, options);
     const result = {
         executor_model: resolveModelInternal(cwd, 'pp-executor'),
         verifier_model: resolveModelInternal(cwd, 'pp-verifier'),
@@ -267,12 +246,7 @@ function cmdInitExecutePhase(cwd, phase, raw, options = {}) {
         branching_strategy: config.branching_strategy,
         phase_branch_template: config.phase_branch_template,
         milestone_branch_template: config.milestone_branch_template,
-        verifier_enabled: tier.gates.verifier,
-        code_review_enabled: tier.gates.code_review,
-        security_enforcement_enabled: tier.gates.security_enforcement,
-        nyquist_validation_enabled: tier.gates.nyquist_validation,
-        install_verification_enabled: tier.gates.install_verification,
-        phase_tier: phaseTierSummary(tier),
+        verifier_enabled: config.verifier,
         phase_found: !!phaseInfo,
         phase_dir: phaseInfo?.['directory'] || null,
         phase_number: phaseInfo?.['phase_number'] || null,
@@ -357,22 +331,15 @@ function cmdInitPlanPhase(cwd, phase, raw, options = {}) {
     assertValidGranularityOverride(granularityOverride, error);
     const granularity = resolveGranularityInternal(cwd, 'planning', granularityOverride || undefined);
     const wf = (config.workflow ?? {});
-    const tier = initPhaseTier(cwd, phase, options);
     const result = {
         researcher_model: resolveModelInternal(cwd, 'pp-phase-researcher'),
         planner_model: resolveModelInternal(cwd, 'pp-planner'),
         checker_model: resolveModelInternal(cwd, 'pp-plan-checker'),
         tdd_mode: options['tdd'] || Boolean(wf['tdd_mode']) || false,
         granularity,
-        research_enabled: tier.gates.research,
-        plan_checker_enabled: tier.gates.plan_check,
-        plan_check_passes: tier.gates.plan_check_passes,
-        nyquist_validation_enabled: tier.gates.nyquist_validation,
-        pattern_mapper_enabled: tier.gates.pattern_mapper,
-        post_planning_gaps_enabled: tier.gates.post_planning_gaps,
-        security_enforcement_enabled: tier.gates.security_enforcement,
-        plan_bounce_enabled: tier.gates.plan_bounce,
-        phase_tier: phaseTierSummary(tier),
+        research_enabled: wf['research'],
+        plan_checker_enabled: config.plan_checker,
+        nyquist_validation_enabled: wf['nyquist_validation'],
         commit_docs: config.commit_docs,
         text_mode: config.text_mode,
         auto_advance: !!(config.auto_advance),
@@ -603,10 +570,14 @@ function cmdInitNewMilestone(cwd, raw) {
     };
     output(withProjectRoot(cwd, result), raw);
 }
-function cmdInitQuick(cwd, description, raw) {
-    const config = loadConfig(cwd);
-    const now = new Date();
-    const slug = description ? generateSlugInternal(description)?.substring(0, 40) : null;
+/**
+ * The quick-task id for a moment: `yymmdd` + `-` + the two-second block of the
+ * local day in base 36, padded to three (`261011-8yt`). A pure function of
+ * `now`, extracted verbatim from `cmdInitQuick` (16-05, D-29) so the plan-id
+ * owner (`SCAFFOLD_PLAN_ID_RE`, src/vault-standards.cts) is tested over ids the
+ * engine itself builds, all-digit and lettered, rather than over hand-typed ones.
+ */
+function buildQuickId(now) {
     const yy = String(now.getFullYear()).slice(-2);
     const mm = String(now.getMonth() + 1).padStart(2, '0');
     const dd = String(now.getDate()).padStart(2, '0');
@@ -614,7 +585,13 @@ function cmdInitQuick(cwd, description, raw) {
     const secondsSinceMidnight = now.getHours() * 3600 + now.getMinutes() * 60 + now.getSeconds();
     const timeBlocks = Math.floor(secondsSinceMidnight / 2);
     const timeEncoded = timeBlocks.toString(36).padStart(3, '0');
-    const quickId = dateStr + '-' + timeEncoded;
+    return dateStr + '-' + timeEncoded;
+}
+function cmdInitQuick(cwd, description, raw) {
+    const config = loadConfig(cwd);
+    const now = new Date();
+    const slug = description ? generateSlugInternal(description)?.substring(0, 40) : null;
+    const quickId = buildQuickId(now);
     const branchSlug = slug || 'quick';
     const quickBranchName = config.quick_branch_template
         ? config.quick_branch_template
@@ -676,22 +653,16 @@ function cmdInitResume(cwd, raw) {
     };
     output(withProjectRoot(cwd, result), raw);
 }
-function cmdInitVerifyWork(cwd, phase, raw, options = {}) {
+function cmdInitVerifyWork(cwd, phase, raw) {
     if (!phase) {
         error('phase required for init verify-work');
     }
     const config = loadConfig(cwd);
     const { phaseInfo } = resolvePhaseForInit(cwd, phase);
-    const tier = initPhaseTier(cwd, phase, options);
     const result = {
         planner_model: resolveModelInternal(cwd, 'pp-planner'),
         checker_model: resolveModelInternal(cwd, 'pp-plan-checker'),
         commit_docs: config.commit_docs,
-        plan_checker_enabled: tier.gates.plan_check,
-        plan_check_passes: tier.gates.plan_check_passes,
-        security_enforcement_enabled: tier.gates.security_enforcement,
-        nyquist_validation_enabled: tier.gates.nyquist_validation,
-        phase_tier: phaseTierSummary(tier),
         phase_found: !!phaseInfo,
         phase_dir: phaseInfo?.['directory'] || null,
         phase_number: phaseInfo?.['phase_number'] || null,
@@ -1882,6 +1853,8 @@ module.exports = {
     cmdInitNewProject,
     cmdInitNewMilestone,
     cmdInitQuick,
+    // 16-05 (D-29): the pure quick-id builder, so the plan-id owner is tested over real ids.
+    buildQuickId,
     cmdInitIngestDocs,
     cmdInitResume,
     cmdInitVerifyWork,

package/pp-core/bin/lib/install-profiles.cjs

@@ -27,7 +27,7 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
  */
 const PROFILES = Object.freeze({
     core: Object.freeze([
-        // init is the front door every installer/hook/no-project message
+        // PBI 75232: init is the front door every installer/hook/no-project message
         // names, so it ships in every profile — a minimal install must not print a
         // start command it did not install.
         'init',

package/pp-core/bin/lib/io.cjs

@@ -187,6 +187,12 @@ const ERROR_REASON = Object.freeze({
     VAULT_PROMOTE_TARGET_REFUSED: 'vault_promote_target_refused',
     VAULT_PROMOTE_CONCURRENT_EDIT: 'vault_promote_concurrent_edit',
     VAULT_PROMOTE_TRANSPORT_FAILED: 'vault_promote_transport_failed',
+    // vault.mode (Vault Assurance 13-03, D-08/D-14): an unrecognised mode value,
+    // and the standards-mode promote refusal
+    VAULT_MODE_INVALID: 'vault_mode_invalid',
+    // 13-REVIEW WR-01: the mode resolver failed; refused like an invalid value
+    VAULT_MODE_UNRESOLVED: 'vault_mode_unresolved',
+    VAULT_PROMOTE_NOT_APPLICABLE: 'vault_promote_not_applicable',
     // discovery rollup (discovery-v2 Phase 1: D-07/D-08 gate)
     DISCOVERY_ROLLUP_PARSE_FAILED: 'discovery_rollup_parse_failed',
     DISCOVERY_ROLLUP_MISMATCH: 'discovery_rollup_mismatch',
@@ -201,6 +207,8 @@ const ERROR_REASON = Object.freeze({
     DISCOVERY_ELEMENT_SWEEP_FAILED: 'discovery_element_sweep_failed',
     // discovery scope re-baselining (discovery-v2 Phase 5: D-72/D-73 gate)
     DISCOVERY_REBASELINE_CHECK_FAILED: 'discovery_rebaseline_check_failed',
+    // discovery vault context record (PBI 75336)
+    DISCOVERY_VAULT_CHECK_FAILED: 'discovery_vault_check_failed',
     // generic
     USAGE: 'usage',
     UNKNOWN: 'unknown',

package/pp-core/bin/lib/loop-resolver.cjs

@@ -13,7 +13,7 @@
  * Command surface: pp-tools loop render-hooks <point>
  *
  * Exports (three things):
- *   resolveLoopHooks({ point, registry, config }) → { point, activeHooks }
+ *   resolveLoopHooks({ point, registry, config, vaultMode?, recordedArtifacts? }) → { point, activeHooks }
  *   renderLoopHooks(resolved) → markdown string
  *   cmdLoopRenderHooks(cwd, point, raw, options) — I/O entry point
  *
@@ -30,19 +30,17 @@
  */
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
-const { output: coreOutput, error: coreError, ERROR_REASON } = ioMod;
+const { output: coreOutput, error: coreError } = ioMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderModule = require("./config-loader.cjs");
-const { loadConfig, unreadableConfigFiles, describeUnreadableConfig } = configLoaderModule;
+const { loadConfig } = configLoaderModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateModule = require("./capability-state.cjs");
-const { resolveCapabilityRuntimeState } = capabilityStateModule;
+const { resolveCapabilityRuntimeState, vaultModeFilterVerdict, resolveInjectedVaultMode, SEAL_FIELD, sealRenderVerdict, resolveInjectedRecordedArtifacts, resolveInjectedPlatformBindingsPresent, } = capabilityStateModule;
 // ─── Capability-activation engine (single owner for config-key precedence) ────
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityActivationModule = require("./capability-activation.cjs");
 const { _getNestedConfigValue, _readRawConfigKey, _resolveActivationValue, resolveConfigKey } = capabilityActivationModule;
-// ─── Phase ceremony tier (pack 9): `--phase` / `--tier` overlay ───────────────
-const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // ─── Canonical points (derived from LOOP_HOST_CONTRACT — authoritative 12) ───
 // FIX 2: Derive the authoritative canonical set from LOOP_HOST_CONTRACT so it
 // cannot drift from the host contract. CANONICAL_POINTS_FALLBACK is kept as an
@@ -105,7 +103,7 @@ function _getCanonicalPoints(_registry) {
  * resolved against `config`; active iff truthy. Inactive hooks are filtered out.
  */
 function resolveLoopHooks(input) {
-    const { point, registry, config, cwd, capabilityStatesById } = input;
+    const { point, registry, config, cwd, capabilityStatesById, vaultMode, recordedArtifacts, platformBindingsPresent, } = input;
     // Validate point
     const canonicalPoints = _getCanonicalPoints(registry);
     if (!canonicalPoints.includes(point)) {
@@ -124,6 +122,12 @@ function resolveLoopHooks(input) {
     }
     const entryMap = entry;
     const activeHooks = [];
+    // Phase 15 D-02/D-28: the per-hook `vaultMode` filter, one rule owned by
+    // capability-state (`vaultModeFilterVerdict`), evaluated against the injected
+    // mode VALUE. The field is read here and never copied into an ActiveHook.
+    function modeOk(hook, kind) {
+        return vaultModeFilterVerdict(hook['vaultMode'], kind, vaultMode);
+    }
     // Helper: check activation using single-key precedence resolver (FIX 1 + FIX 3)
     function isActive(hook) {
         const when = hook['when'];
@@ -150,6 +154,59 @@ function resolveLoopHooks(input) {
         // `=== true` is the correct fail-closed check (not `!== false`).
         return state.active === true;
     }
+    // Phase 16 D-19: the state the seal rule reads for a gate's capability. With
+    // no state map at all, every capability is treated as active, exactly as
+    // `isCapabilityActive` does: normal gates keep today's behaviour and a seal
+    // gate drops (it never renders while its capability is active). With a map,
+    // a missing entry is `undefined`, which the rule drops (fail closed).
+    function gateStateOf(capId) {
+        if (!capabilityStatesById)
+            return { enabled: true, active: true };
+        return capabilityStatesById instanceof Map
+            ? capabilityStatesById.get(capId)
+            : capabilityStatesById[capId];
+    }
+    // Phase 16 D-19 / T-16-33: the injected predicate is asked at most once per
+    // resolve, however many seal gates the point declares. An absent thunk is
+    // the inert answer (no seal renders).
+    let recordedArtifactsMemo;
+    function recordedArtifactsOnce() {
+        if (recordedArtifactsMemo === undefined) {
+            recordedArtifactsMemo = resolveInjectedRecordedArtifacts(recordedArtifacts);
+        }
+        return recordedArtifactsMemo;
+    }
+    // Quick 261015-ect (QD-13): the bindings measurement, asked at most once per
+    // resolve and only for a capability that declares it needs the file. A
+    // missing thunk is `null` (unmeasured), which drops nothing.
+    let bindingsPresentMemo;
+    function bindingsPresentOnce() {
+        if (bindingsPresentMemo === undefined) {
+            bindingsPresentMemo = resolveInjectedPlatformBindingsPresent(platformBindingsPresent);
+        }
+        return bindingsPresentMemo;
+    }
+    function requiresBindings(capId) {
+        // Prototype-pollution guard (inline literal, CodeQL barrier), as the
+        // registry generator guards capability ids.
+        if (capId === '' || capId === '__proto__' || capId === 'constructor' || capId === 'prototype')
+            return false;
+        const caps = registry['capabilities'];
+        if (!caps || typeof caps !== 'object' || Array.isArray(caps))
+            return false;
+        if (!Object.prototype.hasOwnProperty.call(caps, capId))
+            return false;
+        const cap = caps[capId];
+        if (!cap || typeof cap !== 'object')
+            return false;
+        return cap['requiresPlatformBindings'] === true;
+    }
+    // A capability that requires bindings renders nothing where the file is
+    // MEASURED absent: the project is not governed by it (its own description says
+    // it is inert unless the bindings exist).
+    function droppedForBindings(capId) {
+        return requiresBindings(capId) && bindingsPresentOnce() === false;
+    }
     // Helper: safe string array
     function toStringArray(v) {
         if (!Array.isArray(v))
@@ -201,6 +258,10 @@ function resolveLoopHooks(input) {
         const capId = typeof hook['capId'] === 'string' ? hook['capId'] : '';
         if (!isCapabilityActive(capId))
             continue;
+        if (droppedForBindings(capId))
+            continue;
+        if (!modeOk(hook, 'step'))
+            continue;
         if (!isActive(hook))
             continue;
         const ref = (typeof hook['ref'] === 'object' && hook['ref'] !== null)
@@ -235,6 +296,10 @@ function resolveLoopHooks(input) {
         const capId = typeof hook['capId'] === 'string' ? hook['capId'] : '';
         if (!isCapabilityActive(capId))
             continue;
+        if (droppedForBindings(capId))
+            continue;
+        if (!modeOk(hook, 'contribution'))
+            continue;
         if (!isActive(hook))
             continue;
         const into = typeof hook['into'] === 'string' ? hook['into'] : undefined;
@@ -268,9 +333,24 @@ function resolveLoopHooks(input) {
         if (!hook || typeof hook !== 'object')
             continue;
         const capId = typeof hook['capId'] === 'string' ? hook['capId'] : '';
-        if (!isCapabilityActive(capId))
+        // Quick 261015-ect (QD-13): gates too, seal gates included. A project with
+        // no bindings holds no engine-written vault records (D-37/D-42), and every
+        // vault gate already answers inert there, so nothing is left ungated.
+        if (droppedForBindings(capId))
             continue;
-        if (!isActive(hook))
+        // Phase 16 D-19 / research C-1: the mode filter runs FIRST, so a
+        // mode-filtered seal gate never consults the recorded-artifacts predicate
+        // (a default standards project pays no planning-tree read for a seal it
+        // cannot render). `modeOk` is pure, so the order changes no other result.
+        if (!modeOk(hook, 'gate'))
+            continue;
+        const verdict = sealRenderVerdict(hook[SEAL_FIELD], gateStateOf(capId), recordedArtifactsOnce);
+        if (verdict === 'drop')
+            continue;
+        // 'normal': today's path, `when` evaluated. 'seal': the `when` IS the
+        // switch that is off (D-18), so it is not read; the seal rule already
+        // required an enabled, config-inactive capability and recorded artifacts.
+        if (verdict === 'normal' && !isActive(hook))
             continue;
         const when = typeof hook['when'] === 'string' ? hook['when'] : undefined;
         const check = hook['check'] !== undefined ? hook['check'] : undefined;
@@ -396,20 +476,39 @@ function renderLoopHooks(resolved) {
  * pre-cutover keys like `workflow.ui_phase` that live in config.json but are not
  * yet exposed through loadConfig's whitelist.
  *
- * --active-cap <capId>: when present, resolves hooks for <point> exactly as the
- * normal path does, then prints exactly `true` (if any resolved activeHook has
- * capId === <capId>) or `false` followed by a single newline, and exits 0.
+ * --active-cap <capId>: when present, resolves hooks for <point> as the normal
+ * path does EXCEPT for one input — the bindings measurement (quick 261015-ect,
+ * QD-13) is not applied — then prints exactly `true` (if any resolved
+ * activeHook has capId === <capId>) or `false` followed by a single newline,
+ * and exits 0. So on a project with no `.platform-bindings.json` it still
+ * answers the config switch alone: /pp-init Step 2.6's unbound arm ("a
+ * resolving profile with no bindings halts loudly") is reachable only because
+ * this read ignores bindings (16-16 D-81), and the D-28 parity test states
+ * parity on bindings-present shapes only.
  * No JSON envelope is emitted — output is clean for shell $(…) capture.
  * Missing <capId> value → coreError + non-zero exit.
  * Unknown/inactive capId → `false` (not an error).
  *
- * --phase <N> [--tier light|standard|heavy] (pack 9): resolve the phase's
- * ceremony tier (src/phase-tier.cts) and overlay its gate booleans
- * (`workflow.research`, `workflow.pattern_mapper`, …) on the config snapshot
- * BEFORE capability state and hook activation read it, so every `when` /
- * activation key of those gates answers the tier-resolved value. Without
- * `--phase` the project's own booleans are read as before (an explicitly
- * invoked gate command such as /pp-secure-phase is not governed by a tier).
+ * --into <role> (Phase 15 D-12/D-30): resolves exactly as the normal path does,
+ * then prints the `fragment.inline` text of each active contribution whose
+ * `into` equals <role>, in resolved order, separated by one blank line, with a
+ * trailing newline when anything printed. Nothing at all (empty stdout, exit
+ * 0) when no contribution matches. No JSON envelope; `--raw` is ignored. This
+ * is the text execute-phase interpolates verbatim into a spawn prompt (15-09).
+ * `--active-cap` takes precedence: given both, `--into` is ignored.
+ *
+ * options.resolveVaultMode: an injected `() => mode | null` (pp-tools builds it
+ * on vaultModeVerdict). This module never imports vault code (D-02).
+ *
+ * options.resolveRecordedArtifacts: an injected `() => boolean` (pp-tools builds
+ * it on the seal leaf's hasRecordedVaultArtifacts); only literal `true` lets a
+ * seal gate render (Phase 16 D-19). `--active-cap <cap>` also requires the
+ * capability's own state to be active (D-27).
+ *
+ * options.resolvePlatformBindingsPresent: an injected `() => boolean` (pp-tools
+ * builds it on the vault leaf's hasPlatformBindings); only literal `false`
+ * drops a `requiresPlatformBindings` capability's hooks (QD-13). `--into` and
+ * the envelope read the filtered set; `--active-cap` reads the unfiltered one.
  */
 function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     if (!point) {
@@ -422,18 +521,10 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
         coreError('--active-cap requires a <capId> value (e.g. --active-cap tdd)');
         return;
     }
-    // Fail closed on a config that exists but cannot be read. Every hook's `when`
-    // and activation key is read from it, and both readers below swallow a parse
-    // failure into the defaults, so rendering anyway drops exactly the hooks the
-    // project switched on — a required client vault's fetch and blocking gate
-    // among them — and exits 0. A MISSING config is not refused: that is a fresh
-    // project, and the defaults are its real settings. stdout stays empty so a
-    // host capturing `$(…)` never reads a refusal as "no hooks".
-    const unreadable = unreadableConfigFiles(cwd);
-    if (unreadable.length > 0) {
-        coreError(`loop render-hooks ${point} refused: the project config cannot be read, so no hook can be resolved ` +
-            `(rendering anyway would silently drop every hook the config switches on, a required client vault among them). ` +
-            `${describeUnreadableConfig(unreadable)}. Repair or remove the file, then re-run. Stop this workflow here.`, ERROR_REASON.CONFIG_PARSE_FAILED);
+    // --into <role> mode: emit matching contribution fragment text only
+    const intoRole = typeof options['into'] === 'string' ? options['into'] : undefined;
+    if (activeCapId === undefined && intoRole !== undefined && intoRole === '') {
+        coreError('--into requires a <role> value (e.g. --into executor)');
         return;
     }
     const runtimeConfigDir = typeof options['configDir'] === 'string'
@@ -453,17 +544,6 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     catch {
         config = {};
     }
-    const tierPhase = typeof options['phase'] === 'string' && options['phase'] !== '' ? options['phase'] : null;
-    const tierCli = typeof options['tier'] === 'string' && options['tier'] !== '' ? options['tier'] : null;
-    let phaseTier = null;
-    if (tierPhase !== null || tierCli !== null) {
-        if (tierCli !== null && !['light', 'standard', 'heavy'].includes(tierCli)) {
-            coreError('--tier needs one of light, standard, heavy');
-            return;
-        }
-        phaseTier = (0, phase_tier_cjs_1.resolvePhaseTierForProject)(cwd, tierPhase, tierCli);
-        config = (0, phase_tier_cjs_1.overlayTierGates)(config, phaseTier);
-    }
     const state = resolveCapabilityRuntimeState(cwd, runtimeConfigDir, config);
     // Registry is the static generated module — same object capability-state uses internally.
     // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -472,9 +552,27 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const cap of state.capabilities || []) {
         capabilityStatesById.set(cap.id, cap);
     }
+    // Phase 15 D-02: the vault mode arrives through an injected resolver (pp-tools
+    // passes one built on vaultModeVerdict). A missing resolver, a throw or a
+    // non-mode answer is `null`, the fail-closed undefined mode (D-28).
+    const vaultMode = resolveInjectedVaultMode(options['resolveVaultMode']);
+    // Phase 16 D-19: the recorded-artifacts predicate arrives the same way (pp-tools
+    // passes one built on the seal leaf's hasRecordedVaultArtifacts). The resolver
+    // memoises it and asks it only for an enabled, config-inactive seal gate.
+    const resolveRecordedArtifacts = options['resolveRecordedArtifacts'];
+    const recordedArtifacts = () => resolveInjectedRecordedArtifacts(resolveRecordedArtifacts);
+    // Quick 261015-ect (QD-13): the bindings measurement arrives the same way
+    // (pp-tools passes one built on the vault leaf's hasPlatformBindings).
+    const resolvePlatformBindingsPresent = options['resolvePlatformBindingsPresent'];
+    const platformBindingsPresent = () => resolveInjectedPlatformBindingsPresent(resolvePlatformBindingsPresent);
     let resolved;
     try {
-        resolved = resolveLoopHooks({ point, registry, config, cwd, capabilityStatesById });
+        // --active-cap reads the UNFILTERED resolution (16-16 D-81, see above):
+        // without the bindings thunk, so it keeps answering the config switch.
+        resolved = resolveLoopHooks({
+            point, registry, config, cwd, capabilityStatesById, vaultMode, recordedArtifacts,
+            ...(activeCapId === undefined ? { platformBindingsPresent } : {}),
+        });
     }
     catch (err) {
         const msg = (err instanceof Error) ? err.message : String(err);
@@ -483,19 +581,37 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     }
     // --active-cap mode: print exactly 'true' or 'false' with no envelope
     if (activeCapId !== undefined) {
-        const isActive = resolved.activeHooks.some((h) => h.capId === activeCapId);
+        // Phase 16 D-27 (research C-3): a hook rendering is no longer enough — the
+        // capability must itself be active. A seal gate renders for a config-
+        // inactive vault-practices, and the doors read `--active-cap` as their
+        // switch, so a seal must never make an inactive capability answer `true`.
+        // Equivalent to the old answer on every input without a seal: a normal
+        // hook renders only for an active capability.
+        const isActive = resolved.activeHooks.some((h) => h.capId === activeCapId)
+            && capabilityStatesById.get(activeCapId)?.active === true;
         process.stdout.write(isActive ? 'true\n' : 'false\n');
         return;
     }
+    // --into mode: fragment text of the active contributions targeting <role>
+    if (intoRole !== undefined) {
+        const texts = [];
+        for (const h of resolved.activeHooks) {
+            if (h.kind !== 'contribution' || h.into !== intoRole)
+                continue;
+            if (typeof h.fragment?.inline !== 'string')
+                continue;
+            texts.push(h.fragment.inline);
+        }
+        if (texts.length > 0)
+            process.stdout.write(texts.join('\n\n') + '\n');
+        return;
+    }
     const rendered = renderLoopHooks(resolved);
     const envelope = {
         point: resolved.point,
         activeHooks: resolved.activeHooks,
         rendered,
     };
-    if (phaseTier) {
-        envelope.phase_tier = { phase: tierPhase, tier: phaseTier.tier, source: phaseTier.source, suppressed: phaseTier.suppressed };
-    }
     if (state.warnings && state.warnings.length > 0) {
         envelope.warnings = state.warnings;
     }
@@ -518,6 +634,12 @@ module.exports = {
     // Re-exported for identity parity guard (FIX 2: resolveConfigValues in this module
     // calls resolveConfigKey; exporting it here makes the single-owner contract testable).
     resolveConfigKey,
+    // Re-exported for the same identity pin: the mode-filter rule has one owner,
+    // capability-state.cjs (Phase 15 D-02/D-28).
+    vaultModeFilterVerdict,
+    // Re-exported for the same identity pin: the seal rule has one owner,
+    // capability-state.cjs (Phase 16 D-19).
+    sealRenderVerdict,
     CANONICAL_POINTS_FALLBACK,
     CANONICAL_POINTS,
 };