@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/init-contract.cjs

@@ -1,116 +1,78 @@
 "use strict";
-/**
- * src/init-contract.cts — the `/pp-init` question set and end-state
- * invariant check, as code (milestone v1.11.0, Phase 34-07, gap closure).
- *
- * ADR-457 build-at-publish: this TypeScript file is the SOURCE OF TRUTH. It
- * compiles to the git-ignored `pp-core/bin/lib/init-contract.cjs`; do NOT
- * hand-edit the compiled output. Behaviour is locked by
- * `tests/init-contract.test.cjs`.
- *
- * Born from a documented failure, not a speculative hardening. Two human
- * UAT walks of `/pp-init` (`34-VALIDATION.md` § Manual-Only Verifications,
- * `34-05-SUMMARY.md`) found that prose-driven load-bearing behaviour — a
- * question set that must not shrink, a step that must not be skippable, a
- * config key that must be set — is not reliably enforced by an executing
- * agent re-interpreting Markdown, even after two escalating rounds of
- * explicit in-file hardening. `buildInitQuestions` moves the canonical
- * question set (and the provider option list, derived from `PROVIDERS`
- * rather than retyped) out of prose into tested data; `verifyInitInvariants`
- * inspects the RESULTING project state after init runs, rather than
- * trusting that any one step announced itself — enforcement placed inside
- * the step it protects does not constrain an agent that skips the step
- * entirely (see `34-VALIDATION.md`'s diagnosis).
- *
- * Both functions are read-only and never throw. `verifyInitInvariants`
- * calls `composeBindings` in offline mode to answer "was a composable
- * binding ever produced" — this module therefore sits ABOVE
- * `src/compose-bindings.cts` in the CommonJS graph. Nothing in
- * `compose-bindings.cts`, `git-provider.cts` or `org-profile.cts` imports
- * this module, at load time or lazily, so this introduces no require cycle.
- *
- * This module's own prose deliberately never names a concrete org profile
- * package or client, matching the convention `src/org-profile.cts` and
- * `src/compose-bindings.cts` both state in their own headers.
- *
- * Residual risk, stated plainly (see the plan's threat register): nothing
- * here prevents an agent from declining to call this arm at all.
- * `buildInitQuestions` makes the rendered content correct when called;
- * `verifyInitInvariants` makes the omission provable afterwards, by
- * inspecting state `init.md` cannot avoid leaving behind. It does not make
- * step-skipping impossible.
- */
+/** The `/pp-init` question set, session state machine and end-state invariant check, as tested code.
+ * Compiled to the git-ignored `pp-core/bin/lib/init-contract.cjs` — never hand-edit the output. */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INIT_SESSION_WRITE_FAILED = exports.INIT_SESSION_MALFORMED = exports.INIT_CONTRACT_FLAGS = exports.INIT_ORG_PROFILE_DECLINED_KEY = exports.INIT_COMPOSE_DECLINED_KEY = void 0;
+exports.INIT_SESSION_WRITE_FAILED = exports.INIT_SESSION_MALFORMED = exports.INIT_CONTRACT_FLAGS = exports.INIT_PROBE_STATUS = exports.INIT_PROBE_NOTE_KEY = exports.INIT_PROBE_WHO_KEY = exports.INIT_PROBE_WHEN_KEY = exports.INIT_PROBE_STATUS_KEY = exports.INIT_ORG_PROFILE_DECLINED_KEY = exports.INIT_COMPOSE_DECLINED_KEY = void 0;
+exports.resolveVaultEnabledState = resolveVaultEnabledState;
+exports.resolveVaultPracticesEnabledState = resolveVaultPracticesEnabledState;
+exports.resolveVaultRequiredState = resolveVaultRequiredState;
+exports.readVaultEnabledState = readVaultEnabledState;
+exports.readVaultPracticesEnabledState = readVaultPracticesEnabledState;
+exports.readVaultStandardsModeActive = readVaultStandardsModeActive;
+exports.readVaultRequiredState = readVaultRequiredState;
 exports.buildInitQuestions = buildInitQuestions;
+exports.deriveSlug = deriveSlug;
+exports.readProfileInitAnswers = readProfileInitAnswers;
 exports.verifyInitInvariants = verifyInitInvariants;
+exports.armVaultKeysWhereAbsent = armVaultKeysWhereAbsent;
+exports.recordProbeOutcome = recordProbeOutcome;
+exports.recordProbeDeferral = recordProbeDeferral;
 exports.initSessionNext = initSessionNext;
 exports.initSessionAnswer = initSessionAnswer;
 exports.initSessionReset = initSessionReset;
-exports.armVault = armVault;
+exports.armVaultFromProfile = armVaultFromProfile;
 exports.cmdInitContract = cmdInitContract;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 const { output } = io;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const capabilityActivation = require("./capability-activation.cjs");
 const git_provider_cjs_1 = require("./git-provider.cjs");
 const org_profile_cjs_1 = require("./org-profile.cjs");
+const platform_bindings_cjs_1 = require("./platform-bindings.cjs");
 const compose_bindings_cjs_1 = require("./compose-bindings.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // ─── Constants ───────────────────────────────────────────────────────────────
-/**
- * The dotted `.planning/config.json` key `/pp-init` Step 2.5 sets when the
- * operator explicitly declines the compose-and-write confirmation. This is
- * the ONLY signal that distinguishes "the operator was asked and said no"
- * from "the step never ran at all" — both leave `.platform-bindings.json`
- * absent, and `verifyInitInvariants` cannot tell them apart any other way
- * (see `INVARIANT_CODE.COMPOSITION_NOT_RUN` below). Registered as a
- * `vault` capability config key (`capabilities/vault/capability.json`) so
- * `pp-tools config-set` accepts it without the "unknown config key" error
- * a bare unregistered top-level namespace would trip.
- */
+/** Set when the operator declines `compose_confirm` — the only way to tell "declined" from "never ran". */
 exports.INIT_COMPOSE_DECLINED_KEY = 'init.compose_declined';
-/**
- * The dotted `.planning/config.json` key `pp-tools init` sets when the
- * operator is offered a detected org profile and SKIPS it — a blank answer or
- * `none` in any letter case. It is the only signal that tells "offered a
- * detected profile and skipped it" from "the question never ran": both leave
- * `org.profile` unset, and without it `verifyInitInvariants` reported every
- * deliberate skip as `INIT_QUESTIONS_ORG_PROFILE_UNASKED`. Written by
- * `initSessionAnswer` only when a profile was detectable (the predicate the
- * violation reads), read back with strict boolean identity, and written back
- * to `false` when a later run selects a profile. Registered under the
- * `vault` capability so `config-set` accepts it. Kept OFF
- * `ORG_PROFILE_ALLOWLIST`: a profile package must never answer the question
- * about itself.
- */
+/** Legacy upstream marker for a skipped org profile; nothing writes it any more, kept registered so old configs load. */
 exports.INIT_ORG_PROFILE_DECLINED_KEY = 'init.org_profile_declined';
-/** The identity-only choices appended after the provider seam's own
- * `PROVIDERS` list — never retyped ahead of `PROVIDERS` itself (T-34-50). */
-const IDENTITY_ONLY_PROVIDER_OPTIONS = Object.freeze(['github', 'other', 'none']);
-/** Bounds the `node_modules` scan `verifyInitInvariants` runs to answer
- * "could an org profile package have been pointed to" — a DoS guard, the
- * same convention `src/org-profile.cts`'s `PROFILE_FLATTEN_LEAF_CAP` and
- * `PROFILE_FLATTEN_DEPTH_CAP` use for the analogous profile-document walk. */
-const NODE_MODULES_SCAN_CAP = 2000;
+/** The /pp-init Step 2.6 reachability-proof record (status, when, who, note), read back by `--verify`.
+ * Registered vault config keys; never profile-settable and not for operator editing. */
+exports.INIT_PROBE_STATUS_KEY = 'init.probe_status';
+/** ISO-8601 UTC instant the record was written. See `INIT_PROBE_STATUS_KEY`. */
+exports.INIT_PROBE_WHEN_KEY = 'init.probe_when';
+/** Who recorded the proof; never empty (falls back to the literal `unknown`). */
+exports.INIT_PROBE_WHO_KEY = 'init.probe_who';
+/** The bounded human note: the probe's own summary on `passed`/`failed`, the
+ * operator's stated reason on `deferred`. See `INIT_PROBE_STATUS_KEY`. */
+exports.INIT_PROBE_NOTE_KEY = 'init.probe_note';
+/** Probe status vocabulary; `deferred` is only recordable through `recordProbeDeferral`, which requires a reason. */
+exports.INIT_PROBE_STATUS = Object.freeze({
+    PASSED: 'passed',
+    FAILED: 'failed',
+    DEFERRED: 'deferred',
+});
+/** Provider choices that only record identity, appended after `PROVIDERS` (never a retyped copy of it). */
+const IDENTITY_ONLY_PROVIDER_OPTIONS = Object.freeze(['other', 'none']);
 const INVARIANT_CODE = Object.freeze({
-    ORG_PROFILE_UNASKED: 'INIT_QUESTIONS_ORG_PROFILE_UNASKED',
     COMPOSITION_NOT_RUN: 'INIT_COMPOSITION_NOT_RUN',
     VAULT_PROVIDER_UNSET: 'INIT_VAULT_PROVIDER_UNSET',
     IDENTITY_MISSING: 'INIT_IDENTITY_MISSING',
+    /** Reachability proof never run, failed, or consciously deferred — three states that need three different responses. */
+    PROBE_NOT_RUN: 'INIT_PROBE_NOT_RUN',
+    PROBE_FAILED: 'INIT_PROBE_FAILED',
+    PROBE_DEFERRED: 'INIT_PROBE_DEFERRED',
+    /** `vault.enabled` is present but not a JSON boolean, so the activation resolver and the proof check disagree. */
+    VAULT_ENABLED_MALFORMED: 'INIT_VAULT_ENABLED_MALFORMED',
 });
-/** The recognized flag set for the `init-contract` CLI arm (the
- * `pp-tools.cjs` fail-fast unrecognized-flag guard reads this, mirroring
- * `COMPOSE_BINDINGS_FLAGS`). Extended by Task 2 (34-08 gap closure) with the
- * session relay flags — `--session-answer` additionally consumes the next
- * argv token as its `<stepId>=<value>` payload (parsed in `pp-tools.cjs`,
- * mirroring the `--cwd`/`--pick` convention), and `--offline` forwards to
- * every `composeBindings` call the session makes so a CLI-driven loop can
- * run with no network access — parity with `compose-bindings --offline`. */
+/** Flags the `init-contract` CLI arm accepts; `--session-answer`, `--record-probe` and `--defer-probe` take the next token as payload.
+ * `--arm-vault` (quick 261003-kmd) is the non-interactive compose-and-arm `/pp-new-project` calls. */
 exports.INIT_CONTRACT_FLAGS = Object.freeze([
     '--questions',
     '--verify',
@@ -118,39 +80,21 @@ exports.INIT_CONTRACT_FLAGS = Object.freeze([
     '--session-answer',
     '--session-reset',
     '--offline',
+    '--record-probe',
+    '--defer-probe',
     '--arm-vault',
 ]);
-/** `.planning/.init-session.json` — the CLI-owned session state file
- * (Artifacts table, 34-08). Never hand-edited; malformed content is
- * refused, not silently repaired (T-34-63). */
+/** CLI-owned session state file; malformed content is refused, never repaired. */
 const INIT_SESSION_FILE_NAME = '.init-session.json';
-/** The `error` code `initSessionNext`/`initSessionAnswer` report when the
- * session file exists but does not parse as valid session state — the ONLY
- * recovery is `--session-reset` (T-34-63); this module never resumes a
- * malformed file into a guessed-at state. */
+/** Reported when the session file is malformed; the only recovery is `--session-reset`. */
 exports.INIT_SESSION_MALFORMED = 'INIT_SESSION_MALFORMED';
-/** CR-01: the `error`/`reason` code `initSessionNext`/`initSessionAnswer`
- * report when a filesystem write this module performs (`persistSession`,
- * `writeConfigMerge`, the write-mode `composeBindings` call) fails — e.g. an
- * unwritable `.planning` directory (permissions, a read-only mount, a full
- * disk). Every sibling module in this seam (`composeBindings`,
- * `resolveOrgProfileDocument`, `resolveOrgProfile`, `verifyInitInvariants`)
- * never throws and degrades to a bounded data verdict instead (D-09); this
- * module previously did not follow that convention on its write paths and
- * let the exception escape uncaught. Recovery is to fix the underlying
- * filesystem issue and retry the same step — nothing is left half-recorded,
- * since the throw is caught before `session` is persisted. */
+/** Reported when a session write fails (e.g. an unwritable `.planning`); fix the cause and retry the same step. */
 exports.INIT_SESSION_WRITE_FAILED = 'INIT_SESSION_WRITE_FAILED';
-/** compose_confirm's answer vocabulary — deliberately permissive so a human
- * relaying through `AskUserQuestion`/TEXT_MODE can answer naturally; every
- * other string is rejected (never silently treated as a decline). */
+/** `compose_confirm` answers; anything else is rejected, never treated as a decline. */
 const YES_VALUES = Object.freeze(['yes', 'y', 'approve', 'approved', 'true']);
 const NO_VALUES = Object.freeze(['no', 'n', 'decline', 'declined', 'false']);
-/** Maps each of the 7 identity/provider/visibility question ids (every
- * question but `org_profile`, which is written immediately on answer — see
- * `initSessionAnswer` — so the very next question, `provider`, can
- * re-resolve its `preselected` against it) to the short key it is written
- * under inside `.planning/config.json`'s `project` block. */
+/** Maps each of the 7 identity/provider/visibility question ids to the short
+ * key it is written under inside `.planning/config.json`'s `project` block. */
 const PROJECT_BLOCK_QUESTION_MAP = Object.freeze({
     project_name: 'name',
     project_slug: 'slug',
@@ -160,9 +104,7 @@ const PROJECT_BLOCK_QUESTION_MAP = Object.freeze({
     provider: 'provider',
     visibility: 'visibility',
 });
-// ─── Small local helpers (deliberate per-module duplication — this repo's
-// established convention for small, cycle-risk-free helpers; see
-// `src/git-provider.cts`'s `cfgGet` for the canonical example) ────────────────
+// ─── Small local helpers (duplicated per module to avoid require cycles) ──────────
 function isObject(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
 }
@@ -172,35 +114,143 @@ function isUsableString(v) {
 function getDotted(obj, dottedPath) {
     return dottedPath.split('.').reduce((cur, key) => (isObject(cur) ? cur[key] : undefined), obj);
 }
-// ─── buildInitQuestions ────────────────────────────────────────────────────
+/** Arms the vault capability; written by the session machine, never by an org profile. */
+const VAULT_ENABLED_CONFIG_KEY = 'vault.enabled';
+/** Arms vault-practices; set beside `vault.enabled` under the same absent-only rule, inert without it. */
+const VAULT_PRACTICES_ENABLED_CONFIG_KEY = 'vault.practices_enabled';
+/** The single reading of `vault.enabled` in this module, in the form the gate honours
+ * (`resolveGateHonouredKeyState`, Phase 15 D-32). `value` is the observed value, never a
+ * coercion, so reports name what is really in the file. */
+function resolveVaultEnabledState(parsed) {
+    return resolveGateHonouredKeyState(parsed, VAULT_ENABLED_CONFIG_KEY);
+}
+/** Four-state reading of `vault.practices_enabled`, like `resolveVaultEnabledState`. */
+function resolveVaultPracticesEnabledState(parsed) {
+    return resolveGateHonouredKeyState(parsed, VAULT_PRACTICES_ENABLED_CONFIG_KEY);
+}
+/** Four-state reading of the project's OWN `vault.required` (not the profile-layered gate value),
+ * so the arming guard respects an explicit per-project `false`. */
+function resolveVaultRequiredState(parsed) {
+    return resolveBooleanKeyState(parsed, org_profile_cjs_1.VAULT_REQUIRED_CONFIG_KEY);
+}
+/** Classify a PRESENT value into the three present states. */
+function classifyPresentValue(value) {
+    if (value === true)
+        return { state: 'armed', value };
+    if (value === false)
+        return { state: 'off', value };
+    return { state: 'malformed', value };
+}
+/** Either-form four-state reader. Used for `vault.required`, whose gate-side ladder
+ * (`resolveVaultRequired`, `src/org-profile.cts`) reads both key forms. */
+function resolveBooleanKeyState(parsed, key) {
+    const hit = capabilityActivation.getConfigValueEitherForm(parsed, key);
+    if (hit.found !== true)
+        return { state: 'absent', value: undefined };
+    return classifyPresentValue(hit.value);
+}
 /**
- * The canonical `/pp-init` question set, as data. `init.md` renders exactly
- * what this returns, in the order returned, none merged, reordered or
- * dropped — see the module header for why this moved out of prose.
- *
- * Question 6 (`org_profile`) is the org profile pointer, marked
- * `optionalAnswer: true` — that flag describes the ANSWER (pressing Enter
- * is a complete, valid response), never whether the question is asked.
+ * Four-state reading of a vault switch whose gates read ONLY the nested form (Phase 15
+ * D-32): `vault.enabled` and `vault.practices_enabled`. `loadConfig` materialises their
+ * nested defaults, so the gates' evaluator answers at its first level and never reaches a
+ * hand-written FLAT key (it warns that the key is ignored). Reading the flat form as
+ * `armed` therefore told /pp-init that a switch was on while no gate rendered. The
+ * absent-only arming then skipped it, and the done line promised governance nobody
+ * enforced (todo init-practices-reader-reads-flat-form-as-armed).
  *
- * Question 6 (`org_profile`) names a HINT, never a default: when
- * `resolveDetectedOrgProfile` finds exactly one org-profile-shaped package
- * installed (INIT-PATCH-C), the prompt names it, Enter skips, and typing its
- * name (or any other) selects it — the question carries no `preselected`.
- * The prompt text is built from that detected value rather than kept as two
- * hard-coded strings that can drift.
- * `opts._globalRoot` is forwarded to it unchanged, the same test-seam
- * convention `verifyInitInvariants`'s own `_globalRoot` already follows —
- * production callers omit it.
- *
- * Question 7 (`provider`) carries the fixed, complete option list: every
- * value in `PROVIDERS` (imported, never retyped — this is what keeps
- * `azure` from being silently dropped again, T-34-50) plus the three
- * identity-only choices. `preselected` is resolved via `resolveProvider`,
- * the same authority the `compose-bindings --offline --pick provider`
- * probe reads (pure config + org-profile consultation, no network) — so
- * calling it directly here is equivalent, not a second implementation.
+ *   - nested present: its value decides, exactly as before;
+ *   - flat-only `true`: `absent`, because the gate sees nothing. The arming writes the
+ *     canonical nested key, which is what the operator asked for;
+ *   - flat-only `false`: `off`. The gate reads off too, and an explicit false is never
+ *     overwritten (07-09 WR-07);
+ *   - flat-only anything else: `malformed`, kept and reported, never repaired.
+ */
+function resolveGateHonouredKeyState(parsed, key) {
+    const nested = capabilityActivation._getNestedConfigValue(parsed, key);
+    if (nested.found === true)
+        return classifyPresentValue(nested.value);
+    const flat = capabilityActivation._getFlatConfigValue(parsed, key);
+    if (flat.found !== true || flat.value === true)
+        return { state: 'absent', value: undefined };
+    return classifyPresentValue(flat.value);
+}
+/** The vault adapter's gate-side readers, required lazily: pp-tools loads this module on
+ * every command and the vault adapter is large. vault.cjs never requires this module, so
+ * there is no cycle. */
+function vaultGateReaders() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+    const vault = require('./vault.cjs');
+    return vault;
+}
+/** Ask one gate-side reader; any throw (including the require) reads as OFF. */
+function gateReadsOn(read) {
+    try {
+        return read(vaultGateReaders()) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The project-at-`cwd` reading the done line prints from (Phase 15 D-32): `armed` exactly
+ * when the gate-side reader is ON, so the line can never name a switch the gates do not
+ * honour. The root file's own four-state reading supplies everything else.
+ *   - gate ON, root armed → the root reading;
+ *   - gate ON, root not armed → `armed` (another config layer, a workstream config, arms
+ *     it; `value` is the gate's reading, `true`);
+ *   - gate OFF, root armed → `off` (a workstream config overrides it, or the active
+ *     workstream has no config); `value` stays the root's;
+ *   - gate OFF otherwise → the root reading (absent, off or malformed).
  */
-function buildInitQuestions(cwd, opts = {}) {
+function agreeWithGate(root, gateOn) {
+    if (gateOn)
+        return root.state === 'armed' ? root : { state: 'armed', value: true };
+    return root.state === 'armed' ? { state: 'off', value: root.value } : root;
+}
+/** The root config file's four-state reading through `resolve`; unreadable reads as `absent`. */
+function readRootKeyState(cwd, resolve) {
+    try {
+        const { parsed } = readConfigFile(cwd);
+        return resolve(parsed);
+    }
+    catch {
+        return { state: 'absent', value: undefined };
+    }
+}
+/** `vault.enabled` for the project at `cwd`: `armed` exactly when `isVaultGateActive` is
+ * (`agreeWithGate`); an unreadable config reads as `absent`. Never throws. */
+function readVaultEnabledState(cwd) {
+    return agreeWithGate(readRootKeyState(cwd, resolveVaultEnabledState), gateReadsOn((v) => v.isVaultGateActive(cwd)));
+}
+/** `vault.practices_enabled` for the project at `cwd`: `armed` exactly when
+ * `isPracticesGateActive`, the one practices-switch reader (15-02), is ON. Never throws. */
+function readVaultPracticesEnabledState(cwd) {
+    return agreeWithGate(readRootKeyState(cwd, resolveVaultPracticesEnabledState), gateReadsOn((v) => v.isPracticesGateActive(cwd)));
+}
+/**
+ * Whether the project at `cwd` is in standards mode, asked of the one mode owner
+ * (`isStandardsModeActive`, which honours the org-profile ladder). The /pp-init done line
+ * uses it so that, in standards mode, it names the standards record the `vault.trace`
+ * gate checks instead of practice recording, which standards mode does not do
+ * (15-REVIEW WR-09). Any throw reads as not standards. Never throws.
+ */
+function readVaultStandardsModeActive(cwd) {
+    return gateReadsOn((v) => v.isStandardsModeActive(cwd));
+}
+/** `vault.required` for the project at `cwd`: `armed` exactly when the load gate's own
+ * answer (`resolveVaultRequiredFlag`) is true. Never throws. */
+function readVaultRequiredState(cwd) {
+    return agreeWithGate(readRootKeyState(cwd, resolveVaultRequiredState), gateReadsOn((v) => v.resolveVaultRequiredFlag(cwd)));
+}
+/** True only for the JSON boolean `true` — a truthy string does not count.
+ * A non-boolean value is reported by `verifyInitInvariants` as `INIT_VAULT_ENABLED_MALFORMED`. */
+function isVaultEnabledInConfig(parsed) {
+    return resolveVaultEnabledState(parsed).state === 'armed';
+}
+// ─── buildInitQuestions ────────────────────────────────────────────────────
+/** The canonical /pp-init question set, as data; the session may answer some itself (see "Automatic answers").
+ * No org-profile question in this fork (PBI 74316); provider options come from `PROVIDERS`, preselected via `resolveProvider`. */
+function buildInitQuestions(cwd) {
     let preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     try {
         preselected = (0, git_provider_cjs_1.resolveProvider)(cwd).provider;
@@ -209,31 +259,6 @@ function buildInitQuestions(cwd, opts = {}) {
         preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     }
     const providerOptions = Object.freeze([...git_provider_cjs_1.PROVIDERS, ...IDENTITY_ONLY_PROVIDER_OPTIONS]);
-    const detectedOrgProfile = resolveDetectedOrgProfile(cwd, opts);
-    // The template example is written as an angle-bracket placeholder, not a
-    // literal package name. `tests/org-profile.test.cjs`'s client-confidentiality
-    // guard scans this file for any concrete scope-slash-org-prefix package
-    // identifier, so even a generic literal placeholder trips it — the template
-    // keeps the naming convention visible while staying clean, and the guard
-    // stays maximally strict, no allowlist entry was added for it. The detected
-    // value itself is never a literal in this file — it is a runtime string
-    // read from an installed package, interpolated into the prompt below.
-    // A detected profile is a HINT, never a default: no `preselected`, so a
-    // profile installed on the operator's machine (perhaps another client's)
-    // never becomes a project's binding by pressing Enter. Enter skips (and
-    // `initSessionAnswer` records the skip); typing the name selects it.
-    const orgProfileQuestion = isUsableString(detectedOrgProfile)
-        ? {
-            id: 'org_profile',
-            prompt: `Org profile package (optional — "${detectedOrgProfile}" is installed: type its name to use it, ` +
-                'or press Enter to skip)',
-            optionalAnswer: true,
-        }
-        : {
-            id: 'org_profile',
-            prompt: 'Org profile package (optional — press Enter to skip, e.g. "@<your-scope>/org-<name>")',
-            optionalAnswer: true,
-        };
     return [
         { id: 'project_name', prompt: 'Project name (human-readable, e.g. "Acme Dashboard")', optionalAnswer: false },
         { id: 'project_slug', prompt: 'Project slug (kebab-case, e.g. "acme-dashboard")', optionalAnswer: false },
@@ -248,7 +273,6 @@ function buildInitQuestions(cwd, opts = {}) {
             optionalAnswer: false,
         },
         { id: 'description', prompt: 'One-line description (what this project does)', optionalAnswer: false },
-        orgProfileQuestion,
         {
             id: 'provider',
             prompt: 'Provider (gitlab / azure / github / other / none)',
@@ -260,179 +284,88 @@ function buildInitQuestions(cwd, opts = {}) {
         { id: 'visibility', prompt: 'Visibility (private / public / internal)', optionalAnswer: false },
     ];
 }
-// ─── verifyInitInvariants ───────────────────────────────────────────────────
-/** Conservative npm-package-name shape check (bare `name` or scoped
- * `@scope/name`; lowercase, digits, `.`/`_`/`-`, never leading `.`/`_` in
- * either segment). A directory name that does not match is never offered as
- * a detected default (T-QP-02): it cannot be a resolvable package pointer,
- * so rejecting it here keeps a hostile directory name (control characters,
- * terminal escapes) from ever reaching a rendered prompt. */
-const NPM_PACKAGE_NAME_SHAPE_RE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
-/**
- * Walk `nodeModulesDir` exactly like the boolean check below (one level, or
- * one level inside an `@scope/` directory), collecting the name of every
- * package directory carrying `ORG_PROFILE_DATA_FILE` at its root instead of
- * stopping at the first hit. `opts.limit`, when set, stops the walk once
- * that many names have been collected — passing `1` reproduces the boolean
- * check's early-exit behaviour exactly. Bounded at `NODE_MODULES_SCAN_CAP`
- * total directory entries visited (T-34-54: this check must never hang on a
- * pathological `node_modules` tree).
- *
- * This is a heuristic, not a resolution: it answers "a package shaped like
- * an org profile is installed here", not "this exact profile would
- * resolve" — callers never claim more than that.
- */
-function collectOrgProfileShapedPackages(nodeModulesDir, opts = {}) {
-    const names = [];
-    let visited = 0;
-    const limitReached = () => opts.limit !== undefined && names.length >= opts.limit;
-    const addIfShaped = (name) => {
-        if (NPM_PACKAGE_NAME_SHAPE_RE.test(name))
-            names.push(name);
-    };
-    let entries;
-    try {
-        entries = node_fs_1.default.readdirSync(nodeModulesDir, { withFileTypes: true });
-    }
-    catch {
-        return { names, capped: false };
-    }
-    for (const entry of entries) {
-        if (limitReached())
-            return { names, capped: false };
-        if (visited >= NODE_MODULES_SCAN_CAP)
-            return { names, capped: true };
-        visited += 1;
-        if (!entry.isDirectory())
-            continue;
-        if (entry.name.startsWith('@')) {
-            const scopeDir = node_path_1.default.join(nodeModulesDir, entry.name);
-            let scoped;
-            try {
-                scoped = node_fs_1.default.readdirSync(scopeDir, { withFileTypes: true });
-            }
-            catch {
-                continue;
-            }
-            for (const scopedEntry of scoped) {
-                if (limitReached())
-                    return { names, capped: false };
-                if (visited >= NODE_MODULES_SCAN_CAP)
-                    return { names, capped: true };
-                visited += 1;
-                if (!scopedEntry.isDirectory())
-                    continue;
-                try {
-                    if (node_fs_1.default.existsSync(node_path_1.default.join(scopeDir, scopedEntry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE))) {
-                        addIfShaped(`${entry.name}/${scopedEntry.name}`);
-                    }
-                }
-                catch {
-                    continue;
-                }
-            }
-        }
-        else {
-            try {
-                if (node_fs_1.default.existsSync(node_path_1.default.join(nodeModulesDir, entry.name, org_profile_cjs_1.ORG_PROFILE_DATA_FILE))) {
-                    addIfShaped(entry.name);
-                }
-            }
-            catch {
-                continue;
-            }
-        }
+// ─── Automatic answers (PBI 74299): an org profile init section fixes answers and can derive slugs ───
+/** The visibility answers the question accepts. */
+const VISIBILITY_OPTIONS = Object.freeze(['private', 'public', 'internal']);
+/** Longest client name an org profile may fix — the composer's seed-value bound. */
+const INIT_FIXED_VALUE_MAX_LENGTH = 200;
+function hasControlChar(value) {
+    for (let i = 0; i < value.length; i++) {
+        const c = value.charCodeAt(i);
+        if (c <= 0x1f || c === 0x7f)
+            return true;
     }
-    return { names, capped: false };
-}
-/**
- * True when `nodeModulesDir` contains at least one package directory (one
- * level, or one level inside an `@scope/` directory) carrying a file named
- * `ORG_PROFILE_DATA_FILE` at its root — the same fixed filename
- * `resolveOrgProfileDocument` reads, imported rather than retyped. Reduced to
- * the collecting walk above with `limit: 1`, preserving its early-exit
- * behaviour exactly.
- */
-function containsOrgProfileShapedPackage(nodeModulesDir) {
-    return collectOrgProfileShapedPackages(nodeModulesDir, { limit: 1 }).names.length > 0;
+    return false;
 }
-/**
- * The global roots DETECTION scans — the org-profile hint and the UNASKED
- * check — from the one candidate builder in `src/org-profile.cts`, never a
- * private copy (the single-root duplicate that lived here missed every
- * Homebrew layout). `explicitPrefixOnly`: an explicit npm prefix is
- * authoritative, so a hint or a violation never comes from a tree the
- * operator did not point at. The `_globalRoot` seam still wins.
- */
-function detectionGlobalRoots(opts) {
-    return (0, org_profile_cjs_1.globalRootCandidatesFor)({ _globalRoot: opts._globalRoot, explicitPrefixOnly: true });
+/** Derive a slug: diacritics stripped, lowercased, other characters collapsed to "-".
+ * Returns `null` when the result fails `SLUG_RE`, so the slug is asked instead. */
+function deriveSlug(name) {
+    const slug = name
+        .normalize('NFKD')
+        .replace(/[̀-ͯ]/g, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug !== '' && platform_bindings_cjs_1.SLUG_RE.test(slug) ? slug : null;
 }
-function orgProfilePackageResolvable(cwd, opts) {
+/** The validated init section of the org profile; invalid values are dropped so their question is asked. Never throws. */
+function readProfileInitAnswers(cwd, opts = {}) {
+    const none = { fixed: {}, deriveSlugs: false };
     try {
-        const projectNodeModules = node_path_1.default.join(cwd, 'node_modules');
-        if (node_fs_1.default.existsSync(projectNodeModules) && containsOrgProfileShapedPackage(projectNodeModules)) {
-            return true;
+        const doc = (0, org_profile_cjs_1.resolveOrgProfileDocument)(cwd, { _globalRoot: opts._globalRoot });
+        if (!doc.resolved)
+            return none;
+        const section = doc.document[org_profile_cjs_1.ORG_PROFILE_INIT_SECTION];
+        if (!isObject(section))
+            return none;
+        const fixed = {};
+        const clientName = section.client_name;
+        if (typeof clientName === 'string' &&
+            clientName.trim() !== '' &&
+            clientName.length <= INIT_FIXED_VALUE_MAX_LENGTH &&
+            !hasControlChar(clientName)) {
+            fixed.client_name = clientName.trim();
         }
-        for (const globalRoot of detectionGlobalRoots(opts)) {
-            if (containsOrgProfileShapedPackage(globalRoot)) {
-                return true;
-            }
+        const providerOptions = [...git_provider_cjs_1.PROVIDERS, ...IDENTITY_ONLY_PROVIDER_OPTIONS];
+        if (typeof section.provider === 'string' && providerOptions.includes(section.provider.trim())) {
+            fixed.provider = section.provider.trim();
         }
-        return false;
+        if (typeof section.visibility === 'string' && VISIBILITY_OPTIONS.includes(section.visibility.trim())) {
+            fixed.visibility = section.visibility.trim();
+        }
+        return { fixed, deriveSlugs: section.derive_slugs === true };
     }
     catch {
-        return false;
+        return none;
     }
 }
-/**
- * Detect a single, unambiguous installed org-profile-shaped package
- * (INIT-PATCH-C): collects from the project's `node_modules` and — using the
- * same `opts._globalRoot` override convention `orgProfilePackageResolvable`
- * already follows — the global root, de-duplicates by package name across
- * both roots, and returns that single name only when exactly one distinct
- * name was found and NEITHER scan reported `capped`. A capped scan is
- * inconclusive and must never yield a default (T-QP-03). Two or more
- * distinct names, or none, returns null. Never throws.
- */
-function resolveDetectedOrgProfile(cwd, opts) {
-    try {
-        const names = new Set();
-        let anyCapped = false;
-        const projectNodeModules = node_path_1.default.join(cwd, 'node_modules');
-        if (node_fs_1.default.existsSync(projectNodeModules)) {
-            const projectResult = collectOrgProfileShapedPackages(projectNodeModules);
-            if (projectResult.capped)
-                anyCapped = true;
-            for (const name of projectResult.names)
-                names.add(name);
-        }
-        for (const globalRoot of detectionGlobalRoots(opts)) {
-            const globalResult = collectOrgProfileShapedPackages(globalRoot);
-            if (globalResult.capped)
-                anyCapped = true;
-            for (const name of globalResult.names)
-                names.add(name);
-        }
-        if (anyCapped)
-            return null;
-        return names.size === 1 ? [...names][0] : null;
+/** The answer the session fills in itself for question `id`, or `null` to ask it. */
+function autoAnswerFor(id, answers, init) {
+    if (id === 'client_name' || id === 'provider' || id === 'visibility') {
+        const value = init.fixed[id];
+        return value === undefined ? null : { value, source: 'org-profile' };
     }
-    catch {
-        return null;
+    if (init.deriveSlugs && (id === 'project_slug' || id === 'client_slug')) {
+        const name = answers[id === 'project_slug' ? 'project_name' : 'client_name'];
+        const slug = typeof name === 'string' ? deriveSlug(name) : null;
+        return slug === null ? null : { value: slug, source: 'derived' };
     }
+    return null;
 }
-/** The one owner of the org-profile decline rule: a blank answer, or `none`
- * in any letter case with surrounding whitespace, skips the question. Enter
- * in the TTY driver and `--session-answer org_profile=none` / `org_profile=`
- * all end here. */
-function isOrgProfileDecline(value) {
-    const trimmed = value.trim();
-    return trimmed === '' || trimmed.toLowerCase() === 'none';
+/** The session's automatic answers, in question order. */
+function listAutoAnswers(cwd, session) {
+    const sources = session.autoAnswers ?? {};
+    const out = [];
+    for (const q of buildInitQuestions(cwd)) {
+        const source = sources[q.id];
+        const value = session.answers[q.id];
+        if (source !== undefined && typeof value === 'string')
+            out.push({ id: q.id, value, source });
+    }
+    return out;
 }
-/** Read `.planning/config.json` at `cwd`, distinguishing "file absent" from
- * "file present but empty/malformed" — `INIT_IDENTITY_MISSING` only fires
- * on the latter (see `verifyInitInvariants`'s own doc comment for why an
- * absent file must never trip it). Never throws. */
+// ─── verifyInitInvariants ───────────────────────────────────────────────────
+/** Read `.planning/config.json`, telling "absent" from "present but malformed". Never throws. */
 function readConfigFile(cwd) {
     const configPath = node_path_1.default.join(cwd, '.planning', 'config.json');
     let exists = false;
@@ -451,26 +384,8 @@ function readConfigFile(cwd) {
         return { exists, parsed: {} };
     }
 }
-/**
- * Inspect the project's RESULTING state at `cwd` after an `/pp-init` run
- * and report every named invariant it violates. Read-only: no filesystem
- * write anywhere in this function or in the `composeBindings` call it
- * makes (always `offline: true`, `write` omitted so it defaults to
- * `false`). Never throws — each check below is independently guarded so
- * one failing check cannot suppress the others; there is no outer
- * catch-all because none is needed (see the design note below).
- *
- * An empty directory — nothing in `.planning/`, no `.platform-bindings.json`
- * — returns `{ ok: true, violations: [] }`. Every check requires some
- * positive signal that a partial init was attempted (a config file present
- * for `INIT_IDENTITY_MISSING`; a "gitlab"/"azure" `project.provider` for
- * `INIT_VAULT_PROVIDER_UNSET`; an installed org-profile-shaped package for
- * `INIT_QUESTIONS_ORG_PROFILE_UNASKED`; a `composable: true` dry run for
- * `INIT_COMPOSITION_NOT_RUN`) — an empty directory carries none of them, so
- * nothing is reported as skipped. This is deliberate (see the module
- * header): nothing was attempted, so nothing can be reported as attempted-
- * and-abandoned.
- */
+/** Report every invariant the project's state at `cwd` violates. Read-only and never throws;
+ * each check needs a positive signal that init was attempted, so an empty directory is ok. */
 function verifyInitInvariants(cwd, opts = {}) {
     const violations = [];
     const { exists: configExists, parsed } = readConfigFile(cwd);
@@ -491,14 +406,11 @@ function verifyInitInvariants(cwd, opts = {}) {
     catch {
         // fail open — one check's fault must not suppress the others
     }
-    // INIT_VAULT_PROVIDER_UNSET — project.provider names a provisioning
-    // provider (an identity record, D-13) but vault.provider —
-    // resolveProvider's ONLY gating key — was never set, so the D-13
-    // provisioning gate this phase built never fires.
+    // `project.provider` names a vault provider but `vault.provider` was never set.
     try {
         const projectProvider = getDotted(parsed, 'project.provider');
         const vaultProvider = getDotted(parsed, 'vault.provider');
-        if ((projectProvider === 'gitlab' || projectProvider === 'azure') && !isUsableString(vaultProvider)) {
+        if (git_provider_cjs_1.PROVIDERS.includes(projectProvider) && !isUsableString(vaultProvider)) {
             violations.push({
                 code: INVARIANT_CODE.VAULT_PROVIDER_UNSET,
                 message: `project.provider is "${String(projectProvider)}" but vault.provider is unset — the D-13 provisioning gate is disabled.`,
@@ -508,31 +420,7 @@ function verifyInitInvariants(cwd, opts = {}) {
     catch {
         // fail open
     }
-    // INIT_QUESTIONS_ORG_PROFILE_UNASKED — an org-profile-shaped package is
-    // installed (project node_modules or the machine's global root) but
-    // org.profile was never set, i.e. Question 6 appears to have been
-    // skipped rather than answered blank.
-    // A recorded skip (init.org_profile_declined, the JSON boolean true and
-    // nothing else) is an answer. A set pointer is checked first; the marker is
-    // checked before the node_modules scan.
-    try {
-        const orgProfilePointer = getDotted(parsed, org_profile_cjs_1.ORG_PROFILE_CONFIG_KEY);
-        const orgProfileDeclined = getDotted(parsed, exports.INIT_ORG_PROFILE_DECLINED_KEY) === true;
-        if (!isUsableString(orgProfilePointer) && !orgProfileDeclined && orgProfilePackageResolvable(cwd, opts)) {
-            violations.push({
-                code: INVARIANT_CODE.ORG_PROFILE_UNASKED,
-                message: 'An org-profile-shaped package is installed but org.profile is unset and no skip was recorded — the pointer question (Question 6) appears not to have been answered. ' +
-                    'Re-run "pp-tools init --reset" and either type the package name to use it, or press Enter (or type "none") to record a skip.',
-            });
-        }
-    }
-    catch {
-        // fail open
-    }
-    // INIT_COMPOSITION_NOT_RUN — a binding was composable from the org
-    // profile and project answers, but .platform-bindings.json was never
-    // written and no explicit decline was recorded — Step 2.5 appears to
-    // have been skipped rather than run-and-declined.
+    // A binding was composable but never written, and no decline was recorded.
     try {
         const bindingsPath = node_path_1.default.join(cwd, '.platform-bindings.json');
         const bindingsExist = node_fs_1.default.existsSync(bindingsPath);
@@ -542,7 +430,8 @@ function verifyInitInvariants(cwd, opts = {}) {
             if (dryRun.composable === true) {
                 violations.push({
                     code: INVARIANT_CODE.COMPOSITION_NOT_RUN,
-                    message: 'A binding is composable from the org profile and project answers, but .platform-bindings.json was never written and no decline was recorded — Step 2.5 appears to have been skipped.',
+                    message: 'A binding is composable from the org profile and project answers, but .platform-bindings.json was never written and no decline was recorded — Step 2.5 appears to have been skipped. ' +
+                        'Run "pp-tools init --reset" to redo the question set and reach the compose confirmation (init-friction F3: a completed session never re-offers composition on a bare re-run).',
                 });
             }
         }
@@ -550,32 +439,111 @@ function verifyInitInvariants(cwd, opts = {}) {
     catch {
         // fail open
     }
+    // `vault.enabled` present but not a boolean: reported, never repaired (the session scope is exempt).
+    try {
+        if (opts.scope !== 'session' && configExists) {
+            const vaultEnabled = resolveVaultEnabledState(parsed);
+            if (vaultEnabled.state === 'malformed') {
+                // Bounded like every record field; JSON.stringify keeps the value's type visible.
+                const rendered = overrideHelpers().sanitizeOverrideReason(String(JSON.stringify(vaultEnabled.value)));
+                // Phase 15 D-32: what this value does to the gates is fixed BY CONSTRUCTION, so it is
+                // stated, not mirrored and not measured here (measuring would call loadConfig, which
+                // spawns git, and this check spawns nothing). The gates' config loader resolves vault
+                // keys through federated-config, which accepts only a JSON boolean and falls back to the
+                // default (off) for anything else. The old mirror, Boolean(value), told the operator
+                // that every truthy non-boolean armed the gates; the shipped gate armed on none of them.
+                const split = 'The config loader the vault gates read accepts only a JSON boolean and falls back to ' +
+                    'off, so from this value the two blocking vault gates do NOT arm, and /pp-init Step 2.6 ' +
+                    'and this reachability check require the boolean true, so they are inert too. ';
+                violations.push({
+                    code: INVARIANT_CODE.VAULT_ENABLED_MALFORMED,
+                    message: `vault.enabled in .planning/config.json is ${rendered}, which is not a JSON boolean. ` +
+                        split +
+                        'Store the boolean with "pp-tools config-set vault.enabled true" (which accepts only ' +
+                        'true or false, and refuses any other spelling), or "pp-tools config-set vault.enabled ' +
+                        'false" to turn the capability off.',
+                });
+            }
+        }
+    }
+    catch {
+        // fail open — one check's fault must not suppress the others
+    }
+    // A proof is owed when the vault is armed, a profile applies and a binding exists (config only, no machine state).
+    // A failed or deferred record is reported whenever the vault is armed, binding or not.
+    try {
+        if (opts.scope !== 'session') {
+            const orgProfilePointer = getDotted(parsed, org_profile_cjs_1.ORG_PROFILE_CONFIG_KEY);
+            // FORK-ONLY (PBI 74316): with no pointer the embedded profile applies; only "none" opts out.
+            const profileApplies = isUsableString(orgProfilePointer)
+                ? orgProfilePointer.trim().toLowerCase() !== org_profile_cjs_1.ORG_PROFILE_NONE
+                : (0, org_profile_cjs_1.effectiveEmbeddedOrgProfilePath)() !== null;
+            const vaultArmed = configExists && isVaultEnabledInConfig(parsed);
+            const owesAProof = vaultArmed && profileApplies && node_fs_1.default.existsSync(node_path_1.default.join(cwd, '.platform-bindings.json'));
+            // Kept as an object: destructuring trips @typescript-eslint/unbound-method.
+            const helpers = overrideHelpers();
+            // Bound every record field again at print time; a non-string counts as absent.
+            const bounded = (v) => (typeof v === 'string' ? helpers.sanitizeOverrideReason(v) : '');
+            const profile = isUsableString(orgProfilePointer) ? bounded(orgProfilePointer) : org_profile_cjs_1.EMBEDDED_ORG_PROFILE_NAME;
+            const status = bounded(getDotted(parsed, exports.INIT_PROBE_STATUS_KEY));
+            const when = bounded(getDotted(parsed, exports.INIT_PROBE_WHEN_KEY));
+            const who = bounded(getDotted(parsed, exports.INIT_PROBE_WHO_KEY));
+            const note = bounded(getDotted(parsed, exports.INIT_PROBE_NOTE_KEY));
+            if (vaultArmed && status === exports.INIT_PROBE_STATUS.FAILED) {
+                violations.push({
+                    code: INVARIANT_CODE.PROBE_FAILED,
+                    message: `The reachability proof recorded FAILED on ${when} by ${who}: ${note}. ` +
+                        'Re-run "/pp-init" after fixing the remote, or record an attributed deferral with ' +
+                        '"pp-tools query init-contract --defer-probe <reason>".',
+                });
+            }
+            else if (vaultArmed && status === exports.INIT_PROBE_STATUS.DEFERRED) {
+                // A deferral stays a violation until a passing probe overwrites it.
+                violations.push({
+                    code: INVARIANT_CODE.PROBE_DEFERRED,
+                    message: `The reachability proof was deferred by ${who} on ${when} for reason: ${note}. ` +
+                        'Init remains unproven until a re-run of "/pp-init" records a passing probe.',
+                });
+            }
+            else if (owesAProof) {
+                // Name the repair (re-run, or record a deferral) — never deletion.
+                const notRunRemedy = ' Re-run "/pp-init" to probe, or record an attributed deferral with ' +
+                    '"pp-tools query init-contract --defer-probe <reason>".';
+                const notRun = (clause) => ({
+                    code: INVARIANT_CODE.PROBE_NOT_RUN,
+                    message: `The org profile "${profile}" resolves, vault.enabled is true and .platform-bindings.json ` +
+                        `is present, but ${clause} — /pp-init Step 2.6 appears not to have run.` +
+                        notRunRemedy,
+                });
+                if (status === exports.INIT_PROBE_STATUS.PASSED) {
+                    // Only an attributed, timestamped pass clears the check.
+                    if (!isUsableString(who) || !isUsableString(when)) {
+                        violations.push(notRun('the reachability-proof record is malformed (init.probe_status is "passed" but ' +
+                            `${!isUsableString(who) ? 'init.probe_who' : 'init.probe_when'} is absent, so the ` +
+                            'proof is unattributed)'));
+                    }
+                }
+                else {
+                    violations.push(notRun(status === ''
+                        ? 'no reachability-proof record exists (init.probe_status is unset)'
+                        : `no valid reachability-proof record exists (init.probe_status is "${status}", which is not a recognised status)`));
+                }
+            }
+        }
+    }
+    catch {
+        // fail open — one check's fault must not suppress the others
+    }
     return { ok: violations.length === 0, violations };
 }
-// ─── Session state machine (34-08 gap closure) ─────────────────────────────
-//
-// Why this exists at all: `buildInitQuestions`/`verifyInitInvariants` make
-// the CONTENT correct when called and the OMISSION provable afterwards —
-// they do not make skipping impossible, because prose can still hand an
-// agent the full 8-question list and the agent can still compress it (this
-// module's own header; `34-VERIFICATION.md`'s third walk). This session
-// machine removes the list itself: `initSessionNext` returns exactly ONE
-// step, `initSessionAnswer` records exactly ONE answer and rejects
-// anything out of order, and the CLI performs every side effect (identity
-// write, `vault.provider`, composition) at the state that needs it — never
-// leaving it to a workflow's own prose to remember. Neither
-// `buildInitQuestions` nor `verifyInitInvariants` nor `composeBindings` is
-// reimplemented here: this machine only sequences calls into them.
+// ─── Session state machine: one step at a time, every side effect performed by the CLI ───
 function sessionFilePath(cwd) {
     return node_path_1.default.join(cwd, '.planning', INIT_SESSION_FILE_NAME);
 }
 function newSession() {
     return { version: 1, answers: {}, identityWritten: false, composeDecision: null, doneAt: null };
 }
-/** Validate the ENTIRE persisted shape before trusting it — a session file
- * that merely parses as JSON but carries the wrong shape (hand-edited,
- * truncated mid-write, a leftover from an incompatible future version) must
- * fail closed exactly like a parse error (T-34-63). */
+/** Validate the whole persisted shape; a wrong shape fails closed like a parse error. */
 function isValidSessionShape(v) {
     if (!isObject(v))
         return false;
@@ -603,13 +571,18 @@ function isValidSessionShape(v) {
     }
     if (doneAt !== null && typeof doneAt !== 'string')
         return false;
+    const autoAnswers = v.autoAnswers;
+    if (autoAnswers !== undefined) {
+        if (!isObject(autoAnswers))
+            return false;
+        for (const src of Object.values(autoAnswers)) {
+            if (src !== 'org-profile' && src !== 'derived')
+                return false;
+        }
+    }
     return true;
 }
-/** Absent file → a brand-new session (the normal first call). Present and
- * valid → that session. Present but invalid in ANY way → `{ malformed:
- * true }`, and every caller below refuses to proceed rather than silently
- * re-initializing (T-34-63) — `initSessionReset` is the only documented
- * recovery. Never throws. */
+/** Absent → a new session; invalid → `{ malformed: true }` (recover with `--session-reset`). Never throws. */
 function loadSession(cwd) {
     const p = sessionFilePath(cwd);
     try {
@@ -627,8 +600,7 @@ function loadSession(cwd) {
         return { malformed: true };
     }
 }
-/** CR-01: format an unexpected write failure (e.g. EACCES) as a bounded,
- * human-readable message — never a raw stack trace reaching the operator. */
+/** Format an unexpected write failure as a bounded message — never a raw stack trace. */
 function writeFailedMessage(err) {
     const detail = err instanceof Error ? err.message : String(err);
     return (`A filesystem write inside the init session failed (${detail}). ` +
@@ -641,13 +613,7 @@ function persistSession(cwd, session) {
     (0, shell_command_projection_cjs_1.platformEnsureDir)(dir);
     (0, shell_command_projection_cjs_1.platformWriteSync)(sessionFilePath(cwd), JSON.stringify(session, null, 2) + '\n');
 }
-/** Read `.planning/config.json` for a MERGE write — distinct from
- * `readConfigFile` above (which reports `exists`/malformed for
- * `verifyInitInvariants`'s read-only purposes): this helper only ever
- * needs "the object to merge into", degrading to `{}` on any absence or
- * fault so a merge write never crashes on a pre-existing malformed file —
- * it simply starts the merge from empty and the write below then produces
- * a well-formed file going forward. */
+/** The config to merge into; `{}` on absence or fault, so a merge write never crashes. */
 function readConfigForMerge(cwd) {
     try {
         const raw = node_fs_1.default.readFileSync(node_path_1.default.join(cwd, '.planning', 'config.json'), 'utf-8');
@@ -658,13 +624,7 @@ function readConfigForMerge(cwd) {
         return {};
     }
 }
-/** Shallow-recursive merge: object values merge key-by-key; any other
- * value (string, number, boolean, array) replaces the target outright.
- * Bounded by the patches this module ever constructs itself (`project.*`,
- * `vault.provider`, `org.profile`, `init.compose_declined` — never a
- * caller-supplied arbitrary depth), so no depth cap is needed here the way
- * `walkLeaves` in `compose-bindings.cts` needs one for untrusted file
- * content. */
+/** Recursive merge of plain objects; any other value replaces the target. */
 function deepMergeConfigPatch(target, patch) {
     for (const k of Object.keys(patch)) {
         const pv = patch[k];
@@ -678,28 +638,14 @@ function deepMergeConfigPatch(target, patch) {
     }
     return target;
 }
-/** The ONLY place this module writes `.planning/config.json` — every side
- * effect the session performs (identity write, `vault.provider`,
- * `org.profile`, `init.compose_declined`) routes through here, merged
- * against whatever is already on disk so a session step never clobbers an
- * unrelated key a human or another tool wrote. Direct `fs`/`JSON` I/O,
- * bypassing `config-schema.cts`'s registered-key validation — the same
- * convention `compose-bindings.cts`'s `cfgGet` and this module's own
- * `readConfigFile` already use for `project.*`/`org.profile` reads; see
- * `.planning/todos/pending/project-config-key-unknown.md` for why `project`
- * is not (yet) a registered top-level key, out of scope for this plan. */
+/** The only writer of `.planning/config.json` in this module; merges so unrelated keys survive. */
 function writeConfigMerge(cwd, patch) {
     const dir = node_path_1.default.join(cwd, '.planning');
     (0, shell_command_projection_cjs_1.platformEnsureDir)(dir);
     const merged = deepMergeConfigPatch(readConfigForMerge(cwd), patch);
     (0, shell_command_projection_cjs_1.platformWriteSync)(node_path_1.default.join(dir, 'config.json'), JSON.stringify(merged, null, 2) + '\n');
 }
-/** The batch write Task 1 §2 describes: once all 8 answers are recorded,
- * write the `project` identity block and — only when the `provider` answer
- * is exactly `gitlab` or `azure` — `vault.provider`. `org_profile` is
- * excluded from this map: it is written immediately when THAT answer is
- * recorded (see `initSessionAnswer`), not deferred here, precisely so the
- * `provider` question re-resolves its `preselected` against it. */
+/** Write the project identity block, and `vault.provider` when the provider is a vault provider (gitlab, azure or github). */
 function writeIdentityAndProvider(cwd, answers) {
     const projectPatch = {};
     for (const [questionId, configKey] of Object.entries(PROJECT_BLOCK_QUESTION_MAP)) {
@@ -710,14 +656,124 @@ function writeIdentityAndProvider(cwd, answers) {
     }
     const patch = { project: projectPatch };
     const providerAnswer = answers.provider;
-    if (providerAnswer === 'gitlab' || providerAnswer === 'azure') {
+    if (git_provider_cjs_1.PROVIDERS.includes(providerAnswer)) {
         patch.vault = { provider: providerAnswer };
     }
     writeConfigMerge(cwd, patch);
 }
-/** Case/whitespace-tolerant yes/no parse for the `compose_confirm` answer.
- * `null` for anything else — never defaulted to a decline, so a typo'd
- * answer is rejected rather than silently treated as "no". */
+/** The ONE owner of the arm-where-absent rule (quick 261003-kmd): arms `vault.enabled`,
+ * `vault.practices_enabled` and `vault.required` only where ABSENT, from one read in one write.
+ *
+ * A successful composition means a client vault exists, so the three keys are armed (OD-1,
+ * 260915-lmc, 260916-s5n). An explicit `false` or a malformed value is kept — that is the
+ * operator's decision, never overwritten (07-09 WR-07). The write happens only when there is
+ * something to arm: the nested- and flat-form byte-identity pins depend on a no-op writing
+ * nothing. Callers: the session's `'unchanged'` decision (how existing projects get armed by a
+ * plain re-run), the approved `compose_confirm`, and `armVaultFromProfile` (`/pp-new-project`).
+ * It exists because the two session copies had already drifted once — the practices key was
+ * added to both by hand in 260915-lmc — and a third route would have been a third copy.
+ *
+ * @returns the armed key names, in the fixed order enabled, practices_enabled, required. */
+function armVaultKeysWhereAbsent(cwd) {
+    const { parsed } = readConfigFile(cwd);
+    const vaultPatch = {};
+    if (resolveVaultEnabledState(parsed).state === 'absent') {
+        vaultPatch.enabled = true;
+    }
+    if (resolveVaultPracticesEnabledState(parsed).state === 'absent') {
+        vaultPatch.practices_enabled = true;
+    }
+    if (resolveVaultRequiredState(parsed).state === 'absent') {
+        vaultPatch.required = true;
+    }
+    const armed = Object.keys(vaultPatch);
+    if (armed.length > 0) {
+        writeConfigMerge(cwd, { vault: vaultPatch });
+    }
+    return armed;
+}
+/** The reason triad and identity chain, reused from the vault-trace leaf (never re-derived here).
+ * Required lazily: pp-tools loads this module on every command, and the trace leaf is large. */
+function overrideHelpers() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+    const trace = require('./vault-trace.cjs');
+    return trace;
+}
+/** Build the record with `who` and `when` bounded; `status` is checked against `INIT_PROBE_STATUS`. */
+function buildProbeRecord(cwd, status, note, opts, helpers) {
+    const injectedWho = typeof opts._who === 'string' && opts._who.trim() !== '' ? opts._who : null;
+    const rawWho = injectedWho ?? helpers.resolveOverrideIdentity(cwd);
+    // Never an empty string and never an omitted key — an absent `who` and an
+    // unattributable one must not look identical (the trace leaf's own rule).
+    const who = helpers.sanitizeOverrideReason(rawWho) || 'unknown';
+    const when = helpers.sanitizeOverrideReason(opts.now ?? new Date().toISOString());
+    return { status, when, who, note };
+}
+/** The shared record write: four keys merged under `init`. Never throws (`write_failed`). */
+function writeProbeRecord(cwd, record) {
+    try {
+        writeConfigMerge(cwd, {
+            init: {
+                probe_status: record.status,
+                probe_when: record.when,
+                probe_who: record.who,
+                probe_note: record.note,
+            },
+        });
+    }
+    catch (err) {
+        return { ok: false, reason: 'write_failed', message: writeFailedMessage(err) };
+    }
+    return { ok: true, record };
+}
+/** Record that the Step 2.6 probe passed or failed; an unknown status or an empty note is refused, writing nothing.
+ * Deferrals go through `recordProbeDeferral`. */
+function recordProbeOutcome(cwd, input, opts = {}) {
+    const helpers = overrideHelpers();
+    const status = input?.status;
+    if (status !== exports.INIT_PROBE_STATUS.PASSED && status !== exports.INIT_PROBE_STATUS.FAILED) {
+        return {
+            ok: false,
+            reason: 'invalid_probe_status',
+            message: `Cannot record probe status ${JSON.stringify(status)} — expected ` +
+                `"${exports.INIT_PROBE_STATUS.PASSED}" or "${exports.INIT_PROBE_STATUS.FAILED}". ` +
+                `A deferral is recorded with --defer-probe "<reason>", which requires a stated reason.`,
+        };
+    }
+    // A non-string note counts as no note (never String()-coerced).
+    const note = helpers.sanitizeOverrideReason(typeof input?.note === 'string' ? input.note : '');
+    if (note === '') {
+        return {
+            ok: false,
+            reason: 'probe_note_required',
+            message: 'Cannot record a probe outcome with no note. Say what the probe measured — which targets ' +
+                'were reachable, and for a failure which one was not — so the record is evidence and not ' +
+                'just a verdict.',
+        };
+    }
+    return writeProbeRecord(cwd, buildProbeRecord(cwd, status, note, opts, helpers));
+}
+/** Record a deferral of the Step 2.6 proof; the reason is required and validated, and a refusal writes nothing.
+ * `--verify` keeps reporting it until a passing probe overwrites it. */
+function recordProbeDeferral(cwd, reason, opts = {}) {
+    const helpers = overrideHelpers();
+    const refusal = (rejection) => ({
+        ok: false,
+        reason: 'deferral_reason_rejected',
+        message: `Deferral refused: ${rejection}. State why the reachability proof is being deferred — ` +
+            'at least 20 characters, containing letters, not a placeholder.',
+    });
+    if (typeof reason !== 'string' || reason.trim() === '') {
+        return refusal('no reason was given');
+    }
+    const verdict = helpers.validateOverrideReason(reason.trim());
+    if (verdict.state !== 'accepted') {
+        return refusal(verdict.state === 'rejected' ? verdict.rejection : 'the reason was not accepted');
+    }
+    const note = helpers.sanitizeOverrideReason(verdict.reason);
+    return writeProbeRecord(cwd, buildProbeRecord(cwd, exports.INIT_PROBE_STATUS.DEFERRED, note, opts, helpers));
+}
+/** Parse a `compose_confirm` answer; `null` for anything unrecognised (never a silent "no"). */
 function normalizeYesNo(value) {
     if (typeof value !== 'string')
         return null;
@@ -728,43 +784,27 @@ function normalizeYesNo(value) {
         return false;
     return null;
 }
-/**
- * The single decision function every public session entry point drives.
- * Recomputes `buildInitQuestions(cwd)` FRESH on every call — never cached
- * across calls — which is what makes the `provider` question's
- * `preselected` reflect an `org_profile` answer given moments earlier in
- * the SAME session (the walk-3 regression this plan's design hazards
- * name): by the time this function is asked for the `provider` question,
- * `org.profile` has already been written to disk by `initSessionAnswer`,
- * so `buildInitQuestions`'s own `resolveProvider` call sees it.
- *
- * Performs three idempotent side effects, each guarded by its own session
- * flag so re-calling this (as every public entry point does, to validate
- * the current step) never repeats a write: the identity+provider batch
- * write once all 8 questions are answered; marking `composeDecision:
- * 'skipped'` when nothing is composable at all (the real inert path,
- * INIT-02) or `composeDecision: 'unchanged'` when a binding IS composable
- * but the existing file already matches it (a healthy, up-to-date state —
- * NOT the inert path, and reported with its own distinct message; no
- * `compose_confirm` prompt either way, nothing written); and recording
- * `doneAt` once `verifyInitInvariants` first reports `ok: true`.
- */
+/** Decide the current step, performing its idempotent side effects once: automatic answers, the identity write,
+ * the compose decision and `doneAt`. Recomputes the question set on every call. */
 function computeCurrentStep(cwd, session, opts) {
-    // CR-01: every sibling module in this seam (composeBindings,
-    // resolveOrgProfileDocument, resolveOrgProfile, verifyInitInvariants)
-    // wraps its entire body in a top-level try/catch so a filesystem fault
-    // degrades to a bounded result rather than crashing (D-09). This
-    // function's writes (writeIdentityAndProvider/persistSession, below) did
-    // not — an unwritable .planning directory threw an uncaught EACCES
-    // straight out of initSessionNext/initSessionAnswer. Fixed by matching
-    // the convention: any failure anywhere in this body degrades to a
-    // `write_failed` verdict instead of propagating.
+    // Any failure degrades to a `write_failed` step instead of throwing.
     try {
-        const questions = buildInitQuestions(cwd, { _globalRoot: opts._globalRoot });
+        const questions = buildInitQuestions(cwd);
+        // PBI 74299: read once per call; only consulted for an unanswered question.
+        let profileInit = null;
         for (const q of questions) {
-            if (!Object.prototype.hasOwnProperty.call(session.answers, q.id)) {
+            if (Object.prototype.hasOwnProperty.call(session.answers, q.id))
+                continue;
+            profileInit ??= readProfileInitAnswers(cwd, { _globalRoot: opts._globalRoot });
+            const auto = autoAnswerFor(q.id, session.answers, profileInit);
+            if (auto === null) {
                 return { kind: 'question', question: q };
             }
+            // Filled in once and recorded, so a --session-next poll writes the
+            // session file only the first time an answer is decided.
+            session.answers[q.id] = auto.value;
+            session.autoAnswers = { ...(session.autoAnswers ?? {}), [q.id]: auto.source };
+            persistSession(cwd, session);
         }
         if (!session.identityWritten) {
             writeIdentityAndProvider(cwd, session.answers);
@@ -773,20 +813,10 @@ function computeCurrentStep(cwd, session, opts) {
         }
         if (session.composeDecision === null) {
             const dryRun = (0, compose_bindings_cjs_1.composeBindings)(cwd, { offline: opts.offline === true, _globalRoot: opts._globalRoot });
-            // WR-01: only offer compose_confirm when approving it would actually
-            // change something. `action: 'unchanged'` means the existing file
-            // already carries every key the composer would produce (D-08's
-            // absent-only merge) — asking the operator to approve a write that
-            // writes nothing is exactly the shape of prompt that produced the
-            // false-success report this finding names. Fall through to the
-            // messaging below instead of asking — but see the coordinator
-            // follow-up: 'unchanged' and 'not composable at all' are DIFFERENT
-            // end states and must record (and later report) distinct decisions,
-            // never sharing the inert-path (INIT-02) message below.
+            // Offer compose_confirm only when approving would change something; 'unchanged' and 'skipped' are distinct end states.
             if (dryRun.composable === true && dryRun.action !== 'unchanged') {
-                // Pack 6 D-07: `info` is display-only (the CLI and the TTY renderer
-                // print it); approval re-composes with `write: true`, so the written
-                // file keeps the RAW coordinates.
+                // VAULT-EGRESS-1: `info` is display-only (the CLI and the TTY renderer print it); approval
+                // re-composes with `write: true` below, so the written file keeps the RAW coordinates.
                 const shown = (0, compose_bindings_cjs_1.redactComposeResultForEmission)(dryRun);
                 return {
                     kind: 'compose_confirm',
@@ -795,25 +825,24 @@ function computeCurrentStep(cwd, session, opts) {
                         drift: shown.drift,
                         action: dryRun.action,
                         composed: shown.composed,
-                        warnings: shown.warnings,
+                        warnings: dryRun.warnings,
                     },
                 };
             }
             session.composeDecision = dryRun.composable === true && dryRun.action === 'unchanged' ? 'unchanged' : 'skipped';
+            if (session.composeDecision === 'unchanged') {
+                armVaultKeysWhereAbsent(cwd);
+            }
             persistSession(cwd, session);
         }
-        // Three genuinely different end states can reach `done`/`verify` with
-        // nothing written, and each needs its own message — conflating them
-        // (as an earlier pass of this fix did) tells an operator with a
-        // healthy, up-to-date binding that their org profile produced nothing
-        // composable, which is exactly the "tool reports a state that isn't
-        // the real one" failure shape this phase exists to eliminate.
+        // Three different nothing-written end states, each with its own message.
         const skippedComposeInfo = session.composeDecision === 'skipped'
             ? 'Nothing was composable from the org profile and project answers — no compose_confirm step was shown and nothing was written (the inert path, INIT-02).'
             : session.composeDecision === 'unchanged'
                 ? 'The existing .platform-bindings.json is already up to date with what the org profile and project answers would produce — no compose_confirm step was needed and nothing was written.'
                 : undefined;
-        const verifyResult = verifyInitInvariants(cwd, { _globalRoot: opts._globalRoot });
+        // The session verify skips only the INIT_PROBE_* check: Step 2.6 records the proof after init returns.
+        const verifyResult = verifyInitInvariants(cwd, { _globalRoot: opts._globalRoot, scope: 'session' });
         if (verifyResult.ok) {
             if (!session.doneAt) {
                 session.doneAt = new Date().toISOString();
@@ -873,13 +902,7 @@ function currentStepToState(step) {
             };
     }
 }
-/**
- * Return the ONE next step of the `/pp-init` session at `cwd` — a question,
- * `compose_confirm`, `verify`, or `done`. Never a list. Fails closed (T-34-
- * 63) with `error: INIT_SESSION_MALFORMED` when the session file exists but
- * does not parse as valid session state; `--session-reset` is the
- * documented recovery, never a silent re-initialize.
- */
+/** Return the ONE next step of the session; malformed session state fails closed (recover with `--session-reset`). */
 function initSessionNext(cwd, opts = {}) {
     const loaded = loadSession(cwd);
     if (loaded.malformed) {
@@ -892,25 +915,12 @@ function initSessionNext(cwd, opts = {}) {
                 'Run "pp_run query init-contract --session-reset" to start over — it is never resumed silently into an unknown state.',
         };
     }
-    return currentStepToState(computeCurrentStep(cwd, loaded.session, opts));
+    const session = loaded.session;
+    const state = currentStepToState(computeCurrentStep(cwd, session, opts));
+    const autoAnswered = listAutoAnswers(cwd, session);
+    return autoAnswered.length > 0 ? { ...state, autoAnswered } : state;
 }
-/**
- * Record ONE answer for the CURRENT step only. Rejects — with `ok: false`
- * and a named `reason`, never a throw — an answer for any step other than
- * the one `initSessionNext` would currently serve (T-34-60: an agent trying
- * to batch or skip ahead fails loudly), a blank answer to a
- * non-`optionalAnswer` question, an unparseable `compose_confirm` value, or
- * any answer once the session is already `done`.
- *
- * The `org_profile` answer is written to `.planning/config.json` (`org.profile`)
- * IMMEDIATELY when it selects a package — the one exception to the "batch
- * write after the last answer" rule in `computeCurrentStep`'s own doc
- * comment — because the very next question (`provider`) must see it to
- * re-resolve its `preselected` (the walk-3 regression Task 1's acceptance
- * names). A decline (`isOrgProfileDecline`: blank, or `none` in any case) is
- * recorded instead as `init.org_profile_declined: true` when a profile was
- * detectable.
- */
+/** Record one answer for the current step only; out-of-order, blank required, unparseable or post-done answers are rejected. */
 function initSessionAnswer(cwd, stepId, value, opts = {}) {
     const loaded = loadSession(cwd);
     if (loaded.malformed) {
@@ -922,14 +932,7 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
         };
     }
     const session = loaded.session;
-    // CR-01: wrap the entire remaining body — every write this function
-    // performs directly (the `org_profile` immediate write, the batch
-    // `persistSession` calls, the `compose_confirm` decline/approve writes)
-    // — in a top-level try/catch, matching the D-09 convention every sibling
-    // module in this seam already follows. `computeCurrentStep` degrades to
-    // a `write_failed` step on its own internal failures (handled explicitly
-    // below); this catch additionally covers the write sites that live in
-    // THIS function, after `computeCurrentStep` returns.
+    // Any write failure in this function degrades to `write_failed` instead of throwing.
     try {
         const step = computeCurrentStep(cwd, session, opts);
         if (step.kind === 'write_failed') {
@@ -954,32 +957,6 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
                 return { ok: false, reason: 'answer_required', message: `Question "${stepId}" requires a non-blank answer.` };
             }
             const answerValue = typeof value === 'string' ? value : '';
-            if (stepId === 'org_profile') {
-                if (isOrgProfileDecline(answerValue)) {
-                    // Enter and `none` leave the same session record. The marker is
-                    // written exactly when the UNASKED violation would otherwise fire
-                    // (the same predicate); with no profile detectable nothing was
-                    // offered, so nothing is recorded.
-                    session.answers[stepId] = '';
-                    if (orgProfilePackageResolvable(cwd, { _globalRoot: opts._globalRoot })) {
-                        writeConfigMerge(cwd, { init: { org_profile_declined: true } });
-                    }
-                    persistSession(cwd, session);
-                    return { ok: true };
-                }
-                const trimmed = answerValue.trim();
-                session.answers[stepId] = answerValue;
-                const orgPatch = { org: { profile: trimmed } };
-                // A selection after an earlier recorded skip writes the marker back to
-                // false in the same merge, so a stale decline never sits beside a set
-                // pointer. No write when the marker is absent.
-                if (getDotted(readConfigFile(cwd).parsed, exports.INIT_ORG_PROFILE_DECLINED_KEY) === true) {
-                    orgPatch.init = { org_profile_declined: false };
-                }
-                writeConfigMerge(cwd, orgPatch);
-                persistSession(cwd, session);
-                return { ok: true };
-            }
             session.answers[stepId] = answerValue;
             persistSession(cwd, session);
             return { ok: true };
@@ -1001,24 +978,10 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
                 };
             }
             if (normalized === true) {
-                // WR-02: inspect the write-mode result before recording the
-                // decision. The dry run inside computeCurrentStep already reported
-                // composable:true/action!=='unchanged' moments earlier, but the
-                // world can change between that dry run and this write (the file
-                // became malformed on disk in between, a transient fault now caught
-                // internally by composeBindings's own outer catch, etc.) — in that
-                // case `wrote` comes back false even though the operator approved.
-                // Recording 'approved' unconditionally here would make the session
-                // proceed toward done/verify as though the write had succeeded,
-                // and the eventual INIT_COMPOSITION_NOT_RUN violation would then
-                // misdescribe what happened ("Step 2.5 appears to have been
-                // skipped") when in fact the user approved and the write failed.
+                // Check the write result before recording "approved": the file can change between the dry run and this write.
                 const writeResult = (0, compose_bindings_cjs_1.composeBindings)(cwd, { write: true, offline: opts.offline === true, _globalRoot: opts._globalRoot });
                 if (writeResult.composable !== true || writeResult.wrote !== true) {
-                    // Do NOT record composeDecision here — leave it null so the next
-                    // --session-next call re-evaluates from a fresh dry run (and, if
-                    // still composable, re-offers compose_confirm) rather than
-                    // silently treating this as skipped or declined.
+                    // Leave the decision unset so the next call re-evaluates and can re-offer compose_confirm.
                     return {
                         ok: false,
                         reason: 'compose_write_failed',
@@ -1029,6 +992,7 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
                     };
                 }
                 session.composeDecision = 'approved';
+                armVaultKeysWhereAbsent(cwd);
             }
             else {
                 writeConfigMerge(cwd, { init: { compose_declined: true } });
@@ -1048,8 +1012,7 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
         return { ok: false, reason: 'write_failed', message: writeFailedMessage(err) };
     }
 }
-/** Delete the session file, the documented recovery from a malformed
- * session (T-34-63). Never throws; a missing file is not an error. */
+/** Delete the session file (the recovery from a malformed session). Never throws. */
 function initSessionReset(cwd) {
     try {
         const p = sessionFilePath(cwd);
@@ -1061,193 +1024,114 @@ function initSessionReset(cwd) {
     }
     return { ok: true };
 }
-/**
- * `init-contract --arm-vault`: turn the client vault on for a project whose
- * client vault is bound. Writes `vault.enabled: true` ONLY when the key is
- * absent — an explicit `false` (or any other explicit value) is the
- * operator's decision and is kept. When the vault ends up enabled it also
- * writes `vault.required: true` where that key is absent: a project with a
- * bound client vault should stop when that vault stops loading, instead of
- * building without it after a confirmation. An explicit `vault.required`
- * (including `false`) is kept, and so is an org profile's value: when the
- * profile sets `vault.required` nothing is written, because the gate already
- * reads it (project > profile > default). It also writes
- * `vault.practices_enabled: true` where that key is absent, so the project
- * records which client practices each phase applied from its first phase on;
- * an explicit value is kept. All keys go in one write. With no client vault bound (no or
- * malformed `.platform-bindings.json`, or `client.vaultRepo` /
- * `client.vaultRef` missing — the same "bound" the gate's verdict uses) it
- * writes nothing and returns `ok: false` naming /pp-init. A present but
- * unparseable `.planning/config.json` is never overwritten. Never throws.
- * The reported coordinate is display-safe (D-07).
- */
-function armVault(cwd) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const vaultMod = require('./vault.cjs');
-    let binding = { bound: false, repo: null, ref: null };
-    try {
-        binding = vaultMod.readClientBinding(cwd);
-    }
-    catch {
-        /* unbound */
-    }
-    const client = { repo: vaultMod.redactCloneTarget(binding.repo), ref: binding.ref };
-    const configPath = node_path_1.default.join(cwd, '.planning', 'config.json');
-    let cfg = {};
-    let cfgExists = false;
+/** Remedy every failure verdict names: repair through the interactive relay, never deletion. */
+const ARM_VAULT_REMEDY = 'Run "/pp-init" to relay the binding compose interactively and arm the vault.';
+/** Compose the binding from the resolved org profile and arm the vault keys where absent, with no prompt
+ * (quick 261003-kmd, FIX-1). `/pp-new-project` calls this so a project created through it is governed the
+ * same way `/pp-init` leaves one; before it existed, only `/pp-init` armed the vault and a new-project
+ * route left it silently off.
+ *
+ * The binding is written through `composeBindings` — the SAME composer `/pp-init` approves through — so
+ * its shape and provenance are identical, and the keys through `armVaultKeysWhereAbsent`, the one owner.
+ * An inert verdict (a recorded decline, a `vault.enabled` that is set but not the boolean `true`, or no
+ * org profile resolves) writes nothing of any kind and never creates `.planning/`. The `vault_disabled`
+ * arm exists because this route has no human confirm: an explicit `false` (or a malformed value) is the
+ * operator's opt-out, so writing a binding and two keys into that project would turn `vault.status` from
+ * `inert` into a verdict and let a report say "armed" where the gate says the vault is not governing
+ * (261003-kmd verification gap; the more inert reading). `/pp-init`'s approved compose is unchanged — a
+ * human confirmed it. `vault.provider` is deliberately NOT written: `resolveProvider` in
+ * `src/git-provider.cts` already layers the org profile's provider when the config key is absent, so the
+ * fetch resolves the right provider without a second writer. Never reads or writes the session file.
+ * Never throws. */
+function armVaultFromProfile(cwd, opts = {}) {
     try {
-        cfgExists = node_fs_1.default.existsSync(configPath);
-        if (cfgExists) {
-            const parsed = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
-            if (!isObject(parsed))
-                throw new Error('not an object');
-            cfg = parsed;
+        const { parsed } = readConfigFile(cwd);
+        if (capabilityActivation.getConfigValueEitherForm(parsed, exports.INIT_ORG_PROFILE_DECLINED_KEY).value === true) {
+            return {
+                ok: true,
+                armed: false,
+                reason: 'org_profile_declined',
+                message: 'The org profile was declined for this project (init.org_profile_declined), so nothing was composed or armed.',
+            };
         }
-    }
-    catch {
-        return {
-            ok: false,
-            armed: false,
-            enabled: undefined,
-            required: undefined,
-            practicesEnabled: undefined,
-            client,
-            message: '.planning/config.json is not valid JSON — fix it (or re-run /pp-init), then arm the vault again. Nothing was written.',
-        };
-    }
-    const vaultSection = isObject(cfg.vault) ? cfg.vault : null;
-    const nested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'enabled');
-    const flat = Object.prototype.hasOwnProperty.call(cfg, 'vault.enabled');
-    const current = nested && vaultSection ? vaultSection.enabled : flat ? cfg['vault.enabled'] : undefined;
-    const requiredNested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'required');
-    const requiredFlat = Object.prototype.hasOwnProperty.call(cfg, 'vault.required');
-    const currentRequired = requiredNested && vaultSection ? vaultSection.required : requiredFlat ? cfg['vault.required'] : undefined;
-    const practicesNested = vaultSection && Object.prototype.hasOwnProperty.call(vaultSection, 'practices_enabled');
-    const practicesFlat = Object.prototype.hasOwnProperty.call(cfg, 'vault.practices_enabled');
-    const currentPractices = practicesNested && vaultSection
-        ? vaultSection.practices_enabled
-        : practicesFlat
-            ? cfg['vault.practices_enabled']
-            : undefined;
-    const practicesAbsent = !(practicesNested || practicesFlat);
-    if (!binding.bound) {
-        return {
-            ok: false,
-            armed: false,
-            enabled: current,
-            required: currentRequired,
-            practicesEnabled: currentPractices,
-            client,
-            message: 'No client vault is bound — .platform-bindings.json needs client.vaultRepo and client.vaultRef. Run /pp-init to bind it; vault.enabled was not changed.',
-        };
-    }
-    const enabledAbsent = !(nested || flat);
-    const enabledAfter = enabledAbsent ? true : current;
-    const requiredAbsent = !(requiredNested || requiredFlat);
-    // An org profile that sets vault.required already decides it for this project (the gate
-    // reads project > profile > default); arming must not override it with a project value.
-    let profileRequired = null;
-    if (requiredAbsent) {
-        try {
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const orgProfile = require('./org-profile.cjs');
-            const r = orgProfile.resolveVaultRequired(cwd);
-            if (r.source === 'profile')
-                profileRequired = r.required;
+        if (capabilityActivation.getConfigValueEitherForm(parsed, exports.INIT_COMPOSE_DECLINED_KEY).value === true) {
+            return {
+                ok: true,
+                armed: false,
+                reason: 'compose_declined',
+                message: 'The binding compose was declined for this project (init.compose_declined), so nothing was composed or armed.',
+            };
         }
-        catch {
-            /* no profile: arm as before */
+        const enabled = resolveVaultEnabledState(parsed);
+        if (enabled.state !== 'absent' && enabled.state !== 'armed') {
+            return {
+                ok: true,
+                armed: false,
+                reason: 'vault_disabled',
+                message: enabled.state === 'off'
+                    ? 'vault.enabled is false for this project, so the vault was left off and nothing was composed or armed.'
+                    : 'vault.enabled is set but is not the boolean true, so the vault was left off and nothing was composed or armed.',
+            };
         }
-    }
-    const patch = {};
-    if (enabledAbsent)
-        patch.enabled = true;
-    if (enabledAfter === true && requiredAbsent && profileRequired === null)
-        patch.required = true;
-    // A bound client vault also records which of its practices each phase applied,
-    // from the first phase on. An explicit value is the operator's choice and is kept.
-    if (enabledAfter === true && practicesAbsent)
-        patch.practices_enabled = true;
-    const clauses = [
-        enabledAbsent
-            ? 'vault.enabled set to true (it was absent)'
-            : current === true
-                ? 'vault.enabled is already true'
-                : `vault.enabled is explicitly set to ${JSON.stringify(current)} — kept as the operator's choice`,
-    ];
-    if (enabledAfter === true) {
-        clauses.push(!requiredAbsent
-            ? `vault.required is set to ${JSON.stringify(currentRequired)} — kept as the operator's choice`
-            : profileRequired !== null
-                ? `vault.required comes from the org profile (${profileRequired}) — not written to the project`
-                : 'vault.required set to true (it was absent): planning and the build now stop when the client vault does not load');
-        clauses.push(practicesAbsent
-            ? "vault.practices_enabled set to true (it was absent): each plan now carries the client vault's practices and a record of which applied"
-            : `vault.practices_enabled is set to ${JSON.stringify(currentPractices)} — kept as the operator's choice`);
-    }
-    const requiredAfter = Object.prototype.hasOwnProperty.call(patch, 'required')
-        ? true
-        : profileRequired !== null
-            ? profileRequired
-            : currentRequired;
-    const practicesAfter = Object.prototype.hasOwnProperty.call(patch, 'practices_enabled')
-        ? true
-        : currentPractices;
-    if (Object.keys(patch).length === 0) {
+        if (!(0, org_profile_cjs_1.resolveOrgProfileDocument)(cwd, { _globalRoot: opts._globalRoot }).resolved) {
+            return {
+                ok: true,
+                armed: false,
+                reason: 'no_org_profile',
+                message: 'No org profile resolves for this project, so there is no client vault to bind and nothing was written.',
+            };
+        }
+        const compose = (0, compose_bindings_cjs_1.composeBindings)(cwd, { write: true, offline: opts.offline === true, _globalRoot: opts._globalRoot });
+        if (compose.composable !== true) {
+            return {
+                ok: false,
+                armed: false,
+                reason: 'not_composable',
+                message: 'An org profile resolves, but no valid client-vault binding could be composed from it, so the vault was NOT armed. ' +
+                    ARM_VAULT_REMEDY,
+                warnings: compose.warnings,
+            };
+        }
+        if ((compose.action === 'create' || compose.action === 'update') && compose.wrote !== true) {
+            return {
+                ok: false,
+                armed: false,
+                reason: 'compose_write_failed',
+                message: 'The binding was composed but .platform-bindings.json was not written, so the vault was NOT armed. ' + ARM_VAULT_REMEDY,
+                warnings: compose.warnings,
+            };
+        }
+        const vaultKeysArmed = armVaultKeysWhereAbsent(cwd);
         return {
-            ok: true, armed: false, enabled: current, required: requiredAfter, practicesEnabled: practicesAfter, client,
-            message: `${clauses.join('; ')} — nothing to do.`,
+            ok: true,
+            armed: true,
+            profile: {
+                packageName: compose.profile.packageName,
+                version: compose.profile.version,
+                source: compose.profile.source,
+            },
+            compose: { action: compose.action, wrote: compose.wrote },
+            vaultKeysArmed,
+            // VAULT-EGRESS-1: the written file holds the raw coordinate; the report is display-safe.
+            provenance: (0, compose_bindings_cjs_1.redactComposeResultForEmission)(compose).provenance,
+            warnings: compose.warnings,
+            note: 'Project identity (project.*) was not captured by this step; /pp-init completes it.',
         };
     }
-    try {
-        writeConfigMerge(cwd, { vault: patch });
-    }
     catch (err) {
         return {
-            ok: false, armed: false, enabled: current, required: currentRequired, practicesEnabled: currentPractices, client,
-            message: writeFailedMessage(err),
+            ok: false,
+            armed: false,
+            reason: 'write_failed',
+            message: writeFailedMessage(err) + ' ' + ARM_VAULT_REMEDY,
+            warnings: [],
         };
     }
-    return {
-        ok: true, armed: true, enabled: enabledAfter, required: requiredAfter, practicesEnabled: practicesAfter, client,
-        message: `${clauses.join('; ')}.`,
-    };
 }
 // ─── cmdInitContract ────────────────────────────────────────────────────────
-/**
- * CLI adapter for `pp-tools query init-contract`.
- *
- * `--verify` runs `verifyInitInvariants` and always prints the full result
- * as data (so `init.md` can read and show every violation verbatim), then
- * sets `process.exitCode = 1` when the result is not `ok` — a data
- * verdict, never an `error()` usage failure. This is the load-bearing
- * property Task 2's acceptance requires: a caller cannot mistake a failed
- * check for a pass, but the JSON body still reaches stdout either way.
- *
- * `--questions` (also the no-flag default, matching this seam's
- * safe-default convention — mirrors `compose-bindings`'s dry-run default)
- * is read-only and always exits 0.
- *
- * `--session-reset` / `--session-answer` / `--session-next` (34-08 gap
- * closure) drive the session state machine above. Precedence — reset,
- * then answer, then next, then verify, then the questions default — mirrors
- * the order a relay loop actually calls them in (an agent never sends more
- * than one of these per invocation; the order only matters for a caller
- * that somehow set two, which should never happen from `pp-tools.cjs`'s own
- * parsing). `--session-answer` and `--session-next` both set
- * `process.exitCode = 1` on a data verdict that means "not ready to
- * proceed" (`ok: false` / `error` present) — same never-a-usage-failure
- * convention as `--verify`.
- */
+/** CLI adapter for `pp-tools query init-contract`: the session, record, arm-vault, verify and questions flags.
+ * Data verdicts set `exitCode = 1` when not ok, but the JSON result is always printed. */
 function cmdInitContract(cwd, options, raw) {
-    if (options.armVault === true) {
-        const result = armVault(cwd);
-        output(result, raw);
-        if (!result.ok) {
-            process.exitCode = 1;
-        }
-        return;
-    }
     if (options.sessionReset === true) {
         const result = initSessionReset(cwd);
         output(result, raw);
@@ -1271,6 +1155,32 @@ function cmdInitContract(cwd, options, raw) {
         }
         return;
     }
+    // Record writes run before `--verify`, so a combined call verifies the written state.
+    if (options.recordProbe !== undefined) {
+        const result = recordProbeOutcome(cwd, options.recordProbe);
+        output(result, raw);
+        if (!result.ok) {
+            process.exitCode = 1;
+        }
+        return;
+    }
+    if (options.deferProbe !== undefined) {
+        const result = recordProbeDeferral(cwd, options.deferProbe);
+        output(result, raw);
+        if (!result.ok) {
+            process.exitCode = 1;
+        }
+        return;
+    }
+    // An inert `armed: false` is a data verdict on exit 0, like the inert init path; only `ok: false` exits 1.
+    if (options.armVault === true) {
+        const result = armVaultFromProfile(cwd, { offline: options.offline === true });
+        output(result, raw);
+        if (result.ok === false) {
+            process.exitCode = 1;
+        }
+        return;
+    }
     if (options.verify === true) {
         const result = verifyInitInvariants(cwd);
         output(result, raw);