@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/vault-audit.cjs

@@ -4,8 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 /**
  * src/vault-audit.cts — the pure `vault audit` evaluator: the ONE engine both
- * surfaces call (`vault audit <phase-dir>` for an operator, `check vault.audit`
- * for the blocking gate at verify:post and ship:pre).
+ * surfaces in plan 05-06 call (Vault Assurance #71924, phase 05 plan 05;
+ * CHECK-03, CHECK-04).
  *
  * Responsibility. Given the practices the cached vault holds and the files a
  * phase actually changed, decide — per practice — one of exactly four verdicts
@@ -20,32 +20,31 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *     `MATCH_BUDGET_MS` plus `MATCHED_FILES_CAP`.
  *
  *     Nothing on the matching path is re-implemented here and no grammar is
- *     restated in prose: a second matcher would be a copy free to drift. The
- *     declarative-check rule (docs/practices-format.md) — no client-authored
- *     byte is ever compiled into a regular expression — is why content tokens
- *     below are tested by `String.prototype.includes` and nothing else, and
- *     why `globMatch` runs the polynomial matcher rather than a pattern
- *     compiler. The verdict half is mechanised, not merely stated:
- *     `eslint-rules/practices-boundary-inputs.cjs` is wired at this file in
- *     `eslint.config.mjs`.
- *   - `./phase-manifest.cjs` (`readPhaseManifestEntry`) — the phase's recorded
- *     start commit, read from the file `phase manifest start|record` writes.
- *   - `./vault-trace.cjs` — the ledger API: SUMMARY `gitCommit` digests for the
- *     trace-digest rung, and the `check:` census the ledgers recorded.
+ *     restated in prose. ADR-71924 §2 refuses to restate the glob grammar
+ *     precisely so the two cannot drift, and a second matcher would be the
+ *     drifting copy it refuses. §3's prohibition — no client-authored byte is
+ *     ever compiled into a regular expression — is why content tokens below are
+ *     tested by `String.prototype.includes` and nothing else. That prohibition
+ *     is mechanised, not merely stated: `eslint-rules/practices-boundary-inputs.cjs`
+ *     is wired at this file in `eslint.config.mjs`.
  *   - `./git-base-branch.cjs` (`resolveBaseBranchResult`) — the 5-tier ladder is
  *     never re-derived; issue #1146 records what the naive form cost. The RESULT
  *     form, so a REFUSED `git.base_branch` becomes a stated note rather than a
  *     silent change of range (W16).
- *   - `./shell-command-projection.cjs` (`execGit`) — the mandated, timeout-bounded
+ *   - `./shell-command-projection.cjs` (`execGitLocal`, D-116) — the mandated, timeout-bounded
  *     git seam. `execFileSync` is not used anywhere in this module.
  *
  * WHAT `require` MEANS HERE, stated because a recorded number depends on it.
  * A `require` token is satisfied when EVERY matched file contains it. This is
- * the per-file reading. It is chosen because it is the only reading under which a FAIL can name a SPECIFIC
+ * the per-file reading, and it is the reading the CHECK-05 census in
+ * `docs/adr/71924-declarative-check-blocks.md` states as its premise ("`require`
+ * is read per matched file") and measured its 19-of-55 count under. It is
+ * chosen because it is the only reading under which a FAIL can name a SPECIFIC
  * offending file — and a verdict that cannot name what offended it is a verdict
  * an auditor cannot act on, which is the failure D-05-03's vocabulary exists to
- * prevent. Changing this to "some matched file contains the token" is a
- * decision with a paper trail, not an implementation detail.
+ * prevent. Changing this to "some matched file contains the token" would move
+ * the recorded census; it is a decision with a paper trail, not an
+ * implementation detail.
  *
  * TWO KNOWN LIMITS OF THE DIFF, recorded here rather than rediscovered later.
  * Both are inherited deliberately from `cmdShipPractices`' scoping mechanism,
@@ -66,22 +65,17 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
 const git_base_branch_cjs_1 = require("./git-base-branch.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const practicesMod = require("./vault-practices.cjs");
-// The trace leaf (the ledger API), for the SUMMARY trace-digest rung of
-// `resolvePhaseRange` and for the recorded `check:` census. `vault-trace.cts`
-// imports `vault.cjs` and the practices leaf only, and neither imports this
-// module, so this adds no cycle.
+// 260915-ik2 (UAT-6-F1): the trace leaf, for the SUMMARY trace-digest rung of
+// `resolvePhaseRange`. `vault-trace.cts` imports `vault.cjs` and the practices
+// leaf only, and neither imports this module, so this adds no cycle.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const traceMod = require("./vault-trace.cjs");
-// The phase manifest's reader — the same module owns its writer.
+// 16-03: the one `.planning/` path test. Direction: this module imports the
+// seal leaf statically; the leaf requires this module only LAZILY, inside
+// `collectRecordedArtifacts`, so there is no load-time cycle (D-41).
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const phaseManifestMod = require("./phase-manifest.cjs");
-// The one remote/credential redactor, applied to vault-authored text before it
-// reaches the gate message.
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const vaultMod = require("./vault.cjs");
-const { parseVaultTraceBlock, readRecordedCensus } = traceMod;
-const { readPhaseManifestEntry, PHASE_MANIFEST_READ_MISS, COMMIT_SHA_SHAPE } = phaseManifestMod;
-const { redactRemoteText } = vaultMod;
+const vaultSeal = require("./vault-seal.cjs");
+const { parseVaultTraceBlock } = traceMod;
 const { globMatch, isSupportedGlob, boundedToken, discoverPracticeFiles, MATCH_PAIR_CAP, MATCH_BUDGET_MS, MATCHED_FILES_CAP, 
 // 05-REVIEW CR-02/CR-03: the shared fencing idiom and the errno redactor —
 // reused, never re-authored, so the two modules cannot disagree about how a
@@ -123,7 +117,12 @@ const AUDIT_VERDICT = Object.freeze({
  * verdict would let a one-character typo buy a non-blocking outcome, which is
  * the same trade `CHECK_INVALID` already refuses.
  *
- * EIGHT members, and all eight block.
+ * Quick 261015-at3 added `VAULT_STANDARDS_ONLY`: a standards vault (INDEX.md,
+ * no practice files) read in practices mode. A FAIL and not a NO_CHECK on the
+ * `PRACTICE_UNLOADABLE` argument — a practice layer the project is not reading
+ * has unknown check-bearing-ness, so it cannot buy a non-blocking outcome.
+ *
+ * NINE members, and all nine block.
  */
 const AUDIT_FAIL_REASON = Object.freeze({
     UNSATISFIED: 'unsatisfied',
@@ -134,11 +133,12 @@ const AUDIT_FAIL_REASON = Object.freeze({
     DIFF_UNREADABLE: 'diff_unreadable',
     VAULT_UNREADABLE: 'vault_unreadable',
     PRACTICE_UNLOADABLE: 'practice_unloadable',
+    VAULT_STANDARDS_ONLY: 'vault_standards_only',
 });
 /**
  * Where the compared range came from — recorded beside the range itself.
  *
- * In ladder order: the phase's recorded start commit,
+ * In ladder order (260915-ik2, UAT-6-F1): the phase's recorded start commit,
  * the parent of its first recorded commit, the parent of the ancestry-earliest
  * SUMMARY trace digest, and only then the base-branch fallback. Every source
  * but the last is resolved FROM THE PHASE, which is what WR-04's block predicate
@@ -162,9 +162,11 @@ const AUDIT_RANGE_SOURCE = Object.freeze({
      * gate block vacuously had no way to ask it about a range they knew was the
      * phase's. This is the diagnostic channel that answer needs.
      *
-     * A review tier that maps audit sources should leave this one unmapped, for
-     * the same reason as `base-branch`: a review that accepts no range flag can
-     * never be handed an operator range. Kebab-cased like its four siblings — it IS a source, unlike
+     * DELIBERATELY UNMAPPED in the review tier's
+     * `REVIEW_SOURCE_FOR_AUDIT_SOURCE` (`src/vault-review.cts:450-454`), for the
+     * same reason `base-branch` is: the review never accepts a range flag, so an
+     * operator range can never reach it and a mapping would assert a path that
+     * does not exist. Kebab-cased like its four siblings — it IS a source, unlike
      * `AUDIT_RANGE_OUTCOME`'s members.
      */
     OPERATOR_RANGE: 'operator-range',
@@ -218,7 +220,7 @@ function isValidOperatorRange(value) {
  * `phaseCommitsFor` returned `[]` for five structurally different grounds and
  * `resolvePhaseRange` distinguished none of them, so `rangeSource:
  * 'base-branch'` was the whole story an operator got. The executing checkout
- * writes the manifest itself, but a checkout that never ran
+ * writes the manifest itself (260915-ik2), but a checkout that never ran
  * `/pp-execute-phase` — a fresh clone or a CI runner where `.planning/` is
  * gitignored — has no manifest to read, and there the fallback fires whenever
  * no SUMMARY trace digest verifies either. That is precisely the case where
@@ -228,15 +230,15 @@ function isValidOperatorRange(value) {
  */
 const AUDIT_FALLBACK_REASON = Object.freeze({
     /** The phase directory's name does not begin with an `NN` or `NN.M` token. */
-    PHASE_SLUG_UNRECOGNISED: PHASE_MANIFEST_READ_MISS.PHASE_SLUG_UNRECOGNISED,
-    /** No `.phase-manifest.json` at the location `phase manifest start` writes for this phase. */
-    MANIFEST_NOT_FOUND: PHASE_MANIFEST_READ_MISS.MANIFEST_NOT_FOUND,
+    PHASE_SLUG_UNRECOGNISED: 'phase-slug-unrecognised',
+    /** No `.phase-manifest.json` exists anywhere on the walk up from the phase dir. */
+    MANIFEST_NOT_FOUND: 'manifest-not-found',
     /** A manifest was found but is not parseable JSON of the expected shape. */
-    MANIFEST_MALFORMED: PHASE_MANIFEST_READ_MISS.MANIFEST_MALFORMED,
-    /** A manifest parsed, but holds no usable entry for this phase under either key spelling. */
-    PHASE_ENTRY_MISSING: PHASE_MANIFEST_READ_MISS.PHASE_ENTRY_MISSING,
-    /** The phase's entry exists and records neither a start commit nor any commit. */
-    NO_COMMITS_RECORDED: PHASE_MANIFEST_READ_MISS.NO_COMMITS_RECORDED,
+    MANIFEST_MALFORMED: 'manifest-malformed',
+    /** A manifest parsed, but holds no entry for this phase under either key spelling. */
+    PHASE_ENTRY_MISSING: 'phase-entry-missing',
+    /** The phase's entry exists and records no commits. */
+    NO_COMMITS_RECORDED: 'no-commits-recorded',
     /** Commits were recorded, and git verified none of them. */
     COMMIT_UNVERIFIABLE: 'commit-unverifiable',
 });
@@ -256,7 +258,7 @@ const AUDIT_FALLBACK_REASON = Object.freeze({
  *
  * `range_unresolvable` is deliberately NOT a fifth `AUDIT_RANGE_SOURCE` member
  * (RESEARCH R7, Open Question 2): nothing was resolved, so there is no source
- * to name, and a consumer's source map would then owe it a mapping it
+ * to name, and `REVIEW_SOURCE_FOR_AUDIT_SOURCE` would then owe it a mapping it
  * has no meaning for.
  *
  * CASING. These three values are underscore-cased while the kebab-cased
@@ -331,6 +333,37 @@ function classifyRangeOutcome(input) {
 function isPhaseScopedSource(rangeSource) {
     return rangeSource !== AUDIT_RANGE_SOURCE.BASE_BRANCH;
 }
+/**
+ * Why `recordPhaseStart` / `recordPhaseCommits` wrote nothing (260915-ik2).
+ *
+ * Two members REUSE the reader's strings, deliberately: a phase slug the
+ * writer cannot key and a manifest it refuses to overwrite are the same facts
+ * the reader reports on the same file, and two spellings of one fact is the
+ * drift this module's frozen vocabularies exist to prevent.
+ */
+const PHASE_MANIFEST_WRITE_REASON = Object.freeze({
+    /** The phase directory is not an existing directory inside the project root. */
+    PHASE_DIR_UNRESOLVABLE: 'phase-dir-unresolvable',
+    /** The phase directory's name does not begin with an `NN` or `NN.M` token. */
+    PHASE_SLUG_UNRECOGNISED: AUDIT_FALLBACK_REASON.PHASE_SLUG_UNRECOGNISED,
+    /** git could not name the commit HEAD points at (an unborn branch, or no repository). */
+    HEAD_UNRESOLVABLE: 'head-unresolvable',
+    /** The manifest exists and is not a JSON object with an object `phases`; it is left untouched. */
+    MANIFEST_MALFORMED: AUDIT_FALLBACK_REASON.MANIFEST_MALFORMED,
+    /** `record` found no start commit for this phase — `start` never ran for it. */
+    START_NOT_RECORDED: 'start-not-recorded',
+    /** `record` found a start commit that git does not verify. */
+    START_UNVERIFIABLE: 'start-unverifiable',
+    /**
+     * `start` found no anchor for this phase, and its directory already holds a
+     * `*-SUMMARY.md`: the phase has been executed, so HEAD sits AFTER its own
+     * commits and an anchor there would scope the audit past them (R2). Nothing
+     * is written; the SUMMARY trace-digest rung is the range source instead.
+     */
+    PHASE_ALREADY_EXECUTED: 'phase-already-executed',
+    /** The atomic write (temp file + rename) failed; the temp file was removed. */
+    WRITE_FAILED: 'write-failed',
+});
 /**
  * The bounded WHOLE-file read for a content check (1 MiB).
  *
@@ -389,6 +422,13 @@ const AUDIT_OPERATOR_RANGE_REPAIR_SENTENCE = 'Repair: re-run the audit with a we
  * and nothing else (T-4-75).
  */
 const AUDIT_VAULT_REPAIR_SENTENCE = 'Repair: re-fetch the client vault with `pp-tools vault fetch`, confirm `.planning/vault` is readable, then run this audit again.';
+/**
+ * The standards-only arm's repair (quick 261015-at3). A sibling of the vault
+ * arm's sentence and deliberately not that sentence: re-fetching reproduces
+ * the same standards vault, so the only repair is the mode. A repair, never a
+ * removal (T-4-75).
+ */
+const AUDIT_STANDARDS_ONLY_REPAIR_SENTENCE = 'Repair: set "vault": {"mode": "standards"} in .planning/config.json (`pp-tools config-set vault.mode standards`, pp-core 1.16.0 or later), re-plan the phase, then run this audit again.';
 // ─── Shape predicates ─────────────────────────────────────────────────────────
 //
 // SHAPE-PREDICATES-BEGIN
@@ -397,7 +437,7 @@ const AUDIT_VAULT_REPAIR_SENTENCE = 'Repair: re-fetch the client vault with `pp-
 // module's own frozen verdict constants and nothing else. No regular
 // expression, no text-search primitive, no character-code probe, no inline
 // literal may appear here or reach a boundary decision anywhere in this file —
-// The declarative-check rule states the prohibition and `eslint-rules/practices-boundary-inputs.cjs`,
+// ADR-71924 §3 states the prohibition and `eslint-rules/practices-boundary-inputs.cjs`,
 // wired at this file in `eslint.config.mjs`, is what keeps it: a future edit
 // reintroducing one fails `npm run lint`, not a review.
 //
@@ -520,7 +560,7 @@ const AUDIT_COVERAGE_OUTCOME = Object.freeze({
 });
 /**
  * The counts-only coverage line (D-10-03, D-10-18), modelled on
- * the practice review's rate line and inheriting its two rules
+ * `renderRateLine` (`src/vault-review.cts:845`) and inheriting its two rules
  * verbatim:
  *
  *  - the figures are DERIVED from the four verdict counts and a supplied `n`
@@ -544,25 +584,6 @@ function renderMechanicalCoverageLine(counts) {
     return (`${checked} of ${applicable} practices mechanically checked · ` +
         `${pass} PASS · ${fail} FAIL · ${notMatched} NOT_MATCHED · ${noCheck} NO_CHECK`);
 }
-/**
- * The one sentence every surface states about the recorded `check:` census.
- *
- * The census is the vault's, taken when the ledger was written; this audit's
- * counts are the run's. The sentence keeps the two apart: it says what the
- * LEDGER records, and never that the audit found it. Engine-composed apart
- * from the artifact name, which is a file name in the phase directory and is
- * bounded.
- */
-function renderRecordedCensusLine(census) {
-    if (census === null)
-        return "No check: census is recorded in this phase's trace ledgers.";
-    const sha = census.resolvedSha ? census.resolvedSha.slice(0, 12) : 'an unrecorded sha';
-    const moved = census.distinct > 1
-        ? ` The phase's ledgers record ${census.distinct} different censuses, so the vault changed during the phase.`
-        : '';
-    return (`The phase's trace ledger (${boundedToken(census.artifact)}) records ${census.checkBearingPractices} of ` +
-        `${census.practiceUniverse} practices carrying a check: block, at vault ${sha}.${moved}`);
-}
 /**
  * Does this verdict set halt the gate? A blocking decision made on client data,
  * so it is audited: only a FAIL blocks, and it is emitted as a strict boolean
@@ -589,7 +610,7 @@ function blocksOnVerdicts(entries) {
  * gate rejects matches nothing here rather than being interpreted by some
  * second, more permissive reading of the same string. `globMatch` does the
  * matching; this module never writes one. That holds for the applies-to side
- * exactly as it already held for the check side (the declarative-check rule).
+ * exactly as it already held for the check side (ADR-71924 §2 and §3).
  */
 function matchCheckFiles(check, files, appliesTo) {
     const scope = Array.isArray(appliesTo) ? appliesTo : [];
@@ -634,7 +655,7 @@ function matchCheckFiles(check, files, appliesTo) {
  * Does `content` contain the literal token?
  *
  * Plain substring containment, and nothing else, ever. The token is a
- * client-authored byte sequence from the vault repository; the declarative-check rule bars it
+ * client-authored byte sequence from the vault repository; ADR-71924 §3 bars it
  * from every pattern compiler, so a token that LOOKS like a pattern is tested
  * as the literal text it is.
  */
@@ -932,21 +953,173 @@ function evaluatePractices(opts) {
         budgetExhausted,
     };
 }
+// ─── Diff scoping (D-05-08) ───────────────────────────────────────────────────
+/** How far up from a phase directory the manifest walk may climb. */
+const MANIFEST_WALK_MAX = 12;
+/** The manifest file `/pp-undo` already reads for exactly this purpose. */
+const PHASE_MANIFEST_FILE = '.phase-manifest.json';
 /**
- * The commit list and start commit this phase's manifest entry records, plus
- * the NAMED ground on which there was none.
- *
- * The manifest is written by `pp-tools phase manifest start|record`
- * (src/phase-manifest.cts): `start` at execute:pre anchors the phase at HEAD,
- * `record` after every wave lists the commits since. This reads it through the
- * same module, from the same file. The shas it returns are engine-written but
- * sit in editable planning data, so the resolver re-checks their shape before
- * any reaches a git argv. Never throws: every failure is a fallback to the next
- * rung, which is a WIDER comparison, never a narrower one.
+ * An engine-authored guard over engine-written values.
+ *
+ * The shas come from `.phase-manifest.json` — written by `recordPhaseStart` /
+ * `recordPhaseCommits` below, reached through `pp-tools vault manifest
+ * start|record` from the execute-phase step files — and, on the trace-digest
+ * rung, from the `gitCommit` digests in a phase's SUMMARY `vault:` blocks.
+ * Both files are editable planning data and every sha is interpolated into a
+ * git ARGV, where a leading `-` would be read as a flag rather than as a
+ * revision. This is the one shape a sha may have. It is NOT the client-authored
+ * path: no vault byte reaches this, so ADR-71924 §3 is untouched (it bans
+ * compiling a CLIENT-authored byte into a pattern, which nothing here does).
+ */
+const COMMIT_SHA_SHAPE = /^[0-9a-fA-F]{7,64}$/;
+/** The leading `NN` or `NN.M` token of a phase directory slug. */
+const PHASE_SLUG_SHAPE = /^(\d+(?:\.\d+)?)/;
+/**
+ * Is this manifest entry stamped for a DIFFERENT phase directory? (R1)
+ *
+ * Entries are keyed by phase NUMBER, and `/pp-new-milestone
+ * --reset-phase-numbers` reuses numbers, so a new milestone's `01-new` would
+ * otherwise inherit `01-old`'s anchor and commits. The writers stamp
+ * `phaseDir` with the directory basename; an entry whose stamp names another
+ * basename belongs to another phase. An entry with NO stamp (written before
+ * the stamp existed, or by hand) is not stale — it keeps the behaviour it had.
+ */
+function isStaleEntry(entry, slug) {
+    return typeof entry.phaseDir === 'string' && entry.phaseDir !== slug;
+}
+/** The one sentence a stale entry is disclosed with, shared by the reader and nothing else. */
+function staleEntryNote(key, recorded, slug) {
+    return (`the phase manifest entry "${boundedToken(key)}" is stale: it was recorded for phase directory ` +
+        `"${boundedToken(recorded)}", not "${boundedToken(slug)}" (a phase number reused after a milestone reset), ` +
+        'so its startCommit and commits were ignored');
+}
+/**
+ * The commit list this phase's manifest entry records, plus the NAMED ground
+ * on which there was none (05-10).
+ *
+ * Walks UP from the phase directory and tries the manifest at each ancestor,
+ * nearest first, which covers both the flat `.planning/phases/NN-slug` layout
+ * and the partitioned `.planning/workstreams/<name>/phases/NN-slug` one without
+ * either being special-cased. Never throws: every failure at every step is a
+ * fallback to the base-branch range, which is a WIDER comparison, never a
+ * narrower one.
+ *
+ * The miss ground is recorded NEAREST-FIRST and never overwritten by a further
+ * ancestor: the manifest closest to the phase directory is the one an operator
+ * would go and look at, so it is the one worth naming.
+ *
+ * `startCommit` is ADDITIVE (260915-ik2): an entry may carry it beside
+ * `commits`, and the `{ phases: { "05": { commits: [...] } } }` shape
+ * `/pp-undo` reads stays valid — an entry with only `commits` resolves exactly
+ * as it did before the field existed.
  */
 function phaseCommitsFor(root, phaseDir) {
-    const read = readPhaseManifestEntry({ root, phaseDir });
-    return { commits: read.commits, miss: read.miss, startCommit: read.startCommit, notes: read.notes };
+    const phaseDirAbs = node_path_1.default.resolve(phaseDir);
+    const slug = node_path_1.default.basename(phaseDirAbs);
+    const slugMatch = PHASE_SLUG_SHAPE.exec(slug);
+    if (!slugMatch)
+        return { commits: [], miss: AUDIT_FALLBACK_REASON.PHASE_SLUG_UNRECOGNISED, startCommit: null, notes: [] };
+    const rawToken = slugMatch[1];
+    const notes = [];
+    // A directory named `05-x` and a manifest keyed `5` are the same phase; try
+    // both spellings rather than guessing which writer produced the file.
+    const keys = [rawToken, String(Number(rawToken))];
+    let current = node_path_1.default.dirname(phaseDirAbs);
+    const rootAbs = node_path_1.default.resolve(root);
+    // Nearest-first, and never widened once set — see the header note.
+    let miss = AUDIT_FALLBACK_REASON.MANIFEST_NOT_FOUND;
+    const recordMiss = (ground) => {
+        if (miss === AUDIT_FALLBACK_REASON.MANIFEST_NOT_FOUND)
+            miss = ground;
+    };
+    for (let depth = 0; depth < MANIFEST_WALK_MAX; depth += 1) {
+        const candidate = node_path_1.default.join(current, PHASE_MANIFEST_FILE);
+        if (node_fs_1.default.existsSync(candidate)) {
+            try {
+                const parsed = JSON.parse(node_fs_1.default.readFileSync(candidate, 'utf8'));
+                const phases = parsed && typeof parsed === 'object' ? parsed.phases : undefined;
+                if (phases && typeof phases === 'object') {
+                    // A key present with an empty commit list is a DIFFERENT operator
+                    // problem from a key that is not there at all, so the two grounds
+                    // are separated rather than both reading "no entry".
+                    // A STALE entry (R1) is another phase's record, so for this phase it
+                    // is no entry at all: it counts as missing, and it is disclosed.
+                    const usable = (key) => {
+                        if (!Object.prototype.hasOwnProperty.call(phases, key))
+                            return false;
+                        const entry = phases[key];
+                        return !(entry && typeof entry === 'object' && isStaleEntry(entry, slug));
+                    };
+                    const present = keys.some(usable);
+                    recordMiss(present ? AUDIT_FALLBACK_REASON.NO_COMMITS_RECORDED : AUDIT_FALLBACK_REASON.PHASE_ENTRY_MISSING);
+                    // Both fields are read across both key spellings before returning,
+                    // so an anchor under `5` is not hidden by a commit list under `05`.
+                    let startCommit = null;
+                    let commits = null;
+                    for (const key of keys) {
+                        const entry = Object.prototype.hasOwnProperty.call(phases, key) ? phases[key] : undefined;
+                        if (!entry)
+                            continue;
+                        if (typeof entry === 'object' && isStaleEntry(entry, slug)) {
+                            const note = staleEntryNote(key, entry.phaseDir, slug);
+                            if (!notes.includes(note))
+                                notes.push(note);
+                            continue;
+                        }
+                        const start = entry.startCommit;
+                        if (startCommit === null && typeof start === 'string' && COMMIT_SHA_SHAPE.test(start)) {
+                            startCommit = start;
+                        }
+                        const listed = entry.commits;
+                        if (commits === null && Array.isArray(listed) && listed.length > 0) {
+                            commits = listed.filter((c) => typeof c === 'string');
+                        }
+                    }
+                    if (commits !== null)
+                        return { commits, miss: null, startCommit, notes };
+                    // An anchor with no commit list yet (execute:pre ran, verify:post has
+                    // not) IS a record, so it carries no miss ground.
+                    if (startCommit !== null)
+                        return { commits: [], miss: null, startCommit, notes };
+                }
+                else {
+                    recordMiss(AUDIT_FALLBACK_REASON.MANIFEST_MALFORMED);
+                }
+            }
+            catch {
+                // A malformed manifest is not a reason to invent a range; fall through
+                // to the base-branch fallback, which is over-broad but honest. The
+                // GROUND is recorded, because "the manifest you are looking at is not
+                // valid JSON" is a repairable fact and "there is no manifest" is not
+                // the same one.
+                recordMiss(AUDIT_FALLBACK_REASON.MANIFEST_MALFORMED);
+            }
+        }
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current)
+            break;
+        if (current === rootAbs)
+            break;
+        current = parent;
+    }
+    return { commits: [], miss, startCommit: null, notes };
+}
+/**
+ * Does the phase manifest hold a usable entry for this phase directory? (16-03, D-20)
+ *
+ * The seal leaf's `phase_manifest` artifact kind asks THIS reader, so "this
+ * phase has a manifest record" means exactly what the audit's own range ladder
+ * reads: an entry under either key spelling, not stale (R1), carrying a
+ * `commits` list or a `startCommit`. A second walk in the leaf could disagree
+ * with this one about a stale or malformed manifest. Never throws.
+ */
+function hasPhaseManifestEntry(root, phaseDir) {
+    try {
+        return phaseCommitsFor(root, phaseDir).miss === null;
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * Resolve the git range this audit compares, and record WHERE it came from.
@@ -958,7 +1131,7 @@ function phaseCommitsFor(root, phaseDir) {
  * to prevent (D-05-08). And when work is committed straight onto the base
  * branch, `base...HEAD` is EMPTY — the UAT-6-F1 halt.
  *
- * A FOUR-RUNG LADDER, in this order and no other:
+ * A FOUR-RUNG LADDER, in this order and no other (260915-ik2):
  *
  *   1. `phase-start-commit` — the manifest entry's `startCommit`, the commit
  *      HEAD sat at when `/pp-execute-phase` began the phase (written at
@@ -996,7 +1169,7 @@ function phaseCommitsFor(root, phaseDir) {
  *      with it so an operator can see the third rung was tried.
  */
 function resolvePhaseRange(opts) {
-    const exec = typeof opts.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGit;
+    const exec = typeof opts.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGitLocal;
     const found = (() => {
         try {
             return phaseCommitsFor(opts.root, opts.phaseDir);
@@ -1123,7 +1296,7 @@ function resolvePhaseRange(opts) {
         ...withLead(digest.notes),
     };
 }
-// ─── The trace-digest rung ────────────────────────────
+// ─── The trace-digest rung (260915-ik2, UAT-6-F1) ────────────────────────────
 /** The `gitCommit` shape the trace builder records — 40- or 64-hex, lowercase. */
 const TRACE_DIGEST_SHAPE = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/;
 /** At most this many distinct digests are verified and ranked, with a note when it bites. */
@@ -1136,7 +1309,7 @@ const TRACE_DIGEST_CANDIDATE_CAP = 64;
  * bounded by `AUDIT_FILE_READ_MAX`), parsed with the SHIPPED trace parser, and
  * its subjects' digests collected when they have the builder's own shape; the
  * wider `COMMIT_SHA_SHAPE` guard is applied again before any sha reaches argv
- * (the argv-shape guard). The distinct set is capped, then each is verified with
+ * (T-ik2-02). The distinct set is capped, then each is verified with
  * `rev-parse --verify <sha>^{commit}`: an unverifiable digest is never an
  * anchor.
  *
@@ -1250,6 +1423,333 @@ function traceDigestRange(opts) {
         return none(`the SUMMARY trace digests could not be read: ${errnoOf(err)}`);
     }
 }
+/**
+ * Where this phase's manifest lives, or the named ground on which it cannot.
+ *
+ * `phaseDir` resolves against `cwd`, then against `root`; the first that is an
+ * existing directory CONTAINED in the root wins (T-ik2-03), lexically or with
+ * symlinks resolved on both sides (a macOS temp root is `/var` and
+ * `/private/var` at once). The manifest sits two levels above the phase
+ * directory: `.planning/.phase-manifest.json` on the flat layout — the file
+ * `/pp-undo` reads — and `.planning/workstreams/<ws>/.phase-manifest.json` on
+ * a partitioned one, which the reader's walk finds at depth one and which keeps
+ * two workstreams' `05` entries apart.
+ */
+function resolveManifestTarget(opts) {
+    const unresolvable = { ok: false, reason: PHASE_MANIFEST_WRITE_REASON.PHASE_DIR_UNRESOLVABLE };
+    if (typeof opts?.root !== 'string' || opts.root === '')
+        return unresolvable;
+    if (typeof opts?.phaseDir !== 'string' || opts.phaseDir === '' || opts.phaseDir.includes('\0'))
+        return unresolvable;
+    const rootLexical = node_path_1.default.resolve(opts.root);
+    const rootReal = resolvedRootOf(rootLexical);
+    const bases = [typeof opts.cwd === 'string' && opts.cwd !== '' ? opts.cwd : process.cwd(), rootLexical];
+    let phaseDirAbs = null;
+    let rootAbs = rootLexical;
+    for (const base of bases) {
+        const abs = node_path_1.default.resolve(base, opts.phaseDir);
+        try {
+            if (!node_fs_1.default.statSync(abs).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (isContainedIn(abs, rootLexical)) {
+            phaseDirAbs = abs;
+            rootAbs = rootLexical;
+            break;
+        }
+        const real = resolvedRootOf(abs);
+        if (isContainedIn(real, rootReal)) {
+            phaseDirAbs = real;
+            rootAbs = rootReal;
+            break;
+        }
+    }
+    if (phaseDirAbs === null)
+        return unresolvable;
+    const slugMatch = PHASE_SLUG_SHAPE.exec(node_path_1.default.basename(phaseDirAbs));
+    if (!slugMatch)
+        return { ok: false, reason: PHASE_MANIFEST_WRITE_REASON.PHASE_SLUG_UNRECOGNISED };
+    const manifestAbs = node_path_1.default.join(node_path_1.default.dirname(node_path_1.default.dirname(phaseDirAbs)), PHASE_MANIFEST_FILE);
+    if (!isContainedIn(manifestAbs, rootAbs))
+        return unresolvable;
+    return {
+        ok: true,
+        target: {
+            rootAbs,
+            manifestAbs,
+            manifestPath: node_path_1.default.relative(rootAbs, manifestAbs).split(node_path_1.default.sep).join('/'),
+            rawToken: slugMatch[1],
+            phaseDirAbs,
+            phaseSlug: node_path_1.default.basename(phaseDirAbs),
+        },
+    };
+}
+/**
+ * The existing manifest, parsed for an ADDITIVE write — or `null` when it
+ * must not be overwritten: unparseable JSON, a non-object document, a
+ * non-object `phases`, or a non-object entry for this phase (T-ik2-05). An
+ * absent file is an empty document, not a refusal.
+ */
+function readManifestForWrite(manifestAbs) {
+    if (!node_fs_1.default.existsSync(manifestAbs))
+        return { doc: {}, phases: {}, raw: null };
+    try {
+        const raw = node_fs_1.default.readFileSync(manifestAbs, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        const doc = parsed;
+        if (doc.phases === undefined)
+            return { doc, phases: {}, raw };
+        if (!doc.phases || typeof doc.phases !== 'object' || Array.isArray(doc.phases))
+            return null;
+        return { doc, phases: doc.phases, raw };
+    }
+    catch {
+        return null;
+    }
+}
+/** The key this phase's entry lives under: an existing spelling wins, else the slug's own token. */
+function manifestKeyFor(phases, rawToken) {
+    const spellings = [rawToken, String(Number(rawToken))];
+    return spellings.find((key) => Object.prototype.hasOwnProperty.call(phases, key)) ?? rawToken;
+}
+/** The entry under `key` as a plain object, `{}` when absent, `null` when present and not an object. */
+function manifestEntryOf(phases, key) {
+    if (!Object.prototype.hasOwnProperty.call(phases, key))
+        return {};
+    const entry = phases[key];
+    return entry && typeof entry === 'object' && !Array.isArray(entry) ? entry : null;
+}
+/** Two-space JSON with a trailing newline — the one serialization, so a re-record is byte-stable. */
+function serializeManifest(doc) {
+    return `${JSON.stringify(doc, null, 2)}\n`;
+}
+/**
+ * Write atomically: a sibling temp file named with the pid, then `renameSync`
+ * over the target — the pattern `src/runtime-hooks-surface.cts` uses. The temp
+ * file is removed on any failure. Returns `null` on success, else an errno.
+ */
+function writeManifestAtomic(manifestAbs, serialized) {
+    const tmp = `${manifestAbs}.${process.pid}.tmp`;
+    try {
+        node_fs_1.default.writeFileSync(tmp, serialized, 'utf8');
+        node_fs_1.default.renameSync(tmp, manifestAbs);
+        return null;
+    }
+    catch (err) {
+        try {
+            node_fs_1.default.unlinkSync(tmp);
+        }
+        catch {
+            // Nothing to remove, or it cannot be removed; the refusal below stands.
+        }
+        return errnoOf(err);
+    }
+}
+/**
+ * Has this phase already been executed? (R2) `true` when its directory holds
+ * any `*-SUMMARY.md` — the same file set the trace-digest rung reads — and
+ * `null` when the directory cannot be listed, which the caller refuses on
+ * rather than guessing.
+ */
+function phaseHasSummary(phaseDirAbs) {
+    try {
+        return node_fs_1.default.readdirSync(phaseDirAbs).some((name) => name.endsWith('-SUMMARY.md'));
+    }
+    catch {
+        return null;
+    }
+}
+/** A verified commit sha from a `rev-parse --verify` probe, or `null`. */
+function verifiedSha(exec, rev, cwd) {
+    const probe = exec(['rev-parse', '--verify', rev], { cwd });
+    if (probe.exitCode !== 0 || probe.error)
+        return null;
+    const sha = String(probe.stdout || '').trim();
+    return COMMIT_SHA_SHAPE.test(sha) ? sha : null;
+}
+/**
+ * Anchor the phase: `phases[NN].startCommit = HEAD`, WRITE-ONCE.
+ *
+ * Called at execute:pre, in this order:
+ *
+ *   1. WRITE-ONCE. An entry for THIS phase directory that already carries a
+ *      start commit is left byte-identical and reported `unchanged: true`, so
+ *      a resume or a `--gaps-only` run keeps the anchor the phase actually
+ *      started from. An unstamped (legacy) entry counts as this phase's.
+ *   2. ALREADY EXECUTED (R2). With no usable anchor, a phase directory that
+ *      already holds a `*-SUMMARY.md` is refused as `phase-already-executed`
+ *      and nothing is written: execute:pre fires on every re-run, and HEAD on
+ *      an executed phase sits after its own commits, so an anchor there would
+ *      put the phase's work outside its own range. The trace-digest rung is
+ *      the range source for such a phase.
+ *   3. STALE (R1). An entry stamped for another phase directory — a number
+ *      reused after a milestone reset — is REPLACED by a fresh
+ *      `{ startCommit, phaseDir }`; its old commits are dropped. The result
+ *      carries `replacedStale: true`.
+ *
+ * Every write stamps `phaseDir` with the directory basename. Any `commits`
+ * beside a non-stale entry are preserved. Never throws; a refusal is
+ * `{ ok: false, action, reason }` with a `PHASE_MANIFEST_WRITE_REASON` member.
+ */
+function recordPhaseStart(opts) {
+    const action = 'start';
+    try {
+        const exec = typeof opts?.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGitLocal;
+        const resolved = resolveManifestTarget(opts);
+        if (!resolved.ok)
+            return { ok: false, action, reason: resolved.reason };
+        const { target } = resolved;
+        const read = readManifestForWrite(target.manifestAbs);
+        if (read === null)
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.MANIFEST_MALFORMED };
+        const key = manifestKeyFor(read.phases, target.rawToken);
+        const entry = manifestEntryOf(read.phases, key);
+        if (entry === null)
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.MANIFEST_MALFORMED };
+        const stale = isStaleEntry(entry, target.phaseSlug);
+        // Write-once: the anchor a phase began from is never moved by a later run.
+        if (!stale && typeof entry.startCommit === 'string' && COMMIT_SHA_SHAPE.test(entry.startCommit)) {
+            return {
+                ok: true,
+                action,
+                manifestPath: target.manifestPath,
+                phase: key,
+                startCommit: entry.startCommit,
+                unchanged: true,
+            };
+        }
+        // Checked before HEAD is read: a refusal asks git nothing (R2).
+        const executed = phaseHasSummary(target.phaseDirAbs);
+        if (executed === null) {
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.PHASE_DIR_UNRESOLVABLE };
+        }
+        if (executed)
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.PHASE_ALREADY_EXECUTED };
+        const head = verifiedSha(exec, 'HEAD^{commit}', target.rootAbs);
+        if (head === null)
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.HEAD_UNRESOLVABLE };
+        const fresh = stale
+            ? { startCommit: head, phaseDir: target.phaseSlug }
+            : { ...entry, startCommit: head, phaseDir: target.phaseSlug };
+        const doc = { ...read.doc, phases: { ...read.phases, [key]: fresh } };
+        const failure = writeManifestAtomic(target.manifestAbs, serializeManifest(doc));
+        if (failure !== null) {
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.WRITE_FAILED, detail: failure };
+        }
+        return {
+            ok: true,
+            action,
+            manifestPath: target.manifestPath,
+            phase: key,
+            startCommit: head,
+            unchanged: false,
+            ...(stale ? { replacedStale: true } : {}),
+        };
+    }
+    catch (err) {
+        return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.WRITE_FAILED, detail: errnoOf(err) };
+    }
+}
+/**
+ * Close the phase's range: `phases[NN].commits` =
+ * `git rev-list --reverse --no-merges <startCommit>..HEAD`, oldest first.
+ *
+ * Called at verify:post, before the `vault.audit` gate. Recomputed from the
+ * anchor on every call, so two consecutive records leave the file
+ * byte-identical (and the second writes nothing). An empty list is a valid,
+ * honest record. A phase with no anchor answers `start-not-recorded` — the case
+ * the trace-digest rung covers — and so does an entry stamped for ANOTHER
+ * phase directory (R1): that anchor is another phase's, so nothing is listed
+ * from it and the file is left for `start` to replace. A successful record
+ * stamps `phaseDir`, which also adopts an unstamped (legacy) entry. Never
+ * throws.
+ */
+function recordPhaseCommits(opts) {
+    const action = 'record';
+    try {
+        const exec = typeof opts?.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGitLocal;
+        const resolved = resolveManifestTarget(opts);
+        if (!resolved.ok)
+            return { ok: false, action, reason: resolved.reason };
+        const { target } = resolved;
+        const read = readManifestForWrite(target.manifestAbs);
+        if (read === null)
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.MANIFEST_MALFORMED };
+        const key = manifestKeyFor(read.phases, target.rawToken);
+        const entry = manifestEntryOf(read.phases, key);
+        if (entry === null)
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.MANIFEST_MALFORMED };
+        if (isStaleEntry(entry, target.phaseSlug)) {
+            return {
+                ok: false,
+                action,
+                reason: PHASE_MANIFEST_WRITE_REASON.START_NOT_RECORDED,
+                detail: 'the entry under this phase number was recorded for another phase directory',
+            };
+        }
+        const start = entry.startCommit;
+        if (typeof start !== 'string' || !COMMIT_SHA_SHAPE.test(start)) {
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.START_NOT_RECORDED };
+        }
+        if (verifiedSha(exec, `${start}^{commit}`, target.rootAbs) === null) {
+            return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.START_UNVERIFIABLE };
+        }
+        const listed = exec(['rev-list', '--reverse', '--no-merges', `${start}..HEAD`], { cwd: target.rootAbs });
+        if (listed.exitCode !== 0 || listed.error) {
+            return {
+                ok: false,
+                action,
+                reason: PHASE_MANIFEST_WRITE_REASON.HEAD_UNRESOLVABLE,
+                detail: 'git rev-list could not list the commits since the start commit',
+            };
+        }
+        const commits = String(listed.stdout || '')
+            .split('\n')
+            .map((line) => line.trim())
+            .filter((line) => COMMIT_SHA_SHAPE.test(line));
+        const doc = {
+            ...read.doc,
+            phases: { ...read.phases, [key]: { ...entry, commits, phaseDir: target.phaseSlug } },
+        };
+        const serialized = serializeManifest(doc);
+        if (serialized !== read.raw) {
+            const failure = writeManifestAtomic(target.manifestAbs, serialized);
+            if (failure !== null) {
+                return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.WRITE_FAILED, detail: failure };
+            }
+        }
+        return {
+            ok: true,
+            action,
+            manifestPath: target.manifestPath,
+            phase: key,
+            startCommit: start,
+            commits,
+            commitCount: commits.length,
+        };
+    }
+    catch (err) {
+        return { ok: false, action, reason: PHASE_MANIFEST_WRITE_REASON.WRITE_FAILED, detail: errnoOf(err) };
+    }
+}
+/** The one-line operator rendering of a writer result; the step files print it and continue. */
+function renderManifestResult(result) {
+    const r = (result && typeof result === 'object' ? result : {});
+    if (r.ok !== true)
+        return `Phase manifest not written: ${boundedToken(r.reason ?? 'unknown')}`;
+    const sha7 = typeof r.startCommit === 'string' ? r.startCommit.slice(0, 7) : '';
+    if (r.action === 'record') {
+        return `Phase ${boundedToken(r.phase)}: ${Number(r.commitCount)} commit(s) recorded from ${sha7}..HEAD in ${boundedToken(r.manifestPath)}`;
+    }
+    return (`Phase ${boundedToken(r.phase)} anchored at ${sha7} in ${boundedToken(r.manifestPath)}` +
+        (r.unchanged === true ? ' (already anchored; unchanged)' : '') +
+        (r.replacedStale === true ? ' (replaced a stale entry recorded for another phase directory)' : ''));
+}
 // ─── The audit envelope ───────────────────────────────────────────────────────
 /** Is this resolved absolute path the root itself, or somewhere beneath it? */
 function isContainedIn(abs, rootAbs) {
@@ -1366,7 +1866,8 @@ function diffFilesFor(root, range, exec) {
         .map((f) => f.replace(/\\/g, '/'))
         // Load-bearing: a practice glob like `**/*.md` would otherwise match the
         // phase's own planning artifacts and FAIL a practice about product code.
-        .filter((f) => !f.startsWith('.planning/'));
+        // 16-03: the seal leaf owns the `.planning/` path test.
+        .filter((f) => !vaultSeal.isPlanningPath(f));
     const capped = all.length > AUDIT_DIFF_FILE_CAP;
     return { ok: true, files: capped ? all.slice(0, AUDIT_DIFF_FILE_CAP) : all, capped, total: all.length };
 }
@@ -1394,7 +1895,7 @@ function failItemLines(entries) {
         return [];
     // 05-REVIEW CR-02: `id` and `detail` carry vault-authored bytes (the parser
     // pins `id` to the vault filename; `detail` quotes require/forbid tokens),
-    // and the gate runner (`loop run-gates`) prints `message` verbatim into an orchestrating
+    // and `check-query-gate.md` prints `message` verbatim into an orchestrating
     // agent's context on every run — the channel this module's own header calls
     // agent-EXECUTABLE. So the itemized region is defanged and fenced with the
     // idiom `renderPracticeEntry` already uses: a planted fence marker cannot
@@ -1403,15 +1904,10 @@ function failItemLines(entries) {
     // stays OUTSIDE the fence — the notice's claim about what is inside must
     // stay true. The repair sentence is appended by the callers, after this
     // return, so it remains the closing line a prepend can never cut off.
-    //
-    // REDACTED before defanged: a `require`/`forbid` token the vault wrote can
-    // carry a credential-bearing remote, and this message is printed verbatim.
-    // `redactRemoteText` is the one redactor (src/vault.cts); the fence is the
-    // one fence. Both are applied, neither is re-authored here.
     const items = [];
     for (const fail of fails.slice(0, AUDIT_MESSAGE_PROBLEM_CAP)) {
-        const detail = fail.detail ? ` — ${defangFenceMarkers(redactRemoteText(fail.detail))}` : '';
-        items.push(`- ${defangFenceMarkers(redactRemoteText(fail.id))}: ${String(fail.reason)}${detail}`);
+        const detail = fail.detail ? ` — ${defangFenceMarkers(fail.detail)}` : '';
+        items.push(`- ${defangFenceMarkers(fail.id)}: ${String(fail.reason)}${detail}`);
     }
     const lines = [EXTERNAL_CONTENT_FENCE_START, ...FENCE_NOTICE, '', ...items, EXTERNAL_CONTENT_FENCE_END];
     const omitted = fails.length - Math.min(fails.length, AUDIT_MESSAGE_PROBLEM_CAP);
@@ -1447,7 +1943,7 @@ function noteLine(note) {
  *
  * THE ONE COMPOSITION POINT, used by every return path of `runVaultAudit`
  * (05-10, G-1c). Before it, `notes[]` reached neither `block` nor `message` and
- * the gate runner (`loop run-gates`) reads nothing else — so a truncated diff, a refused
+ * `check-query-gate.md` reads nothing else — so a truncated diff, a refused
  * pair count, an unreadable practices directory and a base-branch fallback were
  * all invisible at the gate. The notes go FIRST because they are the limits
  * that may explain the findings below them, and because putting them first is
@@ -1534,7 +2030,7 @@ function verdictsWithoutComparison(practices, reason, detail) {
  * `vaultUnreadable` is computed from TYPED FIELDS and from the catch, never
  * from note prose. That is the whole point: before 05-10 the only vault-side
  * signal was a string in `notes[]`, `notes[]` reached neither `block` nor
- * `message`, and the gate runner reads nothing else — so
+ * `message`, and the enforcer at check-query-gate.md reads nothing else — so
  * every vault-side miss rendered as a clean pass (G-1a). A `startsWith()` over
  * the note would have re-created the prose-matching this codebase already
  * rejected once (`matchBudgetNotes`).
@@ -1547,6 +2043,7 @@ function runDiscovery(discover, root) {
             notes: [...(discovery?.notes ?? [])],
             skipped: Array.isArray(discovery?.skipped) ? discovery.skipped : [],
             vaultUnreadable: discovery?.readFailed === true || discovery?.vaultPresent === false,
+            vaultStandardsOnly: discovery?.vaultStandardsOnly === true,
         };
     }
     catch {
@@ -1559,6 +2056,7 @@ function runDiscovery(discover, root) {
             notes: ['the vault could not be read; no practice was evaluated'],
             skipped: [],
             vaultUnreadable: true,
+            vaultStandardsOnly: false,
         };
     }
 }
@@ -1641,8 +2139,6 @@ function refusedOperatorRangeResult() {
         mechanicallyChecked: counts.mechanicallyChecked,
         applicablePractices: counts.applicablePractices,
         evaluatedNothing: counts.evaluatedNothing,
-        // Nothing is read for a refused input, the ledgers included.
-        recordedCensus: null,
         practices: [],
         pairsEvaluated: 0,
         pairCap: MATCH_PAIR_CAP,
@@ -1670,13 +2166,8 @@ function refusedOperatorRangeResult() {
  * blocking gate.
  */
 function runVaultAudit(opts) {
-    const exec = typeof opts.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGit;
-    // The default reads the cache through `resolveVaultCacheDir` — the same
-    // worktree-aware answer the practice trace pins against — so the audit and
-    // the ledger it is read beside describe one vault.
-    const discover = typeof opts.discover === 'function'
-        ? opts.discover
-        : (root) => discoverPracticeFiles(root, vaultMod.resolveVaultCacheDir(root).dir);
+    const exec = typeof opts.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGitLocal;
+    const discover = typeof opts.discover === 'function' ? opts.discover : discoverPracticeFiles;
     const readFile = typeof opts.readFile === 'function' ? opts.readFile : createBoundedFileReader(opts.root);
     // D-08-19. An operator range REPLACES the ladder rather than joining it: the
     // operator is answering the question the ladder failed to answer, so
@@ -1693,15 +2184,6 @@ function runVaultAudit(opts) {
     const { range, rangeSource, fallbackReason, baseBranchRefused, notes: rangeNotes } = resolved;
     const discovery = runDiscovery(discover, opts.root);
     const practices = discovery.practices;
-    // Read once, from the ledgers, and carried on every arm below.
-    const recordedCensus = (() => {
-        try {
-            return readRecordedCensus(opts.phaseDir);
-        }
-        catch {
-            return null;
-        }
-    })();
     const notes = [...discovery.notes];
     if (operatorRange !== null) {
         // THE DISCLOSURE (D-08-19, threat T-08-25 — accepted, on this sentence).
@@ -1733,11 +2215,11 @@ function runVaultAudit(opts) {
         // the ground is a repairable fact rather than an unavoidable one. Stating
         // it is what makes the range record auditable on a checkout that has no
         // manifest to read — a fresh clone or CI runner where `.planning/` is
-        // gitignored, since only the executing checkout writes one.
+        // gitignored, since only the executing checkout writes one (260915-ik2).
         notes.push(`phase range fell back to the base-branch form (${range}) because the phase-scoped range could not be ` +
             `resolved: ${fallbackReason}`);
     }
-    // The ladder's own notes: a trace-digest range's under-scope
+    // The ladder's own notes (260915-ik2): a trace-digest range's under-scope
     // disclosure, or the statement that the digest rung was tried and found
     // nothing verifiable. Either is a limit on what the range establishes.
     for (const note of rangeNotes ?? [])
@@ -1776,7 +2258,43 @@ function runVaultAudit(opts) {
             mechanicallyChecked: vaultArmCounts.mechanicallyChecked,
             applicablePractices: vaultArmCounts.applicablePractices,
             evaluatedNothing: vaultArmCounts.evaluatedNothing,
-            recordedCensus,
+            practices: entries,
+            pairsEvaluated: 0,
+            pairCap: MATCH_PAIR_CAP,
+            budgetMs: MATCH_BUDGET_MS,
+            filesConsidered: 0,
+            filesCapped: false,
+            notes,
+        };
+    }
+    if (discovery.vaultStandardsOnly) {
+        // Quick 261015-at3 (QD-06, Vince 2026-10-15): the client vault WAS read,
+        // and it is a standards vault — INDEX.md at its root, no practice files —
+        // read in practices mode. Discovery yields zero practices by construction,
+        // and before this arm the audit compared nothing, warned, and did not
+        // block. Placed after the vault-unreadable arm (an unread vault is the more
+        // basic fact) and before the diff is read (nothing here needs it).
+        const entries = [
+            ...verdictsWithoutComparison(practices, AUDIT_FAIL_REASON.VAULT_STANDARDS_ONLY, `the client vault holds standards (INDEX.md) and no practice files, so this practice was never compared against ${range}`),
+            ...unloadable,
+        ];
+        const armCounts = countVerdicts(entries);
+        const lead = `Vault audit: the client vault at .planning/vault holds standards (INDEX.md) and no practice files, ` +
+            `but vault.mode is practices, so no practice was compared against ${range} (source: ${rangeSource}) ` +
+            `and nothing was verified. ${failingEntries(entries).length} practice check(s) are recorded as FAILED.`;
+        return {
+            status: 'warn',
+            // EXPLICITLY true, for the vault-unreadable arm's reason verbatim: on this
+            // arm `entries` is empty by construction, `blocksOnVerdicts([])` is false,
+            // and a gate handed no practice layer verified nothing (G-1a).
+            block: true,
+            message: composeWithNotes(notes, [lead, ...failItemLines(entries), AUDIT_STANDARDS_ONLY_REPAIR_SENTENCE].join('\n')),
+            range,
+            rangeSource,
+            rangeOutcome: classifyRangeOutcome({ phaseScoped: isPhaseScopedSource(rangeSource), filesConsidered: 0 }),
+            mechanicallyChecked: armCounts.mechanicallyChecked,
+            applicablePractices: armCounts.applicablePractices,
+            evaluatedNothing: armCounts.evaluatedNothing,
             practices: entries,
             pairsEvaluated: 0,
             pairCap: MATCH_PAIR_CAP,
@@ -1808,7 +2326,6 @@ function runVaultAudit(opts) {
             mechanicallyChecked: diffArmCounts.mechanicallyChecked,
             applicablePractices: diffArmCounts.applicablePractices,
             evaluatedNothing: diffArmCounts.evaluatedNothing,
-            recordedCensus,
             practices: entries,
             pairsEvaluated: 0,
             pairCap: MATCH_PAIR_CAP,
@@ -1832,7 +2349,7 @@ function runVaultAudit(opts) {
     //
     // On the FALLBACK range that reasoning does not hold, because nothing
     // established that the range corresponds to this phase. The fallback is the
-    // FOURTH rung of `resolvePhaseRange`'s ladder: it is reached
+    // FOURTH rung of `resolvePhaseRange`'s ladder (260915-ik2): it is reached
     // only when the phase has no usable manifest entry (no verifiable startCommit
     // or commit) AND no verifiable SUMMARY trace digest. With
     // `git.branching_strategy: none` — this project's own setting — `main...HEAD`
@@ -1865,7 +2382,7 @@ function runVaultAudit(opts) {
     }
     if (unverifiableEmptyRange) {
         // PREFIXED with the outcome code (08-04, D-08-17). `message` is composed
-        // from `notes`, and the gate runner (`loop run-gates`) prints `message` verbatim — so
+        // from `notes`, and `check-query-gate.md` prints `message` verbatim — so
         // putting the code at the head of this sentence is what makes
         // `range_unresolvable` greppable in BOTH of the two fields the enforcer
         // reads, not only in the envelope field a workflow would have to parse.
@@ -1893,7 +2410,7 @@ function runVaultAudit(opts) {
     if (counts.evaluatedNothing) {
         // PREFIXED with the outcome token, following the `range_unresolvable`
         // precedent above: `message` is composed from `notes` and
-        // the gate runner (`loop run-gates`) prints `message` verbatim, so putting the token at
+        // `check-query-gate.md` prints `message` verbatim, so putting the token at
         // the head of this sentence is what makes the fact greppable in BOTH of the
         // fields the enforcer reads, not only in an envelope field a workflow would
         // have to parse. Composed entirely from engine strings and integers — no
@@ -1902,7 +2419,7 @@ function runVaultAudit(opts) {
         notes.push(`${AUDIT_COVERAGE_OUTCOME.EVALUATED_NOTHING}: ${counts.mechanicallyChecked} of ` +
             `${counts.applicablePractices} applicable practice(s) were mechanically checked over ${range} ` +
             `(source: ${rangeSource}) — no check block was compared against any file, so this run verified ` +
-            `nothing mechanically and no passing claim can be drawn from it. ${renderRecordedCensusLine(recordedCensus)}`);
+            `nothing mechanically and no passing claim can be drawn from it`);
     }
     return {
         // D-10-11: a run in which nothing was mechanically checked is `warn`, never
@@ -1933,7 +2450,6 @@ function runVaultAudit(opts) {
         mechanicallyChecked: counts.mechanicallyChecked,
         applicablePractices: counts.applicablePractices,
         evaluatedNothing: counts.evaluatedNothing,
-        recordedCensus,
         practices: audited,
         pairsEvaluated: evaluated.pairsEvaluated,
         pairCap: evaluated.pairCap,
@@ -1985,7 +2501,6 @@ function renderAuditReport(result) {
         // much was audited. The two sentences answer the same question and an
         // operator reads them together; counts only, never a percentage or a score.
         renderMechanicalCoverageLine(counts),
-        renderRecordedCensusLine(result.recordedCensus ?? null),
     ];
     for (const section of AUDIT_SECTIONS) {
         lines.push('');
@@ -2021,8 +2536,6 @@ module.exports = {
     // one the day either is reworded.
     AUDIT_COVERAGE_OUTCOME,
     renderMechanicalCoverageLine,
-    // The recorded census's one sentence (read through the ledger API).
-    renderRecordedCensusLine,
     // 10-06 (MECH-03, D-10-05): the ONE lead this module composes for an
     // `enforced-by:` claim. Exported so the tests — and any surface that must
     // prove it never says "verified by" — assert against the SHIPPED string.
@@ -2033,6 +2546,8 @@ module.exports = {
     AUDIT_OPERATOR_RANGE_SHAPE,
     AUDIT_OPERATOR_RANGE_MAX_LENGTH,
     isValidOperatorRange,
+    // 260915-ik2: why a manifest writer wrote nothing.
+    PHASE_MANIFEST_WRITE_REASON,
     AUDIT_FILE_READ_MAX,
     AUDIT_MESSAGE_PROBLEM_CAP,
     AUDIT_DIFF_FILE_CAP,
@@ -2043,6 +2558,8 @@ module.exports = {
     AUDIT_REPAIR_SENTENCE,
     AUDIT_DIFF_REPAIR_SENTENCE,
     AUDIT_VAULT_REPAIR_SENTENCE,
+    // Quick 261015-at3: the standards-only arm's repair, same harvest rule.
+    AUDIT_STANDARDS_ONLY_REPAIR_SENTENCE,
     // 08-04: the refused-operator-range arm's repair, exported on the same
     // harvest rule as the three above.
     AUDIT_OPERATOR_RANGE_REPAIR_SENTENCE,
@@ -2052,6 +2569,13 @@ module.exports = {
     // The diff scoping, exported separately from the envelope so a surface that
     // only needs to STATE the range never has to run an audit to learn it.
     resolvePhaseRange,
+    // 16-03 (D-20): the manifest-presence half of the seal leaf's artifact predicate.
+    hasPhaseManifestEntry,
+    // 260915-ik2 (UAT-6-F1): the manifest writers `vault manifest start|record`
+    // reaches, and their one-line operator rendering.
+    recordPhaseStart,
+    recordPhaseCommits,
+    renderManifestResult,
     createBoundedFileReader,
     // The whole audit, and its human rendering.
     runVaultAudit,