@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/vault-command-router.cjs

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *
  * Arg indexing:
  *   args[0] = 'vault'      (family — matched by dispatchCapabilityCommand)
- *   args[1] = subcommand   (fetch | status | summary)
+ *   args[1] = subcommand   (see VAULT_SUBCOMMANDS below)
  *
  * Test seams: pass `_vault` to inject a mock vault module; pass `_core` to inject
  * a mock core module that captures `output()` calls instead of writing to real
@@ -34,76 +34,186 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const io = require("./io.cjs");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+// 16-19 (D-107): `vault anchor certify` runs the strict trace check as a child
+// process, the one spawn in this router (TRACE-04 keeps the check read-only).
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const childProcess = require("node:child_process");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
-// The trace render arm resolves its containment boundary from the project
-// root. project-root.cjs is a leaf (node builtins only), so this adds no cycle.
+// CR-04 (03-11): the trace render arm resolves its containment boundary the same
+// way `cmdVaultTrace` in src/check-command-router.cts does. project-root.cjs is a
+// leaf (node builtins only), so this adds no cycle.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const projectRootMod = require("./project-root.cjs");
 const { findProjectRoot } = projectRootMod;
+// 15-05: the plan-identifier form moved into the vault-standards leaf (one
+// definition shared by the trace verbs, the standards verbs and the gate).
+// That leaf requires only vault-index, which imports nothing, so no cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultStandardsLeaf = require("./vault-standards.cjs");
+// 16-06 (D-14/D-31/D-35): the anchor grammar, the anchors file and the door
+// record have ONE owner, the seal leaf. Its top level imports only `fs` and
+// `path` (D-41), so this static import adds no cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultSeal = require("./vault-seal.cjs");
 const { ERROR_REASON } = io;
-// Default CoreModule implementation. _core seam overrides this for test injection.
-const _defaultCore = { output: io.output };
 /**
- * Pack 6 D-01: the vault router's subcommand table. `readsVerdict` marks every
- * subcommand that reports the vault load verdict — each one must spread the
- * owner's `VAULT_VERDICT_FIELDS` verbatim (tests/vault-status-check.test.cjs
- * enumerates this table and compares every reader against the owner).
- */
-const VAULT_SUBCOMMANDS = Object.freeze([
-    { name: 'fetch', readsVerdict: false },
-    { name: 'status', readsVerdict: true },
-    { name: 'summary', readsVerdict: false },
-    { name: 'practices', readsVerdict: false },
-    { name: 'org-profile', readsVerdict: false },
-    { name: 'probe', readsVerdict: false },
-    { name: 'trace', readsVerdict: false },
-    { name: 'audit', readsVerdict: false },
-    { name: 'update', readsVerdict: false },
-    { name: 'review', readsVerdict: false },
-]);
-/**
- * The two trace stages and the two trace verbs, declared once: the `--stage`
- * validation, the verb check and the operator-facing messages that name the
- * permitted values are all derived from these lists, so they cannot disagree.
- * The values are the frozen contract's (`docs/vault-trace-format.md`).
+ * The subcommand vocabulary, declared once. 02-02 added `probe` (STRICT-02) and
+ * found the name had to be repeated in three unrelated places — the header
+ * comment, the dispatch chain and the unknown-subcommand message — with nothing
+ * keeping them in step. The message is now DERIVED from this list so the
+ * dispatch arm and the operator-facing vocabulary can no longer disagree.
+ */
+const VAULT_SUBCOMMANDS = [
+    'fetch',
+    'status',
+    'probe',
+    'summary',
+    'practices',
+    'org-profile',
+    'trace',
+    // 05-06 (CHECK-03): the mechanical practice audit. Added HERE and nowhere
+    // else — the header comment above, the dispatch chain and the
+    // unknown-subcommand message all derive from this list, which is exactly the
+    // three-place drift 02-02 removed.
+    'audit',
+    // 260915-ik2 (UAT-6-F1): the phase-manifest writer the execute-phase step
+    // files call — `start` at execute:pre, `record` at verify:post. Added HERE
+    // and nowhere else, for the same three-place reason as `audit` above.
+    'manifest',
+    // PBI 74316 (fork-only): move the project to another client vault version.
+    'update',
+    // 15-07 (D-06, D-13): the standards record verbs, `block` and `consulted`.
+    'standards',
+    // 16-04 (D-28): the one door-admission verb every door and loop-point fence asks.
+    'admission',
+    // 16-06 (D-31, D-32): the start anchor a phase or quick directory records at
+    // execute:pre, and the attributed back-fill of a record written before anchors.
+    'anchor',
+    // 16-06 (D-12): the one verb that writes a door's mode-stamped record.
+    'door-record',
+];
+/**
+ * The two trace stages, declared once for the same reason the subcommand
+ * vocabulary is: the `--stage` validation and the operator-facing message that
+ * names the permitted values are both DERIVED from this list, so they cannot
+ * disagree. The values themselves are the frozen contract's
+ * (`docs/vault-trace-format.md` § The freeze contract) — this list restates the
+ * two stage NAMES the CLI accepts, and nothing else about the schema.
  */
 const TRACE_STAGES = ['plan', 'execute'];
+/**
+ * The trace verbs, same discipline (Phase 03-05).
+ */
 const TRACE_VERBS = ['scaffold', 'render'];
 /**
- * The plan-identifier shape `vault trace scaffold --plan` accepts: a phase
- * segment (digits, an optional letter, optional decimal parts) followed by one
- * or more numeric segments — the plan-identifier grammar `agents/pp-planner.md`
- * and `src/phase-id.cts` use. It is exactly the prefix of the artifact's own
- * filename (`04-02` for `04-02-PLAN.md`, `02.3-01` for `02.3-01-PLAN.md`), so a
- * trace gate comparing the recorded identifier with the filename can never be
- * handed one the writer could not emit. It rejects what is not a plan
- * identifier at all: a bare plan number (`01`), a task label (`T1`), a slug
- * (`04-01-vault-trace`) or an empty string.
+ * The manifest verbs, same discipline (260915-ik2): the verb check and the
+ * operator-facing message that names the permitted verbs both derive from it.
+ */
+const MANIFEST_VERBS = ['start', 'record'];
+/**
+ * The standards record verbs (15-07), same discipline: the verb check and the
+ * message naming the permitted verbs both derive from this list.
+ */
+const STANDARDS_VERBS = ['block', 'consulted'];
+/**
+ * The anchor verbs (16-06), same discipline: the verb check and the message
+ * naming the permitted verbs both derive from this list.
+ */
+const ANCHOR_VERBS = ['start', 'backfill', 'certify'];
+/** The flags `vault door-record` takes, declared once for the check and the message (16-06). */
+// 16 review iteration 3 CR-02 (D-103): no `--start`. The start comes only from
+// the door's own `--begin` entry, so no argument can widen a door's range.
+const DOOR_RECORD_FLAGS = ['--door', '--artifact', '--phase'];
+/**
+ * The read cap `vault standards consulted` applies to a PLAN. EQUAL to the
+ * trace gate's `TRACE_ARTIFACT_BYTE_CAP` in src/check-command-router.cts, so
+ * the verb never refuses a plan the gate would read, nor reads one the gate
+ * refuses. That constant is not importable from here (an adapter never
+ * imports an adapter), so the integration test pins the two equal.
+ */
+const STANDARDS_PLAN_READ_BYTES = 1024 * 1024;
+/**
+ * The plan-identifier shape `vault trace scaffold --plan` accepts (04-14,
+ * TGATE-01, CR-03). Defined in `src/vault-standards.cts` since 15-05 and
+ * re-exported from here under the same name; the rationale stays here, beside
+ * the verb that first needed it.
+ *
+ * ONE FORM, READ AND WRITTEN. `filenamePlanId` in `src/check-command-router.cts`
+ * extracts `<this form>-PLAN.md` / `-SUMMARY.md` from an artifact's basename,
+ * building its pattern from this very value, and blocks when the identifier it
+ * extracts disagrees with the one the record carries. So the writer can emit
+ * every identifier the reader can demand (the trap CR-03 reproduced, where
+ * `--plan 01` for `07-01-PLAN.md` blocked at all four points and the remedy
+ * re-ran the same command), and the reader checks every form the writer emits.
+ * Until 15-REVIEW WR-06 the reader stopped at digits-hyphen-digits, so a
+ * decimal (`02.3-01-PLAN.md`, bug #3691) or lettered phase stated no
+ * identifier and its plan-id check was silently skipped; the writer was
+ * deliberately wider then, so as not to refuse a form the gate accepted
+ * (threat T-4-53). The shape is the plan-identifier grammar
+ * `agents/pp-planner.md` and `src/phase-id.cts` use: a phase segment (digits,
+ * an optional letter, optional decimal parts) followed by one or more numeric
+ * segments.
+ *
+ * What it rejects is what CR-03 actually named, and nothing more: a value that
+ * is not a plan identifier at all — a bare plan number (`01`), a task label
+ * (`T1`), a slugged identifier (`04-01-vault-trace`), or an empty string. Every
+ * one of those, written into a canonically named artifact, produces
+ * `plan_id_mismatch`.
+ *
+ * The agreement test in `tests/vault-command-router.test.cjs` and the gate-side
+ * half in `tests/vault-trace.integration.test.cjs` drive both sides over one
+ * shared value list, so an independent edit to either cannot pass.
  */
-const SCAFFOLD_PLAN_ID_RE = /^\d+[A-Za-z]?(?:\.\d+)*(?:-\d+)+$/;
+const SCAFFOLD_PLAN_ID_RE = vaultStandardsLeaf.SCAFFOLD_PLAN_ID_RE;
 /**
- * The required form, in ONE wording, stated in this rejection message and in
- * `pp-core/references/planner-vault-practices.md`. ASCII only and no
- * backticks, so the same bytes survive a JSON string, markdown and a terminal.
+ * The required form, in ONE wording, stated in exactly three places: this
+ * rejection message, `pp-core/references/planner-vault-practices.md`, and the
+ * planner-facing inline instruction in
+ * `capabilities/vault-practices/capability.json` (04-14 T2).
+ *
+ * It is a constant rather than three sentences because a form stated three ways
+ * is three forms (threat T-4-55). The test asserts the sentence extracted
+ * independently from each document is EQUAL to the other's and to this value,
+ * rather than asserting each document merely mentions a form.
+ *
+ * ASCII only, and no backticks: the same bytes have to survive a JSON string, a
+ * markdown paragraph and a terminal, and a backtick would make the markdown
+ * copy differ from the other two.
  */
 const SCAFFOLD_PLAN_ID_FORM = "The plan identifier must be the plan's phase-and-number identifier, exactly the " +
     'prefix of its artifact filename (for example 04-02), not a bare plan number, a task ' +
     'label or a slug.';
 /**
- * Bound on the head read the `trace render` arm performs. The trace lives in
- * the artifact's FRONTMATTER, so a head read is the exact region the parser
- * needs, and an artifact body of any size can never make this arm read more.
+ * The quick-task half of the form (16-05, D-29), appended to both rejection
+ * messages after `SCAFFOLD_PLAN_ID_FORM`.
+ *
+ * A SECOND constant rather than an edit to the first, and argued: the first is
+ * stated verbatim in three places, and two of them are agent context the
+ * golden set records byte for byte (the `vault-practices` plan:pre inline
+ * instruction in three cells) or that sits under an exhausted size budget
+ * (`agents/pp-executor.md`). Rewording it would re-record golden rows Phase 16
+ * may not move. Its sentence is also already true of a quick task — "exactly
+ * the prefix of its artifact filename" — so only the refusal, the one surface
+ * a caller reads after being told no, needs to name the quick form.
+ */
+const SCAFFOLD_QUICK_ID_FORM = 'A quick task uses its quick-task id instead, the same filename prefix (for example 261011-8yt).';
+/**
+ * Bound on the bounded prefix read the `trace render` arm performs. The trace
+ * lives in the artifact's FRONTMATTER, so a head read is not a compromise — it
+ * is the exact region the parser needs, and a SUMMARY.md body of any size can
+ * never make this arm read more.
  */
 const TRACE_ARTIFACT_READ_BYTES = 262_144;
 /** Repo-relative artifact paths, long enough for a workstream phase tree. */
 const TRACE_REFUSAL_PATH_CAP = 200;
-/** A `gitCommit` digest: lowercase hex at sha1 or sha256 length. */
-const GIT_COMMIT_DIGEST_RE = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/;
 /**
- * Bound and control-character-collapse a caller-supplied path before it
- * reaches a refusal message: the message reaches an operator's terminal and,
- * on the workflow path, an agent's context, so a hostile path must not forge
- * an extra line of output nor run to arbitrary length.
+ * Bound and control-character-collapse a caller-supplied path before it reaches
+ * a refusal message (T-03-53). The message reaches an operator's terminal and,
+ * on the workflow path, an agent's context — so a hostile path must not be able
+ * to forge what looks like an additional line of output, nor run to arbitrary
+ * length. Mirrors `sanitizeTraceText` in src/check-command-router.cts; that one
+ * also redacts remotes because it quotes ARTIFACT text, while this one only ever
+ * quotes the argv value the operator just typed.
  */
 function boundedPath(value) {
     const collapsed = value
@@ -117,16 +227,94 @@ function boundedPath(value) {
         : collapsed;
 }
 /**
- * Is the vault-practices capability fully active for this project? Both
- * `vault.enabled` and `vault.practices_enabled` must be strictly `true` — the
- * same requires-closure the promote preflight and `ship.practices` apply. The
- * trace arms gate on this FIRST, before the flag allowlist, so an inert project
- * stays byte-identically silent on every path, a mistyped one included.
+ * The gate an override recorded by the scaffold arm suppresses (04-06, SC4).
+ *
+ * `vault.status` is not a name invented here: it is the `check.query` the
+ * blocking vault gate is declared under at both write points
+ * (`capabilities/vault/capability.json`), and it is the value the freeze
+ * contract's own worked example carries (`docs/vault-trace-format.md`
+ * § The override object). Declared once so the emitted record and the
+ * documented example cannot drift apart. Its one owner is the standards leaf
+ * (15 D-35), because the standards judgement accepts an override line only
+ * under this gate name, and a second literal could drift from the first.
+ */
+const TRACE_OVERRIDE_GATE = vaultStandardsLeaf.STANDARDS_OVERRIDE_GATE;
+/**
+ * A `gitCommit` digest: lowercase hex at sha1 or sha256 length. 16-06 (D-35)
+ * re-binds it to the seal leaf's `ANCHOR_SHA_RE`: a per-file digest and a
+ * record's start/end anchors are the same shape, so they have one owner. The
+ * local name stays, as an alias, so this file's readers keep their wording.
+ */
+const GIT_COMMIT_DIGEST_RE = vaultSeal.ANCHOR_SHA_RE;
+// Default CoreModule implementation. _core seam overrides this for test injection.
+const _defaultCore = { output: io.output };
+function tracePracticesActive(cwd) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { isPracticesGateActive } = require('./vault.cjs');
+    return isPracticesGateActive(cwd);
+}
+/**
+ * 16-09 (SEAL-02, D-39) — the `vault audit` verb's answer when the practices
+ * switch is off, or `null` for "print nothing" (the pre-16-09 behaviour).
+ *
+ * It asks what `check vault.audit` asks, in the gate's order (D-25), through
+ * the same readers: bindings first (no `.platform-bindings.json` never holds
+ * records, D-37/D-42); standards mode active answers nothing (the C-1 cell);
+ * the phase argument must resolve (the same `resolveTracePhaseDir`, so an
+ * argument error still prints nothing, T-03-43); then the leaf's
+ * `collectRecordedArtifacts` and `disabledWithArtifactsVerdict`, whose message
+ * is the gate's message byte for byte. Which switch is off is decided by the
+ * gate readers, never a raw config read. It blocks nothing itself: an operator
+ * surface, exit 0. There is no override.
+ *
+ * From the REAL leaf, not the `_vault` seam: a governance decision must not be
+ * switchable by a test mock (the `tracePracticesActive` rule above).
  */
-function tracePracticesActive(cfgGet, cwd) {
-    return cfgGet(cwd, 'vault.enabled', false) === true && cfgGet(cwd, 'vault.practices_enabled', false) === true;
+function disabledWithArtifactsRefusal(cwd, args) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const v = require('./vault.cjs');
+    let root;
+    try {
+        root = findProjectRoot(cwd) || cwd;
+    }
+    catch {
+        root = cwd;
+    }
+    if (!v.hasPlatformBindings(root))
+        return null;
+    if (v.isStandardsModeActive(cwd))
+        return null;
+    // The audit arm's own positional rule (below): the first token that is not a
+    // flag and not the `--range` value.
+    const auditArgs = args.slice(2);
+    const rangeAt = auditArgs.indexOf('--range');
+    const phaseArg = auditArgs.find((a, i) => !a.startsWith('--') && !(rangeAt !== -1 && i === rangeAt + 1));
+    if (phaseArg === undefined)
+        return null;
+    const phase = v.resolveTracePhaseDir(root, cwd, phaseArg);
+    if (!phase)
+        return null;
+    const whichSwitch = v.isVaultGateActive(root) ? 'vault.practices_enabled' : 'vault.enabled';
+    let mode;
+    if (whichSwitch === 'vault.practices_enabled') {
+        const m = v.vaultModeVerdict(cwd);
+        if (m.active && m.ok === true && m.mode === 'practices')
+            mode = 'practices';
+    }
+    const verdict = vaultSeal.disabledWithArtifactsVerdict(vaultSeal.collectRecordedArtifacts(phase.abs, { root }), {
+        switch: whichSwitch,
+        ...(mode ? { mode } : {}),
+        phaseRel: phase.rel,
+    });
+    if (!verdict)
+        return null;
+    return { status: 'disabled_with_artifacts', block: true, present: true, ...verdict };
 }
-/** The value token after each of `flags`, by index, so a flag's value is never read as a positional. */
+/**
+ * The value token immediately following each of `flags`, by index, so a
+ * flag's value is never mistaken for a positional argument. Mirrors the
+ * `--expect` handling in the `practices promote` arm.
+ */
 function flagValueIndices(argv, flags) {
     const indices = new Set();
     for (const flag of flags) {
@@ -148,15 +336,26 @@ function flagValueIndices(argv, flags) {
 function renderOrgProfileReport(report) {
     const lines = [];
     if (report.pointer.value === null) {
-        lines.push('No org profile is configured (org.profile is unset) — pp-core\'s built-in defaults apply.');
+        lines.push(report.profile.source === 'embedded'
+            ? 'No org profile package is configured (org.profile is unset) — the embedded org profile applies.'
+            : 'No org profile is configured (org.profile is unset) — pp-core\'s built-in defaults apply.');
+    }
+    else if (report.pointer.value.trim().toLowerCase() === 'none') {
+        lines.push('org.profile is "none" — no org profile applies, not even the embedded one; pp-core\'s built-in defaults apply.');
     }
     else {
         lines.push(`org.profile is set to "${report.pointer.value}".`);
     }
-    if (report.profile.resolved) {
+    if (report.profile.resolved && report.profile.source === 'embedded' && report.pointer.value !== null) {
+        lines.push(`The org profile "${report.pointer.value}" could not be resolved — the embedded org profile (pp-core ${report.profile.version ?? 'unknown'}) applies instead.`);
+    }
+    else if (report.profile.resolved && report.profile.source === 'embedded') {
+        lines.push(`Using the embedded org profile shipped with pp-core ${report.profile.version ?? 'unknown'}.`);
+    }
+    else if (report.profile.resolved) {
         lines.push(`Resolved org profile "${report.profile.name}" version ${report.profile.version ?? 'unknown'} from ${report.profile.source}.`);
     }
-    else if (report.pointer.value !== null) {
+    else if (report.pointer.value !== null && report.pointer.value.trim().toLowerCase() !== 'none') {
         lines.push(`The org profile "${report.pointer.value}" could not be resolved from the project or the global npm root.`);
     }
     const contributesKeys = Object.keys(report.contributes);
@@ -166,7 +365,8 @@ function renderOrgProfileReport(report) {
     else {
         lines.push('The org profile contributes:');
         for (const key of contributesKeys) {
-            lines.push(`  ${key} = ${report.contributes[key]}`);
+            const value = report.contributes[key];
+            lines.push(`  ${key} = ${value === '' ? '"" (explicitly none)' : value}`);
         }
     }
     if (report.overridden.length > 0) {
@@ -192,37 +392,124 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
     const vault = _vault ?? require('./vault.cjs');
     const c = _core ?? _defaultCore;
     const subcommand = args[1];
+    // 13-06 (D-08, D-22): an unrecognised `vault.mode` on a project whose vault
+    // gate exists refuses EVERY known subcommand, here, before dispatch. One owner
+    // for ten arms rather than ten copies that a new arm could forget; the test
+    // `D-15 sweep` in tests/vault-mode.test.cjs fails if the chain below and
+    // VAULT_SUBCOMMANDS ever disagree, so no arm can dodge this guard.
+    //   - Keyed on VAULT_SUBCOMMANDS: an unknown subcommand never reads the mode
+    //     and keeps its own message below.
+    //   - The read is a config read; its one possible spawn is loadConfig's memoised, fixed-argument
+    //     git check-ignore, so T-24-08b's typo never reaches the `--changed` git call. On an invalid-mode
+    //     project this refusal now precedes an arm's unknown-flag error.
+    //   - `vaultModeVerdict` answers `{ active: false }` without reading the mode
+    //     when the gate is off, so a vault-off project is byte-identical (golden).
+    //   - From the REAL leaf, not the `_vault` seam, like `isInsideDir` and
+    //     `resolveTracePhaseDir` below: a governance decision must not be
+    //     switchable by a test mock.
+    //   - The message is the leaf's fixed text: it names both allowed values and
+    //     never echoes the configured one (T-13-03).
+    //   - Quick 261015-ect (QD-11): only where `.platform-bindings.json` exists. A
+    //     project without it never reads the mode (T-16-13): admission's own step
+    //     1, read the same way, and the order every `check` vault handler keeps
+    //     (bindings-inert first, D-22). The 1.16.0 release note stated the old
+    //     order as measured; this reverses it, and closes `/pp-fast`'s backstop,
+    //     which asks `vault admission` with no bindings probe of its own.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const modeSeam = require('./vault.cjs');
+    if (VAULT_SUBCOMMANDS.includes(subcommand) && modeSeam.hasPlatformBindings(cwd)) {
+        const modeVerdict = modeSeam.vaultModeVerdict(cwd);
+        if (modeVerdict.active && modeVerdict.ok === false) {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const leaf = require('./vault-mode.cjs');
+            // 13-REVIEW WR-01: a resolver failure is refused like an invalid value,
+            // under its own typed reason.
+            const reason = modeVerdict.reason ?? '';
+            error(leaf.vaultModeRefusalMessage(reason), reason === leaf.VAULT_MODE_REASON.UNRESOLVED ? ERROR_REASON.VAULT_MODE_UNRESOLVED : ERROR_REASON.VAULT_MODE_INVALID);
+            return;
+        }
+    }
     if (subcommand === 'fetch') {
         c.output(vault.vaultFetch(cwd), raw);
     }
     else if (subcommand === 'status') {
-        // Pack 6 D-01: the manifest read is unchanged; the verdict fields come
-        // from the one owner, never from a second derivation here.
-        const status = vault.vaultStatus(cwd);
-        const verdict = vault.computeVaultVerdict && vault.verdictFields ? vault.verdictFields(vault.computeVaultVerdict(cwd)) : {};
-        c.output({ ...status, ...verdict }, raw);
+        // 13-06 (D-10): `mode: standards` LAST, in standards mode only; the same
+        // object otherwise, so a practices-mode envelope gains no key (golden).
+        // 14-05 (D-11/D-14): the same five flat fields `check vault.status` carries,
+        // from the one state function, so the report and the gate cannot tell
+        // different stories (UAT F6). From the REAL module (`modeSeam`), not the
+        // injectable `vault` seam: a governance answer must not be switchable by a
+        // test mock (13-06 precedent). No `block` and no `reason`: this is a report.
+        // The state is null outside standards mode, so practices gains no key.
+        const base = vault.vaultStatus(cwd);
+        const indexState = modeSeam.computeVaultIndexState(cwd);
+        const withIndex = indexState !== null && base['present'] === true
+            ? { ...base, ...modeSeam.vaultIndexEnvelopeFields(indexState) }
+            : base;
+        c.output(modeSeam.withVaultMode(withIndex, cwd), raw);
     }
     else if (subcommand === 'probe') {
-        // Pack 6 D-09: one reachability line, empty when the vault is disabled (D-06).
-        const result = vault.vaultProbe ? vault.vaultProbe(cwd) : { line: '', enabled: false };
-        if (!result.enabled) {
-            c.output(result, true, '');
+        // STRICT-02: pure reachability for the client vault, the shared fallback and
+        // the platform repo — no clone, no cache mutation.
+        //
+        // T-02-07: reject any unrecognized `--` token BEFORE anything spawns, copying
+        // the `practices match` posture below verbatim. A typo must never reach a
+        // subprocess. The host (pp-core/bin/pp-tools.cjs) already splices out its own
+        // global flags before dispatch, which is why the recognized set is one wide.
+        const RECOGNIZED_PROBE_FLAGS = new Set(['--raw']);
+        const unrecognizedProbeFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_PROBE_FLAGS.has(a));
+        if (unrecognizedProbeFlag !== undefined) {
+            error(`Unrecognized flag "${unrecognizedProbeFlag}" for vault probe. Supported: --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        // The probe's ls-remote names its remote by URL, but git still reads the config of the repository the
+        // environment selects (measured: `protocol.file.allow=never` in a pointed-to repository's config made the
+        // bare runner's ls-remote fail with `transport 'file' not allowed`, while the same call with the location
+        // unset answered), so it runs through the owner; transport is kept (D-117).
+        c.output(vault.vaultProbe(cwd, { exec: _exec ?? shell_command_projection_cjs_1.execGitLocal }), raw);
+    }
+    else if (subcommand === 'summary') {
+        // STRICT-05 (02-02): read the STATUS, not the bare string. The write failure
+        // used to be swallowed inside vaultSummary, so this arm could only ever print
+        // success. It still exits 0 on every path — per D-VH-7 the vault and check
+        // commands REPORT and the workflow halts; making this exit non-zero would
+        // route the block into the step's `onError: skip` and reopen the fail-open.
+        const summary = vault.vaultSummaryResult(cwd);
+        if (!summary.ok) {
+            // Warning to stderr so the success-path stdout stays byte-identical to
+            // before this plan for every healthy project.
+            process.stderr.write(`⚠ vault summary: could not write ${summary.path ?? '.planning/vault/SUMMARY.md'} — ${summary.error ?? 'unknown error'}\n`);
         }
-        else if (raw) {
-            c.output(result, true, JSON.stringify(result));
+        if (raw) {
+            c.output(summary, true, JSON.stringify(summary));
         }
         else {
-            c.output(result, true, `${result.line}\n`);
+            c.output(summary.index, false);
         }
     }
-    else if (subcommand === 'summary') {
-        c.output(vault.vaultSummary(cwd), raw);
-    }
     else if (subcommand === 'practices') {
         const verb = args[2];
         if (verb === 'match') {
+            // Quick 261015-at3 (QD-02, todo practices-record-verbs-print-without-
+            // bindings): unless `vault admission` answers `on` this arm prints
+            // nothing, FIRST — before the flag guard and before the mode read. It was
+            // gated by no switch at all (measured 261014-na1: it printed a block on
+            // `vault.enabled: false`), so a record no gate reads could be produced on
+            // a project whose `check ship.practices` answers inert.
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const owner = require('./vault.cjs');
+            if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
+                return;
+            // Quick 261015-ect (QD-14, at3 verifier W-1): in practices mode, silent
+            // where `check ship.practices` answers inert — the practices switch off —
+            // as the trace, audit and manifest arms already are: a block no gate
+            // reads is not produced. Standards mode keeps D-22's answer below on
+            // either switch, because the load-gate card relays that line as its
+            // standards-first clause (15-11) and it records no practice.
+            if (!modeSeam.isStandardsModeActive(cwd) && !tracePracticesActive(cwd))
+                return;
             // T-24-08b: reject any unrecognized `--`-prefixed argument BEFORE the
-            // `--changed` git call (so a typo never spawns a subprocess) instead
+            // `--changed` git call (so a typo never spawns the diff) instead
             // of silently filtering it out of the positional file list. Matched on
             // the WHOLE token so `--files=…` is caught by the same check as
             // `--files value`. DECISION (recorded, not deferred): `--files=` is
@@ -240,9 +527,26 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 error(`Unrecognized flag "${unrecognizedFlag}" for vault practices match. Supported: positional file paths, --changed, --raw, or --block.`, ERROR_REASON.SDK_FAIL_FAST);
                 return;
             }
+            // 13-07 (D-12, PARK-01): in standards mode the matcher has no practice
+            // layer to read, so this arm answers not-applicable — one line naming the
+            // mode, or `--raw`'s envelope with NO match-set key, exit 0. AFTER the
+            // flag guard (a typo still fails first, T-24-08b) and BEFORE the
+            // `--changed` git call (a parked path spawns no diff, T-13-12). `--block`
+            // is non-raw, so it prints the same line and no `<vault_practices>` block.
+            // There is deliberately NO activation guard on this branch: the arm
+            // answers not-applicable whenever the vault gate is active, even with
+            // `vault.practices_enabled` false (D-22; QD-14 above gates practices mode
+            // only). The text is the leaf's.
+            if (modeSeam.isStandardsModeActive(cwd)) {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { notApplicableMatchEnvelope } = require('./vault-mode.cjs');
+                const naMatch = notApplicableMatchEnvelope();
+                c.output(naMatch, true, raw ? JSON.stringify(naMatch) : naMatch.message);
+                return;
+            }
             // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
             const practices = _practices ?? require('./vault-practices.cjs');
-            const runGit = _exec ?? shell_command_projection_cjs_1.execGit;
+            const runGit = _exec ?? shell_command_projection_cjs_1.execGitLocal;
             let files;
             if (args.includes('--changed')) {
                 const gitResult = runGit(['diff', '--name-only', 'HEAD'], { cwd });
@@ -341,6 +645,8 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         const coordinates = _coordinates ?? require('./vault-coordinates.cjs');
         // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
         const providerModule = _provider ?? require('./git-provider.cjs');
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { VAULT_MODE_CONFIG_KEY: vaultModeKey } = require('./vault-mode.cjs');
         const resolution = orgProfile.resolveOrgProfile(cwd);
         // Resolve the EFFECTIVE values by calling the real resolvers, so the
         // report shows what actually won rather than what the profile offered.
@@ -353,13 +659,32 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         const platformHost = coordinates.resolvePlatformHost(cwd);
         const effectiveByKey = {
             'vault.provider': provider,
-            [coordinates.SHARED_REPO_CONFIG_KEY]: shared.repo,
+            // An explicit opt-out (an empty string, from config or profile) reads
+            // back as "" rather than null, so it is not reported as overridden.
+            [coordinates.SHARED_REPO_CONFIG_KEY]: shared.repo ?? (shared.suppressedKind === 'explicit-opt-out' ? '' : null),
             [coordinates.SHARED_REF_CONFIG_KEY]: shared.ref,
             [coordinates.SHARED_HOST_CONFIG_KEY]: shared.host,
             [coordinates.PLATFORM_HOST_CONFIG_KEY]: platformHost.host,
-            // The policy row, through the same ladder the load gate reads, so a
-            // profile value that won is not reported as overridden by null.
+            // 13-05 / D-20: the two POLICY keys, through their own resolvers.
+            // Without these rows both read null, and a profile-seeded value that
+            // actually won was reported as `profile offered "true", but "null"
+            // won.` (reproduced on 1.15.1) — a diagnostic stating something untrue.
+            // The profile carries `vault.required` as the canonical string
+            // 'true'/'false', so String(required) compares equal when it won.
+            // `resolveVaultRequired` is the SAME ladder the load gate asks
+            // (13-REVIEW CR-02): workstream then root config, trimmed, and an
+            // unparseable project value falls through to the profile — so the
+            // report cannot say the profile lost while the gate enforces it. It is
+            // the policy only; with `vault.enabled` off no gate exists to apply it.
             [orgProfile.VAULT_REQUIRED_CONFIG_KEY]: String(orgProfile.resolveVaultRequired(cwd).required),
+            // An invalid PROJECT mode reads as the typed reason
+            // (`vault_mode_invalid`), never the value: the project's invalid value
+            // did win over the profile, and the report says so without repeating
+            // operator text (T-13-03).
+            [vaultModeKey]: (() => {
+                const r = orgProfile.resolveVaultMode(cwd);
+                return r.ok ? r.mode : r.reason;
+            })(),
         };
         // Build `effective`'s key list from ORG_PROFILE_ALLOWLIST rather than a
         // fresh literal array, so a future allowlist change surfaces here
@@ -380,21 +705,15 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 overridden.push({ key, profile: profileValue, effective: effectiveValue });
             }
         }
-        // Pack 6 D-07: the drift comparison above ran on RAW values (two repos
-        // differing only by a credential still report drift); what is EMITTED is
-        // display-safe — the shared-repo coordinate through the owner, prose
-        // through the prose redactor.
-        const shownRepo = (key, v) => key === coordinates.SHARED_REPO_CONFIG_KEY && typeof v === 'string' && vault.redactCloneTarget
-            ? vault.redactCloneTarget(v)
-            : v;
-        const shownText = (t) => (vault.redactRemoteText ? vault.redactRemoteText(t) : t);
-        const shownContributes = {};
-        for (const key of Object.keys(resolution.contributes)) {
-            shownContributes[key] = shownRepo(key, resolution.contributes[key]) ?? '';
-        }
-        const shownEffective = {};
-        for (const key of Object.keys(effective))
-            shownEffective[key] = shownRepo(key, effective[key]);
+        // VAULT-EGRESS-1 (quick 261005-8py): a credential embedded in
+        // `vault.fallback_repo` must not reach stdout. `overridden` above compares
+        // the RAW values, so redaction happens here, at emission only, through the
+        // one owner — never a second redactor.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { redactCloneTarget } = require('./vault.cjs');
+        const safe = (key, value) => (key === coordinates.SHARED_REPO_CONFIG_KEY && typeof value === 'string' && value !== ''
+            ? (redactCloneTarget(value) ?? value) : value);
+        const safeMap = (map) => Object.fromEntries(Object.entries(map).map(([k, v]) => [k, safe(k, v)]));
         const report = {
             pointer: { key: orgProfile.ORG_PROFILE_CONFIG_KEY, value: resolution.configured },
             profile: {
@@ -404,16 +723,12 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 source: resolution.source,
                 dataPath: resolution.dataPath,
             },
-            contributes: shownContributes,
-            effective: shownEffective,
-            overridden: overridden.map((o) => ({
-                key: o.key,
-                profile: shownRepo(o.key, o.profile) ?? '',
-                effective: shownRepo(o.key, o.effective),
-            })),
+            contributes: safeMap(resolution.contributes),
+            effective: safeMap(effective),
+            overridden: overridden.map((o) => ({ ...o, profile: safe(o.key, o.profile), effective: safe(o.key, o.effective) })),
             ignored: resolution.ignored,
             rejected: resolution.rejected,
-            warnings: resolution.warnings.map(shownText),
+            warnings: resolution.warnings,
         };
         // Never call error() for a project with no profile, and never exit
         // non-zero for a resolution failure — this is a diagnostic, not an
@@ -427,21 +742,621 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         }
     }
     else if (subcommand === 'trace') {
-        routeTrace({ args, cwd, raw, error, vault, c, _exec, _trace });
+        // ── The practice-trace producer (Phase 03-05, TRACE-01/02/03) ──
+        //
+        // D-01's split, mechanised: the CLI owns everything that must be PROVABLE
+        // — the pinned `ref`, the `resolvedSha` and the considered practice-ID set
+        // — and the agent writes only the judgement half (`status` + `reason`).
+        // "Provable" cannot rest on an agent transcribing a forty-character SHA
+        // correctly, and a well-formedness gate by definition cannot catch a
+        // wrong-but-well-formed SHA.
+        //
+        // BOTH arms below are pass-throughs to `./vault-trace.cjs`. They collect
+        // arguments, call through, and emit. They hold NO envelope logic, NO glob
+        // pass and NO second read of the manifest: every provable field is the
+        // leaf module's business, and duplicating any of it here would create a
+        // second place where the trace can disagree with the gate that validates
+        // it.
+        //
+        // NEITHER ARM WRITES A FILE, and that is a requirement rather than a
+        // convenience not yet added. The producer emits text for an agent to embed
+        // in the single write it is already performing. A CLI that patched a
+        // plan's frontmatter would have to round-trip it through the shared
+        // serializer, which this repository documents as "a deliberately lossy
+        // serializer — it cannot faithfully re-emit nested object-list items" —
+        // so the same write that added the trace would destroy the plan's own
+        // must-haves block (T-03-23). If a direct write is ever wanted it must be a
+        // raw text splice on the delimited region, and that is not this phase's
+        // business. Do not add the convenience.
+        //
+        // ORDERING, and why it is this way round: the sub-verb check comes first,
+        // so a mistyped sub-verb is refused with the usage error, bindings or not,
+        // and produces no record (quick 261015-ect, QD-12 — measured and pinned).
+        // Then the admission verdict and the capability gate (quick 261015-at3 put
+        // the admission line ahead of the gate), ahead of the flag allowlist. The
+        // two orders both satisfy T-03-25 (nothing is required and nothing spawns
+        // before an unknown flag is rejected), because the gate is a bounded config
+        // read, not a subprocess. Only this order also satisfies D-04's
+        // non-negotiable clause — for every VALID sub-verb an inert project's
+        // output is byte-identical, on every flag path including a mistyped one
+        // (T-03-26).
+        const verb = args[2];
+        const traceArgs = args.slice(3);
+        if (verb !== 'scaffold' && verb !== 'render') {
+            error(`Unknown trace subcommand. Available: ${TRACE_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+            return;
+        }
+        // Quick 261015-at3: the admission verdict precedes the capability gate, as
+        // in `routeVaultAnchor` — no `.platform-bindings.json` means `check
+        // vault.trace` answers inert, so no trace may be produced either.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const owner = require('./vault.cjs');
+        if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
+            return;
+        if (!tracePracticesActive(cwd))
+            return;
+        if (verb === 'scaffold') {
+            const RECOGNIZED_SCAFFOLD_FLAGS = new Set(['--stage', '--plan', '--anchors-dir', '--raw']);
+            const unrecognizedScaffoldFlag = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_SCAFFOLD_FLAGS.has(a));
+            if (unrecognizedScaffoldFlag !== undefined) {
+                error(`Unrecognized flag "${unrecognizedScaffoldFlag}" for vault trace scaffold. ` +
+                    `Supported: positional file paths, --stage <${TRACE_STAGES.join('|')}>, --plan <id>, ` +
+                    '--anchors-dir <dir> (execute stage), --raw.', ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // Quick 261015-ect (QD-15): parked in standards mode, beside `practices
+            // match` (PARK-01) and `vault audit` (PARK-02). A standards-mode plan
+            // carries no practices ledger: `check ship.practices`, `check
+            // vault.audit` and `check vault.review` answer not_applicable here, and
+            // the standards `check vault.trace` reads `<vault_standards>` blocks, not
+            // this ledger. After admission, the practices gate and this verb's flag
+            // allowlist (a typo still fails first, as in the match and audit arms),
+            // before any read; one fixed line from the leaf, exit 0, nothing written.
+            if (modeSeam.isStandardsModeActive(cwd)) {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { notApplicableTraceVerbEnvelope } = require('./vault-mode.cjs');
+                const naTrace = notApplicableTraceVerbEnvelope();
+                c.output(naTrace, true, raw ? JSON.stringify(naTrace) : naTrace.message);
+                return;
+            }
+            const valueIndices = flagValueIndices(traceArgs, ['--stage', '--plan', '--anchors-dir']);
+            const stageIdx = traceArgs.indexOf('--stage');
+            const stage = stageIdx !== -1 ? traceArgs[stageIdx + 1] : undefined;
+            // A missing stage and an invalid one share a reason deliberately: both
+            // are "this invocation cannot be interpreted", and splitting them would
+            // make the operator read two messages to learn the same two words.
+            if (stage === undefined || !TRACE_STAGES.includes(stage)) {
+                error(`Missing or unrecognized --stage value for vault trace scaffold. ` +
+                    `Supported: ${TRACE_STAGES.join(', ')}.`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            const planIdx = traceArgs.indexOf('--plan');
+            const planId = planIdx !== -1 ? traceArgs[planIdx + 1] : undefined;
+            if (planId === undefined || planId.startsWith('--')) {
+                error('No plan identifier was given. Usage: vault trace scaffold ' +
+                    `--stage <${TRACE_STAGES.join('|')}> --plan <id> [files...] [--raw].`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            // 04-14 (TGATE-01, CR-03): the value is PRESENT but is not a plan
+            // identifier. Its own rejection, below both guards and beside the other
+            // two argument rejections, so a vault-disabled project still reaches
+            // none of them.
+            //
+            // THE REASON IS THE ESTABLISHED ONE, not a third vocabulary entry. It is
+            // `sdk_fail_fast`, the same reason the stage validation above uses,
+            // because this is the same class of defect: a value was supplied and
+            // cannot be interpreted. `sdk_missing_arg` belongs to the branch directly
+            // above, where the value was consumed by a following flag and no
+            // identifier reached the arm at all.
+            //
+            // IT TEACHES RATHER THAN REFUSING. The message names the value that was
+            // given, the required form and one conforming example, and then says what
+            // the gate will do with the value — because a caller who is told only
+            // that a value is invalid has to guess, and the guess CR-03 documents is
+            // the one this rejection exists to stop.
+            //
+            // FENCE 3 is untouched: this arm still writes no file, and a rejection
+            // returns before the leaf is required, so nothing is produced and nothing
+            // is partially produced.
+            if (!SCAFFOLD_PLAN_ID_RE.test(planId)) {
+                error(`Invalid --plan value "${planId}" for vault trace scaffold. ` +
+                    `${SCAFFOLD_PLAN_ID_FORM} ${SCAFFOLD_QUICK_ID_FORM} The trace gate compares the identifier a plan artifact ` +
+                    'records against the one its own filename states, and blocks on a disagreement.', ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            const files = traceArgs.filter((a, i) => !a.startsWith('--') && !valueIndices.has(i));
+            // The execute stage resolves a `gitCommit` digest per governed file, so
+            // the statement asserts something falsifiable: these practices governed
+            // THESE artifacts at this vault SHA (D-08). The digest is the commit
+            // that last produced the artifact, not merely HEAD, so a subject entry
+            // points at the work it actually describes. A file with no commit yields
+            // no digest — deliberately, because the leaf module records that gap as
+            // a LOUD note inside the statement, and a HEAD fallback would paper over
+            // a real coverage hole with a plausible-looking value.
+            const runGit = _exec ?? shell_command_projection_cjs_1.execGitLocal;
+            // 16-06 (D-14/D-31/D-35): the execute-stage record's anchors, read by the
+            // CLI and never typed. The END anchor is HEAD now; the START anchor is
+            // the one `vault anchor start` recorded in the plan's directory at
+            // execute:pre (phase) or where quick captured its base. `--anchors-dir`
+            // names that directory explicitly; otherwise it is derived from `--plan`
+            // (`resolveScaffoldAnchorsDir`). The plan stage reads neither and its
+            // output is byte-identical (golden-pinned).
+            const anchorsDirIdx = traceArgs.indexOf('--anchors-dir');
+            let anchors = null;
+            if (anchorsDirIdx !== -1) {
+                const anchorsDirArg = traceArgs[anchorsDirIdx + 1];
+                if (stage !== 'execute') {
+                    error('--anchors-dir applies to --stage execute only; a plan-stage ledger records no anchors.', ERROR_REASON.SDK_FAIL_FAST);
+                    return;
+                }
+                if (anchorsDirArg === undefined || anchorsDirArg.startsWith('--')) {
+                    error('--anchors-dir needs a directory under .planning/. Usage: vault trace scaffold --stage execute --plan <id> --anchors-dir <dir> [files...].', ERROR_REASON.SDK_MISSING_ARG);
+                    return;
+                }
+            }
+            if (stage === 'execute') {
+                const head = runGit(['rev-parse', 'HEAD'], { cwd });
+                const end = head.exitCode === 0 ? head.stdout.trim() : '';
+                anchors = {};
+                if (vaultSeal.ANCHOR_SHA_RE.test(end))
+                    anchors.endCommit = end;
+                const located = anchorsDirIdx !== -1
+                    ? resolvePlanningPath(cwd, traceArgs[anchorsDirIdx + 1], 'dir')
+                    : resolveScaffoldAnchorsDir(cwd, planId);
+                if (anchorsDirIdx !== -1 && !located.ok) {
+                    error(`--anchors-dir ${located.message}`, ERROR_REASON.SDK_FAIL_FAST);
+                    return;
+                }
+                const start = located.ok ? vaultSeal.readDirAnchors(located.abs)?.start : undefined;
+                if (start !== undefined) {
+                    anchors.startCommit = start;
+                }
+                else {
+                    // A note, not an error: the record is still written, with its END
+                    // anchor, and the strict points type the missing start (16-07). One
+                    // line on stderr, so the embedded block on stdout is unchanged.
+                    process.stderr.write(`vault trace scaffold: no start anchor recorded for plan ${boundedPath(planId)} ` +
+                        `(${located.ok ? `${located.rel} holds no ${vaultSeal.VAULT_ANCHORS_FILE}` : located.message}); ` +
+                        'the ledger carries endCommit only. `pp_run vault anchor start <dir>` records it at execute:pre.\n');
+                }
+            }
+            const fileInputs = files.map((name) => {
+                if (stage !== 'execute')
+                    return name;
+                const res = runGit(['log', '-1', '--format=%H', '--', name], { cwd });
+                const digest = res.exitCode === 0 ? res.stdout.trim() : '';
+                return GIT_COMMIT_DIGEST_RE.test(digest) ? { name, gitCommit: digest } : name;
+            });
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const traceMod = _trace ?? require('./vault-trace.cjs');
+            // No files is a REAL path, not an error: a documentation-only plan is
+            // still governed by the global practices, and emitting nothing there
+            // would make the ruled-out set unauditable for exactly the plans where a
+            // reviewer most wants to know what was considered.
+            //
+            // THE OVERRIDE CONTEXT (04-06, SC4 / D-13 / D-14 / D-15).
+            //
+            // The verdict is obtained HERE rather than inside the leaf, and the
+            // reason is the same one that put the digest mapping above in the arm:
+            // this is the only place that knows a trace is being written NOW, and an
+            // override record is a statement about now. `buildTraceStatement`
+            // reaching for a live verdict from inside itself would make a pure
+            // producer's output depend on the machine's vault state through a path
+            // its signature does not declare — the producer/judge split D-01 drew,
+            // undone.
+            //
+            // The AGENT is never the courier for these three fields. Were the gate,
+            // the block and the suppressed reason passed as flags, a bypass could be
+            // concealed by simply not passing one — and the record that a bypass
+            // happened is the single field a bypass most wants hidden. The CLI
+            // computes all three, so there is nothing for a caller to omit.
+            //
+            // D-13: the arm runs once per stage per plan, and each invocation
+            // re-reads the environment and re-computes the verdict at its own
+            // timestamp. A bypass taken at execution but not at planning is
+            // therefore a distinct visible event, not an inference.
+            //
+            // The common path is unchanged. `buildOverrideRecord` returns null unless
+            // the verdict GENUINELY blocked *and* an accepted override reason is
+            // present in the environment; a non-blocking verdict with the reason set
+            // still records nothing, because recording one would manufacture evidence
+            // of a bypass that never happened (D-15).
+            //
+            // Obtaining a verdict is a READ. `computeVaultVerdict` never fetches or
+            // throws (its one possible spawn is a read-only git check-ignore), and this arm still writes no file and
+            // splices no frontmatter (FENCE 3).
+            const verdict = vault.computeVaultVerdict(cwd);
+            const statement = traceMod.buildTraceStatement({
+                cwd,
+                stage,
+                plan: planId,
+                files: fileInputs,
+                override: {
+                    gate: TRACE_OVERRIDE_GATE,
+                    block: verdict.block,
+                    suppressedReason: verdict.reason,
+                },
+                // Spread, never `anchors: null` on the plan stage: a seam that records
+                // its arguments (the router tests' trace mock) then sees the call it
+                // saw before 16-06.
+                ...(anchors !== null ? { anchors } : {}),
+            });
+            // The three-way emit the `practices match --block` arm established: the
+            // structured object is ALWAYS the output value, and the text a consumer
+            // embeds is the third argument. The planner embeds the block VERBATIM —
+            // it never renames a field and never re-derives a value, which is the
+            // whole point of D-01's split.
+            if (raw) {
+                c.output(statement, true, JSON.stringify(statement));
+            }
+            else {
+                c.output(statement, true, traceMod.serializeTraceBlock(statement));
+            }
+        }
+        else {
+            const RECOGNIZED_RENDER_FLAGS = new Set(['--raw']);
+            const unrecognizedRenderFlag = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_RENDER_FLAGS.has(a));
+            if (unrecognizedRenderFlag !== undefined) {
+                error(`Unrecognized flag "${unrecognizedRenderFlag}" for vault trace render. ` +
+                    'Supported: a positional artifact path, --raw.', ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // Quick 261015-ect (QD-15): parked in standards mode, as the scaffold
+            // branch above is and for the same reason (no practices ledger is read).
+            if (modeSeam.isStandardsModeActive(cwd)) {
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const { notApplicableTraceVerbEnvelope } = require('./vault-mode.cjs');
+                const naRender = notApplicableTraceVerbEnvelope();
+                c.output(naRender, true, raw ? JSON.stringify(naRender) : naRender.message);
+                return;
+            }
+            const artifactPath = traceArgs.find((a) => !a.startsWith('--'));
+            if (artifactPath === undefined) {
+                error('No artifact path was given. Usage: vault trace render <artifact> [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            // CONTAINMENT (CR-04, T-03-50/51/52). `artifactPath` is an unvalidated
+            // positional and the read below is unconditional, so before this branch
+            // existed `vault trace render ../outside/secret.md` emitted an out-of-tree
+            // file's content as the `## Practices Applied` section that
+            // `agents/pp-executor.md` instructs the executor to include VERBATIM in
+            // SUMMARY.md — an arbitrary file's bytes becoming governance-artifact
+            // content a later reviewer agent reads.
+            //
+            // It sits HERE, inside the render arm, BELOW the `tracePracticesActive`
+            // early return above — and must stay there. That return is the single
+            // guard making the whole trace verb inert on a capability-off project, so
+            // no containment decision, no project-root resolution and no read may be
+            // reachable above it or an inert project stops being byte-identically
+            // silent (D-04, T-03-26). Do not hoist any of this for a cheaper argument
+            // check, and do not share a resolved root with the scaffold arm.
+            //
+            // It also sits BEFORE the read rather than being inferred from it:
+            // `readHeadBounded` returns the empty string on any problem and never
+            // throws, so a decision taken on its RESULT would be no decision at all.
+            //
+            // The predicate comes from the REAL leaf, not the `_vault` seam: a
+            // security decision must not be switchable by a test mock. Same
+            // `require('./vault.cjs')` the seam itself defaults to — one module, not
+            // a second import path.
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { isInsideDir } = require('./vault.cjs');
+            if (artifactPath.indexOf('\u0000') !== -1) {
+                error(`The artifact path is not a usable path: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            let projectRoot;
+            try {
+                projectRoot = findProjectRoot(cwd) || cwd;
+            }
+            catch {
+                projectRoot = cwd;
+            }
+            let artifactAbs;
+            try {
+                artifactAbs = node_path_1.default.resolve(cwd, artifactPath);
+            }
+            catch {
+                error(`The artifact path could not be resolved: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            if (!isInsideDir(projectRoot, artifactAbs)) {
+                error(`The artifact path resolves outside the project and was not read: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const traceMod = _trace ?? require('./vault-trace.cjs');
+            const content = vault.readHeadBounded(artifactAbs, TRACE_ARTIFACT_READ_BYTES);
+            const parsed = traceMod.parseVaultTraceBlock(content, artifactPath);
+            // THE LEDGER, AND ONLY THE LEDGER. This arm must never call the matcher.
+            // Re-deriving the practice set at render time would produce a section
+            // that disagrees with the frontmatter it is supposedly generated from,
+            // which is the precise failure D-03 exists to prevent: the whole point of
+            // GENERATING the surface is that the two can never disagree (T-03-24).
+            // Adding a matcher call here looks like a robustness improvement and is
+            // the exact opposite — it reintroduces the drift the generation removed.
+            //
+            // An absent ledger yields the parser's documented absent result and NO
+            // section — not an error, and not an empty heading. An empty ledger is a
+            // different thing entirely and the leaf module's renderer handles it: it
+            // emits the heading plus one explanatory line, because a degraded run's
+            // record must stay visible and a reader who finds no section at all
+            // cannot tell a degraded run from a plan that was never vault-enabled.
+            const rendered = parsed.present ? traceMod.renderPracticesApplied(parsed.statement) : '';
+            if (raw) {
+                c.output(parsed, true, JSON.stringify(parsed));
+            }
+            else {
+                c.output(parsed, true, rendered);
+            }
+        }
     }
     else if (subcommand === 'audit') {
-        routeAudit({ args, cwd, raw, error, vault, c, _exec, _audit });
+        // ── The mechanical practice audit (Phase 05-06, CHECK-03/SC1) ──
+        //
+        // A PASS-THROUGH, on exactly the rule the two trace arms above state: it
+        // collects arguments, calls through and emits. It holds NO verdict, NO
+        // message, NO range and NO cap logic. `check vault.audit` serializes the
+        // SAME envelope from the SAME engine, and duplicating any of it here would
+        // create a second place where the operator's report can disagree with the
+        // gate that blocks the build on it (D-05-02). Even the human text is the
+        // leaf's — `renderAuditReport` is called over the object the leaf returned,
+        // never over a copy this arm rebuilt.
+        //
+        // ORDERING, copied from the trace arm above because the reason carries over
+        // verbatim: the capability gate is the FIRST branch, ahead of the flag
+        // allowlist (the admission verdict follows it here, per QD-03 below). Both orders satisfy T-02-07/T-03-25 — nothing is required and
+        // nothing spawns before an unknown flag is rejected, because the gate is a
+        // bounded config read and not a subprocess. Only THIS order also satisfies
+        // D-04's non-negotiable clause: an inert project's output is byte-identical
+        // on every path INCLUDING a mistyped one (T-03-26).
+        //
+        // 16-09 (SEAL-02, D-39) — ONE exception, and it is the gate's own: a
+        // switch that is off over a phase holding engine-written vault records.
+        // `check vault.audit` answers that `disabled_with_artifacts`, blocking, and
+        // this verb prints the SAME line from the SAME leaf (an agreeing pair). A
+        // project that never recorded anything still prints nothing.
+        if (!tracePracticesActive(cwd)) {
+            const refusal = disabledWithArtifactsRefusal(cwd, args);
+            if (refusal)
+                c.output(refusal, true, raw ? JSON.stringify(refusal) : refusal.message);
+            return;
+        }
+        // Quick 261015-at3 (QD-03, D-39): the admission verdict comes AFTER the
+        // switch block above, not before it. That block's refusal already asks
+        // `hasPlatformBindings` first and is the verb's half of an agreeing pair with
+        // `check vault.audit`; an admission-first line would silence the
+        // `vault.enabled: false`-over-records refusal the gate still answers. This
+        // line closes the remaining shape — both switches on, no bindings — where
+        // `check vault.audit` answers `inert`.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const owner = require('./vault.cjs');
+        if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
+            return;
+        // T-5-19 / T-02-07: whole-token rejection, so `--raw=json` is caught by the
+        // same check as a bare unknown flag rather than slipping past a prefix test
+        // and reaching a subprocess. The host (pp-core/bin/pp-tools.cjs) splices out
+        // its own global flags before dispatch, which is why the recognized set is
+        // one wide.
+        // The flag's NAME is spelled here and in `check-command-router.cts`'s
+        // `AUDIT_RANGE_FLAG`. What must not be duplicated is the POLICY — what
+        // counts as a well-formed range — and it is not: both surfaces call the
+        // leaf's `isValidOperatorRange`. A shared constant for the token itself
+        // would mean importing the audit leaf at this file's top level, which the
+        // lazy-require convention here exists to avoid, to buy agreement on seven
+        // characters that a test on each surface already pins.
+        const AUDIT_RANGE_FLAG = '--range';
+        const RECOGNIZED_AUDIT_FLAGS = new Set(['--raw', AUDIT_RANGE_FLAG]);
+        const unrecognizedAuditFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_AUDIT_FLAGS.has(a));
+        if (unrecognizedAuditFlag !== undefined) {
+            error(`Unrecognized flag "${unrecognizedAuditFlag}" for vault audit. ` +
+                `Supported: a positional phase directory, --raw, ${AUDIT_RANGE_FLAG} <from>..<to>.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        // 13-07 (D-13, PARK-02): standards mode has no practice layer to audit.
+        // AFTER the inert gate above (D-22) and the flag guard, BEFORE the range,
+        // the positional and the leaf — the same place `check vault.audit` answers
+        // it, so the two surfaces agree on every argument shape. Still a
+        // pass-through: it emits the leaf's builder output, never its own wording
+        // (D-05-02).
+        if (modeSeam.isStandardsModeActive(cwd)) {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { notApplicableGateEnvelope } = require('./vault-mode.cjs');
+            const naAudit = notApplicableGateEnvelope('vault.audit');
+            c.output(naAudit, true, raw ? JSON.stringify(naAudit) : naAudit.message);
+            return;
+        }
+        // 08-06 (D-08-19): the operator's range, and the ONE token in this arm that
+        // is a flag's VALUE rather than a positional. It is located before the
+        // positional is picked because the pick below is "the first token that does
+        // not start with `--`" — which, for `vault audit --range a..b <dir>`, is
+        // `a..b`. That would have scoped the audit to a phase directory nobody
+        // named, silently and with a plausible-looking envelope: the exact class of
+        // the WR-08 defect the gate surface's positional scanner was rewritten to
+        // remove. Here the fix is local, because this arm has one value-bearing
+        // flag and no enforcer appending others.
+        const auditArgs = args.slice(2);
+        const rangeAt = auditArgs.indexOf(AUDIT_RANGE_FLAG);
+        const auditRangeValue = rangeAt === -1 ? undefined : auditArgs[rangeAt + 1];
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+        const auditMod = _audit ?? require('./vault-audit.cjs');
+        if (rangeAt !== -1) {
+            // HARVESTED, NEVER RESTATED: the predicate is the leaf's own, so this
+            // operator surface and the gate surface cannot disagree about what a
+            // well-formed range is. A seam that does not provide it (the test mock)
+            // falls back to the real module rather than to "anything goes" — a
+            // missing predicate must never mean a passing one.
+            //
+            // Each candidate is CALLED ON ITS OWN OBJECT rather than detached into a
+            // variable: an unbound method is a `this` hazard the linter is right
+            // about, and nothing here needs the function as a value.
+            const rangeIsWellFormed = (v) => {
+                if (typeof auditMod.isValidOperatorRange === 'function') {
+                    return auditMod.isValidOperatorRange(v);
+                }
+                // eslint-disable-next-line @typescript-eslint/no-require-imports
+                const leaf = require('./vault-audit.cjs');
+                return typeof leaf.isValidOperatorRange === 'function' ? leaf.isValidOperatorRange(v) : false;
+            };
+            if (typeof auditRangeValue !== 'string' || !rangeIsWellFormed(auditRangeValue)) {
+                // The refused value is NOT echoed: it failed validation, so it is not
+                // trusted text, and this arm's message is read by a person whose next
+                // action is to retype it (T-08-32).
+                error(`${AUDIT_RANGE_FLAG} needs a well-formed <from>..<to> git range (letters, digits, `
+                    + '. _ / ^ ~ -, two or three dots, at most 200 characters). The supplied value is not '
+                    + 'reproduced here because it failed validation. Re-run with a well-formed range, or '
+                    + 'drop the flag to let the phase-start ladder resolve it.', ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+        }
+        // The phase argument. A DIRECTORY path carries the workstream partition,
+        // which is why neither dispatch point has to pass `--ws`
+        // (check-query-gate.md:27, and the four-times-shipped omitted-`--ws`
+        // lesson behind it). The range's VALUE is excluded by index, so the flag
+        // may precede the positional.
+        const auditPhaseArg = auditArgs.find((a, i) => !a.startsWith('--') && !(rangeAt !== -1 && i === rangeAt + 1));
+        if (auditPhaseArg === undefined) {
+            error(`No phase directory was given. Usage: vault audit <phase-dir> [${AUDIT_RANGE_FLAG} <from>..<to>] [--raw].`, ERROR_REASON.SDK_MISSING_ARG);
+            return;
+        }
+        let auditRoot;
+        try {
+            auditRoot = findProjectRoot(cwd) || cwd;
+        }
+        catch {
+            auditRoot = cwd;
+        }
+        // 08-10 (F4). THE ARGUMENT IS PART OF THE PASS-THROUGH. This arm read the
+        // positional as a raw path while `check vault.audit` resolved it through
+        // `resolveTracePhaseDir` — either an existing directory OR a phase token the
+        // locator resolves. Measured on the live fixture, `01` therefore produced
+        // `{"status":"ok","block":false,"rangeSource":"phase-start-commit"}` from the
+        // gate and `{"status":"warn","block":true,"rangeSource":"base-branch",
+        // "...":"manifest-not-found"}` from the operator's own command: a blocking,
+        // meaningless verdict where the gate saw a clean phase-scoped pass. That is
+        // exactly the disagreement this arm's own doc comment above forbids
+        // (D-05-02), so the RESOLVER is harvested — never restated — from the leaf
+        // both routers already import.
+        //
+        // From the REAL leaf, not the `_vault` seam — same rule and same reason as
+        // the `isInsideDir` harvest in the render arm above: a containment decision
+        // must not be switchable by a test mock.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { resolveTracePhaseDir } = require('./vault.cjs');
+        const resolvedAuditPhase = resolveTracePhaseDir(auditRoot, cwd, auditPhaseArg);
+        if (!resolvedAuditPhase) {
+            // The SAME `unresolved` shape the gate emits (check-command-router.cts),
+            // not a base-branch fallback that reads as a real audit of nothing. Stated
+            // only from what was measured, and naming a re-run rather than a deletion
+            // (T-4-75).
+            const unresolved = {
+                status: 'unresolved',
+                block: true,
+                message: `Vault audit: "${boundedPath(auditPhaseArg)}" is neither an existing `
+                    + 'directory inside the project nor a phase the locator resolves, so no practice was '
+                    + 'compared against anything. Repair: re-run this command with the phase directory.',
+            };
+            c.output(unresolved, true, raw ? JSON.stringify(unresolved) : unresolved.message);
+            return;
+        }
+        const auditResult = auditMod.runVaultAudit({
+            root: auditRoot,
+            phaseDir: resolvedAuditPhase.abs,
+            exec: _exec ?? shell_command_projection_cjs_1.execGitLocal,
+            // Spread, never `range: undefined` — the leaf keys on the key's TYPE to
+            // decide whether its ladder runs.
+            ...(typeof auditRangeValue === 'string' ? { range: auditRangeValue } : {}),
+        });
+        if (raw) {
+            c.output(auditResult, true, JSON.stringify(auditResult));
+        }
+        else {
+            c.output(auditResult, true, auditMod.renderAuditReport(auditResult));
+        }
     }
-    else if (subcommand === 'review') {
-        routeReview({ args, cwd, raw, c });
+    else if (subcommand === 'manifest') {
+        // ── The phase-manifest writer (260915-ik2, UAT-6-F1) ──
+        //
+        // `start` anchors `phases[NN].startCommit = HEAD` (write-once); `record`
+        // writes `phases[NN].commits` from that anchor. Both are the leaf's —
+        // this arm collects arguments, calls through and emits, exactly as the
+        // `audit` arm above does, and in the same ORDER for the same reason: the
+        // capability gate is FIRST and silent, so an inert project's output is
+        // byte-identical on every path including a mistyped one (T-03-26,
+        // T-ik2-08). It exits 0 on every path: the step files print the result and
+        // continue, and a refusal travels as `ok: false` with a reason.
+        //
+        // Quick 261015-at3: the admission verdict precedes the capability gate — a
+        // project with no `.platform-bindings.json` gets no manifest file written.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const owner = require('./vault.cjs');
+        if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
+            return;
+        if (!tracePracticesActive(cwd))
+            return;
+        const RECOGNIZED_MANIFEST_FLAGS = new Set(['--raw']);
+        const unrecognizedManifestFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_MANIFEST_FLAGS.has(a));
+        if (unrecognizedManifestFlag !== undefined) {
+            error(`Unrecognized flag "${unrecognizedManifestFlag}" for vault manifest. ` +
+                `Supported: a verb (${MANIFEST_VERBS.join(' | ')}), a positional phase directory, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        const manifestPositionals = args.slice(2).filter((a) => !a.startsWith('--'));
+        const manifestVerb = manifestPositionals[0];
+        if (manifestVerb !== 'start' && manifestVerb !== 'record') {
+            error(`Unknown vault manifest verb. Available: ${MANIFEST_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+            return;
+        }
+        // Quick 261015-ect (QD-15): parked in standards mode. The range this verb
+        // anchors serves two gates, `vault audit` and `check vault.review`, and
+        // both answer not_applicable in this mode (PARK-02, PARK-04). Its third
+        // reader, `/pp-undo --phase` (pp-core/workflows/undo.md), falls back to its
+        // git-log search when the file or the phase entry is missing — the path a
+        // project with no bindings or with the practices switch off already takes.
+        // After the verb check and before any positional or phase read; the
+        // envelope carries `ok: false` and a typed reason, which is how the step
+        // files read a manifest refusal (print the line and continue).
+        if (modeSeam.isStandardsModeActive(cwd)) {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const { notApplicableManifestVerbEnvelope } = require('./vault-mode.cjs');
+            const naManifest = notApplicableManifestVerbEnvelope();
+            c.output(naManifest, true, raw ? JSON.stringify(naManifest) : naManifest.message);
+            return;
+        }
+        // The phase DIRECTORY, as for `audit`: the path carries the workstream
+        // partition, and the manifest is written two levels above it.
+        const manifestPhaseDir = manifestPositionals[1];
+        if (manifestPhaseDir === undefined) {
+            error('No phase directory was given. Usage: vault manifest <start|record> <phase-dir> [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+            return;
+        }
+        let manifestRoot;
+        try {
+            manifestRoot = findProjectRoot(cwd) || cwd;
+        }
+        catch {
+            manifestRoot = cwd;
+        }
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+        const manifestMod = _audit ?? require('./vault-audit.cjs');
+        const writeOpts = { root: manifestRoot, phaseDir: manifestPhaseDir, cwd, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal };
+        const manifestResult = manifestVerb === 'start'
+            ? manifestMod.recordPhaseStart(writeOpts)
+            : manifestMod.recordPhaseCommits(writeOpts);
+        if (raw) {
+            c.output(manifestResult, true, JSON.stringify(manifestResult));
+        }
+        else {
+            c.output(manifestResult, true, manifestMod.renderManifestResult(manifestResult));
+        }
     }
     else if (subcommand === 'update') {
-        // `vault update [<tag>] [--yes]`: without --yes it reports the plan and
-        // writes nothing; see src/vault-update.cts for the contract.
+        // PBI 74316: `vault update [<tag>] [--yes]`. Without --yes it reports the
+        // plan and writes nothing; see src/vault-update.cts for the contract.
         const RECOGNIZED_UPDATE_FLAGS = new Set(['--raw', '--yes']);
         const unrecognizedUpdateFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_UPDATE_FLAGS.has(a));
         if (unrecognizedUpdateFlag !== undefined) {
-            error(`Unrecognized flag "${boundedPath(unrecognizedUpdateFlag)}" for vault update. Supported: --yes, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            error(`Unrecognized flag "${unrecognizedUpdateFlag}" for vault update. Supported: --yes, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
         const updatePositionals = args.slice(2).filter((a) => !a.startsWith('--'));
@@ -466,109 +1381,282 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
             c.output(updateResult, true, updateMod.renderVaultUpdate(updateResult));
         }
     }
+    else if (subcommand === 'standards') {
+        // 15-07 (D-06, D-08, D-13): the standards record verbs. The arm body lives
+        // in `routeVaultStandards` below; the invalid-mode refusal above already
+        // ran, because 'standards' is a member of VAULT_SUBCOMMANDS.
+        routeVaultStandards({ cwd, args, raw, error, vault, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
+    }
+    else if (subcommand === 'admission') {
+        // 16-04 (D-28, D-05): the arm body lives in `admissionVerb` below.
+        admissionVerb({ cwd, rest: args.slice(2), raw, error, c });
+    }
+    else if (subcommand === 'anchor') {
+        // 16-06 (D-31, D-32): the arm body lives in `routeVaultAnchor` below.
+        routeVaultAnchor({ cwd, args, raw, error, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
+    }
+    else if (subcommand === 'door-record') {
+        // 16-06 (D-12): the arm body lives in `doorRecordVerb` below.
+        doorRecordVerb({ cwd, rest: args.slice(2), raw, error, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
+    }
     else {
-        error(`Unknown vault subcommand. Available: ${VAULT_SUBCOMMANDS.map((x) => x.name).join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error(`Unknown vault subcommand. Available: ${VAULT_SUBCOMMANDS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
 /**
- * `vault trace scaffold|render` — the practice-trace producer.
+ * `vault admission [--explain]` (16-04, D-28, D-05): prints exactly one of
+ * `inert | off | on | config-unreadable` and exits 0. With `--explain` and
+ * `config-unreadable`, one more line per unreadable file names the file and the
+ * repair; `--raw` prints the verdict object instead.
  *
- * The CLI owns everything that must be PROVABLE — the pinned ref, the
- * resolved sha, the practice-id set and the per-file digests — and the agent
- * writes only the judgement half (`status`, `reason`, `tasks`). Provability
- * cannot rest on an agent transcribing a forty-character sha.
+ * The answer comes from `vaultAdmissionVerdict` in the REAL src/vault.cts, never
+ * from the injectable `_vault` seam: a governance decision must not be
+ * switchable by a test mock (the mode-guard precedent in `routeVaultCommand`).
+ * It stays on the cwd's own verdict, not the producer verdict the seven record
+ * producers ask (quick 261015-ect, QD-10): this verb is a REPORT of the cwd,
+ * which is what every fence asks, so a bindings-less linked worktree answers
+ * `inert` here even where its owning checkout is admitted (QD-09 "Not changed").
  *
- * NEITHER ARM WRITES A FILE. The producer emits text the agent embeds in the
- * single write it already performs. Patching a plan's frontmatter here would
- * have to round-trip it through the shared serializer, which cannot re-emit
- * nested object lists, so the same write would damage the plan's own
- * must-haves block.
+ * Exit 0 on every answer, because a door fence reads the TOKEN: any stdout other
+ * than `on`, `off` or `inert` halts it, and its `|| echo unrecognised` fallback
+ * turns a non-zero exit into a halt as well. The only non-zero paths are an
+ * argument error here and the 13-06 invalid-mode refusal that precedes every
+ * vault subcommand where `.platform-bindings.json` exists (QD-11); both
+ * therefore halt the fence, never skip it.
  */
-function routeTrace({ args, cwd, raw, error, vault, c, _exec, _trace, }) {
+function admissionVerb({ cwd, rest, raw, error, c }) {
+    let explain = false;
+    for (const a of rest) {
+        if (a === '--raw')
+            continue;
+        if (a === '--explain') {
+            explain = true;
+            continue;
+        }
+        error(`Unrecognized argument "${boundedPath(a)}" for vault admission. Supported: --explain, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const realVault = require('./vault.cjs');
-    const cfgGet = vault.cfgGet ? vault.cfgGet.bind(vault) : realVault.cfgGet;
-    const verb = args[2];
-    const traceArgs = args.slice(3);
-    if (verb !== 'scaffold' && verb !== 'render') {
-        error(`Unknown trace subcommand. Available: ${TRACE_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    const owner = require('./vault.cjs');
+    const verdict = owner.vaultAdmissionVerdict(cwd);
+    if (raw) {
+        c.output(verdict, true, JSON.stringify(verdict));
         return;
     }
-    // Inert unless both vault keys are on: no output at all, before any flag check.
-    if (!tracePracticesActive(cfgGet, cwd))
+    const lines = [verdict.state];
+    if (explain && verdict.state === 'config-unreadable') {
+        for (const u of verdict.unreadable) {
+            lines.push(`${u.file}: ${u.error} — repair: fix the JSON in ${u.file} (or remove the key that broke it) and re-run; ` +
+                'the gate cannot read this file and refuses to pass having checked nothing');
+        }
+    }
+    c.output(verdict, true, `${lines.join('\n')}\n`);
+}
+/**
+ * `vault standards block|consulted` (15-07). The CLI owns everything provable
+ * about a standards record (D-06): the pin comes from the manifest, a path is
+ * accepted only when the loaded INDEX resolves it (D-19), the degraded line is
+ * chosen from the measured state (D-08) and the override line comes from the
+ * one override builder. The planner fills reason slots and the executor fills
+ * status slots; nothing else in the record is typed by an agent.
+ *
+ * ORDER: unless `vault admission` answers `on` (bindings present, every config
+ * readable, the vault switch on) both verbs print nothing and write nothing,
+ * before any argument or the mode is read — so a project without the vault is
+ * byte-identical on every path including a mistyped one, and a standards record
+ * cannot be produced on a project whose trace gate is inert (17-REVIEW CR-01,
+ * D-13; the same gate `routeVaultAnchor` and `doorRecordVerb` ask). The verdict
+ * is asked of the checkout whose vault cache the verbs read (quick 261015-at3,
+ * QD-09): in a linked worktree reading its owning checkout's cache — where an
+ * executor runs `consulted` and has no untracked bindings of its own — that is
+ * the owning checkout, which is also where the gate reading the record runs. Then
+ * practices mode answers its one not-applicable line, then the verb and the
+ * flags are checked. An invalid mode never reaches here: the pre-dispatch
+ * guard in `routeVaultCommand` refused it.
+ *
+ * Every governance read is from the REAL module, never the `_vault` seam (the
+ * mode-guard precedent); only the bounded PLAN read goes through the seam, so
+ * a test can count it. Neither verb writes a file.
+ */
+function routeVaultStandards({ cwd, args, raw, error, vault, c, exec }) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const owner = require('./vault.cjs');
+    if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
         return;
-    if (verb === 'scaffold') {
-        const RECOGNIZED_SCAFFOLD_FLAGS = new Set(['--stage', '--plan', '--raw']);
-        const unrecognized = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_SCAFFOLD_FLAGS.has(a));
-        if (unrecognized !== undefined) {
-            error(`Unrecognized flag "${unrecognized}" for vault trace scaffold. ` +
-                `Supported: positional file paths, --stage <${TRACE_STAGES.join('|')}>, --plan <id>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
-            return;
+    if (!owner.isStandardsModeActive(cwd)) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { notApplicableStandardsVerbEnvelope } = require('./vault-mode.cjs');
+        const na = notApplicableStandardsVerbEnvelope();
+        c.output(na, true, raw ? JSON.stringify(na) : na.message);
+        return;
+    }
+    const verb = args[2];
+    const rest = args.slice(3);
+    if (verb === 'block') {
+        standardsBlockVerb({ cwd, rest, raw, error, c, owner });
+    }
+    else if (verb === 'consulted') {
+        standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec });
+    }
+    else {
+        error(`Unknown standards subcommand. Available: ${STANDARDS_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    }
+}
+function standardsBlockVerb({ cwd, rest, raw, error, c, owner }) {
+    // ── arguments ──
+    let planId;
+    let planGiven = false;
+    const positionals = [];
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--plan') {
+            planGiven = true;
+            planId = rest[i + 1];
+            i += 1;
+            continue;
+        }
+        if (a.startsWith('--plan=')) {
+            planGiven = true;
+            planId = a.slice('--plan='.length);
+            continue;
         }
-        const valueIndices = flagValueIndices(traceArgs, ['--stage', '--plan']);
-        const stageIdx = traceArgs.indexOf('--stage');
-        const stage = stageIdx !== -1 ? traceArgs[stageIdx + 1] : undefined;
-        if (stage === undefined || !TRACE_STAGES.includes(stage)) {
-            error(`Missing or unrecognized --stage value for vault trace scaffold. Supported: ${TRACE_STAGES.join(', ')}.`, ERROR_REASON.SDK_FAIL_FAST);
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault standards block. ` +
+                'Supported: --plan <plan-id>, positional INDEX paths, --raw.', ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        const planIdx = traceArgs.indexOf('--plan');
-        const planId = planIdx !== -1 ? traceArgs[planIdx + 1] : undefined;
-        if (planId === undefined || planId.startsWith('--')) {
-            error('No plan identifier was given. Usage: vault trace scaffold ' +
-                `--stage <${TRACE_STAGES.join('|')}> --plan <id> [files...] [--raw].`, ERROR_REASON.SDK_MISSING_ARG);
+        positionals.push(a);
+    }
+    if (!planGiven || planId === undefined || planId === '' || planId.startsWith('--')) {
+        error('No plan identifier was given. Usage: vault standards block --plan <plan-id> [<index-path>...] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    if (!SCAFFOLD_PLAN_ID_RE.test(planId)) {
+        error(`Invalid --plan value "${boundedPath(planId)}" for vault standards block. ${SCAFFOLD_PLAN_ID_FORM} ${SCAFFOLD_QUICK_ID_FORM}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // ── the measured state, read once, from one cache ──
+    // The manifest and the INDEX come from the same directory, the one
+    // `resolveVaultCacheDir` names (in a main checkout, `.planning/vault/`), so
+    // the pin and the resolved paths always describe one cache. "Loaded" and the
+    // stamp status are the leaf's predicates, shared with the trace gate.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const indexLeaf = require('./vault-index.cjs');
+    const cacheDir = owner.resolveVaultCacheDir(cwd).dir;
+    const pin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cacheDir));
+    const state = pin === null ? null : owner.computeVaultIndexState(cwd, { vaultDir: cacheDir });
+    const indexStatus = vaultStandardsLeaf.standardsMeasuredIndexStatus(pin, state);
+    // ── the selection (D-19) ──
+    // The repair comes from the one owner the consulted verb and the trace gate
+    // also read (15-REVIEW iter-3 WR-01), so the three cannot name different ones.
+    const indexFix = vaultStandardsLeaf.standardsIndexRepair(indexStatus);
+    if (indexFix !== null && positionals.length > 0) {
+        error(`Vault standards block: no document can be selected: the index is ${indexStatus}. ` +
+            'Run the command with no index paths to record that state; to select documents, ' +
+            `${indexFix.repair.charAt(0).toLowerCase()}${indexFix.repair.slice(1)} first.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const selectable = vaultStandardsLeaf.standardsResolvedPaths(state);
+    const seen = new Set();
+    for (const p of positionals) {
+        // Exact string membership: no normalisation, no join, no stat (Phase 14
+        // D-08). A path the INDEX does not resolve is refused in ONE wording
+        // whatever the reason, so the refusal never tells a caller which class of
+        // file a path names.
+        if (seen.has(p)) {
+            error(`Vault standards block: ${indexLeaf.displayVaultPath(p)} is listed more than once; name each INDEX path once.`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        if (!SCAFFOLD_PLAN_ID_RE.test(planId)) {
-            error(`Invalid --plan value "${boundedPath(planId)}" for vault trace scaffold. ${SCAFFOLD_PLAN_ID_FORM} ` +
-                'A trace gate compares the identifier a plan artifact records against the one its own filename states.', ERROR_REASON.SDK_FAIL_FAST);
+        seen.add(p);
+        if (!selectable.has(p)) {
+            error(`Vault standards block: ${indexLeaf.displayVaultPath(p)} is not a selectable INDEX entry. ` +
+                'Choose from the entries the ## INDEX section of .planning/vault/SUMMARY.md lists, exactly as written there.', ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        const files = traceArgs.filter((a, i) => !a.startsWith('--') && !valueIndices.has(i));
-        // The execute stage records, per governed file, the commit that last
-        // produced it, so the statement asserts something falsifiable. A file with
-        // no commit yields no digest — the leaf records that gap as a loud note; a
-        // HEAD fallback would paper over a real coverage hole.
-        const runGit = _exec ?? shell_command_projection_cjs_1.execGit;
-        const fileInputs = files.map((name) => {
-            if (stage !== 'execute')
-                return name;
-            const res = runGit(['log', '-1', '--format=%H', '--', name], { cwd });
-            const digest = res.exitCode === 0 ? res.stdout.trim() : '';
-            return GIT_COMMIT_DIGEST_RE.test(digest) ? { name, gitCommit: digest } : name;
+    }
+    // ── the record ──
+    const repoText = pin !== null
+        ? indexLeaf.sanitiseVaultText(owner.redactCloneTarget(pin.repo) ?? '', 200).replace(/\s+/g, '_')
+        : '';
+    // Document lines only on a healthy index with a selection; otherwise the
+    // one degraded line the measured status implies (D-08).
+    const degraded = indexStatus === 'ok' && positionals.length > 0
+        ? null
+        : vaultStandardsLeaf.standardsDegradedLineFor(indexStatus);
+    const record = {
+        planId,
+        repo: pin !== null && repoText !== '' ? repoText : null,
+        ref: pin?.ref ?? null,
+        sha: pin?.sha ?? null,
+        indexStatus,
+        documents: degraded === null
+            ? positionals.map((p) => ({ path: p, ref: pin.ref, sha: pin.sha, reason: '' }))
+            : [],
+        degraded,
+        override: null,
+    };
+    // ── the override line (D-08): only through the one builder ──
+    // Recorded only when the load gate's verdict GENUINELY blocks now and the
+    // trace leaf accepts the operator's override reason from this process's
+    // environment; a non-blocking verdict records nothing (D-15 of Phase 4). The
+    // router names no part of the override stack (the leaf owns it all). The
+    // gate name is the scaffold arm's own constant. The verdict is computed
+    // against the SAME cache the stamp above measured (D-36, 15-REVIEW iter-2
+    // WR-02), exactly as the trace gate recomputes it, so the suppressed reason
+    // recorded here is the one the gate will compare it with, in any checkout.
+    const verdict = owner.computeVaultVerdict(cwd, { vaultDir: cacheDir });
+    if (verdict.block === true) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const traceLeaf = require('./vault-trace.cjs');
+        const ov = traceLeaf.buildStandardsOverrideRecord(cwd, {
+            gate: TRACE_OVERRIDE_GATE,
+            block: true,
+            suppressedReason: verdict.reason,
         });
-        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-        const traceMod = _trace ?? require('./vault-trace.cjs');
-        // No files is a REAL path: a documentation-only plan is still governed by
-        // the global practices, and its ruled-out set must stay auditable.
-        const statement = traceMod.buildTraceStatement({ cwd, stage, plan: planId, files: fileInputs });
-        if (raw) {
-            c.output(statement, true, JSON.stringify(statement));
-        }
-        else {
-            c.output(statement, true, traceMod.serializeTraceBlock(statement));
+        if (ov) {
+            record.override = { gate: ov.gate, suppressedReason: ov.suppressedReason, who: ov.who, when: ov.when, reason: ov.reason };
         }
+    }
+    let text;
+    try {
+        text = vaultStandardsLeaf.serializeStandardsBlock(record);
+    }
+    catch (e) {
+        error(`Vault standards block could not write the record: ${boundedPath(e instanceof Error ? e.message : String(e))}`, ERROR_REASON.UNKNOWN);
         return;
     }
-    // ── render ──
-    const RECOGNIZED_RENDER_FLAGS = new Set(['--raw']);
-    const unrecognizedRender = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_RENDER_FLAGS.has(a));
-    if (unrecognizedRender !== undefined) {
-        error(`Unrecognized flag "${unrecognizedRender}" for vault trace render. Supported: a positional artifact path, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+    const envelope = owner.withVaultMode({
+        status: 'ok',
+        planId,
+        stamp: { repo: record.repo, ref: record.ref, sha: record.sha, indexStatus },
+        documents: record.documents.map((d) => ({ path: d.path, ref: d.ref, sha: d.sha })),
+        degraded: record.degraded,
+        override: record.override,
+        text,
+    }, cwd);
+    c.output(envelope, true, raw ? JSON.stringify(envelope) : text);
+}
+function standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec, }) {
+    const unrecognized = rest.find((a) => a.startsWith('--') && a !== '--raw');
+    if (unrecognized !== undefined) {
+        error(`Unrecognized flag "${boundedPath(unrecognized)}" for vault standards consulted. ` +
+            'Supported: a positional plan path, --raw.', ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    const artifactPath = traceArgs.find((a) => !a.startsWith('--'));
-    if (artifactPath === undefined) {
-        error('No artifact path was given. Usage: vault trace render <artifact> [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+    const positionals = rest.filter((a) => !a.startsWith('--'));
+    if (positionals.length !== 1) {
+        error('vault standards consulted takes exactly one plan path. Usage: vault standards consulted <plan-path> [--raw].', positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    // CONTAINMENT, decided BEFORE the read (the bounded reader returns '' on any
-    // problem and never throws, so a decision taken on its result would be none).
-    // The rendered section is included verbatim in SUMMARY.md, so an out-of-tree
-    // file must never become its content. The predicate is the real leaf's, not
-    // the `_vault` seam's: a security decision is not switchable by a mock.
+    const artifactPath = positionals[0];
+    const shown = boundedPath(artifactPath);
+    // CONTAINMENT FIRST, then the size, then the read (the `trace render`
+    // precedent, T-03-50): the plan path is an unvalidated positional, and a
+    // decision taken on the bounded read's RESULT would be no decision.
     if (artifactPath.indexOf('\u0000') !== -1) {
-        error(`The artifact path is not a usable path: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+        error(`The plan path is not a usable path: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
     let projectRoot;
@@ -579,225 +1667,1374 @@ function routeTrace({ args, cwd, raw, error, vault, c, _exec, _trace, }) {
         projectRoot = cwd;
     }
     const artifactAbs = node_path_1.default.resolve(cwd, artifactPath);
-    if (!realVault.isInsideDir(projectRoot, artifactAbs)) {
-        error(`The artifact path resolves outside the project and was not read: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+    if (!owner.isInsideDir(projectRoot, artifactAbs)) {
+        error(`The plan path resolves outside the project and was not read: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-    const traceMod = _trace ?? require('./vault-trace.cjs');
-    const readHead = vault.readHeadBounded ? vault.readHeadBounded.bind(vault) : realVault.readHeadBounded;
-    const content = readHead(artifactAbs, TRACE_ARTIFACT_READ_BYTES);
-    const parsed = traceMod.parseVaultTraceBlock(content, artifactPath);
-    // THE LEDGER, AND ONLY THE LEDGER: this arm never calls the matcher, so the
-    // rendered section cannot disagree with the frontmatter it is generated
-    // from. An absent ledger yields no section; an empty one yields the heading
-    // plus one explanatory line (the leaf's renderer).
-    const rendered = parsed.present ? traceMod.renderPracticesApplied(parsed.statement) : '';
-    if (raw) {
-        c.output(parsed, true, JSON.stringify(parsed));
+    let size;
+    try {
+        const st = node_fs_1.default.statSync(artifactAbs);
+        if (!st.isFile())
+            throw new Error('not a file');
+        size = st.size;
     }
-    else {
-        c.output(parsed, true, rendered);
+    catch {
+        error(`The plan path is not a readable file: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
     }
-}
-/**
- * `vault audit <phase> [--range <from>..<to>] [--raw]` — the operator's view of
- * the mechanical practice audit.
- *
- * A PASS-THROUGH: it collects arguments, calls `runVaultAudit` and prints the
- * leaf's own envelope (`--raw`) or the leaf's own report. `check vault.audit`
- * serializes the same envelope from the same engine, and the phase argument is
- * resolved by the same `resolveDecisionPhaseDir`, so the report cannot disagree
- * with the gate that blocks on it.
- *
- * Inert (no output at all) unless both vault keys are on, decided before the
- * flag allowlist so an inert project is silent on every path. A malformed
- * `--range` is refused by the leaf's own predicate and never echoed. The
- * range's value is excluded by index, so the flag may precede the phase.
- */
-function routeAudit({ args, cwd, raw, error, vault, c, _exec, _audit, }) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const realVault = require('./vault.cjs');
-    const cfgGet = vault.cfgGet ? vault.cfgGet.bind(vault) : realVault.cfgGet;
-    if (!tracePracticesActive(cfgGet, cwd))
+    if (size > STANDARDS_PLAN_READ_BYTES) {
+        error(`The plan is ${size} bytes, above the ${STANDARDS_PLAN_READ_BYTES}-byte read cap the trace gate also applies, ` +
+            `and was not read: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
         return;
-    const auditArgs = args.slice(2);
-    const RECOGNIZED_AUDIT_FLAGS = new Set(['--raw', '--range']);
-    const unrecognized = auditArgs.find((a) => a.startsWith('--') && !RECOGNIZED_AUDIT_FLAGS.has(a));
-    if (unrecognized !== undefined) {
-        error(`Unrecognized flag "${boundedPath(unrecognized)}" for vault audit. Supported: a phase directory or number, --raw, --range <from>..<to>.`, ERROR_REASON.SDK_FAIL_FAST);
+    }
+    const text = vault.readHeadBounded(artifactAbs, STANDARDS_PLAN_READ_BYTES);
+    const parsed = vaultStandardsLeaf.parseStandardsBlock(text, { artifact: shown });
+    if (parsed.record === null || parsed.problems.length > 0) {
+        const first = parsed.problems[0];
+        error(first
+            ? `Vault standards consulted: ${first.kind}: ${first.detail}`
+            : `Vault standards consulted: ${shown} carries no readable ${vaultStandardsLeaf.VAULT_STANDARDS_TAG_OPEN} record. ` +
+                'Re-run `pp-tools vault standards block --plan <plan-id> <index-path...>` and embed its output verbatim.', ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-    const auditMod = _audit ?? require('./vault-audit.cjs');
+    const record = parsed.record;
+    // ── absolute cache paths (D-30, C-9) ──
+    // Resolved through the one cache resolver, so an executor in a linked
+    // worktree (which has no cache of its own) is pointed at the main checkout's.
+    // Every path is contained in the cache directory: a block edited by hand
+    // could name `../x.md`, and that must be refused before anyone reads it.
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const checkRouter = require('./check-command-router.cjs');
-    const rangeAt = auditArgs.indexOf('--range');
-    const rangeValue = rangeAt === -1 ? undefined : auditArgs[rangeAt + 1];
-    if (rangeAt !== -1) {
-        // The real leaf's predicate: a range check is not switchable by a test mock.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const leaf = require('./vault-audit.cjs');
-        if (typeof rangeValue !== 'string' || !leaf.isValidOperatorRange(rangeValue)) {
-            error(checkRouter.AUDIT_RANGE_REFUSED_MESSAGE, ERROR_REASON.SDK_FAIL_FAST);
+    const indexLeaf = require('./vault-index.cjs');
+    const cache = owner.resolveVaultCacheDir(cwd);
+    // And every path is a RESOLVED INDEX entry of that cache (D-19, 15-REVIEW
+    // WR-04): the executor is told to read each listed document in full, and a
+    // withheld or credential file is in the cache too. The same reads and the
+    // same set the block verb selects from, so a PLAN that never passed
+    // plan:post, or was edited after it, cannot hand such a path to an executor.
+    // One reason-free wording, as the block verb's: the refusal never says why.
+    const loadedPin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cache.dir));
+    const indexState = loadedPin === null ? null : owner.computeVaultIndexState(cwd, { vaultDir: cache.dir });
+    const selectable = vaultStandardsLeaf.standardsResolvedPaths(indexState);
+    // 15-REVIEW iter-2 WR-05: with no vault loaded, or a loaded vault whose INDEX
+    // is degraded, NO document can be listed, and the per-path wording below
+    // would name a loaded vault that is not there and send the reader back to
+    // `vault standards block`, where the only record left to write is a degraded
+    // one: a governed plan would lose its document record. So this case is
+    // refused first, naming the measured cause and the repair (`vault fetch`),
+    // from the one owner the block verb and the trace gate also read (iter-3
+    // WR-01), so the gate cannot send the same record somewhere else.
+    const indexStatus = vaultStandardsLeaf.standardsMeasuredIndexStatus(loadedPin, indexState);
+    const indexFix = vaultStandardsLeaf.standardsIndexRepair(indexStatus);
+    if (record.documents.length > 0 && indexFix !== null) {
+        error(`Vault standards consulted: ${indexFix.cause}, so no document of ${shown} can be listed. ` +
+            `${indexFix.repair}, then re-run this command.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const documents = [];
+    for (const d of record.documents) {
+        const cachePath = node_path_1.default.join(cache.dir, d.path);
+        if (node_path_1.default.isAbsolute(d.path) || !owner.isInsideDir(cache.dir, cachePath) || cachePath === cache.dir) {
+            error(`Vault standards consulted: ${indexLeaf.displayVaultPath(d.path)} in ${shown} resolves outside the vault cache ` +
+                'and was not listed. Re-run `pp-tools vault standards block` for this plan and embed its output verbatim.', ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
+        if (!selectable.has(d.path)) {
+            error(`Vault standards consulted: ${indexLeaf.displayVaultPath(d.path)} in ${shown} is not a selectable INDEX entry ` +
+                'of the loaded vault and was not listed. Re-run `pp-tools vault standards block` for this plan, choosing from ' +
+                'the entries the ## INDEX section of .planning/vault/SUMMARY.md lists, and embed its output verbatim.', ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        documents.push({ path: d.path, ref: d.ref, sha: d.sha, cachePath });
     }
-    const phaseArg = auditArgs.find((a, i) => !a.startsWith('--') && !(rangeAt !== -1 && i === rangeAt + 1));
-    if (phaseArg === undefined) {
-        error('No phase directory or phase number was given. Usage: vault audit <phase-dir|phase-number> [--range <from>..<to>] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
-        return;
-    }
-    let root;
+    // 16-06 (D-14/D-31/D-35): the anchor line, the section's last line. END is
+    // HEAD now (the executor runs this after the last task commit); START is the
+    // anchor `vault anchor start` recorded in the plan's own directory, when one
+    // is there. Both come from git and the anchors file, never from the agent.
+    // HEAD unreadable (no commit, git failing) writes no line at all, and the
+    // strict points then type the missing anchor (16-07); a write point is
+    // silent on it (D-16).
+    const headRun = exec(['rev-parse', 'HEAD'], { cwd });
+    const end = headRun.exitCode === 0 ? headRun.stdout.trim() : '';
+    const start = vaultSeal.readDirAnchors(node_path_1.default.dirname(artifactAbs))?.start ?? null;
+    const anchors = vaultSeal.ANCHOR_SHA_RE.test(end) ? { start, end } : null;
+    const section = vaultStandardsLeaf.serializeConsultedSection(record, { anchors });
+    const envelope = owner.withVaultMode({
+        status: 'ok',
+        planId: record.planId,
+        stamp: { repo: record.repo, ref: record.ref, sha: record.sha },
+        documents,
+        // The section and this field echo one sanitised line (15-REVIEW WR-03).
+        degraded: record.degraded === null ? null : vaultStandardsLeaf.standardsEchoDegraded(record.degraded),
+        cacheSource: cache.source,
+        section,
+    }, cwd);
+    c.output(envelope, true, raw ? JSON.stringify(envelope) : section);
+}
+/**
+ * The real vault module, for the governance reads of the 16-06 verbs: the
+ * admission verdict, containment and phase resolution must not be switchable
+ * by a test mock (the mode-guard precedent in `routeVaultCommand`).
+ */
+function anchorOwner() {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('./vault.cjs');
+}
+/** The project root the router's other containment checks use: `findProjectRoot(cwd) || cwd`. */
+function projectRootOf(cwd) {
     try {
-        root = findProjectRoot(cwd) || cwd;
+        return findProjectRoot(cwd) || cwd;
     }
     catch {
-        root = cwd;
-    }
-    const phase = checkRouter.resolveDecisionPhaseDir(root, cwd, phaseArg);
-    if (!phase) {
-        const unresolved = {
-            status: 'unresolved',
-            block: true,
-            message: `Vault audit: "${boundedPath(phaseArg)}" is neither an existing directory inside the project nor a `
-                + 'phase the locator resolves, so no practice was compared against anything. Repair: re-run this '
-                + 'command with the phase directory or number.',
-        };
-        c.output(unresolved, true, raw ? JSON.stringify(unresolved) : unresolved.message);
-        return;
+        return cwd;
     }
-    const result = auditMod.runVaultAudit({
-        root,
-        phaseDir: phase.abs,
-        exec: _exec ?? shell_command_projection_cjs_1.execGit,
-        ...(typeof rangeValue === 'string' ? { range: rangeValue } : {}),
-    });
-    // The leaf's object, untouched: the operator view and the gate serialize the
-    // same envelope, and nothing between the leaf and the screen rebuilds it.
-    if (raw) {
-        c.output(result, true, JSON.stringify(result));
+}
+/**
+ * THE CONTAINMENT LADDER for a path a 16-06 verb is handed (the
+ * `standardsConsultedVerb` order, T-03-50): a NUL byte is refused, the project
+ * root is resolved, the path must resolve inside the root AND inside its
+ * `.planning/` tree (never the tree itself), and only then is it stat'ed.
+ *
+ *   - `dir`: an existing directory;
+ *   - `file`: an existing regular file (not a symlink);
+ *   - `artifact`: a file that may not exist yet, whose directory exists inside
+ *     `.planning/`; when it does exist it must be a regular file (not a
+ *     symlink), so a write can never be redirected out of the tree.
+ *
+ * `.planning/` is required, not only the root, because every path these verbs
+ * write or read is a planning record; an anchors file or a door record in the
+ * project's source tree would be committed as source (D-55). The refusal names
+ * the bounded argv value, never file content.
+ */
+function resolvePlanningPath(cwd, raw, want) {
+    const shown = boundedPath(raw);
+    if (raw.indexOf('\u0000') !== -1)
+        return { ok: false, reason: 'path-unusable', message: `"${shown}" is not a usable path` };
+    const owner = anchorOwner();
+    const root = projectRootOf(cwd);
+    const abs = node_path_1.default.resolve(cwd, raw);
+    if (!owner.isInsideDir(root, abs)) {
+        return { ok: false, reason: 'outside-project', message: `"${shown}" resolves outside the project and was not used` };
+    }
+    const planning = node_path_1.default.join(root, '.planning');
+    const under = want === 'artifact' ? node_path_1.default.dirname(abs) : abs;
+    if (!owner.isInsideDir(planning, under) || (want !== 'artifact' && owner.isInsideDir(abs, planning))) {
+        return { ok: false, reason: 'outside-planning', message: `"${shown}" is not inside the project's .planning/ tree` };
+    }
+    const rel = node_path_1.default.relative(root, abs).split(node_path_1.default.sep).join('/');
+    try {
+        if (want === 'dir') {
+            if (!node_fs_1.default.statSync(abs).isDirectory())
+                return { ok: false, reason: 'not-a-directory', message: `"${shown}" is not a directory` };
+        }
+        else if (want === 'file') {
+            const st = node_fs_1.default.lstatSync(abs);
+            if (!st.isFile())
+                return { ok: false, reason: 'not-a-file', message: `"${shown}" is not a regular file` };
+        }
+        else {
+            if (!node_fs_1.default.statSync(node_path_1.default.dirname(abs)).isDirectory()) {
+                return { ok: false, reason: 'not-a-directory', message: `the directory of "${shown}" does not exist` };
+            }
+            if (node_fs_1.default.existsSync(abs) || isDanglingLink(abs)) {
+                const st = node_fs_1.default.lstatSync(abs);
+                if (!st.isFile())
+                    return { ok: false, reason: 'not-a-file', message: `"${shown}" exists and is not a regular file` };
+            }
+        }
+    }
+    catch {
+        return { ok: false, reason: 'not-found', message: `"${shown}" does not exist` };
+    }
+    return { ok: true, root, abs, rel };
+}
+/** A symlink whose target is missing: `existsSync` says false, and a write would follow it. */
+function isDanglingLink(abs) {
+    try {
+        return node_fs_1.default.lstatSync(abs).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where the execute-stage scaffold reads a plan's START anchor from, derived
+ * from `--plan` (16-06, D-31). Measured order:
+ *
+ *   1. the QUICK form first: the one directory `<root>/.planning/quick/<id>-*`
+ *      (quick task directories always live under the ROOT planning tree,
+ *      `src/init.cts`). Exactly one match resolves; two or more is ambiguous
+ *      and resolves nothing. Tried for every id, so an all-digit quick id
+ *      (`261011-123`, which the phase alternative of `SCAFFOLD_PLAN_ID_RE`
+ *      also accepts) still finds its quick directory, and no second copy of
+ *      the quick-id form is needed here;
+ *   2. otherwise the PHASE form: the segment before the first `-` (`02.1` of
+ *      `02.1-03`) resolved by `resolveTracePhaseDir`, the resolver the trace
+ *      gate uses for a phase-number positional, which honours the active
+ *      workstream (`--ws`, `GSD_WORKSTREAM`, the session pointer) through the
+ *      phase locator.
+ *
+ * Unresolvable → `ok: false`, and the scaffold writes `endCommit` only.
+ */
+function resolveScaffoldAnchorsDir(cwd, planId) {
+    const root = projectRootOf(cwd);
+    const quickRoot = node_path_1.default.join(root, '.planning', 'quick');
+    let quick = [];
+    try {
+        quick = node_fs_1.default.readdirSync(quickRoot, { withFileTypes: true })
+            .filter((d) => d.isDirectory() && d.name.startsWith(`${planId}-`))
+            .map((d) => d.name);
+    }
+    catch {
+        quick = [];
+    }
+    if (quick.length === 1) {
+        const abs = node_path_1.default.join(quickRoot, quick[0]);
+        return { ok: true, root, abs, rel: node_path_1.default.relative(root, abs).split(node_path_1.default.sep).join('/') };
+    }
+    if (quick.length > 1) {
+        return { ok: false, reason: 'anchors-dir-ambiguous', message: `${quick.length} quick directories match .planning/quick/${boundedPath(planId)}-*` };
+    }
+    const dash = planId.indexOf('-');
+    if (dash > 0) {
+        const resolved = anchorOwner().resolveTracePhaseDir(root, cwd, planId.slice(0, dash));
+        if (resolved && resolved.onlyFile === undefined)
+            return { ok: true, root, abs: resolved.abs, rel: resolved.rel };
+    }
+    return { ok: false, reason: 'anchors-dir-unresolved', message: `no phase or quick directory resolves for plan ${boundedPath(planId)}` };
+}
+/**
+ * `vault anchor <verb>` (16-06). INERT FIRST (D-13): unless the producer
+ * admission verdict is `on` (bindings present, every config readable, the
+ * vault gate active) the verb prints nothing and writes nothing, before any
+ * argument is read, so a project without the vault is byte-identical on every
+ * path, including a mistyped one. A `config-unreadable` project is halted by
+ * the admission fence that precedes every call site, never here.
+ *
+ * The verdict is the PRODUCER's (quick 261015-ect, QD-10), the one the other
+ * six record producers ask: equal to the cwd's own except in a linked worktree
+ * with no bindings of its own, where it is the owning checkout's. So all seven
+ * answer alike in every shape; the door fences, which probe the cwd's bindings
+ * first, never reach this verb in such a worktree, so only by-hand calls move.
+ */
+function routeVaultAnchor({ cwd, args, raw, error, c, exec }) {
+    if (anchorOwner().vaultProducerAdmissionVerdict(cwd).state !== 'on')
+        return;
+    const verb = args[2];
+    const rest = args.slice(3);
+    if (verb === 'start') {
+        anchorStartVerb({ cwd, rest, raw, error, c, exec });
+    }
+    else if (verb === 'backfill') {
+        anchorBackfillVerb({ cwd, rest, raw, error, c, exec });
+    }
+    else if (verb === 'certify') {
+        anchorCertifyVerb({ cwd, rest, raw, error, c, exec });
     }
     else {
-        c.output(result, true, auditMod.renderAuditReport(result));
+        error(`Unknown vault anchor verb. Available: ${ANCHOR_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
-const REVIEW_VERBS = ['scaffold', 'finalize'];
-const REVIEW_USAGE = 'vault review scaffold|finalize <phase> [--force] [--raw]';
-/** The artifact a review writes in its phase directory: `<NN>-VAULT-REVIEW.md`. */
-function reviewArtifactName(phaseToken) {
-    return `${phaseToken ? `${phaseToken}-` : ''}VAULT-REVIEW.md`;
+/**
+ * `vault anchor start <dir>` (16-06, D-31): record HEAD as the START anchor of
+ * a phase or quick directory, in `<dir>/.vault-anchors.json`
+ * (`{ start, recordedAt }`, written by the seal leaf's `writeDirStartAnchor`).
+ * Mode-neutral: it is the start the practices-only `vault manifest start`
+ * cannot give a standards-mode phase.
+ *
+ * Re-running at the SAME HEAD keeps the recorded start (`kept: true`, nothing
+ * written). At any other HEAD it records HEAD as the new start and says which
+ * start it superseded (`replaced`) — 16 review iteration 2 CR-02, D-98, which
+ * reverses D-93's "keep the first start". Keeping it let every record written
+ * after a resume carry the first start, so its range covered a commit made
+ * between the two runs: a claim of governance nothing granted (rule 3). The
+ * superseded start is kept in the directory's history, newest first, and an
+ * END-only record (a linked worktree's, D-59) takes the latest start that
+ * precedes its own end, so a record written before the resume still covers
+ * its own work. Commits made between the last record and the resume are
+ * covered by nothing and the strict gate names them; the phase's own work
+ * among them is repaired with the attributed start back-fill
+ * (`vault anchor backfill <summary> --from <commit>`), never by a silent
+ * widening.
+ *
+ * Exit 0 on every refusal, which travels as `{ ok: false, reason, message }`
+ * (the `vault manifest` posture: the step prints it and continues; the strict
+ * points type a missing start). An argument error is the only exit 1.
+ */
+function anchorStartVerb({ cwd, rest, raw, error, c, exec }) {
+    const positionals = [];
+    for (const a of rest) {
+        if (a === '--raw')
+            continue;
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault anchor start. Supported: a positional directory under .planning/, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        positionals.push(a);
+    }
+    if (positionals.length !== 1) {
+        error('vault anchor start takes exactly one directory. Usage: vault anchor start <phase-or-quick-dir> [--raw].', positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const emit = (result, text) => {
+        c.output(result, true, raw ? JSON.stringify(result) : text);
+    };
+    const located = resolvePlanningPath(cwd, positionals[0], 'dir');
+    if (!located.ok) {
+        emit({ ok: false, action: 'start', reason: located.reason, message: located.message }, `No start anchor was recorded: ${located.message}.`);
+        return;
+    }
+    const head = exec(['rev-parse', 'HEAD'], { cwd });
+    const sha = head.exitCode === 0 ? head.stdout.trim() : '';
+    if (!vaultSeal.ANCHOR_SHA_RE.test(sha)) {
+        const message = 'HEAD could not be read as a full commit id (no commit yet, or git failed)';
+        emit({ ok: false, action: 'start', reason: 'head-unreadable', message }, `No start anchor was recorded: ${message}.`);
+        return;
+    }
+    const file = `${located.rel}/${vaultSeal.VAULT_ANCHORS_FILE}`;
+    const existing = vaultSeal.readDirAnchors(located.abs);
+    if (existing !== null && existing.start === sha) {
+        emit({ ok: true, action: 'start', start: existing.start, recordedAt: existing.recordedAt, file, kept: true }, `Kept the start anchor ${existing.start} already recorded in ${file} (HEAD has not moved since it was recorded).`);
+        return;
+    }
+    let recorded;
+    try {
+        recorded = vaultSeal.writeDirStartAnchor(located.abs, sha);
+    }
+    catch {
+        const message = `${file} could not be written`;
+        emit({ ok: false, action: 'start', reason: 'write-failed', message }, `No start anchor was recorded: ${message}.`);
+        return;
+    }
+    const replaced = existing !== null ? { replaced: existing.start } : {};
+    emit({ ok: true, action: 'start', start: recorded.start, recordedAt: recorded.recordedAt, file, ...replaced }, existing !== null
+        ? `Recorded start anchor ${recorded.start} in ${file}, replacing ${existing.start} as the start of every record written from now on; `
+            + 'the earlier start stays in the directory\'s history for a record that ended before this one.'
+        : `Recorded start anchor ${recorded.start} in ${file}.`);
 }
+// ─── 16-19: the certificate writer (D-107, D-108) ────────────────────────────
+/** How long the strict check `vault anchor certify` runs may take before it is a `check-failed` refusal. */
+const CERTIFY_CHECK_TIMEOUT_MS = 120_000;
+/** The most stdout the certify verb reads from its child check (a larger envelope is `check-failed`). */
+const CERTIFY_CHECK_MAX_BUFFER = 8 * 1024 * 1024;
+/** At most this many problem kinds, added ends or removed ends travel in one certify refusal. */
+const CERTIFY_LIST_CAP = 20;
+/** How much of the child check's stderr a `check-failed` refusal quotes. */
+const CERTIFY_STDERR_HEAD = 120;
 /**
- * `vault review scaffold|finalize <phase> [--force] [--raw]` — the artifact half
- * of `/pp-vault-review`. The derivation is `check vault-review`'s, through the
- * same exported resolver and composer, so all three see one phase and one
- * payload.
- *
- *   - `scaffold` writes `<phase-dir>/<NN>-VAULT-REVIEW.md` from the payload:
- *     every computed section, every derived row, one `TODO` row per practice
- *     the agent must judge, and the three computed lines. It does not replace
- *     an existing review unless `--force` is given.
- *   - `finalize` re-stamps the rate, counts and coverage lines from the rows the
- *     agent wrote (the only writer of those lines), writes the file back when
- *     that changed it, and reports every problem: the validator's (a `TODO`
- *     left, a missing reason, a reclassified derived row, a score) and the
- *     population's (a practice dropped, added or duplicated).
- *
- * Exit 0 on every path and no `block` key on any envelope: the review reports
- * and never gates, so a problem is a repair item, never a halt.
- */
-function routeReview({ args, cwd, raw, c, }) {
-    const say = (envelope, text) => {
-        c.output(envelope, true, raw ? JSON.stringify(envelope) : text);
+ * `vault anchor certify <phase-dir>` (16 gap closure 16-19, D-107, D-108): the
+ * ONE writer of a phase directory's `.vault-certificates.json`. A certificate
+ * says "a clean strict check of this phase judged this SUMMARY's END, at this
+ * HEAD, at this time"; only a certified phase record bounds a later phase's
+ * SEAL-01 reach (16-18), so the certificate is the recorded fact D-101 said the
+ * gate did not have.
+ *
+ * WHY A CHILD PROCESS. `check vault.trace` is read-only by contract (TRACE-04)
+ * and its handler emits to stdout. Running it as the enforcer does, as
+ * `pp-tools check vault.trace <dir> --unpaired strict --raw`, keeps its exit-0
+ * posture and its envelope exactly what every gate reads, and this verb only
+ * reads that envelope. The engine is the one running (`pp-tools.cjs` beside
+ * this module's directory); the positional is the contained rel, after the
+ * subcommand, never in an option position.
+ *
+ * WHY THE ENDS AND HEAD ARE COLLECTED BEFORE THE SPAWN, AND RE-CHECKED AFTER.
+ * A certificate for an end the check never judged, or stamped with a HEAD the
+ * check did not judge at, is a certificate for a check that never passed: the
+ * shape D-106 closed at the leaf, reopened by its writer. So HEAD is read and
+ * the phase's ended SUMMARY records are collected first, only those ends are
+ * certified, and after the child returns a different HEAD is `head-moved` and a
+ * different set of ends is `records-changed`, each writing nothing. The verb
+ * refuses rather than certifying the intersection, so a concurrent writer is
+ * visible and never silently narrowed; a SUMMARY added while the check ran is
+ * certified by the next clean run.
+ *
+ * WHY THE GIT ENVIRONMENT IS SCRUBBED, FOR THE VERB'S READS AND THE CHILD
+ * ALIKE. A git hook or an agent shell exports the repository pointer
+ * (`GIT_DIR`, `GIT_WORK_TREE`, …), so an inherited value is ordinary, and a
+ * lasting certificate must never describe another repository's HEAD or
+ * verdict. The overlay comes from its one owner, `scrubbedGitEnv` in
+ * `src/vault.cts` (the cache resolver's precedent, 260915-mzx R2): every
+ * inherited `GIT_*` key is `undefined`, which unsets it, because neither
+ * `execGit` nor `spawnSync` passes an undefined value on.
+ *
+ * WHY THE OVERRIDE VARIABLE IS EMPTIED (D-108). An override never certifies:
+ * `checked_with_override`, an envelope carrying `override` and one carrying
+ * `overrideRejected` are each refused, and the child's `VAULT_OVERRIDE_ENV` is
+ * the empty string (which the trace leaf reads as absent), so an operator's
+ * per-run override in the calling shell can never turn a blocking check into a
+ * certificate, whatever a later engine's check does with that variable.
+ *
+ * WHY A QUICK DIRECTORY IS REFUSED (D-104). A quick task's record never bounds
+ * a later phase, so it is never certified (D-113 keeps the leaf from reading
+ * one as certified even if a file named its end).
+ *
+ * A skipped call certifies nothing, which only widens the next phase's reach
+ * and never hides a commit (D-110). Exit 0 on every refusal, which travels as
+ * `{ ok: false, action: 'certify', reason, … }`; an argument error is the only
+ * exit 1. Inert before any argument is read (`routeVaultAnchor`, D-13).
+ */
+function anchorCertifyVerb({ cwd, rest, raw, error, c, exec }) {
+    const positionals = [];
+    for (const a of rest) {
+        if (a === '--raw')
+            continue;
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault anchor certify. Supported: a positional phase directory under .planning/, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        positionals.push(a);
+    }
+    if (positionals.length !== 1) {
+        error('vault anchor certify takes exactly one phase directory. Usage: vault anchor certify <phase-dir> [--raw].', positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const emit = (result, text) => {
+        c.output(result, true, raw ? JSON.stringify(result) : text);
     };
-    const verb = args[2];
-    if (!REVIEW_VERBS.includes(verb)) {
-        const statement = `Vault review: "${boundedPath(typeof verb === 'string' ? verb : '')}" is not a review verb, so nothing was ` +
-            `reviewed. Usage: ${REVIEW_USAGE}.`;
-        say({ status: 'usage', statement }, statement);
+    const refuse = (reason, message, extra = {}) => {
+        emit({ ok: false, action: 'certify', reason, ...extra, message }, `Nothing was certified: ${message}.`);
+    };
+    const located = resolvePlanningPath(cwd, positionals[0], 'dir');
+    if (!located.ok) {
+        refuse(located.reason, located.message);
+        return;
+    }
+    if (!vaultSeal.isPhaseRecordRel(`${located.rel}/x`)) {
+        refuse('not-a-phase-dir', `${located.rel} is not a phase directory; a quick task's or a door's record never bounds a later phase (D-104), so it is never certified`);
+        return;
+    }
+    const gitEnv = anchorOwner().scrubbedGitEnv(process.env);
+    const readHead = () => {
+        const r = exec(['rev-parse', 'HEAD'], { cwd, env: gitEnv });
+        const sha = r.exitCode === 0 ? r.stdout.trim() : '';
+        return vaultSeal.ANCHOR_SHA_RE.test(sha) ? sha : '';
+    };
+    const head = readHead();
+    if (head === '') {
+        refuse('head-unreadable', 'HEAD could not be read as a full commit id (no commit yet, or git failed)');
+        return;
+    }
+    // A filesystem walk, no git: the ends of the SUMMARY records directly in this
+    // directory, sorted and unique.
+    const collectEnds = () => {
+        const scan = vaultSeal.collectCoveringRecords(located.root);
+        const prefix = `${located.rel}/`;
+        const ends = scan.records
+            .filter((r) => vaultSeal.isSummaryRecordRel(r.rel) && r.rel.startsWith(prefix) && r.rel.indexOf('/', prefix.length) === -1)
+            .map((r) => r.end);
+        return [...new Set(ends)].sort();
+    };
+    const endsBefore = collectEnds();
+    if (endsBefore.length === 0) {
+        const message = `${located.rel} has no SUMMARY with an end anchor, so there is nothing to certify; the strict check was not run`;
+        emit({ ok: false, action: 'certify', reason: 'no-ended-record', message }, `Nothing was certified: ${message}.`);
         return;
     }
-    const force = verb === 'scaffold' && args.includes('--force');
-    const tokens = args.slice(3).filter((a) => a !== '--raw' && !(force && a === '--force'));
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const checkRouter = require('./check-command-router.cjs');
-    const target = checkRouter.resolveVaultReviewTarget(cwd, tokens, REVIEW_USAGE);
-    if (!target.ok) {
-        say({ status: target.status, statement: target.statement }, target.statement);
+    const { VAULT_OVERRIDE_ENV } = require('./vault-trace.cjs');
+    const child = childProcess.spawnSync(process.execPath, [node_path_1.default.join(__dirname, '..', 'pp-tools.cjs'), 'check', 'vault.trace', located.rel, '--unpaired', 'strict', '--raw'], {
+        cwd: located.root,
+        encoding: 'utf8',
+        timeout: CERTIFY_CHECK_TIMEOUT_MS,
+        maxBuffer: CERTIFY_CHECK_MAX_BUFFER,
+        env: { ...process.env, ...gitEnv, [VAULT_OVERRIDE_ENV]: '' },
+        windowsHide: true,
+    });
+    const stderrHead = boundedPath(String(child.stderr ?? '').slice(0, CERTIFY_STDERR_HEAD));
+    const failed = (why) => {
+        refuse('check-failed', `the strict check of ${located.rel} could not be read (${why})`, { detail: `${why}; stderr: ${stderrHead}` });
+    };
+    if (child.error) {
+        failed(`the check did not run: ${boundedPath(child.error.message).slice(0, CERTIFY_STDERR_HEAD)}`);
+        return;
+    }
+    if (child.signal) {
+        failed(`the check was ended by ${child.signal}`);
+        return;
+    }
+    if (child.status !== 0) {
+        failed(`the check exited ${child.status}`);
+        return;
+    }
+    const stdout = String(child.stdout ?? '');
+    if (stdout.trim() === '') {
+        failed('the check printed nothing');
+        return;
+    }
+    let envelope;
+    try {
+        const parsed = JSON.parse(stdout);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            failed('the check printed JSON that is not an object');
+            return;
+        }
+        envelope = parsed;
+    }
+    catch {
+        failed('the check printed something that is not JSON');
+        return;
+    }
+    // The verdict gate (D-107, D-108): a clean strict verdict, and nothing else.
+    const has = (k) => Object.prototype.hasOwnProperty.call(envelope, k);
+    const status = typeof envelope.status === 'string' ? boundedPath(envelope.status) : null;
+    const block = typeof envelope.block === 'boolean' ? envelope.block : null;
+    const clean = envelope.status === 'checked' && envelope.block === false && !has('override') && !has('overrideRejected');
+    if (!clean) {
+        const problems = Array.isArray(envelope.problems) ? envelope.problems : [];
+        const kinds = [...new Set(problems
+                .map((p) => (p && typeof p === 'object' ? p.kind : undefined))
+                .filter((k) => typeof k === 'string')
+                .map((k) => boundedPath(k)))].sort().slice(0, CERTIFY_LIST_CAP);
+        const overridden = envelope.status === 'checked_with_override' || has('override');
+        refuse(overridden ? 'overridden' : 'not-clean', `the strict check of ${located.rel} answered ${status ?? 'no status'}, block ${String(block)}`
+            + `${kinds.length > 0 ? ` (${kinds.join(', ')})` : ''}`
+            + `${overridden ? '; an override never certifies (D-108)' : ''}`, { status, block, kinds });
+        return;
+    }
+    // After the child returned clean: the HEAD it judged at, then the ends it judged.
+    const headAfter = readHead();
+    if (headAfter !== head) {
+        refuse('head-moved', `HEAD moved from ${head} to ${headAfter || 'an unreadable HEAD'} while the strict check of ${located.rel} ran; re-run certify`, { head, headAfter: headAfter || null });
+        return;
+    }
+    const endsAfter = collectEnds();
+    const beforeSet = new Set(endsBefore);
+    const afterSet = new Set(endsAfter);
+    const added = endsAfter.filter((e) => !beforeSet.has(e));
+    const removed = endsBefore.filter((e) => !afterSet.has(e));
+    if (added.length > 0 || removed.length > 0) {
+        refuse('records-changed', `the ended records of ${located.rel} changed while its strict check ran (${added.length} added, ${removed.length} removed); re-run certify`, { added: added.slice(0, CERTIFY_LIST_CAP), removed: removed.slice(0, CERTIFY_LIST_CAP) });
+        return;
+    }
+    // Only the ends collected BEFORE the spawn, stamped with the HEAD read before it.
+    const file = `${located.rel}/${vaultSeal.VAULT_CERTIFICATES_FILE}`;
+    const already = new Set(vaultSeal.readDirCertificates(located.abs).map((cert) => cert.end));
+    const fresh = endsBefore.filter((e) => !already.has(e));
+    const old = endsBefore.filter((e) => already.has(e));
+    if (fresh.length > 0) {
+        const at = new Date().toISOString();
+        try {
+            vaultSeal.appendDirCertificates(located.abs, fresh.map((end) => ({ end, head, at })));
+        }
+        catch (e) {
+            refuse('write-failed', `${file} could not be written (${boundedPath(e instanceof Error ? e.message : String(e))})`);
+            return;
+        }
+    }
+    emit({ ok: true, action: 'certify', dir: located.rel, file, head, certified: fresh, alreadyCertified: old, ...(fresh.length === 0 ? { kept: true } : {}) }, fresh.length === 0
+        ? `Kept: every end anchor of ${located.rel} is already certified (${old.length}); nothing written.`
+        : `Certified ${fresh.length} end anchor(s) of ${located.rel} at HEAD ${head} after its strict check passed clean (${old.length} already certified).`);
+}
+/**
+ * The text's lines, split on the same boundaries the record parsers split on
+ * (`\r\n`, `\r`, `\n`), with their offsets, so an insertion lands at a line the
+ * parser counted and every other byte stays where it was.
+ */
+function lineSpans(text) {
+    const spans = [];
+    const re = /\r\n|\r|\n/g;
+    let last = 0;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        spans.push({ start: last, end: m.index, eol: m[0] });
+        last = m.index + m[0].length;
+    }
+    spans.push({ start: last, end: text.length, eol: '' });
+    return spans;
+}
+/** Insert `lines` as new lines directly after line `after`, in that line's own line ending. */
+function insertLinesAfter(text, spans, after, lines) {
+    const eol = spans[after].eol || (spans.find((sp) => sp.eol !== '')?.eol ?? '\n');
+    const at = spans[after].end;
+    return `${text.slice(0, at)}${lines.map((l) => `${eol}${l}`).join('')}${text.slice(at)}`;
+}
+/**
+ * The index of the practices ledger's `generatedAt` line, the line the
+ * serializer writes the anchors after, located the way the parser locates the
+ * block: the frontmatter from line 0 to the first later line opening `---`, the
+ * top-level `vault:` key, its `predicate:` child, and that child's own
+ * `generatedAt:` key. Also returns the indent of the predicate's keys and one
+ * indentation step, so the spliced lines sit at the ledger's own indentation.
+ * `null` when any of these is missing.
+ */
+function ledgerGeneratedAtLine(text, spans) {
+    const line = (i) => text.slice(spans[i].start, spans[i].end);
+    const indentOf = (l) => l.length - l.trimStart().length;
+    if (spans.length < 3 || line(0) !== '---')
+        return null;
+    let close = -1;
+    for (let i = 1; i < spans.length; i += 1) {
+        if (line(i).startsWith('---')) {
+            close = i;
+            break;
+        }
+    }
+    if (close === -1)
+        return null;
+    const vaultAt = Array.from({ length: close - 1 }, (_, k) => k + 1).find((i) => /^vault:\s*$/.test(line(i)));
+    if (vaultAt === undefined)
+        return null;
+    let predicateAt = -1;
+    let childIndent = -1;
+    for (let i = vaultAt + 1; i < close; i += 1) {
+        const l = line(i);
+        if (l.trim() === '')
+            continue;
+        const ind = indentOf(l);
+        if (ind === 0)
+            break;
+        if (childIndent === -1)
+            childIndent = ind;
+        if (ind === childIndent && l.trim() === 'predicate:') {
+            predicateAt = i;
+            break;
+        }
+    }
+    if (predicateAt === -1)
+        return null;
+    let keyIndent = -1;
+    for (let i = predicateAt + 1; i < close; i += 1) {
+        const l = line(i);
+        if (l.trim() === '')
+            continue;
+        const ind = indentOf(l);
+        if (ind <= childIndent)
+            break;
+        if (keyIndent === -1)
+            keyIndent = ind;
+        if (ind === keyIndent && l.trimStart().startsWith('generatedAt:')) {
+            return { index: i, keyIndent, step: keyIndent - childIndent };
+        }
+    }
+    return null;
+}
+/** The parsed statement minus its anchor keys, as text, for the before/after equality the back-fill asserts. */
+function statementWithoutAnchors(statement) {
+    const st = JSON.parse(JSON.stringify(statement ?? null));
+    if (st && st.predicate) {
+        for (const k of ['startCommit', 'endCommit', 'anchorBackfill', 'anchorsDropped'])
+            delete st.predicate[k];
+    }
+    return JSON.stringify(st);
+}
+/**
+ * `vault anchor backfill <summary> --at <sha>` (16-06, D-32):
+ * give a record written before anchors existed its anchors, ATTRIBUTED. There
+ * is no silent restamp at HEAD: `--at` is required (the operator states which
+ * commit the record's work ended at), it must be an ancestor of HEAD, and the
+ * record gains, beside the anchor, who ran the back-fill (`git config
+ * user.name`, bounded) and when. 16-07 reports a back-filled anchor as a note
+ * on every later check. `--at HEAD` is allowed, and is still attributed.
+ *
+ *   - practices (a SUMMARY's execute-stage `vault:` ledger, tried first):
+ *     `predicate.endCommit` = `--at` and `predicate.anchorBackfill: { by, at }`
+ *     (no start: the record takes its directory's, D-59), spliced after the
+ *     ledger's `generatedAt` line with the serializer's own lines
+ *     (`traceAnchorLines`), so a later `trace render` round trip agrees;
+ *   - standards (a `## Standards Consulted` section): the anchor line with its
+ *     `backfilled by <who> at <iso>` tail, inserted as the section's last line.
+ *
+ * Every other byte of the file is kept: the new text is the old one with lines
+ * inserted, and it is parsed back before it is written — the anchors must read
+ * back as written and the rest of the record must parse to exactly what it
+ * parsed to before, or nothing is written. The write is a temporary sibling
+ * renamed into place.
+ *
+ * Refused, writing nothing: a record that already carries an anchor (a valid,
+ * a dropped or a malformed one: `already-anchored`), a file with no record of
+ * either family (`no-record`), an `--at` that is not an ancestor of HEAD. A
+ * path outside `.planning/`, a malformed sha and `--from`/`--attest` beside
+ * `--at` are argument errors (exit 1), refused before any read or git call;
+ * the state refusals are `ok: false` envelopes (exit 0).
+ *
+ * 16 review iteration 3 CR-01 (D-102): `--at --from <commit>` set a start of
+ * the operator's choosing (the root commit, say), and D-98's `--from` alone
+ * widened an anchored record's start the same way; either covered every commit
+ * in between with one attribution and named none. Both are gone. The one repair
+ * left for a commit a record's range misses is `--from <recorded start>
+ * --attest <commit>` (`attestVerb`), which covers that commit alone.
+ */
+function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
+    const usage = 'Usage: vault anchor backfill <summary-path> --at <commit> [--raw], or, on a record that carries an end, '
+        + '--from <a start its directory recorded> --attest <commit> [--attest <commit> ...] [--raw].';
+    const positionals = [];
+    const shas = {};
+    const attest = [];
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--at' || a === '--from' || a === '--attest') {
+            const v = rest[i + 1];
+            if (v === undefined || v.startsWith('--')) {
+                error(`${a} needs a commit. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            if (a === '--attest')
+                attest.push(v);
+            else
+                shas[a] = v;
+            i += 1;
+            continue;
+        }
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault anchor backfill. Supported: --at <commit>, --from <commit>, --attest <commit>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        positionals.push(a);
+    }
+    if (positionals.length !== 1) {
+        error(`vault anchor backfill takes exactly one SUMMARY path. ${usage}`, positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (shas['--at'] === undefined && shas['--from'] === undefined) {
+        error(`vault anchor backfill needs --at <commit>: there is no silent restamp at HEAD; name the commit the record's work ended at. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    // 16 review iteration 3 CR-01 (D-102): nothing widens a record's start any
+    // more. `--at` gives a record with no anchor its END (its start is its
+    // directory's, D-59); `--from` only bounds `--attest`, which names each
+    // commit that counts as covered, one by one.
+    if (shas['--at'] !== undefined && (shas['--from'] !== undefined || attest.length > 0)) {
+        error(`--at gives a record its end and nothing else; --from and --attest are for a record that already carries one (they attest single commits, they never widen its range). ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (shas['--at'] === undefined && (shas['--from'] === undefined || attest.length === 0)) {
+        error(`${shas['--from'] === undefined ? '--attest needs --from <a start the record\'s directory recorded>' : '--from needs at least one --attest <commit>: each commit is attested by its own full id, and nothing else is covered'}. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    for (const [flag, value] of [['--at', shas['--at']], ['--from', shas['--from']], ...attest.map((v) => ['--attest', v])]) {
+        if (value !== undefined && !vaultSeal.ANCHOR_SHA_RE.test(value)) {
+            error(`${flag} is not a full lowercase commit id (40 or 64 hex). ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+    }
+    const located = resolvePlanningPath(cwd, positionals[0], 'file');
+    if (!located.ok) {
+        error(`The SUMMARY path ${located.message}; a back-fill rewrites only a record under .planning/.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const at = shas['--at'];
+    const from = shas['--from'];
+    const emit = (result, text) => {
+        c.output(result, true, raw ? JSON.stringify(result) : text);
+    };
+    const refuse = (reason, message) => {
+        emit({ ok: false, action: 'backfill', file: located.rel, reason, message }, `No anchor was back-filled: ${message}.`);
+    };
+    const size = node_fs_1.default.statSync(located.abs).size;
+    if (size > vaultSeal.TRACE_ARTIFACT_BYTE_CAP) {
+        refuse('too-large', `${located.rel} is ${size} bytes, above the ${vaultSeal.TRACE_ARTIFACT_BYTE_CAP}-byte read cap the record readers apply`);
         return;
     }
+    const text = node_fs_1.default.readFileSync(located.abs, 'utf8');
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const leaf = require('./vault-review.cjs');
-    const payload = checkRouter.composeVaultReviewPayload(target.root, target.phase, target.phaseToken);
-    const name = reviewArtifactName(target.phaseToken);
-    const file = `${target.phase.rel}/${name}`;
-    const abs = node_path_1.default.join(target.phase.abs, name);
-    const partition = (payload.partition ?? {});
-    const coverage = typeof payload.mechanicalCoverageLine === 'string' ? payload.mechanicalCoverageLine : null;
-    if (verb === 'scaffold') {
-        if (node_fs_1.default.existsSync(abs) && !force) {
-            const statement = `Vault review: ${file} already exists, so it was left as it is. Re-run with --force to replace it ` +
-                'with a fresh scaffold, or run vault review finalize to check it.';
-            say({ status: 'exists', file, statement }, statement);
-            return;
-        }
-        const text = leaf.renderReviewScaffold(payload, {
-            date: new Date().toISOString().slice(0, 10),
-            phaseToken: target.phaseToken,
+    const traceLeaf = require('./vault-trace.cjs');
+    const ledger = traceLeaf.parseVaultTraceBlock(text, located.rel);
+    const st = (ledger.present ? ledger.statement : null);
+    const isLedger = st !== null && st._type === traceLeaf.TRACE_STATEMENT_TYPE && st.predicateType === traceLeaf.TRACE_PREDICATE_TYPE
+        && st.predicate !== undefined && st.predicate.stage === 'execute';
+    const section = isLedger ? null : vaultStandardsLeaf.parseConsultedSection(text);
+    const isSection = section !== null && section.present && section.planId !== null;
+    if (!isLedger && !isSection) {
+        refuse('no-record', `${located.rel} carries no execute-stage vault: ledger and no ${vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING} section to back-fill`);
+        return;
+    }
+    const anchored = isLedger
+        ? ['startCommit', 'endCommit', 'anchorBackfill', 'anchorsDropped'].some((k) => k in st.predicate)
+        : section.anchors !== undefined
+            || section.problems.some((p) => p.kind === vaultStandardsLeaf.STANDARDS_PROBLEM_KIND.ANCHOR_MALFORMED);
+    if (at === undefined) {
+        // `--from` + `--attest`: the attestation (16 review iteration 3 CR-01, D-102).
+        if (!anchored) {
+            refuse('at-required', `${located.rel} carries no anchor yet; give it its end with --at <commit> (--from and --attest attest single commits on a record that already carries an end)`);
+            return;
+        }
+        attestVerb({
+            cwd, exec, text, located, from, attest, isLedger, refuse, emit, traceLeaf,
         });
-        node_fs_1.default.writeFileSync(abs, text, 'utf-8');
-        const toJudge = Array.isArray(partition.remainder) ? partition.remainder.length : 0;
-        const derived = (Array.isArray(partition.naUniverse) ? partition.naUniverse.length : 0) +
-            (Array.isArray(partition.naNoFile) ? partition.naNoFile.length : 0);
-        const statement = `Vault review: wrote ${file} (arm: ${String(payload.arm)}; ${toJudge} practice(s) to judge, ` +
-            `${derived} derived N-A${payload.refusesCleanRender === true ? '; no clean review may be rendered from it' : ''}).`;
-        say({ status: 'written', file, arm: payload.arm, toJudge, derived, refusesCleanRender: payload.refusesCleanRender === true, statement }, statement);
         return;
     }
-    // finalize
-    let current;
+    if (anchored) {
+        refuse('already-anchored', `${located.rel} already carries an anchor; a back-fill only gives anchors to a record that never had one (a commit its range misses is attested with --from and --attest)`);
+        return;
+    }
+    // The shas reach git only now, shape-checked, after the subcommand (T-16-21).
+    if (exec(['merge-base', '--is-ancestor', at, 'HEAD'], { cwd }).exitCode !== 0) {
+        refuse('at-not-ancestor', `--at ${at} is not an ancestor of HEAD (or is not in this repository)`);
+        return;
+    }
+    const backfill = { by: traceLeaf.resolveBackfillIdentity(cwd), at: new Date().toISOString() };
+    const spans = lineSpans(text);
+    let next;
+    if (isLedger) {
+        const where = ledgerGeneratedAtLine(text, spans);
+        if (where === null) {
+            refuse('rewrite-unverifiable', `the ledger in ${located.rel} has no generatedAt line where the anchors belong`);
+            return;
+        }
+        // The serializer's lines, re-indented to this ledger's own indentation.
+        const lines = traceLeaf.traceAnchorLines({ ...(from !== undefined ? { startCommit: from } : {}), endCommit: at, anchorBackfill: backfill })
+            .map((l) => {
+            const depth = (l.length - l.trimStart().length) / 2 - 2;
+            return `${' '.repeat(where.keyIndent + depth * where.step)}${l.trimStart()}`;
+        });
+        next = insertLinesAfter(text, spans, where.index, lines);
+        const back = traceLeaf.parseVaultTraceBlock(next, located.rel);
+        const bp = back.present ? back.statement.predicate : {};
+        const agrees = back.present
+            && bp.endCommit === at
+            && bp.startCommit === from
+            && JSON.stringify(bp.anchorBackfill) === JSON.stringify(backfill)
+            && !('anchorsDropped' in bp)
+            && statementWithoutAnchors(back.statement) === statementWithoutAnchors(st);
+        if (!agrees) {
+            refuse('rewrite-unverifiable', `the back-filled ledger in ${located.rel} would not read back as written, so nothing was written`);
+            return;
+        }
+    }
+    else {
+        const live = vaultStandardsLeaf.findLiveSection(text, vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING);
+        const lastBody = live.body[live.body.length - 1];
+        const line = vaultStandardsLeaf.formatStandardsAnchorLine({ start: from ?? null, end: at, backfill });
+        next = insertLinesAfter(text, spans, lastBody, [line]);
+        const back = vaultStandardsLeaf.parseConsultedSection(next);
+        const before = section;
+        const expected = { ...(from !== undefined ? { start: from } : {}), end: at, backfill };
+        const strip = (p) => JSON.stringify({ ...p, anchors: undefined, headingLine: undefined });
+        const agrees = back.present
+            && JSON.stringify(back.anchors) === JSON.stringify({ end: expected.end, ...(from !== undefined ? { start: from } : {}), backfill })
+            && strip(back) === strip(before);
+        if (!agrees) {
+            refuse('rewrite-unverifiable', `the back-filled section in ${located.rel} would not read back as written, so nothing was written`);
+            return;
+        }
+    }
+    const tmp = `${located.abs}.${process.pid}.tmp`;
     try {
-        current = node_fs_1.default.readFileSync(abs, 'utf-8');
+        node_fs_1.default.writeFileSync(tmp, next, 'utf8');
+        node_fs_1.default.renameSync(tmp, located.abs);
     }
     catch {
-        const statement = `Vault review: ${file} does not exist, so there is nothing to finalize. Run vault review scaffold first.`;
-        say({ status: 'absent', file, statement }, statement);
-        return;
-    }
-    const stamped = leaf.stampReviewLines(current, { coverageLine: coverage });
-    if (stamped.stamped && stamped.text !== current)
-        node_fs_1.default.writeFileSync(abs, stamped.text, 'utf-8');
-    const result = leaf.validateReviewArtifact(stamped.text, { expectedCoverageLine: coverage });
-    const problems = [...result.problems, ...leaf.compareReviewPopulation(result.rows, partition)];
-    const envelope = {
-        status: problems.length === 0 ? 'valid' : 'problems',
-        file,
-        rateLine: result.expectedRateLine,
-        countsLine: result.expectedCountsLine,
-        problems,
+        try {
+            node_fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* nothing to clean */ }
+        refuse('write-failed', `${located.rel} could not be written`);
+        return;
+    }
+    const result = {
+        ok: true,
+        action: 'backfill',
+        file: located.rel,
+        family: isLedger ? 'practices' : 'standards',
+        endCommit: at,
+        ...(from !== undefined ? { startCommit: from } : {}),
+        backfilledBy: backfill.by,
+        backfilledAt: backfill.at,
     };
-    const text = [
-        `Vault review: ${file}`,
-        result.expectedRateLine,
-        result.expectedCountsLine,
-        ...(problems.length === 0
-            ? ['No repair items.']
-            : [
-                `Repair items (${problems.length}) — fix them in the artifact, then run vault review finalize again:`,
-                ...problems.map((p) => `- ${p.kind}${p.id ? ` (${p.id})` : ''}${p.line ? `, line ${p.line}` : ''}: ${p.detail}`),
-            ]),
-        'This review reports and does not gate.',
-    ].join('\n');
-    say(envelope, text);
+    emit(result, `Back-filled ${located.rel}: end ${at}${from !== undefined ? `, start ${from}` : ''}, by ${backfill.by} at ${backfill.at}.`);
+}
+/**
+ * The attestation (16 review iteration 3 CR-01, D-102; replaces D-98's start
+ * back-fill): `vault anchor backfill <summary> --from <start> --attest <commit>
+ * [--attest <commit> ...]` on a record that already carries an end.
+ *
+ * D-98 records a new directory start on every resume, so the phase's own
+ * commits made between its last record and the resume are covered by nothing,
+ * and the strict gate names them. Whether such a commit is the phase's work or
+ * an ungoverned one is not something the engine can tell. D-98's repair widened
+ * the record's START, which covered every commit in between — an ungoverned one
+ * made by someone else between the runs included — and left a note naming none
+ * of them. An attestation widens nothing: each `--attest` names ONE commit, and
+ * that commit alone counts as covered by the record. Every later strict check
+ * lists it, with its subject and paths and who attested it. A commit nobody
+ * attested stays named, and stays a block.
+ *
+ * Refused, writing nothing (each an `ok: false` envelope):
+ *   - a record with no valid end (`at-required`, `no-end`) or a malformed anchor;
+ *   - `--from` that is not a start the record's own directory recorded
+ *     (`vault anchor start` writes them, D-98 keeps the superseded ones), so no
+ *     attestation reaches below where the CLI saw this phase begin
+ *     (`from-not-recorded`), or that is not an ancestor of the record's end;
+ *   - an `--attest` that is not on the record's own (first-parent) line between
+ *     `--from` and its end, a merge commit, a commit touching no source path, one
+ *     the record already covers, one already attested on it, or given twice.
+ *
+ * The attestations are written to `<dir>/.vault-attestations.json` (the seal
+ * leaf's `appendDirAttestations`), never into the record: the record's bytes,
+ * and the range they state, do not change. `by` is the git `user.name` of
+ * whoever ran the command — what the CLI can read, not a verified identity —
+ * and the envelope says so (`byVerified: false`).
+ */
+function attestVerb({ cwd, exec, text, located, from, attest, isLedger, refuse, emit, traceLeaf }) {
+    const dirAbs = node_path_1.default.dirname(located.abs);
+    const recordName = node_path_1.default.basename(located.abs);
+    const kind = isLedger ? vaultSeal.RECORDED_ARTIFACT_KIND.SUMMARY_LEDGER : vaultSeal.RECORDED_ARTIFACT_KIND.STANDARDS_CONSULTED;
+    const isAncestor = (a, d) => vaultSeal.isAnchorSha(a) && vaultSeal.isAnchorSha(d)
+        && exec(['merge-base', '--is-ancestor', a, d], { cwd }).exitCode === 0;
+    const anchors = vaultSeal.resolveRecordAnchors(text, kind, dirAbs, { isAncestor });
+    if (anchors.problems.some((p) => p.kind === 'anchor_invalid')) {
+        refuse('anchors-malformed', `an anchor of ${located.rel} is malformed or was dropped; restore the value the CLI wrote before attesting a commit on it`);
+        return;
+    }
+    const end = anchors.end;
+    if (end === undefined) {
+        refuse('no-end', `${located.rel} carries no valid end anchor; give it one with --at <commit> first`);
+        return;
+    }
+    const dir = vaultSeal.readDirAnchors(dirAbs);
+    const recorded = dir === null ? [] : [dir.start, ...(dir.earlier ?? []).map((e) => e.start)];
+    if (!recorded.includes(from)) {
+        refuse('from-not-recorded', `--from ${from} is not a start this record's directory recorded (${recorded.length} recorded, by vault anchor start); `
+            + 'an attestation reaches back only to a start the CLI recorded for this phase, never to an arbitrary commit');
+        return;
+    }
+    if (from === end || !isAncestor(from, end)) {
+        refuse('from-not-ancestor', `--from ${from} is not an ancestor of the record's end ${end}`);
+        return;
+    }
+    const cap = vaultSeal.SEAL_CANDIDATE_CAP;
+    const lineRun = exec(['rev-list', '--first-parent', '--parents', `--max-count=${cap + 1}`, `^${from}`, end], { cwd });
+    const rows = lineRun.exitCode === 0 ? lineRun.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).map((l) => l.split(/\s+/)) : null;
+    if (rows === null || !rows.every((r) => r.every((x) => vaultSeal.isAnchorSha(x)))) {
+        refuse('git-failed', 'the commits between --from and the record\'s end could not be listed');
+        return;
+    }
+    if (rows.length > cap) {
+        refuse('too-many', `more than ${cap} commits lie between --from and the record's end`);
+        return;
+    }
+    const onLine = new Map(rows.map((r) => [r[0], r.length - 1]));
+    let own = new Set();
+    if (anchors.start !== undefined && isAncestor(anchors.start, end)) {
+        const ownRun = exec(['rev-list', '--first-parent', `--max-count=${cap + 1}`, `^${anchors.start}`, end], { cwd });
+        if (ownRun.exitCode !== 0) {
+            refuse('git-failed', 'the commits the record already covers could not be listed');
+            return;
+        }
+        own = new Set(ownRun.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean));
+    }
+    const already = new Set(vaultSeal.attestedFor(vaultSeal.readDirAttestations(dirAbs), recordName).map((a) => a.sha));
+    const by = traceLeaf.resolveBackfillIdentity(cwd);
+    const at = new Date().toISOString();
+    const entries = [];
+    for (const sha of attest) {
+        if (entries.some((e) => e.sha === sha)) {
+            refuse('attest-duplicate', `--attest ${sha} was given twice`);
+            return;
+        }
+        if (!onLine.has(sha)) {
+            refuse('attest-not-in-range', `--attest ${sha} is not on ${located.rel}'s own line between --from ${from} and its end ${end}`);
+            return;
+        }
+        if (onLine.get(sha) > 1) {
+            refuse('attest-merge', `--attest ${sha} is a merge commit; attest the commits it brought in, each by its own id`);
+            return;
+        }
+        if (own.has(sha)) {
+            refuse('attest-already-covered', `--attest ${sha} is already inside ${located.rel}'s own range; it needs no attestation`);
+            return;
+        }
+        if (already.has(sha)) {
+            refuse('attest-already-attested', `--attest ${sha} is already attested on ${located.rel}`);
+            return;
+        }
+        const tree = exec(['diff-tree', '-r', '-z', '--root', '--no-commit-id', '--name-only', '--no-renames', sha], { cwd });
+        const subj = exec(['log', '-1', '--format=%s', sha], { cwd });
+        if (tree.exitCode !== 0 || subj.exitCode !== 0) {
+            refuse('git-failed', `the paths or subject of ${sha} could not be read`);
+            return;
+        }
+        const paths = tree.stdout.split('\0').filter((p) => p !== '' && !vaultSeal.isNonSourcePath(p));
+        if (paths.length === 0) {
+            refuse('attest-not-source', `--attest ${sha} touches no governed source path, so no check names it and there is nothing to attest`);
+            return;
+        }
+        const flat = (v, n) => {
+            const f = v.replace(/[\u0000-\u001F\u007F-\u009F]+/g, ' ').replace(/\s+/g, ' ').trim();
+            return f.length > n ? `${f.slice(0, n)}…` : f;
+        };
+        entries.push({
+            record: recordName,
+            from,
+            sha,
+            subject: flat(subj.stdout, vaultSeal.SEAL_SUBJECT_CAP),
+            paths: paths.slice(0, vaultSeal.ATTESTATION_PATHS_CAP).map((p) => flat(p, 1000)),
+            by,
+            at,
+        });
+    }
+    try {
+        vaultSeal.appendDirAttestations(dirAbs, entries);
+    }
+    catch (e) {
+        refuse('write-failed', `${vaultSeal.VAULT_ATTESTATIONS_FILE} next to ${located.rel} could not be written (${boundedPath(e instanceof Error ? e.message : String(e))})`);
+        return;
+    }
+    const listed = entries.map((e) => ({ sha: e.sha, subject: e.subject, paths: e.paths }));
+    emit({
+        ok: true,
+        action: 'attest',
+        file: located.rel,
+        family: isLedger ? 'practices' : 'standards',
+        from,
+        endCommit: end,
+        attested: listed,
+        attestedBy: by,
+        byVerified: false,
+        attestedAt: at,
+    }, `Attested ${entries.length} commit${entries.length === 1 ? '' : 's'} on ${located.rel}, by ${by} (the git user.name, not verified) at ${at}: `
+        + `${entries.map((e) => `${e.sha.slice(0, 12)} "${e.subject}" (${e.paths.join(', ')})`).join('; ')}. Every later strict check lists each one.`);
+}
+/** The longest free-text value a door record line carries (the reason-clause bound, with room). */
+const DOOR_TEXT_MAX = 190;
+/**
+ * A free-text value made safe for a door record line: the vault leaf's display
+ * sanitiser (controls, bidi, zero-width, fence markers), backticks turned into
+ * apostrophes, bounded. Empty or the literal `none` becomes `unknown`, because
+ * `none` is how a door record spells an absent value.
+ */
+function doorText(value, opts = {}) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const indexLeaf = require('./vault-index.cjs');
+    let t = indexLeaf.sanitiseVaultText(typeof value === 'string' ? value : '', DOOR_TEXT_MAX).replace(/`/g, "'").trim();
+    if (opts.token === true)
+        t = t.replace(/\s+/g, '_');
+    return t === '' || t === 'none' ? 'unknown' : t;
+}
+/**
+ * The vault coordinates a door worked under, or the degraded one-liner saying
+ * why there are none (D-12 "or") — read by the SAME pin reader the mode's own
+ * record verb uses, never a third reader of the manifest:
+ *
+ *   - practices: the trace scaffold's `resolvePin` over the one resolved cache.
+ *     Only a `loaded` pin is recorded as coordinates; a degraded run (stale,
+ *     fallback tier, ref drift, miss, no cache) records its reason instead,
+ *     the same distinction the practices ledger draws;
+ *   - standards: `standardsLoadedPin` over the manifest of the one resolved
+ *     cache, the block verb's reader; no loaded pin records the degraded line
+ *     `vault standards block` would write for it.
+ *
+ * The repo has already been through `redactCloneTarget` (both readers go
+ * through `readManifest`), so no credential reaches the record.
+ */
+function doorVaultPin(cwd, mode, owner) {
+    const cacheDir = owner.resolveVaultCacheDir(cwd).dir;
+    if (mode === 'practices') {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const traceLeaf = require('./vault-trace.cjs');
+        const pin = traceLeaf.resolvePin(cwd, cacheDir);
+        if (pin.state === 'loaded' && typeof pin.ref === 'string' && vaultSeal.ANCHOR_SHA_RE.test(pin.resolvedSha ?? '')) {
+            return { vault: { repo: doorText(pin.repo, { token: true }), ref: doorText(pin.ref, { token: true }), sha: pin.resolvedSha }, degraded: null };
+        }
+        return { vault: null, degraded: doorText(pin.reason ?? 'the vault was not loaded') };
+    }
+    const pin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cacheDir));
+    if (pin !== null && vaultSeal.ANCHOR_SHA_RE.test(pin.sha)) {
+        return { vault: { repo: doorText(pin.repo, { token: true }), ref: doorText(pin.ref, { token: true }), sha: pin.sha }, degraded: null };
+    }
+    const line = vaultStandardsLeaf.standardsDegradedLineFor('not-loaded');
+    return { vault: null, degraded: doorText(`${line.kind}: ${line.reason}`) };
+}
+/**
+ * Where a door artifact may live: a phase directory (root or workstream), a
+ * quick-task directory, or `.planning/audits`. Those are exactly the
+ * directories the seal readers walk (`hasRecordedVaultArtifacts`, 16-07's
+ * covering-record walk), so a record written anywhere else would be a record
+ * no reader ever finds: the door would believe it was recorded and nothing
+ * would see it (D-55).
+ */
+function isDoorArtifactLocation(rel) {
+    const parts = rel.split('/');
+    if (parts[0] !== '.planning')
+        return false;
+    if (parts.length === 4 && (parts[1] === 'phases' || parts[1] === 'quick'))
+        return true;
+    if (parts.length === 6 && parts[1] === 'workstreams' && parts[3] === 'phases')
+        return true;
+    return parts.length === 3 && parts[1] === 'audits';
+}
+/**
+ * `vault door-record --begin --door <name>` (16 review CR-01): record HEAD as
+ * the door's START in `.planning/.vault-door-starts.json` (the seal leaf's
+ * `writeDoorStart`), before the door's agent runs. The record step then reads
+ * it, so the start survives the agent's fresh shell per step and is never
+ * typed. Called after admission (`on`) and the door-name check; takes no other
+ * flag. Every refusal is an error (exit 1), like the record itself: a door that
+ * cannot capture its start halts before its agent writes anything.
+ */
+function doorBegin({ cwd, door, extra, raw, error, c, exec, usage }) {
+    if (extra.length > 0) {
+        error(`--begin takes only --door; ${extra.join(', ')} belong to the record step. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const root = projectRootOf(cwd);
+    const planning = node_path_1.default.join(root, '.planning');
+    try {
+        if (!node_fs_1.default.statSync(planning).isDirectory())
+            throw new Error('not a directory');
+    }
+    catch {
+        error('The project has no .planning/ directory, so the door start has nowhere to be recorded.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const head = exec(['rev-parse', 'HEAD'], { cwd });
+    const sha = head.exitCode === 0 ? head.stdout.trim() : '';
+    if (!vaultSeal.ANCHOR_SHA_RE.test(sha)) {
+        error('HEAD could not be read as a full commit id (no commit yet, or git failed), so no door start was recorded.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    let recorded;
+    try {
+        recorded = vaultSeal.writeDoorStart(planning, door, sha);
+    }
+    catch {
+        error(`.planning/${vaultSeal.VAULT_DOOR_STARTS_FILE} could not be written, so no door start was recorded.`, ERROR_REASON.UNKNOWN);
+        return;
+    }
+    const file = `.planning/${vaultSeal.VAULT_DOOR_STARTS_FILE}`;
+    const result = { ok: true, action: 'begin', door, start: recorded.start, recordedAt: recorded.recordedAt, file };
+    c.output(result, true, raw ? JSON.stringify(result) : `Recorded the ${door} door's start ${recorded.start.slice(0, 12)} in ${file}.`);
+}
+/**
+ * `vault door-record --door <name> --artifact <path> [--phase <N|dir>]`
+ * (16-06, D-12), after `vault door-record --begin --door <name>` (16 review
+ * CR-01): the ONE verb that writes a door's record, a mode-stamped
+ * `## Vault Door Record` section (`formatDoorRecord`, the seal leaf's grammar)
+ * appended to the door's own artifact.
+ *
+ * The record carries the mode, the vault ref and sha (or the degraded
+ * one-liner), the governing phase, the START commit the door captured before
+ * its agent ran, the END commit (HEAD now) and when it was written. The start
+ * is the one the door's `--begin` recorded in `.planning/`, and nothing else
+ * (16 review iteration 3 CR-02, D-103: an explicit `--start` was a side door
+ * that widened a record to any ancestor of HEAD with no note); nothing in the
+ * record is typed by an agent (the
+ * Phase 15 D-06 lesson), and no shell variable has to survive between the
+ * door's steps.
+ *
+ * ORDER: admission first and silent (D-13: no output, no file, unless the
+ * producer admission verdict answers `on` — the one every vault record producer
+ * asks, quick 261015-ect QD-10: the cwd's own verdict except in a linked
+ * worktree with no bindings of its own, where it is the owning checkout's; the
+ * door fences probe the cwd's bindings first and never reach here there), then
+ * the arguments, the door name, the artifact
+ * (containment ladder, `.planning/` only, a seal-walked directory, a door
+ * artifact filename), the start (anchor shape BEFORE it reaches git, then an
+ * ancestor of HEAD, with the revision after the subcommand, T-16-21), the
+ * phase, HEAD, the pin.
+ *
+ * APPEND, NEVER REWRITE: existing content is kept byte for byte and the section
+ * goes after it; an absent artifact is created with a one-line header. An
+ * artifact that already carries a door record is REFUSED rather than given a
+ * second one, because two sections are a duplicate the reader rejects, which
+ * would leave the door with no readable record at all. The composed text is
+ * read back with `parseDoorRecord` before anything is written, so the verb can
+ * never write a record its own reader refuses (an unclosed fence above the
+ * section, say), and the write is a temporary sibling renamed into place.
+ *
+ * Every refusal is an error (exit 1): a door that cannot record halts its
+ * fence instead of passing unrecorded.
+ */
+function doorRecordVerb({ cwd, rest, raw, error, c, exec }) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const owner = require('./vault.cjs');
+    if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
+        return;
+    const usage = 'Usage: vault door-record --begin --door <name> [--raw], then vault door-record --door <name> --artifact <path under .planning/> [--phase <N|dir>] [--raw].';
+    const values = {};
+    let begin = false;
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--begin') {
+            begin = true;
+            continue;
+        }
+        if (DOOR_RECORD_FLAGS.includes(a)) {
+            const v = rest[i + 1];
+            if (v === undefined || v.startsWith('--')) {
+                error(`${a} needs a value. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            if (values[a] !== undefined) {
+                error(`${a} was given more than once. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            values[a] = v;
+            i += 1;
+            continue;
+        }
+        error(`Unrecognized argument "${boundedPath(a)}" for vault door-record. Supported: --begin, ${DOOR_RECORD_FLAGS.map((f) => `${f} <value>`).join(', ')}, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (values['--door'] === undefined) {
+        error(`vault door-record needs --door. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    const door = values['--door'];
+    if (!vaultSeal.DOOR_NAMES.includes(door)) {
+        error(`"${boundedPath(door)}" is not a door that writes a record. Allowed doors: ${vaultSeal.DOOR_NAMES.join(', ')}.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (begin) {
+        doorBegin({ cwd, door, extra: Object.keys(values).filter((k) => k !== '--door'), raw, error, c, exec, usage });
+        return;
+    }
+    if (values['--artifact'] === undefined) {
+        error(`vault door-record needs --artifact. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    const located = resolvePlanningPath(cwd, values['--artifact'], 'artifact');
+    if (!located.ok) {
+        error(`The door artifact ${located.message}; a door record is written only into a door's own artifact under .planning/.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (!isDoorArtifactLocation(located.rel)) {
+        error(`The door artifact "${boundedPath(located.rel)}" is not in a phase directory, a quick-task directory or .planning/audits, ` +
+            'the directories the seal readers walk; a record anywhere else would never be read.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // 16 review IN-02: the readers still recognise a `-VALIDATION.md` door
+    // artifact (a legacy record stays readable), but the verb never WRITES one:
+    // a `*-VALIDATION.md` file makes a phase read as validated (D-79 (3)).
+    const artifactName = node_path_1.default.basename(located.abs);
+    if (!vaultSeal.DOOR_ARTIFACT_FILENAME_RE.test(artifactName) || /(^|-)VALIDATION\.md$/.test(artifactName)) {
+        error(`The door artifact "${boundedPath(artifactName)}" does not end in -REVIEW-FIX.md, -ADD-TESTS.md or -AUDIT-FIX.md, ` +
+            'the door artifact names the verb writes (a -VALIDATION.md file would make the phase read as validated).', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // The start is the one this door's `--begin` recorded in `.planning/`, and
+    // only that (16 review iteration 3 CR-02, D-103: `--start` is gone), so no
+    // shell variable has to survive between the two steps, the agent never types
+    // a sha, and no argument can move the start. It reaches git only after it has
+    // the anchor shape, and only AFTER the subcommand and its flag (T-16-21).
+    const recorded = vaultSeal.readDoorStart(node_path_1.default.join(located.root, '.planning'), door);
+    if (recorded === null) {
+        error(`No start was recorded for the ${door} door, so its range is unknown and the record was not written. `
+            + `Run \`pp-tools vault door-record --begin --door ${door}\` before the door's agent runs; a start recorded now covers only commits made after it.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const start = recorded.start;
+    if (exec(['merge-base', '--is-ancestor', start, 'HEAD'], { cwd }).exitCode !== 0) {
+        error(`The start the ${door} door's --begin recorded (${start}) is not an ancestor of HEAD (or is not in this repository), so it cannot be the commit this door started from. `
+            + `Run \`pp-tools vault door-record --begin --door ${door}\` again, then redo the door's work.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const headRun = exec(['rev-parse', 'HEAD'], { cwd });
+    const end = headRun.exitCode === 0 ? headRun.stdout.trim() : '';
+    if (!vaultSeal.ANCHOR_SHA_RE.test(end)) {
+        error('HEAD could not be read as a full commit id, so the record has no end commit and was not written.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    let phase = null;
+    if (values['--phase'] !== undefined) {
+        const resolved = owner.resolveTracePhaseDir(located.root, cwd, values['--phase']);
+        if (!resolved) {
+            error(`--phase "${boundedPath(values['--phase'])}" is neither a phase directory inside the project nor a phase the locator resolves.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        phase = doorText(resolved.rel, { token: true });
+    }
+    const modeVerdict = owner.vaultModeVerdict(cwd);
+    const mode = modeVerdict.active && modeVerdict.ok === true && (modeVerdict.mode === 'practices' || modeVerdict.mode === 'standards')
+        ? modeVerdict.mode
+        : null;
+    if (mode === null) {
+        error('The vault mode could not be resolved, so the record has no mode and was not written.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const pin = doorVaultPin(cwd, mode, owner);
+    let existing = '';
+    if (node_fs_1.default.existsSync(located.abs)) {
+        const size = node_fs_1.default.statSync(located.abs).size;
+        if (size > vaultSeal.TRACE_ARTIFACT_BYTE_CAP) {
+            error(`The door artifact is ${size} bytes, above the ${vaultSeal.TRACE_ARTIFACT_BYTE_CAP}-byte read cap the seal readers apply; a record there would never be read.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        existing = node_fs_1.default.readFileSync(located.abs, 'utf8');
+        const prior = vaultSeal.parseDoorRecord(existing);
+        if (!prior.ok || prior.record !== null) {
+            error(`The door artifact "${boundedPath(located.rel)}" already carries a ${vaultSeal.DOOR_RECORD_HEADING} section; a second one would make both unreadable. ` +
+                'Write the door\'s artifact afresh for this run, then record it.', ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+    }
+    let section;
+    try {
+        section = vaultSeal.formatDoorRecord({
+            door: door,
+            mode,
+            vault: pin.vault,
+            degraded: pin.degraded,
+            phase,
+            startCommit: start,
+            endCommit: end,
+            recordedAt: new Date().toISOString(),
+        });
+    }
+    catch (e) {
+        error(`The door record could not be composed: ${boundedPath(e instanceof Error ? e.message : String(e))}`, ERROR_REASON.UNKNOWN);
+        return;
+    }
+    const separator = existing === '' ? '' : existing.endsWith('\n\n') ? '' : existing.endsWith('\n') ? '\n' : '\n\n';
+    const next = existing === '' ? `# ${door} door record\n\n${section}` : `${existing}${separator}${section}`;
+    const readBack = vaultSeal.parseDoorRecord(next);
+    if (!readBack.ok || readBack.record === null || readBack.record.startCommit !== start || readBack.record.endCommit !== end) {
+        error(`The door record would not read back from "${boundedPath(located.rel)}" (an unclosed code fence or comment above it, for example), so nothing was written.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // D-100 (16 review iteration 2 WR-01): consume the `--begin` start BEFORE the
+    // record is written, after every refusal above. A start that cannot be
+    // consumed refuses the record; a record whose write then fails leaves the
+    // door with no start, so a retry halts naming `--begin` — both arms leave
+    // commits uncovered (named by SEAL-01), never a range wider than one run.
+    {
+        let consumed = false;
+        try {
+            consumed = vaultSeal.consumeDoorStart(node_path_1.default.join(located.root, '.planning'), door, start);
+        }
+        catch {
+            consumed = false;
+        }
+        if (!consumed) {
+            error(`The ${door} door's start could not be consumed from .planning/${vaultSeal.VAULT_DOOR_STARTS_FILE} (it changed or could not be rewritten), so the record was not written. `
+                + `Run \`pp-tools vault door-record --begin --door ${door}\` again, then redo the door's work; a start recorded now covers only commits made after it.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+    }
+    const tmp = `${located.abs}.${process.pid}.tmp`;
+    try {
+        node_fs_1.default.writeFileSync(tmp, next, 'utf8');
+        node_fs_1.default.renameSync(tmp, located.abs);
+    }
+    catch {
+        try {
+            node_fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* nothing to clean */ }
+        error(`The door artifact "${boundedPath(located.rel)}" could not be written.`, ERROR_REASON.UNKNOWN);
+        return;
+    }
+    const result = { ok: true, door, artifact: located.rel, mode, phase, startCommit: start, endCommit: end };
+    c.output(result, true, raw ? JSON.stringify(result) : `Recorded the ${door} door in ${located.rel} (${start.slice(0, 12)}..${end.slice(0, 12)}).`);
 }
 module.exports = {
     routeVaultCommand,
+    // 13-06: exported so the D-15 sweep test and the D-08 subcommand test read
+    // the vocabulary from the running module instead of restating it.
     VAULT_SUBCOMMANDS,
-    // The scaffold's plan-identifier shape and its one wording, exported so a
-    // trace gate's filename extractor and the planner reference are checked
-    // against the running module rather than a restated copy.
+    // 04-14: exported so the agreement and documentation tests read the SHAPE and
+    // the WORDING from the running module rather than restating either. A test
+    // that restated them would pass while the module drifted.
     SCAFFOLD_PLAN_ID_RE,
     SCAFFOLD_PLAN_ID_FORM,
-    TRACE_STAGES,
+    // 16-05 (D-29): the quick-task half both rejection messages append.
+    SCAFFOLD_QUICK_ID_FORM,
+    // 16-06: the anchor verbs, read by the tests from the running module.
+    ANCHOR_VERBS,
+    // 15-07: exported so the integration test pins it equal to the trace gate's
+    // artifact read cap, which is the agreement its own comment states.
+    STANDARDS_PLAN_READ_BYTES,
 };