@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/vault-practices.cjs

@@ -18,10 +18,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *   no vault cache is present.
  *
  * Responsibility (Phase 24-02 — matcher + global-bucket + formatter half):
- *   `globMatch`/`fallbackGlobToRegex` provide deterministic glob matching
- *   through ONE hand-rolled, polynomial-time matcher on every runtime (the
- *   native `path.posix.matchesGlob` backtracks on many-star segments and is
- *   used only as the tests' oracle). `matchPractices` partitions discovered practices into a
+ *   `globMatch`/`fallbackGlobToRegex` provide deterministic glob matching,
+ *   feature-detecting `path.posix.matchesGlob` (Node >=22.5.0) with a hand-
+ *   rolled, linear-time regex fallback for the 22.0–22.4 gap (engines floor
+ *   is >=22.0.0). `matchPractices` partitions discovered practices into a
  *   glob-matched `matched` bucket and an always-surfaced `global` bucket (a
  *   bounded, fenced excerpt per global practice — the matcher itself makes
  *   ZERO calls to any hosted model or scoring service; relevance of globals
@@ -35,8 +35,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *   - `./vault.cjs` (`usableFiles`, `isSecretFile`, `readManifest`,
  *     `readHeadBounded`) — the existing vault-tier discovery/secret/manifest/
  *     bounded-read helpers.
- *   - no `minimatch`/`picomatch` dependency (RESEARCH STACK.md), and no
- *     native `path.posix.matchesGlob` on the matching path (see `globMatch`).
+ *   - `node:path`'s `path.posix.matchesGlob` (feature-detected) — no
+ *     `minimatch`/`picomatch` dependency (RESEARCH STACK.md).
  *
  * Out of scope here (later plans): the CLI `practices match` router wiring
  * and cross-tier client-beats-shared id dedup (explicitly DEFERRED to
@@ -59,14 +59,16 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const fmMod = require("./frontmatter.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const vaultMod = require("./vault.cjs");
-// FIX-3: the ONE version resolver — the same function and
+// D-17/D-26 (14-04): the fence markers and their defang have ONE owner, the
+// dependency-free vault-index leaf, which src/vault.cts can import without the
+// cycle this module's vault.cjs import would create.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultIndexLeaf = require("./vault-index.cjs");
+// Quick 261003-jby (FIX-3): the ONE version resolver — the same function and
 // candidate ladder `project.createdWith` is written from — so the block's
 // status stamp and the bindings can never name different engine versions.
 // compose-bindings imports nothing from vault-practices, so no cycle.
 const compose_bindings_cjs_1 = require("./compose-bindings.cjs");
-// The one source/non-source predicate (plan graph). A leaf with no imports of
-// its own, so no cycle.
-const plan_graph_cjs_1 = require("./plan-graph.cjs");
 const { extractFrontmatter } = fmMod;
 // ─── Constants ─────────────────────────────────────────────────────────────────
 // DoS-guard cap (T-24-04) mirroring vault.cts's SUMMARY_FILE_CAP discipline —
@@ -82,7 +84,7 @@ const PRACTICES_SUBDIR = 'practices/';
 // retained + warned, never dropped).
 //
 // `check` joined the set in 05-01 and `enforced-by` in 10-03 (MECH-03,
-// D-10-04). Both are step 1 of the degrade-loudly rule's fixed rollout order (engine
+// D-10-04). Both are step 1 of ADR-71924 §5's fixed rollout order (engine
 // release → verified rollout → vault-repo merge): the engine admits the key
 // first, the rollout is verified, and only then does the vault repo merge
 // practices that use it. Neither addition bumped PRACTICE_SCHEMA_VERSION
@@ -114,7 +116,7 @@ const GLOB_PATTERN_MAX = 200;
 // Bounded markdown-body excerpt size for scope:global practices (D-15) —
 // mirrors vault.cts's SUMMARY_READ_BYTES bounded-read discipline.
 const PRACTICE_EXCERPT_BYTES = 1024;
-// Over-read factor for the excerpt's bounded read (FIX-1).
+// Over-read factor for the excerpt's bounded read (quick 261003-jby, FIX-1).
 // The excerpt is normalised to LF before it is capped, and every carriage
 // return that normalisation removes consumed a raw byte as half of a CRLF pair.
 // Reading `PRACTICE_EXCERPT_BYTES * 2` body bytes therefore guarantees the cap
@@ -124,12 +126,17 @@ const EXCERPT_CRLF_OVERREAD_FACTOR = 2;
 // Matched-file list cap per practice (T-24-04) — matchedCount still carries
 // the true total so callers know the cap was hit.
 const MATCHED_FILES_CAP = 20;
-// The unmatched-source-file note's candidate set (FIX-2, QD-2) is the plan
-// graph's own source predicate (`isSourceFile`, src/plan-graph.cts) — the one
-// owner of "is this a source file" — not a second list of extensions. When a
-// source file matched no scoped practice the block says so in one plain line,
+// The unmatched-source-file note's candidate set (quick 261003-jby, FIX-2,
+// QD-2): a file passed to the matcher whose basename ends with one of these
+// extensions (case-insensitive), or starts with the Dockerfile prefix (exact),
+// is one a scoped practice is EXPECTED to govern in the client's stacks. When
+// such a file matched no scoped practice the block says so in one plain line,
 // because a vault laid out for a different folder structure otherwise drops its
-// scoped practices with no word at all.
+// scoped practices with no word at all (probe test 6: 20 scoped practices, 5 of
+// them critical, silently matched nothing). Frozen constants so widening the
+// set is a one-line edit, not a decision buried in a predicate.
+const UNMATCHED_NOTE_SOURCE_EXTENSIONS = Object.freeze(['.cs', '.sql', '.ts', '.vue', '.kt']);
+const UNMATCHED_NOTE_BASENAME_PREFIX = 'Dockerfile';
 // Bounded prefix read for practice files during DISCOVERY (CR-03) — frontmatter
 // + bodyOffset comfortably fit well inside this; the whole file is NEVER read.
 // Mirrors vault.cts's SUMMARY_READ_BYTES bounded-read discipline.
@@ -154,9 +161,6 @@ const WARNING_TOKEN_MAX = 80;
 //   pre-22.5 fallback matcher       0.098 ms / pair  (same corpus, feature
 //                                   detect deleted before require)
 //
-// (The fallback matcher is now the only shipped engine — see `globMatch`.
-// The native figure is kept as the measurement the caps below were sized on.)
-//
 // 05-RESEARCH § OQ1 measured 1.47 ms/pair native over three points that were
 // linear in pair count, so `cost ≈ pairs × rate` is a measured model rather
 // than a hoped-for one. Its 5.0 ms/pair fallback figure did NOT reproduce on
@@ -181,8 +185,8 @@ const WARNING_TOKEN_MAX = 80;
 // makes the verdict machine-dependent, which is exactly the non-determinism
 // VERIFY-03 bars from a deterministic gate).
 //
-// Sized above the legitimate ceiling and well below the hostile one: a
-// measured production vault's 92 globs against the 2000-file ship diff cap is 184,000
+// Sized above the legitimate ceiling and well below the hostile one: the real
+// client vault's 92 globs against the 2000-file ship diff cap is 184,000
 // pairs, so this leaves ~5× headroom over any honest corpus while sitting
 // ~7.8× below the 7,800,000-pair hostile saturation bound.
 //
@@ -239,13 +243,13 @@ const PRACTICES_VAULT_UNREADABLE_SENTENCE = 'Practices were NOT checked — the
  */
 const PRACTICES_VAULT_ABSENT_SENTENCE = 'Practices were NOT checked — no client vault has been fetched. Run the vault fetch first.';
 /**
- * The FOURTH member of the family (FIX-4, QD-5).
+ * The FOURTH member of the family (quick 261003-jby, FIX-4, QD-5).
  *
  * A fetch that failed every tier with no prior copy leaves a manifest recording
  * a miss: no tier, no sha, no files. The vault directory is present, nothing
  * failed to READ, and discovery yields zero practices — so the ladder fell
  * through to "none found in the vault", telling a code-writing agent its client
- * documented no standards about a fetch that reached nothing.
+ * documented no standards about a fetch that reached nothing (probe test 2).
  *
  * The documented "could not be checked: <reason>." form, with the reason
  * phrase copied from the practice trace's own miss reason (`resolvePin` in
@@ -253,7 +257,18 @@ const PRACTICES_VAULT_ABSENT_SENTENCE = 'Practices were NOT checked — no clien
  */
 const PRACTICES_VAULT_MISS_SENTENCE = 'Practices could not be checked: the vault manifest records a miss — no vault content was reached.';
 /**
- * The status stamp's fixed opening (FIX-3, QD-4).
+ * The FIFTH member of the family (quick 261015-at3, Vince 2026-10-15).
+ *
+ * The vault was fetched and read, and it is a standards vault: `INDEX.md` at
+ * its root and no practice files. The project reads it in practices mode, so
+ * discovery yields zero practices and the ladder fell through to "none found in
+ * the vault" — telling a code-writing agent the client documented no practices,
+ * about a vault whose standards the project is not reading at all. Names the
+ * one repair: the mode, and the engine version that has it.
+ */
+const PRACTICES_VAULT_STANDARDS_ONLY_SENTENCE = 'Practices were NOT checked — this vault holds standards (INDEX.md) and no practice files, but the project reads it in practices mode. Set "vault": {"mode": "standards"} in .planning/config.json (pp-core 1.16.0 or later) and re-plan.';
+/**
+ * The status stamp's fixed opening (quick 261003-jby, FIX-3, QD-4).
  *
  * Every rendered `<vault_practices>` block carries ONE HTML comment as its
  * first inner line, written by this module, naming the vault ref, short sha,
@@ -273,6 +288,9 @@ const PRACTICES_STAMP_STATES = Object.freeze({
     VAULT_UNREADABLE: 'vault-unreadable',
     VAULT_ABSENT: 'vault-absent',
     VAULT_MISS: 'vault-miss',
+    // Quick 261015-at3: a standards vault (INDEX.md, no practice files) read in
+    // practices mode.
+    STANDARDS_ONLY: 'standards-only',
     ALL_REFUSED: 'all-refused',
     NONE_FOUND: 'none-found',
     NONE_APPLY: 'none-apply',
@@ -358,6 +376,12 @@ function boundedToken(v) {
     const s = safeStringify(v).replace(/[\r\n]+/g, ' ');
     return s.length > WARNING_TOKEN_MAX ? `${s.slice(0, WARNING_TOKEN_MAX)}…` : s;
 }
+// ─── Glob matching (PRAC-02) ───────────────────────────────────────────────────
+// Feature-detect once at module scope: `path.posix.matchesGlob` landed in
+// Node 22.5.0 and stabilized in 22.20.0 (RESEARCH STACK.md), but this repo's
+// engines floor is >=22.0.0 — the 22.0–22.4 gap must fall back to the
+// hand-rolled matcher below rather than throwing `TypeError: not a function`.
+const hasMatchesGlob = typeof node_path_1.default.posix?.matchesGlob === 'function';
 const NEVER_MATCHES = { test: () => false };
 // Bounds the total number of concrete patterns a `{a,b,c}` expansion can
 // produce (T-24-04) — client-authored globs never legitimately need more.
@@ -498,7 +522,7 @@ function globSegmentsMatch(patternSegs, subjectSegs) {
  *
  * ON THE NAME (05-04). Despite it, this function constructs NO `RegExp` — it
  * returns an object literal whose `test` runs the two-pointer matcher above.
- * the declarative-data rule says the same thing ("despite its name") and the confusion has
+ * ADR-71924 §3 says the same thing ("despite its name") and the confusion has
  * now cost more than one verification pass, so it is stated here at the
  * definition rather than only in the ADR. A rename to `compileGlobMatcher`
  * was considered and REJECTED: the rename guard's 2331-file baseline is not
@@ -521,18 +545,23 @@ function fallbackGlobToRegex(pattern) {
 }
 /**
  * True when `filePath` matches `pattern`. Normalizes `\` → `/` (Windows path
- * input) before matching, then runs the polynomial-time `fallbackGlobToRegex`
- * matcher on every runtime (see the note above `CompiledGlob` for why the
- * native engine is not used). Deterministic: identical inputs always yield the
- * identical boolean (PRAC-02).
+ * input) before matching. Uses `path.posix.matchesGlob` when the runtime
+ * supports it (feature-detected once at module scope), else the linear/
+ * polynomial-time `fallbackGlobToRegex` matcher. Deterministic: identical
+ * inputs always yield the identical boolean (PRAC-02).
  */
 function globMatch(filePath, pattern) {
-    // Length guard (T-24-04): GLOB_PATTERN_MAX holds here as well as inside the
-    // compiler, so an over-long pattern never matches on any path.
+    // Pre-dispatch length guard (T-24-04, gap #1 verifier ask b): apply
+    // GLOB_PATTERN_MAX BEFORE choosing an engine so the cap holds for the
+    // native `path.posix.matchesGlob` path too, not only the fallback
+    // compiler's internal check.
     if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > GLOB_PATTERN_MAX) {
         return false;
     }
     const normalized = filePath.replace(/\\/g, '/');
+    if (hasMatchesGlob) {
+        return node_path_1.default.posix.matchesGlob(normalized, pattern);
+    }
     return fallbackGlobToRegex(pattern).test(normalized);
 }
 // Unsupported glob metacharacters (gap #1 closure option a, D-14/D-07):
@@ -642,13 +671,13 @@ function normalizeCheckBoolean(v) {
 }
 /**
  * Parse and validate a practice's `check:` block. THE ONLY parser for this
- * shape (the one-parser rule): 05-05's evaluator receives a validated record and
+ * shape (ADR-71924 §2): 05-05's evaluator receives a validated record and
  * validates nothing itself, so a rule that is not enforced here is not
  * enforced anywhere.
  *
  * A violation never skips the practice. The block is dropped whole — never
  * half-built — and one bounded, single-line `checkInvalid` records the defect,
- * because the practice's prose still applies (the degrade-loudly rule). 05-05 maps
+ * because the practice's prose still applies (ADR §5). 05-05 maps
  * `checkInvalid` to a fail-closed FAIL so a broken block can never read as a
  * pass, nor be mistaken for "this practice was never checkable".
  *
@@ -657,7 +686,7 @@ function normalizeCheckBoolean(v) {
  * the evaluator and the reader drifting apart. The literal half is bounded by
  * CHECK_TOKEN_COUNT_CAP and CHECK_TOKEN_MAX, and is compared only by plain
  * substring containment: no client-authored byte reaches a RegExp constructor
- * or any other pattern compiler (the declarative-data rule, T-5-05).
+ * or any other pattern compiler (ADR §3, T-5-05).
  */
 function parseCheckBlock(id, rawCheck) {
     const invalid = (defect) => ({
@@ -827,7 +856,7 @@ function parsePracticeFile(filePath, raw) {
         // Unknown-key DEGRADE (IN-05, inverted by CHECK-02 in 05-01).
         //
         // This branch used to `return { ok: false }`, dropping the whole practice.
-        // the degrade-loudly rule requires the opposite: an engine that meets a key it does
+        // ADR-71924 §5 requires the opposite: an engine that meets a key it does
         // not recognize must degrade LOUDLY — retain the practice, apply its prose
         // through the normal path, and warn naming the key. Dropping it meant the
         // practice silently governed nothing, which is the "governance check that
@@ -939,7 +968,7 @@ function parsePracticeFile(filePath, raw) {
             // Note the asymmetry with the `< 1` / non-integer arm just above, which
             // stays a HARD skip: a malformed value is not a forward-compat signal,
             // it is a broken file. Only a well-formed version this engine is too old
-            // to understand degrades — that is the case the degrade-loudly rule's rollout order
+            // to understand degrades — that is the case ADR-71924 §5's rollout order
             // exists to make legible rather than silent.
             if (parsed > PRACTICE_SCHEMA_VERSION) {
                 degradedWarnings.push(`${safePath} degraded: schemaVersion ${parsed} is newer than this pp-core supports ` +
@@ -951,7 +980,7 @@ function parsePracticeFile(filePath, raw) {
         const fmMatch = raw.match(/^---\r?\n[\s\S]+?\r?\n---/);
         const bodyOffset = fmMatch ? fmMatch[0].length : 0;
         // The check: block is validated HERE, alongside every other parse-time
-        // rule, so there is exactly one parser for it (the one-parser rule). An invalid
+        // rule, so there is exactly one parser for it (ADR-71924 §2). An invalid
         // block never skips the practice — see `parseCheckBlock`.
         const checkOutcome = fm.check === undefined ? null : parseCheckBlock(id, fm.check);
         // `enforced-by:` is read HERE, in the position parseCheckBlock occupies —
@@ -1062,7 +1091,8 @@ function probePracticesDir(practicesDirPath) {
  *
  * @param cwd Project root (parent of `.planning/`).
  * @param vaultDir Optional cache directory to read instead of
- *   `<cwd>/.planning/vault` (worktree executors). Defaults to the cwd
+ *   `<cwd>/.planning/vault` (260915-ms2, UAT-6-F3 — the trace writer passes the
+ *   owning main checkout's cache from a linked worktree). Defaults to the cwd
  *   join, so the absent-versus-unreadable distinction below is unchanged for
  *   every caller that does not pass it.
  */
@@ -1078,7 +1108,7 @@ function discoverPracticeFiles(cwd, vaultDir) {
             // grounds stay separable for whoever has to repair it.
             return {
                 practices: [], skipped: [], degraded: [], tier: null, notes: [], vaultPresent: false, readFailed: false,
-                vaultRef: null, vaultSha: null, vaultMiss: false,
+                vaultRef: null, vaultSha: null, vaultMiss: false, vaultStandardsOnly: false,
             };
         }
         const probe = probePracticesDir(node_path_1.default.join(vaultDirPath, PRACTICES_SUBDIR.slice(0, -1)));
@@ -1095,12 +1125,24 @@ function discoverPracticeFiles(cwd, vaultDir) {
         }
         const manifest = vaultMod.readManifest(vaultDirPath);
         const tier = manifest && manifest.tier ? manifest.tier : null;
-        // FIX-3/FIX-4: the coordinates the status stamp carries,
+        // Quick 261003-jby (FIX-3/FIX-4): the coordinates the status stamp carries,
         // and the recorded-miss fact the sentence ladder states. Typed facts on the
         // result, never sniffed out of notes prose.
         const vaultRef = manifest && typeof manifest.ref === 'string' ? manifest.ref : null;
         const vaultSha = manifest && typeof manifest.resolvedSha === 'string' ? manifest.resolvedSha : null;
         const vaultMiss = vaultMod.manifestRecordsMiss(manifest);
+        // Quick 261015-at3 (Vince 2026-10-15): a standards vault read in practices
+        // mode. Two facts from the ONE `allFiles` listing the practice filter read
+        // above (exact-case INDEX match, the standards reader's own contract) plus
+        // one mode read. The mode is part of the owner on purpose: the audit's and
+        // the trace's readers have no standards-mode short-circuit of their own, so
+        // a caller that forgot one still cannot trip this flag in standards mode.
+        const modeVerdict = vaultMod.vaultModeVerdict(cwd);
+        const vaultStandardsOnly = modeVerdict.active === true
+            && modeVerdict.ok === true
+            && modeVerdict.mode === 'practices'
+            && allFiles.includes(vaultIndexLeaf.VAULT_INDEX_FILENAME)
+            && practiceFiles.length === 0;
         const practices = [];
         const skipped = [];
         const degraded = [];
@@ -1142,7 +1184,7 @@ function discoverPracticeFiles(cwd, vaultDir) {
         }
         return {
             practices, skipped, degraded, tier, notes, vaultPresent: true, readFailed: probe.failed,
-            vaultRef, vaultSha, vaultMiss,
+            vaultRef, vaultSha, vaultMiss, vaultStandardsOnly,
         };
     }
     catch (e) {
@@ -1168,16 +1210,16 @@ function discoverPracticeFiles(cwd, vaultDir) {
             vaultRef: null,
             vaultSha: null,
             vaultMiss: false,
+            vaultStandardsOnly: false,
         };
     }
 }
 // ─── Matching + report (PRAC-02 / PRAC-03 / COMM-01) ───────────────────────────
-// External-content fence (D-15 / T-24-05). Pack 6 D-08: the fence has ONE
-// owner, src/vault.cts — the marker strings and `defangFenceMarkers` are
-// imported from it rather than copied, so every path that hands vault text to
-// an agent defangs every marker spelling (case, whitespace, HTML entities,
-// compatibility forms, zero-width characters), not only the literal marker.
-const { EXTERNAL_CONTENT_FENCE_START, EXTERNAL_CONTENT_FENCE_END, defangFenceMarkers } = vaultMod;
+// External-content fence markers and `defangFenceMarkers` (D-15 / CR-01 /
+// T-24-05): the owner moved to the vault-index leaf (D-17/D-26, 14-04), and
+// these bindings re-export it by reference so every consumer of this module
+// measures the leaf's one function rather than a copy.
+const { EXTERNAL_CONTENT_FENCE_START, EXTERNAL_CONTENT_FENCE_END, defangFenceMarkers } = vaultIndexLeaf;
 /**
  * Read a BOUNDED prefix of a practice file's markdown BODY (frontmatter
  * stripped) and wrap it in the `vault:external-content` fence + untrusted-
@@ -1189,16 +1231,16 @@ const { EXTERNAL_CONTENT_FENCE_START, EXTERNAL_CONTENT_FENCE_END, defangFenceMar
  * neutralized via `defangFenceMarkers` BEFORE being placed between the real
  * markers (CR-01), so an untrusted body can never spoof an early fence closer.
  *
- * LINE ENDINGS (FIX-1). The body is sliced at `bodyOffset`
+ * LINE ENDINGS (quick 261003-jby, FIX-1). The body is sliced at `bodyOffset`
  * FIRST — it is an index into the raw text, computed by `parsePracticeFile` on
  * the same bytes — and THEN normalised by deleting every carriage return, which
  * turns each CRLF pair into LF and drops any lone carriage return (a control
  * character that must not reach an agent context). Only then is it trimmed and capped, so the
  * `PRACTICE_EXCERPT_BYTES` cap is measured on normalised text and a CRLF
  * checkout renders the same excerpt as its LF twin. Before this, the cap was
- * applied to raw text: a `core.autocrlf=true` checkout was measured losing
- * 3–18 chars from 8 of 55 practices, with 610 carriage returns reaching the
- * executor-facing block.
+ * applied to raw text: probe test 4 measured 8 of 55 practices losing 3–18
+ * chars on a `core.autocrlf=true` checkout, and 610 carriage returns reaching
+ * the executor-facing block.
  *
  * @param filePath Absolute path to the practice `.md` file on disk.
  * @param bodyOffset Byte index where the markdown body begins (from the
@@ -1225,16 +1267,19 @@ function boundedFencedExcerpt(filePath, bodyOffset) {
 }
 /**
  * Is this file one the unmatched-source-file note reports when no scoped
- * practice matched it? (FIX-2, QD-2.)
+ * practice matched it? (quick 261003-jby, FIX-2, QD-2.)
  *
- * Exactly the plan graph's source predicate: tests, docs, baselines,
- * changesets and `.planning/` files are never reported, and everything else
- * is. Windows separators are normalised first.
+ * POSIX basename (Windows separators are normalised first); the extension
+ * compare is case-insensitive, the `Dockerfile` prefix compare is exact.
  *
  * @param filePath A project-relative file path, either separator.
  */
 function isUnmatchedNoteCandidate(filePath) {
-    return (0, plan_graph_cjs_1.isSourceFile)(String(filePath).replace(/\\/g, '/'));
+    const base = node_path_1.default.posix.basename(String(filePath).replace(/\\/g, '/'));
+    if (base.startsWith(UNMATCHED_NOTE_BASENAME_PREFIX))
+        return true;
+    const lower = base.toLowerCase();
+    return UNMATCHED_NOTE_SOURCE_EXTENSIONS.some((ext) => lower.endsWith(ext));
 }
 /**
  * Match discovered practices against a candidate file list, partitioning
@@ -1306,6 +1351,8 @@ function matchPractices(opts) {
             vaultRef: discovery.vaultRef,
             vaultSha: discovery.vaultSha,
             vaultMiss: discovery.vaultMiss,
+            // Quick 261015-at3: threaded on BOTH return sites (05-13 rule).
+            vaultStandardsOnly: discovery.vaultStandardsOnly === true,
             pairBudget: {
                 pairs,
                 cap: MATCH_PAIR_CAP,
@@ -1412,10 +1459,12 @@ function matchPractices(opts) {
         vaultAbsent: discovery.vaultPresent === false,
         unmatchedSourceFiles,
         // The manifest coordinates and recorded-miss fact, carried verbatim from
-        // discovery (FIX-3/FIX-4).
+        // discovery (quick 261003-jby, FIX-3/FIX-4).
         vaultRef: discovery.vaultRef,
         vaultSha: discovery.vaultSha,
         vaultMiss: discovery.vaultMiss,
+        // Quick 261015-at3: the standards-vault-in-practices-mode fact, verbatim.
+        vaultStandardsOnly: discovery.vaultStandardsOnly === true,
         pairBudget: {
             pairs,
             cap: MATCH_PAIR_CAP,
@@ -1490,7 +1539,7 @@ function renderSkippedLines(skipped) {
 }
 /**
  * The one-line note naming candidate files that matched no scoped practice
- * (FIX-2). `null` when there are none.
+ * (quick 261003-jby, FIX-2). `null` when there are none.
  *
  * The paths are project-authored — the plan's `files_modified` or the
  * operator's argv, the same trust class `matched_files` already renders — so
@@ -1629,8 +1678,8 @@ function unwrapFencedExcerpt(fenced) {
  * `id` and `source` just as much as the excerpt prose — and this block is read
  * by a code-WRITING executor in Phase 26. So every field passes through
  * `boundedToken` (length bound, control-character strip) AND
- * `defangFenceMarkers` (so a planted `<!-- vault:external-content-end -->`
- * cannot terminate the fence early and smuggle text out of the data region)
+ * `defangFenceMarkers` (so a planted end-of-fence marker, spelled only in the
+ * vault-index leaf, cannot terminate the fence early and smuggle text out of the data region)
  * before it is placed between the markers. Nothing vault-authored is emitted
  * outside a fence anywhere in this block.
  */
@@ -1671,7 +1720,8 @@ function stampSha(sha) {
     return hex.length >= 8 ? hex.slice(0, 8) : '(none)';
 }
 /**
- * Render the block's status stamp — ONE line, an HTML comment (FIX-3, QD-4).
+ * Render the block's status stamp — ONE line, an HTML comment (quick
+ * 261003-jby, FIX-3, QD-4).
  *
  * `ref=` and `sha=` name the vault read, `entries=<n>` counts the fenced
  * practice entries rendered OR `state=<token>` names the degraded state —
@@ -1696,7 +1746,7 @@ function renderPracticesStamp(parts) {
 }
 /**
  * Choose the sentence an entry-less block states AND its stamp token, in ONE
- * place so the two cannot drift (FIX-3/FIX-4).
+ * place so the two cannot drift (quick 261003-jby, FIX-3/FIX-4).
  *
  * ORDER IS LOAD-BEARING and pinned rung by rung. The pair-cap refusal stays
  * FIRST: it is a statement about work this engine declined to do. Read
@@ -1705,6 +1755,12 @@ function renderPracticesStamp(parts) {
  * none-found rungs, which are facts about a vault that WAS read. The miss rung
  * (FIX-4) sits after absence (an absent directory has no manifest to record a
  * miss in, so absence is the more basic fact) and before all-refused.
+ *
+ * The standards-only rung (quick 261015-at3) sits after the miss — a miss
+ * reached no vault that could hold an index, so it is the more basic fact —
+ * and ABOVE all-refused and none-found. It is a statement about a vault that
+ * WAS read, which is why it is below the unread family; and "none found" is
+ * false of a vault whose practice layer the project is not even reading.
  */
 function selectEmptyBlockSentence(result, skippedCount) {
     if (result?.pairBudget?.exceeded === true) {
@@ -1720,11 +1776,16 @@ function selectEmptyBlockSentence(result, skippedCount) {
     if (result?.vaultAbsent === true) {
         return { sentence: PRACTICES_VAULT_ABSENT_SENTENCE, state: PRACTICES_STAMP_STATES.VAULT_ABSENT };
     }
-    // FIX-4: a manifest that records a miss — the fetch ran
+    // Quick 261003-jby (FIX-4): a manifest that records a miss — the fetch ran
     // and reached nothing.
     if (result?.vaultMiss === true) {
         return { sentence: PRACTICES_VAULT_MISS_SENTENCE, state: PRACTICES_STAMP_STATES.VAULT_MISS };
     }
+    // Quick 261015-at3: a standards vault (INDEX.md, no practice files) read in
+    // practices mode — NOT checked, never none-found.
+    if (result?.vaultStandardsOnly === true) {
+        return { sentence: PRACTICES_VAULT_STANDARDS_ONLY_SENTENCE, state: PRACTICES_STAMP_STATES.STANDARDS_ONLY };
+    }
     if (result && result.practicesProcessed === 0 && skippedCount > 0) {
         // 05-REVIEW WR-02, the fifth rung. `practicesProcessed === 0` is true of a
         // THIRD kind of vault as well: one that holds practice files and had every
@@ -1759,7 +1820,7 @@ function selectEmptyBlockSentence(result, skippedCount) {
 function renderPracticesBlock(result, reason) {
     const open = '<vault_practices>';
     const close = '</vault_practices>';
-    // FIX-3: the status stamp is the first line inside the
+    // FIX-3 (quick 261003-jby): the status stamp is the first line inside the
     // block on all three return paths, then the blank line, then the preamble.
     const engine = (0, compose_bindings_cjs_1.resolveCreatedWithFrom)(__dirname);
     const headWith = (stamp) => [
@@ -1850,7 +1911,7 @@ function renderPracticesBlock(result, reason) {
             '',
         ]
         : [];
-    // FIX-2: candidate files no scoped practice matched. The
+    // FIX-2 (quick 261003-jby): candidate files no scoped practice matched. The
     // matcher owns the gating (QD-3); the renderer renders whenever the array is
     // non-empty. Engine-composed text around project-authored, bounded and
     // defanged paths — nothing vault-authored — so it sits outside a fence.
@@ -1876,7 +1937,7 @@ function renderPracticesBlock(result, reason) {
         //
         // The rungs themselves — and their order — live in
         // `selectEmptyBlockSentence`, which picks the sentence and the stamp token
-        // together so the two cannot drift.
+        // together (quick 261003-jby) so the two cannot drift.
         const { sentence, state } = selectEmptyBlockSentence(result, skipped.length);
         const head = headWith({ state });
         return [...head, ...notesSection, ...degradedSection, ...refusedSection, ...noteSection, sentence, '', close].join('\n');
@@ -1911,7 +1972,7 @@ module.exports = {
     // class comes back: a second renderer is a second place a client-authored byte
     // can reach an agent context unfenced. Purely additive; no call site changed.
     renderPracticeEntry,
-    // D-05-07: exported so the trace scaffold digests the SAME
+    // 261003-j89 (D-05-07 closed): exported so the trace scaffold digests the SAME
     // text `renderPracticeEntry` places under `ask:`/`excerpt:` — one unwrap, two
     // readers. A second unwrap in src/vault-trace.cts would be a second place the
     // fence-stripping rule could drift, and the digest would then disagree with
@@ -1973,17 +2034,23 @@ module.exports = {
     // exact hazard (see its doc comment) — never a raw Node error message, which
     // interpolates the absolute path CLAUDE.md § Logging forbids surfacing.
     errnoOf,
-    // FIX-1: the excerpt's CRLF over-read factor, exported so
+    // Quick 261003-jby (FIX-1): the excerpt's CRLF over-read factor, exported so
     // the bounded-read test and the contract page HARVEST it.
     EXCERPT_CRLF_OVERREAD_FACTOR,
-    // FIX-2: the unmatched-source-file note's predicate and one-line composer —
-    // exported so tests and both rendered channels compose the line in one place.
+    // Quick 261003-jby (FIX-2): the unmatched-source-file note's candidate set,
+    // predicate and one-line composer — exported so tests and the contract page
+    // harvest them and both rendered channels compose the line in one place.
+    UNMATCHED_NOTE_SOURCE_EXTENSIONS,
+    UNMATCHED_NOTE_BASENAME_PREFIX,
     isUnmatchedNoteCandidate,
     renderUnmatchedSourceNote,
-    // FIX-3/FIX-4: the status stamp's prefix, state vocabulary
+    // Quick 261003-jby (FIX-3/FIX-4): the status stamp's prefix, state vocabulary
     // and renderer, and the recorded-miss sentence — exported so tests and the
     // contract page harvest them rather than copy them.
     PRACTICES_VAULT_MISS_SENTENCE,
+    // Quick 261015-at3: the standards-vault-in-practices-mode sentence, exported
+    // on the same harvest rule.
+    PRACTICES_VAULT_STANDARDS_ONLY_SENTENCE,
     PRACTICES_STAMP_PREFIX,
     PRACTICES_STAMP_STATES,
     renderPracticesStamp,