@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/vault-review.cjs

@@ -3,115 +3,162 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 /**
- * src/vault-review.cts — the DETERMINISTIC half of the agent practice review
- * (`/pp-vault-review`, vault assurance R5).
+ * src/vault-review.cts — the DETERMINISTIC half of Phase 6's agent tier
+ * (Vault Assurance #71924, phase 06 plan 03; VERIFY-01, D-06-09 … D-06-15).
  *
  * ## What this module is
  *
- * The agent review judges vault practices no `check:` block can settle. A
- * judgement is not reproducible, so everything the agent must NOT invent lives
- * here instead: the input set, both derived-N-A populations, the counts, the
- * rate line, the git range the review was computed over, the artifact the agent
- * fills in, and the lines that artifact must state. Every one of them is an
- * exported, unit-tested function, so the agent's discretionary surface shrinks
- * to the genuinely ambiguous remainder and nothing else.
+ * The agent tier judges vault practices no regex can settle. A judgement is not
+ * reproducible, so everything the agent must NOT invent lives here instead: the
+ * input set, both derived-N-A populations, the counts, the rate line, and the
+ * git range the review was computed over. Every one of them is an exported,
+ * unit-tested pure function, so the agent's discretionary surface shrinks to
+ * the genuinely ambiguous remainder and nothing else.
  *
  * Purely a LEAF. It imports leaves (`./vault-audit.cjs`, `./vault-practices.cjs`,
- * `./vault-trace.cjs`, `./practices-review-check.cjs`, `./git-base-branch.cjs`,
- * `./shell-command-projection.cjs`) and no adapter. The two functions that touch
- * the world — the oracle run and the range resolver — take INJECTED seams
- * (`_audit`, `exec`), so a test drives them without a repo. The I/O composition
- * (reading the trace, the vault cache and the verdict owner) is the CLI arm's,
- * in `src/check-command-router.cts`.
- *
- * The sibling modules are imported at the top rather than required at call
- * time: under `recommendedTypeChecked` a bare `require()` returns `any`, while
+ * `./git-base-branch.cjs`, `./shell-command-projection.cjs`) and no adapter, and
+ * every derivation function is pure text/set/list in, structure out. The two
+ * functions that touch the world — the oracle run and the range resolver — take
+ * INJECTED seams (`_audit`, `exec`) in the `_check`/`_core` idiom
+ * `cmdCheckPracticesReview` established, so a test drives them without a repo.
+ *
+ * A note on that idiom: the shipped one defers `require` to call time. Here the
+ * sibling modules are imported at the top instead and the seam is the injection
+ * parameter alone. Reason: this file is linted with
+ * `tseslint.configs.recommendedTypeChecked`, under which a bare `require()`
+ * returns `any` and every use of the result is a `no-unsafe-*` error, whereas
  * `import x = require('./y.cjs')` resolves to the sibling's `.cts` source and is
- * fully typed. None of them performs I/O at load.
+ * fully typed. Neither sibling performs I/O at load, so nothing is paid for the
+ * eager import, and the property the idiom exists for — a test can substitute
+ * the module — is preserved exactly.
  *
- * ## The verdict vocabulary is LOCKED
+ * ## The verdict vocabulary is LOCKED (D-06-10)
  *
- * `REVIEW_VERDICT` holds exactly PASS / FAIL / N-A / INCONCLUSIVE. It is a module
- * constant and is never re-derived from configuration or from the vault — the
- * rule `src/vault-trace.cts` and `src/vault-audit.cts` state for the same
- * reason: a verdict vocabulary a client repository could move is not one.
+ * `REVIEW_VERDICT` holds exactly PASS / FAIL / N-A / INCONCLUSIVE, with `N-A`
+ * spelled with the hyphen D-06-10's own text uses. It is a module constant and
+ * is never re-derived from configuration or from the vault — the same rule
+ * `src/vault-trace.cts` and `src/vault-audit.cts` state, for the same reason: a
+ * verdict vocabulary a client repository could move is not a verdict vocabulary.
  *
- * It shares no token with the mechanical audit's `AUDIT_VERDICT`. `NO_CHECK` and
+ * It shares no token with the mechanical tier's `AUDIT_VERDICT`. `NO_CHECK` and
  * `NOT_MATCHED` are facts about a machine-checkable rule; `N-A` and
- * `INCONCLUSIVE` are facts about a judgement.
- *
- * A DELIBERATE DIVERGENCE from code review's practices findings ("likely
- * violates, never certainty", capped at Warning): this review asserts a FLAT
- * `FAIL`. It can, because it gates nothing — a FAIL here moves no score and
- * blocks no ship. Uncertainty has its own honest home, `INCONCLUSIVE`.
- *
- * ## Arm A widens the judged boundary, and says so in every row
- *
- * `deriveNaAUniverse` (Arm A) reports on practices that were NEVER traced — the
- * vault practice universe recorded at the pinned ref minus the ledger. That is
- * wider than "traced practices with no usable `check:` block", and every Arm A
- * row's reason names the universe as its source, so a reader meets the widening
- * at the row that caused it. It is needed because `buildTraceStatement` fills
- * the ledger from `matchPractices(...).matched ++ .global` only: every ledger
- * entry already matched, so "never matched" can only come from the universe.
- * Arm B re-derives applicability at review time from the phase's real diff.
- *
- * ## `check:`-presence is read LIVE, with an advisory — no trace-schema change
+ * `INCONCLUSIVE` are facts about a judgement, and a shared token would invite
+ * one to be read as the other.
+ *
+ * RECORDED DIVERGENCE from `agents/pp-code-reviewer.md`, which deliberately says
+ * "likely violates, never certainty": this tier asserts a FLAT `FAIL`. It can,
+ * because it gates nothing (D-06-03, VERIFY-03) — a FAIL here moves no score and
+ * blocks no ship, so hedging the word buys no safety and costs the reader the
+ * one signal the artifact exists to carry. Uncertainty has its own honest home:
+ * `INCONCLUSIVE`, which D-06-10 split out precisely so "I could not determine
+ * this" never hides inside "not applicable here". The agent-side rationale is
+ * plan 06-06's; the vocabulary decision is recorded here, where the constant is.
+ *
+ * ## STATED DEVIATION — Arm A widens the judged boundary
+ *
+ * `06-CONTEXT.md`'s `<domain>` fixes this phase's input set to *traced practices
+ * that carry no usable `check:` block*. `deriveNaAUniverse` (Arm A, plan 06-03
+ * task 2) reports on practices that were NEVER traced — the whole vault practice
+ * universe recorded at the pinned ref. That is WIDER than the stated boundary.
+ * It is an operator-approved deviation, approved 2026-09-03 when F-2 was
+ * resolved, and it is stated here rather than buried in a count because a
+ * denominator that silently grew is a denominator nobody can audit.
+ *
+ * It also surfaces in the ARTIFACT, not only in this comment: every Arm A row's
+ * reason text names the vault universe at the pinned ref as its source, so a
+ * reader of the rendered review meets the widening at the row that caused it.
+ *
+ * WHY the widening was necessary. `buildTraceStatement`
+ * (`src/vault-trace.cts:645-680`) populates the ledger from
+ * `matchPractices(...).matched ++ .global` and nothing else. Every ledger entry
+ * therefore ALREADY matched: there is no "never matched" ledger entry to derive
+ * D-06-09's N-A from. Arm A derives it from `practiceUniverse \ ledger` — data
+ * the statement already carries (`src/vault-trace.cts:618`) — and Arm B
+ * re-derives applicability at review time from the phase's real diff. Two arms,
+ * two DISTINCTLY LABELLED derived reasons that never blur.
+ *
+ * ## DECISION — `check:`-presence is read LIVE, with an advisory; NO schema change
  *
  * The trace records no `check:`-presence field, so "traced ∩ NO_CHECK" needs the
- * vault cache at review time. This module reads it through the shipped
- * evaluator (`evaluatePractices` + `isNoCheckVerdict`); when the trace's pin and
- * the cache's `resolvedSha` disagree it emits one advisory shaped like the trace
- * gate's `PIN_DIVERGED` note — it reports, never blocks. A `checkPresent` field
- * on the trace would be a schema change under `docs/vault-trace-format.md`'s
- * freeze discipline for a consumer that does not need it, and this review is not
- * a gate, so environment-dependence is acceptable here.
+ * vault cache at review time. This module reads it live and harvests the answer
+ * through the SHIPPED evaluator (`evaluatePractices` + `isNoCheckVerdict`); when
+ * the trace's pin and the cache's `resolvedSha` disagree it emits one advisory
+ * shaped like the shipped `PIN_DIVERGED` wording — reports, never blocks,
+ * explicit that no reader action is required.
+ *
+ * Justification, recorded because the alternative was live:
+ *   (a) adding `checkPresent` to `TracePractice` is a trace-SCHEMA change,
+ *       carrying the `predicateType`/`schemaVersion` freeze discipline
+ *       (`docs/vault-trace-format.md`), for a consumer this phase can serve
+ *       without it;
+ *   (b) the advisory idiom is shipped and mutation-proved one module over
+ *       (`src/check-command-router.cts:2687-2725`), including the discipline that
+ *       an advisory stays in the record and is excluded from every block
+ *       decision;
+ *   (c) this tier is not a gate, so environment-dependence is acceptable here —
+ *       the exact carve-out `docs/vault-trace-format.md`'s own warning permits.
  *
  * ## The oracle is HARVESTED, never re-derived
  *
  * `deriveCandidateSet` learns `check:`-presence by running the shipped
- * `evaluatePractices` and filtering with `isNoCheckVerdict`. It never scans for a
- * `check:` key, because the audit tests `hasInvalidCheck` FIRST: an INVALID check
- * is the mechanical audit's `FAIL`, not a `NO_CHECK`. The oracle runs over an
- * EMPTY file set on purpose: `NO_CHECK` is decided before any file is consulted,
- * so the answer is file- and machine-independent.
- *
- * ## Findings this module is built around
- *
- * - `matchPractices` returns `practicesProcessed: 0` for a never-fetched vault
- *   and an empty one alike, so Arm B consumes a `discoverPracticeFiles` result
- *   (whose `vaultPresent` and `readFailed` stay DISTINCT) plus the verdict
- *   owner's view of the cache (`computeVaultVerdict`), never the match count.
- * - A parser-rejected practice is reported as a NAMED exclusion, and a degraded
- *   one as a note — never a silent narrowing.
- * - The review range SHARES the audit's phase-scoped resolution first
- *   (`resolvePhaseRange`: the manifest's `startCommit`, its recorded commits,
- *   then SUMMARY trace digests). Only when that falls back does this module run
- *   its own `(NN-` commit-token scan over `base..HEAD`, and only then the whole
- *   base-branch span. `REVIEW_RANGE_SOURCE` mirrors the phase-scoped values
- *   rather than referencing `AUDIT_RANGE_SOURCE`, which belongs to the blocking
- *   gate.
- * - An invalid `check:` is the mechanical audit's FAIL: it is excluded from the
- *   candidate set and reported as a named exclusion (the practices README states
- *   the audit blocks on it). Every judgement here binds to the audit's verdicts,
- *   never to prose.
+ * `evaluatePractices` and filtering with the shipped `isNoCheckVerdict`. It
+ * never scans for a `check:` key, because the shipped ladder
+ * (`src/vault-audit.cts:381-396`) tests `hasInvalidCheck` FIRST: an INVALID
+ * check is the mechanical tier's `FAIL`, not a `NO_CHECK`. A hand-rolled scan
+ * gets exactly that case backwards and would hand a typo'd practice to the agent
+ * as if the mechanical tier had declined it.
+ *
+ * The oracle runs over an EMPTY file set on purpose. The ladder returns
+ * `NO_CHECK` before any file is consulted (`if (!check)` precedes both the pair
+ * cap and the matching), so the answer is file-independent — and running it over
+ * no files makes it machine-independent too.
+ *
+ * ## Phase 5 findings this module is planned AROUND, not assumed fixed
+ *
+ * - **CR-01.** `matchPractices` returns `practicesProcessed: 0` on a
+ *   never-fetched vault, indistinguishable from an empty one. This module does
+ *   not modify `src/vault-practices.cts`; Arm B instead consumes a
+ *   `discoverPracticeFiles` result, whose typed shape keeps `vaultPresent` and
+ *   `readFailed` DISTINCT (`src/vault-practices.cts:165-175`).
+ * - **WR-02.** A parser-rejected practice silently leaves the practice set.
+ *   `deriveCandidateSet` reports discovery's `skipped` entries as NAMED
+ *   exclusions and its `degraded` entries as notes. Never silently narrowed.
+ * - **WR-04 / F-3, and UAT-6-F1.** The review range now SHARES the mechanical
+ *   tier's phase-scoped resolution first: `resolvePhaseRange` answers from the
+ *   phase manifest's `startCommit` (written at execute:pre by `vault manifest
+ *   start`), then its recorded `commits` (written at verify:post), then the
+ *   SUMMARY trace digests of a phase built before that writer existed. Only when
+ *   all three fall back does this module run its OWN `(NN-` commit-token scan
+ *   over `base..HEAD`, and only then the whole base-branch span. The vocabulary
+ *   stays SEPARATE: `REVIEW_RANGE_SOURCE` mirrors the three phase-scoped values
+ *   rather than referencing `AUDIT_RANGE_SOURCE`, because that object belongs to
+ *   the blocking tier, and a shared vocabulary would couple the wall's two sides
+ *   and shift producer-audit citations for no gain.
+ * - **CR-04 (05-REVIEW:364) — OUT OF SCOPE and NOT assumed fixed.**
+ *   `pp-core/templates/practices/README.md` tells vault authors that a skipped
+ *   or check-invalid practice "never breaks the run", while at HEAD both halt
+ *   the blocking gates. This module builds on the SHIPPED semantics as measured:
+ *   an invalid `check:` is a mechanical-tier FAIL, excluded from the candidate
+ *   set and reported as a named exclusion, whatever the README claims. Fixing
+ *   the README is vault-repo docs work. If it is fixed later nothing here
+ *   changes, because every judgement below binds to `verdictForPractice` /
+ *   `isNoCheckVerdict` and never to the README's prose.
  *
  * ## Nothing measured must never render as clean
  *
- * Every degenerate path returns a record that SAYS what did not happen —
- * `oracleSource: 'unavailable'` with a note, a `notDerived` record per arm, and
- * `reviewRefusesCleanRender`, the single predicate that forbids a clean review
- * when no file was considered or an input was not measured.
+ * Every degenerate path here returns a record that SAYS what did not happen —
+ * `oracleSource: 'unavailable'` with a note, a `notDerived` record per arm
+ * (task 2), and `reviewRefusesCleanRender` (task 3), the single predicate
+ * (D-06-15 / F-3) that forbids a clean review whenever `filesConsidered === 0`.
  *
  * ## Trust boundary
  *
  * Practice ids, `applies-to` globs and practice prose are CLIENT-AUTHORED DATA.
  * They are bounded with the shipped `boundedToken` before they reach any string
  * this module returns, and applicability is decided by the shipped `globMatch`
- * alone. No client-authored byte is ever compiled into a regular expression and
- * no second glob grammar is written here (the declarative-check rule,
- * docs/practices-format.md). Reason texts name practice ids and mechanisms,
- * never absolute filesystem paths.
+ * alone. No client-authored byte is ever compiled into a regular expression
+ * (ADR-71924 §3), and no second glob grammar is written here (§2). Reason texts
+ * name practice ids and mechanisms, never absolute filesystem paths.
  */
 const node_path_1 = __importDefault(require("node:path"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
@@ -182,12 +229,9 @@ const NOT_DERIVED_GROUND = Object.freeze({
     VAULT_STATE_UNKNOWN: 'vault-state-unknown',
     VAULT_NEVER_FETCHED: 'vault-never-fetched',
     VAULT_UNREADABLE: 'vault-unreadable',
-    /**
-     * The cache the vault verdict owner reads records a fetch MISS, or holds no
-     * file: a vault directory may exist, but no client vault was loaded into it.
-     * Without this ground a miss rendered as an empty, clean review.
-     */
-    VAULT_FETCH_MISS: 'vault-fetch-miss',
+    // Quick 261015-at3: the vault was read, and it is a standards vault the
+    // project reads in practices mode — no practice layer was read at all.
+    VAULT_STANDARDS_ONLY: 'vault-standards-only',
     NO_FILES_CONSIDERED: 'no-files-considered',
     MATCHER_UNAVAILABLE: 'matcher-unavailable',
 });
@@ -209,8 +253,8 @@ const ORACLE_UNAVAILABLE_GROUND = 'no-check-oracle-unavailable';
  * difference between fixing D3 and shouting it. That ground says the TRACE
  * records no practice universe — which is true of every reconstruct review by
  * definition, because a phase with no trace has no universe key. Refusing on it
- * would refuse the entire reconstruct arm, which is the primary path (every
- * phase of a project that never traced takes it), not a degraded one. A review that refuses
+ * would refuse the entire reconstruct arm, and `pp-core/workflows/vault-review.md`
+ * §3 calls that arm the primary path, not a degraded one. A review that refuses
  * everything judges exactly as much as one that judges nothing; it is only
  * louder about it.
  */
@@ -218,7 +262,7 @@ const UNMEASURED_GROUND = new Set([
     NOT_DERIVED_GROUND.VAULT_STATE_UNKNOWN,
     NOT_DERIVED_GROUND.VAULT_NEVER_FETCHED,
     NOT_DERIVED_GROUND.VAULT_UNREADABLE,
-    NOT_DERIVED_GROUND.VAULT_FETCH_MISS,
+    NOT_DERIVED_GROUND.VAULT_STANDARDS_ONLY,
     NOT_DERIVED_GROUND.NO_FILES_CONSIDERED,
     NOT_DERIVED_GROUND.MATCHER_UNAVAILABLE,
     ORACLE_UNAVAILABLE_GROUND,
@@ -231,7 +275,7 @@ const UNMEASURED_GROUND = new Set([
  * shared vocabulary would couple the two sides of the wall D-06-01 exists to
  * keep apart — and would shift the producer-audit citations for no gain.
  *
- * * UAT-6-F1 added three members whose VALUES mirror the
+ * 260915-ik2 (UAT-6-F1) added three members whose VALUES mirror the
  * phase-scoped sources of the shared resolution. They are this object's own
  * strings, reached from the audit's through `REVIEW_SOURCE_FOR_AUDIT_SOURCE`,
  * never a reference to the audit's object.
@@ -266,7 +310,7 @@ const REVIEW_SOURCE_FOR_AUDIT_SOURCE = Object.freeze({
  * still has no way to review the phase in front of them.
  */
 const REVIEW_RANGE_UNRESOLVABLE_REMEDY = 'Anchor the phase by running it through /pp-execute-phase (execute:pre records the start commit ' +
-    'via phase manifest start), or audit it by hand over a range you name: ' +
+    'via vault manifest start), or audit it by hand over a range you name: ' +
     'pp-tools vault audit <phase-dir> --range <from>..<to>.';
 /**
  * The opening of the note `resolveReviewRange` pushes when the SHARED
@@ -344,8 +388,8 @@ function isNonVerdict(verdict) {
  * every check-bearing one); crossing that universe with the review's real diff
  * is `deriveNaANoFile`'s job and reaches the SHIPPED `globMatch` through the
  * same `_practices` seam. No second matcher is written for the reconstruct arm,
- * because a second matcher is a second answer to one question (the
- * declarative-check rule). The practices that fall outside the range therefore leave
+ * because a second matcher is a second answer to one question (ADR-71924 §2,
+ * and CR-02's class). The practices that fall outside the range therefore leave
  * this set as STATED derived N-A rows rather than as silent absences.
  *
  * Three oracle paths, and the third one SAYS so:
@@ -494,8 +538,8 @@ function deriveCandidateSet(opts) {
 /**
  * The pin advisory (recorded decision above; no trace-schema change).
  *
- * Mirrors the wording discipline of the trace gate's `PIN_DIVERGED` note
- * (`cmdVaultTrace`) and harvests its KIND from
+ * Mirrors the wording discipline of the shipped `PIN_DIVERGED` note at
+ * `src/check-command-router.cts:2687-2716` and harvests its KIND from
  * `TRACE_PROBLEM_KIND` so the two cannot drift. It reports; it never blocks;
  * it states that no reader action is required. An ABSENT cache emits NOTHING —
  * an absent cache is not a divergence, and a check that fired on absence would
@@ -519,8 +563,8 @@ function derivePinAdvisories(tracePinSha, cacheSha) {
 }
 // ─── Counts and the rate line ────────────────────────────────────────────────
 /**
- * Count the four verdicts, in the shape the audit's `countVerdicts`
- * established one tier down.
+ * Count the four verdicts, in the shape `countVerdicts`
+ * (`src/vault-audit.cts:404-414`) established one tier down.
  *
  * `judged` is `total - na`. Recorded because it is a choice: an `INCONCLUSIVE`
  * practice WAS judged — the agent looked at it and could not determine an
@@ -580,7 +624,7 @@ function countReviewVerdicts(rows) {
                 counts.malformed.push({
                     id: quotableId(id),
                     verdict,
-                    problem: 'A non-verdict must carry a stated reason. A bare N-A or INCONCLUSIVE is ' +
+                    problem: 'D-06-11: a non-verdict must carry a stated reason. A bare N-A or INCONCLUSIVE is ' +
                         'indistinguishable from the agent giving up.',
                 });
             }
@@ -669,7 +713,7 @@ function deriveMechanicalCoverageLine(opts) {
  *
  * BOUNDARY WIDENING, surfaced in every row (and in the module header): these
  * ids were never traced, so reporting them widens the judged boundary beyond
- * the traced input set (see the module header). The reason
+ * `06-CONTEXT.md`'s stated input set. Operator-approved 2026-09-03. The reason
  * text names the vault universe as its source so a reader of the ARTIFACT meets
  * the widening at the row that caused it, never only in a plan nobody reopens.
  *
@@ -694,9 +738,9 @@ function deriveNaAUniverse(opts) {
                     ? {
                         ground: NOT_DERIVED_GROUND.UNIVERSE_WITHHELD,
                         statement: 'Arm A derived NOTHING: this trace DOES record a practice universe, and it was ' +
-                            'deliberately withheld because the trace is DEGRADED — it records that the vault could ' +
-                            'not be loaded when the work was planned, so its universe proves nothing about which ' +
-                            'practices governed that work and may not be subtracted from. This is a ' +
+                            'deliberately withheld because the trace is DEGRADED — it records that no trusted vault ' +
+                            'load existed when the work was planned, so its universe proves nothing about which ' +
+                            'practices governed that work and may not be subtracted from (D-06-15). This is a ' +
                             // Same wording constraint as the sibling branch below: the
                             // prompt-injection scanner's regex carries no leading word
                             // boundary, so "is a different fact from …" is written in place
@@ -767,8 +811,8 @@ function deriveNaAUniverse(opts) {
  * global practice applies to the whole change set by definition, so "no file
  * fell under it" is not a statement that can be true of one.
  *
- * Applicability is decided by the SHIPPED `globMatch` alone (the declarative-check
- * rule: no second grammar, no client-authored byte compiled into a RegExp).
+ * Applicability is decided by the SHIPPED `globMatch` alone (ADR-71924 §2 — no
+ * second grammar; §3 — no client-authored byte compiled into a RegExp).
  */
 function deriveNaANoFile(opts) {
     const arm = NA_DERIVED_REASON.NO_FILE_IN_DIFF;
@@ -787,20 +831,24 @@ function deriveNaANoFile(opts) {
             'honest N-A.');
     }
     if (discovery.vaultPresent === false) {
-        return refuse(NOT_DERIVED_GROUND.VAULT_NEVER_FETCHED, 'Arm B derived NOTHING: no fetched client vault cache exists on this machine — the vault was ' +
+        return refuse(NOT_DERIVED_GROUND.VAULT_NEVER_FETCHED, 'Arm B derived NOTHING: the client vault directory does not exist on this machine — the vault was ' +
             'NEVER FETCHED. This is not an empty vault, and no applicability was derived from it. Repair by ' +
             'fetching the vault, then re-run the review.');
     }
-    if (discovery.fetchMiss === true) {
-        return refuse(NOT_DERIVED_GROUND.VAULT_FETCH_MISS, 'Arm B derived NOTHING: the vault cache records a FETCH MISS (or holds no file), so no client vault ' +
-            'was loaded and no applicability was derived from it. An empty practice set read from a miss is ' +
-            'not an empty vault. Repair by fetching the vault, then re-run the review.');
-    }
     if (discovery.readFailed === true) {
         return refuse(NOT_DERIVED_GROUND.VAULT_UNREADABLE, 'Arm B derived NOTHING: the client vault is PRESENT but a read of it REFUSED — the vault is ' +
             'unreadable. This is not an empty vault and not a missing one, and no applicability was derived ' +
             'from it. Repair by making the cached vault readable, then re-run the review.');
     }
+    // Quick 261015-at3 (entry-point sweep): read from the same typed discovery
+    // result as the two rungs above, never from prose. A trace an older engine
+    // recorded `loaded` over this vault would otherwise take the traced arm and
+    // render a clean "0 of 0" review of a phase no practice governed.
+    if (discovery.vaultStandardsOnly === true) {
+        return refuse(NOT_DERIVED_GROUND.VAULT_STANDARDS_ONLY, 'Arm B derived NOTHING: the client vault holds standards (INDEX.md) and no practice files, and this ' +
+            'project reads it in practices mode, so no practice layer was read. This is not an empty vault, and ' +
+            'no applicability was derived from it. Repair by setting vault.mode to standards, then re-plan the phase.');
+    }
     const diffFiles = asStringList(opts.diffFiles).map((f) => f.replace(/\\/g, '/'));
     if (diffFiles.length === 0) {
         return refuse(NOT_DERIVED_GROUND.NO_FILES_CONSIDERED, 'Arm B derived NOTHING: the review range yielded zero files, so no applicability was measured. ' +
@@ -811,7 +859,7 @@ function deriveNaANoFile(opts) {
     const matcher = opts._practices ?? practicesMod;
     if (typeof matcher.globMatch !== 'function') {
         return refuse(NOT_DERIVED_GROUND.MATCHER_UNAVAILABLE, 'Arm B derived NOTHING: the shipped glob matcher could not be reached, and no second matcher is ' +
-            'written here (the declarative-check rule). No applicability was measured.');
+            'written here (ADR-71924 §2). No applicability was measured.');
     }
     const byId = new Map();
     for (const p of opts.practices ?? []) {
@@ -916,7 +964,7 @@ function normalisePhaseToken(v) {
  * Resolve the range this review is computed over, and RECORD where it came from
  * (F-3 / WR-04).
  *
- * First — the SHARED phase-scoped resolution (UAT-6-F1). When a
+ * First — the SHARED phase-scoped resolution (260915-ik2, UAT-6-F1). When a
  * `phaseDir` is given, the mechanical tier's `resolvePhaseRange` is asked
  * before anything else, and its ladder is the one this tier adopts:
  * `phase-start-commit` (the manifest anchor written at execute:pre),
@@ -945,7 +993,7 @@ function normalisePhaseToken(v) {
  * Fallback — `base-branch`: `resolveBaseBranchResult(cwd)...HEAD`. The 5-tier
  * ladder is never re-derived (#1146 records what the naive `origin/HEAD` +
  * `:-main` form cost) and every git call goes through the timeout-bounded
- * `execGit` seam, never `execFileSync`. The RESULT form is used rather than the
+ * `execGitLocal` seam (D-116), never `execFileSync`. The RESULT form is used rather than the
  * bare string so a REFUSED `git.base_branch` becomes a stated note instead of a
  * silent change of range (T-6-49).
  *
@@ -966,7 +1014,7 @@ function normalisePhaseToken(v) {
  * that could not be read must never look like a phase that changed nothing.
  */
 function resolveReviewRange(opts) {
-    const exec = typeof opts?.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGit;
+    const exec = typeof opts?.exec === 'function' ? opts.exec : shell_command_projection_cjs_1.execGitLocal;
     const cwd = typeof opts?.cwd === 'string' && opts.cwd !== '' ? opts.cwd : process.cwd();
     const notes = [];
     let base = 'main';
@@ -990,7 +1038,7 @@ function resolveReviewRange(opts) {
     }
     let range = `${base}...HEAD`;
     let rangeSource = REVIEW_RANGE_SOURCE.BASE_BRANCH;
-    // The shared phase-scoped resolution, ahead of the token scan (UAT-6-F1).
+    // The shared phase-scoped resolution, ahead of the token scan (260915-ik2).
     let sharedResolved = false;
     if (typeof opts?.phaseDir === 'string' && opts.phaseDir !== '') {
         try {
@@ -1224,8 +1272,9 @@ const REVIEW_PROBLEM_KIND = Object.freeze({
     /** D-06-13: the counts line's numbers are not the ones the rows support. */
     COUNTS_LINE_ARITHMETIC: 'counts-line-arithmetic',
     // ── MECH-02 / D-10-20: the mechanical coverage line ────────────────────────
-    // An instructed-only line is an unenforced one: an artifact that dropped it
-    // validated clean. These four kinds close it.
+    // Phase 10 verification found this line INSTRUCTED (agents/pp-vault-reviewer.md
+    // :56-68) and ENFORCED NOWHERE — an artifact that dropped it validated clean,
+    // while that line is MECH-02's whole deliverable. These four kinds close it.
     /** The payload carried a coverage line and the artifact does not. */
     COVERAGE_LINE_ABSENT: 'coverage-line-absent',
     /** A coverage line is present but is not the engine's sentence, verbatim. */
@@ -1246,13 +1295,6 @@ const REVIEW_PROBLEM_KIND = Object.freeze({
     FENCE_UNBALANCED: 'fence-unbalanced',
     /** The parse cap was reached; rows beyond it were NOT judged. */
     ROWS_TRUNCATED: 'rows-truncated',
-    // ── The population, checked against the payload by `vault review finalize` ──
-    /** A practice of the review's population has no row: dropped rather than judged. */
-    ROW_POPULATION_MISSING: 'row-population-missing',
-    /** A row names a practice outside the population the payload derived. */
-    ROW_POPULATION_UNEXPECTED: 'row-population-unexpected',
-    /** One practice carries more than one row. */
-    ROW_DUPLICATE: 'row-duplicate',
     // The four D-06-13 score forms.
     FORBIDDEN_PERCENTAGE: 'forbidden-percentage',
     FORBIDDEN_RATIO: 'forbidden-ratio',
@@ -1264,8 +1306,8 @@ const REVIEW_SECTION_HEADING = '## Practice Verdicts (agent-judged)';
 /** The D-06-12 rate line, as a shape. The renderer above is the only writer. */
 const RATE_LINE_SHAPE = /^(\d+) of (\d+) practices judged · (\d+) N-A · (\d+) INCONCLUSIVE$/;
 /**
- * The D-10-03 mechanical coverage line, as a shape. The audit's
- * `renderMechanicalCoverageLine` is the only writer; this recognises its output so a
+ * The D-10-03 mechanical coverage line, as a shape. `deriveMechanicalCoverageLine`
+ * (`src/vault-audit.cts:823`) is the only writer; this recognises its output so a
  * MISPLACED or UNEXPECTED line can be named even when no expectation was supplied.
  */
 const COVERAGE_LINE_SHAPE = /^(\d+) of (\d+) practices mechanically checked · (\d+) PASS · (\d+) FAIL · (\d+) NOT_MATCHED · (\d+) NO_CHECK$/;
@@ -1346,18 +1388,12 @@ function isSeparatorLine(line) {
  * empty result.
  */
 function locateReviewSection(lines) {
-    // A line between a closed pair of fence markers is client prose, never
-    // structure: a heading-shaped client line can neither open the section nor
-    // end it (the same trust boundary `parseReviewRows` draws for rows).
-    const fenced = fencedLineMap(lines);
-    const start = lines.findIndex((l, i) => !fenced[i] && l.trim() === REVIEW_SECTION_HEADING);
+    const start = lines.findIndex((l) => l.trim() === REVIEW_SECTION_HEADING);
     if (start === -1)
         return { present: false, start: 0, end: lines.length };
     let end = lines.length;
     for (let i = start + 1; i < lines.length; i += 1) {
         const line = lines[i];
-        if (fenced[i])
-            continue;
         if (line.startsWith('## ') || line.trim() === '---') {
             end = i;
             break;
@@ -1497,11 +1533,11 @@ function judgeReviewRow(unit) {
     }
     const recognised = isJudgedVerdict(verdict) || isNonVerdict(verdict);
     if (!recognised) {
-        problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_UNKNOWN_VERDICT, id === '' ? null : id, line, `"${safe(verdict)}" is not one of the four locked verdicts. A coined fifth verdict ` +
+        problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_UNKNOWN_VERDICT, id === '' ? null : id, line, `"${safe(verdict)}" is not one of the four locked verdicts (D-06-10). A coined fifth verdict ` +
             'is counted as unrecognised and is never absorbed into a real one.'));
     }
     else if (isNonVerdict(verdict) && reason === '') {
-        problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_MISSING_REASON, id === '' ? null : id, line, 'A non-verdict must carry a stated reason. A bare N-A or INCONCLUSIVE is ' +
+        problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_MISSING_REASON, id === '' ? null : id, line, 'D-06-11: a non-verdict must carry a stated reason. A bare N-A or INCONCLUSIVE is ' +
             'indistinguishable from the agent giving up.'));
     }
     const derived = DERIVED_SOURCE_SHAPE.test(source);
@@ -1517,7 +1553,7 @@ function judgeReviewRow(unit) {
                 'and a reader who cannot tell them apart cannot act on either.'));
         }
         if (isJudgedVerdict(verdict)) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_DERIVED_VERDICT_CONFLICT, id === '' ? null : id, line, `a derived row carries "${safe(verdict)}", a judged verdict. Derived rows are handed to ` +
+            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_DERIVED_VERDICT_CONFLICT, id === '' ? null : id, line, `a derived row carries "${safe(verdict)}", a judged verdict. D-06-09 hands derived rows to ` +
                 'the agent to reproduce, not to reclassify: a derived N-A promoted to PASS or FAIL is a ' +
                 'computed fact overwritten by a judgement.'));
         }
@@ -1574,7 +1610,7 @@ function validateReviewArtifact(text, opts) {
     }
     else if (!section.present) {
         problems.push(reviewProblem(REVIEW_PROBLEM_KIND.SECTION_ABSENT, null, null, `the artifact carries no "${REVIEW_SECTION_HEADING}" heading, so no verdict row was found ` +
-            'and nothing was judged. The heading is locked; a section under any other heading is ' +
+            'and nothing was judged. D-06-02 locks that heading; a section under any other heading is ' +
             'not this section.'));
     }
     const { units, truncated } = section.present
@@ -1593,7 +1629,8 @@ function validateReviewArtifact(text, opts) {
     }
     if (section.present && units.length === 0) {
         problems.push(reviewProblem(REVIEW_PROBLEM_KIND.NO_ROWS, null, null, 'the section heading is present and carries no verdict row. An empty section is not a clean ' +
-            'review: a gap is reported loudly, never as an empty register.'));
+            'review: D-06-14 requires a gap to be reported loudly, and §10 of the verifier contract ' +
+            'requires no input to produce NO section rather than an empty one.'));
     }
     const counts = countReviewVerdicts(rows);
     const expectedRateLine = renderRateLine(counts);
@@ -1603,19 +1640,19 @@ function validateReviewArtifact(text, opts) {
     const foundCountsLine = body.map((l) => l.trim()).find((l) => COUNTS_LINE_SHAPE.test(l)) ?? null;
     if (section.present) {
         if (foundRateLine === null) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.RATE_LINE_ABSENT, null, null, `The section carries no non-verdict rate line. Expected the computed line ` +
+            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.RATE_LINE_ABSENT, null, null, `D-06-12: the section carries no non-verdict rate line. Expected the computed line ` +
                 `"${expectedRateLine}" — the denominator is the point, and a list of green rows without ` +
                 'it cannot tell a reader that a review is hollow.'));
         }
         else if (foundRateLine !== expectedRateLine) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.RATE_LINE_ARITHMETIC, null, null, `The rate line reads "${safe(foundRateLine)}" while the rows support ` +
+            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.RATE_LINE_ARITHMETIC, null, null, `D-06-12: the rate line reads "${safe(foundRateLine)}" while the rows support ` +
                 `"${expectedRateLine}". The arithmetic is computed from the rows and never narrated.`));
         }
         if (foundCountsLine === null) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COUNTS_LINE_ABSENT, null, null, `The section carries no counts line. Expected "${expectedCountsLine}".`));
+            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COUNTS_LINE_ABSENT, null, null, `D-06-13: the section carries no counts line. Expected "${expectedCountsLine}".`));
         }
         else if (foundCountsLine !== expectedCountsLine) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COUNTS_LINE_ARITHMETIC, null, null, `The counts line reads "${safe(foundCountsLine)}" while the rows support ` +
+            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COUNTS_LINE_ARITHMETIC, null, null, `D-06-13: the counts line reads "${safe(foundCountsLine)}" while the rows support ` +
                 `"${expectedCountsLine}".`));
         }
     }
@@ -1628,10 +1665,7 @@ function validateReviewArtifact(text, opts) {
         const expected = opts.expectedCoverageLine;
         const inSection = (i) => section.present && i >= section.start && i < section.end;
         let foundIdx = -1;
-        const fencedLines = fencedLineMap(lines);
         for (let i = 0; i < lines.length; i += 1) {
-            if (fencedLines[i])
-                continue;
             if (COVERAGE_LINE_SHAPE.test(lines[i].trim())) {
                 foundIdx = i;
                 break;
@@ -1640,23 +1674,23 @@ function validateReviewArtifact(text, opts) {
         const found = foundIdx >= 0 ? lines[foundIdx].trim() : null;
         if (typeof expected === 'string' && expected.length > 0) {
             if (found === null) {
-                problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_ABSENT, null, null, `The payload carried the mechanical coverage line "${expected}" and the ` +
+                problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_ABSENT, null, null, `D-10-03: the payload carried the mechanical coverage line "${expected}" and the ` +
                     'artifact reproduces it nowhere. That line is how a reader learns how much of the ' +
                     'vault was mechanically checked; without it a page of judged rows cannot say ' +
                     'whether the mechanical tier ran at all.'));
             }
             else if (found !== expected) {
-                problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_MISMATCH, null, null, `The coverage line reads "${safe(found)}" where the engine computed ` +
+                problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_MISMATCH, null, null, `D-10-03: the coverage line reads "${safe(found)}" where the engine computed ` +
                     `"${expected}". It is the engine's sentence, reproduced verbatim and never restated.`));
             }
             else if (inSection(foundIdx)) {
-                problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_MISPLACED, null, null, 'The coverage line sits inside the verdicts section, where a second bare ' +
+                problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_MISPLACED, null, null, 'D-10-03: the coverage line sits inside the verdicts section, where a second bare ' +
                     'shaped line makes the section contradict itself — its figures count a different ' +
                     'population from the rate line above them. It belongs under "## Range".'));
             }
         }
         else if (expected === null && found !== null) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_UNEXPECTED, null, null, `The artifact carries "${safe(found)}" while the payload carried no coverage ` +
+            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.COVERAGE_LINE_UNEXPECTED, null, null, `D-10-03: the artifact carries "${safe(found)}" while the payload carried no coverage ` +
                 'line at all. Its absence means the inputs were never measured, so this figure ' +
                 'states a measurement nobody took.'));
         }
@@ -1686,7 +1720,7 @@ function validateReviewArtifact(text, opts) {
             'marks it as reference data, which is the escape the fencing exists to prevent.'));
     }
     for (const finding of scanForbiddenScoreTokens(body.join('\n'))) {
-        problems.push(reviewProblem(finding.kind, null, section.present ? section.start + finding.line : finding.line, `No single-number roll-up may appear anywhere in this section; "${finding.match}" is one. ` +
+        problems.push(reviewProblem(finding.kind, null, section.present ? section.start + finding.line : finding.line, `D-06-13 forbids a single-number roll-up anywhere in this section; "${finding.match}" is one. ` +
             'Counts by verdict stay sortable and trackable across phases without inviting a ' +
             'measured-sounding claim about a judgement.'));
     }
@@ -1815,7 +1849,7 @@ function buildReviewPayload(opts) {
     const range = resolveReviewRange({
         cwd: opts.cwd,
         phaseToken: opts?.phaseToken ?? null,
-        // UAT-6-F1: the check router already supplies `phaseDir: phase.rel`, so
+        // 260915-ik2: the check router already supplies `phaseDir: phase.rel`, so
         // forwarding it is all the shared phase-scoped resolution needs.
         phaseDir: typeof opts?.phaseDir === 'string' && opts.phaseDir !== '' ? opts.phaseDir : null,
         ...(typeof opts?.exec === 'function' ? { exec: opts.exec } : {}),
@@ -1825,26 +1859,13 @@ function buildReviewPayload(opts) {
         'applicability judgement below is scoped to exactly that set.');
     for (const note of range.notes)
         statements.push(`Range note: ${note}`);
-    // ── The vault verdict owner's answer, stated when it is not `loaded`: the
-    // practices below were read from the cache as it stands, and a reader must
-    // know whether the load gate considers that cache the client's loaded vault.
-    const ownerVerdict = opts?.vaultVerdict ?? null;
-    const vault = ownerVerdict !== null && typeof ownerVerdict === 'object' && typeof ownerVerdict.verdict === 'string'
-        ? { verdict: safe(ownerVerdict.verdict), reason: typeof ownerVerdict.reason === 'string' ? safe(ownerVerdict.reason) : '' }
-        : null;
-    if (vault !== null && vault.verdict !== 'loaded') {
-        statements.push(`The vault verdict owner reports this project's vault as ${vault.verdict}` +
-            (vault.reason === '' ? '' : ` (${vault.reason})`) +
-            ': the practices reviewed below were read from the local cache as it stands, which the vault load ' +
-            "gate does not treat as the client's loaded vault.");
-    }
     // ── D-06-15: an absent trace does not refuse; it says so and RECONSTRUCTS.
     if (!tracePresent) {
         statements.push('No practice trace was found for this phase' +
             (phaseDir === null ? '' : ` in ${phaseDir}`) +
             '. This review therefore took the RECONSTRUCT arm: the applicable practice set is rebuilt ' +
             "from this phase's real diff and the vault's own practice list rather than from a ledger. " +
-            'Any completed phase is eligible for review and a missing trace is itself a finding, ' +
+            'Any completed phase is eligible for review (D-06-14) and a missing trace is itself a finding, ' +
             'so it is recorded here rather than used as a reason to refuse.');
     }
     // ── G1: a trace that PARSES but records a failed vault load. This is not the
@@ -1859,9 +1880,9 @@ function buildReviewPayload(opts) {
         'A practice trace WAS found for this phase' +
             (phaseDir === null ? '' : ` in ${phaseDir}`) +
             `, and it records a FAILURE — ${traceReason ?? 'no reason recorded'}. A degraded block is a valid ` +
-            'record of a failure — it says the vault could not be loaded when the work was planned — so it ' +
-            'proves nothing about which practices governed that work and may not stand in for a loaded trace. ' +
-            'This review therefore took the RECONSTRUCT arm: the applicable practice set is rebuilt ' +
+            'record of a failure — it says no trusted vault load existed when the work was planned — so it ' +
+            'proves nothing about which practices governed that work and may not stand in for a loaded trace ' +
+            '(D-06-15). This review therefore took the RECONSTRUCT arm: the applicable practice set is rebuilt ' +
             "from this phase's real diff and the vault's own practice list, and this trace's own ledger and " +
             'practice universe are deliberately not consulted.');
     }
@@ -1882,7 +1903,7 @@ function buildReviewPayload(opts) {
             `${said(o.who)} at ${said(o.when)} with the stated reason "${said(o.reason)}", suppressing the ` +
             `verdict ${said(o.suppressedReason)}. The work this phase records was therefore planned or ` +
             'executed under a deliberate, attributed bypass of that gate; this review reports the fact ' +
-            'and does not judge it.');
+            '(D-08-11) and does not judge it.');
     }
     // ── The input set: this arm's universe ∩ NO_CHECK, harvested through the
     // shipped ladder. On the reconstruct arm the universe is the vault's own
@@ -2019,7 +2040,6 @@ function buildReviewPayload(opts) {
         // the latter and never re-derives it from the former (06-12, T-6-48).
         arm: traceLoaded ? 'traced' : 'reconstruct',
         phaseDir,
-        vault,
         statements,
         trace: {
             present: tracePresent,
@@ -2044,278 +2064,6 @@ function buildReviewPayload(opts) {
         notes,
     };
 }
-// ─── The artifact the agent fills in, and the lines only code writes ─────────
-/**
- * The verdict cell of a remainder row until the agent judges it. Deliberately
- * outside the locked vocabulary: a row left unjudged is reported by the
- * validator as `row-unknown-verdict`, never counted as any verdict.
- */
-const REVIEW_UNJUDGED_VERDICT = 'TODO';
-/** The `## Range` heading the coverage line is stamped under. */
-const RANGE_SECTION_HEADING = '## Range';
-/** A table cell: one line, no column separator, never empty. */
-function tableCell(v, empty = 'none.') {
-    const s = (typeof v === 'string' ? v : '').replace(/[\r\n]+/g, ' ').replace(/\|/g, '¦').trim();
-    return s === '' ? empty : s;
-}
-/**
- * The gaps the payload recorded, one row each, in a fixed order. Every row is
- * written on every run; a row with nothing to report says `none.`, so "nothing
- * to report" and "not looked at" never look alike.
- */
-function reviewGapRows(p) {
-    const notDerived = (arm) => (arm.notDerived ? arm.notDerived.statement : '');
-    const vaultGround = p.naNoFile.notDerived?.ground ?? '';
-    const vaultGap = [
-        NOT_DERIVED_GROUND.VAULT_STATE_UNKNOWN,
-        NOT_DERIVED_GROUND.VAULT_NEVER_FETCHED,
-        NOT_DERIVED_GROUND.VAULT_FETCH_MISS,
-        NOT_DERIVED_GROUND.VAULT_UNREADABLE,
-    ].some((g) => g === vaultGround)
-        ? notDerived(p.naNoFile)
-        : '';
-    const traceGap = !p.trace.present
-        ? 'absent — no practice trace was found, so this review took the reconstruct arm'
-        : p.trace.loaded
-            ? ''
-            : `degraded — ${p.trace.reason ?? 'no reason recorded'}`;
-    const said = (v) => v ?? '(not recorded)';
-    const overrides = p.trace.overrides
-        .map((o) => `${said(o.gate)} overridden by ${said(o.who)} at ${said(o.when)} in ${said(o.source)}: "${said(o.reason)}" (suppressed ${said(o.suppressedReason)})`)
-        .join('; ');
-    const rangeGap = p.range.outcome === auditMod.AUDIT_RANGE_OUTCOME.RANGE_UNRESOLVABLE
-        ? `${p.range.outcome}: ${REVIEW_RANGE_UNRESOLVABLE_REMEDY}`
-        : '';
-    const skipped = p.inputSet.exclusions
-        .filter((e) => e.reason === AUDIT_FAIL_REASON.PRACTICE_UNLOADABLE)
-        .map((e) => quotableId(e.id))
-        .join(', ');
-    const unmeasured = unmeasuredGrounds({
-        filesConsidered: p.range.filesConsidered,
-        inputSet: p.inputSet,
-        naUniverse: p.naUniverse,
-        naNoFile: p.naNoFile,
-    });
-    const refused = p.refusesCleanRender
-        ? `no clean review may be rendered: ${p.range.filesConsidered === 0 ? 'zero files were considered' : `inputs not measured (${unmeasured.join(', ')})`}`
-        : '';
-    return [
-        ['Vault absent, never fetched, missed or unreadable', vaultGap],
-        ['Practice universe not recorded at the pin', notDerived(p.naUniverse)],
-        ['Trace absent or degraded', traceGap],
-        ['Gate override recorded (who, when, reason)', overrides],
-        ['Range refused or unresolvable', rangeGap],
-        ['Empty diff — no file considered', p.range.filesConsidered === 0 ? 'zero files were considered' : ''],
-        ['Practices skipped or rejected before matching', skipped],
-        ['Clean review refused', refused],
-    ];
-}
-/**
- * Render the `NN-VAULT-REVIEW.md` the agent fills in, from the payload alone.
- *
- * Everything computed is written here, by code: provenance, the range, every
- * derived row with its reason and arm label, every gap row, the payload's
- * statements, the fixed limits, and — through `stampReviewLines` — the rate,
- * counts and coverage lines. Each remainder practice gets one row whose verdict
- * reads `TODO` and whose reason is empty: those two cells are the agent's whole
- * writable surface. The remainder's practice text follows, last, inside the
- * fences the shipped renderer already put around it.
- *
- * Pure: payload and date in, text out.
- */
-function renderReviewScaffold(payload, meta = {}) {
-    const p = payload;
-    const token = typeof meta.phaseToken === 'string' && meta.phaseToken !== '' ? safe(meta.phaseToken) : '?';
-    const date = typeof meta.date === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(meta.date) ? meta.date : '';
-    const traceCell = !p.trace.present
-        ? 'absent'
-        : p.trace.loaded
-            ? 'present and loaded'
-            : `degraded — ${p.trace.reason ?? 'no reason recorded'}`;
-    const advisories = p.inputSet.advisories.map((a) => a.detail).join(' ');
-    const rows = [];
-    for (const id of p.partition.remainder) {
-        rows.push(`| \`${tableCell(quotableId(id))}\` | ${REVIEW_UNJUDGED_VERDICT} |  | agent-judged |`);
-    }
-    for (const r of [...p.partition.naUniverse, ...p.partition.naNoFile]) {
-        rows.push(`| \`${tableCell(quotableId(r.id))}\` | ${r.verdict} | ${tableCell(r.reason)} | derived (${tableCell(r.naDerivedReason ?? '')}) |`);
-    }
-    const lines = [
-        '---',
-        `phase: "${token}"`,
-        'artifact: vault-review',
-        `reviewed: ${date === '' ? 'unknown' : date}`,
-        `arm: ${p.arm}`,
-        '---',
-        '',
-        `# Phase ${token} — Vault Practice Review`,
-        '',
-        '> This review reports and never gates: no verdict here changes a phase status, a score, a gap or a',
-        '> ship. Verdicts are agent-judged, not measured, and two runs may differ. Counts by verdict only.',
-        '',
-        '## Provenance',
-        '',
-        '| Field | Value |',
-        '| --- | --- |',
-        `| Phase directory | ${tableCell(p.phaseDir ?? '')} |`,
-        `| Arm | ${p.arm} |`,
-        `| Trace | ${tableCell(traceCell)} |`,
-        `| Trace sources | ${tableCell(p.trace.sources.join(', '))} |`,
-        `| Vault verdict | ${tableCell(p.vault ? `${p.vault.verdict}${p.vault.reason ? ` (${p.vault.reason})` : ''}` : '', 'not supplied')} |`,
-        `| Pin advisory | ${tableCell(advisories)} |`,
-        '',
-        RANGE_SECTION_HEADING,
-        '',
-        '| Field | Value |',
-        '| --- | --- |',
-        `| \`range\` | \`${tableCell(p.range.range)}\` |`,
-        `| \`rangeSource\` | \`${tableCell(p.range.rangeSource)}\` |`,
-        `| \`filesConsidered\` | ${p.range.filesConsidered} |`,
-        `| \`outcome\` | \`${tableCell(p.range.outcome)}\` |`,
-        '',
-        REVIEW_SECTION_HEADING,
-        '',
-        '| Practice | Verdict | Reason / evidence | Source |',
-        '| --- | --- | --- | --- |',
-        ...rows,
-        '',
-        '## Not Derived — the gaps',
-        '',
-        '| Gap | Statement |',
-        '| --- | --- |',
-        ...reviewGapRows(p).map(([gap, statement]) => `| ${gap} | ${tableCell(statement)} |`),
-        '',
-        '## Derivation Statements',
-        '',
-        ...(p.statements.length + p.notes.length === 0
-            ? ['none.']
-            : [...p.statements.map((st) => `- ${st}`), ...p.notes.map((n) => `- Note: ${n}`)]),
-        '',
-        '## Limits of This Review',
-        '',
-        '- Nothing in this artifact gates anything. A `FAIL` is a report to a human, not a halt.',
-        '- A verdict is one agent run\'s judgement; reproducibility is not claimed.',
-        '- The non-verdict rate is reported, not judged: there is no threshold at which a review is declared',
-        '  low-confidence.',
-        '- A practice absent from the register was not in the input set; the gaps table says why. Absence',
-        '  is not a statement that it was followed.',
-        '',
-        '## Practice Text (client reference data)',
-        '',
-        ...(p.practiceEntries.length === 0 ? ['none.'] : p.practiceEntries.flatMap((e) => [e, ''])),
-        '',
-    ];
-    return stampReviewLines(lines.join('\n'), { coverageLine: p.mechanicalCoverageLine ?? null }).text;
-}
-/** Index of the first unfenced line equal to `heading`, or -1. */
-function unfencedHeadingIndex(lines, heading) {
-    const fenced = fencedLineMap(lines);
-    return lines.findIndex((l, i) => !fenced[i] && l.trim() === heading);
-}
-/**
- * Write the three computed lines into an artifact — the ONLY writer of them.
- *
- * Every unfenced rate- or counts-shaped line inside the verdicts section, and
- * every unfenced coverage-shaped line anywhere, is removed; then the rate and
- * counts lines the validator computes from the section's own rows are written
- * directly under the section heading, and the payload's coverage line (when it
- * carries one) at the end of `## Range` — or above the verdicts section when
- * there is no `## Range`. A narrated figure therefore cannot survive, and the
- * two count populations (the payload's derived rows and the register's rows)
- * cannot be confused by anyone: the register's lines are always the register's.
- *
- * Fenced client prose is never touched. Without the verdicts heading nothing is
- * stamped and the validator reports the absent section.
- */
-function stampReviewLines(text, opts = {}) {
-    if (typeof text !== 'string')
-        return { text: '', stamped: false };
-    const src = text.split(/\r?\n/);
-    const section = locateReviewSection(src);
-    if (!section.present)
-        return { text, stamped: false };
-    const fenced = fencedLineMap(src);
-    const kept = [];
-    for (let i = 0; i < src.length; i += 1) {
-        const t = src[i].trim();
-        if (!fenced[i]) {
-            if (COVERAGE_LINE_SHAPE.test(t))
-                continue;
-            if (i >= section.start && i < section.end && (RATE_LINE_SHAPE.test(t) || COUNTS_LINE_SHAPE.test(t)))
-                continue;
-        }
-        kept.push(src[i]);
-    }
-    const probe = validateReviewArtifact(kept.join('\n'));
-    const head = unfencedHeadingIndex(kept, REVIEW_SECTION_HEADING);
-    let after = head + 1;
-    while (after < kept.length && kept[after].trim() === '')
-        after += 1;
-    kept.splice(head + 1, after - (head + 1), '', probe.expectedRateLine, probe.expectedCountsLine, '');
-    const coverage = typeof opts.coverageLine === 'string' ? opts.coverageLine.trim() : '';
-    if (coverage !== '' && COVERAGE_LINE_SHAPE.test(coverage)) {
-        const fencedNow = fencedLineMap(kept);
-        const range = unfencedHeadingIndex(kept, RANGE_SECTION_HEADING);
-        let at = unfencedHeadingIndex(kept, REVIEW_SECTION_HEADING);
-        if (range !== -1) {
-            at = kept.length;
-            for (let i = range + 1; i < kept.length; i += 1) {
-                if (!fencedNow[i] && (kept[i].startsWith('## ') || kept[i].trim() === '---')) {
-                    at = i;
-                    break;
-                }
-            }
-            while (at > range + 1 && kept[at - 1].trim() === '')
-                at -= 1;
-            kept.splice(at, 0, '', coverage);
-        }
-        else {
-            kept.splice(at, 0, coverage, '');
-        }
-    }
-    // Removing a line leaves its blank neighbours behind; collapse every unfenced
-    // run of blank lines to one, so stamping is idempotent.
-    const fencedOut = fencedLineMap(kept);
-    const out = kept.filter((l, i) => fencedOut[i] || l.trim() !== '' || i === 0 || kept[i - 1].trim() !== '');
-    return { text: out.join('\n'), stamped: true };
-}
-/**
- * The register's rows against the population the payload derived: every
- * practice of `partition.population` (remainder plus both derived arms) has
- * exactly one row, and no row names anything else. Deleting a row is how a
- * hard practice disappears from a review; this makes that a reported problem.
- */
-function compareReviewPopulation(rows, partition) {
-    const expected = uniqueInOrder([
-        ...partition.remainder,
-        ...partition.naUniverse.map((r) => r.id),
-        ...partition.naNoFile.map((r) => r.id),
-    ]);
-    const want = new Set(expected.map((id) => quotableId(id)));
-    const seen = new Map();
-    for (const r of rows) {
-        if (typeof r?.id !== 'string' || r.id === '')
-            continue;
-        seen.set(r.id, (seen.get(r.id) ?? 0) + 1);
-    }
-    const problems = [];
-    for (const id of want) {
-        if (!seen.has(id)) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_POPULATION_MISSING, id, null, `"${id}" is in the population this review derived and has no row: a practice handed to the review ` +
-                'is judged or reproduced, never dropped.'));
-        }
-    }
-    for (const [id, n] of seen) {
-        if (!want.has(id)) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_POPULATION_UNEXPECTED, id, null, `"${safe(id)}" has a row but is not in the population this review derived, so its verdict judges ` +
-                'something the review was not handed.'));
-        }
-        if (n > 1) {
-            problems.push(reviewProblem(REVIEW_PROBLEM_KIND.ROW_DUPLICATE, id, null, `"${safe(id)}" carries ${n} rows; each practice carries exactly one verdict.`));
-        }
-    }
-    return problems;
-}
 module.exports = {
     // The three frozen vocabularies. These ARE the contract 06-04/06-06/06-08 and
     // 06-10 serialize; nothing downstream re-derives a token.
@@ -2351,9 +2099,4 @@ module.exports = {
     // `cmdVaultAudit` states about its own leaf: a second composition is a second
     // place the report can disagree with the derivation it claims to report.
     buildReviewPayload,
-    // The artifact the agent fills in, and the three lines only code writes.
-    REVIEW_UNJUDGED_VERDICT,
-    renderReviewScaffold,
-    stampReviewLines,
-    compareReviewPopulation,
 };