@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/bin/lib/vault-trace.cjs

@@ -5,8 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 /**
  * src/vault-trace.cts — the vault practice-trace envelope: the frozen
  * contract's constants, the statement builder, the frontmatter serializer,
- * the `## Practices Applied` renderer, the bespoke block parser, and the
- * pure validators a trace gate composes.
+ * the `## Practices Applied` renderer, and the bespoke block parser
+ * (Vault Assurance #71924, Phase 03-01).
  *
  * Responsibility (Phase 03-01 — task 1, the frozen half):
  *   The five constants below ARE the contract. `docs/vault-trace-format.md`
@@ -17,10 +17,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *   could move is not a version marker.
  *
  * Reuses (no new runtime dependency):
- *   - `./vault.cjs` (`computeVaultVerdict`, `readManifest`) — the pin's state
- *     is the vault verdict's, and its values are READ through the existing
- *     manifest reader, never re-parsed here. A second reader would let the
- *     trace disagree with the load gate about one cache.
+ *   - `./vault.cjs` (`vaultStatus`, `readManifest`) — the pin is READ through
+ *     the existing manifest readers, never re-parsed here. A second manifest
+ *     parser would drift from the degrade path's prior-manifest spread and the
+ *     trace would then disagree with the gate that validates it.
  *   - `./vault-practices.cjs` (`matchPractices`, `boundedToken`) — the practice
  *     denominator is the matcher's return set, and the id bounding is the
  *     shared helper.
@@ -69,10 +69,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const vaultMod = require("./vault.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const practicesMod = require("./vault-practices.cjs");
+// 16-06 (D-35): the anchor grammar and the back-fill shape have ONE owner, the
+// seal leaf. Static and cycle-free: the seal leaf's top level imports only
+// `fs` and `path`, and it requires this module back lazily (D-41).
+const vault_seal_cjs_1 = require("./vault-seal.cjs");
 // The count cap is IMPORTED, never re-declared. `derivePracticeUniverse` below
 // must bound the recorded universe by the same number `discoverPracticeFiles`
 // bounds its return set by; a second literal here would be a second cap that
@@ -110,18 +115,14 @@ function collapseControlChars(value) {
  */
 const TRACE_STATEMENT_TYPE = 'https://in-toto.io/Statement/v1';
 /**
- * The custom predicate type, and the MAJOR version carrier. pp-core's own
- * namespace: every trace this engine WRITES carries exactly this URI. The URI
- * is an identifier, not an endpoint — nothing fetches it.
- *
- * READERS accept this URI plus any URI the project's org profile lists under
- * `vault.trace.accepted_predicates` (`acceptedPredicateTypes`), so a project
- * that switches engine mid-engagement keeps reading the traces its earlier
- * engine wrote. An accepted URI must carry the same major as this one
- * (`/v<TRACE_SCHEMA_VERSION>`): the URI major and the schema version move
- * together, or not at all.
+ * The custom predicate type, and the MAJOR version carrier. The namespace is
+ * Pareto-owned: `github.com/pareto000/pp-core` is the canonical home of this
+ * distribution. The URI is an identifier, not an endpoint — nothing fetches
+ * it. A separate distribution of this capability would need its OWN predicate
+ * namespace rather than reusing this one, which would otherwise attribute
+ * every trace in the fleet to an organisation that did not produce it.
  */
-const TRACE_PREDICATE_TYPE = 'https://pareto.ooo/attestation/vault-practice-trace/v1';
+const TRACE_PREDICATE_TYPE = 'https://github.com/pareto000/pp-core/attestation/vault-practice-trace/v1';
 /**
  * The schema version, mirroring the `PRACTICE_SCHEMA_VERSION` discipline in
  * `src/vault-practices.cts`. An integer, not a string. A consumer reading a
@@ -152,6 +153,159 @@ const TRACE_STATUS_VALUES = Object.freeze(['applied', 'not-applicable', 'deviate
  * calls and would return alternating results for the same input.
  */
 const TRACE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+// ─── The override: environment-only, by construction ──────────────────────────
+/**
+ * The per-run override reason (GATE-07 / D-14). A REASON, deliberately — not a
+ * boolean: the reason IS the switch, so it is structurally impossible to take
+ * the override without stating one.
+ *
+ * An ENVIRONMENT value, never a config key, on EVERY path. This is
+ * load-bearing, not stylistic: a config-settable override would be reachable
+ * from the org-profile allowlist that plan 02-04 widened, and one package
+ * publish could then disable every gate in the fleet at once. Nothing in this
+ * section reads configuration, and the property is pinned by a test that
+ * writes this key at three config levels, proves each write is readable back,
+ * and still expects a null override.
+ *
+ * NOTE for the next reader: `src/check-command-router.cts` carries the
+ * Phase-2 copy of this reader (`evaluateVaultOverride`), which is not exported
+ * and which a leaf module must not import (adapters import leaves; leaves
+ * never import adapters). THIS is the canonical home going forward — the
+ * router's copy is to be rewired to call this one when the router is next
+ * touched. The duplication is recorded here so it is not silently forked.
+ */
+const VAULT_OVERRIDE_ENV = 'PP_VAULT_OVERRIDE_REASON';
+/** Long enough that a placeholder is uncomfortable to type and obvious in review. */
+const VAULT_OVERRIDE_MIN_LENGTH = 20;
+/**
+ * THE SINGLE HOME OF THE REASON RULES (GATE-07's triad: a length floor, at
+ * least one letter, not a repeated character). Extracted from
+ * `evaluateTraceOverride` by Phase 7 (plan 07-01, OD-2) so that the two
+ * places a bypass reason can enter the engine share one implementation:
+ *
+ *   - the trace override — ENV-sourced, via `evaluateTraceOverride` below;
+ *   - `/pp-init`'s reachability-proof deferral (D-07-03) — CLI-sourced, via
+ *     `recordProbeDeferral` in `src/init-contract.cts`.
+ *
+ * The point of the extraction is that a future tightening of what counts as
+ * a real reason lands in ONE place and applies to both. Re-deriving these
+ * checks in a second module is what `tests/vault-status-check.test.cjs`'s
+ * SINGLE IMPLEMENTATION guard exists to catch; this function is the
+ * sanctioned way to reuse them.
+ *
+ * The caller owns trimming and owns where the string came from — this
+ * function judges a reason and nothing else.
+ */
+function validateOverrideReason(reason) {
+    if (reason.length < VAULT_OVERRIDE_MIN_LENGTH) {
+        return {
+            state: 'rejected',
+            rejection: `the reason is ${reason.length} characters; at least ${VAULT_OVERRIDE_MIN_LENGTH} are required`,
+        };
+    }
+    if (!/[A-Za-z]/.test(reason)) {
+        return { state: 'rejected', rejection: 'the reason contains no letters' };
+    }
+    // A single character repeated ("aaaaaaaa…") is a placeholder, not a reason.
+    if (new Set(reason.replace(/\s/g, '')).size <= 2) {
+        return { state: 'rejected', rejection: 'the reason is a repeated character, not an explanation' };
+    }
+    return { state: 'accepted', reason };
+}
+function evaluateTraceOverride() {
+    const raw = process.env[VAULT_OVERRIDE_ENV];
+    if (typeof raw !== 'string' || raw.trim() === '')
+        return { state: 'absent' };
+    return validateOverrideReason(raw.trim());
+}
+/**
+ * The override reason is operator-supplied, not manifest-sourced, but it still
+ * becomes durable record content — so it gets the same newline/control-
+ * character collapse and length bound the enforcer's message applies.
+ */
+function sanitizeOverrideReason(reason) {
+    const flat = reason.replace(/[\u0000-\u001F\u007F]+/g, ' ').replace(/\s+/g, ' ').trim();
+    return flat.length > 200 ? `${flat.slice(0, 200)}…` : flat;
+}
+/**
+ * Resolve who took the override (D-14's `who`). No existing helper in this
+ * repository resolves an author identity — `src/vault-write-back.cts` only
+ * SETS `user.name` on a throwaway clone — so this is new code, and its
+ * fallback chain is stated here rather than left to be inferred:
+ *
+ *   1. `git config user.name` in the project — the identity that will appear
+ *      on the commits this run produces, so the override and the work it
+ *      unblocked are attributable to the same name. Read through
+ *      `execGitLocal` (D-116), so it is the cwd repository's identity, never
+ *      that of a repository an inherited `GIT_DIR` names.
+ *   2. `GIT_AUTHOR_NAME`, then `USER`, then `USERNAME` — a CI runner often has
+ *      no git identity configured but does export one of these.
+ *   3. A literal `unknown` marker. NEVER an empty string and never an omitted
+ *      key: "we did not record who" must be readable as a fact, because an
+ *      absent `who` and an unattributable one would otherwise look identical.
+ *
+ * Never throws: `execGitLocal` is a bounded `spawnSync` that reports ENOENT and
+ * timeouts as a result rather than an exception.
+ */
+function resolveOverrideIdentity(cwd) {
+    try {
+        const res = (0, shell_command_projection_cjs_1.execGitLocal)(['config', 'user.name'], { cwd, timeout: 5_000 });
+        if (res.exitCode === 0 && res.stdout.trim() !== '')
+            return boundedToken(res.stdout.trim());
+    }
+    catch {
+        /* fall through to the environment */
+    }
+    for (const key of ['GIT_AUTHOR_NAME', 'USER', 'USERNAME']) {
+        const v = process.env[key];
+        if (typeof v === 'string' && v.trim() !== '')
+            return boundedToken(v.trim());
+    }
+    return 'unknown';
+}
+/**
+ * Build the override record, or null.
+ *
+ * Null in three distinct situations, and they are deliberately collapsed to
+ * one value because they share a meaning — "no bypass happened here":
+ *   - no override context at all;
+ *   - a context whose verdict did NOT block (recording one would manufacture
+ *     evidence of a bypass that never happened);
+ *   - an environment value that is absent or REFUSED (a refused override does
+ *     not suppress anything — the block stands — so there is nothing to record).
+ */
+function buildOverrideRecord(cwd, ctx, when) {
+    if (!ctx || ctx.block !== true)
+        return null;
+    const ov = evaluateTraceOverride();
+    if (ov.state !== 'accepted')
+        return null;
+    return {
+        gate: boundedToken(ctx.gate),
+        reason: sanitizeOverrideReason(ov.reason),
+        suppressedReason: boundedToken(ctx.suppressedReason),
+        who: resolveOverrideIdentity(cwd),
+        when,
+    };
+}
+/**
+ * The override record for a standards record (15-07, D-08): the SAME builder
+ * above, with the timestamp taken here, now. It exists so the standards block
+ * verb reaches `buildOverrideRecord` without that function joining the export
+ * surface, which two tests pin closed: a caller of this wrapper can no more
+ * choose `when` than a caller of `buildTraceStatement` can. The validation,
+ * sanitisation and identity chain are not restated; this is one call.
+ */
+function buildStandardsOverrideRecord(cwd, ctx) {
+    return buildOverrideRecord(cwd, ctx, new Date().toISOString());
+}
+/**
+ * The eighth degraded cause's reason (quick 261015-at3, QD-05/QD-07). Contract
+ * surface, exported so the degraded-cause tests HARVEST it rather than restate
+ * it. Phrased outside `unprovablePairTail`'s miss/stale/tier substrings; it is
+ * routed to its own lead there (the repair is the mode, not a fetch).
+ */
+const TRACE_REASON_STANDARDS_ONLY = 'vault holds standards (INDEX.md) and no practice files, but vault.mode is practices; no practice was read — set vault.mode to standards (pp-core 1.16.0 or later) and re-plan';
 const NULL_PIN = Object.freeze({
     ref: null,
     resolvedSha: null,
@@ -160,113 +314,210 @@ const NULL_PIN = Object.freeze({
     repo: null,
 });
 /**
- * The degraded reason sentences, one per cause. Contract surface: the format
- * page lists them, and a reader six months later needs to know WHICH failure
- * a degraded trace records. Every interpolated value is bounded.
- */
-const PIN_REASON = Object.freeze({
-    noCache: 'no vault cache present at .planning/vault',
-    manifestMissing: 'vault manifest missing at .planning/vault/.manifest.json',
-    manifestMalformed: 'vault manifest unreadable or malformed at .planning/vault/.manifest.json',
-    miss: 'vault manifest records a miss; no vault content was reached',
-    empty: 'vault cache holds no files; no vault content was reached',
-    noBindings: 'no client vault is bound (.platform-bindings.json needs client.vaultRepo and client.vaultRef); '
-        + 'only a client-tier load at the configured ref records loaded',
-    configUnreadable: 'the project config cannot be read, so the vault state is unknown',
-    disabled: 'vault.enabled is not true',
-});
-/**
- * Read the pin. The STATE is the vault verdict's — `computeVaultVerdict` in
- * src/vault.cts is the one owner of "is the client vault loaded" (pack 6), so
- * the trace and the load gate cannot disagree about one cache: `loaded`
- * exactly when the verdict is `loaded` (the client tier, at the configured
- * repo and ref, fresh). The pin VALUES (ref, sha, tier, source, repo) are
- * read from the same cache's manifest through `readManifest`, which already
- * returns the display-safe repo; this module parses `.manifest.json` nowhere.
+ * Read the pin THROUGH the existing readers — `vaultStatus` for the freshness
+ * signal it already computes from `vault.cache_ttl_hours`, and `readManifest`
+ * for `repo`, which the status shape does not carry. This module opens
+ * `.manifest.json` nowhere: a second manifest parser would drift from the
+ * degrade path's prior-manifest spread, and the trace would then disagree with
+ * the gate that validates it. For the same reason it reads the CONFIGURED
+ * coordinates nowhere either — the drift arm below asks the verdict leaf's
+ * `resolveRefDrift`, the one owner of that predicate (D-08-35).
  *
  * A degraded run is a FIRST-CLASS path, not an error branch — the caller
- * always gets a pin object, and a statement is always produced. A stale,
- * fallback-tier or drifted cache keeps its pin: the cached copy really did
- * come from that SHA, and only the reason says why it does not prove the
- * configured standards were applied.
- *
- * WORKTREES. `vaultDirPath` is the directory `buildTraceStatement` resolved
- * once through `vaultMod.resolveVaultCacheDir`: the local `.planning/vault`,
- * or, for the root of a linked git worktree with no local manifest, the
- * owning main checkout's cache. The verdict is judged against that same
- * directory.
+ * always gets a pin object, and a statement is always produced.
+ *
+ * WORKTREES (260915-ms2, UAT-6-F3). `vaultDirPath` is the directory
+ * `buildTraceStatement` resolved ONCE through `vaultMod.resolveVaultCacheDir`:
+ * the local `<cwd>/.planning/vault`, or — only for the root of a linked git
+ * worktree with no local manifest — the owning main checkout's cache, located
+ * with `git rev-parse --git-common-dir`. A main checkout's own `.git` is a
+ * directory, so it never asks git and can never recurse into itself. A project
+ * whose main checkout has no cache still resolves the local path and degrades
+ * with the same reasons as before. The three reason strings below are
+ * deliberately unchanged whichever directory was read: they are contract
+ * surface pinned by the frozen document's degraded-cause list.
+ *
+ * FIVE reason strings now, not three (D-08-25, then D-08-34): the tier arm's
+ * sentence and the ref-drift arm's join them as contract surface, pinned by the
+ * same degraded-cause list and by the tail's seven-reason loop. The three that
+ * predate them are unchanged — they are quoted verbatim in two other suites and
+ * in the frozen document.
+ *
+ * EIGHT degraded causes in all (quick 261015-at3 adds the last,
+ * `TRACE_REASON_STANDARDS_ONLY`): a client-tier cache at the configured ref,
+ * fresh, that holds standards (INDEX.md) and no practice files, read in
+ * practices mode. It sits LAST, after the stale arm and immediately before
+ * `loaded` (QD-05): every earlier arm says the cache is not the configured
+ * client vault, or not a current copy of it; this one says it IS, read in a
+ * mode it cannot serve. The union stays frozen (A3).
  */
 function resolvePin(cwd, vaultDirPath = node_path_1.default.join(cwd, '.planning', 'vault')) {
-    const v = vaultMod.computeVaultVerdict(cwd, { vaultDir: vaultDirPath });
-    const manifest = vaultMod.readManifest(vaultDirPath);
-    const str = (x) => (typeof x === 'string' && x !== '' ? x : null);
-    const pin = manifest
-        ? {
-            ref: str(manifest.ref),
-            resolvedSha: str(manifest.resolvedSha),
-            tier: str(manifest.tier),
-            source: str(manifest.source),
-            repo: vaultMod.redactCloneTarget(str(manifest.repo)),
+    const status = vaultMod.vaultStatus(cwd, { vaultDir: vaultDirPath });
+    if (!status.present) {
+        // `vaultStatus` collapses every problem to `{present:false}`, so name the
+        // actual failure here — an operator reading a degraded trace six months
+        // later needs to know WHICH of these it was.
+        let reason;
+        if (!node_fs_1.default.existsSync(vaultDirPath)) {
+            reason = 'no vault cache present at .planning/vault';
+        }
+        else if (!node_fs_1.default.existsSync(node_path_1.default.join(vaultDirPath, '.manifest.json'))) {
+            reason = 'vault manifest missing at .planning/vault/.manifest.json';
         }
-        : { ...NULL_PIN };
-    if (v.verdict === 'loaded') {
+        else {
+            reason = 'vault manifest unreadable or malformed at .planning/vault/.manifest.json';
+        }
+        return { state: 'degraded', reason, ...NULL_PIN, manifestFiles: null };
+    }
+    const manifest = vaultMod.readManifest(vaultDirPath);
+    const pin = {
+        ref: status.ref ?? null,
+        resolvedSha: status.resolvedSha ?? null,
+        tier: status.tier ?? null,
+        source: status.source ?? null,
+        repo: manifest && manifest.repo ? manifest.repo : null,
+    };
+    // One owner for the miss predicate (261003-jby's `manifestRecordsMiss`; this
+    // copy adopted it in 261003-j89 as the follow-up that change recorded).
+    if (vaultMod.manifestRecordsMiss(status)) {
         return {
-            state: 'loaded',
-            reason: null,
+            state: 'degraded',
+            reason: 'vault manifest records a miss; no vault content was reached',
             ...pin,
-            manifestFiles: manifest && Array.isArray(manifest.files)
-                ? manifest.files.filter((f) => typeof f === 'string')
-                : [],
+            manifestFiles: null,
         };
     }
-    let reason;
-    switch (v.reason) {
-        case 'never_fetched':
-            if (!node_fs_1.default.existsSync(vaultDirPath))
-                reason = PIN_REASON.noCache;
-            else if (!node_fs_1.default.existsSync(node_path_1.default.join(vaultDirPath, '.manifest.json')))
-                reason = PIN_REASON.manifestMissing;
-            else
-                reason = PIN_REASON.manifestMalformed;
-            break;
-        case 'fetch_miss':
-            reason = vaultMod.manifestRecordsMiss(manifest) ? PIN_REASON.miss : PIN_REASON.empty;
-            break;
-        case 'fallback_tier':
-            reason =
-                `vault loaded on the ${boundedToken(pin.tier ?? 'unknown')} tier `
-                    + `(${boundedToken(pin.repo ?? 'no repo recorded')}); no client standards were applied `
-                    + '— only a client-tier load records loaded';
-            break;
-        case 'ref_drift':
-            // Both refs come FIRST so they survive an 80-character head, and both go
-            // through `boundedToken`: a ref is project-authored text reaching an
-            // agent's context unfenced.
-            reason = pin.ref !== v.configuredRef
-                ? `vault cache was fetched from ref ${boundedToken(pin.ref ?? 'unknown')} `
-                    + `but client.vaultRef is now ${boundedToken(v.configuredRef ?? 'unknown')}; `
-                    + 'the cached standards are not the configured ones — only a client-tier load '
-                    + 'at the configured ref records loaded'
-                : `vault cache was fetched from ${boundedToken(pin.repo ?? 'unknown')} `
-                    + `but client.vaultRepo is now ${boundedToken(v.configuredRepo ?? 'unknown')}; `
-                    + 'the cached standards are not the configured ones — only a client-tier load '
-                    + 'at the configured repo records loaded';
-            break;
-        case 'stale_cache':
-            reason =
-                `vault cache is stale (fetched ${boundedToken(str(manifest?.fetchedAt) ?? 'unknown')}); `
-                    + 'it exceeds vault.cache_ttl_hours';
-            break;
-        case 'no_bindings':
-            reason = PIN_REASON.noBindings;
-            break;
-        case 'config_unreadable':
-            reason = PIN_REASON.configUnreadable;
-            break;
-        default:
-            reason = PIN_REASON.disabled;
+    // D-08-25 / HGATE-08 (RESEARCH M8, reproduced live through this same
+    // writer). `state` tracked STALENESS only, so every present, non-miss,
+    // fresh manifest returned `loaded` whatever tier had actually loaded — and
+    // arms 9, 10 and 12 of the v1.0 UAT duly wrote `state: loaded, reason: null`,
+    // the strongest statement this schema can make, for a load that applied NO
+    // client standards. The shared vault being reachable is not the client's
+    // vault being governed.
+    //
+    // ORDER, BOTH SIDES. After the miss arm: a miss reached no vault at all and
+    // so has no tier worth naming — "loaded on the unknown tier" would misreport
+    // a fetch that never landed. Before the stale arm: the tier is the STRONGER
+    // fact. A stale fallback cache is still not the client's vault, and its age
+    // is the lesser of the two problems; the load gate's own suffix keeps
+    // reporting that age, so nothing is lost by leading with the tier here.
+    //
+    // The pin SURVIVES, for the stale arm's reason below: the shared vault
+    // really was read at that SHA.
+    //
+    // The union stays FROZEN at `'loaded' | 'degraded'` (Assumption A3). A third
+    // state would be a schema-version change and would leave every existing
+    // consumer — `VAULT_STATE_INVALID`, the strict coverage gate — with a value
+    // it has no rule for. Routing the tier to `degraded` with a reason that
+    // names it is the smaller change and the honest one: nothing here is proven.
+    if (status.tier !== 'client') {
+        return {
+            state: 'degraded',
+            reason: `vault loaded on the ${boundedToken(status.tier ?? 'unknown')} tier `
+                + `(${boundedToken(pin.repo ?? 'no repo recorded')}); no client standards were applied `
+                + '— only a client-tier load records loaded',
+            ...pin,
+            manifestFiles: null,
+        };
+    }
+    // D-08-34 / HGATE-08 (UAT F5, reproduced live through this same writer).
+    // `state` knew about the manifest's presence, its source, its tier and its
+    // age — and nothing about the ref the project CONFIGURES. So a client-tier
+    // cache fetched from a ref the project has since re-pinned recorded
+    // `state: loaded, reason: null`, byte-identical to the no-drift control: the
+    // strongest statement this schema can make, for a vault that is not the
+    // client's currently configured standards. Measured under `vault.required:
+    // false` — the SCHEMA DEFAULT, and the posture where D-08-29 keeps the status
+    // envelope thin, leaving this trace as the only durable record of the load.
+    //
+    // The tier arm's own principle applies unchanged: a cache from an
+    // unconfigured ref is the same class of untruth as a reachable shared vault.
+    //
+    // ORDER, BOTH SIDES. AFTER the tier arm, because a fallback manifest's `ref`
+    // belongs to the SHARED vault and is not a client pin to drift from — sending
+    // that reader to fetch a configured ref would point them at the wrong vault
+    // entirely. (The owner's TIER gate answers `false` there anyway, so this is
+    // belt and braces; the ORDER test pins it so a reorder is loud.) BEFORE the
+    // stale arm, on D-08-23's ground, quoted verbatim from the verdict: drift is
+    // reported ahead of staleness "because it is the more specific fact — a stale
+    // cache from a ref the project has re-pinned is not made relevant by
+    // re-fetching that same ref". The verdict already orders them that way, and
+    // two surfaces telling different stories about one cache is the defect class
+    // D-08-35 exists to close.
+    //
+    // The pin SURVIVES, for the stale arm's reason below: the cache really did
+    // come from that SHA. "degraded" is not "no pin".
+    //
+    // The union stays FROZEN at `'loaded' | 'degraded'` (Assumption A3), so
+    // `VAULT_STATE_INVALID` and the strict coverage gate need no new rule —
+    // both key on `state`, neither enumerates causes.
+    //
+    // THE OWNER IS CALLED THROUGH `vaultMod` AT CALL TIME, not destructured at
+    // module scope, and that is deliberate rather than an oversight a later tidy-
+    // up should "fix": it is what lets `SEAM (D-08-35)` stub the owner and prove
+    // this arm consumes it. A behaviour test cannot tell one owner from two
+    // identical copies, and this phase has shipped that exact defect four times.
+    // `computeVaultVerdict` is NOT called here and must not be: since 08-10 it
+    // short-circuits on `vault.enabled` and resolves `vault.required`, and a trace
+    // that consulted policy would stop recording drift on exactly the
+    // default-config projects F5 was measured on.
+    const drift = vaultMod.resolveRefDrift({
+        cwd, tier: status.tier ?? null, cachedRef: status.ref ?? null,
+    });
+    if (drift.refDrift) {
+        return {
+            state: 'degraded',
+            // Both refs come FIRST so they survive the 80-character head the
+            // strict-point tail is budgeted against, and both go through
+            // `boundedToken` because a ref is project-authored text reaching an
+            // agent's context unfenced (T-08-54). Phrased outside `unprovablePairTail`'s
+            // three classifier substrings on purpose (D-08-36): this cause belongs to
+            // the re-fetch-first lead, because `vault fetch` reads the CONFIGURED ref.
+            reason: `vault cache was fetched from ref ${boundedToken(status.ref ?? 'unknown')} `
+                + `but client.vaultRef is now ${boundedToken(drift.configuredRef ?? 'unknown')}; `
+                + 'the cached standards are not the configured ones — only a client-tier load '
+                + 'at the configured ref records loaded',
+            ...pin,
+            manifestFiles: null,
+        };
+    }
+    if (status.stale === true) {
+        // The pin SURVIVES a stale cache: the cached copy really did come from
+        // that SHA. "degraded" is not "no pin", and a validator that nulled the
+        // pin here would lose the only provable thing about the run.
+        return {
+            state: 'degraded',
+            reason: `vault cache is stale (fetched ${boundedToken(status.fetchedAt ?? 'unknown')}); it exceeds vault.cache_ttl_hours`,
+            ...pin,
+            manifestFiles: null,
+        };
+    }
+    // Quick 261015-at3 (QD-05, Vince 2026-10-15): the configured client vault,
+    // fresh, read in a mode it cannot serve — a standards vault (INDEX.md, no
+    // practice files) read in practices mode. Before this arm it recorded
+    // `loaded` with an empty universe: the strongest statement the schema allows,
+    // for a run in which no practice was read. The pin SURVIVES (the cache really
+    // was read at that SHA); the universe does not (D-04).
+    //
+    // THE OWNER IS CALLED THROUGH `practicesMod` AT CALL TIME, on the D-08-35
+    // seam argument verbatim: a test stubs `discoverPracticeFiles` and proves this
+    // arm consumes the owner rather than a re-derived copy of the predicate.
+    if (practicesMod.discoverPracticeFiles(cwd, vaultDirPath).vaultStandardsOnly === true) {
+        return {
+            state: 'degraded',
+            reason: TRACE_REASON_STANDARDS_ONLY,
+            ...pin,
+            manifestFiles: null,
+        };
     }
-    return { state: 'degraded', reason, ...pin, manifestFiles: null };
+    return {
+        state: 'loaded',
+        reason: null,
+        ...pin,
+        manifestFiles: manifest && Array.isArray(manifest.files)
+            ? manifest.files.filter((f) => typeof f === 'string')
+            : [],
+    };
 }
 // ─── The universe ──────────────────────────────────────────────────────────────
 /** The manifest-relative directory prefix under which practice files live. */
@@ -497,83 +748,10 @@ function deriveCheckBearingCensus(universe, facts) {
     }
     return checkBearing;
 }
-/** At most this many PLAN/SUMMARY artifacts are read for the census. */
-const CENSUS_ARTIFACT_CAP = 200;
-/** Each artifact is read whole or not at all, up to this many bytes. */
-const CENSUS_ARTIFACT_BYTE_CAP = 1024 * 1024;
-/**
- * Read the `check:` census this phase's ledgers RECORDED — never re-derive it.
- *
- * The census is taken once, by `buildTraceStatement`, against the pinned vault
- * the plan or summary was written under. A consumer (the mechanical audit)
- * reads that record back here instead of counting the vault again: a second
- * count could describe a different vault than the ledger does.
- *
- * Execute-stage ledgers (SUMMARY.md) are preferred over plan-stage ones, and
- * within a stage the last artifact in name order — the latest plan — is the
- * one reported. `distinct` counts how many different censuses the phase's
- * ledgers record, so a vault that moved during the phase is visible. A ledger
- * with no census (a degraded run) is skipped. `null` when no ledger records
- * one. Pure read; never throws.
- */
-function readRecordedCensus(phaseDir) {
-    try {
-        const names = node_fs_1.default
-            .readdirSync(phaseDir)
-            .filter((name) => /(^|-)(PLAN|SUMMARY)\.md$/.test(name))
-            .sort()
-            .slice(0, CENSUS_ARTIFACT_CAP);
-        const found = [];
-        for (const name of names) {
-            const abs = node_path_1.default.join(phaseDir, name);
-            let content;
-            try {
-                const stat = node_fs_1.default.lstatSync(abs);
-                if (!stat.isFile() || stat.size > CENSUS_ARTIFACT_BYTE_CAP)
-                    continue;
-                content = node_fs_1.default.readFileSync(abs, 'utf8');
-            }
-            catch {
-                continue;
-            }
-            const parsed = parseVaultTraceBlock(content, name);
-            const vault = parsed.present && parsed.statement ? parsed.statement.predicate?.vault : null;
-            if (!vault)
-                continue;
-            const census = vault.checkBearingPractices;
-            if (typeof census !== 'number' || !Number.isInteger(census) || census < 0)
-                continue;
-            if (!Array.isArray(vault.practiceUniverse))
-                continue;
-            found.push({
-                census,
-                universe: vault.practiceUniverse.length,
-                sha: typeof vault.resolvedSha === 'string' ? vault.resolvedSha : null,
-                artifact: name,
-                execute: /(^|-)SUMMARY\.md$/.test(name),
-            });
-        }
-        if (found.length === 0)
-            return null;
-        const pool = found.some((f) => f.execute) ? found.filter((f) => f.execute) : found;
-        const chosen = pool[pool.length - 1];
-        const distinct = new Set(found.map((f) => `${f.census}/${f.universe}/${f.sha ?? ''}`)).size;
-        return {
-            checkBearingPractices: chosen.census,
-            practiceUniverse: chosen.universe,
-            resolvedSha: chosen.sha,
-            artifact: chosen.artifact,
-            distinct,
-        };
-    }
-    catch {
-        return null;
-    }
-}
 // ─── The builder ───────────────────────────────────────────────────────────────
 /**
  * The statement note recorded when the cache was read from the owning main git
- * worktree (worktree executors). A fact, never a path.
+ * worktree (260915-ms2, UAT-6-F3). A fact, never a path.
  */
 const TRACE_WORKTREE_CACHE_NOTE = 'vault cache read from the owning main git worktree; this checkout carries no local .planning/vault';
 /**
@@ -589,7 +767,7 @@ function buildTraceStatement(opts) {
     const files = Array.isArray(opts.files) ? opts.files : [];
     const notes = [];
     const generatedAt = new Date().toISOString();
-    // ONE cache directory for the pin AND the matcher (worktree executors), so
+    // ONE cache directory for the pin AND the matcher (260915-ms2, UAT-6-F3), so
     // the practice set and the ref it is recorded against come from one vault.
     const cache = vaultMod.resolveVaultCacheDir(cwd);
     if (cache.source === 'main-worktree') {
@@ -670,7 +848,7 @@ function buildTraceStatement(opts) {
             const clause = pinnedFacts.clauseById.get(id);
             if (typeof clause === 'string' && clause !== '')
                 entry.enforcedBy = clause;
-            // THE TEXT DIGEST (D-05-07). Digested from the SAME unwrapped excerpt
+            // THE TEXT DIGEST (261003-j89). Digested from the SAME unwrapped excerpt
             // `renderPracticeEntry` places under `ask:`/`excerpt:` in the body block
             // — `unwrapFencedExcerpt` is the practices module's own, exported for
             // exactly this, so the two readers cannot strip the fence differently.
@@ -691,6 +869,18 @@ function buildTraceStatement(opts) {
         // never worth losing to an unexpected read failure.
         notes.push(`practice matching failed: ${boundedToken(e.message)}`);
     }
+    // 16-06: the anchors sit right after `generatedAt`, the order the serializer
+    // writes them in; the spread of an empty object adds no key, so a plan-stage
+    // statement is the object it was before.
+    const anchorFields = {};
+    if (stage === 'execute' && opts.anchors) {
+        if (typeof opts.anchors.startCommit === 'string' && vault_seal_cjs_1.ANCHOR_SHA_RE.test(opts.anchors.startCommit)) {
+            anchorFields.startCommit = opts.anchors.startCommit;
+        }
+        if (typeof opts.anchors.endCommit === 'string' && vault_seal_cjs_1.ANCHOR_SHA_RE.test(opts.anchors.endCommit)) {
+            anchorFields.endCommit = opts.anchors.endCommit;
+        }
+    }
     return {
         _type: TRACE_STATEMENT_TYPE,
         predicateType: TRACE_PREDICATE_TYPE,
@@ -700,6 +890,7 @@ function buildTraceStatement(opts) {
             stage,
             plan,
             generatedAt,
+            ...anchorFields,
             vault: {
                 state: pin.state,
                 reason: pin.reason,
@@ -713,35 +904,10 @@ function buildTraceStatement(opts) {
             },
             practices,
             notes,
-            override: null,
+            override: buildOverrideRecord(cwd, opts.override, generatedAt),
         },
     };
 }
-// ─── The reader allowlist ──────────────────────────────────────────────────────
-/**
- * The predicate types a trace READER accepts for the project at `cwd`:
- * `TRACE_PREDICATE_TYPE` first, then each URI the org profile lists under
- * `vault.trace.accepted_predicates` that carries the same major
- * (`/v<TRACE_SCHEMA_VERSION>`). A listed URI of another major is ignored —
- * the URI major and the schema version move together. Never throws; writers
- * never call it.
- */
-function acceptedPredicateTypes(cwd) {
-    const out = [TRACE_PREDICATE_TYPE];
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const orgProfile = require('./org-profile.cjs');
-        const majorSuffix = `/v${TRACE_SCHEMA_VERSION}`;
-        for (const uri of orgProfile.resolveAcceptedTracePredicates(cwd)) {
-            if (typeof uri === 'string' && uri.endsWith(majorSuffix) && !out.includes(uri))
-                out.push(uri);
-        }
-    }
-    catch {
-        /* no profile reader: pp-core's own type only */
-    }
-    return out;
-}
 // ─── The serializer ────────────────────────────────────────────────────────────
 const INDENT = '  ';
 /**
@@ -820,6 +986,12 @@ function serializeTraceBlock(statement) {
     lines.push(scalarLine(2, 'stage', p.stage));
     lines.push(scalarLine(2, 'plan', p.plan));
     lines.push(scalarLine(2, 'generatedAt', p.generatedAt));
+    // 16-06 (D-35): the anchors, right after `generatedAt`. NOTHING is emitted
+    // for an absent key, so a plan-stage ledger and a pre-16 ledger keep their
+    // bytes (golden-pinned). Re-validated at emit time on the id filter's rule:
+    // a value that is not an anchor is dropped WITH a note, never written as a
+    // commit a later gate would place in a git argv.
+    lines.push(...anchorLines(p, notes));
     lines.push(`${INDENT.repeat(2)}vault:`);
     lines.push(scalarLine(3, 'state', p.vault.state));
     lines.push(scalarLine(3, 'reason', p.vault.reason));
@@ -902,7 +1074,7 @@ function serializeTraceBlock(statement) {
             const clause = defangFenceMarkers(renderSafeField(entry.enforcedBy));
             if (clause !== '')
                 lines.push(scalarLine(4, 'enforcedBy', clause));
-            // The text digest (D-05-07), between `enforcedBy` and `tasks`. NOTHING
+            // The text digest (261003-j89), between `enforcedBy` and `tasks`. NOTHING
             // is emitted when the entry carries none, so a ledger written from a
             // statement without digests keeps the shape it had. Re-validated at emit
             // time on the same rule as the id filter: only a 64-character lowercase
@@ -943,6 +1115,60 @@ function serializeTraceBlock(statement) {
     // `collectBlockLines` already skips.
     return `${lines.join('\n')}\n`;
 }
+/**
+ * The predicate's anchor lines (16-06), in the one order they are written and
+ * back-filled: `startCommit`, `endCommit`, then the `anchorBackfill` block.
+ * Exported (as `traceAnchorLines`) so `vault anchor backfill` splices exactly
+ * the lines the serializer would have written, never a second spelling.
+ */
+function anchorLines(p, notes) {
+    const out = [];
+    for (const key of ['startCommit', 'endCommit']) {
+        const v = p[key];
+        if (v === undefined || v === null)
+            continue;
+        if (typeof v === 'string' && vault_seal_cjs_1.ANCHOR_SHA_RE.test(v))
+            out.push(scalarLine(2, key, v));
+        else
+            notes.push(`${key} dropped at serialize time: not a full lowercase commit id`);
+    }
+    const b = p.anchorBackfill;
+    if (b !== undefined && b !== null) {
+        if ((0, vault_seal_cjs_1.isAnchorBackfill)(b)) {
+            out.push(`${INDENT.repeat(2)}anchorBackfill:`);
+            out.push(scalarLine(3, 'by', b.by));
+            out.push(scalarLine(3, 'at', b.at));
+        }
+        else {
+            notes.push('anchorBackfill dropped at serialize time: not { by, at }');
+        }
+    }
+    return out;
+}
+/**
+ * The anchor lines a back-fill splices into an existing ledger, after its
+ * `generatedAt` line (16-06, D-32). The SAME `anchorLines` the serializer
+ * uses, so a later `trace render` round trip of the back-filled ledger and a
+ * fresh serialization of the same statement agree. Throws on a value that
+ * would be dropped: the back-fill verb validated it first, so a throw is an
+ * engine bug.
+ */
+function traceAnchorLines(anchors) {
+    const notes = [];
+    const out = anchorLines(anchors, notes);
+    if (notes.length > 0)
+        throw new Error(`traceAnchorLines: ${notes[0]}`);
+    return out;
+}
+/**
+ * The `by` a back-fill records: the trace's one identity chain
+ * (`resolveOverrideIdentity`: `git config user.name`, then the environment,
+ * then `unknown`), normalised by the seal leaf so it is accepted by both record
+ * families' parsers.
+ */
+function resolveBackfillIdentity(cwd) {
+    return (0, vault_seal_cjs_1.normaliseAnchorBackfillWho)(resolveOverrideIdentity(cwd));
+}
 // ─── The rendered surface ──────────────────────────────────────────────────────
 const PRACTICES_APPLIED_HEADING = '## Practices Applied';
 /**
@@ -979,6 +1205,12 @@ function renderSafeField(value) {
         ? `${flat.slice(0, TRACE_RENDERED_FIELD_MAX)}…`
         : flat;
 }
+/**
+ * The rendered line for an empty ledger whose trace is DEGRADED (quick
+ * 261015-at3). Constant text: the recorded `reason` is artifact text and is not
+ * echoed into a section another agent reads unfenced.
+ */
+const TRACE_DEGRADED_RENDER_LINE = 'No client-vault practice was read for this plan: its recorded vault trace is degraded (see its `reason`), so no practice is recorded here as applied or as out of scope.';
 /**
  * Render the `## Practices Applied` section from the ledger.
  *
@@ -995,6 +1227,15 @@ function renderPracticesApplied(statement) {
     const entries = statement?.predicate?.practices ?? [];
     const lines = [PRACTICES_APPLIED_HEADING, ''];
     if (entries.length === 0) {
+        // Quick 261015-at3 (entry-point sweep): a DEGRADED ledger is empty because
+        // no practice was read, not because none was in scope — "were in scope" is
+        // a claim about a practice set that was never computed, written into a
+        // SUMMARY on every one of the eight degraded causes. The empty-and-loaded
+        // line below is unchanged (pinned byte-identical).
+        if (statement?.predicate?.vault?.state === 'degraded') {
+            lines.push(TRACE_DEGRADED_RENDER_LINE);
+            return lines.join('\n');
+        }
         // Never an empty section: D-04 requires a degraded or empty run to be
         // READABLE as a fact. An omitted section and an unrecorded one look
         // identical to every downstream reader.
@@ -1295,7 +1536,7 @@ function parseVaultTraceBlock(content, artifactPath = 'the artifact') {
         // parsed into then. An `undefined` property would not be that.
         if (typeof p.enforcedBy === 'string' && p.enforcedBy !== '')
             entry.enforcedBy = p.enforcedBy;
-        // Optional (D-05-07): reconstructed ONLY when the document carried it,
+        // Optional (261003-j89): reconstructed ONLY when the document carried it,
         // on the same reasoning as `enforcedBy` above.
         if (typeof p.textSha256 === 'string' && p.textSha256 !== '')
             entry.textSha256 = p.textSha256;
@@ -1340,6 +1581,33 @@ function parseVaultTraceBlock(content, artifactPath = 'the artifact') {
             when: asString(o.when),
         };
     }
+    // 16-06 (D-35): the optional anchors, reconstructed ONLY when the document
+    // carried them and they pass their grammar (the `enforcedBy` precedent), so a
+    // ledger written before 16-06 parses into the exact statement it did then. A
+    // key that is present but fails is DROPPED, and its NAME (never its value)
+    // is listed in `anchorsDropped`, so the validator can type it
+    // (`anchor_invalid`) and no caller ever reads it as a commit.
+    const anchorFields = {};
+    const dropped = [];
+    for (const key of ['startCommit', 'endCommit']) {
+        if (!(key in predicate))
+            continue;
+        const v = predicate[key];
+        if (typeof v === 'string' && vault_seal_cjs_1.ANCHOR_SHA_RE.test(v))
+            anchorFields[key] = v;
+        else
+            dropped.push(key);
+    }
+    if ('anchorBackfill' in predicate) {
+        const b = asObject(predicate.anchorBackfill);
+        const candidate = { by: b.by, at: b.at };
+        if ((0, vault_seal_cjs_1.isAnchorBackfill)(candidate))
+            anchorFields.anchorBackfill = { by: candidate.by, at: candidate.at };
+        else
+            dropped.push('anchorBackfill');
+    }
+    if (dropped.length > 0)
+        anchorFields.anchorsDropped = dropped;
     const statement = {
         _type: asString(root._type),
         predicateType: asString(root.predicateType),
@@ -1349,6 +1617,7 @@ function parseVaultTraceBlock(content, artifactPath = 'the artifact') {
             stage: asString(predicate.stage),
             plan: asString(predicate.plan),
             generatedAt: asString(predicate.generatedAt),
+            ...anchorFields,
             vault: {
                 state: asString(vault.state),
                 reason: asStringOrNull(vault.reason),
@@ -1498,13 +1767,25 @@ const EXECUTE_DIGEST_REMEDY = ' A governed file in this trace has no git commit,
  * validator now needs it too, and the handler already imports this module —
  * the reverse edge would be a cycle (the D-12 split's own lesson).
  *
- * The remedy names `pp_run`, the launcher every workflow binds in its
- * preamble and ships as `pp-core/bin/pp_run`, because a bare `pp-tools` can
- * resolve to a different install than the project's own. INVARIANT 1 derives
+ * UAT-4-F2: the remedy names `pp_run`, the launcher every workflow binds in
+ * its preamble and ships as `pp-core/bin/pp_run`, because a bare `pp-tools`
+ * resolved to a different install on a consultant machine. INVARIANT 1 derives
  * its floor from the command's first token, so the floor moved with the rename.
  * The literal pins live in the two vault-trace suites and vault-status-check.
  */
 const TRACE_REGENERATE_COMMAND = 'pp_run vault trace scaffold --stage <plan|execute> --plan <plan-id> <files_modified...>';
+/**
+ * The trusted tail of every `anchor_invalid` detail: the repair, never a
+ * deletion. 16 review WR-03: it names only a repair that cannot widen
+ * coverage, restoring the value the CLI wrote. Regenerating the ledger is NOT
+ * offered (16-06 offered it): it records today's HEAD as the end, so the
+ * record would claim every commit since its real end, the restamp D-32
+ * forbids and D-63 removed from the SEAL-01 footer for the same reason. A
+ * back-fill is not offered either: the verb refuses a record that carries an
+ * anchor, malformed or not (D-61), so naming it would be a remedy that cannot
+ * clear the problem. A value that cannot be recovered is the operator's call.
+ */
+const TRACE_ANCHOR_TAIL = ' Restore the value exactly as the CLI wrote it when the record was made; an anchor is written by the CLI, never typed. Regenerating the ledger is not a repair here: it would record today\'s HEAD as the end and claim commits this record never covered. If the value cannot be recovered, the operator decides how this record is re-anchored.';
 /**
  * Stable, machine-readable problem kinds. A consumer branches on these; the
  * `detail` string is for a human and is not a contract.
@@ -1665,11 +1946,11 @@ const TRACE_PROBLEM_KIND = Object.freeze({
     ID_UNRESOLVED: 'practice_id_unresolved',
     STATUS_OUT_OF_VOCABULARY: 'status_out_of_vocabulary',
     DEVIATED_REASON_MISSING: 'deviated_reason_missing',
-    // ── THE BODY-BLOCK FAMILY (D-05-07) ────────────────────
+    // ── THE BODY-BLOCK FAMILY (261003-j89; closes D-05-07) ────────────────────
     //
     // Seven kinds that compare the `vault:` LEDGER against the `<vault_practices>`
-    // BODY BLOCK of the same plan artifact. Measured on a fresh project: seven
-    // perturbations that removed or
+    // BODY BLOCK of the same plan artifact. Measured 2026-10-02 on a fresh 1.14.3
+    // project (vault-gate-probe, test 1): seven perturbations that removed or
     // gutted the body block — the only practice text the executor reads — all
     // answered `block: false`, because nothing read the block back. A plan could
     // record full governance and deliver none. These kinds end that silence.
@@ -1704,6 +1985,16 @@ const TRACE_PROBLEM_KIND = Object.freeze({
     PRACTICES_BLOCK_ID_UNEXPECTED: 'practices_block_id_unexpected',
     PRACTICES_BLOCK_TEXT_MISMATCH: 'practices_block_text_mismatch',
     VALIDATOR_ERROR: 'validator_error',
+    // 16-06 (D-35; T-16-23): a statement-shape kind, appended LAST. An anchor key
+    // (`startCommit`, `endCommit`, `anchorBackfill`) that the record carries but
+    // that fails its grammar — a short or uppercase sha, an option-shaped value,
+    // a back-fill without a valid `by` or `at`. The parser dropped it, so it can
+    // never reach a git argv; this kind makes the drop visible and blocking,
+    // because an anchor is CLI-written and a hand-edited one is a record that
+    // claims coverage it was never given. A record with NO anchor has no problem
+    // here: write points are silent on a missing anchor (D-16), and the strict
+    // points' `anchor_missing` is the handler's (16-07).
+    ANCHOR_INVALID: 'anchor_invalid',
 });
 function isPlainObject(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
@@ -1855,16 +2146,8 @@ function validateTraceStatement(input, options) {
         if (statement['_type'] !== TRACE_STATEMENT_TYPE) {
             add(TRACE_PROBLEM_KIND.STATEMENT_TYPE_MISMATCH, `_type must be exactly "${TRACE_STATEMENT_TYPE}"; found "${describeValue(statement['_type'])}".`);
         }
-        const acceptedTypes = [
-            TRACE_PREDICATE_TYPE,
-            ...(Array.isArray(opts.acceptedPredicateTypes)
-                ? opts.acceptedPredicateTypes.filter((t) => typeof t === 'string' && t !== '')
-                : []),
-        ];
-        if (!acceptedTypes.includes(statement['predicateType'])) {
-            add(TRACE_PROBLEM_KIND.PREDICATE_TYPE_MISMATCH, `predicateType must be exactly "${TRACE_PREDICATE_TYPE}"` +
-                (acceptedTypes.length > 1 ? ` or one of the ${acceptedTypes.length - 1} the org profile accepts` : '') +
-                `; found "${describeValue(statement['predicateType'])}". The URI carries the MAJOR version — this reader is pinned to it and will not silently accept another.`);
+        if (statement['predicateType'] !== TRACE_PREDICATE_TYPE) {
+            add(TRACE_PROBLEM_KIND.PREDICATE_TYPE_MISMATCH, `predicateType must be exactly "${TRACE_PREDICATE_TYPE}"; found "${describeValue(statement['predicateType'])}". The URI carries the MAJOR version — this reader is pinned to it and will not silently accept another.`);
         }
         const schemaVersion = statement['schemaVersion'];
         if (typeof schemaVersion !== 'number' || !Number.isInteger(schemaVersion)) {
@@ -1882,6 +2165,28 @@ function validateTraceStatement(input, options) {
                 add(TRACE_PROBLEM_KIND.STAGE_MISMATCH, `predicate.stage must be "${stage}" for this artifact; found "${describeValue(predicate['stage'])}".`);
             }
         }
+        // ── the anchors (16-06, D-35) ──
+        // Present-but-invalid only: an absent anchor is not this check's business.
+        // The detail names the KEY, never the value (the seal leaf's message
+        // discipline): the value failed its grammar, so it is not trusted text.
+        for (const key of ['startCommit', 'endCommit']) {
+            if (!(key in predicate))
+                continue;
+            const v = predicate[key];
+            if (!(typeof v === 'string' && vault_seal_cjs_1.ANCHOR_SHA_RE.test(v))) {
+                add(TRACE_PROBLEM_KIND.ANCHOR_INVALID, `predicate.${key} in ${file} is not a full lowercase commit id (40 or 64 hex), so it was not read as an anchor.`, TRACE_ANCHOR_TAIL);
+            }
+        }
+        if ('anchorBackfill' in predicate && !(0, vault_seal_cjs_1.isAnchorBackfill)(predicate['anchorBackfill'])) {
+            add(TRACE_PROBLEM_KIND.ANCHOR_INVALID, `predicate.anchorBackfill in ${file} is not { by, at } with a bounded name and an ISO-8601 instant, so the back-fill was not read.`, TRACE_ANCHOR_TAIL);
+        }
+        if (Array.isArray(predicate['anchorsDropped'])) {
+            for (const key of predicate['anchorsDropped']) {
+                if (key !== 'startCommit' && key !== 'endCommit' && key !== 'anchorBackfill')
+                    continue;
+                add(TRACE_PROBLEM_KIND.ANCHOR_INVALID, `predicate.${key} in ${file} failed its grammar and was dropped when the ledger was read, so it was not read as an anchor.`, TRACE_ANCHOR_TAIL);
+            }
+        }
         // ── the pin, scoped to a LOADED state ──
         // A degraded statement legitimately carries a null pin (D-04), and a stale
         // cache is degraded WITH a live pin. A validator that checked the pin
@@ -2125,10 +2430,17 @@ function traceGeneratedAtOf(statement) {
  *     all three classifier substrings below, deliberately, and lands on the
  *     re-fetch-first lead (D-08-36).
  *
+ *   - a fresh client-tier cache at the configured ref that holds standards
+ *     (INDEX.md) and no practice files, read in practices mode (quick
+ *     261015-at3). The eighth cause, and its own lead: the vault is the right
+ *     one, so neither re-fetching nor restoring access clears it — only setting
+ *     `vault.mode` to `standards` does.
+ *
  * So ALL THREE tails name BOTH routes, and the second route — turning the practices
  * capability off for this project, a local `.planning/config.json` edit — is
  * performable with the vault down, from the same checkout the gate ran in.
- * There is no third route: nothing overrides this kind.
+ * There is no third route: `PP_VAULT_OVERRIDE_REASON` records a `vault.status`
+ * override, not a trace-gate one, and does not suppress this kind.
  *
  * WHAT THE CLASSIFIER DOES, AND WHAT IT DELIBERATELY CANNOT DO. It reads the
  * recorded reason only to choose which route to state FIRST, so a reader on the
@@ -2141,7 +2453,9 @@ function traceGeneratedAtOf(statement) {
  * mechanism here and would not be if it gated the routes themselves.
  */
 function unprovablePairTail(reason) {
-    // THREE leads for SEVEN causes now (D-08-25, then D-08-34). The tier cause is tested FIRST
+    // FOUR leads for EIGHT causes now (D-08-25, D-08-34, then 261015-at3). The
+    // standards-only cause is tested first only because its phrase is unique to
+    // it; among the original causes the tier cause is tested FIRST
     // because it is the only one neither existing lead describes: the vault was
     // reached, freshly, successfully — at the WRONG TIER. Regenerating alone
     // reproduces it (the scaffold reads the cache, it does not fetch), and so
@@ -2169,14 +2483,21 @@ function unprovablePairTail(reason) {
     // fact that a fetch must follow it. The fuller remedy (re-point
     // `client.vaultRepo` / `client.vaultRef`, re-fetch, regenerate) is spelled
     // out in `docs/vault-trace-format.md`, which has no cap.
-    const lead = /no client standards were applied/.test(reason)
-        ? ' Wrong vault: fix client.vaultRepo, re-fetch, then '
-        // The two reasons the resolver emits when the vault was REACHED FOR and not
-        // reached. Anything else — including an empty reason — falls to the
-        // re-fetch-first tail, which also names the disable route.
-        : /records a miss|is stale/.test(reason)
-            ? ' Regenerating alone reproduces this: restore vault access first, then '
-            : " Re-fetch the vault and regenerate that stage's trace: ";
+    // The fourth lead (quick 261015-at3): the standards-only cause. The vault was
+    // reached, freshly, at the configured ref and tier — it is the RIGHT vault,
+    // read in a mode it cannot serve. Neither a re-fetch nor restored access
+    // moves it; only the mode does. Kept inside the same 62-character budget as
+    // the tier lead.
+    const lead = /but vault\.mode is practices/.test(reason)
+        ? ' Standards vault: set vault.mode to standards, then '
+        : /no client standards were applied/.test(reason)
+            ? ' Wrong vault: fix client.vaultRepo, re-fetch, then '
+            // The two reasons the resolver emits when the vault was REACHED FOR and not
+            // reached. Anything else — including an empty reason — falls to the
+            // re-fetch-first tail, which also names the disable route.
+            : /records a miss|is stale/.test(reason)
+                ? ' Regenerating alone reproduces this: restore vault access first, then '
+                : " Re-fetch the vault and regenerate that stage's trace: ";
     return (lead
         + TRACE_REGENERATE_COMMAND
         // The SECOND route, and it is the same sentence in all three tails on
@@ -2445,7 +2766,7 @@ function comparePracticeCoverage(planStatement, summaryStatement, options) {
         ];
     }
 }
-// ─── The body block, read back against the ledger (D-05-07) ─
+// ─── The body block, read back against the ledger (261003-j89; closes D-05-07) ─
 //
 // A vault-enabled plan carries TWO surfaces: the `vault:` frontmatter LEDGER
 // (the audit record) and the `<vault_practices>` BODY BLOCK (the practice text
@@ -2517,7 +2838,7 @@ function practiceTextDigest(text) {
  * markdown code fence and an HTML comment are skipped too — a tag quoted as an
  * example or commented out is not a block the executor reads as one, and
  * counting it would let an example satisfy the presence check (plan-checker
- * remark 2 on D-05-07). Tags are matched at column 0 only, which is where
+ * remark 2 on 261003-j89). Tags are matched at column 0 only, which is where
  * the renderer puts them and where the planner reference says they go; an
  * entry is a fenced region whose FIRST `id:` line
  * precedes its `ask:`/`excerpt:` label — the degraded and refused sections are
@@ -2794,7 +3115,7 @@ module.exports = {
     // judgement about a trace in the leaf, which is the property that stops a
     // second, drifting implementation from growing in an adapter.
     comparePracticeCoverage,
-    // D-05-07: the body-block check, its digest and its remedy
+    // 261003-j89 (closes D-05-07): the body-block check, its digest and its remedy
     // command. The router composes the problems exactly as it composes the
     // validator's; the two digest sites (builder and body check) share
     // `practiceTextDigest`, so the normalisation is written once.
@@ -2820,12 +3141,44 @@ module.exports = {
     // validator's missing-universe remedy and the handler's block message must
     // name the SAME command, and the handler already imports this module.
     TRACE_REGENERATE_COMMAND,
+    // Quick 261015-at3: the eighth degraded cause's reason, harvested by tests.
+    TRACE_REASON_STANDARDS_ONLY,
+    // Quick 261015-at3: the degraded empty-ledger render line, harvested by tests.
+    TRACE_DEGRADED_RENDER_LINE,
+    VAULT_OVERRIDE_ENV,
     PRACTICES_APPLIED_HEADING,
-    // The reader allowlist: pp-core's own predicate type plus any the org
-    // profile lists (same major). The validator takes the list through its
-    // options, so a gate passes `acceptedPredicateTypes(root)`.
-    acceptedPredicateTypes,
-    TRACE_WORKTREE_CACHE_NOTE,
-    // The recorded check: census, read back for the mechanical audit.
-    readRecordedCensus,
+    // Additive exports (Phase 04-01): both functions already existed above —
+    // this widens the export list ONLY; no function body and no call site
+    // changes. Reason: src/check-command-router.cts carries a duplicated
+    // override evaluator and sanitiser which plan 04-03 deletes and rewires to
+    // THIS pair, and two copies of an override validator would let a future
+    // tightening land in one and not the other. `buildOverrideRecord` stays
+    // deliberately UNexported — it is reached through `buildTraceStatement`,
+    // which owns the `generatedAt` value the override's `when` field reuses,
+    // and exporting it would invite the scaffold arm to bypass that seam.
+    //
+    // Widened again additively by Phase 7 (plan 07-01) with the pair below:
+    // `/pp-init`'s reachability-proof deferral (D-07-03, OD-2) is an ATTRIBUTED
+    // bypass of exactly the same shape as the trace override, so it reuses this
+    // module's reason triad (`validateOverrideReason`, extracted out of
+    // `evaluateTraceOverride` for that purpose) and its identity chain
+    // (`resolveOverrideIdentity`) rather than growing a second copy in
+    // `src/init-contract.cts`. `buildOverrideRecord` STILL stays unexported for
+    // the reason stated just above — Phase 7 builds its own record shape from
+    // the four `init.probe_*` config keys and never borrows the trace record's.
+    evaluateTraceOverride,
+    sanitizeOverrideReason,
+    validateOverrideReason,
+    resolveOverrideIdentity,
+    // 15-07 (D-08): the standards block verb's override line. A wrapper that
+    // stamps its own `when`, so `buildOverrideRecord` itself stays unexported.
+    buildStandardsOverrideRecord,
+    // 16-06 (D-32): what `vault anchor backfill` splices into a practices
+    // ledger, and who it records as having done it. One spelling of each.
+    traceAnchorLines,
+    resolveBackfillIdentity,
+    // 16-06 (D-12): the scaffold's own pin reader, so `vault door-record` in
+    // practices mode records the pin the practices record would, never a third
+    // reading of the manifest.
+    resolvePin,
 };