@pareto4/pp-core 1.13.0 → 1.18.0

package/pp-core/bin/lib/vault-command-router.cjs

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *
  * Arg indexing:
  *   args[0] = 'vault'      (family — matched by dispatchCapabilityCommand)
- *   args[1] = subcommand   (fetch | status | summary)
+ *   args[1] = subcommand   (see VAULT_SUBCOMMANDS below)
  *
  * Test seams: pass `_vault` to inject a mock vault module; pass `_core` to inject
  * a mock core module that captures `output()` calls instead of writing to real
@@ -34,76 +34,140 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const io = require("./io.cjs");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+// 16-19 (D-107): `vault anchor certify` runs the strict trace check as a child
+// process, the one spawn in this router (TRACE-04 keeps the check read-only).
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const childProcess = require("node:child_process");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
-// The trace render arm resolves its containment boundary from the project
-// root. project-root.cjs is a leaf (node builtins only), so this adds no cycle.
+// CR-04 (03-11): this router's path arms resolve their containment boundary the
+// same way `cmdVaultTrace` in src/check-command-router.cts does. project-root.cjs is a
+// leaf (node builtins only), so this adds no cycle.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const projectRootMod = require("./project-root.cjs");
 const { findProjectRoot } = projectRootMod;
+// 15-05: the plan-identifier form moved into the vault-standards leaf (one
+// definition shared by the standards verbs and the gate).
+// That leaf requires only vault-index, which imports nothing, so no cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultStandardsLeaf = require("./vault-standards.cjs");
+// 16-06 (D-14/D-31/D-35): the anchor grammar, the anchors file and the door
+// record have ONE owner, the seal leaf. Its top level imports only `fs` and
+// `path` (D-41), so this static import adds no cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultSeal = require("./vault-seal.cjs");
 const { ERROR_REASON } = io;
-// Default CoreModule implementation. _core seam overrides this for test injection.
-const _defaultCore = { output: io.output };
 /**
- * Pack 6 D-01: the vault router's subcommand table. `readsVerdict` marks every
- * subcommand that reports the vault load verdict — each one must spread the
- * owner's `VAULT_VERDICT_FIELDS` verbatim (tests/vault-status-check.test.cjs
- * enumerates this table and compares every reader against the owner).
+ * The subcommand vocabulary, declared once. 02-02 added `probe` (STRICT-02) and
+ * found the name had to be repeated in three unrelated places — the header
+ * comment, the dispatch chain and the unknown-subcommand message — with nothing
+ * keeping them in step. The message is now DERIVED from this list so the
+ * dispatch arm and the operator-facing vocabulary can no longer disagree.
+ */
+const VAULT_SUBCOMMANDS = [
+    'fetch',
+    'status',
+    'probe',
+    'summary',
+    'org-profile',
+    // PBI 74316 (fork-only): move the project to another client vault version.
+    'update',
+    // 15-07 (D-06, D-13): the standards record verbs, `block` and `consulted`.
+    'standards',
+    // 16-04 (D-28): the one door-admission verb every door and loop-point fence asks.
+    'admission',
+    // 16-06 (D-31, D-32): the start anchor a phase or quick directory records at
+    // execute:pre, and the attributed back-fill of a record written before anchors.
+    'anchor',
+    // 16-06 (D-12): the one verb that writes a door's mode-stamped record.
+    'door-record',
+];
+/**
+ * The standards verbs (15-07), same discipline: the verb check and the message
+ * naming the permitted verbs both derive from this list. `promote` writes to
+ * the client vault rather than a record, and answers its own refusals.
  */
-const VAULT_SUBCOMMANDS = Object.freeze([
-    { name: 'fetch', readsVerdict: false },
-    { name: 'status', readsVerdict: true },
-    { name: 'summary', readsVerdict: false },
-    { name: 'practices', readsVerdict: false },
-    { name: 'org-profile', readsVerdict: false },
-    { name: 'probe', readsVerdict: false },
-    { name: 'trace', readsVerdict: false },
-    { name: 'audit', readsVerdict: false },
-    { name: 'update', readsVerdict: false },
-    { name: 'review', readsVerdict: false },
-]);
+const STANDARDS_VERBS = ['block', 'consulted', 'promote'];
 /**
- * The two trace stages and the two trace verbs, declared once: the `--stage`
- * validation, the verb check and the operator-facing messages that name the
- * permitted values are all derived from these lists, so they cannot disagree.
- * The values are the frozen contract's (`docs/vault-trace-format.md`).
+ * The anchor verbs (16-06), same discipline: the verb check and the message
+ * naming the permitted verbs both derive from this list.
  */
-const TRACE_STAGES = ['plan', 'execute'];
-const TRACE_VERBS = ['scaffold', 'render'];
+const ANCHOR_VERBS = ['start', 'backfill', 'certify'];
+/** The flags `vault door-record` takes, declared once for the check and the message (16-06). */
+// 16 review iteration 3 CR-02 (D-103): no `--start`. The start comes only from
+// the door's own `--begin` entry, so no argument can widen a door's range.
+const DOOR_RECORD_FLAGS = ['--door', '--artifact', '--phase'];
 /**
- * The plan-identifier shape `vault trace scaffold --plan` accepts: a phase
- * segment (digits, an optional letter, optional decimal parts) followed by one
- * or more numeric segments — the plan-identifier grammar `agents/pp-planner.md`
- * and `src/phase-id.cts` use. It is exactly the prefix of the artifact's own
- * filename (`04-02` for `04-02-PLAN.md`, `02.3-01` for `02.3-01-PLAN.md`), so a
- * trace gate comparing the recorded identifier with the filename can never be
- * handed one the writer could not emit. It rejects what is not a plan
- * identifier at all: a bare plan number (`01`), a task label (`T1`), a slug
- * (`04-01-vault-trace`) or an empty string.
+ * The read cap `vault standards consulted` applies to a PLAN. EQUAL to the
+ * trace gate's `TRACE_ARTIFACT_BYTE_CAP` in src/check-command-router.cts, so
+ * the verb never refuses a plan the gate would read, nor reads one the gate
+ * refuses. That constant is not importable from here (an adapter never
+ * imports an adapter), so the integration test pins the two equal.
  */
-const SCAFFOLD_PLAN_ID_RE = /^\d+[A-Za-z]?(?:\.\d+)*(?:-\d+)+$/;
+const STANDARDS_PLAN_READ_BYTES = 1024 * 1024;
 /**
- * The required form, in ONE wording, stated in this rejection message and in
- * `pp-core/references/planner-vault-practices.md`. ASCII only and no
- * backticks, so the same bytes survive a JSON string, markdown and a terminal.
+ * The plan-identifier shape `vault standards block --plan` accepts (04-14,
+ * TGATE-01, CR-03). Defined in `src/vault-standards.cts` since 15-05 and
+ * re-exported from here under the same name; the rationale stays here, beside
+ * the verb that uses it.
+ *
+ * ONE FORM, READ AND WRITTEN. `filenamePlanId` in `src/check-command-router.cts`
+ * extracts `<this form>-PLAN.md` / `-SUMMARY.md` from an artifact's basename,
+ * building its pattern from this very value, and blocks when the identifier it
+ * extracts disagrees with the one the record carries. So the writer can emit
+ * every identifier the reader can demand (the trap CR-03 reproduced, where
+ * `--plan 01` for `07-01-PLAN.md` blocked at all four points and the remedy
+ * re-ran the same command), and the reader checks every form the writer emits.
+ * Until 15-REVIEW WR-06 the reader stopped at digits-hyphen-digits, so a
+ * decimal (`02.3-01-PLAN.md`, bug #3691) or lettered phase stated no
+ * identifier and its plan-id check was silently skipped; the writer was
+ * deliberately wider then, so as not to refuse a form the gate accepted
+ * (threat T-4-53). The shape is the plan-identifier grammar
+ * `agents/pp-planner.md` and `src/phase-id.cts` use: a phase segment (digits,
+ * an optional letter, optional decimal parts) followed by one or more numeric
+ * segments.
+ *
+ * What it rejects is what CR-03 actually named, and nothing more: a value that
+ * is not a plan identifier at all — a bare plan number (`01`), a task label
+ * (`T1`), a slugged identifier (`04-01-vault-trace`), or an empty string. Every
+ * one of those, written into a canonically named artifact, produces
+ * `plan_id_mismatch`.
+ *
+ * The agreement test in `tests/vault-command-router.test.cjs` and the gate-side
+ * half in `tests/vault-trace.integration.test.cjs` drive both sides over one
+ * shared value list, so an independent edit to either cannot pass.
+ */
+const SCAFFOLD_PLAN_ID_RE = vaultStandardsLeaf.SCAFFOLD_PLAN_ID_RE;
+/**
+ * The required form, in ONE wording: the `vault standards block` rejection
+ * message (04-14 T2). A constant so the refusal and the test that pins it read
+ * one sentence (threat T-4-55).
+ *
+ * ASCII only, and no backticks: the same bytes have to survive a JSON string, a
+ * markdown paragraph and a terminal.
  */
 const SCAFFOLD_PLAN_ID_FORM = "The plan identifier must be the plan's phase-and-number identifier, exactly the " +
     'prefix of its artifact filename (for example 04-02), not a bare plan number, a task ' +
     'label or a slug.';
 /**
- * Bound on the head read the `trace render` arm performs. The trace lives in
- * the artifact's FRONTMATTER, so a head read is the exact region the parser
- * needs, and an artifact body of any size can never make this arm read more.
+ * The quick-task half of the form (16-05, D-29), appended to both rejection
+ * messages after `SCAFFOLD_PLAN_ID_FORM`.
+ *
+ * A second constant rather than an edit to the first: the first sentence is
+ * already true of a quick task — "exactly the prefix of its artifact filename"
+ * — so only the refusal, the one surface a caller reads after being told no,
+ * needs to name the quick form.
  */
-const TRACE_ARTIFACT_READ_BYTES = 262_144;
+const SCAFFOLD_QUICK_ID_FORM = 'A quick task uses its quick-task id instead, the same filename prefix (for example 261011-8yt).';
 /** Repo-relative artifact paths, long enough for a workstream phase tree. */
 const TRACE_REFUSAL_PATH_CAP = 200;
-/** A `gitCommit` digest: lowercase hex at sha1 or sha256 length. */
-const GIT_COMMIT_DIGEST_RE = /^[0-9a-f]{40}$|^[0-9a-f]{64}$/;
 /**
- * Bound and control-character-collapse a caller-supplied path before it
- * reaches a refusal message: the message reaches an operator's terminal and,
- * on the workflow path, an agent's context, so a hostile path must not forge
- * an extra line of output nor run to arbitrary length.
+ * Bound and control-character-collapse a caller-supplied path before it reaches
+ * a refusal message (T-03-53). The message reaches an operator's terminal and,
+ * on the workflow path, an agent's context — so a hostile path must not be able
+ * to forge what looks like an additional line of output, nor run to arbitrary
+ * length. Mirrors `sanitizeTraceText` in src/check-command-router.cts; that one
+ * also redacts remotes because it quotes ARTIFACT text, while this one only ever
+ * quotes the argv value the operator just typed.
  */
 function boundedPath(value) {
     const collapsed = value
@@ -117,25 +181,20 @@ function boundedPath(value) {
         : collapsed;
 }
 /**
- * Is the vault-practices capability fully active for this project? Both
- * `vault.enabled` and `vault.practices_enabled` must be strictly `true` — the
- * same requires-closure the promote preflight and `ship.practices` apply. The
- * trace arms gate on this FIRST, before the flag allowlist, so an inert project
- * stays byte-identically silent on every path, a mistyped one included.
+ * The gate an override recorded by `vault standards block` suppresses (04-06, SC4).
+ *
+ * `vault.status` is not a name invented here: it is the `check.query` the
+ * blocking vault gate is declared under at both write points
+ * (`capabilities/vault/capability.json`), and it is the gate the override
+ * line names (`docs/vault-standards-mode.md` § Gates, "The override").
+ * Declared once so the emitted record and the documented contract cannot
+ * drift apart. Its one owner is the standards leaf
+ * (15 D-35), because the standards judgement accepts an override line only
+ * under this gate name, and a second literal could drift from the first.
  */
-function tracePracticesActive(cfgGet, cwd) {
-    return cfgGet(cwd, 'vault.enabled', false) === true && cfgGet(cwd, 'vault.practices_enabled', false) === true;
-}
-/** The value token after each of `flags`, by index, so a flag's value is never read as a positional. */
-function flagValueIndices(argv, flags) {
-    const indices = new Set();
-    for (const flag of flags) {
-        const i = argv.indexOf(flag);
-        if (i !== -1)
-            indices.add(i + 1);
-    }
-    return indices;
-}
+const TRACE_OVERRIDE_GATE = vaultStandardsLeaf.STANDARDS_OVERRIDE_GATE;
+// Default CoreModule implementation. _core seam overrides this for test injection.
+const _defaultCore = { output: io.output };
 /**
  * Render a short plain-text `vault org-profile` report from its structured
  * shape — one line naming the pointer, one naming the resolution, a
@@ -148,15 +207,26 @@ function flagValueIndices(argv, flags) {
 function renderOrgProfileReport(report) {
     const lines = [];
     if (report.pointer.value === null) {
-        lines.push('No org profile is configured (org.profile is unset) — pp-core\'s built-in defaults apply.');
+        lines.push(report.profile.source === 'embedded'
+            ? 'No org profile package is configured (org.profile is unset) — the embedded org profile applies.'
+            : 'No org profile is configured (org.profile is unset) — pp-core\'s built-in defaults apply.');
+    }
+    else if (report.pointer.value.trim().toLowerCase() === 'none') {
+        lines.push('org.profile is "none" — no org profile applies, not even the embedded one; pp-core\'s built-in defaults apply.');
     }
     else {
         lines.push(`org.profile is set to "${report.pointer.value}".`);
     }
-    if (report.profile.resolved) {
+    if (report.profile.resolved && report.profile.source === 'embedded' && report.pointer.value !== null) {
+        lines.push(`The org profile "${report.pointer.value}" could not be resolved — the embedded org profile (pp-core ${report.profile.version ?? 'unknown'}) applies instead.`);
+    }
+    else if (report.profile.resolved && report.profile.source === 'embedded') {
+        lines.push(`Using the embedded org profile shipped with pp-core ${report.profile.version ?? 'unknown'}.`);
+    }
+    else if (report.profile.resolved) {
         lines.push(`Resolved org profile "${report.profile.name}" version ${report.profile.version ?? 'unknown'} from ${report.profile.source}.`);
     }
-    else if (report.pointer.value !== null) {
+    else if (report.pointer.value !== null && report.pointer.value.trim().toLowerCase() !== 'none') {
         lines.push(`The org profile "${report.pointer.value}" could not be resolved from the project or the global npm root.`);
     }
     const contributesKeys = Object.keys(report.contributes);
@@ -166,7 +236,8 @@ function renderOrgProfileReport(report) {
     else {
         lines.push('The org profile contributes:');
         for (const key of contributesKeys) {
-            lines.push(`  ${key} = ${report.contributes[key]}`);
+            const value = report.contributes[key];
+            lines.push(`  ${key} = ${value === '' ? '"" (explicitly none)' : value}`);
         }
     }
     if (report.overridden.length > 0) {
@@ -187,146 +258,74 @@ function renderOrgProfileReport(report) {
     return lines.join('\n');
 }
 // ─── Implementation ───────────────────────────────────────────────────────────
-function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _exec, _writeBack, _orgProfile, _coordinates, _provider, _trace, _audit, _update, }) {
+function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _exec, _orgProfile, _coordinates, _provider, _update, }) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const vault = _vault ?? require('./vault.cjs');
     const c = _core ?? _defaultCore;
     const subcommand = args[1];
+    // From the REAL leaf, not the `_vault` seam: a governance answer must not be
+    // switchable by a test mock.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const indexSeam = require('./vault.cjs');
     if (subcommand === 'fetch') {
         c.output(vault.vaultFetch(cwd), raw);
     }
     else if (subcommand === 'status') {
-        // Pack 6 D-01: the manifest read is unchanged; the verdict fields come
-        // from the one owner, never from a second derivation here.
-        const status = vault.vaultStatus(cwd);
-        const verdict = vault.computeVaultVerdict && vault.verdictFields ? vault.verdictFields(vault.computeVaultVerdict(cwd)) : {};
-        c.output({ ...status, ...verdict }, raw);
+        // 14-05 (D-11/D-14): the same five flat fields `check vault.status` carries,
+        // from the one state function, so the report and the gate cannot tell
+        // different stories (UAT F6). From the REAL module (`indexSeam`), not the
+        // injectable `vault` seam: a governance answer must not be switchable by a
+        // test mock (13-06 precedent). No `block` and no `reason`: this is a report.
+        // The state is null with the vault off, so the envelope gains no key.
+        const base = vault.vaultStatus(cwd);
+        const indexState = indexSeam.computeVaultIndexState(cwd);
+        const withIndex = indexState !== null && base['present'] === true
+            ? { ...base, ...indexSeam.vaultIndexEnvelopeFields(indexState) }
+            : base;
+        c.output(withIndex, raw);
     }
     else if (subcommand === 'probe') {
-        // Pack 6 D-09: one reachability line, empty when the vault is disabled (D-06).
-        const result = vault.vaultProbe ? vault.vaultProbe(cwd) : { line: '', enabled: false };
-        if (!result.enabled) {
-            c.output(result, true, '');
-        }
-        else if (raw) {
-            c.output(result, true, JSON.stringify(result));
-        }
-        else {
-            c.output(result, true, `${result.line}\n`);
+        // STRICT-02: pure reachability for the client vault, the shared fallback and
+        // the platform repo — no clone, no cache mutation.
+        //
+        // T-02-07: reject any unrecognized `--` token BEFORE anything spawns. A typo must never reach a
+        // subprocess. The host (pp-core/bin/pp-tools.cjs) already splices out its own
+        // global flags before dispatch, which is why the recognized set is one wide.
+        const RECOGNIZED_PROBE_FLAGS = new Set(['--raw']);
+        const unrecognizedProbeFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_PROBE_FLAGS.has(a));
+        if (unrecognizedProbeFlag !== undefined) {
+            error(`Unrecognized flag "${unrecognizedProbeFlag}" for vault probe. Supported: --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
         }
+        // The probe's ls-remote names its remote by URL, but git still reads the config of the repository the
+        // environment selects (measured: `protocol.file.allow=never` in a pointed-to repository's config made the
+        // bare runner's ls-remote fail with `transport 'file' not allowed`, while the same call with the location
+        // unset answered), so it runs through the owner; transport is kept (D-117).
+        c.output(vault.vaultProbe(cwd, { exec: _exec ?? shell_command_projection_cjs_1.execGitLocal }), raw);
     }
     else if (subcommand === 'summary') {
-        c.output(vault.vaultSummary(cwd), raw);
-    }
-    else if (subcommand === 'practices') {
-        const verb = args[2];
-        if (verb === 'match') {
-            // T-24-08b: reject any unrecognized `--`-prefixed argument BEFORE the
-            // `--changed` git call (so a typo never spawns a subprocess) instead
-            // of silently filtering it out of the positional file list. Matched on
-            // the WHOLE token so `--files=…` is caught by the same check as
-            // `--files value`. DECISION (recorded, not deferred): `--files=` is
-            // NOT implemented as a comma-splitting alias here, unlike
-            // `/pp-code-review`'s `--files=a,b` (pp-core/workflows/code-review.md).
-            // The auditor marked the alias "optional and secondary"; the required
-            // behavior is loud failure, and the error message below names the
-            // supported forms instead. The host (pp-core/bin/pp-tools.cjs) already
-            // splices out its own global flags (--json-errors/--cwd/--ws/--raw/
-            // --pick/--default) before dispatch, which is why the recognized set
-            // here is only two flags wide.
-            const RECOGNIZED_MATCH_FLAGS = new Set(['--changed', '--raw', '--block']);
-            const unrecognizedFlag = args.slice(3).find((a) => a.startsWith('--') && !RECOGNIZED_MATCH_FLAGS.has(a));
-            if (unrecognizedFlag !== undefined) {
-                error(`Unrecognized flag "${unrecognizedFlag}" for vault practices match. Supported: positional file paths, --changed, --raw, or --block.`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-            const practices = _practices ?? require('./vault-practices.cjs');
-            const runGit = _exec ?? shell_command_projection_cjs_1.execGit;
-            let files;
-            if (args.includes('--changed')) {
-                const gitResult = runGit(['diff', '--name-only', 'HEAD'], { cwd });
-                if (gitResult.exitCode !== 0) {
-                    error('Could not determine changed files: git diff failed (WR-02)', ERROR_REASON.SDK_FAIL_FAST);
-                    return;
-                }
-                files = gitResult.stdout.split('\n').map((f) => f.trim()).filter((f) => f.length > 0);
-            }
-            else {
-                files = args.slice(3).filter((a) => !a.startsWith('--'));
-            }
-            const result = practices.matchPractices({ cwd, files });
-            if (args.includes('--block')) {
-                // T-25-08: emit the finished <vault_practices> block so the planner
-                // embeds it VERBATIM. The planner never renames a field or applies a
-                // fence itself — that transformation used to be prose-only, which is
-                // what left the phase's prompt-injection mitigation unenforced.
-                c.output(result, true, practices.renderPracticesBlock(result));
-            }
-            else if (raw) {
-                c.output(result, true, JSON.stringify(result));
-            }
-            else {
-                c.output(result, true, practices.renderPracticesReport(result));
-            }
+        // STRICT-05 (02-02): read the STATUS, not the bare string. The write failure
+        // used to be swallowed inside vaultSummary, so this arm could only ever print
+        // success. It still exits 0 on every path — per D-VH-7 the vault and check
+        // commands REPORT and the workflow halts; making this exit non-zero would
+        // route the block into the step's `onError: skip` and reopen the fail-open.
+        const summary = vault.vaultSummaryResult(cwd);
+        if (!summary.ok) {
+            // Warning to stderr so the success-path stdout stays byte-identical to
+            // before this plan for every healthy project.
+            process.stderr.write(`⚠ vault summary: could not write ${summary.path ?? '.planning/vault/SUMMARY.md'} — ${summary.error ?? 'unknown error'}\n`);
         }
-        else if (verb === 'promote') {
-            // T-29-16: reject any unrecognized `--`-prefixed argument BEFORE the
-            // lazy require of the write-back module and before any subprocess can
-            // spawn — mirrors the `match` branch's T-24-08b guard exactly. Matched
-            // on the WHOLE token so `--name=value` is caught by the same check as
-            // `--name value`. The recognized set holds exactly three flags — no
-            // flag that disables, bypasses, or relaxes any guard exists.
-            const RECOGNIZED_PROMOTE_FLAGS = new Set(['--confirmed', '--expect', '--raw']);
-            const promoteArgs = args.slice(3);
-            const unrecognizedPromoteFlag = promoteArgs.find((a) => a.startsWith('--') && !RECOGNIZED_PROMOTE_FLAGS.has(a));
-            if (unrecognizedPromoteFlag !== undefined) {
-                error(`Unrecognized flag "${unrecognizedPromoteFlag}" for vault practices promote. Supported: --confirmed, --expect <token>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // Positional file path: the first token that is not `--`-prefixed and
-            // is not the value immediately following `--expect`.
-            const expectFlagIdx = promoteArgs.indexOf('--expect');
-            const expectValueIdx = expectFlagIdx !== -1 ? expectFlagIdx + 1 : -1;
-            const filePath = promoteArgs.find((a, i) => !a.startsWith('--') && i !== expectValueIdx);
-            if (filePath === undefined) {
-                error('No practice file was given. Usage: vault practices promote <file> [--confirmed --expect <token>] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
-                return;
-            }
-            const confirmed = promoteArgs.includes('--confirmed');
-            const expect = expectValueIdx !== -1 ? promoteArgs[expectValueIdx] : undefined;
-            if (confirmed && (expect === undefined || expect.startsWith('--'))) {
-                error('This practice was not pushed: the confirmation is missing the preview token it needs. ' +
-                    'Run the promotion without confirming first, then pass the token it prints.', ERROR_REASON.VAULT_PROMOTE_CONCURRENT_EDIT);
-                return;
-            }
-            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-            const writeBack = _writeBack ?? require('./vault-write-back.cjs');
-            const verdict = writeBack.promotePractice({ cwd, filePath, confirmed, expect });
-            // Emit the structured verdict BEFORE any error call — a refusal still
-            // carries its verdict to stdout. This ordering is the whole point of
-            // the uniform D-16 refusal contract and is what lets a wrapper
-            // workflow render results without scraping prose.
-            if (raw) {
-                c.output(verdict, true, JSON.stringify(verdict));
-            }
-            else {
-                c.output(verdict, true, writeBack.renderPromoteReport(verdict));
-            }
-            if (verdict.status === 'refused') {
-                // An action command's refusal must be observable in the exit code —
-                // do not adopt the ship gate's always-exit-zero convention here.
-                error(verdict.message ?? 'This practice was not promoted.', verdict.reason ?? ERROR_REASON.UNKNOWN);
-            }
+        if (raw) {
+            c.output(summary, true, JSON.stringify(summary));
         }
         else {
-            error('Unknown practices subcommand. Available: match, promote', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+            c.output(summary.index, false);
         }
     }
     else if (subcommand === 'org-profile') {
         // T-33-13: reject any unrecognized `--`-prefixed argument BEFORE any
-        // lazy require or resolution work — mirrors the `practices match`
-        // T-24-08b guard exactly, so a typo can never trigger filesystem work.
+        // lazy require or resolution work (T-24-08b), so a typo can never trigger
+        // filesystem work.
         const RECOGNIZED_ORG_PROFILE_FLAGS = new Set(['--raw']);
         const unrecognizedOrgProfileFlag = args
             .slice(2)
@@ -353,12 +352,23 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         const platformHost = coordinates.resolvePlatformHost(cwd);
         const effectiveByKey = {
             'vault.provider': provider,
-            [coordinates.SHARED_REPO_CONFIG_KEY]: shared.repo,
+            // An explicit opt-out (an empty string, from config or profile) reads
+            // back as "" rather than null, so it is not reported as overridden.
+            [coordinates.SHARED_REPO_CONFIG_KEY]: shared.repo ?? (shared.suppressedKind === 'explicit-opt-out' ? '' : null),
             [coordinates.SHARED_REF_CONFIG_KEY]: shared.ref,
             [coordinates.SHARED_HOST_CONFIG_KEY]: shared.host,
             [coordinates.PLATFORM_HOST_CONFIG_KEY]: platformHost.host,
-            // The policy row, through the same ladder the load gate reads, so a
-            // profile value that won is not reported as overridden by null.
+            // 13-05 / D-20: the two POLICY keys, through their own resolvers.
+            // Without these rows both read null, and a profile-seeded value that
+            // actually won was reported as `profile offered "true", but "null"
+            // won.` (reproduced on 1.15.1) — a diagnostic stating something untrue.
+            // The profile carries `vault.required` as the canonical string
+            // 'true'/'false', so String(required) compares equal when it won.
+            // `resolveVaultRequired` is the SAME ladder the load gate asks
+            // (13-REVIEW CR-02): workstream then root config, trimmed, and an
+            // unparseable project value falls through to the profile — so the
+            // report cannot say the profile lost while the gate enforces it. It is
+            // the policy only; with `vault.enabled` off no gate exists to apply it.
             [orgProfile.VAULT_REQUIRED_CONFIG_KEY]: String(orgProfile.resolveVaultRequired(cwd).required),
         };
         // Build `effective`'s key list from ORG_PROFILE_ALLOWLIST rather than a
@@ -380,21 +390,15 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 overridden.push({ key, profile: profileValue, effective: effectiveValue });
             }
         }
-        // Pack 6 D-07: the drift comparison above ran on RAW values (two repos
-        // differing only by a credential still report drift); what is EMITTED is
-        // display-safe — the shared-repo coordinate through the owner, prose
-        // through the prose redactor.
-        const shownRepo = (key, v) => key === coordinates.SHARED_REPO_CONFIG_KEY && typeof v === 'string' && vault.redactCloneTarget
-            ? vault.redactCloneTarget(v)
-            : v;
-        const shownText = (t) => (vault.redactRemoteText ? vault.redactRemoteText(t) : t);
-        const shownContributes = {};
-        for (const key of Object.keys(resolution.contributes)) {
-            shownContributes[key] = shownRepo(key, resolution.contributes[key]) ?? '';
-        }
-        const shownEffective = {};
-        for (const key of Object.keys(effective))
-            shownEffective[key] = shownRepo(key, effective[key]);
+        // VAULT-EGRESS-1 (quick 261005-8py): a credential embedded in
+        // `vault.fallback_repo` must not reach stdout. `overridden` above compares
+        // the RAW values, so redaction happens here, at emission only, through the
+        // one owner — never a second redactor.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { redactCloneTarget } = require('./vault.cjs');
+        const safe = (key, value) => (key === coordinates.SHARED_REPO_CONFIG_KEY && typeof value === 'string' && value !== ''
+            ? (redactCloneTarget(value) ?? value) : value);
+        const safeMap = (map) => Object.fromEntries(Object.entries(map).map(([k, v]) => [k, safe(k, v)]));
         const report = {
             pointer: { key: orgProfile.ORG_PROFILE_CONFIG_KEY, value: resolution.configured },
             profile: {
@@ -404,16 +408,12 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
                 source: resolution.source,
                 dataPath: resolution.dataPath,
             },
-            contributes: shownContributes,
-            effective: shownEffective,
-            overridden: overridden.map((o) => ({
-                key: o.key,
-                profile: shownRepo(o.key, o.profile) ?? '',
-                effective: shownRepo(o.key, o.effective),
-            })),
+            contributes: safeMap(resolution.contributes),
+            effective: safeMap(effective),
+            overridden: overridden.map((o) => ({ ...o, profile: safe(o.key, o.profile), effective: safe(o.key, o.effective) })),
             ignored: resolution.ignored,
             rejected: resolution.rejected,
-            warnings: resolution.warnings.map(shownText),
+            warnings: resolution.warnings,
         };
         // Never call error() for a project with no profile, and never exit
         // non-zero for a resolution failure — this is a diagnostic, not an
@@ -426,22 +426,13 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
             c.output(report, true, renderOrgProfileReport(report));
         }
     }
-    else if (subcommand === 'trace') {
-        routeTrace({ args, cwd, raw, error, vault, c, _exec, _trace });
-    }
-    else if (subcommand === 'audit') {
-        routeAudit({ args, cwd, raw, error, vault, c, _exec, _audit });
-    }
-    else if (subcommand === 'review') {
-        routeReview({ args, cwd, raw, c });
-    }
     else if (subcommand === 'update') {
-        // `vault update [<tag>] [--yes]`: without --yes it reports the plan and
-        // writes nothing; see src/vault-update.cts for the contract.
+        // PBI 74316: `vault update [<tag>] [--yes]`. Without --yes it reports the
+        // plan and writes nothing; see src/vault-update.cts for the contract.
         const RECOGNIZED_UPDATE_FLAGS = new Set(['--raw', '--yes']);
         const unrecognizedUpdateFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_UPDATE_FLAGS.has(a));
         if (unrecognizedUpdateFlag !== undefined) {
-            error(`Unrecognized flag "${boundedPath(unrecognizedUpdateFlag)}" for vault update. Supported: --yes, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            error(`Unrecognized flag "${unrecognizedUpdateFlag}" for vault update. Supported: --yes, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
         const updatePositionals = args.slice(2).filter((a) => !a.startsWith('--'));
@@ -466,109 +457,349 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
             c.output(updateResult, true, updateMod.renderVaultUpdate(updateResult));
         }
     }
+    else if (subcommand === 'standards') {
+        // 15-07 (D-06, D-08, D-13): the standards record verbs. The arm body lives
+        // in `routeVaultStandards` below.
+        routeVaultStandards({ cwd, args, raw, error, vault, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
+    }
+    else if (subcommand === 'admission') {
+        // 16-04 (D-28, D-05): the arm body lives in `admissionVerb` below.
+        admissionVerb({ cwd, rest: args.slice(2), raw, error, c });
+    }
+    else if (subcommand === 'anchor') {
+        // 16-06 (D-31, D-32): the arm body lives in `routeVaultAnchor` below.
+        routeVaultAnchor({ cwd, args, raw, error, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
+    }
+    else if (subcommand === 'door-record') {
+        // 16-06 (D-12): the arm body lives in `doorRecordVerb` below.
+        doorRecordVerb({ cwd, rest: args.slice(2), raw, error, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
+    }
     else {
-        error(`Unknown vault subcommand. Available: ${VAULT_SUBCOMMANDS.map((x) => x.name).join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error(`Unknown vault subcommand. Available: ${VAULT_SUBCOMMANDS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
 /**
- * `vault trace scaffold|render` — the practice-trace producer.
- *
- * The CLI owns everything that must be PROVABLE — the pinned ref, the
- * resolved sha, the practice-id set and the per-file digests — and the agent
- * writes only the judgement half (`status`, `reason`, `tasks`). Provability
- * cannot rest on an agent transcribing a forty-character sha.
- *
- * NEITHER ARM WRITES A FILE. The producer emits text the agent embeds in the
- * single write it already performs. Patching a plan's frontmatter here would
- * have to round-trip it through the shared serializer, which cannot re-emit
- * nested object lists, so the same write would damage the plan's own
- * must-haves block.
+ * `vault admission [--explain]` (16-04, D-28, D-05): prints exactly one of
+ * `inert | off | on | config-unreadable` and exits 0. With `--explain` and
+ * `config-unreadable`, one more line per unreadable file names the file and the
+ * repair; `--raw` prints the verdict object instead.
+ *
+ * The answer comes from `vaultAdmissionVerdict` in the REAL src/vault.cts, never
+ * from the injectable `_vault` seam: a governance decision must not be
+ * switchable by a test mock.
+ * It stays on the cwd's own verdict, not the producer verdict the seven record
+ * producers ask (quick 261015-ect, QD-10): this verb is a REPORT of the cwd,
+ * which is what every fence asks, so a bindings-less linked worktree answers
+ * `inert` here even where its owning checkout is admitted (QD-09 "Not changed").
+ *
+ * Exit 0 on every answer, because a door fence reads the TOKEN: any stdout other
+ * than `on`, `off` or `inert` halts it, and its `|| echo unrecognised` fallback
+ * turns a non-zero exit into a halt as well. The only non-zero paths are an
+ * argument error here, which therefore halts the fence, never skips it.
  */
-function routeTrace({ args, cwd, raw, error, vault, c, _exec, _trace, }) {
+function admissionVerb({ cwd, rest, raw, error, c }) {
+    let explain = false;
+    for (const a of rest) {
+        if (a === '--raw')
+            continue;
+        if (a === '--explain') {
+            explain = true;
+            continue;
+        }
+        error(`Unrecognized argument "${boundedPath(a)}" for vault admission. Supported: --explain, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const realVault = require('./vault.cjs');
-    const cfgGet = vault.cfgGet ? vault.cfgGet.bind(vault) : realVault.cfgGet;
-    const verb = args[2];
-    const traceArgs = args.slice(3);
-    if (verb !== 'scaffold' && verb !== 'render') {
-        error(`Unknown trace subcommand. Available: ${TRACE_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    const owner = require('./vault.cjs');
+    const verdict = owner.vaultAdmissionVerdict(cwd);
+    if (raw) {
+        c.output(verdict, true, JSON.stringify(verdict));
+        return;
+    }
+    const lines = [verdict.state];
+    if (explain && verdict.state === 'config-unreadable') {
+        for (const u of verdict.unreadable) {
+            lines.push(`${u.file}: ${u.error} — repair: fix the JSON in ${u.file} (or remove the key that broke it) and re-run; ` +
+                'the gate cannot read this file and refuses to pass having checked nothing');
+        }
+    }
+    c.output(verdict, true, `${lines.join('\n')}\n`);
+}
+/**
+ * `vault standards block|consulted` (15-07). The CLI owns everything provable
+ * about a standards record (D-06): the pin comes from the manifest, a path is
+ * accepted only when the loaded INDEX resolves it (D-19), the degraded line is
+ * chosen from the measured state (D-08) and the override line comes from the
+ * one override builder. The planner fills reason slots and the executor fills
+ * status slots; nothing else in the record is typed by an agent.
+ *
+ * ORDER: unless `vault admission` answers `on` (bindings present, every config
+ * readable, the vault switch on) both verbs print nothing and write nothing,
+ * before any argument is read — so a project without the vault is
+ * byte-identical on every path including a mistyped one, and a standards record
+ * cannot be produced on a project whose trace gate is inert (17-REVIEW CR-01,
+ * D-13; the same gate `routeVaultAnchor` and `doorRecordVerb` ask). The verdict
+ * is asked of the checkout whose vault cache the verbs read (quick 261015-at3,
+ * QD-09): in a linked worktree reading its owning checkout's cache — where an
+ * executor runs `consulted` and has no untracked bindings of its own — that is
+ * the owning checkout, which is also where the gate reading the record runs. Then
+ * the verb and the flags are checked.
+ *
+ * Every governance read is from the REAL module, never the `_vault` seam; only the bounded PLAN read goes through the seam, so
+ * a test can count it. Neither verb writes a file.
+ */
+function routeVaultStandards({ cwd, args, raw, error, vault, c, exec }) {
+    // `promote` is an operator action, not a record producer: it is dispatched
+    // BEFORE the producer admission below, so a vault that is off answers with
+    // the promote module's own activation refusal instead of printing nothing.
+    if (args[2] === 'promote') {
+        standardsPromoteVerb({ cwd, rest: args.slice(3), raw, error, c, exec });
         return;
     }
-    // Inert unless both vault keys are on: no output at all, before any flag check.
-    if (!tracePracticesActive(cfgGet, cwd))
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const owner = require('./vault.cjs');
+    if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
         return;
-    if (verb === 'scaffold') {
-        const RECOGNIZED_SCAFFOLD_FLAGS = new Set(['--stage', '--plan', '--raw']);
-        const unrecognized = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_SCAFFOLD_FLAGS.has(a));
-        if (unrecognized !== undefined) {
-            error(`Unrecognized flag "${unrecognized}" for vault trace scaffold. ` +
-                `Supported: positional file paths, --stage <${TRACE_STAGES.join('|')}>, --plan <id>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+    const verb = args[2];
+    const rest = args.slice(3);
+    if (verb === 'block') {
+        standardsBlockVerb({ cwd, rest, raw, error, c, owner });
+    }
+    else if (verb === 'consulted') {
+        standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec });
+    }
+    else {
+        error(`Unknown standards subcommand. Available: ${STANDARDS_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    }
+}
+/** The flags `vault standards promote` takes that carry a value. */
+const PROMOTE_VALUE_FLAGS = ['--path', '--entry', '--section', '--expect'];
+/**
+ * `vault standards promote <file> [--path <vault-path>] [--entry "<what it is>;
+ * used when <…>"] [--section <INDEX section>] [--confirmed --expect <token>]
+ * [--raw]` (FORK-ONLY): add a standards document from this project to the
+ * client vault with its INDEX.md entry. Without `--confirmed` it only
+ * previews; see src/vault-standards-promote.cts for the guards and the two
+ * runs. An unrecognised flag is refused BEFORE the module loads or anything
+ * spawns (T-29-16); no flag disables or relaxes a guard. The verdict is
+ * written to stdout first, then a refusal also exits non-zero: an action
+ * command's refusal must be observable in the exit code.
+ */
+function standardsPromoteVerb({ cwd, rest, raw, error, c, exec }) {
+    const usage = 'Usage: vault standards promote <file> [--path <vault-path>] [--entry "<what it is>; used when <...>"] '
+        + '[--section <INDEX section>] [--confirmed --expect <token>] [--raw].';
+    const values = {};
+    let confirmed = false;
+    let filePath;
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--confirmed') {
+            confirmed = true;
+            continue;
+        }
+        if (PROMOTE_VALUE_FLAGS.includes(a)) {
+            const v = rest[i + 1];
+            if (v === undefined || v.startsWith('--')) {
+                error(`${a} needs a value. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            values[a] = v;
+            i += 1;
+            continue;
+        }
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault standards promote. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        const valueIndices = flagValueIndices(traceArgs, ['--stage', '--plan']);
-        const stageIdx = traceArgs.indexOf('--stage');
-        const stage = stageIdx !== -1 ? traceArgs[stageIdx + 1] : undefined;
-        if (stage === undefined || !TRACE_STAGES.includes(stage)) {
-            error(`Missing or unrecognized --stage value for vault trace scaffold. Supported: ${TRACE_STAGES.join(', ')}.`, ERROR_REASON.SDK_FAIL_FAST);
+        if (filePath !== undefined) {
+            error(`vault standards promote takes exactly one document. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        const planIdx = traceArgs.indexOf('--plan');
-        const planId = planIdx !== -1 ? traceArgs[planIdx + 1] : undefined;
-        if (planId === undefined || planId.startsWith('--')) {
-            error('No plan identifier was given. Usage: vault trace scaffold ' +
-                `--stage <${TRACE_STAGES.join('|')}> --plan <id> [files...] [--raw].`, ERROR_REASON.SDK_MISSING_ARG);
+        filePath = a;
+    }
+    if (filePath === undefined) {
+        error(`No standards document was given. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    if (confirmed && values['--expect'] === undefined) {
+        error('This standards document was not pushed: the confirmation is missing the preview token. '
+            + 'Run the promotion without --confirmed first, then pass the token it prints.', ERROR_REASON.VAULT_PROMOTE_CONCURRENT_EDIT);
+        return;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const promote = require('./vault-standards-promote.cjs');
+    const verdict = promote.promoteStandard({
+        cwd,
+        filePath,
+        vaultPath: values['--path'] ?? null,
+        entry: values['--entry'] ?? null,
+        section: values['--section'] ?? null,
+        confirmed,
+        expect: values['--expect'] ?? null,
+        _exec: exec,
+    });
+    c.output(verdict, true, raw ? JSON.stringify(verdict) : promote.renderPromoteReport(verdict));
+    if (verdict.status === 'refused') {
+        error(String(verdict.message), String(verdict.reason));
+    }
+}
+function standardsBlockVerb({ cwd, rest, raw, error, c, owner }) {
+    // ── arguments ──
+    let planId;
+    let planGiven = false;
+    const positionals = [];
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--plan') {
+            planGiven = true;
+            planId = rest[i + 1];
+            i += 1;
+            continue;
+        }
+        if (a.startsWith('--plan=')) {
+            planGiven = true;
+            planId = a.slice('--plan='.length);
+            continue;
+        }
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault standards block. ` +
+                'Supported: --plan <plan-id>, positional INDEX paths, --raw.', ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        if (!SCAFFOLD_PLAN_ID_RE.test(planId)) {
-            error(`Invalid --plan value "${boundedPath(planId)}" for vault trace scaffold. ${SCAFFOLD_PLAN_ID_FORM} ` +
-                'A trace gate compares the identifier a plan artifact records against the one its own filename states.', ERROR_REASON.SDK_FAIL_FAST);
+        positionals.push(a);
+    }
+    if (!planGiven || planId === undefined || planId === '' || planId.startsWith('--')) {
+        error('No plan identifier was given. Usage: vault standards block --plan <plan-id> [<index-path>...] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    if (!SCAFFOLD_PLAN_ID_RE.test(planId)) {
+        error(`Invalid --plan value "${boundedPath(planId)}" for vault standards block. ${SCAFFOLD_PLAN_ID_FORM} ${SCAFFOLD_QUICK_ID_FORM}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // ── the measured state, read once, from one cache ──
+    // The manifest and the INDEX come from the same directory, the one
+    // `resolveVaultCacheDir` names (in a main checkout, `.planning/vault/`), so
+    // the pin and the resolved paths always describe one cache. "Loaded" and the
+    // stamp status are the leaf's predicates, shared with the trace gate.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const indexLeaf = require('./vault-index.cjs');
+    const cacheDir = owner.resolveVaultCacheDir(cwd).dir;
+    const pin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cacheDir));
+    const state = pin === null ? null : owner.computeVaultIndexState(cwd, { vaultDir: cacheDir });
+    const indexStatus = vaultStandardsLeaf.standardsMeasuredIndexStatus(pin, state);
+    // ── the selection (D-19) ──
+    // The repair comes from the one owner the consulted verb and the trace gate
+    // also read (15-REVIEW iter-3 WR-01), so the three cannot name different ones.
+    const indexFix = vaultStandardsLeaf.standardsIndexRepair(indexStatus);
+    if (indexFix !== null && positionals.length > 0) {
+        error(`Vault standards block: no document can be selected: the index is ${indexStatus}. ` +
+            'Run the command with no index paths to record that state; to select documents, ' +
+            `${indexFix.repair.charAt(0).toLowerCase()}${indexFix.repair.slice(1)} first.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const selectable = vaultStandardsLeaf.standardsResolvedPaths(state);
+    const seen = new Set();
+    for (const p of positionals) {
+        // Exact string membership: no normalisation, no join, no stat (Phase 14
+        // D-08). A path the INDEX does not resolve is refused in ONE wording
+        // whatever the reason, so the refusal never tells a caller which class of
+        // file a path names.
+        if (seen.has(p)) {
+            error(`Vault standards block: ${indexLeaf.displayVaultPath(p)} is listed more than once; name each INDEX path once.`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
-        const files = traceArgs.filter((a, i) => !a.startsWith('--') && !valueIndices.has(i));
-        // The execute stage records, per governed file, the commit that last
-        // produced it, so the statement asserts something falsifiable. A file with
-        // no commit yields no digest — the leaf records that gap as a loud note; a
-        // HEAD fallback would paper over a real coverage hole.
-        const runGit = _exec ?? shell_command_projection_cjs_1.execGit;
-        const fileInputs = files.map((name) => {
-            if (stage !== 'execute')
-                return name;
-            const res = runGit(['log', '-1', '--format=%H', '--', name], { cwd });
-            const digest = res.exitCode === 0 ? res.stdout.trim() : '';
-            return GIT_COMMIT_DIGEST_RE.test(digest) ? { name, gitCommit: digest } : name;
-        });
-        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-        const traceMod = _trace ?? require('./vault-trace.cjs');
-        // No files is a REAL path: a documentation-only plan is still governed by
-        // the global practices, and its ruled-out set must stay auditable.
-        const statement = traceMod.buildTraceStatement({ cwd, stage, plan: planId, files: fileInputs });
-        if (raw) {
-            c.output(statement, true, JSON.stringify(statement));
+        seen.add(p);
+        if (!selectable.has(p)) {
+            error(`Vault standards block: ${indexLeaf.displayVaultPath(p)} is not a selectable INDEX entry. ` +
+                'Choose from the entries the ## INDEX section of .planning/vault/SUMMARY.md lists, exactly as written there.', ERROR_REASON.SDK_FAIL_FAST);
+            return;
         }
-        else {
-            c.output(statement, true, traceMod.serializeTraceBlock(statement));
+    }
+    // ── the record ──
+    const repoText = pin !== null
+        ? indexLeaf.sanitiseVaultText(owner.redactCloneTarget(pin.repo) ?? '', 200).replace(/\s+/g, '_')
+        : '';
+    // Document lines only on a healthy index with a selection; otherwise the
+    // one degraded line the measured status implies (D-08).
+    const degraded = indexStatus === 'ok' && positionals.length > 0
+        ? null
+        : vaultStandardsLeaf.standardsDegradedLineFor(indexStatus);
+    const record = {
+        planId,
+        repo: pin !== null && repoText !== '' ? repoText : null,
+        ref: pin?.ref ?? null,
+        sha: pin?.sha ?? null,
+        indexStatus,
+        documents: degraded === null
+            ? positionals.map((p) => ({ path: p, ref: pin.ref, sha: pin.sha, reason: '' }))
+            : [],
+        degraded,
+        override: null,
+    };
+    // ── the override line (D-08): only through the one builder ──
+    // Recorded only when the load gate's verdict GENUINELY blocks now and the
+    // trace leaf accepts the operator's override reason from this process's
+    // environment; a non-blocking verdict records nothing (D-15 of Phase 4). The
+    // router names no part of the override stack (the leaf owns it all). The
+    // gate name is `TRACE_OVERRIDE_GATE`. The verdict is computed
+    // against the SAME cache the stamp above measured (D-36, 15-REVIEW iter-2
+    // WR-02), exactly as the trace gate recomputes it, so the suppressed reason
+    // recorded here is the one the gate will compare it with, in any checkout.
+    const verdict = owner.computeVaultVerdict(cwd, { vaultDir: cacheDir });
+    if (verdict.block === true) {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const traceLeaf = require('./vault-trace.cjs');
+        const ov = traceLeaf.buildStandardsOverrideRecord(cwd, {
+            gate: TRACE_OVERRIDE_GATE,
+            block: true,
+            suppressedReason: verdict.reason,
+        });
+        if (ov) {
+            record.override = { gate: ov.gate, suppressedReason: ov.suppressedReason, who: ov.who, when: ov.when, reason: ov.reason };
         }
+    }
+    let text;
+    try {
+        text = vaultStandardsLeaf.serializeStandardsBlock(record);
+    }
+    catch (e) {
+        error(`Vault standards block could not write the record: ${boundedPath(e instanceof Error ? e.message : String(e))}`, ERROR_REASON.UNKNOWN);
         return;
     }
-    // ── render ──
-    const RECOGNIZED_RENDER_FLAGS = new Set(['--raw']);
-    const unrecognizedRender = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_RENDER_FLAGS.has(a));
-    if (unrecognizedRender !== undefined) {
-        error(`Unrecognized flag "${unrecognizedRender}" for vault trace render. Supported: a positional artifact path, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+    const envelope = {
+        status: 'ok',
+        planId,
+        stamp: { repo: record.repo, ref: record.ref, sha: record.sha, indexStatus },
+        documents: record.documents.map((d) => ({ path: d.path, ref: d.ref, sha: d.sha })),
+        degraded: record.degraded,
+        override: record.override,
+        text,
+    };
+    c.output(envelope, true, raw ? JSON.stringify(envelope) : text);
+}
+function standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec, }) {
+    const unrecognized = rest.find((a) => a.startsWith('--') && a !== '--raw');
+    if (unrecognized !== undefined) {
+        error(`Unrecognized flag "${boundedPath(unrecognized)}" for vault standards consulted. ` +
+            'Supported: a positional plan path, --raw.', ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    const artifactPath = traceArgs.find((a) => !a.startsWith('--'));
-    if (artifactPath === undefined) {
-        error('No artifact path was given. Usage: vault trace render <artifact> [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+    const positionals = rest.filter((a) => !a.startsWith('--'));
+    if (positionals.length !== 1) {
+        error('vault standards consulted takes exactly one plan path. Usage: vault standards consulted <plan-path> [--raw].', positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    // CONTAINMENT, decided BEFORE the read (the bounded reader returns '' on any
-    // problem and never throws, so a decision taken on its result would be none).
-    // The rendered section is included verbatim in SUMMARY.md, so an out-of-tree
-    // file must never become its content. The predicate is the real leaf's, not
-    // the `_vault` seam's: a security decision is not switchable by a mock.
+    const artifactPath = positionals[0];
+    const shown = boundedPath(artifactPath);
+    // CONTAINMENT FIRST, then the size, then the read (T-03-50): the plan path
+    // is an unvalidated positional, and a decision taken on the bounded read's
+    // RESULT would be no decision.
     if (artifactPath.indexOf('\u0000') !== -1) {
-        error(`The artifact path is not a usable path: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+        error(`The plan path is not a usable path: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
     let projectRoot;
@@ -579,225 +810,1199 @@ function routeTrace({ args, cwd, raw, error, vault, c, _exec, _trace, }) {
         projectRoot = cwd;
     }
     const artifactAbs = node_path_1.default.resolve(cwd, artifactPath);
-    if (!realVault.isInsideDir(projectRoot, artifactAbs)) {
-        error(`The artifact path resolves outside the project and was not read: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
+    if (!owner.isInsideDir(projectRoot, artifactAbs)) {
+        error(`The plan path resolves outside the project and was not read: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-    const traceMod = _trace ?? require('./vault-trace.cjs');
-    const readHead = vault.readHeadBounded ? vault.readHeadBounded.bind(vault) : realVault.readHeadBounded;
-    const content = readHead(artifactAbs, TRACE_ARTIFACT_READ_BYTES);
-    const parsed = traceMod.parseVaultTraceBlock(content, artifactPath);
-    // THE LEDGER, AND ONLY THE LEDGER: this arm never calls the matcher, so the
-    // rendered section cannot disagree with the frontmatter it is generated
-    // from. An absent ledger yields no section; an empty one yields the heading
-    // plus one explanatory line (the leaf's renderer).
-    const rendered = parsed.present ? traceMod.renderPracticesApplied(parsed.statement) : '';
-    if (raw) {
-        c.output(parsed, true, JSON.stringify(parsed));
+    let size;
+    try {
+        const st = node_fs_1.default.statSync(artifactAbs);
+        if (!st.isFile())
+            throw new Error('not a file');
+        size = st.size;
     }
-    else {
-        c.output(parsed, true, rendered);
+    catch {
+        error(`The plan path is not a readable file: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (size > STANDARDS_PLAN_READ_BYTES) {
+        error(`The plan is ${size} bytes, above the ${STANDARDS_PLAN_READ_BYTES}-byte read cap the trace gate also applies, ` +
+            `and was not read: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const text = vault.readHeadBounded(artifactAbs, STANDARDS_PLAN_READ_BYTES);
+    const parsed = vaultStandardsLeaf.parseStandardsBlock(text, { artifact: shown });
+    if (parsed.record === null || parsed.problems.length > 0) {
+        const first = parsed.problems[0];
+        error(first
+            ? `Vault standards consulted: ${first.kind}: ${first.detail}`
+            : `Vault standards consulted: ${shown} carries no readable ${vaultStandardsLeaf.VAULT_STANDARDS_TAG_OPEN} record. ` +
+                'Re-run `pp-tools vault standards block --plan <plan-id> <index-path...>` and embed its output verbatim.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const record = parsed.record;
+    // ── absolute cache paths (D-30, C-9) ──
+    // Resolved through the one cache resolver, so an executor in a linked
+    // worktree (which has no cache of its own) is pointed at the main checkout's.
+    // Every path is contained in the cache directory: a block edited by hand
+    // could name `../x.md`, and that must be refused before anyone reads it.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const indexLeaf = require('./vault-index.cjs');
+    const cache = owner.resolveVaultCacheDir(cwd);
+    // And every path is a RESOLVED INDEX entry of that cache (D-19, 15-REVIEW
+    // WR-04): the executor is told to read each listed document in full, and a
+    // withheld or credential file is in the cache too. The same reads and the
+    // same set the block verb selects from, so a PLAN that never passed
+    // plan:post, or was edited after it, cannot hand such a path to an executor.
+    // One reason-free wording, as the block verb's: the refusal never says why.
+    const loadedPin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cache.dir));
+    const indexState = loadedPin === null ? null : owner.computeVaultIndexState(cwd, { vaultDir: cache.dir });
+    const selectable = vaultStandardsLeaf.standardsResolvedPaths(indexState);
+    // 15-REVIEW iter-2 WR-05: with no vault loaded, or a loaded vault whose INDEX
+    // is degraded, NO document can be listed, and the per-path wording below
+    // would name a loaded vault that is not there and send the reader back to
+    // `vault standards block`, where the only record left to write is a degraded
+    // one: a governed plan would lose its document record. So this case is
+    // refused first, naming the measured cause and the repair (`vault fetch`),
+    // from the one owner the block verb and the trace gate also read (iter-3
+    // WR-01), so the gate cannot send the same record somewhere else.
+    const indexStatus = vaultStandardsLeaf.standardsMeasuredIndexStatus(loadedPin, indexState);
+    const indexFix = vaultStandardsLeaf.standardsIndexRepair(indexStatus);
+    if (record.documents.length > 0 && indexFix !== null) {
+        error(`Vault standards consulted: ${indexFix.cause}, so no document of ${shown} can be listed. ` +
+            `${indexFix.repair}, then re-run this command.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
     }
+    const documents = [];
+    for (const d of record.documents) {
+        const cachePath = node_path_1.default.join(cache.dir, d.path);
+        if (node_path_1.default.isAbsolute(d.path) || !owner.isInsideDir(cache.dir, cachePath) || cachePath === cache.dir) {
+            error(`Vault standards consulted: ${indexLeaf.displayVaultPath(d.path)} in ${shown} resolves outside the vault cache ` +
+                'and was not listed. Re-run `pp-tools vault standards block` for this plan and embed its output verbatim.', ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        if (!selectable.has(d.path)) {
+            error(`Vault standards consulted: ${indexLeaf.displayVaultPath(d.path)} in ${shown} is not a selectable INDEX entry ` +
+                'of the loaded vault and was not listed. Re-run `pp-tools vault standards block` for this plan, choosing from ' +
+                'the entries the ## INDEX section of .planning/vault/SUMMARY.md lists, and embed its output verbatim.', ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        documents.push({ path: d.path, ref: d.ref, sha: d.sha, cachePath });
+    }
+    // 16-06 (D-14/D-31/D-35): the anchor line, the section's last line. END is
+    // HEAD now (the executor runs this after the last task commit); START is the
+    // anchor `vault anchor start` recorded in the plan's own directory, when one
+    // is there. Both come from git and the anchors file, never from the agent.
+    // HEAD unreadable (no commit, git failing) writes no line at all, and the
+    // strict points then type the missing anchor (16-07); a write point is
+    // silent on it (D-16).
+    const headRun = exec(['rev-parse', 'HEAD'], { cwd });
+    const end = headRun.exitCode === 0 ? headRun.stdout.trim() : '';
+    const start = vaultSeal.readDirAnchors(node_path_1.default.dirname(artifactAbs))?.start ?? null;
+    const anchors = vaultSeal.ANCHOR_SHA_RE.test(end) ? { start, end } : null;
+    const section = vaultStandardsLeaf.serializeConsultedSection(record, { anchors });
+    const envelope = {
+        status: 'ok',
+        planId: record.planId,
+        stamp: { repo: record.repo, ref: record.ref, sha: record.sha },
+        documents,
+        // The section and this field echo one sanitised line (15-REVIEW WR-03).
+        degraded: record.degraded === null ? null : vaultStandardsLeaf.standardsEchoDegraded(record.degraded),
+        cacheSource: cache.source,
+        section,
+    };
+    c.output(envelope, true, raw ? JSON.stringify(envelope) : section);
 }
 /**
- * `vault audit <phase> [--range <from>..<to>] [--raw]` — the operator's view of
- * the mechanical practice audit.
- *
- * A PASS-THROUGH: it collects arguments, calls `runVaultAudit` and prints the
- * leaf's own envelope (`--raw`) or the leaf's own report. `check vault.audit`
- * serializes the same envelope from the same engine, and the phase argument is
- * resolved by the same `resolveDecisionPhaseDir`, so the report cannot disagree
- * with the gate that blocks on it.
- *
- * Inert (no output at all) unless both vault keys are on, decided before the
- * flag allowlist so an inert project is silent on every path. A malformed
- * `--range` is refused by the leaf's own predicate and never echoed. The
- * range's value is excluded by index, so the flag may precede the phase.
+ * The real vault module, for the governance reads of the 16-06 verbs: the
+ * admission verdict, containment and phase resolution must not be switchable
+ * by a test mock.
  */
-function routeAudit({ args, cwd, raw, error, vault, c, _exec, _audit, }) {
+function anchorOwner() {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const realVault = require('./vault.cjs');
-    const cfgGet = vault.cfgGet ? vault.cfgGet.bind(vault) : realVault.cfgGet;
-    if (!tracePracticesActive(cfgGet, cwd))
-        return;
-    const auditArgs = args.slice(2);
-    const RECOGNIZED_AUDIT_FLAGS = new Set(['--raw', '--range']);
-    const unrecognized = auditArgs.find((a) => a.startsWith('--') && !RECOGNIZED_AUDIT_FLAGS.has(a));
-    if (unrecognized !== undefined) {
-        error(`Unrecognized flag "${boundedPath(unrecognized)}" for vault audit. Supported: a phase directory or number, --raw, --range <from>..<to>.`, ERROR_REASON.SDK_FAIL_FAST);
+    return require('./vault.cjs');
+}
+/** The project root the router's other containment checks use: `findProjectRoot(cwd) || cwd`. */
+function projectRootOf(cwd) {
+    try {
+        return findProjectRoot(cwd) || cwd;
+    }
+    catch {
+        return cwd;
+    }
+}
+/**
+ * THE CONTAINMENT LADDER for a path a 16-06 verb is handed (the
+ * `standardsConsultedVerb` order, T-03-50): a NUL byte is refused, the project
+ * root is resolved, the path must resolve inside the root AND inside its
+ * `.planning/` tree (never the tree itself), and only then is it stat'ed.
+ *
+ *   - `dir`: an existing directory;
+ *   - `file`: an existing regular file (not a symlink);
+ *   - `artifact`: a file that may not exist yet, whose directory exists inside
+ *     `.planning/`; when it does exist it must be a regular file (not a
+ *     symlink), so a write can never be redirected out of the tree.
+ *
+ * `.planning/` is required, not only the root, because every path these verbs
+ * write or read is a planning record; an anchors file or a door record in the
+ * project's source tree would be committed as source (D-55). The refusal names
+ * the bounded argv value, never file content.
+ */
+function resolvePlanningPath(cwd, raw, want) {
+    const shown = boundedPath(raw);
+    if (raw.indexOf('\u0000') !== -1)
+        return { ok: false, reason: 'path-unusable', message: `"${shown}" is not a usable path` };
+    const owner = anchorOwner();
+    const root = projectRootOf(cwd);
+    const abs = node_path_1.default.resolve(cwd, raw);
+    if (!owner.isInsideDir(root, abs)) {
+        return { ok: false, reason: 'outside-project', message: `"${shown}" resolves outside the project and was not used` };
+    }
+    const planning = node_path_1.default.join(root, '.planning');
+    const under = want === 'artifact' ? node_path_1.default.dirname(abs) : abs;
+    if (!owner.isInsideDir(planning, under) || (want !== 'artifact' && owner.isInsideDir(abs, planning))) {
+        return { ok: false, reason: 'outside-planning', message: `"${shown}" is not inside the project's .planning/ tree` };
+    }
+    const rel = node_path_1.default.relative(root, abs).split(node_path_1.default.sep).join('/');
+    try {
+        if (want === 'dir') {
+            if (!node_fs_1.default.statSync(abs).isDirectory())
+                return { ok: false, reason: 'not-a-directory', message: `"${shown}" is not a directory` };
+        }
+        else if (want === 'file') {
+            const st = node_fs_1.default.lstatSync(abs);
+            if (!st.isFile())
+                return { ok: false, reason: 'not-a-file', message: `"${shown}" is not a regular file` };
+        }
+        else {
+            if (!node_fs_1.default.statSync(node_path_1.default.dirname(abs)).isDirectory()) {
+                return { ok: false, reason: 'not-a-directory', message: `the directory of "${shown}" does not exist` };
+            }
+            if (node_fs_1.default.existsSync(abs) || isDanglingLink(abs)) {
+                const st = node_fs_1.default.lstatSync(abs);
+                if (!st.isFile())
+                    return { ok: false, reason: 'not-a-file', message: `"${shown}" exists and is not a regular file` };
+            }
+        }
+    }
+    catch {
+        return { ok: false, reason: 'not-found', message: `"${shown}" does not exist` };
+    }
+    return { ok: true, root, abs, rel };
+}
+/** A symlink whose target is missing: `existsSync` says false, and a write would follow it. */
+function isDanglingLink(abs) {
+    try {
+        return node_fs_1.default.lstatSync(abs).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `vault anchor <verb>` (16-06). INERT FIRST (D-13): unless the producer
+ * admission verdict is `on` (bindings present, every config readable, the
+ * vault gate active) the verb prints nothing and writes nothing, before any
+ * argument is read, so a project without the vault is byte-identical on every
+ * path, including a mistyped one. A `config-unreadable` project is halted by
+ * the admission fence that precedes every call site, never here.
+ *
+ * The verdict is the PRODUCER's (quick 261015-ect, QD-10), the one the other
+ * six record producers ask: equal to the cwd's own except in a linked worktree
+ * with no bindings of its own, where it is the owning checkout's. So all seven
+ * answer alike in every shape; the door fences, which probe the cwd's bindings
+ * first, never reach this verb in such a worktree, so only by-hand calls move.
+ */
+function routeVaultAnchor({ cwd, args, raw, error, c, exec }) {
+    if (anchorOwner().vaultProducerAdmissionVerdict(cwd).state !== 'on')
         return;
+    const verb = args[2];
+    const rest = args.slice(3);
+    if (verb === 'start') {
+        anchorStartVerb({ cwd, rest, raw, error, c, exec });
     }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-    const auditMod = _audit ?? require('./vault-audit.cjs');
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const checkRouter = require('./check-command-router.cjs');
-    const rangeAt = auditArgs.indexOf('--range');
-    const rangeValue = rangeAt === -1 ? undefined : auditArgs[rangeAt + 1];
-    if (rangeAt !== -1) {
-        // The real leaf's predicate: a range check is not switchable by a test mock.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const leaf = require('./vault-audit.cjs');
-        if (typeof rangeValue !== 'string' || !leaf.isValidOperatorRange(rangeValue)) {
-            error(checkRouter.AUDIT_RANGE_REFUSED_MESSAGE, ERROR_REASON.SDK_FAIL_FAST);
+    else if (verb === 'backfill') {
+        anchorBackfillVerb({ cwd, rest, raw, error, c, exec });
+    }
+    else if (verb === 'certify') {
+        anchorCertifyVerb({ cwd, rest, raw, error, c, exec });
+    }
+    else {
+        error(`Unknown vault anchor verb. Available: ${ANCHOR_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    }
+}
+/**
+ * `vault anchor start <dir>` (16-06, D-31): record HEAD as the START anchor of
+ * a phase or quick directory, in `<dir>/.vault-anchors.json`
+ * (`{ start, recordedAt }`, written by the seal leaf's `writeDirStartAnchor`).
+ *
+ * Re-running at the SAME HEAD keeps the recorded start (`kept: true`, nothing
+ * written). At any other HEAD it records HEAD as the new start and says which
+ * start it superseded (`replaced`) — 16 review iteration 2 CR-02, D-98, which
+ * reverses D-93's "keep the first start". Keeping it let every record written
+ * after a resume carry the first start, so its range covered a commit made
+ * between the two runs: a claim of governance nothing granted (rule 3). The
+ * superseded start is kept in the directory's history, newest first, and an
+ * END-only record (a linked worktree's, D-59) takes the latest start that
+ * precedes its own end, so a record written before the resume still covers
+ * its own work. Commits made between the last record and the resume are
+ * covered by nothing and the strict gate names them; the phase's own work
+ * among them is repaired with the attributed start back-fill
+ * (`vault anchor backfill <summary> --from <commit>`), never by a silent
+ * widening.
+ *
+ * Exit 0 on every refusal, which travels as `{ ok: false, reason, message }`
+ * (the step prints it and continues; the strict points type a missing
+ * start). An argument error is the only exit 1.
+ */
+function anchorStartVerb({ cwd, rest, raw, error, c, exec }) {
+    const positionals = [];
+    for (const a of rest) {
+        if (a === '--raw')
+            continue;
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault anchor start. Supported: a positional directory under .planning/, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
             return;
         }
+        positionals.push(a);
+    }
+    if (positionals.length !== 1) {
+        error('vault anchor start takes exactly one directory. Usage: vault anchor start <phase-or-quick-dir> [--raw].', positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
+        return;
     }
-    const phaseArg = auditArgs.find((a, i) => !a.startsWith('--') && !(rangeAt !== -1 && i === rangeAt + 1));
-    if (phaseArg === undefined) {
-        error('No phase directory or phase number was given. Usage: vault audit <phase-dir|phase-number> [--range <from>..<to>] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+    const emit = (result, text) => {
+        c.output(result, true, raw ? JSON.stringify(result) : text);
+    };
+    const located = resolvePlanningPath(cwd, positionals[0], 'dir');
+    if (!located.ok) {
+        emit({ ok: false, action: 'start', reason: located.reason, message: located.message }, `No start anchor was recorded: ${located.message}.`);
         return;
     }
-    let root;
+    const head = exec(['rev-parse', 'HEAD'], { cwd });
+    const sha = head.exitCode === 0 ? head.stdout.trim() : '';
+    if (!vaultSeal.ANCHOR_SHA_RE.test(sha)) {
+        const message = 'HEAD could not be read as a full commit id (no commit yet, or git failed)';
+        emit({ ok: false, action: 'start', reason: 'head-unreadable', message }, `No start anchor was recorded: ${message}.`);
+        return;
+    }
+    const file = `${located.rel}/${vaultSeal.VAULT_ANCHORS_FILE}`;
+    const existing = vaultSeal.readDirAnchors(located.abs);
+    if (existing !== null && existing.start === sha) {
+        emit({ ok: true, action: 'start', start: existing.start, recordedAt: existing.recordedAt, file, kept: true }, `Kept the start anchor ${existing.start} already recorded in ${file} (HEAD has not moved since it was recorded).`);
+        return;
+    }
+    let recorded;
     try {
-        root = findProjectRoot(cwd) || cwd;
+        recorded = vaultSeal.writeDirStartAnchor(located.abs, sha);
     }
     catch {
-        root = cwd;
+        const message = `${file} could not be written`;
+        emit({ ok: false, action: 'start', reason: 'write-failed', message }, `No start anchor was recorded: ${message}.`);
+        return;
     }
-    const phase = checkRouter.resolveDecisionPhaseDir(root, cwd, phaseArg);
-    if (!phase) {
-        const unresolved = {
-            status: 'unresolved',
-            block: true,
-            message: `Vault audit: "${boundedPath(phaseArg)}" is neither an existing directory inside the project nor a `
-                + 'phase the locator resolves, so no practice was compared against anything. Repair: re-run this '
-                + 'command with the phase directory or number.',
-        };
-        c.output(unresolved, true, raw ? JSON.stringify(unresolved) : unresolved.message);
+    const replaced = existing !== null ? { replaced: existing.start } : {};
+    emit({ ok: true, action: 'start', start: recorded.start, recordedAt: recorded.recordedAt, file, ...replaced }, existing !== null
+        ? `Recorded start anchor ${recorded.start} in ${file}, replacing ${existing.start} as the start of every record written from now on; `
+            + 'the earlier start stays in the directory\'s history for a record that ended before this one.'
+        : `Recorded start anchor ${recorded.start} in ${file}.`);
+}
+// ─── 16-19: the certificate writer (D-107, D-108) ────────────────────────────
+/** How long the strict check `vault anchor certify` runs may take before it is a `check-failed` refusal. */
+const CERTIFY_CHECK_TIMEOUT_MS = 120_000;
+/** The most stdout the certify verb reads from its child check (a larger envelope is `check-failed`). */
+const CERTIFY_CHECK_MAX_BUFFER = 8 * 1024 * 1024;
+/** At most this many problem kinds, added ends or removed ends travel in one certify refusal. */
+const CERTIFY_LIST_CAP = 20;
+/** How much of the child check's stderr a `check-failed` refusal quotes. */
+const CERTIFY_STDERR_HEAD = 120;
+/**
+ * `vault anchor certify <phase-dir>` (16 gap closure 16-19, D-107, D-108): the
+ * ONE writer of a phase directory's `.vault-certificates.json`. A certificate
+ * says "a clean strict check of this phase judged this SUMMARY's END, at this
+ * HEAD, at this time"; only a certified phase record bounds a later phase's
+ * SEAL-01 reach (16-18), so the certificate is the recorded fact D-101 said the
+ * gate did not have.
+ *
+ * WHY A CHILD PROCESS. `check vault.trace` is read-only by contract (TRACE-04)
+ * and its handler emits to stdout. Running it as the enforcer does, as
+ * `pp-tools check vault.trace <dir> --unpaired strict --raw`, keeps its exit-0
+ * posture and its envelope exactly what every gate reads, and this verb only
+ * reads that envelope. The engine is the one running (`pp-tools.cjs` beside
+ * this module's directory); the positional is the contained rel, after the
+ * subcommand, never in an option position.
+ *
+ * WHY THE ENDS AND HEAD ARE COLLECTED BEFORE THE SPAWN, AND RE-CHECKED AFTER.
+ * A certificate for an end the check never judged, or stamped with a HEAD the
+ * check did not judge at, is a certificate for a check that never passed: the
+ * shape D-106 closed at the leaf, reopened by its writer. So HEAD is read and
+ * the phase's ended SUMMARY records are collected first, only those ends are
+ * certified, and after the child returns a different HEAD is `head-moved` and a
+ * different set of ends is `records-changed`, each writing nothing. The verb
+ * refuses rather than certifying the intersection, so a concurrent writer is
+ * visible and never silently narrowed; a SUMMARY added while the check ran is
+ * certified by the next clean run.
+ *
+ * WHY THE GIT ENVIRONMENT IS SCRUBBED, FOR THE VERB'S READS AND THE CHILD
+ * ALIKE. A git hook or an agent shell exports the repository pointer
+ * (`GIT_DIR`, `GIT_WORK_TREE`, …), so an inherited value is ordinary, and a
+ * lasting certificate must never describe another repository's HEAD or
+ * verdict. The overlay comes from its one owner, `scrubbedGitEnv` in
+ * `src/vault.cts` (the cache resolver's precedent, 260915-mzx R2): every
+ * inherited `GIT_*` key is `undefined`, which unsets it, because neither
+ * `execGit` nor `spawnSync` passes an undefined value on.
+ *
+ * WHY THE OVERRIDE VARIABLE IS EMPTIED (D-108). An override never certifies:
+ * `checked_with_override`, an envelope carrying `override` and one carrying
+ * `overrideRejected` are each refused, and the child's `VAULT_OVERRIDE_ENV` is
+ * the empty string (which the trace leaf reads as absent), so an operator's
+ * per-run override in the calling shell can never turn a blocking check into a
+ * certificate, whatever a later engine's check does with that variable.
+ *
+ * WHY A QUICK DIRECTORY IS REFUSED (D-104). A quick task's record never bounds
+ * a later phase, so it is never certified (D-113 keeps the leaf from reading
+ * one as certified even if a file named its end).
+ *
+ * A skipped call certifies nothing, which only widens the next phase's reach
+ * and never hides a commit (D-110). Exit 0 on every refusal, which travels as
+ * `{ ok: false, action: 'certify', reason, … }`; an argument error is the only
+ * exit 1. Inert before any argument is read (`routeVaultAnchor`, D-13).
+ */
+function anchorCertifyVerb({ cwd, rest, raw, error, c, exec }) {
+    const positionals = [];
+    for (const a of rest) {
+        if (a === '--raw')
+            continue;
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault anchor certify. Supported: a positional phase directory under .planning/, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        positionals.push(a);
+    }
+    if (positionals.length !== 1) {
+        error('vault anchor certify takes exactly one phase directory. Usage: vault anchor certify <phase-dir> [--raw].', positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const emit = (result, text) => {
+        c.output(result, true, raw ? JSON.stringify(result) : text);
+    };
+    const refuse = (reason, message, extra = {}) => {
+        emit({ ok: false, action: 'certify', reason, ...extra, message }, `Nothing was certified: ${message}.`);
+    };
+    const located = resolvePlanningPath(cwd, positionals[0], 'dir');
+    if (!located.ok) {
+        refuse(located.reason, located.message);
+        return;
+    }
+    if (!vaultSeal.isPhaseRecordRel(`${located.rel}/x`)) {
+        refuse('not-a-phase-dir', `${located.rel} is not a phase directory; a quick task's or a door's record never bounds a later phase (D-104), so it is never certified`);
+        return;
+    }
+    const gitEnv = anchorOwner().scrubbedGitEnv(process.env);
+    const readHead = () => {
+        const r = exec(['rev-parse', 'HEAD'], { cwd, env: gitEnv });
+        const sha = r.exitCode === 0 ? r.stdout.trim() : '';
+        return vaultSeal.ANCHOR_SHA_RE.test(sha) ? sha : '';
+    };
+    const head = readHead();
+    if (head === '') {
+        refuse('head-unreadable', 'HEAD could not be read as a full commit id (no commit yet, or git failed)');
+        return;
+    }
+    // A filesystem walk, no git: the ends of the SUMMARY records directly in this
+    // directory, sorted and unique.
+    const collectEnds = () => {
+        const scan = vaultSeal.collectCoveringRecords(located.root);
+        const prefix = `${located.rel}/`;
+        const ends = scan.records
+            .filter((r) => vaultSeal.isSummaryRecordRel(r.rel) && r.rel.startsWith(prefix) && r.rel.indexOf('/', prefix.length) === -1)
+            .map((r) => r.end);
+        return [...new Set(ends)].sort();
+    };
+    const endsBefore = collectEnds();
+    if (endsBefore.length === 0) {
+        const message = `${located.rel} has no SUMMARY with an end anchor, so there is nothing to certify; the strict check was not run`;
+        emit({ ok: false, action: 'certify', reason: 'no-ended-record', message }, `Nothing was certified: ${message}.`);
         return;
     }
-    const result = auditMod.runVaultAudit({
-        root,
-        phaseDir: phase.abs,
-        exec: _exec ?? shell_command_projection_cjs_1.execGit,
-        ...(typeof rangeValue === 'string' ? { range: rangeValue } : {}),
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { VAULT_OVERRIDE_ENV } = require('./vault-trace.cjs');
+    const child = childProcess.spawnSync(process.execPath, [node_path_1.default.join(__dirname, '..', 'pp-tools.cjs'), 'check', 'vault.trace', located.rel, '--unpaired', 'strict', '--raw'], {
+        cwd: located.root,
+        encoding: 'utf8',
+        timeout: CERTIFY_CHECK_TIMEOUT_MS,
+        maxBuffer: CERTIFY_CHECK_MAX_BUFFER,
+        env: { ...process.env, ...gitEnv, [VAULT_OVERRIDE_ENV]: '' },
+        windowsHide: true,
     });
-    // The leaf's object, untouched: the operator view and the gate serialize the
-    // same envelope, and nothing between the leaf and the screen rebuilds it.
-    if (raw) {
-        c.output(result, true, JSON.stringify(result));
+    const stderrHead = boundedPath(String(child.stderr ?? '').slice(0, CERTIFY_STDERR_HEAD));
+    const failed = (why) => {
+        refuse('check-failed', `the strict check of ${located.rel} could not be read (${why})`, { detail: `${why}; stderr: ${stderrHead}` });
+    };
+    if (child.error) {
+        failed(`the check did not run: ${boundedPath(child.error.message).slice(0, CERTIFY_STDERR_HEAD)}`);
+        return;
     }
-    else {
-        c.output(result, true, auditMod.renderAuditReport(result));
+    if (child.signal) {
+        failed(`the check was ended by ${child.signal}`);
+        return;
+    }
+    if (child.status !== 0) {
+        failed(`the check exited ${child.status}`);
+        return;
     }
+    const stdout = String(child.stdout ?? '');
+    if (stdout.trim() === '') {
+        failed('the check printed nothing');
+        return;
+    }
+    let envelope;
+    try {
+        const parsed = JSON.parse(stdout);
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            failed('the check printed JSON that is not an object');
+            return;
+        }
+        envelope = parsed;
+    }
+    catch {
+        failed('the check printed something that is not JSON');
+        return;
+    }
+    // The verdict gate (D-107, D-108): a clean strict verdict, and nothing else.
+    const has = (k) => Object.prototype.hasOwnProperty.call(envelope, k);
+    const status = typeof envelope.status === 'string' ? boundedPath(envelope.status) : null;
+    const block = typeof envelope.block === 'boolean' ? envelope.block : null;
+    const clean = envelope.status === 'checked' && envelope.block === false && !has('override') && !has('overrideRejected');
+    if (!clean) {
+        const problems = Array.isArray(envelope.problems) ? envelope.problems : [];
+        const kinds = [...new Set(problems
+                .map((p) => (p && typeof p === 'object' ? p.kind : undefined))
+                .filter((k) => typeof k === 'string')
+                .map((k) => boundedPath(k)))].sort().slice(0, CERTIFY_LIST_CAP);
+        const overridden = envelope.status === 'checked_with_override' || has('override');
+        refuse(overridden ? 'overridden' : 'not-clean', `the strict check of ${located.rel} answered ${status ?? 'no status'}, block ${String(block)}`
+            + `${kinds.length > 0 ? ` (${kinds.join(', ')})` : ''}`
+            + `${overridden ? '; an override never certifies (D-108)' : ''}`, { status, block, kinds });
+        return;
+    }
+    // After the child returned clean: the HEAD it judged at, then the ends it judged.
+    const headAfter = readHead();
+    if (headAfter !== head) {
+        refuse('head-moved', `HEAD moved from ${head} to ${headAfter || 'an unreadable HEAD'} while the strict check of ${located.rel} ran; re-run certify`, { head, headAfter: headAfter || null });
+        return;
+    }
+    const endsAfter = collectEnds();
+    const beforeSet = new Set(endsBefore);
+    const afterSet = new Set(endsAfter);
+    const added = endsAfter.filter((e) => !beforeSet.has(e));
+    const removed = endsBefore.filter((e) => !afterSet.has(e));
+    if (added.length > 0 || removed.length > 0) {
+        refuse('records-changed', `the ended records of ${located.rel} changed while its strict check ran (${added.length} added, ${removed.length} removed); re-run certify`, { added: added.slice(0, CERTIFY_LIST_CAP), removed: removed.slice(0, CERTIFY_LIST_CAP) });
+        return;
+    }
+    // Only the ends collected BEFORE the spawn, stamped with the HEAD read before it.
+    const file = `${located.rel}/${vaultSeal.VAULT_CERTIFICATES_FILE}`;
+    const already = new Set(vaultSeal.readDirCertificates(located.abs).map((cert) => cert.end));
+    const fresh = endsBefore.filter((e) => !already.has(e));
+    const old = endsBefore.filter((e) => already.has(e));
+    if (fresh.length > 0) {
+        const at = new Date().toISOString();
+        try {
+            vaultSeal.appendDirCertificates(located.abs, fresh.map((end) => ({ end, head, at })));
+        }
+        catch (e) {
+            refuse('write-failed', `${file} could not be written (${boundedPath(e instanceof Error ? e.message : String(e))})`);
+            return;
+        }
+    }
+    emit({ ok: true, action: 'certify', dir: located.rel, file, head, certified: fresh, alreadyCertified: old, ...(fresh.length === 0 ? { kept: true } : {}) }, fresh.length === 0
+        ? `Kept: every end anchor of ${located.rel} is already certified (${old.length}); nothing written.`
+        : `Certified ${fresh.length} end anchor(s) of ${located.rel} at HEAD ${head} after its strict check passed clean (${old.length} already certified).`);
+}
+/**
+ * The text's lines, split on the same boundaries the record parsers split on
+ * (`\r\n`, `\r`, `\n`), with their offsets, so an insertion lands at a line the
+ * parser counted and every other byte stays where it was.
+ */
+function lineSpans(text) {
+    const spans = [];
+    const re = /\r\n|\r|\n/g;
+    let last = 0;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        spans.push({ start: last, end: m.index, eol: m[0] });
+        last = m.index + m[0].length;
+    }
+    spans.push({ start: last, end: text.length, eol: '' });
+    return spans;
 }
-const REVIEW_VERBS = ['scaffold', 'finalize'];
-const REVIEW_USAGE = 'vault review scaffold|finalize <phase> [--force] [--raw]';
-/** The artifact a review writes in its phase directory: `<NN>-VAULT-REVIEW.md`. */
-function reviewArtifactName(phaseToken) {
-    return `${phaseToken ? `${phaseToken}-` : ''}VAULT-REVIEW.md`;
+/** Insert `lines` as new lines directly after line `after`, in that line's own line ending. */
+function insertLinesAfter(text, spans, after, lines) {
+    const eol = spans[after].eol || (spans.find((sp) => sp.eol !== '')?.eol ?? '\n');
+    const at = spans[after].end;
+    return `${text.slice(0, at)}${lines.map((l) => `${eol}${l}`).join('')}${text.slice(at)}`;
 }
 /**
- * `vault review scaffold|finalize <phase> [--force] [--raw]` — the artifact half
- * of `/pp-vault-review`. The derivation is `check vault-review`'s, through the
- * same exported resolver and composer, so all three see one phase and one
- * payload.
- *
- *   - `scaffold` writes `<phase-dir>/<NN>-VAULT-REVIEW.md` from the payload:
- *     every computed section, every derived row, one `TODO` row per practice
- *     the agent must judge, and the three computed lines. It does not replace
- *     an existing review unless `--force` is given.
- *   - `finalize` re-stamps the rate, counts and coverage lines from the rows the
- *     agent wrote (the only writer of those lines), writes the file back when
- *     that changed it, and reports every problem: the validator's (a `TODO`
- *     left, a missing reason, a reclassified derived row, a score) and the
- *     population's (a practice dropped, added or duplicated).
- *
- * Exit 0 on every path and no `block` key on any envelope: the review reports
- * and never gates, so a problem is a repair item, never a halt.
+ * `vault anchor backfill <summary> --at <sha>` (16-06, D-32):
+ * give a record written before anchors existed its anchors, ATTRIBUTED. There
+ * is no silent restamp at HEAD: `--at` is required (the operator states which
+ * commit the record's work ended at), it must be an ancestor of HEAD, and the
+ * record gains, beside the anchor, who ran the back-fill (`git config
+ * user.name`, bounded) and when. 16-07 reports a back-filled anchor as a note
+ * on every later check. `--at HEAD` is allowed, and is still attributed.
+ *
+ * The record is a SUMMARY's `## Standards Consulted` section: the anchor line
+ * with its `backfilled by <who> at <iso>` tail is inserted as the section's
+ * last line (no start: the record takes its directory's, D-59).
+ *
+ * Every other byte of the file is kept: the new text is the old one with lines
+ * inserted, and it is parsed back before it is written — the anchors must read
+ * back as written and the rest of the record must parse to exactly what it
+ * parsed to before, or nothing is written. The write is a temporary sibling
+ * renamed into place.
+ *
+ * Refused, writing nothing: a record that already carries an anchor (a valid,
+ * a dropped or a malformed one: `already-anchored`), a file with no
+ * Standards Consulted section (`no-record`), an `--at` that is not an ancestor of HEAD. A
+ * path outside `.planning/`, a malformed sha and `--from`/`--attest` beside
+ * `--at` are argument errors (exit 1), refused before any read or git call;
+ * the state refusals are `ok: false` envelopes (exit 0).
+ *
+ * 16 review iteration 3 CR-01 (D-102): `--at --from <commit>` set a start of
+ * the operator's choosing (the root commit, say), and D-98's `--from` alone
+ * widened an anchored record's start the same way; either covered every commit
+ * in between with one attribution and named none. Both are gone. The one repair
+ * left for a commit a record's range misses is `--from <recorded start>
+ * --attest <commit>` (`attestVerb`), which covers that commit alone.
  */
-function routeReview({ args, cwd, raw, c, }) {
-    const say = (envelope, text) => {
-        c.output(envelope, true, raw ? JSON.stringify(envelope) : text);
+function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
+    const usage = 'Usage: vault anchor backfill <summary-path> --at <commit> [--raw], or, on a record that carries an end, '
+        + '--from <a start its directory recorded> --attest <commit> [--attest <commit> ...] [--raw].';
+    const positionals = [];
+    const shas = {};
+    const attest = [];
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--at' || a === '--from' || a === '--attest') {
+            const v = rest[i + 1];
+            if (v === undefined || v.startsWith('--')) {
+                error(`${a} needs a commit. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            if (a === '--attest')
+                attest.push(v);
+            else
+                shas[a] = v;
+            i += 1;
+            continue;
+        }
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault anchor backfill. Supported: --at <commit>, --from <commit>, --attest <commit>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        positionals.push(a);
+    }
+    if (positionals.length !== 1) {
+        error(`vault anchor backfill takes exactly one SUMMARY path. ${usage}`, positionals.length === 0 ? ERROR_REASON.SDK_MISSING_ARG : ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (shas['--at'] === undefined && shas['--from'] === undefined) {
+        error(`vault anchor backfill needs --at <commit>: there is no silent restamp at HEAD; name the commit the record's work ended at. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    // 16 review iteration 3 CR-01 (D-102): nothing widens a record's start any
+    // more. `--at` gives a record with no anchor its END (its start is its
+    // directory's, D-59); `--from` only bounds `--attest`, which names each
+    // commit that counts as covered, one by one.
+    if (shas['--at'] !== undefined && (shas['--from'] !== undefined || attest.length > 0)) {
+        error(`--at gives a record its end and nothing else; --from and --attest are for a record that already carries one (they attest single commits, they never widen its range). ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (shas['--at'] === undefined && (shas['--from'] === undefined || attest.length === 0)) {
+        error(`${shas['--from'] === undefined ? '--attest needs --from <a start the record\'s directory recorded>' : '--from needs at least one --attest <commit>: each commit is attested by its own full id, and nothing else is covered'}. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    for (const [flag, value] of [['--at', shas['--at']], ['--from', shas['--from']], ...attest.map((v) => ['--attest', v])]) {
+        if (value !== undefined && !vaultSeal.ANCHOR_SHA_RE.test(value)) {
+            error(`${flag} is not a full lowercase commit id (40 or 64 hex). ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+    }
+    const located = resolvePlanningPath(cwd, positionals[0], 'file');
+    if (!located.ok) {
+        error(`The SUMMARY path ${located.message}; a back-fill rewrites only a record under .planning/.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const at = shas['--at'];
+    const from = shas['--from'];
+    const emit = (result, text) => {
+        c.output(result, true, raw ? JSON.stringify(result) : text);
     };
-    const verb = args[2];
-    if (!REVIEW_VERBS.includes(verb)) {
-        const statement = `Vault review: "${boundedPath(typeof verb === 'string' ? verb : '')}" is not a review verb, so nothing was ` +
-            `reviewed. Usage: ${REVIEW_USAGE}.`;
-        say({ status: 'usage', statement }, statement);
+    const refuse = (reason, message) => {
+        emit({ ok: false, action: 'backfill', file: located.rel, reason, message }, `No anchor was back-filled: ${message}.`);
+    };
+    const size = node_fs_1.default.statSync(located.abs).size;
+    if (size > vaultSeal.TRACE_ARTIFACT_BYTE_CAP) {
+        refuse('too-large', `${located.rel} is ${size} bytes, above the ${vaultSeal.TRACE_ARTIFACT_BYTE_CAP}-byte read cap the record readers apply`);
         return;
     }
-    const force = verb === 'scaffold' && args.includes('--force');
-    const tokens = args.slice(3).filter((a) => a !== '--raw' && !(force && a === '--force'));
+    const text = node_fs_1.default.readFileSync(located.abs, 'utf8');
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const checkRouter = require('./check-command-router.cjs');
-    const target = checkRouter.resolveVaultReviewTarget(cwd, tokens, REVIEW_USAGE);
-    if (!target.ok) {
-        say({ status: target.status, statement: target.statement }, target.statement);
+    const traceLeaf = require('./vault-trace.cjs');
+    const section = vaultStandardsLeaf.parseConsultedSection(text);
+    if (!section.present || section.planId === null) {
+        refuse('no-record', `${located.rel} carries no ${vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING} section to back-fill`);
         return;
     }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const leaf = require('./vault-review.cjs');
-    const payload = checkRouter.composeVaultReviewPayload(target.root, target.phase, target.phaseToken);
-    const name = reviewArtifactName(target.phaseToken);
-    const file = `${target.phase.rel}/${name}`;
-    const abs = node_path_1.default.join(target.phase.abs, name);
-    const partition = (payload.partition ?? {});
-    const coverage = typeof payload.mechanicalCoverageLine === 'string' ? payload.mechanicalCoverageLine : null;
-    if (verb === 'scaffold') {
-        if (node_fs_1.default.existsSync(abs) && !force) {
-            const statement = `Vault review: ${file} already exists, so it was left as it is. Re-run with --force to replace it ` +
-                'with a fresh scaffold, or run vault review finalize to check it.';
-            say({ status: 'exists', file, statement }, statement);
+    const anchored = section.anchors !== undefined
+        || section.problems.some((p) => p.kind === vaultStandardsLeaf.STANDARDS_PROBLEM_KIND.ANCHOR_MALFORMED);
+    if (at === undefined) {
+        // `--from` + `--attest`: the attestation (16 review iteration 3 CR-01, D-102).
+        if (!anchored) {
+            refuse('at-required', `${located.rel} carries no anchor yet; give it its end with --at <commit> (--from and --attest attest single commits on a record that already carries an end)`);
             return;
         }
-        const text = leaf.renderReviewScaffold(payload, {
-            date: new Date().toISOString().slice(0, 10),
-            phaseToken: target.phaseToken,
+        attestVerb({
+            cwd, exec, text, located, from, attest, refuse, emit, traceLeaf,
         });
-        node_fs_1.default.writeFileSync(abs, text, 'utf-8');
-        const toJudge = Array.isArray(partition.remainder) ? partition.remainder.length : 0;
-        const derived = (Array.isArray(partition.naUniverse) ? partition.naUniverse.length : 0) +
-            (Array.isArray(partition.naNoFile) ? partition.naNoFile.length : 0);
-        const statement = `Vault review: wrote ${file} (arm: ${String(payload.arm)}; ${toJudge} practice(s) to judge, ` +
-            `${derived} derived N-A${payload.refusesCleanRender === true ? '; no clean review may be rendered from it' : ''}).`;
-        say({ status: 'written', file, arm: payload.arm, toJudge, derived, refusesCleanRender: payload.refusesCleanRender === true, statement }, statement);
         return;
     }
-    // finalize
-    let current;
+    if (anchored) {
+        refuse('already-anchored', `${located.rel} already carries an anchor; a back-fill only gives anchors to a record that never had one (a commit its range misses is attested with --from and --attest)`);
+        return;
+    }
+    // The shas reach git only now, shape-checked, after the subcommand (T-16-21).
+    if (exec(['merge-base', '--is-ancestor', at, 'HEAD'], { cwd }).exitCode !== 0) {
+        refuse('at-not-ancestor', `--at ${at} is not an ancestor of HEAD (or is not in this repository)`);
+        return;
+    }
+    const backfill = { by: traceLeaf.resolveBackfillIdentity(cwd), at: new Date().toISOString() };
+    const spans = lineSpans(text);
+    const live = vaultStandardsLeaf.findLiveSection(text, vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING);
+    const lastBody = live.body[live.body.length - 1];
+    const line = vaultStandardsLeaf.formatStandardsAnchorLine({ start: from ?? null, end: at, backfill });
+    const next = insertLinesAfter(text, spans, lastBody, [line]);
+    const back = vaultStandardsLeaf.parseConsultedSection(next);
+    const before = section;
+    const expected = { ...(from !== undefined ? { start: from } : {}), end: at, backfill };
+    const strip = (p) => JSON.stringify({ ...p, anchors: undefined, headingLine: undefined });
+    const agrees = back.present
+        && JSON.stringify(back.anchors) === JSON.stringify({ end: expected.end, ...(from !== undefined ? { start: from } : {}), backfill })
+        && strip(back) === strip(before);
+    if (!agrees) {
+        refuse('rewrite-unverifiable', `the back-filled section in ${located.rel} would not read back as written, so nothing was written`);
+        return;
+    }
+    const tmp = `${located.abs}.${process.pid}.tmp`;
     try {
-        current = node_fs_1.default.readFileSync(abs, 'utf-8');
+        node_fs_1.default.writeFileSync(tmp, next, 'utf8');
+        node_fs_1.default.renameSync(tmp, located.abs);
     }
     catch {
-        const statement = `Vault review: ${file} does not exist, so there is nothing to finalize. Run vault review scaffold first.`;
-        say({ status: 'absent', file, statement }, statement);
+        try {
+            node_fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* nothing to clean */ }
+        refuse('write-failed', `${located.rel} could not be written`);
         return;
     }
-    const stamped = leaf.stampReviewLines(current, { coverageLine: coverage });
-    if (stamped.stamped && stamped.text !== current)
-        node_fs_1.default.writeFileSync(abs, stamped.text, 'utf-8');
-    const result = leaf.validateReviewArtifact(stamped.text, { expectedCoverageLine: coverage });
-    const problems = [...result.problems, ...leaf.compareReviewPopulation(result.rows, partition)];
-    const envelope = {
-        status: problems.length === 0 ? 'valid' : 'problems',
-        file,
-        rateLine: result.expectedRateLine,
-        countsLine: result.expectedCountsLine,
-        problems,
+    const result = {
+        ok: true,
+        action: 'backfill',
+        file: located.rel,
+        family: 'standards',
+        endCommit: at,
+        ...(from !== undefined ? { startCommit: from } : {}),
+        backfilledBy: backfill.by,
+        backfilledAt: backfill.at,
     };
-    const text = [
-        `Vault review: ${file}`,
-        result.expectedRateLine,
-        result.expectedCountsLine,
-        ...(problems.length === 0
-            ? ['No repair items.']
-            : [
-                `Repair items (${problems.length}) — fix them in the artifact, then run vault review finalize again:`,
-                ...problems.map((p) => `- ${p.kind}${p.id ? ` (${p.id})` : ''}${p.line ? `, line ${p.line}` : ''}: ${p.detail}`),
-            ]),
-        'This review reports and does not gate.',
-    ].join('\n');
-    say(envelope, text);
+    emit(result, `Back-filled ${located.rel}: end ${at}${from !== undefined ? `, start ${from}` : ''}, by ${backfill.by} at ${backfill.at}.`);
+}
+/**
+ * The attestation (16 review iteration 3 CR-01, D-102; replaces D-98's start
+ * back-fill): `vault anchor backfill <summary> --from <start> --attest <commit>
+ * [--attest <commit> ...]` on a record that already carries an end.
+ *
+ * D-98 records a new directory start on every resume, so the phase's own
+ * commits made between its last record and the resume are covered by nothing,
+ * and the strict gate names them. Whether such a commit is the phase's work or
+ * an ungoverned one is not something the engine can tell. D-98's repair widened
+ * the record's START, which covered every commit in between — an ungoverned one
+ * made by someone else between the runs included — and left a note naming none
+ * of them. An attestation widens nothing: each `--attest` names ONE commit, and
+ * that commit alone counts as covered by the record. Every later strict check
+ * lists it, with its subject and paths and who attested it. A commit nobody
+ * attested stays named, and stays a block.
+ *
+ * Refused, writing nothing (each an `ok: false` envelope):
+ *   - a record with no valid end (`at-required`, `no-end`) or a malformed anchor;
+ *   - `--from` that is not a start the record's own directory recorded
+ *     (`vault anchor start` writes them, D-98 keeps the superseded ones), so no
+ *     attestation reaches below where the CLI saw this phase begin
+ *     (`from-not-recorded`), or that is not an ancestor of the record's end;
+ *   - an `--attest` that is not on the record's own (first-parent) line between
+ *     `--from` and its end, a merge commit, a commit touching no source path, one
+ *     the record already covers, one already attested on it, or given twice.
+ *
+ * The attestations are written to `<dir>/.vault-attestations.json` (the seal
+ * leaf's `appendDirAttestations`), never into the record: the record's bytes,
+ * and the range they state, do not change. `by` is the git `user.name` of
+ * whoever ran the command — what the CLI can read, not a verified identity —
+ * and the envelope says so (`byVerified: false`).
+ */
+function attestVerb({ cwd, exec, text, located, from, attest, refuse, emit, traceLeaf }) {
+    const dirAbs = node_path_1.default.dirname(located.abs);
+    const recordName = node_path_1.default.basename(located.abs);
+    const kind = vaultSeal.RECORDED_ARTIFACT_KIND.STANDARDS_CONSULTED;
+    const isAncestor = (a, d) => vaultSeal.isAnchorSha(a) && vaultSeal.isAnchorSha(d)
+        && exec(['merge-base', '--is-ancestor', a, d], { cwd }).exitCode === 0;
+    const anchors = vaultSeal.resolveRecordAnchors(text, kind, dirAbs, { isAncestor });
+    if (anchors.problems.some((p) => p.kind === 'anchor_invalid')) {
+        refuse('anchors-malformed', `an anchor of ${located.rel} is malformed or was dropped; restore the value the CLI wrote before attesting a commit on it`);
+        return;
+    }
+    const end = anchors.end;
+    if (end === undefined) {
+        refuse('no-end', `${located.rel} carries no valid end anchor; give it one with --at <commit> first`);
+        return;
+    }
+    const dir = vaultSeal.readDirAnchors(dirAbs);
+    const recorded = dir === null ? [] : [dir.start, ...(dir.earlier ?? []).map((e) => e.start)];
+    if (!recorded.includes(from)) {
+        refuse('from-not-recorded', `--from ${from} is not a start this record's directory recorded (${recorded.length} recorded, by vault anchor start); `
+            + 'an attestation reaches back only to a start the CLI recorded for this phase, never to an arbitrary commit');
+        return;
+    }
+    if (from === end || !isAncestor(from, end)) {
+        refuse('from-not-ancestor', `--from ${from} is not an ancestor of the record's end ${end}`);
+        return;
+    }
+    const cap = vaultSeal.SEAL_CANDIDATE_CAP;
+    const lineRun = exec(['rev-list', '--first-parent', '--parents', `--max-count=${cap + 1}`, `^${from}`, end], { cwd });
+    const rows = lineRun.exitCode === 0 ? lineRun.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).map((l) => l.split(/\s+/)) : null;
+    if (rows === null || !rows.every((r) => r.every((x) => vaultSeal.isAnchorSha(x)))) {
+        refuse('git-failed', 'the commits between --from and the record\'s end could not be listed');
+        return;
+    }
+    if (rows.length > cap) {
+        refuse('too-many', `more than ${cap} commits lie between --from and the record's end`);
+        return;
+    }
+    const onLine = new Map(rows.map((r) => [r[0], r.length - 1]));
+    let own = new Set();
+    if (anchors.start !== undefined && isAncestor(anchors.start, end)) {
+        const ownRun = exec(['rev-list', '--first-parent', `--max-count=${cap + 1}`, `^${anchors.start}`, end], { cwd });
+        if (ownRun.exitCode !== 0) {
+            refuse('git-failed', 'the commits the record already covers could not be listed');
+            return;
+        }
+        own = new Set(ownRun.stdout.split(/\r?\n/).map((l) => l.trim()).filter(Boolean));
+    }
+    const already = new Set(vaultSeal.attestedFor(vaultSeal.readDirAttestations(dirAbs), recordName).map((a) => a.sha));
+    const by = traceLeaf.resolveBackfillIdentity(cwd);
+    const at = new Date().toISOString();
+    const entries = [];
+    for (const sha of attest) {
+        if (entries.some((e) => e.sha === sha)) {
+            refuse('attest-duplicate', `--attest ${sha} was given twice`);
+            return;
+        }
+        if (!onLine.has(sha)) {
+            refuse('attest-not-in-range', `--attest ${sha} is not on ${located.rel}'s own line between --from ${from} and its end ${end}`);
+            return;
+        }
+        if (onLine.get(sha) > 1) {
+            refuse('attest-merge', `--attest ${sha} is a merge commit; attest the commits it brought in, each by its own id`);
+            return;
+        }
+        if (own.has(sha)) {
+            refuse('attest-already-covered', `--attest ${sha} is already inside ${located.rel}'s own range; it needs no attestation`);
+            return;
+        }
+        if (already.has(sha)) {
+            refuse('attest-already-attested', `--attest ${sha} is already attested on ${located.rel}`);
+            return;
+        }
+        const tree = exec(['diff-tree', '-r', '-z', '--root', '--no-commit-id', '--name-only', '--no-renames', sha], { cwd });
+        const subj = exec(['log', '-1', '--format=%s', sha], { cwd });
+        if (tree.exitCode !== 0 || subj.exitCode !== 0) {
+            refuse('git-failed', `the paths or subject of ${sha} could not be read`);
+            return;
+        }
+        const paths = tree.stdout.split('\0').filter((p) => p !== '' && !vaultSeal.isNonSourcePath(p));
+        if (paths.length === 0) {
+            refuse('attest-not-source', `--attest ${sha} touches no governed source path, so no check names it and there is nothing to attest`);
+            return;
+        }
+        const flat = (v, n) => {
+            const f = v.replace(/[\u0000-\u001F\u007F-\u009F]+/g, ' ').replace(/\s+/g, ' ').trim();
+            return f.length > n ? `${f.slice(0, n)}…` : f;
+        };
+        entries.push({
+            record: recordName,
+            from,
+            sha,
+            subject: flat(subj.stdout, vaultSeal.SEAL_SUBJECT_CAP),
+            paths: paths.slice(0, vaultSeal.ATTESTATION_PATHS_CAP).map((p) => flat(p, 1000)),
+            by,
+            at,
+        });
+    }
+    try {
+        vaultSeal.appendDirAttestations(dirAbs, entries);
+    }
+    catch (e) {
+        refuse('write-failed', `${vaultSeal.VAULT_ATTESTATIONS_FILE} next to ${located.rel} could not be written (${boundedPath(e instanceof Error ? e.message : String(e))})`);
+        return;
+    }
+    const listed = entries.map((e) => ({ sha: e.sha, subject: e.subject, paths: e.paths }));
+    emit({
+        ok: true,
+        action: 'attest',
+        file: located.rel,
+        family: 'standards',
+        from,
+        endCommit: end,
+        attested: listed,
+        attestedBy: by,
+        byVerified: false,
+        attestedAt: at,
+    }, `Attested ${entries.length} commit${entries.length === 1 ? '' : 's'} on ${located.rel}, by ${by} (the git user.name, not verified) at ${at}: `
+        + `${entries.map((e) => `${e.sha.slice(0, 12)} "${e.subject}" (${e.paths.join(', ')})`).join('; ')}. Every later strict check lists each one.`);
+}
+/** The longest free-text value a door record line carries (the reason-clause bound, with room). */
+const DOOR_TEXT_MAX = 190;
+/**
+ * A free-text value made safe for a door record line: the vault leaf's display
+ * sanitiser (controls, bidi, zero-width), backticks turned into
+ * apostrophes, bounded. Empty or the literal `none` becomes `unknown`, because
+ * `none` is how a door record spells an absent value.
+ */
+function doorText(value, opts = {}) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const indexLeaf = require('./vault-index.cjs');
+    let t = indexLeaf.sanitiseVaultText(typeof value === 'string' ? value : '', DOOR_TEXT_MAX).replace(/`/g, "'").trim();
+    if (opts.token === true)
+        t = t.replace(/\s+/g, '_');
+    return t === '' || t === 'none' ? 'unknown' : t;
+}
+/**
+ * The vault coordinates a door worked under, or the degraded one-liner saying
+ * why there are none (D-12 "or") — read by the standards block verb's own pin
+ * reader, `standardsLoadedPin` over the manifest of the one resolved cache; no
+ * loaded pin records the degraded line `vault standards block` would write.
+ *
+ * The repo has already been through `redactCloneTarget` (`readManifest`), so
+ * no credential reaches the record.
+ */
+function doorVaultPin(cwd, owner) {
+    const cacheDir = owner.resolveVaultCacheDir(cwd).dir;
+    const pin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cacheDir));
+    if (pin !== null && vaultSeal.ANCHOR_SHA_RE.test(pin.sha)) {
+        return { vault: { repo: doorText(pin.repo, { token: true }), ref: doorText(pin.ref, { token: true }), sha: pin.sha }, degraded: null };
+    }
+    const line = vaultStandardsLeaf.standardsDegradedLineFor('not-loaded');
+    return { vault: null, degraded: doorText(`${line.kind}: ${line.reason}`) };
+}
+/**
+ * Where a door artifact may live: a phase directory (root or workstream), a
+ * quick-task directory, or `.planning/audits`. Those are exactly the
+ * directories the seal readers walk (`hasRecordedVaultArtifacts`, 16-07's
+ * covering-record walk), so a record written anywhere else would be a record
+ * no reader ever finds: the door would believe it was recorded and nothing
+ * would see it (D-55).
+ */
+function isDoorArtifactLocation(rel) {
+    const parts = rel.split('/');
+    if (parts[0] !== '.planning')
+        return false;
+    if (parts.length === 4 && (parts[1] === 'phases' || parts[1] === 'quick'))
+        return true;
+    if (parts.length === 6 && parts[1] === 'workstreams' && parts[3] === 'phases')
+        return true;
+    return parts.length === 3 && parts[1] === 'audits';
+}
+/**
+ * `vault door-record --begin --door <name>` (16 review CR-01): record HEAD as
+ * the door's START in `.planning/.vault-door-starts.json` (the seal leaf's
+ * `writeDoorStart`), before the door's agent runs. The record step then reads
+ * it, so the start survives the agent's fresh shell per step and is never
+ * typed. Called after admission (`on`) and the door-name check; takes no other
+ * flag. Every refusal is an error (exit 1), like the record itself: a door that
+ * cannot capture its start halts before its agent writes anything.
+ */
+function doorBegin({ cwd, door, extra, raw, error, c, exec, usage }) {
+    if (extra.length > 0) {
+        error(`--begin takes only --door; ${extra.join(', ')} belong to the record step. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const root = projectRootOf(cwd);
+    const planning = node_path_1.default.join(root, '.planning');
+    try {
+        if (!node_fs_1.default.statSync(planning).isDirectory())
+            throw new Error('not a directory');
+    }
+    catch {
+        error('The project has no .planning/ directory, so the door start has nowhere to be recorded.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const head = exec(['rev-parse', 'HEAD'], { cwd });
+    const sha = head.exitCode === 0 ? head.stdout.trim() : '';
+    if (!vaultSeal.ANCHOR_SHA_RE.test(sha)) {
+        error('HEAD could not be read as a full commit id (no commit yet, or git failed), so no door start was recorded.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    let recorded;
+    try {
+        recorded = vaultSeal.writeDoorStart(planning, door, sha);
+    }
+    catch {
+        error(`.planning/${vaultSeal.VAULT_DOOR_STARTS_FILE} could not be written, so no door start was recorded.`, ERROR_REASON.UNKNOWN);
+        return;
+    }
+    const file = `.planning/${vaultSeal.VAULT_DOOR_STARTS_FILE}`;
+    const result = { ok: true, action: 'begin', door, start: recorded.start, recordedAt: recorded.recordedAt, file };
+    c.output(result, true, raw ? JSON.stringify(result) : `Recorded the ${door} door's start ${recorded.start.slice(0, 12)} in ${file}.`);
+}
+/**
+ * `vault door-record --door <name> --artifact <path> [--phase <N|dir>]`
+ * (16-06, D-12), after `vault door-record --begin --door <name>` (16 review
+ * CR-01): the ONE verb that writes a door's record, a mode-stamped
+ * `## Vault Door Record` section (`formatDoorRecord`, the seal leaf's grammar)
+ * appended to the door's own artifact.
+ *
+ * The record carries the mode, the vault ref and sha (or the degraded
+ * one-liner), the governing phase, the START commit the door captured before
+ * its agent ran, the END commit (HEAD now) and when it was written. The start
+ * is the one the door's `--begin` recorded in `.planning/`, and nothing else
+ * (16 review iteration 3 CR-02, D-103: an explicit `--start` was a side door
+ * that widened a record to any ancestor of HEAD with no note); nothing in the
+ * record is typed by an agent (the
+ * Phase 15 D-06 lesson), and no shell variable has to survive between the
+ * door's steps.
+ *
+ * ORDER: admission first and silent (D-13: no output, no file, unless the
+ * producer admission verdict answers `on` — the one every vault record producer
+ * asks, quick 261015-ect QD-10: the cwd's own verdict except in a linked
+ * worktree with no bindings of its own, where it is the owning checkout's; the
+ * door fences probe the cwd's bindings first and never reach here there), then
+ * the arguments, the door name, the artifact
+ * (containment ladder, `.planning/` only, a seal-walked directory, a door
+ * artifact filename), the start (anchor shape BEFORE it reaches git, then an
+ * ancestor of HEAD, with the revision after the subcommand, T-16-21), the
+ * phase, HEAD, the pin.
+ *
+ * APPEND, NEVER REWRITE: existing content is kept byte for byte and the section
+ * goes after it; an absent artifact is created with a one-line header. An
+ * artifact that already carries a door record is REFUSED rather than given a
+ * second one, because two sections are a duplicate the reader rejects, which
+ * would leave the door with no readable record at all. The composed text is
+ * read back with `parseDoorRecord` before anything is written, so the verb can
+ * never write a record its own reader refuses (an unclosed fence above the
+ * section, say), and the write is a temporary sibling renamed into place.
+ *
+ * Every refusal is an error (exit 1): a door that cannot record halts its
+ * fence instead of passing unrecorded.
+ */
+function doorRecordVerb({ cwd, rest, raw, error, c, exec }) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const owner = require('./vault.cjs');
+    if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
+        return;
+    const usage = 'Usage: vault door-record --begin --door <name> [--raw], then vault door-record --door <name> --artifact <path under .planning/> [--phase <N|dir>] [--raw].';
+    const values = {};
+    let begin = false;
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--begin') {
+            begin = true;
+            continue;
+        }
+        if (DOOR_RECORD_FLAGS.includes(a)) {
+            const v = rest[i + 1];
+            if (v === undefined || v.startsWith('--')) {
+                error(`${a} needs a value. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            if (values[a] !== undefined) {
+                error(`${a} was given more than once. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            values[a] = v;
+            i += 1;
+            continue;
+        }
+        error(`Unrecognized argument "${boundedPath(a)}" for vault door-record. Supported: --begin, ${DOOR_RECORD_FLAGS.map((f) => `${f} <value>`).join(', ')}, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (values['--door'] === undefined) {
+        error(`vault door-record needs --door. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    const door = values['--door'];
+    if (!vaultSeal.DOOR_NAMES.includes(door)) {
+        error(`"${boundedPath(door)}" is not a door that writes a record. Allowed doors: ${vaultSeal.DOOR_NAMES.join(', ')}.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (begin) {
+        doorBegin({ cwd, door, extra: Object.keys(values).filter((k) => k !== '--door'), raw, error, c, exec, usage });
+        return;
+    }
+    if (values['--artifact'] === undefined) {
+        error(`vault door-record needs --artifact. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    const located = resolvePlanningPath(cwd, values['--artifact'], 'artifact');
+    if (!located.ok) {
+        error(`The door artifact ${located.message}; a door record is written only into a door's own artifact under .planning/.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    if (!isDoorArtifactLocation(located.rel)) {
+        error(`The door artifact "${boundedPath(located.rel)}" is not in a phase directory, a quick-task directory or .planning/audits, ` +
+            'the directories the seal readers walk; a record anywhere else would never be read.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // 16 review IN-02: the readers still recognise a `-VALIDATION.md` door
+    // artifact (a legacy record stays readable), but the verb never WRITES one:
+    // a `*-VALIDATION.md` file makes a phase read as validated (D-79 (3)).
+    const artifactName = node_path_1.default.basename(located.abs);
+    if (!vaultSeal.DOOR_ARTIFACT_FILENAME_RE.test(artifactName) || /(^|-)VALIDATION\.md$/.test(artifactName)) {
+        error(`The door artifact "${boundedPath(artifactName)}" does not end in -REVIEW-FIX.md, -ADD-TESTS.md or -AUDIT-FIX.md, ` +
+            'the door artifact names the verb writes (a -VALIDATION.md file would make the phase read as validated).', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // The start is the one this door's `--begin` recorded in `.planning/`, and
+    // only that (16 review iteration 3 CR-02, D-103: `--start` is gone), so no
+    // shell variable has to survive between the two steps, the agent never types
+    // a sha, and no argument can move the start. It reaches git only after it has
+    // the anchor shape, and only AFTER the subcommand and its flag (T-16-21).
+    const recorded = vaultSeal.readDoorStart(node_path_1.default.join(located.root, '.planning'), door);
+    if (recorded === null) {
+        error(`No start was recorded for the ${door} door, so its range is unknown and the record was not written. `
+            + `Run \`pp-tools vault door-record --begin --door ${door}\` before the door's agent runs; a start recorded now covers only commits made after it.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const start = recorded.start;
+    if (exec(['merge-base', '--is-ancestor', start, 'HEAD'], { cwd }).exitCode !== 0) {
+        error(`The start the ${door} door's --begin recorded (${start}) is not an ancestor of HEAD (or is not in this repository), so it cannot be the commit this door started from. `
+            + `Run \`pp-tools vault door-record --begin --door ${door}\` again, then redo the door's work.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    const headRun = exec(['rev-parse', 'HEAD'], { cwd });
+    const end = headRun.exitCode === 0 ? headRun.stdout.trim() : '';
+    if (!vaultSeal.ANCHOR_SHA_RE.test(end)) {
+        error('HEAD could not be read as a full commit id, so the record has no end commit and was not written.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    let phase = null;
+    if (values['--phase'] !== undefined) {
+        const resolved = owner.resolveTracePhaseDir(located.root, cwd, values['--phase']);
+        if (!resolved) {
+            error(`--phase "${boundedPath(values['--phase'])}" is neither a phase directory inside the project nor a phase the locator resolves.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        phase = doorText(resolved.rel, { token: true });
+    }
+    if (!owner.isVaultGateActive(cwd)) {
+        error('The vault is off for this project, so there is no vault record to write.', ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // The record grammar keeps its `mode` field; standards is the only mode.
+    const mode = 'standards';
+    const pin = doorVaultPin(cwd, owner);
+    let existing = '';
+    if (node_fs_1.default.existsSync(located.abs)) {
+        const size = node_fs_1.default.statSync(located.abs).size;
+        if (size > vaultSeal.TRACE_ARTIFACT_BYTE_CAP) {
+            error(`The door artifact is ${size} bytes, above the ${vaultSeal.TRACE_ARTIFACT_BYTE_CAP}-byte read cap the seal readers apply; a record there would never be read.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        existing = node_fs_1.default.readFileSync(located.abs, 'utf8');
+        const prior = vaultSeal.parseDoorRecord(existing);
+        if (!prior.ok || prior.record !== null) {
+            error(`The door artifact "${boundedPath(located.rel)}" already carries a ${vaultSeal.DOOR_RECORD_HEADING} section; a second one would make both unreadable. ` +
+                'Write the door\'s artifact afresh for this run, then record it.', ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+    }
+    let section;
+    try {
+        section = vaultSeal.formatDoorRecord({
+            door: door,
+            mode,
+            vault: pin.vault,
+            degraded: pin.degraded,
+            phase,
+            startCommit: start,
+            endCommit: end,
+            recordedAt: new Date().toISOString(),
+        });
+    }
+    catch (e) {
+        error(`The door record could not be composed: ${boundedPath(e instanceof Error ? e.message : String(e))}`, ERROR_REASON.UNKNOWN);
+        return;
+    }
+    const separator = existing === '' ? '' : existing.endsWith('\n\n') ? '' : existing.endsWith('\n') ? '\n' : '\n\n';
+    const next = existing === '' ? `# ${door} door record\n\n${section}` : `${existing}${separator}${section}`;
+    const readBack = vaultSeal.parseDoorRecord(next);
+    if (!readBack.ok || readBack.record === null || readBack.record.startCommit !== start || readBack.record.endCommit !== end) {
+        error(`The door record would not read back from "${boundedPath(located.rel)}" (an unclosed code fence or comment above it, for example), so nothing was written.`, ERROR_REASON.SDK_FAIL_FAST);
+        return;
+    }
+    // D-100 (16 review iteration 2 WR-01): consume the `--begin` start BEFORE the
+    // record is written, after every refusal above. A start that cannot be
+    // consumed refuses the record; a record whose write then fails leaves the
+    // door with no start, so a retry halts naming `--begin` — both arms leave
+    // commits uncovered (named by SEAL-01), never a range wider than one run.
+    {
+        let consumed = false;
+        try {
+            consumed = vaultSeal.consumeDoorStart(node_path_1.default.join(located.root, '.planning'), door, start);
+        }
+        catch {
+            consumed = false;
+        }
+        if (!consumed) {
+            error(`The ${door} door's start could not be consumed from .planning/${vaultSeal.VAULT_DOOR_STARTS_FILE} (it changed or could not be rewritten), so the record was not written. `
+                + `Run \`pp-tools vault door-record --begin --door ${door}\` again, then redo the door's work; a start recorded now covers only commits made after it.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+    }
+    const tmp = `${located.abs}.${process.pid}.tmp`;
+    try {
+        node_fs_1.default.writeFileSync(tmp, next, 'utf8');
+        node_fs_1.default.renameSync(tmp, located.abs);
+    }
+    catch {
+        try {
+            node_fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* nothing to clean */ }
+        error(`The door artifact "${boundedPath(located.rel)}" could not be written.`, ERROR_REASON.UNKNOWN);
+        return;
+    }
+    const result = { ok: true, door, artifact: located.rel, mode, phase, startCommit: start, endCommit: end };
+    c.output(result, true, raw ? JSON.stringify(result) : `Recorded the ${door} door in ${located.rel} (${start.slice(0, 12)}..${end.slice(0, 12)}).`);
 }
 module.exports = {
     routeVaultCommand,
+    // 13-06: exported so the D-15 sweep test and the D-08 subcommand test read
+    // the vocabulary from the running module instead of restating it.
     VAULT_SUBCOMMANDS,
-    // The scaffold's plan-identifier shape and its one wording, exported so a
-    // trace gate's filename extractor and the planner reference are checked
-    // against the running module rather than a restated copy.
+    // 04-14: exported so the agreement and documentation tests read the SHAPE and
+    // the WORDING from the running module rather than restating either. A test
+    // that restated them would pass while the module drifted.
     SCAFFOLD_PLAN_ID_RE,
     SCAFFOLD_PLAN_ID_FORM,
-    TRACE_STAGES,
+    // 16-05 (D-29): the quick-task half both rejection messages append.
+    SCAFFOLD_QUICK_ID_FORM,
+    // 16-06: the anchor verbs, read by the tests from the running module.
+    ANCHOR_VERBS,
+    // 15-07: exported so the integration test pins it equal to the trace gate's
+    // artifact read cap, which is the agreement its own comment states.
+    STANDARDS_PLAN_READ_BYTES,
 };