@pareto4/pp-core 1.17.1 → 1.19.0

package/pp-core/bin/lib/vault-command-router.cjs

@@ -39,14 +39,14 @@ const node_path_1 = __importDefault(require("node:path"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const childProcess = require("node:child_process");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
-// CR-04 (03-11): the trace render arm resolves its containment boundary the same
-// way `cmdVaultTrace` in src/check-command-router.cts does. project-root.cjs is a
+// CR-04 (03-11): this router's path arms resolve their containment boundary the
+// same way `cmdVaultTrace` in src/check-command-router.cts does. project-root.cjs is a
 // leaf (node builtins only), so this adds no cycle.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const projectRootMod = require("./project-root.cjs");
 const { findProjectRoot } = projectRootMod;
 // 15-05: the plan-identifier form moved into the vault-standards leaf (one
-// definition shared by the trace verbs, the standards verbs and the gate).
+// definition shared by the standards verbs and the gate).
 // That leaf requires only vault-index, which imports nothing, so no cycle.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const vaultStandardsLeaf = require("./vault-standards.cjs");
@@ -68,18 +68,7 @@ const VAULT_SUBCOMMANDS = [
     'status',
     'probe',
     'summary',
-    'practices',
     'org-profile',
-    'trace',
-    // 05-06 (CHECK-03): the mechanical practice audit. Added HERE and nowhere
-    // else — the header comment above, the dispatch chain and the
-    // unknown-subcommand message all derive from this list, which is exactly the
-    // three-place drift 02-02 removed.
-    'audit',
-    // 260915-ik2 (UAT-6-F1): the phase-manifest writer the execute-phase step
-    // files call — `start` at execute:pre, `record` at verify:post. Added HERE
-    // and nowhere else, for the same three-place reason as `audit` above.
-    'manifest',
     // PBI 74316 (fork-only): move the project to another client vault version.
     'update',
     // 15-07 (D-06, D-13): the standards record verbs, `block` and `consulted`.
@@ -93,28 +82,11 @@ const VAULT_SUBCOMMANDS = [
     'door-record',
 ];
 /**
- * The two trace stages, declared once for the same reason the subcommand
- * vocabulary is: the `--stage` validation and the operator-facing message that
- * names the permitted values are both DERIVED from this list, so they cannot
- * disagree. The values themselves are the frozen contract's
- * (`docs/vault-trace-format.md` § The freeze contract) — this list restates the
- * two stage NAMES the CLI accepts, and nothing else about the schema.
+ * The standards verbs (15-07), same discipline: the verb check and the message
+ * naming the permitted verbs both derive from this list. `promote` writes to
+ * the client vault rather than a record, and answers its own refusals.
  */
-const TRACE_STAGES = ['plan', 'execute'];
-/**
- * The trace verbs, same discipline (Phase 03-05).
- */
-const TRACE_VERBS = ['scaffold', 'render'];
-/**
- * The manifest verbs, same discipline (260915-ik2): the verb check and the
- * operator-facing message that names the permitted verbs both derive from it.
- */
-const MANIFEST_VERBS = ['start', 'record'];
-/**
- * The standards record verbs (15-07), same discipline: the verb check and the
- * message naming the permitted verbs both derive from this list.
- */
-const STANDARDS_VERBS = ['block', 'consulted'];
+const STANDARDS_VERBS = ['block', 'consulted', 'promote'];
 /**
  * The anchor verbs (16-06), same discipline: the verb check and the message
  * naming the permitted verbs both derive from this list.
@@ -133,10 +105,10 @@ const DOOR_RECORD_FLAGS = ['--door', '--artifact', '--phase'];
  */
 const STANDARDS_PLAN_READ_BYTES = 1024 * 1024;
 /**
- * The plan-identifier shape `vault trace scaffold --plan` accepts (04-14,
+ * The plan-identifier shape `vault standards block --plan` accepts (04-14,
  * TGATE-01, CR-03). Defined in `src/vault-standards.cts` since 15-05 and
  * re-exported from here under the same name; the rationale stays here, beside
- * the verb that first needed it.
+ * the verb that uses it.
  *
  * ONE FORM, READ AND WRITTEN. `filenamePlanId` in `src/check-command-router.cts`
  * extracts `<this form>-PLAN.md` / `-SUMMARY.md` from an artifact's basename,
@@ -166,19 +138,12 @@ const STANDARDS_PLAN_READ_BYTES = 1024 * 1024;
  */
 const SCAFFOLD_PLAN_ID_RE = vaultStandardsLeaf.SCAFFOLD_PLAN_ID_RE;
 /**
- * The required form, in ONE wording, stated in exactly three places: this
- * rejection message, `pp-core/references/planner-vault-practices.md`, and the
- * planner-facing inline instruction in
- * `capabilities/vault-practices/capability.json` (04-14 T2).
- *
- * It is a constant rather than three sentences because a form stated three ways
- * is three forms (threat T-4-55). The test asserts the sentence extracted
- * independently from each document is EQUAL to the other's and to this value,
- * rather than asserting each document merely mentions a form.
+ * The required form, in ONE wording: the `vault standards block` rejection
+ * message (04-14 T2). A constant so the refusal and the test that pins it read
+ * one sentence (threat T-4-55).
  *
  * ASCII only, and no backticks: the same bytes have to survive a JSON string, a
- * markdown paragraph and a terminal, and a backtick would make the markdown
- * copy differ from the other two.
+ * markdown paragraph and a terminal.
  */
 const SCAFFOLD_PLAN_ID_FORM = "The plan identifier must be the plan's phase-and-number identifier, exactly the " +
     'prefix of its artifact filename (for example 04-02), not a bare plan number, a task ' +
@@ -187,23 +152,12 @@ const SCAFFOLD_PLAN_ID_FORM = "The plan identifier must be the plan's phase-and-
  * The quick-task half of the form (16-05, D-29), appended to both rejection
  * messages after `SCAFFOLD_PLAN_ID_FORM`.
  *
- * A SECOND constant rather than an edit to the first, and argued: the first is
- * stated verbatim in three places, and two of them are agent context the
- * golden set records byte for byte (the `vault-practices` plan:pre inline
- * instruction in three cells) or that sits under an exhausted size budget
- * (`agents/pp-executor.md`). Rewording it would re-record golden rows Phase 16
- * may not move. Its sentence is also already true of a quick task — "exactly
- * the prefix of its artifact filename" — so only the refusal, the one surface
- * a caller reads after being told no, needs to name the quick form.
+ * A second constant rather than an edit to the first: the first sentence is
+ * already true of a quick task — "exactly the prefix of its artifact filename"
+ * — so only the refusal, the one surface a caller reads after being told no,
+ * needs to name the quick form.
  */
 const SCAFFOLD_QUICK_ID_FORM = 'A quick task uses its quick-task id instead, the same filename prefix (for example 261011-8yt).';
-/**
- * Bound on the bounded prefix read the `trace render` arm performs. The trace
- * lives in the artifact's FRONTMATTER, so a head read is not a compromise — it
- * is the exact region the parser needs, and a SUMMARY.md body of any size can
- * never make this arm read more.
- */
-const TRACE_ARTIFACT_READ_BYTES = 262_144;
 /** Repo-relative artifact paths, long enough for a workstream phase tree. */
 const TRACE_REFUSAL_PATH_CAP = 200;
 /**
@@ -227,103 +181,20 @@ function boundedPath(value) {
         : collapsed;
 }
 /**
- * The gate an override recorded by the scaffold arm suppresses (04-06, SC4).
+ * The gate an override recorded by `vault standards block` suppresses (04-06, SC4).
  *
  * `vault.status` is not a name invented here: it is the `check.query` the
  * blocking vault gate is declared under at both write points
- * (`capabilities/vault/capability.json`), and it is the value the freeze
- * contract's own worked example carries (`docs/vault-trace-format.md`
- * § The override object). Declared once so the emitted record and the
- * documented example cannot drift apart. Its one owner is the standards leaf
+ * (`capabilities/vault/capability.json`), and it is the gate the override
+ * line names (`docs/vault-standards-mode.md` § Gates, "The override").
+ * Declared once so the emitted record and the documented contract cannot
+ * drift apart. Its one owner is the standards leaf
  * (15 D-35), because the standards judgement accepts an override line only
  * under this gate name, and a second literal could drift from the first.
  */
 const TRACE_OVERRIDE_GATE = vaultStandardsLeaf.STANDARDS_OVERRIDE_GATE;
-/**
- * A `gitCommit` digest: lowercase hex at sha1 or sha256 length. 16-06 (D-35)
- * re-binds it to the seal leaf's `ANCHOR_SHA_RE`: a per-file digest and a
- * record's start/end anchors are the same shape, so they have one owner. The
- * local name stays, as an alias, so this file's readers keep their wording.
- */
-const GIT_COMMIT_DIGEST_RE = vaultSeal.ANCHOR_SHA_RE;
 // Default CoreModule implementation. _core seam overrides this for test injection.
 const _defaultCore = { output: io.output };
-function tracePracticesActive(cwd) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { isPracticesGateActive } = require('./vault.cjs');
-    return isPracticesGateActive(cwd);
-}
-/**
- * 16-09 (SEAL-02, D-39) — the `vault audit` verb's answer when the practices
- * switch is off, or `null` for "print nothing" (the pre-16-09 behaviour).
- *
- * It asks what `check vault.audit` asks, in the gate's order (D-25), through
- * the same readers: bindings first (no `.platform-bindings.json` never holds
- * records, D-37/D-42); standards mode active answers nothing (the C-1 cell);
- * the phase argument must resolve (the same `resolveTracePhaseDir`, so an
- * argument error still prints nothing, T-03-43); then the leaf's
- * `collectRecordedArtifacts` and `disabledWithArtifactsVerdict`, whose message
- * is the gate's message byte for byte. Which switch is off is decided by the
- * gate readers, never a raw config read. It blocks nothing itself: an operator
- * surface, exit 0. There is no override.
- *
- * From the REAL leaf, not the `_vault` seam: a governance decision must not be
- * switchable by a test mock (the `tracePracticesActive` rule above).
- */
-function disabledWithArtifactsRefusal(cwd, args) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const v = require('./vault.cjs');
-    let root;
-    try {
-        root = findProjectRoot(cwd) || cwd;
-    }
-    catch {
-        root = cwd;
-    }
-    if (!v.hasPlatformBindings(root))
-        return null;
-    if (v.isStandardsModeActive(cwd))
-        return null;
-    // The audit arm's own positional rule (below): the first token that is not a
-    // flag and not the `--range` value.
-    const auditArgs = args.slice(2);
-    const rangeAt = auditArgs.indexOf('--range');
-    const phaseArg = auditArgs.find((a, i) => !a.startsWith('--') && !(rangeAt !== -1 && i === rangeAt + 1));
-    if (phaseArg === undefined)
-        return null;
-    const phase = v.resolveTracePhaseDir(root, cwd, phaseArg);
-    if (!phase)
-        return null;
-    const whichSwitch = v.isVaultGateActive(root) ? 'vault.practices_enabled' : 'vault.enabled';
-    let mode;
-    if (whichSwitch === 'vault.practices_enabled') {
-        const m = v.vaultModeVerdict(cwd);
-        if (m.active && m.ok === true && m.mode === 'practices')
-            mode = 'practices';
-    }
-    const verdict = vaultSeal.disabledWithArtifactsVerdict(vaultSeal.collectRecordedArtifacts(phase.abs, { root }), {
-        switch: whichSwitch,
-        ...(mode ? { mode } : {}),
-        phaseRel: phase.rel,
-    });
-    if (!verdict)
-        return null;
-    return { status: 'disabled_with_artifacts', block: true, present: true, ...verdict };
-}
-/**
- * The value token immediately following each of `flags`, by index, so a
- * flag's value is never mistaken for a positional argument. Mirrors the
- * `--expect` handling in the `practices promote` arm.
- */
-function flagValueIndices(argv, flags) {
-    const indices = new Set();
-    for (const flag of flags) {
-        const i = argv.indexOf(flag);
-        if (i !== -1)
-            indices.add(i + 1);
-    }
-    return indices;
-}
 /**
  * Render a short plain-text `vault org-profile` report from its structured
  * shape — one line naming the pointer, one naming the resolution, a
@@ -387,73 +258,37 @@ function renderOrgProfileReport(report) {
     return lines.join('\n');
 }
 // ─── Implementation ───────────────────────────────────────────────────────────
-function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _exec, _writeBack, _orgProfile, _coordinates, _provider, _trace, _audit, _update, }) {
+function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _exec, _orgProfile, _coordinates, _provider, _update, }) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const vault = _vault ?? require('./vault.cjs');
     const c = _core ?? _defaultCore;
     const subcommand = args[1];
-    // 13-06 (D-08, D-22): an unrecognised `vault.mode` on a project whose vault
-    // gate exists refuses EVERY known subcommand, here, before dispatch. One owner
-    // for ten arms rather than ten copies that a new arm could forget; the test
-    // `D-15 sweep` in tests/vault-mode.test.cjs fails if the chain below and
-    // VAULT_SUBCOMMANDS ever disagree, so no arm can dodge this guard.
-    //   - Keyed on VAULT_SUBCOMMANDS: an unknown subcommand never reads the mode
-    //     and keeps its own message below.
-    //   - The read is a config read; its one possible spawn is loadConfig's memoised, fixed-argument
-    //     git check-ignore, so T-24-08b's typo never reaches the `--changed` git call. On an invalid-mode
-    //     project this refusal now precedes an arm's unknown-flag error.
-    //   - `vaultModeVerdict` answers `{ active: false }` without reading the mode
-    //     when the gate is off, so a vault-off project is byte-identical (golden).
-    //   - From the REAL leaf, not the `_vault` seam, like `isInsideDir` and
-    //     `resolveTracePhaseDir` below: a governance decision must not be
-    //     switchable by a test mock.
-    //   - The message is the leaf's fixed text: it names both allowed values and
-    //     never echoes the configured one (T-13-03).
-    //   - Quick 261015-ect (QD-11): only where `.platform-bindings.json` exists. A
-    //     project without it never reads the mode (T-16-13): admission's own step
-    //     1, read the same way, and the order every `check` vault handler keeps
-    //     (bindings-inert first, D-22). The 1.16.0 release note stated the old
-    //     order as measured; this reverses it, and closes `/pp-fast`'s backstop,
-    //     which asks `vault admission` with no bindings probe of its own.
+    // From the REAL leaf, not the `_vault` seam: a governance answer must not be
+    // switchable by a test mock.
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const modeSeam = require('./vault.cjs');
-    if (VAULT_SUBCOMMANDS.includes(subcommand) && modeSeam.hasPlatformBindings(cwd)) {
-        const modeVerdict = modeSeam.vaultModeVerdict(cwd);
-        if (modeVerdict.active && modeVerdict.ok === false) {
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const leaf = require('./vault-mode.cjs');
-            // 13-REVIEW WR-01: a resolver failure is refused like an invalid value,
-            // under its own typed reason.
-            const reason = modeVerdict.reason ?? '';
-            error(leaf.vaultModeRefusalMessage(reason), reason === leaf.VAULT_MODE_REASON.UNRESOLVED ? ERROR_REASON.VAULT_MODE_UNRESOLVED : ERROR_REASON.VAULT_MODE_INVALID);
-            return;
-        }
-    }
+    const indexSeam = require('./vault.cjs');
     if (subcommand === 'fetch') {
         c.output(vault.vaultFetch(cwd), raw);
     }
     else if (subcommand === 'status') {
-        // 13-06 (D-10): `mode: standards` LAST, in standards mode only; the same
-        // object otherwise, so a practices-mode envelope gains no key (golden).
         // 14-05 (D-11/D-14): the same five flat fields `check vault.status` carries,
         // from the one state function, so the report and the gate cannot tell
-        // different stories (UAT F6). From the REAL module (`modeSeam`), not the
+        // different stories (UAT F6). From the REAL module (`indexSeam`), not the
         // injectable `vault` seam: a governance answer must not be switchable by a
         // test mock (13-06 precedent). No `block` and no `reason`: this is a report.
-        // The state is null outside standards mode, so practices gains no key.
+        // The state is null with the vault off, so the envelope gains no key.
         const base = vault.vaultStatus(cwd);
-        const indexState = modeSeam.computeVaultIndexState(cwd);
+        const indexState = indexSeam.computeVaultIndexState(cwd);
         const withIndex = indexState !== null && base['present'] === true
-            ? { ...base, ...modeSeam.vaultIndexEnvelopeFields(indexState) }
+            ? { ...base, ...indexSeam.vaultIndexEnvelopeFields(indexState) }
             : base;
-        c.output(modeSeam.withVaultMode(withIndex, cwd), raw);
+        c.output(withIndex, raw);
     }
     else if (subcommand === 'probe') {
         // STRICT-02: pure reachability for the client vault, the shared fallback and
         // the platform repo — no clone, no cache mutation.
         //
-        // T-02-07: reject any unrecognized `--` token BEFORE anything spawns, copying
-        // the `practices match` posture below verbatim. A typo must never reach a
+        // T-02-07: reject any unrecognized `--` token BEFORE anything spawns. A typo must never reach a
         // subprocess. The host (pp-core/bin/pp-tools.cjs) already splices out its own
         // global flags before dispatch, which is why the recognized set is one wide.
         const RECOGNIZED_PROBE_FLAGS = new Set(['--raw']);
@@ -487,150 +322,10 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
             c.output(summary.index, false);
         }
     }
-    else if (subcommand === 'practices') {
-        const verb = args[2];
-        if (verb === 'match') {
-            // Quick 261015-at3 (QD-02, todo practices-record-verbs-print-without-
-            // bindings): unless `vault admission` answers `on` this arm prints
-            // nothing, FIRST — before the flag guard and before the mode read. It was
-            // gated by no switch at all (measured 261014-na1: it printed a block on
-            // `vault.enabled: false`), so a record no gate reads could be produced on
-            // a project whose `check ship.practices` answers inert.
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const owner = require('./vault.cjs');
-            if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
-                return;
-            // Quick 261015-ect (QD-14, at3 verifier W-1): in practices mode, silent
-            // where `check ship.practices` answers inert — the practices switch off —
-            // as the trace, audit and manifest arms already are: a block no gate
-            // reads is not produced. Standards mode keeps D-22's answer below on
-            // either switch, because the load-gate card relays that line as its
-            // standards-first clause (15-11) and it records no practice.
-            if (!modeSeam.isStandardsModeActive(cwd) && !tracePracticesActive(cwd))
-                return;
-            // T-24-08b: reject any unrecognized `--`-prefixed argument BEFORE the
-            // `--changed` git call (so a typo never spawns the diff) instead
-            // of silently filtering it out of the positional file list. Matched on
-            // the WHOLE token so `--files=…` is caught by the same check as
-            // `--files value`. DECISION (recorded, not deferred): `--files=` is
-            // NOT implemented as a comma-splitting alias here, unlike
-            // `/pp-code-review`'s `--files=a,b` (pp-core/workflows/code-review.md).
-            // The auditor marked the alias "optional and secondary"; the required
-            // behavior is loud failure, and the error message below names the
-            // supported forms instead. The host (pp-core/bin/pp-tools.cjs) already
-            // splices out its own global flags (--json-errors/--cwd/--ws/--raw/
-            // --pick/--default) before dispatch, which is why the recognized set
-            // here is only two flags wide.
-            const RECOGNIZED_MATCH_FLAGS = new Set(['--changed', '--raw', '--block']);
-            const unrecognizedFlag = args.slice(3).find((a) => a.startsWith('--') && !RECOGNIZED_MATCH_FLAGS.has(a));
-            if (unrecognizedFlag !== undefined) {
-                error(`Unrecognized flag "${unrecognizedFlag}" for vault practices match. Supported: positional file paths, --changed, --raw, or --block.`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // 13-07 (D-12, PARK-01): in standards mode the matcher has no practice
-            // layer to read, so this arm answers not-applicable — one line naming the
-            // mode, or `--raw`'s envelope with NO match-set key, exit 0. AFTER the
-            // flag guard (a typo still fails first, T-24-08b) and BEFORE the
-            // `--changed` git call (a parked path spawns no diff, T-13-12). `--block`
-            // is non-raw, so it prints the same line and no `<vault_practices>` block.
-            // There is deliberately NO activation guard on this branch: the arm
-            // answers not-applicable whenever the vault gate is active, even with
-            // `vault.practices_enabled` false (D-22; QD-14 above gates practices mode
-            // only). The text is the leaf's.
-            if (modeSeam.isStandardsModeActive(cwd)) {
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { notApplicableMatchEnvelope } = require('./vault-mode.cjs');
-                const naMatch = notApplicableMatchEnvelope();
-                c.output(naMatch, true, raw ? JSON.stringify(naMatch) : naMatch.message);
-                return;
-            }
-            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-            const practices = _practices ?? require('./vault-practices.cjs');
-            const runGit = _exec ?? shell_command_projection_cjs_1.execGitLocal;
-            let files;
-            if (args.includes('--changed')) {
-                const gitResult = runGit(['diff', '--name-only', 'HEAD'], { cwd });
-                if (gitResult.exitCode !== 0) {
-                    error('Could not determine changed files: git diff failed (WR-02)', ERROR_REASON.SDK_FAIL_FAST);
-                    return;
-                }
-                files = gitResult.stdout.split('\n').map((f) => f.trim()).filter((f) => f.length > 0);
-            }
-            else {
-                files = args.slice(3).filter((a) => !a.startsWith('--'));
-            }
-            const result = practices.matchPractices({ cwd, files });
-            if (args.includes('--block')) {
-                // T-25-08: emit the finished <vault_practices> block so the planner
-                // embeds it VERBATIM. The planner never renames a field or applies a
-                // fence itself — that transformation used to be prose-only, which is
-                // what left the phase's prompt-injection mitigation unenforced.
-                c.output(result, true, practices.renderPracticesBlock(result));
-            }
-            else if (raw) {
-                c.output(result, true, JSON.stringify(result));
-            }
-            else {
-                c.output(result, true, practices.renderPracticesReport(result));
-            }
-        }
-        else if (verb === 'promote') {
-            // T-29-16: reject any unrecognized `--`-prefixed argument BEFORE the
-            // lazy require of the write-back module and before any subprocess can
-            // spawn — mirrors the `match` branch's T-24-08b guard exactly. Matched
-            // on the WHOLE token so `--name=value` is caught by the same check as
-            // `--name value`. The recognized set holds exactly three flags — no
-            // flag that disables, bypasses, or relaxes any guard exists.
-            const RECOGNIZED_PROMOTE_FLAGS = new Set(['--confirmed', '--expect', '--raw']);
-            const promoteArgs = args.slice(3);
-            const unrecognizedPromoteFlag = promoteArgs.find((a) => a.startsWith('--') && !RECOGNIZED_PROMOTE_FLAGS.has(a));
-            if (unrecognizedPromoteFlag !== undefined) {
-                error(`Unrecognized flag "${unrecognizedPromoteFlag}" for vault practices promote. Supported: --confirmed, --expect <token>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // Positional file path: the first token that is not `--`-prefixed and
-            // is not the value immediately following `--expect`.
-            const expectFlagIdx = promoteArgs.indexOf('--expect');
-            const expectValueIdx = expectFlagIdx !== -1 ? expectFlagIdx + 1 : -1;
-            const filePath = promoteArgs.find((a, i) => !a.startsWith('--') && i !== expectValueIdx);
-            if (filePath === undefined) {
-                error('No practice file was given. Usage: vault practices promote <file> [--confirmed --expect <token>] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
-                return;
-            }
-            const confirmed = promoteArgs.includes('--confirmed');
-            const expect = expectValueIdx !== -1 ? promoteArgs[expectValueIdx] : undefined;
-            if (confirmed && (expect === undefined || expect.startsWith('--'))) {
-                error('This practice was not pushed: the confirmation is missing the preview token it needs. ' +
-                    'Run the promotion without confirming first, then pass the token it prints.', ERROR_REASON.VAULT_PROMOTE_CONCURRENT_EDIT);
-                return;
-            }
-            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-            const writeBack = _writeBack ?? require('./vault-write-back.cjs');
-            const verdict = writeBack.promotePractice({ cwd, filePath, confirmed, expect });
-            // Emit the structured verdict BEFORE any error call — a refusal still
-            // carries its verdict to stdout. This ordering is the whole point of
-            // the uniform D-16 refusal contract and is what lets a wrapper
-            // workflow render results without scraping prose.
-            if (raw) {
-                c.output(verdict, true, JSON.stringify(verdict));
-            }
-            else {
-                c.output(verdict, true, writeBack.renderPromoteReport(verdict));
-            }
-            if (verdict.status === 'refused') {
-                // An action command's refusal must be observable in the exit code —
-                // do not adopt the ship gate's always-exit-zero convention here.
-                error(verdict.message ?? 'This practice was not promoted.', verdict.reason ?? ERROR_REASON.UNKNOWN);
-            }
-        }
-        else {
-            error('Unknown practices subcommand. Available: match, promote', ERROR_REASON.SDK_UNKNOWN_COMMAND);
-        }
-    }
     else if (subcommand === 'org-profile') {
         // T-33-13: reject any unrecognized `--`-prefixed argument BEFORE any
-        // lazy require or resolution work — mirrors the `practices match`
-        // T-24-08b guard exactly, so a typo can never trigger filesystem work.
+        // lazy require or resolution work (T-24-08b), so a typo can never trigger
+        // filesystem work.
         const RECOGNIZED_ORG_PROFILE_FLAGS = new Set(['--raw']);
         const unrecognizedOrgProfileFlag = args
             .slice(2)
@@ -645,8 +340,6 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
         const coordinates = _coordinates ?? require('./vault-coordinates.cjs');
         // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
         const providerModule = _provider ?? require('./git-provider.cjs');
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const { VAULT_MODE_CONFIG_KEY: vaultModeKey } = require('./vault-mode.cjs');
         const resolution = orgProfile.resolveOrgProfile(cwd);
         // Resolve the EFFECTIVE values by calling the real resolvers, so the
         // report shows what actually won rather than what the profile offered.
@@ -677,14 +370,6 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
             // report cannot say the profile lost while the gate enforces it. It is
             // the policy only; with `vault.enabled` off no gate exists to apply it.
             [orgProfile.VAULT_REQUIRED_CONFIG_KEY]: String(orgProfile.resolveVaultRequired(cwd).required),
-            // An invalid PROJECT mode reads as the typed reason
-            // (`vault_mode_invalid`), never the value: the project's invalid value
-            // did win over the profile, and the report says so without repeating
-            // operator text (T-13-03).
-            [vaultModeKey]: (() => {
-                const r = orgProfile.resolveVaultMode(cwd);
-                return r.ok ? r.mode : r.reason;
-            })(),
         };
         // Build `effective`'s key list from ORG_PROFILE_ALLOWLIST rather than a
         // fresh literal array, so a future allowlist change surfaces here
@@ -741,615 +426,6 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
             c.output(report, true, renderOrgProfileReport(report));
         }
     }
-    else if (subcommand === 'trace') {
-        // ── The practice-trace producer (Phase 03-05, TRACE-01/02/03) ──
-        //
-        // D-01's split, mechanised: the CLI owns everything that must be PROVABLE
-        // — the pinned `ref`, the `resolvedSha` and the considered practice-ID set
-        // — and the agent writes only the judgement half (`status` + `reason`).
-        // "Provable" cannot rest on an agent transcribing a forty-character SHA
-        // correctly, and a well-formedness gate by definition cannot catch a
-        // wrong-but-well-formed SHA.
-        //
-        // BOTH arms below are pass-throughs to `./vault-trace.cjs`. They collect
-        // arguments, call through, and emit. They hold NO envelope logic, NO glob
-        // pass and NO second read of the manifest: every provable field is the
-        // leaf module's business, and duplicating any of it here would create a
-        // second place where the trace can disagree with the gate that validates
-        // it.
-        //
-        // NEITHER ARM WRITES A FILE, and that is a requirement rather than a
-        // convenience not yet added. The producer emits text for an agent to embed
-        // in the single write it is already performing. A CLI that patched a
-        // plan's frontmatter would have to round-trip it through the shared
-        // serializer, which this repository documents as "a deliberately lossy
-        // serializer — it cannot faithfully re-emit nested object-list items" —
-        // so the same write that added the trace would destroy the plan's own
-        // must-haves block (T-03-23). If a direct write is ever wanted it must be a
-        // raw text splice on the delimited region, and that is not this phase's
-        // business. Do not add the convenience.
-        //
-        // ORDERING, and why it is this way round: the sub-verb check comes first,
-        // so a mistyped sub-verb is refused with the usage error, bindings or not,
-        // and produces no record (quick 261015-ect, QD-12 — measured and pinned).
-        // Then the admission verdict and the capability gate (quick 261015-at3 put
-        // the admission line ahead of the gate), ahead of the flag allowlist. The
-        // two orders both satisfy T-03-25 (nothing is required and nothing spawns
-        // before an unknown flag is rejected), because the gate is a bounded config
-        // read, not a subprocess. Only this order also satisfies D-04's
-        // non-negotiable clause — for every VALID sub-verb an inert project's
-        // output is byte-identical, on every flag path including a mistyped one
-        // (T-03-26).
-        const verb = args[2];
-        const traceArgs = args.slice(3);
-        if (verb !== 'scaffold' && verb !== 'render') {
-            error(`Unknown trace subcommand. Available: ${TRACE_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
-            return;
-        }
-        // Quick 261015-at3: the admission verdict precedes the capability gate, as
-        // in `routeVaultAnchor` — no `.platform-bindings.json` means `check
-        // vault.trace` answers inert, so no trace may be produced either.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const owner = require('./vault.cjs');
-        if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
-            return;
-        if (!tracePracticesActive(cwd))
-            return;
-        if (verb === 'scaffold') {
-            const RECOGNIZED_SCAFFOLD_FLAGS = new Set(['--stage', '--plan', '--anchors-dir', '--raw']);
-            const unrecognizedScaffoldFlag = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_SCAFFOLD_FLAGS.has(a));
-            if (unrecognizedScaffoldFlag !== undefined) {
-                error(`Unrecognized flag "${unrecognizedScaffoldFlag}" for vault trace scaffold. ` +
-                    `Supported: positional file paths, --stage <${TRACE_STAGES.join('|')}>, --plan <id>, ` +
-                    '--anchors-dir <dir> (execute stage), --raw.', ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // Quick 261015-ect (QD-15): parked in standards mode, beside `practices
-            // match` (PARK-01) and `vault audit` (PARK-02). A standards-mode plan
-            // carries no practices ledger: `check ship.practices`, `check
-            // vault.audit` and `check vault.review` answer not_applicable here, and
-            // the standards `check vault.trace` reads `<vault_standards>` blocks, not
-            // this ledger. After admission, the practices gate and this verb's flag
-            // allowlist (a typo still fails first, as in the match and audit arms),
-            // before any read; one fixed line from the leaf, exit 0, nothing written.
-            if (modeSeam.isStandardsModeActive(cwd)) {
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { notApplicableTraceVerbEnvelope } = require('./vault-mode.cjs');
-                const naTrace = notApplicableTraceVerbEnvelope();
-                c.output(naTrace, true, raw ? JSON.stringify(naTrace) : naTrace.message);
-                return;
-            }
-            const valueIndices = flagValueIndices(traceArgs, ['--stage', '--plan', '--anchors-dir']);
-            const stageIdx = traceArgs.indexOf('--stage');
-            const stage = stageIdx !== -1 ? traceArgs[stageIdx + 1] : undefined;
-            // A missing stage and an invalid one share a reason deliberately: both
-            // are "this invocation cannot be interpreted", and splitting them would
-            // make the operator read two messages to learn the same two words.
-            if (stage === undefined || !TRACE_STAGES.includes(stage)) {
-                error(`Missing or unrecognized --stage value for vault trace scaffold. ` +
-                    `Supported: ${TRACE_STAGES.join(', ')}.`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            const planIdx = traceArgs.indexOf('--plan');
-            const planId = planIdx !== -1 ? traceArgs[planIdx + 1] : undefined;
-            if (planId === undefined || planId.startsWith('--')) {
-                error('No plan identifier was given. Usage: vault trace scaffold ' +
-                    `--stage <${TRACE_STAGES.join('|')}> --plan <id> [files...] [--raw].`, ERROR_REASON.SDK_MISSING_ARG);
-                return;
-            }
-            // 04-14 (TGATE-01, CR-03): the value is PRESENT but is not a plan
-            // identifier. Its own rejection, below both guards and beside the other
-            // two argument rejections, so a vault-disabled project still reaches
-            // none of them.
-            //
-            // THE REASON IS THE ESTABLISHED ONE, not a third vocabulary entry. It is
-            // `sdk_fail_fast`, the same reason the stage validation above uses,
-            // because this is the same class of defect: a value was supplied and
-            // cannot be interpreted. `sdk_missing_arg` belongs to the branch directly
-            // above, where the value was consumed by a following flag and no
-            // identifier reached the arm at all.
-            //
-            // IT TEACHES RATHER THAN REFUSING. The message names the value that was
-            // given, the required form and one conforming example, and then says what
-            // the gate will do with the value — because a caller who is told only
-            // that a value is invalid has to guess, and the guess CR-03 documents is
-            // the one this rejection exists to stop.
-            //
-            // FENCE 3 is untouched: this arm still writes no file, and a rejection
-            // returns before the leaf is required, so nothing is produced and nothing
-            // is partially produced.
-            if (!SCAFFOLD_PLAN_ID_RE.test(planId)) {
-                error(`Invalid --plan value "${planId}" for vault trace scaffold. ` +
-                    `${SCAFFOLD_PLAN_ID_FORM} ${SCAFFOLD_QUICK_ID_FORM} The trace gate compares the identifier a plan artifact ` +
-                    'records against the one its own filename states, and blocks on a disagreement.', ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            const files = traceArgs.filter((a, i) => !a.startsWith('--') && !valueIndices.has(i));
-            // The execute stage resolves a `gitCommit` digest per governed file, so
-            // the statement asserts something falsifiable: these practices governed
-            // THESE artifacts at this vault SHA (D-08). The digest is the commit
-            // that last produced the artifact, not merely HEAD, so a subject entry
-            // points at the work it actually describes. A file with no commit yields
-            // no digest — deliberately, because the leaf module records that gap as
-            // a LOUD note inside the statement, and a HEAD fallback would paper over
-            // a real coverage hole with a plausible-looking value.
-            const runGit = _exec ?? shell_command_projection_cjs_1.execGitLocal;
-            // 16-06 (D-14/D-31/D-35): the execute-stage record's anchors, read by the
-            // CLI and never typed. The END anchor is HEAD now; the START anchor is
-            // the one `vault anchor start` recorded in the plan's directory at
-            // execute:pre (phase) or where quick captured its base. `--anchors-dir`
-            // names that directory explicitly; otherwise it is derived from `--plan`
-            // (`resolveScaffoldAnchorsDir`). The plan stage reads neither and its
-            // output is byte-identical (golden-pinned).
-            const anchorsDirIdx = traceArgs.indexOf('--anchors-dir');
-            let anchors = null;
-            if (anchorsDirIdx !== -1) {
-                const anchorsDirArg = traceArgs[anchorsDirIdx + 1];
-                if (stage !== 'execute') {
-                    error('--anchors-dir applies to --stage execute only; a plan-stage ledger records no anchors.', ERROR_REASON.SDK_FAIL_FAST);
-                    return;
-                }
-                if (anchorsDirArg === undefined || anchorsDirArg.startsWith('--')) {
-                    error('--anchors-dir needs a directory under .planning/. Usage: vault trace scaffold --stage execute --plan <id> --anchors-dir <dir> [files...].', ERROR_REASON.SDK_MISSING_ARG);
-                    return;
-                }
-            }
-            if (stage === 'execute') {
-                const head = runGit(['rev-parse', 'HEAD'], { cwd });
-                const end = head.exitCode === 0 ? head.stdout.trim() : '';
-                anchors = {};
-                if (vaultSeal.ANCHOR_SHA_RE.test(end))
-                    anchors.endCommit = end;
-                const located = anchorsDirIdx !== -1
-                    ? resolvePlanningPath(cwd, traceArgs[anchorsDirIdx + 1], 'dir')
-                    : resolveScaffoldAnchorsDir(cwd, planId);
-                if (anchorsDirIdx !== -1 && !located.ok) {
-                    error(`--anchors-dir ${located.message}`, ERROR_REASON.SDK_FAIL_FAST);
-                    return;
-                }
-                const start = located.ok ? vaultSeal.readDirAnchors(located.abs)?.start : undefined;
-                if (start !== undefined) {
-                    anchors.startCommit = start;
-                }
-                else {
-                    // A note, not an error: the record is still written, with its END
-                    // anchor, and the strict points type the missing start (16-07). One
-                    // line on stderr, so the embedded block on stdout is unchanged.
-                    process.stderr.write(`vault trace scaffold: no start anchor recorded for plan ${boundedPath(planId)} ` +
-                        `(${located.ok ? `${located.rel} holds no ${vaultSeal.VAULT_ANCHORS_FILE}` : located.message}); ` +
-                        'the ledger carries endCommit only. `pp_run vault anchor start <dir>` records it at execute:pre.\n');
-                }
-            }
-            const fileInputs = files.map((name) => {
-                if (stage !== 'execute')
-                    return name;
-                const res = runGit(['log', '-1', '--format=%H', '--', name], { cwd });
-                const digest = res.exitCode === 0 ? res.stdout.trim() : '';
-                return GIT_COMMIT_DIGEST_RE.test(digest) ? { name, gitCommit: digest } : name;
-            });
-            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-            const traceMod = _trace ?? require('./vault-trace.cjs');
-            // No files is a REAL path, not an error: a documentation-only plan is
-            // still governed by the global practices, and emitting nothing there
-            // would make the ruled-out set unauditable for exactly the plans where a
-            // reviewer most wants to know what was considered.
-            //
-            // THE OVERRIDE CONTEXT (04-06, SC4 / D-13 / D-14 / D-15).
-            //
-            // The verdict is obtained HERE rather than inside the leaf, and the
-            // reason is the same one that put the digest mapping above in the arm:
-            // this is the only place that knows a trace is being written NOW, and an
-            // override record is a statement about now. `buildTraceStatement`
-            // reaching for a live verdict from inside itself would make a pure
-            // producer's output depend on the machine's vault state through a path
-            // its signature does not declare — the producer/judge split D-01 drew,
-            // undone.
-            //
-            // The AGENT is never the courier for these three fields. Were the gate,
-            // the block and the suppressed reason passed as flags, a bypass could be
-            // concealed by simply not passing one — and the record that a bypass
-            // happened is the single field a bypass most wants hidden. The CLI
-            // computes all three, so there is nothing for a caller to omit.
-            //
-            // D-13: the arm runs once per stage per plan, and each invocation
-            // re-reads the environment and re-computes the verdict at its own
-            // timestamp. A bypass taken at execution but not at planning is
-            // therefore a distinct visible event, not an inference.
-            //
-            // The common path is unchanged. `buildOverrideRecord` returns null unless
-            // the verdict GENUINELY blocked *and* an accepted override reason is
-            // present in the environment; a non-blocking verdict with the reason set
-            // still records nothing, because recording one would manufacture evidence
-            // of a bypass that never happened (D-15).
-            //
-            // Obtaining a verdict is a READ. `computeVaultVerdict` never fetches or
-            // throws (its one possible spawn is a read-only git check-ignore), and this arm still writes no file and
-            // splices no frontmatter (FENCE 3).
-            const verdict = vault.computeVaultVerdict(cwd);
-            const statement = traceMod.buildTraceStatement({
-                cwd,
-                stage,
-                plan: planId,
-                files: fileInputs,
-                override: {
-                    gate: TRACE_OVERRIDE_GATE,
-                    block: verdict.block,
-                    suppressedReason: verdict.reason,
-                },
-                // Spread, never `anchors: null` on the plan stage: a seam that records
-                // its arguments (the router tests' trace mock) then sees the call it
-                // saw before 16-06.
-                ...(anchors !== null ? { anchors } : {}),
-            });
-            // The three-way emit the `practices match --block` arm established: the
-            // structured object is ALWAYS the output value, and the text a consumer
-            // embeds is the third argument. The planner embeds the block VERBATIM —
-            // it never renames a field and never re-derives a value, which is the
-            // whole point of D-01's split.
-            if (raw) {
-                c.output(statement, true, JSON.stringify(statement));
-            }
-            else {
-                c.output(statement, true, traceMod.serializeTraceBlock(statement));
-            }
-        }
-        else {
-            const RECOGNIZED_RENDER_FLAGS = new Set(['--raw']);
-            const unrecognizedRenderFlag = traceArgs.find((a) => a.startsWith('--') && !RECOGNIZED_RENDER_FLAGS.has(a));
-            if (unrecognizedRenderFlag !== undefined) {
-                error(`Unrecognized flag "${unrecognizedRenderFlag}" for vault trace render. ` +
-                    'Supported: a positional artifact path, --raw.', ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // Quick 261015-ect (QD-15): parked in standards mode, as the scaffold
-            // branch above is and for the same reason (no practices ledger is read).
-            if (modeSeam.isStandardsModeActive(cwd)) {
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const { notApplicableTraceVerbEnvelope } = require('./vault-mode.cjs');
-                const naRender = notApplicableTraceVerbEnvelope();
-                c.output(naRender, true, raw ? JSON.stringify(naRender) : naRender.message);
-                return;
-            }
-            const artifactPath = traceArgs.find((a) => !a.startsWith('--'));
-            if (artifactPath === undefined) {
-                error('No artifact path was given. Usage: vault trace render <artifact> [--raw].', ERROR_REASON.SDK_MISSING_ARG);
-                return;
-            }
-            // CONTAINMENT (CR-04, T-03-50/51/52). `artifactPath` is an unvalidated
-            // positional and the read below is unconditional, so before this branch
-            // existed `vault trace render ../outside/secret.md` emitted an out-of-tree
-            // file's content as the `## Practices Applied` section that
-            // `agents/pp-executor.md` instructs the executor to include VERBATIM in
-            // SUMMARY.md — an arbitrary file's bytes becoming governance-artifact
-            // content a later reviewer agent reads.
-            //
-            // It sits HERE, inside the render arm, BELOW the `tracePracticesActive`
-            // early return above — and must stay there. That return is the single
-            // guard making the whole trace verb inert on a capability-off project, so
-            // no containment decision, no project-root resolution and no read may be
-            // reachable above it or an inert project stops being byte-identically
-            // silent (D-04, T-03-26). Do not hoist any of this for a cheaper argument
-            // check, and do not share a resolved root with the scaffold arm.
-            //
-            // It also sits BEFORE the read rather than being inferred from it:
-            // `readHeadBounded` returns the empty string on any problem and never
-            // throws, so a decision taken on its RESULT would be no decision at all.
-            //
-            // The predicate comes from the REAL leaf, not the `_vault` seam: a
-            // security decision must not be switchable by a test mock. Same
-            // `require('./vault.cjs')` the seam itself defaults to — one module, not
-            // a second import path.
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const { isInsideDir } = require('./vault.cjs');
-            if (artifactPath.indexOf('\u0000') !== -1) {
-                error(`The artifact path is not a usable path: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            let projectRoot;
-            try {
-                projectRoot = findProjectRoot(cwd) || cwd;
-            }
-            catch {
-                projectRoot = cwd;
-            }
-            let artifactAbs;
-            try {
-                artifactAbs = node_path_1.default.resolve(cwd, artifactPath);
-            }
-            catch {
-                error(`The artifact path could not be resolved: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            if (!isInsideDir(projectRoot, artifactAbs)) {
-                error(`The artifact path resolves outside the project and was not read: ${boundedPath(artifactPath)}`, ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-            const traceMod = _trace ?? require('./vault-trace.cjs');
-            const content = vault.readHeadBounded(artifactAbs, TRACE_ARTIFACT_READ_BYTES);
-            const parsed = traceMod.parseVaultTraceBlock(content, artifactPath);
-            // THE LEDGER, AND ONLY THE LEDGER. This arm must never call the matcher.
-            // Re-deriving the practice set at render time would produce a section
-            // that disagrees with the frontmatter it is supposedly generated from,
-            // which is the precise failure D-03 exists to prevent: the whole point of
-            // GENERATING the surface is that the two can never disagree (T-03-24).
-            // Adding a matcher call here looks like a robustness improvement and is
-            // the exact opposite — it reintroduces the drift the generation removed.
-            //
-            // An absent ledger yields the parser's documented absent result and NO
-            // section — not an error, and not an empty heading. An empty ledger is a
-            // different thing entirely and the leaf module's renderer handles it: it
-            // emits the heading plus one explanatory line, because a degraded run's
-            // record must stay visible and a reader who finds no section at all
-            // cannot tell a degraded run from a plan that was never vault-enabled.
-            const rendered = parsed.present ? traceMod.renderPracticesApplied(parsed.statement) : '';
-            if (raw) {
-                c.output(parsed, true, JSON.stringify(parsed));
-            }
-            else {
-                c.output(parsed, true, rendered);
-            }
-        }
-    }
-    else if (subcommand === 'audit') {
-        // ── The mechanical practice audit (Phase 05-06, CHECK-03/SC1) ──
-        //
-        // A PASS-THROUGH, on exactly the rule the two trace arms above state: it
-        // collects arguments, calls through and emits. It holds NO verdict, NO
-        // message, NO range and NO cap logic. `check vault.audit` serializes the
-        // SAME envelope from the SAME engine, and duplicating any of it here would
-        // create a second place where the operator's report can disagree with the
-        // gate that blocks the build on it (D-05-02). Even the human text is the
-        // leaf's — `renderAuditReport` is called over the object the leaf returned,
-        // never over a copy this arm rebuilt.
-        //
-        // ORDERING, copied from the trace arm above because the reason carries over
-        // verbatim: the capability gate is the FIRST branch, ahead of the flag
-        // allowlist (the admission verdict follows it here, per QD-03 below). Both orders satisfy T-02-07/T-03-25 — nothing is required and
-        // nothing spawns before an unknown flag is rejected, because the gate is a
-        // bounded config read and not a subprocess. Only THIS order also satisfies
-        // D-04's non-negotiable clause: an inert project's output is byte-identical
-        // on every path INCLUDING a mistyped one (T-03-26).
-        //
-        // 16-09 (SEAL-02, D-39) — ONE exception, and it is the gate's own: a
-        // switch that is off over a phase holding engine-written vault records.
-        // `check vault.audit` answers that `disabled_with_artifacts`, blocking, and
-        // this verb prints the SAME line from the SAME leaf (an agreeing pair). A
-        // project that never recorded anything still prints nothing.
-        if (!tracePracticesActive(cwd)) {
-            const refusal = disabledWithArtifactsRefusal(cwd, args);
-            if (refusal)
-                c.output(refusal, true, raw ? JSON.stringify(refusal) : refusal.message);
-            return;
-        }
-        // Quick 261015-at3 (QD-03, D-39): the admission verdict comes AFTER the
-        // switch block above, not before it. That block's refusal already asks
-        // `hasPlatformBindings` first and is the verb's half of an agreeing pair with
-        // `check vault.audit`; an admission-first line would silence the
-        // `vault.enabled: false`-over-records refusal the gate still answers. This
-        // line closes the remaining shape — both switches on, no bindings — where
-        // `check vault.audit` answers `inert`.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const owner = require('./vault.cjs');
-        if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
-            return;
-        // T-5-19 / T-02-07: whole-token rejection, so `--raw=json` is caught by the
-        // same check as a bare unknown flag rather than slipping past a prefix test
-        // and reaching a subprocess. The host (pp-core/bin/pp-tools.cjs) splices out
-        // its own global flags before dispatch, which is why the recognized set is
-        // one wide.
-        // The flag's NAME is spelled here and in `check-command-router.cts`'s
-        // `AUDIT_RANGE_FLAG`. What must not be duplicated is the POLICY — what
-        // counts as a well-formed range — and it is not: both surfaces call the
-        // leaf's `isValidOperatorRange`. A shared constant for the token itself
-        // would mean importing the audit leaf at this file's top level, which the
-        // lazy-require convention here exists to avoid, to buy agreement on seven
-        // characters that a test on each surface already pins.
-        const AUDIT_RANGE_FLAG = '--range';
-        const RECOGNIZED_AUDIT_FLAGS = new Set(['--raw', AUDIT_RANGE_FLAG]);
-        const unrecognizedAuditFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_AUDIT_FLAGS.has(a));
-        if (unrecognizedAuditFlag !== undefined) {
-            error(`Unrecognized flag "${unrecognizedAuditFlag}" for vault audit. ` +
-                `Supported: a positional phase directory, --raw, ${AUDIT_RANGE_FLAG} <from>..<to>.`, ERROR_REASON.SDK_FAIL_FAST);
-            return;
-        }
-        // 13-07 (D-13, PARK-02): standards mode has no practice layer to audit.
-        // AFTER the inert gate above (D-22) and the flag guard, BEFORE the range,
-        // the positional and the leaf — the same place `check vault.audit` answers
-        // it, so the two surfaces agree on every argument shape. Still a
-        // pass-through: it emits the leaf's builder output, never its own wording
-        // (D-05-02).
-        if (modeSeam.isStandardsModeActive(cwd)) {
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const { notApplicableGateEnvelope } = require('./vault-mode.cjs');
-            const naAudit = notApplicableGateEnvelope('vault.audit');
-            c.output(naAudit, true, raw ? JSON.stringify(naAudit) : naAudit.message);
-            return;
-        }
-        // 08-06 (D-08-19): the operator's range, and the ONE token in this arm that
-        // is a flag's VALUE rather than a positional. It is located before the
-        // positional is picked because the pick below is "the first token that does
-        // not start with `--`" — which, for `vault audit --range a..b <dir>`, is
-        // `a..b`. That would have scoped the audit to a phase directory nobody
-        // named, silently and with a plausible-looking envelope: the exact class of
-        // the WR-08 defect the gate surface's positional scanner was rewritten to
-        // remove. Here the fix is local, because this arm has one value-bearing
-        // flag and no enforcer appending others.
-        const auditArgs = args.slice(2);
-        const rangeAt = auditArgs.indexOf(AUDIT_RANGE_FLAG);
-        const auditRangeValue = rangeAt === -1 ? undefined : auditArgs[rangeAt + 1];
-        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-        const auditMod = _audit ?? require('./vault-audit.cjs');
-        if (rangeAt !== -1) {
-            // HARVESTED, NEVER RESTATED: the predicate is the leaf's own, so this
-            // operator surface and the gate surface cannot disagree about what a
-            // well-formed range is. A seam that does not provide it (the test mock)
-            // falls back to the real module rather than to "anything goes" — a
-            // missing predicate must never mean a passing one.
-            //
-            // Each candidate is CALLED ON ITS OWN OBJECT rather than detached into a
-            // variable: an unbound method is a `this` hazard the linter is right
-            // about, and nothing here needs the function as a value.
-            const rangeIsWellFormed = (v) => {
-                if (typeof auditMod.isValidOperatorRange === 'function') {
-                    return auditMod.isValidOperatorRange(v);
-                }
-                // eslint-disable-next-line @typescript-eslint/no-require-imports
-                const leaf = require('./vault-audit.cjs');
-                return typeof leaf.isValidOperatorRange === 'function' ? leaf.isValidOperatorRange(v) : false;
-            };
-            if (typeof auditRangeValue !== 'string' || !rangeIsWellFormed(auditRangeValue)) {
-                // The refused value is NOT echoed: it failed validation, so it is not
-                // trusted text, and this arm's message is read by a person whose next
-                // action is to retype it (T-08-32).
-                error(`${AUDIT_RANGE_FLAG} needs a well-formed <from>..<to> git range (letters, digits, `
-                    + '. _ / ^ ~ -, two or three dots, at most 200 characters). The supplied value is not '
-                    + 'reproduced here because it failed validation. Re-run with a well-formed range, or '
-                    + 'drop the flag to let the phase-start ladder resolve it.', ERROR_REASON.SDK_FAIL_FAST);
-                return;
-            }
-        }
-        // The phase argument. A DIRECTORY path carries the workstream partition,
-        // which is why neither dispatch point has to pass `--ws`
-        // (check-query-gate.md:27, and the four-times-shipped omitted-`--ws`
-        // lesson behind it). The range's VALUE is excluded by index, so the flag
-        // may precede the positional.
-        const auditPhaseArg = auditArgs.find((a, i) => !a.startsWith('--') && !(rangeAt !== -1 && i === rangeAt + 1));
-        if (auditPhaseArg === undefined) {
-            error(`No phase directory was given. Usage: vault audit <phase-dir> [${AUDIT_RANGE_FLAG} <from>..<to>] [--raw].`, ERROR_REASON.SDK_MISSING_ARG);
-            return;
-        }
-        let auditRoot;
-        try {
-            auditRoot = findProjectRoot(cwd) || cwd;
-        }
-        catch {
-            auditRoot = cwd;
-        }
-        // 08-10 (F4). THE ARGUMENT IS PART OF THE PASS-THROUGH. This arm read the
-        // positional as a raw path while `check vault.audit` resolved it through
-        // `resolveTracePhaseDir` — either an existing directory OR a phase token the
-        // locator resolves. Measured on the live fixture, `01` therefore produced
-        // `{"status":"ok","block":false,"rangeSource":"phase-start-commit"}` from the
-        // gate and `{"status":"warn","block":true,"rangeSource":"base-branch",
-        // "...":"manifest-not-found"}` from the operator's own command: a blocking,
-        // meaningless verdict where the gate saw a clean phase-scoped pass. That is
-        // exactly the disagreement this arm's own doc comment above forbids
-        // (D-05-02), so the RESOLVER is harvested — never restated — from the leaf
-        // both routers already import.
-        //
-        // From the REAL leaf, not the `_vault` seam — same rule and same reason as
-        // the `isInsideDir` harvest in the render arm above: a containment decision
-        // must not be switchable by a test mock.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const { resolveTracePhaseDir } = require('./vault.cjs');
-        const resolvedAuditPhase = resolveTracePhaseDir(auditRoot, cwd, auditPhaseArg);
-        if (!resolvedAuditPhase) {
-            // The SAME `unresolved` shape the gate emits (check-command-router.cts),
-            // not a base-branch fallback that reads as a real audit of nothing. Stated
-            // only from what was measured, and naming a re-run rather than a deletion
-            // (T-4-75).
-            const unresolved = {
-                status: 'unresolved',
-                block: true,
-                message: `Vault audit: "${boundedPath(auditPhaseArg)}" is neither an existing `
-                    + 'directory inside the project nor a phase the locator resolves, so no practice was '
-                    + 'compared against anything. Repair: re-run this command with the phase directory.',
-            };
-            c.output(unresolved, true, raw ? JSON.stringify(unresolved) : unresolved.message);
-            return;
-        }
-        const auditResult = auditMod.runVaultAudit({
-            root: auditRoot,
-            phaseDir: resolvedAuditPhase.abs,
-            exec: _exec ?? shell_command_projection_cjs_1.execGitLocal,
-            // Spread, never `range: undefined` — the leaf keys on the key's TYPE to
-            // decide whether its ladder runs.
-            ...(typeof auditRangeValue === 'string' ? { range: auditRangeValue } : {}),
-        });
-        if (raw) {
-            c.output(auditResult, true, JSON.stringify(auditResult));
-        }
-        else {
-            c.output(auditResult, true, auditMod.renderAuditReport(auditResult));
-        }
-    }
-    else if (subcommand === 'manifest') {
-        // ── The phase-manifest writer (260915-ik2, UAT-6-F1) ──
-        //
-        // `start` anchors `phases[NN].startCommit = HEAD` (write-once); `record`
-        // writes `phases[NN].commits` from that anchor. Both are the leaf's —
-        // this arm collects arguments, calls through and emits, exactly as the
-        // `audit` arm above does, and in the same ORDER for the same reason: the
-        // capability gate is FIRST and silent, so an inert project's output is
-        // byte-identical on every path including a mistyped one (T-03-26,
-        // T-ik2-08). It exits 0 on every path: the step files print the result and
-        // continue, and a refusal travels as `ok: false` with a reason.
-        //
-        // Quick 261015-at3: the admission verdict precedes the capability gate — a
-        // project with no `.platform-bindings.json` gets no manifest file written.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const owner = require('./vault.cjs');
-        if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
-            return;
-        if (!tracePracticesActive(cwd))
-            return;
-        const RECOGNIZED_MANIFEST_FLAGS = new Set(['--raw']);
-        const unrecognizedManifestFlag = args.slice(2).find((a) => a.startsWith('--') && !RECOGNIZED_MANIFEST_FLAGS.has(a));
-        if (unrecognizedManifestFlag !== undefined) {
-            error(`Unrecognized flag "${unrecognizedManifestFlag}" for vault manifest. ` +
-                `Supported: a verb (${MANIFEST_VERBS.join(' | ')}), a positional phase directory, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
-            return;
-        }
-        const manifestPositionals = args.slice(2).filter((a) => !a.startsWith('--'));
-        const manifestVerb = manifestPositionals[0];
-        if (manifestVerb !== 'start' && manifestVerb !== 'record') {
-            error(`Unknown vault manifest verb. Available: ${MANIFEST_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
-            return;
-        }
-        // Quick 261015-ect (QD-15): parked in standards mode. The range this verb
-        // anchors serves two gates, `vault audit` and `check vault.review`, and
-        // both answer not_applicable in this mode (PARK-02, PARK-04). Its third
-        // reader, `/pp-undo --phase` (pp-core/workflows/undo.md), falls back to its
-        // git-log search when the file or the phase entry is missing — the path a
-        // project with no bindings or with the practices switch off already takes.
-        // After the verb check and before any positional or phase read; the
-        // envelope carries `ok: false` and a typed reason, which is how the step
-        // files read a manifest refusal (print the line and continue).
-        if (modeSeam.isStandardsModeActive(cwd)) {
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            const { notApplicableManifestVerbEnvelope } = require('./vault-mode.cjs');
-            const naManifest = notApplicableManifestVerbEnvelope();
-            c.output(naManifest, true, raw ? JSON.stringify(naManifest) : naManifest.message);
-            return;
-        }
-        // The phase DIRECTORY, as for `audit`: the path carries the workstream
-        // partition, and the manifest is written two levels above it.
-        const manifestPhaseDir = manifestPositionals[1];
-        if (manifestPhaseDir === undefined) {
-            error('No phase directory was given. Usage: vault manifest <start|record> <phase-dir> [--raw].', ERROR_REASON.SDK_MISSING_ARG);
-            return;
-        }
-        let manifestRoot;
-        try {
-            manifestRoot = findProjectRoot(cwd) || cwd;
-        }
-        catch {
-            manifestRoot = cwd;
-        }
-        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-        const manifestMod = _audit ?? require('./vault-audit.cjs');
-        const writeOpts = { root: manifestRoot, phaseDir: manifestPhaseDir, cwd, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal };
-        const manifestResult = manifestVerb === 'start'
-            ? manifestMod.recordPhaseStart(writeOpts)
-            : manifestMod.recordPhaseCommits(writeOpts);
-        if (raw) {
-            c.output(manifestResult, true, JSON.stringify(manifestResult));
-        }
-        else {
-            c.output(manifestResult, true, manifestMod.renderManifestResult(manifestResult));
-        }
-    }
     else if (subcommand === 'update') {
         // PBI 74316: `vault update [<tag>] [--yes]`. Without --yes it reports the
         // plan and writes nothing; see src/vault-update.cts for the contract.
@@ -1383,8 +459,7 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
     }
     else if (subcommand === 'standards') {
         // 15-07 (D-06, D-08, D-13): the standards record verbs. The arm body lives
-        // in `routeVaultStandards` below; the invalid-mode refusal above already
-        // ran, because 'standards' is a member of VAULT_SUBCOMMANDS.
+        // in `routeVaultStandards` below.
         routeVaultStandards({ cwd, args, raw, error, vault, c, exec: _exec ?? shell_command_projection_cjs_1.execGitLocal });
     }
     else if (subcommand === 'admission') {
@@ -1411,7 +486,7 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
  *
  * The answer comes from `vaultAdmissionVerdict` in the REAL src/vault.cts, never
  * from the injectable `_vault` seam: a governance decision must not be
- * switchable by a test mock (the mode-guard precedent in `routeVaultCommand`).
+ * switchable by a test mock.
  * It stays on the cwd's own verdict, not the producer verdict the seven record
  * producers ask (quick 261015-ect, QD-10): this verb is a REPORT of the cwd,
  * which is what every fence asks, so a bindings-less linked worktree answers
@@ -1420,9 +495,7 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _
  * Exit 0 on every answer, because a door fence reads the TOKEN: any stdout other
  * than `on`, `off` or `inert` halts it, and its `|| echo unrecognised` fallback
  * turns a non-zero exit into a halt as well. The only non-zero paths are an
- * argument error here and the 13-06 invalid-mode refusal that precedes every
- * vault subcommand where `.platform-bindings.json` exists (QD-11); both
- * therefore halt the fence, never skip it.
+ * argument error here, which therefore halts the fence, never skips it.
  */
 function admissionVerb({ cwd, rest, raw, error, c }) {
     let explain = false;
@@ -1462,7 +535,7 @@ function admissionVerb({ cwd, rest, raw, error, c }) {
  *
  * ORDER: unless `vault admission` answers `on` (bindings present, every config
  * readable, the vault switch on) both verbs print nothing and write nothing,
- * before any argument or the mode is read — so a project without the vault is
+ * before any argument is read — so a project without the vault is
  * byte-identical on every path including a mistyped one, and a standards record
  * cannot be produced on a project whose trace gate is inert (17-REVIEW CR-01,
  * D-13; the same gate `routeVaultAnchor` and `doorRecordVerb` ask). The verdict
@@ -1470,26 +543,23 @@ function admissionVerb({ cwd, rest, raw, error, c }) {
  * QD-09): in a linked worktree reading its owning checkout's cache — where an
  * executor runs `consulted` and has no untracked bindings of its own — that is
  * the owning checkout, which is also where the gate reading the record runs. Then
- * practices mode answers its one not-applicable line, then the verb and the
- * flags are checked. An invalid mode never reaches here: the pre-dispatch
- * guard in `routeVaultCommand` refused it.
+ * the verb and the flags are checked.
  *
- * Every governance read is from the REAL module, never the `_vault` seam (the
- * mode-guard precedent); only the bounded PLAN read goes through the seam, so
+ * Every governance read is from the REAL module, never the `_vault` seam; only the bounded PLAN read goes through the seam, so
  * a test can count it. Neither verb writes a file.
  */
 function routeVaultStandards({ cwd, args, raw, error, vault, c, exec }) {
+    // `promote` is an operator action, not a record producer: it is dispatched
+    // BEFORE the producer admission below, so a vault that is off answers with
+    // the promote module's own activation refusal instead of printing nothing.
+    if (args[2] === 'promote') {
+        standardsPromoteVerb({ cwd, rest: args.slice(3), raw, error, c, exec });
+        return;
+    }
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const owner = require('./vault.cjs');
     if (owner.vaultProducerAdmissionVerdict(cwd).state !== 'on')
         return;
-    if (!owner.isStandardsModeActive(cwd)) {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const { notApplicableStandardsVerbEnvelope } = require('./vault-mode.cjs');
-        const na = notApplicableStandardsVerbEnvelope();
-        c.output(na, true, raw ? JSON.stringify(na) : na.message);
-        return;
-    }
     const verb = args[2];
     const rest = args.slice(3);
     if (verb === 'block') {
@@ -1502,6 +572,79 @@ function routeVaultStandards({ cwd, args, raw, error, vault, c, exec }) {
         error(`Unknown standards subcommand. Available: ${STANDARDS_VERBS.join(', ')}`, ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
+/** The flags `vault standards promote` takes that carry a value. */
+const PROMOTE_VALUE_FLAGS = ['--path', '--entry', '--section', '--expect'];
+/**
+ * `vault standards promote <file> [--path <vault-path>] [--entry "<what it is>;
+ * used when <…>"] [--section <INDEX section>] [--confirmed --expect <token>]
+ * [--raw]` (FORK-ONLY): add a standards document from this project to the
+ * client vault with its INDEX.md entry. Without `--confirmed` it only
+ * previews; see src/vault-standards-promote.cts for the guards and the two
+ * runs. An unrecognised flag is refused BEFORE the module loads or anything
+ * spawns (T-29-16); no flag disables or relaxes a guard. The verdict is
+ * written to stdout first, then a refusal also exits non-zero: an action
+ * command's refusal must be observable in the exit code.
+ */
+function standardsPromoteVerb({ cwd, rest, raw, error, c, exec }) {
+    const usage = 'Usage: vault standards promote <file> [--path <vault-path>] [--entry "<what it is>; used when <...>"] '
+        + '[--section <INDEX section>] [--confirmed --expect <token>] [--raw].';
+    const values = {};
+    let confirmed = false;
+    let filePath;
+    for (let i = 0; i < rest.length; i += 1) {
+        const a = rest[i];
+        if (a === '--raw')
+            continue;
+        if (a === '--confirmed') {
+            confirmed = true;
+            continue;
+        }
+        if (PROMOTE_VALUE_FLAGS.includes(a)) {
+            const v = rest[i + 1];
+            if (v === undefined || v.startsWith('--')) {
+                error(`${a} needs a value. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            values[a] = v;
+            i += 1;
+            continue;
+        }
+        if (a.startsWith('--')) {
+            error(`Unrecognized flag "${boundedPath(a)}" for vault standards promote. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        if (filePath !== undefined) {
+            error(`vault standards promote takes exactly one document. ${usage}`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        filePath = a;
+    }
+    if (filePath === undefined) {
+        error(`No standards document was given. ${usage}`, ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    if (confirmed && values['--expect'] === undefined) {
+        error('This standards document was not pushed: the confirmation is missing the preview token. '
+            + 'Run the promotion without --confirmed first, then pass the token it prints.', ERROR_REASON.VAULT_PROMOTE_CONCURRENT_EDIT);
+        return;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const promote = require('./vault-standards-promote.cjs');
+    const verdict = promote.promoteStandard({
+        cwd,
+        filePath,
+        vaultPath: values['--path'] ?? null,
+        entry: values['--entry'] ?? null,
+        section: values['--section'] ?? null,
+        confirmed,
+        expect: values['--expect'] ?? null,
+        _exec: exec,
+    });
+    c.output(verdict, true, raw ? JSON.stringify(verdict) : promote.renderPromoteReport(verdict));
+    if (verdict.status === 'refused') {
+        error(String(verdict.message), String(verdict.reason));
+    }
+}
 function standardsBlockVerb({ cwd, rest, raw, error, c, owner }) {
     // ── arguments ──
     let planId;
@@ -1602,7 +745,7 @@ function standardsBlockVerb({ cwd, rest, raw, error, c, owner }) {
     // trace leaf accepts the operator's override reason from this process's
     // environment; a non-blocking verdict records nothing (D-15 of Phase 4). The
     // router names no part of the override stack (the leaf owns it all). The
-    // gate name is the scaffold arm's own constant. The verdict is computed
+    // gate name is `TRACE_OVERRIDE_GATE`. The verdict is computed
     // against the SAME cache the stamp above measured (D-36, 15-REVIEW iter-2
     // WR-02), exactly as the trace gate recomputes it, so the suppressed reason
     // recorded here is the one the gate will compare it with, in any checkout.
@@ -1627,7 +770,7 @@ function standardsBlockVerb({ cwd, rest, raw, error, c, owner }) {
         error(`Vault standards block could not write the record: ${boundedPath(e instanceof Error ? e.message : String(e))}`, ERROR_REASON.UNKNOWN);
         return;
     }
-    const envelope = owner.withVaultMode({
+    const envelope = {
         status: 'ok',
         planId,
         stamp: { repo: record.repo, ref: record.ref, sha: record.sha, indexStatus },
@@ -1635,7 +778,7 @@ function standardsBlockVerb({ cwd, rest, raw, error, c, owner }) {
         degraded: record.degraded,
         override: record.override,
         text,
-    }, cwd);
+    };
     c.output(envelope, true, raw ? JSON.stringify(envelope) : text);
 }
 function standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec, }) {
@@ -1652,9 +795,9 @@ function standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec,
     }
     const artifactPath = positionals[0];
     const shown = boundedPath(artifactPath);
-    // CONTAINMENT FIRST, then the size, then the read (the `trace render`
-    // precedent, T-03-50): the plan path is an unvalidated positional, and a
-    // decision taken on the bounded read's RESULT would be no decision.
+    // CONTAINMENT FIRST, then the size, then the read (T-03-50): the plan path
+    // is an unvalidated positional, and a decision taken on the bounded read's
+    // RESULT would be no decision.
     if (artifactPath.indexOf('\u0000') !== -1) {
         error(`The plan path is not a usable path: ${shown}`, ERROR_REASON.SDK_FAIL_FAST);
         return;
@@ -1758,7 +901,7 @@ function standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec,
     const start = vaultSeal.readDirAnchors(node_path_1.default.dirname(artifactAbs))?.start ?? null;
     const anchors = vaultSeal.ANCHOR_SHA_RE.test(end) ? { start, end } : null;
     const section = vaultStandardsLeaf.serializeConsultedSection(record, { anchors });
-    const envelope = owner.withVaultMode({
+    const envelope = {
         status: 'ok',
         planId: record.planId,
         stamp: { repo: record.repo, ref: record.ref, sha: record.sha },
@@ -1767,13 +910,13 @@ function standardsConsultedVerb({ cwd, rest, raw, error, c, owner, vault, exec,
         degraded: record.degraded === null ? null : vaultStandardsLeaf.standardsEchoDegraded(record.degraded),
         cacheSource: cache.source,
         section,
-    }, cwd);
+    };
     c.output(envelope, true, raw ? JSON.stringify(envelope) : section);
 }
 /**
  * The real vault module, for the governance reads of the 16-06 verbs: the
  * admission verdict, containment and phase resolution must not be switchable
- * by a test mock (the mode-guard precedent in `routeVaultCommand`).
+ * by a test mock.
  */
 function anchorOwner() {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -1856,52 +999,6 @@ function isDanglingLink(abs) {
         return false;
     }
 }
-/**
- * Where the execute-stage scaffold reads a plan's START anchor from, derived
- * from `--plan` (16-06, D-31). Measured order:
- *
- *   1. the QUICK form first: the one directory `<root>/.planning/quick/<id>-*`
- *      (quick task directories always live under the ROOT planning tree,
- *      `src/init.cts`). Exactly one match resolves; two or more is ambiguous
- *      and resolves nothing. Tried for every id, so an all-digit quick id
- *      (`261011-123`, which the phase alternative of `SCAFFOLD_PLAN_ID_RE`
- *      also accepts) still finds its quick directory, and no second copy of
- *      the quick-id form is needed here;
- *   2. otherwise the PHASE form: the segment before the first `-` (`02.1` of
- *      `02.1-03`) resolved by `resolveTracePhaseDir`, the resolver the trace
- *      gate uses for a phase-number positional, which honours the active
- *      workstream (`--ws`, `GSD_WORKSTREAM`, the session pointer) through the
- *      phase locator.
- *
- * Unresolvable → `ok: false`, and the scaffold writes `endCommit` only.
- */
-function resolveScaffoldAnchorsDir(cwd, planId) {
-    const root = projectRootOf(cwd);
-    const quickRoot = node_path_1.default.join(root, '.planning', 'quick');
-    let quick = [];
-    try {
-        quick = node_fs_1.default.readdirSync(quickRoot, { withFileTypes: true })
-            .filter((d) => d.isDirectory() && d.name.startsWith(`${planId}-`))
-            .map((d) => d.name);
-    }
-    catch {
-        quick = [];
-    }
-    if (quick.length === 1) {
-        const abs = node_path_1.default.join(quickRoot, quick[0]);
-        return { ok: true, root, abs, rel: node_path_1.default.relative(root, abs).split(node_path_1.default.sep).join('/') };
-    }
-    if (quick.length > 1) {
-        return { ok: false, reason: 'anchors-dir-ambiguous', message: `${quick.length} quick directories match .planning/quick/${boundedPath(planId)}-*` };
-    }
-    const dash = planId.indexOf('-');
-    if (dash > 0) {
-        const resolved = anchorOwner().resolveTracePhaseDir(root, cwd, planId.slice(0, dash));
-        if (resolved && resolved.onlyFile === undefined)
-            return { ok: true, root, abs: resolved.abs, rel: resolved.rel };
-    }
-    return { ok: false, reason: 'anchors-dir-unresolved', message: `no phase or quick directory resolves for plan ${boundedPath(planId)}` };
-}
 /**
  * `vault anchor <verb>` (16-06). INERT FIRST (D-13): unless the producer
  * admission verdict is `on` (bindings present, every config readable, the
@@ -1938,8 +1035,6 @@ function routeVaultAnchor({ cwd, args, raw, error, c, exec }) {
  * `vault anchor start <dir>` (16-06, D-31): record HEAD as the START anchor of
  * a phase or quick directory, in `<dir>/.vault-anchors.json`
  * (`{ start, recordedAt }`, written by the seal leaf's `writeDirStartAnchor`).
- * Mode-neutral: it is the start the practices-only `vault manifest start`
- * cannot give a standards-mode phase.
  *
  * Re-running at the SAME HEAD keeps the recorded start (`kept: true`, nothing
  * written). At any other HEAD it records HEAD as the new start and says which
@@ -1957,8 +1052,8 @@ function routeVaultAnchor({ cwd, args, raw, error, c, exec }) {
  * widening.
  *
  * Exit 0 on every refusal, which travels as `{ ok: false, reason, message }`
- * (the `vault manifest` posture: the step prints it and continues; the strict
- * points type a missing start). An argument error is the only exit 1.
+ * (the step prints it and continues; the strict points type a missing
+ * start). An argument error is the only exit 1.
  */
 function anchorStartVerb({ cwd, rest, raw, error, c, exec }) {
     const positionals = [];
@@ -2247,75 +1342,6 @@ function insertLinesAfter(text, spans, after, lines) {
     const at = spans[after].end;
     return `${text.slice(0, at)}${lines.map((l) => `${eol}${l}`).join('')}${text.slice(at)}`;
 }
-/**
- * The index of the practices ledger's `generatedAt` line, the line the
- * serializer writes the anchors after, located the way the parser locates the
- * block: the frontmatter from line 0 to the first later line opening `---`, the
- * top-level `vault:` key, its `predicate:` child, and that child's own
- * `generatedAt:` key. Also returns the indent of the predicate's keys and one
- * indentation step, so the spliced lines sit at the ledger's own indentation.
- * `null` when any of these is missing.
- */
-function ledgerGeneratedAtLine(text, spans) {
-    const line = (i) => text.slice(spans[i].start, spans[i].end);
-    const indentOf = (l) => l.length - l.trimStart().length;
-    if (spans.length < 3 || line(0) !== '---')
-        return null;
-    let close = -1;
-    for (let i = 1; i < spans.length; i += 1) {
-        if (line(i).startsWith('---')) {
-            close = i;
-            break;
-        }
-    }
-    if (close === -1)
-        return null;
-    const vaultAt = Array.from({ length: close - 1 }, (_, k) => k + 1).find((i) => /^vault:\s*$/.test(line(i)));
-    if (vaultAt === undefined)
-        return null;
-    let predicateAt = -1;
-    let childIndent = -1;
-    for (let i = vaultAt + 1; i < close; i += 1) {
-        const l = line(i);
-        if (l.trim() === '')
-            continue;
-        const ind = indentOf(l);
-        if (ind === 0)
-            break;
-        if (childIndent === -1)
-            childIndent = ind;
-        if (ind === childIndent && l.trim() === 'predicate:') {
-            predicateAt = i;
-            break;
-        }
-    }
-    if (predicateAt === -1)
-        return null;
-    let keyIndent = -1;
-    for (let i = predicateAt + 1; i < close; i += 1) {
-        const l = line(i);
-        if (l.trim() === '')
-            continue;
-        const ind = indentOf(l);
-        if (ind <= childIndent)
-            break;
-        if (keyIndent === -1)
-            keyIndent = ind;
-        if (ind === keyIndent && l.trimStart().startsWith('generatedAt:')) {
-            return { index: i, keyIndent, step: keyIndent - childIndent };
-        }
-    }
-    return null;
-}
-/** The parsed statement minus its anchor keys, as text, for the before/after equality the back-fill asserts. */
-function statementWithoutAnchors(statement) {
-    const st = JSON.parse(JSON.stringify(statement ?? null));
-    if (st && st.predicate) {
-        for (const k of ['startCommit', 'endCommit', 'anchorBackfill', 'anchorsDropped'])
-            delete st.predicate[k];
-    }
-    return JSON.stringify(st);
-}
 /**
  * `vault anchor backfill <summary> --at <sha>` (16-06, D-32):
  * give a record written before anchors existed its anchors, ATTRIBUTED. There
@@ -2325,13 +1351,9 @@ function statementWithoutAnchors(statement) {
  * user.name`, bounded) and when. 16-07 reports a back-filled anchor as a note
  * on every later check. `--at HEAD` is allowed, and is still attributed.
  *
- *   - practices (a SUMMARY's execute-stage `vault:` ledger, tried first):
- *     `predicate.endCommit` = `--at` and `predicate.anchorBackfill: { by, at }`
- *     (no start: the record takes its directory's, D-59), spliced after the
- *     ledger's `generatedAt` line with the serializer's own lines
- *     (`traceAnchorLines`), so a later `trace render` round trip agrees;
- *   - standards (a `## Standards Consulted` section): the anchor line with its
- *     `backfilled by <who> at <iso>` tail, inserted as the section's last line.
+ * The record is a SUMMARY's `## Standards Consulted` section: the anchor line
+ * with its `backfilled by <who> at <iso>` tail is inserted as the section's
+ * last line (no start: the record takes its directory's, D-59).
  *
  * Every other byte of the file is kept: the new text is the old one with lines
  * inserted, and it is parsed back before it is written — the anchors must read
@@ -2340,8 +1362,8 @@ function statementWithoutAnchors(statement) {
  * renamed into place.
  *
  * Refused, writing nothing: a record that already carries an anchor (a valid,
- * a dropped or a malformed one: `already-anchored`), a file with no record of
- * either family (`no-record`), an `--at` that is not an ancestor of HEAD. A
+ * a dropped or a malformed one: `already-anchored`), a file with no
+ * Standards Consulted section (`no-record`), an `--at` that is not an ancestor of HEAD. A
  * path outside `.planning/`, a malformed sha and `--from`/`--attest` beside
  * `--at` are argument errors (exit 1), refused before any read or git call;
  * the state refusals are `ok: false` envelopes (exit 0).
@@ -2429,20 +1451,13 @@ function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
     const text = node_fs_1.default.readFileSync(located.abs, 'utf8');
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const traceLeaf = require('./vault-trace.cjs');
-    const ledger = traceLeaf.parseVaultTraceBlock(text, located.rel);
-    const st = (ledger.present ? ledger.statement : null);
-    const isLedger = st !== null && st._type === traceLeaf.TRACE_STATEMENT_TYPE && st.predicateType === traceLeaf.TRACE_PREDICATE_TYPE
-        && st.predicate !== undefined && st.predicate.stage === 'execute';
-    const section = isLedger ? null : vaultStandardsLeaf.parseConsultedSection(text);
-    const isSection = section !== null && section.present && section.planId !== null;
-    if (!isLedger && !isSection) {
-        refuse('no-record', `${located.rel} carries no execute-stage vault: ledger and no ${vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING} section to back-fill`);
-        return;
-    }
-    const anchored = isLedger
-        ? ['startCommit', 'endCommit', 'anchorBackfill', 'anchorsDropped'].some((k) => k in st.predicate)
-        : section.anchors !== undefined
-            || section.problems.some((p) => p.kind === vaultStandardsLeaf.STANDARDS_PROBLEM_KIND.ANCHOR_MALFORMED);
+    const section = vaultStandardsLeaf.parseConsultedSection(text);
+    if (!section.present || section.planId === null) {
+        refuse('no-record', `${located.rel} carries no ${vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING} section to back-fill`);
+        return;
+    }
+    const anchored = section.anchors !== undefined
+        || section.problems.some((p) => p.kind === vaultStandardsLeaf.STANDARDS_PROBLEM_KIND.ANCHOR_MALFORMED);
     if (at === undefined) {
         // `--from` + `--attest`: the attestation (16 review iteration 3 CR-01, D-102).
         if (!anchored) {
@@ -2450,7 +1465,7 @@ function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
             return;
         }
         attestVerb({
-            cwd, exec, text, located, from, attest, isLedger, refuse, emit, traceLeaf,
+            cwd, exec, text, located, from, attest, refuse, emit, traceLeaf,
         });
         return;
     }
@@ -2465,49 +1480,20 @@ function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
     }
     const backfill = { by: traceLeaf.resolveBackfillIdentity(cwd), at: new Date().toISOString() };
     const spans = lineSpans(text);
-    let next;
-    if (isLedger) {
-        const where = ledgerGeneratedAtLine(text, spans);
-        if (where === null) {
-            refuse('rewrite-unverifiable', `the ledger in ${located.rel} has no generatedAt line where the anchors belong`);
-            return;
-        }
-        // The serializer's lines, re-indented to this ledger's own indentation.
-        const lines = traceLeaf.traceAnchorLines({ ...(from !== undefined ? { startCommit: from } : {}), endCommit: at, anchorBackfill: backfill })
-            .map((l) => {
-            const depth = (l.length - l.trimStart().length) / 2 - 2;
-            return `${' '.repeat(where.keyIndent + depth * where.step)}${l.trimStart()}`;
-        });
-        next = insertLinesAfter(text, spans, where.index, lines);
-        const back = traceLeaf.parseVaultTraceBlock(next, located.rel);
-        const bp = back.present ? back.statement.predicate : {};
-        const agrees = back.present
-            && bp.endCommit === at
-            && bp.startCommit === from
-            && JSON.stringify(bp.anchorBackfill) === JSON.stringify(backfill)
-            && !('anchorsDropped' in bp)
-            && statementWithoutAnchors(back.statement) === statementWithoutAnchors(st);
-        if (!agrees) {
-            refuse('rewrite-unverifiable', `the back-filled ledger in ${located.rel} would not read back as written, so nothing was written`);
-            return;
-        }
-    }
-    else {
-        const live = vaultStandardsLeaf.findLiveSection(text, vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING);
-        const lastBody = live.body[live.body.length - 1];
-        const line = vaultStandardsLeaf.formatStandardsAnchorLine({ start: from ?? null, end: at, backfill });
-        next = insertLinesAfter(text, spans, lastBody, [line]);
-        const back = vaultStandardsLeaf.parseConsultedSection(next);
-        const before = section;
-        const expected = { ...(from !== undefined ? { start: from } : {}), end: at, backfill };
-        const strip = (p) => JSON.stringify({ ...p, anchors: undefined, headingLine: undefined });
-        const agrees = back.present
-            && JSON.stringify(back.anchors) === JSON.stringify({ end: expected.end, ...(from !== undefined ? { start: from } : {}), backfill })
-            && strip(back) === strip(before);
-        if (!agrees) {
-            refuse('rewrite-unverifiable', `the back-filled section in ${located.rel} would not read back as written, so nothing was written`);
-            return;
-        }
+    const live = vaultStandardsLeaf.findLiveSection(text, vaultStandardsLeaf.STANDARDS_CONSULTED_HEADING);
+    const lastBody = live.body[live.body.length - 1];
+    const line = vaultStandardsLeaf.formatStandardsAnchorLine({ start: from ?? null, end: at, backfill });
+    const next = insertLinesAfter(text, spans, lastBody, [line]);
+    const back = vaultStandardsLeaf.parseConsultedSection(next);
+    const before = section;
+    const expected = { ...(from !== undefined ? { start: from } : {}), end: at, backfill };
+    const strip = (p) => JSON.stringify({ ...p, anchors: undefined, headingLine: undefined });
+    const agrees = back.present
+        && JSON.stringify(back.anchors) === JSON.stringify({ end: expected.end, ...(from !== undefined ? { start: from } : {}), backfill })
+        && strip(back) === strip(before);
+    if (!agrees) {
+        refuse('rewrite-unverifiable', `the back-filled section in ${located.rel} would not read back as written, so nothing was written`);
+        return;
     }
     const tmp = `${located.abs}.${process.pid}.tmp`;
     try {
@@ -2526,7 +1512,7 @@ function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
         ok: true,
         action: 'backfill',
         file: located.rel,
-        family: isLedger ? 'practices' : 'standards',
+        family: 'standards',
         endCommit: at,
         ...(from !== undefined ? { startCommit: from } : {}),
         backfilledBy: backfill.by,
@@ -2566,10 +1552,10 @@ function anchorBackfillVerb({ cwd, rest, raw, error, c, exec }) {
  * whoever ran the command — what the CLI can read, not a verified identity —
  * and the envelope says so (`byVerified: false`).
  */
-function attestVerb({ cwd, exec, text, located, from, attest, isLedger, refuse, emit, traceLeaf }) {
+function attestVerb({ cwd, exec, text, located, from, attest, refuse, emit, traceLeaf }) {
     const dirAbs = node_path_1.default.dirname(located.abs);
     const recordName = node_path_1.default.basename(located.abs);
-    const kind = isLedger ? vaultSeal.RECORDED_ARTIFACT_KIND.SUMMARY_LEDGER : vaultSeal.RECORDED_ARTIFACT_KIND.STANDARDS_CONSULTED;
+    const kind = vaultSeal.RECORDED_ARTIFACT_KIND.STANDARDS_CONSULTED;
     const isAncestor = (a, d) => vaultSeal.isAnchorSha(a) && vaultSeal.isAnchorSha(d)
         && exec(['merge-base', '--is-ancestor', a, d], { cwd }).exitCode === 0;
     const anchors = vaultSeal.resolveRecordAnchors(text, kind, dirAbs, { isAncestor });
@@ -2676,7 +1662,7 @@ function attestVerb({ cwd, exec, text, located, from, attest, isLedger, refuse,
         ok: true,
         action: 'attest',
         file: located.rel,
-        family: isLedger ? 'practices' : 'standards',
+        family: 'standards',
         from,
         endCommit: end,
         attested: listed,
@@ -2690,7 +1676,7 @@ function attestVerb({ cwd, exec, text, located, from, attest, isLedger, refuse,
 const DOOR_TEXT_MAX = 190;
 /**
  * A free-text value made safe for a door record line: the vault leaf's display
- * sanitiser (controls, bidi, zero-width, fence markers), backticks turned into
+ * sanitiser (controls, bidi, zero-width), backticks turned into
  * apostrophes, bounded. Empty or the literal `none` becomes `unknown`, because
  * `none` is how a door record spells an absent value.
  */
@@ -2704,31 +1690,15 @@ function doorText(value, opts = {}) {
 }
 /**
  * The vault coordinates a door worked under, or the degraded one-liner saying
- * why there are none (D-12 "or") — read by the SAME pin reader the mode's own
- * record verb uses, never a third reader of the manifest:
+ * why there are none (D-12 "or") — read by the standards block verb's own pin
+ * reader, `standardsLoadedPin` over the manifest of the one resolved cache; no
+ * loaded pin records the degraded line `vault standards block` would write.
  *
- *   - practices: the trace scaffold's `resolvePin` over the one resolved cache.
- *     Only a `loaded` pin is recorded as coordinates; a degraded run (stale,
- *     fallback tier, ref drift, miss, no cache) records its reason instead,
- *     the same distinction the practices ledger draws;
- *   - standards: `standardsLoadedPin` over the manifest of the one resolved
- *     cache, the block verb's reader; no loaded pin records the degraded line
- *     `vault standards block` would write for it.
- *
- * The repo has already been through `redactCloneTarget` (both readers go
- * through `readManifest`), so no credential reaches the record.
+ * The repo has already been through `redactCloneTarget` (`readManifest`), so
+ * no credential reaches the record.
  */
-function doorVaultPin(cwd, mode, owner) {
+function doorVaultPin(cwd, owner) {
     const cacheDir = owner.resolveVaultCacheDir(cwd).dir;
-    if (mode === 'practices') {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const traceLeaf = require('./vault-trace.cjs');
-        const pin = traceLeaf.resolvePin(cwd, cacheDir);
-        if (pin.state === 'loaded' && typeof pin.ref === 'string' && vaultSeal.ANCHOR_SHA_RE.test(pin.resolvedSha ?? '')) {
-            return { vault: { repo: doorText(pin.repo, { token: true }), ref: doorText(pin.ref, { token: true }), sha: pin.resolvedSha }, degraded: null };
-        }
-        return { vault: null, degraded: doorText(pin.reason ?? 'the vault was not loaded') };
-    }
     const pin = vaultStandardsLeaf.standardsLoadedPin(owner.readManifest(cacheDir));
     if (pin !== null && vaultSeal.ANCHOR_SHA_RE.test(pin.sha)) {
         return { vault: { repo: doorText(pin.repo, { token: true }), ref: doorText(pin.ref, { token: true }), sha: pin.sha }, degraded: null };
@@ -2937,15 +1907,13 @@ function doorRecordVerb({ cwd, rest, raw, error, c, exec }) {
         }
         phase = doorText(resolved.rel, { token: true });
     }
-    const modeVerdict = owner.vaultModeVerdict(cwd);
-    const mode = modeVerdict.active && modeVerdict.ok === true && (modeVerdict.mode === 'practices' || modeVerdict.mode === 'standards')
-        ? modeVerdict.mode
-        : null;
-    if (mode === null) {
-        error('The vault mode could not be resolved, so the record has no mode and was not written.', ERROR_REASON.SDK_FAIL_FAST);
+    if (!owner.isVaultGateActive(cwd)) {
+        error('The vault is off for this project, so there is no vault record to write.', ERROR_REASON.SDK_FAIL_FAST);
         return;
     }
-    const pin = doorVaultPin(cwd, mode, owner);
+    // The record grammar keeps its `mode` field; standards is the only mode.
+    const mode = 'standards';
+    const pin = doorVaultPin(cwd, owner);
     let existing = '';
     if (node_fs_1.default.existsSync(located.abs)) {
         const size = node_fs_1.default.statSync(located.abs).size;