@pareto4/pp-core 1.18.0 → 1.19.0

package/pp-core/bin/lib/init-contract.cjs

@@ -225,7 +225,7 @@ function isVaultEnabledInConfig(parsed) {
 // ─── buildInitQuestions ────────────────────────────────────────────────────
 /** The canonical /pp-init question set, as data; the session may answer some itself (see "Automatic answers").
  * No org-profile question in this fork (PBI 74316); provider options come from `PROVIDERS`, preselected via `resolveProvider`. */
-function buildInitQuestions(cwd) {
+function buildInitQuestions(cwd, opts = {}) {
     let preselected = git_provider_cjs_1.DEFAULT_PROVIDER;
     try {
         preselected = (0, git_provider_cjs_1.resolveProvider)(cwd).provider;
@@ -247,6 +247,7 @@ function buildInitQuestions(cwd) {
             prompt: 'Client slug (kebab-case, e.g. "acme") — type "internal" if none',
             optionalAnswer: false,
         },
+        ...clientVaultQuestion(cwd, opts),
         { id: 'description', prompt: 'One-line description (what this project does)', optionalAnswer: false },
         {
             id: 'provider',
@@ -259,6 +260,23 @@ function buildInitQuestions(cwd) {
         { id: 'visibility', prompt: 'Visibility (private / public / internal)', optionalAnswer: false },
     ];
 }
+/** The client-vault question, asked while no vault is bound and a binding can be composed (`clientVaultChoice`).
+ * Blank or "none" keeps the org profile's seeded vault, if any; an answer replaces it in the binding.
+ * An internal project is answered "none" automatically (see `autoAnswerFor`). */
+function clientVaultQuestion(cwd, opts) {
+    const choice = (0, compose_bindings_cjs_1.clientVaultChoice)(cwd, opts);
+    if (!choice.offered)
+        return [];
+    return [
+        {
+            id: 'client_vault',
+            prompt: choice.defaultRepo === null
+                ? 'Client vault repo ("owner/name" or a full clone URL) — type "none" to bind no client vault'
+                : `Client vault repo ("owner/name" or a full clone URL) — type "none" to use the default vault (${choice.defaultRepo})`,
+            optionalAnswer: true,
+        },
+    ];
+}
 // ─── Automatic answers (PBI 74299): an org profile init section fixes answers and can derive slugs ───
 /** The visibility answers the question accepts. */
 const VISIBILITY_OPTIONS = Object.freeze(['private', 'public', 'internal']);
@@ -320,6 +338,9 @@ function autoAnswerFor(id, answers, init) {
         const value = init.fixed[id];
         return value === undefined ? null : { value, source: 'org-profile' };
     }
+    if (id === 'client_vault' && answers.client_slug === 'internal') {
+        return { value: 'none', source: 'derived' };
+    }
     if (init.deriveSlugs && (id === 'project_slug' || id === 'client_slug')) {
         const name = answers[id === 'project_slug' ? 'project_name' : 'client_name'];
         const slug = typeof name === 'string' ? deriveSlug(name) : null;
@@ -328,10 +349,10 @@ function autoAnswerFor(id, answers, init) {
     return null;
 }
 /** The session's automatic answers, in question order. */
-function listAutoAnswers(cwd, session) {
+function listAutoAnswers(cwd, session, opts) {
     const sources = session.autoAnswers ?? {};
     const out = [];
-    for (const q of buildInitQuestions(cwd)) {
+    for (const q of buildInitQuestions(cwd, { _globalRoot: opts._globalRoot })) {
         const source = sources[q.id];
         const value = session.answers[q.id];
         if (source !== undefined && typeof value === 'string')
@@ -758,10 +779,15 @@ function normalizeYesNo(value) {
 }
 /** Decide the current step, performing its idempotent side effects once: automatic answers, the identity write,
  * the compose decision and `doneAt`. Recomputes the question set on every call. */
+/** The client vault the operator named, or `undefined` to keep the seeded one. */
+function answeredClientVault(session) {
+    const checked = (0, compose_bindings_cjs_1.validateClientVaultAnswer)(session.answers.client_vault);
+    return checked.ok && checked.value !== null ? checked.value : undefined;
+}
 function computeCurrentStep(cwd, session, opts) {
     // Any failure degrades to a `write_failed` step instead of throwing.
     try {
-        const questions = buildInitQuestions(cwd);
+        const questions = buildInitQuestions(cwd, { _globalRoot: opts._globalRoot });
         // PBI 74299: read once per call; only consulted for an unanswered question.
         let profileInit = null;
         for (const q of questions) {
@@ -784,7 +810,11 @@ function computeCurrentStep(cwd, session, opts) {
             persistSession(cwd, session);
         }
         if (session.composeDecision === null) {
-            const dryRun = (0, compose_bindings_cjs_1.composeBindings)(cwd, { offline: opts.offline === true, _globalRoot: opts._globalRoot });
+            const dryRun = (0, compose_bindings_cjs_1.composeBindings)(cwd, {
+                offline: opts.offline === true,
+                _globalRoot: opts._globalRoot,
+                clientVaultRepo: answeredClientVault(session),
+            });
             // Offer compose_confirm only when approving would change something; 'unchanged' and 'skipped' are distinct end states.
             if (dryRun.composable === true && dryRun.action !== 'unchanged') {
                 // VAULT-EGRESS-1: `info` is display-only (the CLI and the TTY renderer print it); approval
@@ -889,7 +919,7 @@ function initSessionNext(cwd, opts = {}) {
     }
     const session = loaded.session;
     const state = currentStepToState(computeCurrentStep(cwd, session, opts));
-    const autoAnswered = listAutoAnswers(cwd, session);
+    const autoAnswered = listAutoAnswers(cwd, session, opts);
     return autoAnswered.length > 0 ? { ...state, autoAnswered } : state;
 }
 /** Record one answer for the current step only; out-of-order, blank required, unparseable or post-done answers are rejected. */
@@ -929,6 +959,12 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
                 return { ok: false, reason: 'answer_required', message: `Question "${stepId}" requires a non-blank answer.` };
             }
             const answerValue = typeof value === 'string' ? value : '';
+            if (stepId === 'client_vault') {
+                const checked = (0, compose_bindings_cjs_1.validateClientVaultAnswer)(answerValue);
+                if (!checked.ok) {
+                    return { ok: false, reason: 'invalid_answer', message: `Question "client_vault": ${checked.reason}` };
+                }
+            }
             session.answers[stepId] = answerValue;
             persistSession(cwd, session);
             return { ok: true };
@@ -951,7 +987,12 @@ function initSessionAnswer(cwd, stepId, value, opts = {}) {
             }
             if (normalized === true) {
                 // Check the write result before recording "approved": the file can change between the dry run and this write.
-                const writeResult = (0, compose_bindings_cjs_1.composeBindings)(cwd, { write: true, offline: opts.offline === true, _globalRoot: opts._globalRoot });
+                const writeResult = (0, compose_bindings_cjs_1.composeBindings)(cwd, {
+                    write: true,
+                    offline: opts.offline === true,
+                    _globalRoot: opts._globalRoot,
+                    clientVaultRepo: answeredClientVault(session),
+                });
                 if (writeResult.composable !== true || writeResult.wrote !== true) {
                     // Leave the decision unset so the next call re-evaluates and can re-offer compose_confirm.
                     return {

package/pp-core/bin/lib/vault-coordinates.cjs

@@ -73,7 +73,7 @@ exports.DEFAULT_HOST_FOR_PROVIDER = Object.freeze({
     github: 'github.com',
 });
 /** The values moving out of `src/vault.cts`'s `DEFAULT_FALLBACK_REPO`/`DEFAULT_FALLBACK_REF`. */
-exports.DEFAULT_SHARED_REPO = 'pareto000/Pareto-Vault';
+exports.DEFAULT_SHARED_REPO = 'pareto-ooo/pareto-vault-releases';
 exports.DEFAULT_SHARED_REF = 'main';
 /** Dotted `.planning/config.json` keys, named so no consumer hand-writes a key string. */
 exports.SHARED_REPO_CONFIG_KEY = 'vault.fallback_repo';

package/pp-core/bin/lib/vault-index.cjs

@@ -39,7 +39,7 @@
  * has already sanitised.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VAULT_INDEX_WITHHELD_KINDS = exports.VAULT_INDEX_UNCHECKED_CAUSES = exports.VAULT_INDEX_UNPARSEABLE_CAUSES = exports.VAULT_INDEX_REASON = exports.DISPLAY_UNSAFE_TEXT_CHAR_RE = exports.VAULT_BINDING_NOTE = exports.VAULT_PATH_REASONS = exports.VAULT_INDEX_LIST_BOUND = exports.VAULT_TEXT_MAX = exports.VAULT_INDEX_GRAMMAR = exports.VAULT_SECTION_HEADING_PREFIX = exports.VAULT_USED_WHEN_RE = exports.VAULT_USED_WHEN_MARKER = exports.VAULT_ENTRY_SEPARATOR = exports.VAULT_ENTRY_PREFIX = exports.VAULT_INDEX_BYTE_CAP = exports.VAULT_INDEX_FILENAME = void 0;
+exports.VAULT_INDEX_WITHHELD_KINDS = exports.VAULT_INDEX_UNCHECKED_CAUSES = exports.VAULT_INDEX_UNPARSEABLE_CAUSES = exports.VAULT_INDEX_REASON = exports.DISPLAY_UNSAFE_TEXT_CHAR_RE = exports.VAULT_BINDING_NOTE = exports.VAULT_PATH_REASONS = exports.VAULT_INDEX_LIST_BOUND = exports.VAULT_TEXT_MAX = exports.VAULT_INDEX_GRAMMAR = exports.VAULT_CROSS_CUTTING_MARK = exports.VAULT_SECTION_HEADING_PREFIX = exports.VAULT_USED_WHEN_RE = exports.VAULT_USED_WHEN_MARKER = exports.VAULT_ENTRY_SEPARATOR = exports.VAULT_ENTRY_PREFIX = exports.VAULT_INDEX_BYTE_CAP = exports.VAULT_INDEX_FILENAME = void 0;
 exports.classifyVaultPath = classifyVaultPath;
 exports.isSafeVaultPath = isSafeVaultPath;
 exports.splitVaultEntryLine = splitVaultEntryLine;
@@ -74,6 +74,13 @@ exports.VAULT_USED_WHEN_MARKER = '; used when ';
 exports.VAULT_USED_WHEN_RE = /;\s+used when\s+/i;
 /** A section is opened by a level-2 ATX heading at column 0. */
 exports.VAULT_SECTION_HEADING_PREFIX = '## ';
+/**
+ * The cross-cutting mark (issue #12, items 16-17): an entry whose remainder
+ * starts with it holds a rule every Discovery session must read — approval
+ * routes, folder layout, naming — whatever the session's topics are. It is
+ * stripped from the description and recorded as `crossCutting: true`.
+ */
+exports.VAULT_CROSS_CUTTING_MARK = '[cross-cutting]';
 /** The six grammar values bundled, frozen, for a consumer that quotes the grammar whole. */
 exports.VAULT_INDEX_GRAMMAR = Object.freeze({
     filename: exports.VAULT_INDEX_FILENAME,
@@ -219,16 +226,22 @@ const LEVEL1_HEADING_RE = /^#(?:[ \t].*)?$/;
 // D-28: an entry prefix indented 1-3 spaces is a near-miss, not a nested list.
 const INDENTED_ENTRY_RE = /^ {1,3}- `/;
 function buildEntry(section, path, rest, line) {
-    const m = exports.VAULT_USED_WHEN_RE.exec(rest);
+    // The mark is read off the front of the remainder; a mark with nothing after
+    // it stays text, so the description is never left empty.
+    const lead = rest.trimStart();
+    const marked = lead.startsWith(exports.VAULT_CROSS_CUTTING_MARK) && lead.slice(exports.VAULT_CROSS_CUTTING_MARK.length).trim() !== '';
+    const body = marked ? lead.slice(exports.VAULT_CROSS_CUTTING_MARK.length) : rest;
+    const flag = marked ? { crossCutting: true } : {};
+    const m = exports.VAULT_USED_WHEN_RE.exec(body);
     if (m) {
-        const usedWhen = rest.slice(m.index + m[0].length).trim();
+        const usedWhen = body.slice(m.index + m[0].length).trim();
         if (usedWhen !== '') {
-            return { section, path, description: rest.slice(0, m.index).trim(), usedWhen, line };
+            return { section, path, description: body.slice(0, m.index).trim(), usedWhen, ...flag, line };
         }
     }
     // No clause, or an empty one: the whole remainder is the description and the
     // key is omitted — a clause is never invented and text is never dropped.
-    return { section, path, description: rest.trim(), line };
+    return { section, path, description: body.trim(), ...flag, line };
 }
 /**
  * Parse an INDEX.md text tolerantly. Never throws; a non-string is read as

package/pp-core/bin/lib/vault-update.cjs

@@ -109,6 +109,7 @@ function vaultUpdate(cwd, opts = {}) {
         from: null,
         to: null,
         latest: null,
+        newer: null,
         available: [],
         fetch: null,
         nextStep: null,
@@ -152,6 +153,9 @@ function vaultUpdate(cwd, opts = {}) {
     tags = [...new Set(tags)].sort((a, b) => (0, semver_compare_cjs_1.compareSemverCore)(b, a));
     result.available = tags.slice(0, exports.AVAILABLE_TAGS_CAP);
     result.latest = tags[0] ?? null;
+    if (result.from && result.latest && (0, semver_compare_cjs_1.isStableTripletSemver)(result.from) && (0, semver_compare_cjs_1.compareSemverCore)(result.latest, result.from) > 0) {
+        result.newer = result.latest;
+    }
     if (tags.length === 0) {
         return fail('no_tags', `The vault repo "${redactCloneTarget(repo)}" has no stable vX.Y.Z tag to pin to.`);
     }

package/pp-core/bin/lib/vault.cjs

@@ -2809,7 +2809,7 @@ function resolveRefDrift({ cwd, tier, cachedRef }) {
         // DEVIATION from plan 08-01's step 3, recorded so the next reader does not
         // "restore" it: the plan prescribed copying the miss branch's call-site-
         // scoped `require('./git-provider.cjs')` / `require('./vault-coordinates.cjs')`
-        // pair from src/check-command-router.cts:1558-1565. That shape exists THERE
+        // pair from src/check-command-router.cts:1587-1594. That shape exists THERE
         // because the check router does not otherwise import those leaves, so the
         // require genuinely keeps its module graph narrow. It buys nothing HERE:
         // this module already imports `resolveProvider` (:40) and
@@ -2833,7 +2833,7 @@ function resolveRefDrift({ cwd, tier, cachedRef }) {
         //     UNCONDITIONALLY, including when `repo` is null, so an ungated
         //     comparison reports phantom drift on every project that configures no
         //     client vault at all. The miss branch argues the same point at
-        //     src/check-command-router.cts:1567-1570, where it keeps the truthful
+        //     src/check-command-router.cts:1596-1599, where it keeps the truthful
         //     `(no ref pinned)` placeholder for the same reason.
         //
         //     D-08-39(a): a BLANK or WHITESPACE-ONLY `client.vaultRepo` is not a

package/pp-core/bin/pp-tools.cjs

@@ -19,8 +19,8 @@
  *   state signal-resume                Remove WAITING.json signal
  *   resolve-model <agent-type>         Get model for agent based on profile
  *   find-phase <phase>                 Find phase directory by number
- *   commit <message> [--files f1 f2] [--no-verify]   Commit planning docs
- *   commit-to-subrepo <msg> --files f1 f2  Route commits to sub-repos
+ *   commit <message> [--files f1 f2] [--phase id] [--quick id] [--no-verify]   Commit planning docs
+ *   commit-to-subrepo <msg> --files f1 f2 [--phase id]  Route commits to sub-repos
  *   verify-summary <path>              Verify a SUMMARY.md file
  *   generate-slug <text>               Convert text to URL-safe slug
  *   current-timestamp [format]         Get timestamp (full|date|filename)
@@ -1158,6 +1158,10 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
     }
 
     case 'commit': {
+      // --phase <id> / --quick <id> add a `Phase:` / `Quick:` trailer; pulled out
+      // first so their values are never read as message words or --files paths.
+      const trailerArgs = commands.extractCommitTrailerArgs(args);
+      args = trailerArgs.args;
       const amend = args.includes('--amend');
       const noVerify = args.includes('--no-verify');
       const filesIndex = args.indexOf('--files');
@@ -1168,7 +1172,7 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
       const messageArgs = args.slice(1, endIndex).filter(a => !a.startsWith('--'));
       const message = messageArgs.join(' ') || undefined;
       const files = filesIndex !== -1 ? args.slice(filesIndex + 1).filter(a => !a.startsWith('--')) : [];
-      commands.cmdCommit(cwd, message, files, raw, amend, noVerify);
+      commands.cmdCommit(cwd, message, files, raw, amend, noVerify, { phase: trailerArgs.phase, quick: trailerArgs.quick });
       break;
     }
 
@@ -1178,10 +1182,12 @@ async function runCommand(command, args, cwd, raw, defaultValue, originalCommand
     }
 
     case 'commit-to-subrepo': {
+      const trailerArgs = commands.extractCommitTrailerArgs(args);
+      args = trailerArgs.args;
       const message = args[1];
       const filesIndex = args.indexOf('--files');
       const files = filesIndex !== -1 ? args.slice(filesIndex + 1).filter(a => !a.startsWith('--')) : [];
-      commands.cmdCommitToSubrepo(cwd, message, files, raw);
+      commands.cmdCommitToSubrepo(cwd, message, files, raw, { phase: trailerArgs.phase, quick: trailerArgs.quick });
       break;
     }
 

package/pp-core/org-profile.json

@@ -11,7 +11,7 @@
       "repo": "pareto000/Pareto-Platform"
     },
     "client": {
-      "vaultRepo": "pareto000/Pareto-Vault",
+      "vaultRepo": "pareto-ooo/pareto-vault-releases",
       "vaultHost": "github.com"
     },
     "provisioning": {

package/pp-core/references/autonomous-best-effort.md

@@ -83,7 +83,7 @@ grep -q "^handled=${PHASE_NUM}:" "$RUN_STATE" 2>/dev/null ||
   printf 'handled=%s:%s\n' "$PHASE_NUM" "$OUTCOME" >> "$RUN_STATE"
 PADDED_PHASE=$(basename "$PHASE_DIR" | cut -d- -f1)
 if [ -f "$REPORT" ]; then
-  pp_run query commit "docs(${PADDED_PHASE}): autonomous report" --files "$REPORT"
+  pp_run query commit "docs(planning): autonomous report" --phase "${PADDED_PHASE}" --files "$REPORT"
 fi
 ```
 
@@ -400,6 +400,7 @@ phase. Printed by the lifecycle single-phase banner, the STOPPED banner and the
 Used by `autonomous.md` §3a when `workflow.skip_discuss` is true. Get phase details:
 
 ```bash
+[ -z "${ZSH_VERSION:-}" ] || emulate -R sh
 DETAIL=$(pp_run query roadmap.get-phase ${PHASE_NUM})
 ```
 
@@ -452,7 +453,7 @@ None — discuss phase skipped.
 Commit the minimal context:
 
 ```bash
-pp_run query commit "docs(${padded_phase}): auto-generated context (discuss skipped)" --files "${phase_dir}/${padded_phase}-CONTEXT.md"
+pp_run query commit "docs(planning): auto-generated context (discuss skipped)" --phase "${padded_phase}" --files "${phase_dir}/${padded_phase}-CONTEXT.md"
 ```
 
 ## Banner math

package/pp-core/references/autonomous-lifecycle.md

@@ -109,6 +109,7 @@ Skill(skill="pp-complete-milestone", args="${milestone_version}")
 After complete-milestone returns, verify it produced output:
 
 ```bash
+[ -z "${ZSH_VERSION:-}" ] || emulate -R sh
 ls .planning/milestones/v${milestone_version}-ROADMAP.md 2>/dev/null || true
 ```
 

package/pp-core/references/autonomous-smart-discuss.md

@@ -5,6 +5,7 @@ Smart discuss is the autonomous-optimized variant of `pp-discuss-phase`. It prop
 **Inputs:** `PHASE_NUM` from execute_phase. Run init to get phase paths:
 
 ```bash
+[ -z "${ZSH_VERSION:-}" ] || emulate -R sh
 PHASE_STATE=$(pp-tools query init.phase-op ${PHASE_NUM})
 ```
 
@@ -34,6 +35,7 @@ Extract from these:
 **Read all prior CONTEXT.md files:**
 
 ```bash
+[ -z "${ZSH_VERSION:-}" ] || emulate -R sh
 (find "$(dirname "$STATE_PATH")/phases" -name "*-CONTEXT.md" 2>/dev/null || true) | sort
 ```
 
@@ -68,6 +70,7 @@ Lightweight codebase scan to inform grey area identification and proposals. Keep
 **Check for existing codebase maps:**
 
 ```bash
+[ -z "${ZSH_VERSION:-}" ] || emulate -R sh
 ls .planning/codebase/*.md 2>/dev/null || true
 ```
 
@@ -96,6 +99,7 @@ Read the 3-5 most relevant files to understand existing patterns.
 **Get phase details:**
 
 ```bash
+[ -z "${ZSH_VERSION:-}" ] || emulate -R sh
 DETAIL=$(pp-tools query roadmap.get-phase ${PHASE_NUM})
 ```
 
@@ -270,7 +274,7 @@ Write the file.
 **Commit:**
 
 ```bash
-pp-tools query commit "docs(${PADDED_PHASE}): smart discuss context" --files "${phase_dir}/${padded_phase}-CONTEXT.md"
+pp_run query commit "docs(planning): smart discuss context" --phase "${PADDED_PHASE}" --files "${phase_dir}/${padded_phase}-CONTEXT.md"
 ```
 
 Display confirmation:

package/pp-core/references/discovery-id-conventions.md

@@ -17,12 +17,13 @@ never `@`-imported.
 | Data-gathering items | `DG-<nn>` — same shape as SP. Regex: `DG-\d{2}` | `DG-07` | Open data-gathering items in `_risks.md` |
 | Research items | `RS-<nn>` — same shape as SP/DG: zero-padded 2-digit global sequence, no session component. Regex: `RS-\d{2}` | `RS-01` | Rows of `_research.md`, the research-only backlog |
 | Screens | `SCR-<nn>` — zero-padded 2-digit global sequence, no session and no role component, minted by scan (D-12). Regex: `SCR-\d{2}` | `SCR-01` | Rows of `_screens.md`, the requirement-to-screen inventory; Role is a grouping column, not part of the ID (D-50) |
+| Processes | `PRC-<nn>` — zero-padded 2-digit global sequence. Regex: `PRC-\d{2}` | `PRC-03` | Rows of the Session 2 **Process Inventory**, the as-is processes Session 3 transforms |
 | Requirements | `<PREFIX><n>` — PREFIX is a registered domain prefix (uppercase letters/digits ending in `-`, e.g. a stakeholder-domain prefix, `N-` non-functional, `T-` technical); `<n>` is a numeric sequence, zero-padded to 2 digits by convention (`01`..`99`, then `100`). Regex: `[A-Z][A-Z0-9]*-\d+` | `N-01` | Rows of `_requirements.md`; the prefix carries the classification — there is no separate Type column |
 | Input-package accessions | `NN` — zero-padded 2-digit number, assigned in arrival order and never renumbered; a mid-sprint document takes the next number (D-16). Regex: `\d{2}` | `03` | Numbered documents in `.planning/discovery-input/` (including its `confidential/` subdir — one number space spans both locations, D-21). Reading order is a README column, not the number |
 
 ## Reserved Prefixes
 
-Six prefixes are reserved by the ID families above and MUST NOT be registered as
+Seven prefixes are reserved by the ID families above and MUST NOT be registered as
 domain prefixes in the `_requirements.md` Prefix Registry:
 
 | Reserved | Owned by |
@@ -33,6 +34,7 @@ domain prefixes in the `_requirements.md` Prefix Registry:
 | `DG-` | Data-gathering items |
 | `RS-` | Research items |
 | `SCR-` | Screens |
+| `PRC-` | Processes |
 
 Every one of them satisfies the requirement-ID regex `[A-Z][A-Z0-9]*-\d+`, so a
 registry that claims one mints requirement IDs indistinguishable from the family that
@@ -43,7 +45,11 @@ collide, and no reader or parser can tell them apart.
 sequence, so a registry claiming `SCR-` would make `SCR-01` ambiguous between a screen
 and a requirement — the same collision, one artifact further along the traceability ring.
 
-Session 1's kick-off prefix selection (D-09) must refuse all six: pick a different
+`PRC-` followed with issue #12: Session 2 used to number processes `P-<nn>`, which an
+engagement had also registered as a domain prefix, so `P-03` meant two things. Process IDs
+moved to `PRC-` and the prefix is reserved so the clash cannot come back.
+
+Session 1's kick-off prefix selection (D-09) must refuse all seven: pick a different
 domain prefix (any other uppercase letters/digits ending in `-`, e.g. `K-` for *Klant*).
 Non-reserved prefixes are unaffected.
 
@@ -53,6 +59,33 @@ registry, so its requirement rows also report `unknown_prefix`. The check is ret
 — an engagement that registered one of these before the rule existed turns red on
 upgrade. The remedy is the same: choose a different domain prefix.
 
+## Session-Table Row IDs
+
+The Notes Templates number some table rows with their own short prefixes. These IDs are
+local to their table: they are not requirements, never enter `_requirements.md`, and are
+not reserved — but Session 1 should not propose a domain prefix that repeats one, or a
+citation such as `C-01` reads two ways.
+
+| Prefix | Table | Session |
+|--------|-------|---------|
+| `CON-` | Constraints and Risks Register (constraints) | 1 |
+| `R-` | Constraints and Risks Register (risks), continued by the Risk Register | 1, 11 |
+| `PP-` | Pain Points Register | 2 |
+| `MP-` | Main Process Register | 3 |
+| `BO-` | Business Objectives | 3 |
+| `E-` | EPIC Register | 3 |
+| `US-` | User Stories | 3 |
+| `C-` | Component Inventory | 5 |
+| `INT-` | Integration Points Map | 5 |
+| `ADR-` | Architecture Decision Records | 5 |
+| `CR-` | Compliance Requirements Register | 6 |
+| `IF-` | Integration Design Register | 8 |
+| `OI-` | Open Items Register | 13 |
+
+Non-functional requirements are not in this list: they are `N-` rows of
+`_requirements.md`, minted like every other requirement, and Session 3's
+**Non-Functional Requirements** table cites them by that ID.
+
 ## Citation Rules
 
 - Requirement IDs are never renumbered and never reused (REQM-02). A gap in a sequence

package/pp-core/references/execute-mvp-tdd.md

@@ -15,11 +15,11 @@ If any of these is false, the gate is inactive — execution proceeds normally.
 
 For each task gated by MVP+TDD, the executor MUST verify (before running the implementation step):
 
-1. **A failing-test commit exists.** Search git log on the current branch for a commit matching `test({phase}-{plan})` whose subject mentions the same plan as the current task. The commit must touch a test file (`*.test.*`, `*.spec.*`, `tests/**`).
+1. **A failing-test commit exists.** Search git log on the current branch for a commit of type `test` (any scope) that carries the trailer `Phase: {phase}-{plan}` for the same plan as the current task. The commit must touch a test file (`*.test.*`, `*.spec.*`, `tests/**`).
 2. **The test was actually red.** The commit message body or the executor's recent shell history must show the test failed when first run. Acceptable evidence:
    - Commit message contains `RED:` prefix or `(RED)` tag
    - Recent terminal output shows `FAIL` or non-zero exit on the new test before any implementation commit
-3. **No implementation commit yet.** No `feat({phase}-{plan})` commit may exist for the same plan ID before the failing-test commit.
+3. **No implementation commit yet.** No `feat` commit carrying the trailer `Phase: {phase}-{plan}` may exist before the failing-test commit.
 
 If any check fails, the gate trips.
 
@@ -51,7 +51,7 @@ The executor MUST:
 
    Required next step:
    1. Write a failing test for the behavior above.
-   2. Commit it as: test({phase}-{plan}): {short description}
+   2. Commit it as: test({area}): {short description} — with the trailer Phase: {phase}-{plan}
    3. Re-run /pp:execute-phase
    ```