@run402/sdk 4.95.0 → 4.97.0

package/dist/namespaces/{gitvault.js → repos.js}

@@ -1,12 +1,12 @@
 /**
- * `r.gitvault` — the host-blind encrypted Git remote, as the SDK's programmatic
- * API (add-gitvault task 5.10).
+ * `r.repos` — the host-blind encrypted Git remote, as the SDK's programmatic
+ * API (add-vault task 5.10).
  *
  * ARCHITECTURAL LAW (client-surface spec, "All protocol logic lives in the
  * SDK"): every piece of vault protocol behaviour — crypto core, keystore,
  * creation journal, snapshot + capture, publication state machines, ref
  * transactions, verification budget, token exchange, repair — is implemented
- * ONCE here. `run402 gitvault …`, `git-remote-run402`, and the MCP tools are
+ * ONCE here. `run402 repos …`, `git-remote-run402`, and the MCP tools are
  * adapters over this namespace: argument parsing, TTY output, exit codes, and
  * local file I/O only. Anything the CLI can do is reachable programmatically
  * with identical semantics.
@@ -29,9 +29,9 @@
  * never persisted into an agent-surface result store, and never logged.
  */
 import { LocalError, isRun402Error, isNetworkError } from "../errors.js";
-import { GITVAULT_BYO_UNMIRRORED_REMEDY_STATEMENT, GITVAULT_DEGRADED_READ_STATEMENT, GITVAULT_DURABILITY_STATEMENT, GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT, GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT, GITVAULT_UNMIRRORED_FINDING_STATEMENT, bytesToHex, computeKeystorePossessionProof, computeSigningKeyPossessionSignature, ed25519PublicKey, fromBase64url, hexToBytes, jcs, parseGitvaultStrict, randomBytes, sha256Hex, verifyGitvaultObject, toBase64url, } from "./gitvault.crypto.js";
+import { VAULT_BYO_UNMIRRORED_REMEDY_STATEMENT, VAULT_DEGRADED_READ_STATEMENT, VAULT_DURABILITY_STATEMENT, VAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT, VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, VAULT_TERMINAL_LOSS_DOCTOR_TEXT, VAULT_TERMINAL_LOSS_STATEMENT, VAULT_UNMIRRORED_FINDING_STATEMENT, bytesToHex, computeKeystorePossessionProof, computeSigningKeyPossessionSignature, ed25519PublicKey, fromBase64url, hexToBytes, jcs, parseVaultStrict, randomBytes, sha256Hex, verifyVaultObject, toBase64url, } from "./vault.crypto.js";
 /**
- * gitvault-agent-envelopes — per-process memo for the session-start
+ * vault-agent-envelopes — per-process memo for the session-start
  * fulfilment (`<keystore root>|<repo_id>`) and the enroll-if-absent step
  * (`<keystore root>`), so a process that opens the same vault many times
  * (a `git push` runs several verbs) reconciles and enrolls once.
@@ -45,8 +45,8 @@ const SESSION_RECONCILED = new Set();
  * best-effort.
  */
 const RECONCILE_FATAL_CODES = new Set([
-    "GITVAULT_ENVELOPE_ALTERED",
-    "GITVAULT_SIGNATURE_INVALID",
+    "VAULT_ENVELOPE_ALTERED",
+    "VAULT_SIGNATURE_INVALID",
     "VAULT_CREATION_CONFLICT",
 ]);
 function rethrowFatalReconcile(e) {
@@ -70,7 +70,7 @@ async function nodeOnly(load, verb) {
         return await load();
     }
     catch (e) {
-        throw new LocalError(`\`r.gitvault.${verb}\` needs the Node runtime (keystore + git); import it from a Node process, or use the read-only vault methods in a browser.`, `running gitvault ${verb}`, { code: "GITVAULT_NODE_ONLY", details: { cause: e instanceof Error ? e.message : String(e) } });
+        throw new LocalError(`\`r.repos.${verb}\` needs the Node runtime (keystore + git); import it from a Node process, or use the read-only vault methods in a browser.`, `running vault ${verb}`, { code: "VAULT_NODE_ONLY", details: { cause: e instanceof Error ? e.message : String(e) } });
     }
 }
 /** Byte counts in the refusal text read as MiB — the unit an operator's tier is quoted in. */
@@ -80,7 +80,7 @@ function mib(bytes) {
 /**
  * A client-generated handoff id (RFC 4122 v4), minted BEFORE the mint call
  * (kygit-handoff design D3): `auth_secret`/`wrap_key` derive off it, so it
- * cannot be gateway-assigned the way `internal.gitvault_claims.id` alone
+ * cannot be gateway-assigned the way `internal.vault_claims.id` alone
  * would suggest — this SDK supplies it, mirroring the SAME
  * client_creation_id/client_open_id convention this protocol family
  * already uses elsewhere for idempotent creation. `handoff()` refuses if
@@ -96,8 +96,8 @@ function randomHandoffUuid() {
 /**
  * The gateway names the vault by its three ids on the wire — `repo_id`,
  * `org_id`, `project_id` (docs/style.md's API-boundary vocabulary) — on
- * BOTH the handoff mint (`POST /gitvault/v1/vaults/:vault_id/handoffs`) and
- * claim (`POST /gitvault/v1/handoffs/:handoff_id/redeem`) responses. The SDK
+ * BOTH the handoff mint (`POST /vaults/v1/:vault_id/handoffs`) and
+ * claim (`POST /vaults/v1/handoffs/:handoff_id/redeem`) responses. The SDK
  * groups them under `vault` with the `organization_id` spelling every other
  * SDK result uses. Neither response carries a slug-form address, so
  * `address` is `null` unless the caller already knows one (a slug-form
@@ -122,8 +122,8 @@ export function handoffMembershipFromWire(wire) {
  */
 export const INVITE_DEFAULT_ROLE = "developer";
 /**
- * gitvault-byo-primary-bucket task 3.3 — the number of `{key, object_kind}`
- * entries `GITVAULT_BYO_OBJECT_MISSING`'s `details.missing` lists before
+ * vault-byo-primary-bucket task 3.3 — the number of `{key, object_kind}`
+ * entries `VAULT_BYO_OBJECT_MISSING`'s `details.missing` lists before
  * truncating (`details.missing_count` always carries the true total, and
  * `details.missing_truncated` says whether the list above was cut). A
  * chain-referenced object list can be arbitrarily large; an error envelope
@@ -131,14 +131,14 @@ export const INVITE_DEFAULT_ROLE = "developer";
  * `sample_keys`-class cap (asset-sync's plan response, `PLATFORM_INCIDENT_
  * FANOUT_CAP`) rather than inventing a new number.
  */
-export const GITVAULT_BYO_OBJECT_MISSING_LIST_CAP = 50;
+export const VAULT_BYO_OBJECT_MISSING_LIST_CAP = 50;
 /**
  * D210 (rev 44) — the decision function behind `fsck`'s best-effort
- * proof-of-open submission, factored out of {@link Gitvault}'s private
+ * proof-of-open submission, factored out of {@link Repos}'s private
  * `#submitFsckOpenProof` so it is directly unit-testable with injected
  * (fake) `resolvePrincipalId`/`submit` dependencies, independent of a real
  * HTTP-backed vault. `fsck()` itself supplies the REAL dependencies (`GET
- * /agent/v1/whoami`, {@link Gitvault.submitProofOfOpen}) — this function
+ * /agent/v1/whoami`, {@link Repos.submitProofOfOpen}) — this function
  * contains no HTTP/transport code of its own.
  *
  * Gating (all LOCAL, no network call made when either holds):
@@ -173,8 +173,8 @@ export async function computeOpenProofOutcome(input) {
                 deduplicated: null,
                 receipt: null,
                 error: {
-                    code: "GITVAULT_PROOF_OF_OPEN_PRINCIPAL_UNRESOLVED",
-                    message: "GET /agent/v1/whoami returned no resolvable principal for this credential (delegate bearers are not accepted by whoami) — submit via r.gitvault.submitProofOfOpen(repoId, principalId, evidence) directly instead",
+                    code: "VAULT_PROOF_OF_OPEN_PRINCIPAL_UNRESOLVED",
+                    message: "GET /agent/v1/whoami returned no resolvable principal for this credential (grant-key bearers are not accepted by whoami) — submit via r.repos.submitProofOfOpen(repoId, principalId, evidence) directly instead",
                 },
             };
         }
@@ -197,8 +197,8 @@ export async function computeOpenProofOutcome(input) {
     }
 }
 /**
- * gitvault-byo-primary-bucket task 3.3 (design D6) — the decision function
- * behind `fsck`'s BYO presence check, factored out of {@link Gitvault}'s
+ * vault-byo-primary-bucket task 3.3 (design D6) — the decision function
+ * behind `fsck`'s BYO presence check, factored out of {@link Repos}'s
  * private `#checkByoPresence` the same way {@link computeOpenProofOutcome}
  * is factored out of `#submitFsckOpenProof`, so it is directly unit-testable
  * with an injected (fake) `hasLocalConfig`/`verifyPresence`, independent of
@@ -218,15 +218,15 @@ export async function computeOpenProofOutcome(input) {
  * NO local credentials configured (`hasLocalConfig()` returns `false`) is
  * reported, never thrown — a BYO vault this machine cannot reach is an
  * honest "not checked", not a failure that should break `fsck` for a
- * credential-less returning agent (see {@link GitvaultFsckByoPresence}'s
+ * credential-less returning agent (see {@link VaultFsckByoPresence}'s
  * own doc comment). A confirmed absence is the opposite: it THROWS
- * `GITVAULT_BYO_OBJECT_MISSING` — the same severity class as {@link
- * Gitvault.mirrorVerify}'s own `GITVAULT_MIRROR_NOT_CONFIGURED` throw when
+ * `VAULT_BYO_OBJECT_MISSING` — the same severity class as {@link
+ * Repos.mirrorVerify}'s own `VAULT_MIRROR_NOT_CONFIGURED` throw when
  * `--mirror` is requested against an unconfigured vault — this is exactly
  * the honesty D6 names: "we can tell the customer what SHOULD exist and
  * does not", stated as a real refusal rather than a silently-embedded
  * finding. The listed entries are capped at
- * {@link GITVAULT_BYO_OBJECT_MISSING_LIST_CAP} (a chain-referenced object
+ * {@link VAULT_BYO_OBJECT_MISSING_LIST_CAP} (a chain-referenced object
  * list can be arbitrarily large and this is an error envelope, not a
  * report); `missing_count` always carries the true total regardless of how
  * many are listed.
@@ -250,9 +250,9 @@ export async function computeByoPresenceOutcome(input) {
     }
     const report = await input.verifyPresence();
     if (report.missing.length > 0) {
-        const missing = report.missing.slice(0, GITVAULT_BYO_OBJECT_MISSING_LIST_CAP);
-        throw new LocalError(`the BYO destination for ${input.repoId} (${report.destination}) is missing ${report.missing.length} object(s) run402's own signed chain says should exist`, "running gitvault fsck", {
-            code: "GITVAULT_BYO_OBJECT_MISSING",
+        const missing = report.missing.slice(0, VAULT_BYO_OBJECT_MISSING_LIST_CAP);
+        throw new LocalError(`the BYO destination for ${input.repoId} (${report.destination}) is missing ${report.missing.length} object(s) run402's own signed chain says should exist`, "running vault fsck", {
+            code: "VAULT_BYO_OBJECT_MISSING",
             details: {
                 repo_id: input.repoId,
                 destination: report.destination,
@@ -272,7 +272,7 @@ export async function computeByoPresenceOutcome(input) {
     return { verified: true, destination: report.destination, checked_count: report.checked, not_checked_reason: null };
 }
 /**
- * {@link Gitvault.deploy}'s post-push glue: attach the best-effort
+ * {@link Repos.deploy}'s post-push glue: attach the best-effort
  * mirror/reconcile hooks to a deploy result, gated on whether this deploy
  * actually landed a new generation in the vault. Extracted as a standalone
  * function (rather than inlined in `deploy()`) purely so the gating can be
@@ -289,10 +289,10 @@ export async function computeByoPresenceOutcome(input) {
  * `reconcile_recipients` are OMITTED rather than a faked `skipped_*` value —
  * there is nothing this deploy did that either hook could report on.
  */
-export async function attachGitvaultDeployHooks(result, mirror, reconcile) {
+export async function attachVaultDeployHooks(result, mirror, reconcile) {
     if (result.outcome !== "DEPLOYED_AND_VAULTED" && result.outcome !== "DEPLOY_FAILED_VAULTED")
         return result;
-    // Sequential, not Promise.all — same ordering push() uses, so a reconcile
+    // Sequential, not Promise.all — same ordering capture() uses, so a reconcile
     // failure can never be misread as a mirror failure in a log line that
     // assumed ordering.
     const mirrorPush = await mirror();
@@ -300,7 +300,7 @@ export async function attachGitvaultDeployHooks(result, mirror, reconcile) {
     return { ...result, mirror_push: mirrorPush, reconcile_recipients: reconcileRecipients };
 }
 // ─── The namespace ───────────────────────────────────────────────────────────
-export class Gitvault {
+export class Repos {
     #client;
     constructor(client) {
         this.#client = client;
@@ -308,7 +308,7 @@ export class Gitvault {
     // ── Control-plane reads (isomorphic) ──────────────────────────────────────
     /** The vault record — policy, allocation generation, storage + maintenance state. */
     async get(repoId) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}`, { context: "reading the gitvault record" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}`, { context: "reading the vault record" });
     }
     /**
      * Resolve a project's vault with no local state. This is the cold-restart
@@ -316,12 +316,12 @@ export class Gitvault {
      * the project learns its `repo_id` here.
      */
     async forProject(projectId) {
-        return this.#client.request(`/gitvault/v1/vaults?project_id=${encodeURIComponent(projectId)}`, { context: "resolving the project's gitvault" });
+        return this.#client.request(`/vaults/v1?project_id=${encodeURIComponent(projectId)}`, { context: "resolving the project's vault" });
     }
     /**
      * Every vault the organization owns, one round trip — `repos list`'s bulk
      * read. See {@link
-     * GitvaultOrgVaultsListing}'s doc comment for the FROZEN response shape and
+     * VaultOrgVaultsListing}'s doc comment for the FROZEN response shape and
      * the 404-until-shipped fallback contract.
      */
     async listByOrg(orgId) {
@@ -334,7 +334,7 @@ export class Gitvault {
         const all = [];
         let cursor;
         for (let page = 0; page < 100; page++) {
-            const url = `/gitvault/v1/vaults?org_id=${encodeURIComponent(orgId)}` + (cursor ? `&cursor=${encodeURIComponent(cursor)}` : "");
+            const url = `/vaults/v1?org_id=${encodeURIComponent(orgId)}` + (cursor ? `&cursor=${encodeURIComponent(cursor)}` : "");
             const res = await this.#client.request(url, { context: "listing the organization's vaults" });
             all.push(...res.vaults);
             if (!res.has_more || !res.next_cursor)
@@ -345,18 +345,18 @@ export class Gitvault {
     }
     /**
      * Resolve a vault by its address-form `org-slug/name` —
-     * `GET /gitvault/v1/vaults?repo=<org-slug>/<name>`.
+     * `GET /vaults/v1?repo=<org-slug>/<name>`.
      * `RESOURCE_NOT_FOUND` for no such org OR no such name (deliberately
      * collapsed — see the design's slug-namespace-probing note);
-     * `SLUG_RELEASED` (read it with {@link gitvaultSlugReleasedInfo}) while the
+     * `SLUG_RELEASED` (read it with {@link vaultSlugReleasedInfo}) while the
      * slug is in its post-rename cooldown — never auto-followed.
      */
     async forRepo(address) {
         const repo = `${address.org_slug}/${address.repo_name}`;
-        return this.#client.request(`/gitvault/v1/vaults?repo=${encodeURIComponent(repo)}`, { context: "resolving the gitvault by repo address" });
+        return this.#client.request(`/vaults/v1?repo=${encodeURIComponent(repo)}`, { context: "resolving the vault by repo address" });
     }
     /**
-     * Resolve a parsed remote address (`parseGitvaultRemoteUrl`'s output),
+     * Resolve a parsed remote address (`parseVaultRemoteUrl`'s output),
      * dispatching on its form: id-form resolves exactly like
      * {@link forProject}; slug-form resolves via {@link forRepo}. A pure read —
      * no pinning, no creation. Node-only callers wanting BOTH should use
@@ -364,7 +364,7 @@ export class Gitvault {
      * and (opt-in) push-to-create.
      */
     async resolveAddress(address) {
-        return gitvaultRemoteAddressForm(address) === "id"
+        return vaultRemoteAddressForm(address) === "id"
             ? this.forProject(address.project_id)
             : this.forRepo({ org_slug: address.org_id, repo_name: address.project_id });
     }
@@ -384,7 +384,7 @@ export class Gitvault {
         const qs = new URLSearchParams({ after_generation: request.after_generation, limit: request.limit });
         if (request.cursor !== undefined)
             qs.set("cursor", request.cursor);
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/heads?${qs.toString()}`, { context: "listing gitvault heads" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/heads?${qs.toString()}`, { context: "listing vault heads" });
     }
     /**
      * Walk the whole listing above the anchor, verifying page coupling, ordering,
@@ -413,10 +413,10 @@ export class Gitvault {
      * `required`.
      */
     async setPolicy(repoId, input) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/policy`, {
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/policy`, {
             method: "PATCH",
-            body: { gitvault_policy: input.gitvault_policy, ...(input.reason !== undefined ? { reason: input.reason } : {}) },
-            context: "setting the gitvault activation policy",
+            body: { vault_policy: input.vault_policy, ...(input.reason !== undefined ? { reason: input.reason } : {}) },
+            context: "setting the vault activation policy",
         });
     }
     /**
@@ -425,7 +425,7 @@ export class Gitvault {
      * clears it.
      */
     async completeOverride(repoId, input) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/override-completions`, { method: "POST", body: input, context: "submitting the gitvault override completion" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/override-completions`, { method: "POST", body: input, context: "submitting the vault override completion" });
     }
     /**
      * Take the owner's maintenance reservation for a compact/prune cycle.
@@ -440,22 +440,22 @@ export class Gitvault {
     // `gitvault.rotate`) — same "direct #client.request" shape as `setPolicy`/
     // `completeOverride` above. The actual ROTATION (sampling K_e, sealing
     // envelopes, submitting the head) needs the Node-only keystore + crypto
-    // core and lives on `GitvaultVault` (`sdk/src/node/gitvault-publication.ts`);
+    // core and lives on `Vault` (`sdk/src/node/vault-publication.ts`);
     // see {@link rotateEpoch} / {@link rotateEpochForKeyRevocation} below.
     /** `POST …/recipients/:principal_id/confirm` (D197) — first-seen pin confirmation. */
     async confirmRecipient(repoId, principalId, newFingerprint) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/confirm`, {
-            method: "POST", body: { new_fingerprint: newFingerprint }, context: "confirming a gitvault recipient's first pin",
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/confirm`, {
+            method: "POST", body: { new_fingerprint: newFingerprint }, context: "confirming a vault recipient's first pin",
         });
     }
     /** `POST …/recipients/:principal_id/repin` (D197) — re-pin ceremony. */
     async repinRecipient(repoId, principalId, input) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/repin`, {
-            method: "POST", body: input, context: "re-pinning a gitvault recipient",
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/repin`, {
+            method: "POST", body: input, context: "re-pinning a vault recipient",
         });
     }
     /**
-     * gitvault-agent-envelopes D3 — a KEY-HOLDER explicitly accepts a recipient's
+     * vault-agent-envelopes D3 — a KEY-HOLDER explicitly accepts a recipient's
      * CHANGED key. The session-start reconcile refuses to wrap under a
      * fingerprint that differs from this keystore's TOFU pin
      * (`pinned_key_mismatch`) — that refusal is the substitution defence and
@@ -471,11 +471,11 @@ export class Gitvault {
      */
     async acceptRecipientKeyChange(options) {
         const repoId = await this.#resolveRepoId(options);
-        const { GitvaultKeystore } = await this.#keystore();
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const { VaultKeystore } = await this.#keystore();
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const repo = keystore.readRepo(repoId);
         if (!repo)
-            throw new LocalError("this keystore holds no repo state for the vault — only a key-holder can accept a recipient's key change", "accepting a recipient key change", { code: "GITVAULT_REPO_STATE_MISSING", details: { repo_id: repoId } });
+            throw new LocalError("this keystore holds no repo state for the vault — only a key-holder can accept a recipient's key change", "accepting a recipient key change", { code: "VAULT_REPO_STATE_MISSING", details: { repo_id: repoId } });
         const record = await this.get(repoId);
         const directory = await this.#client.request(`/orgs/v1/${encodeURIComponent(record.org_id)}/encryption-keys`, { context: "reading the org encryption-key directory" });
         const served = directory.keys.find((k) => k.principal_id === options.principal_id)?.ek_fingerprint ?? null;
@@ -504,8 +504,8 @@ export class Gitvault {
      * fully self-contained entry point.
      */
     async declareRecipientKeyRevoked(repoId, principalId) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/key-revocation`, {
-            method: "POST", body: {}, context: "declaring a gitvault recipient key revoked",
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/key-revocation`, {
+            method: "POST", body: {}, context: "declaring a vault recipient key revoked",
         });
     }
     /**
@@ -519,11 +519,11 @@ export class Gitvault {
      * comment on the confirmed gap in what the gateway exposes today).
      */
     async declareEpochSecretExposed(repoId) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/epoch-secret-exposure`, { method: "POST", body: {}, context: "declaring a gitvault epoch secret exposed" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/epoch-secret-exposure`, { method: "POST", body: {}, context: "declaring a vault epoch secret exposed" });
     }
     /** `POST …/writer-authority/declare-unavailable` (D202) — an explicit, audited fact that the writer signing key is gone. */
     async declareWriterAuthorityUnavailable(repoId) {
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/writer-authority/declare-unavailable`, { method: "POST", body: {}, context: "declaring gitvault writer authority unavailable" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/writer-authority/declare-unavailable`, { method: "POST", body: {}, context: "declaring vault writer authority unavailable" });
     }
     /**
      * `POST …/recipients/:principal_id/proof-of-open` (D210, rev 44) — submit
@@ -538,18 +538,18 @@ export class Gitvault {
      *
      * Self-match only: the gateway requires `principalId` to equal the
      * AUTHENTICATED caller, never overridable by any credential class — a
-     * mismatch is the ordinary 403 `GITVAULT_ACCESS_DENIED`. Idempotent on
+     * mismatch is the ordinary 403 `VAULT_ACCESS_DENIED`. Idempotent on
      * `(repo_id, principal_id, ek_fingerprint, decryptable_to_generation)` —
      * `deduplicated: true` means the gateway returned the tuple's EXISTING
      * receipt (HTTP 200) rather than minting a fresh one (HTTP 201).
      */
     async submitProofOfOpen(repoId, principalId, evidence) {
-        const res = await this.#client.requestWithResponse(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/proof-of-open`, { method: "POST", body: evidence, context: "submitting a gitvault proof-of-open receipt" });
+        const res = await this.#client.requestWithResponse(`/vaults/v1/${encodeURIComponent(repoId)}/recipients/${encodeURIComponent(principalId)}/proof-of-open`, { method: "POST", body: evidence, context: "submitting a vault proof-of-open receipt" });
         return { receipt: res.body, deduplicated: res.status === 200 };
     }
     async acquireMaintenanceLease(request) {
         const { repo_id, ...body } = request;
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repo_id)}/maintenance-leases`, {
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repo_id)}/maintenance-leases`, {
             method: "POST",
             body: {
                 base_head_sha256: body.base_head_sha256,
@@ -559,7 +559,7 @@ export class Gitvault {
                 p_before_c1_size_bytes: body.p_before_c1_size_bytes ?? "0",
                 p_before_c2_size_bytes: body.p_before_c2_size_bytes ?? "0",
             },
-            context: "acquiring the gitvault maintenance lease",
+            context: "acquiring the vault maintenance lease",
         });
     }
     // ── Node-only verbs ───────────────────────────────────────────────────────
@@ -569,23 +569,23 @@ export class Gitvault {
      * surface (ref transactions, repair, checkpoint building).
      */
     async open(options = {}) {
-        const [{ GitvaultVault, createGitvaultHttpTransport }, { GitvaultKeystore }] = await Promise.all([this.#publication(), this.#keystore()]);
+        const [{ Vault, createVaultHttpTransport }, { VaultKeystore }] = await Promise.all([this.#publication(), this.#keystore()]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
-        // gitvault-object-host-predial (design D1, task 1.2): this is the ONE
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        // vault-object-host-predial (design D1, task 1.2): this is the ONE
         // transport whose object reads back the returned handle's vault, so
         // wiring the origin-observation hook here (and nowhere else `open()`
         // is reached from — `openOrCreate`'s own allocation-only transport
         // never serves object reads) covers every read path.
-        const transport = createGitvaultHttpTransport(this.#client, {
+        const transport = createVaultHttpTransport(this.#client, {
             onObjectStoreOriginObserved: (rid, origins) => keystore.recordObjectStoreOrigins(rid, origins),
             byoBackend: await this.#byoBackendResolver(keystore),
         });
-        // gitvault-agent-envelopes D3: enroll the keystore's key if this principal
+        // vault-agent-envelopes D3: enroll the keystore's key if this principal
         // has none (publish + possession proof, one round trip each); a differing
         // current key REFUSES here — rotation is never automatic.
         const enrollment = await this.#ensureEnrolled(keystore);
-        const vault = new GitvaultVault({
+        const vault = new Vault({
             keystore,
             transport,
             repo_id: repoId,
@@ -594,13 +594,13 @@ export class Gitvault {
             ...(options.service_public_key !== undefined ? { service_public_key: options.service_public_key } : {}),
         });
         // D4: a cold keystore restores from its own envelope (or fails
-        // GITVAULT_ENVELOPE_PENDING with the exact next actions). The lazy
+        // VAULT_ENVELOPE_PENDING with the exact next actions). The lazy
         // fallback is an ALLOWLIST of typed transport/absence states, not a
         // denylist of known verdicts (consult round 2 §5): a network fault, an
         // older gateway missing the route (404/501), or a vault with no admitted
         // genesis yet (CHAIN_BROKEN — not born, nothing to restore or disclose)
         // leave the handle lazy so the verb fails exactly where it always did
-        // (`GITVAULT_REPO_STATE_MISSING` at first use). EVERYTHING else —
+        // (`VAULT_REPO_STATE_MISSING` at first use). EVERYTHING else —
         // integrity failures, parse failures, programming errors — propagates.
         // A keystore with NO identity has nothing to restore and nothing that
         // could be disclosed — stay lazy and let the verb hit the ordinary
@@ -674,7 +674,7 @@ export class Gitvault {
                 }
             }
         }
-        // gitvault-multi-writer (task 5.7) — the SAME "session-start"/"read"
+        // vault-multi-writer (task 5.7) — the SAME "session-start"/"read"
         // wiring point as the envelope reconcile above, but a genuinely simpler
         // policy: no disclosure risk, so only `forbidden` is honored — no
         // custody gate, no `deferred`/memoization branch.
@@ -682,7 +682,7 @@ export class Gitvault {
         return { repo_id: repoId, keystore, transport, vault, restored, reconcile_recipients: reconcileRecipients, writer_reconcile: writerReconcile, enrollment };
     }
     /**
-     * gitvault-agent-envelopes D3 — enroll-if-absent, checked FRESH on every
+     * vault-agent-envelopes D3 — enroll-if-absent, checked FRESH on every
      * open (consult round 2 §4: memoizing this decision let a long-lived
      * process keep trusting a key an owner had since revoked). Reads
      * `GET /agent/v1/whoami` (the gateway folds the principal's current key
@@ -693,7 +693,7 @@ export class Gitvault {
      *   - current key = this keystore's key, still `pending` → finish the
      *     activation (a crashed earlier enrollment);
      *   - current key = this keystore's key, `active` → no-op;
-     *   - current key ≠ this keystore's key → `GITVAULT_KEY_ROTATION_REQUIRED`.
+     *   - current key ≠ this keystore's key → `VAULT_KEY_ROTATION_REQUIRED`.
      *     Never published as a rotation: a stolen wallet key must not silently
      *     replace a member's decryption identity. The remedies are the
      *     gateway's — restore the keystore backup; an org owner revokes the
@@ -710,7 +710,7 @@ export class Gitvault {
         catch (e) {
             // An older gateway, a credential whoami refuses, or a transport fault:
             // enrollment is best-effort on the way IN — the verb itself still runs
-            // (and a cold open will say `GITVAULT_ENVELOPE_PENDING` honestly if it
+            // (and a cold open will say `VAULT_ENVELOPE_PENDING` honestly if it
             // needed an envelope this principal never enrolled for). A keystore
             // with no identity reaches the ordinary KEYSTORE_MISSING wall unchanged.
             return { outcome: identity ? "skipped_error" : "skipped_no_identity", ek_fingerprint: identity?.encryption_fingerprint ?? null, signing_fingerprint: identity?.signing_fingerprint ?? null, error: e instanceof Error ? e.message : String(e) };
@@ -725,7 +725,7 @@ export class Gitvault {
             return { outcome: "skipped_not_enrollable", ek_fingerprint: identity?.encryption_fingerprint ?? null, signing_fingerprint: identity?.signing_fingerprint ?? null };
         }
         if (identity?.enrolled_principal_id && identity.enrolled_principal_id !== whoami.principal.id) {
-            throw new LocalError(`this keystore identity enrolled as principal ${identity.enrolled_principal_id}, but the active credential resolves to ${whoami.principal.id} — refusing cross-profile reuse of a custody identity`, "enrolling the keystore encryption key", { code: "GITVAULT_IDENTITY_PROFILE_MISMATCH", details: { enrolled_principal_id: identity.enrolled_principal_id, principal_id: whoami.principal.id, keystore_root: keystore.rootDir } });
+            throw new LocalError(`this keystore identity enrolled as principal ${identity.enrolled_principal_id}, but the active credential resolves to ${whoami.principal.id} — refusing cross-profile reuse of a custody identity`, "enrolling the keystore encryption key", { code: "VAULT_IDENTITY_PROFILE_MISMATCH", details: { enrolled_principal_id: identity.enrolled_principal_id, principal_id: whoami.principal.id, keystore_root: keystore.rootDir } });
         }
         const current = whoami.encryption_key ?? null;
         // A member joining from a FRESH machine has no keystore identity yet.
@@ -739,27 +739,27 @@ export class Gitvault {
             identity = keystore.ensureIdentity();
         if (!identity) {
             throw new LocalError(`this principal has a published encryption key (${current.ek_fingerprint}) but this keystore holds no identity — the keystore that enrolled it is not this one; rotation is never automatic`, "enrolling the keystore encryption key", {
-                code: "GITVAULT_KEY_ROTATION_REQUIRED",
+                code: "VAULT_KEY_ROTATION_REQUIRED",
                 details: { current_ek_fingerprint: current.ek_fingerprint, current_state: current.state, local_ek_fingerprint: null, keystore_root: keystore.rootDir },
                 next_actions: [
-                    { type: "edit_request", why: "restore the keystore backup that holds the current key (~/.config/run402/gitvault or the wallet profile's gitvault dir)" },
-                    { type: "edit_request", why: "have an org owner revoke the stale key: DELETE /orgs/v1/:org_id/members/:principal_id/encryption-key (owner + step-up); your next gitvault operation then enrolls a fresh key" },
+                    { type: "edit_request", why: "restore the keystore backup that holds the current key (~/.config/run402/vault or the wallet profile's vault dir)" },
+                    { type: "edit_request", why: "have an org owner revoke the stale key: DELETE /orgs/v1/:org_id/members/:principal_id/encryption-key (owner + step-up); your next vault operation then enrolls a fresh key" },
                     { type: "edit_request", why: "if this principal is the sole custody-eligible member of every org it belongs to: POST /agent/v1/whoami/encryption-key with replace_current: true" },
                 ],
             });
         }
         if (current && current.ek_fingerprint !== identity.encryption_fingerprint) {
             throw new LocalError(`this principal's published encryption key (${current.ek_fingerprint}) is not this keystore's key (${identity.encryption_fingerprint}); rotation is never automatic`, "enrolling the keystore encryption key", {
-                code: "GITVAULT_KEY_ROTATION_REQUIRED",
+                code: "VAULT_KEY_ROTATION_REQUIRED",
                 details: { current_ek_fingerprint: current.ek_fingerprint, current_state: current.state, local_ek_fingerprint: identity.encryption_fingerprint, keystore_root: keystore.rootDir },
                 next_actions: [
-                    { type: "edit_request", why: "restore the keystore backup that holds the current key (~/.config/run402/gitvault or the wallet profile's gitvault dir)" },
-                    { type: "edit_request", why: "have an org owner revoke the stale key: DELETE /orgs/v1/:org_id/members/:principal_id/encryption-key (owner + step-up); your next gitvault operation then enrolls this key" },
+                    { type: "edit_request", why: "restore the keystore backup that holds the current key (~/.config/run402/vault or the wallet profile's vault dir)" },
+                    { type: "edit_request", why: "have an org owner revoke the stale key: DELETE /orgs/v1/:org_id/members/:principal_id/encryption-key (owner + step-up); your next vault operation then enrolls this key" },
                     { type: "edit_request", why: "if this principal is the sole custody-eligible member of every org it belongs to: POST /agent/v1/whoami/encryption-key with replace_current: true" },
                 ],
             });
         }
-        // gitvault-multi-writer rev 47 (task 5.3, design D9) — the signing half's
+        // vault-multi-writer rev 47 (task 5.3, design D9) — the signing half's
         // OWN continuity check, parallel to the encryption half's: does the
         // directory's currently-published signing_fingerprint already equal
         // this keystore's? UNLIKE the encryption half this is never a rotation
@@ -773,7 +773,7 @@ export class Gitvault {
         }
         const keypair = keystore.encryptionKeypair(identity);
         if (!keypair) {
-            throw new LocalError("the keystore identity has no X25519 private key — it cannot enroll or open envelopes", "enrolling the keystore encryption key", { code: "VAULT_UNRECOVERABLE", details: { statement: GITVAULT_TERMINAL_LOSS_STATEMENT } });
+            throw new LocalError("the keystore identity has no X25519 private key — it cannot enroll or open envelopes", "enrolling the keystore encryption key", { code: "VAULT_UNRECOVERABLE", details: { statement: VAULT_TERMINAL_LOSS_STATEMENT } });
         }
         // The signing half rides the SAME publish call as the encryption half
         // (task 4.1's gateway contract: one round trip, both halves, all-or-
@@ -838,7 +838,7 @@ export class Gitvault {
      * allocation on first push).
      *
      * This is the ONE primitive the remote helper and the capture lane
-     * (`run402 gitvault push`/`snapshot`) drive so that a push against an
+     * (`run402 repos capture`/`snapshot`) drive so that a push against an
      * unallocated project runs the six-stage creation journal inline instead of
      * refusing: it resolves `repo_id` from `project_id` exactly like
      * {@link open}, and when that resolution fails, tries to create the vault —
@@ -858,19 +858,19 @@ export class Gitvault {
      */
     async openOrCreate(options) {
         if (!options.repo_id && !options.project_id) {
-            throw new LocalError("pass repo_id, or project_id to resolve it from the control plane", "opening the gitvault", { code: "GITVAULT_VAULT_UNRESOLVED" });
+            throw new LocalError("pass repo_id, or project_id to resolve it from the control plane", "opening the vault", { code: "VAULT_UNRESOLVED" });
         }
         // An explicit repo_id addresses the vault directly — there is nothing to
         // resolve or lazily create from an id alone, so this degrades to a plain
         // open (matches `open()`'s own precedence: repo_id always wins).
         if (options.repo_id) {
             const handle = await this.open(options);
-            return { handle, found: true, created: null, terminal_loss_statement: GITVAULT_TERMINAL_LOSS_STATEMENT };
+            return { handle, found: true, created: null, terminal_loss_statement: VAULT_TERMINAL_LOSS_STATEMENT };
         }
-        const [{ createGitvaultHttpTransport }, { GitvaultKeystore }, { openOrCreateGitvault }] = await Promise.all([this.#publication(), this.#keystore(), this.#openOrCreate()]);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
-        const transport = createGitvaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
-        const result = await openOrCreateGitvault({
+        const [{ createVaultHttpTransport }, { VaultKeystore }, { openOrCreateVault }] = await Promise.all([this.#publication(), this.#keystore(), this.#openOrCreate()]);
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const transport = createVaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
+        const result = await openOrCreateVault({
             keystore,
             transport,
             project_id: options.project_id,
@@ -880,29 +880,29 @@ export class Gitvault {
         });
         const handle = await this.open({ ...options, repo_id: result.repo_id });
         return result.found
-            ? { handle, found: true, created: null, terminal_loss_statement: GITVAULT_TERMINAL_LOSS_STATEMENT }
-            : { handle, found: false, created: result.created, terminal_loss_statement: GITVAULT_TERMINAL_LOSS_STATEMENT };
+            ? { handle, found: true, created: null, terminal_loss_statement: VAULT_TERMINAL_LOSS_STATEMENT }
+            : { handle, found: false, created: result.created, terminal_loss_statement: VAULT_TERMINAL_LOSS_STATEMENT };
     }
     /**
      * Resolve a parsed remote address to an OPEN handle, pinning `repo_id` in
      * local git state on the first successful resolution of EITHER form
-     * (gitvault-client-round-trips design D4 widens the original slug-form-only
+     * (vault-client-round-trips design D4 widens the original slug-form-only
      * pin to id-form too — an id-form address needs no pin to survive a
      * rename, but the resolution round trip it skips is the same either way),
      * and — when `allow_create` is set and resolution misses — push-to-create
-     * it. This is what the remote helper and `gitvault snapshot` drive for a
+     * it. This is what the remote helper and `vault snapshot` drive for a
      * `run402::<org>/<name>` remote, whichever form it names, so a caller need
      * not branch on the address's form itself. A pinned id/address that no
      * longer resolves (404) clears the pin and re-resolves once.
      *
      * `SLUG_RELEASED` is NEVER auto-followed — it rethrows unchanged; read it
-     * with {@link gitvaultSlugReleasedInfo} for the successor slug and cooldown.
+     * with {@link vaultSlugReleasedInfo} for the successor slug and cooldown.
      */
     async resolveOrCreateAddress(options) {
-        const [{ createGitvaultHttpTransport }, { GitvaultKeystore }, { resolveGitvaultAddress }] = await Promise.all([this.#publication(), this.#keystore(), this.#address()]);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
-        const transport = createGitvaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
-        const resolution = await resolveGitvaultAddress({
+        const [{ createVaultHttpTransport }, { VaultKeystore }, { resolveVaultAddress }] = await Promise.all([this.#publication(), this.#keystore(), this.#address()]);
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const transport = createVaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
+        const resolution = await resolveVaultAddress({
             keystore,
             transport,
             address: options.address,
@@ -917,13 +917,13 @@ export class Gitvault {
             handle,
             found: resolution.via !== "created",
             created: resolution.created,
-            terminal_loss_statement: GITVAULT_TERMINAL_LOSS_STATEMENT,
+            terminal_loss_statement: VAULT_TERMINAL_LOSS_STATEMENT,
             resolution,
         };
     }
     /**
      * Stale-pin recovery for OFFLINE address resolutions
-     * (gitvault-force-spelling-and-pin-fold): an id-carrying pin resolves with
+     * (vault-force-spelling-and-pin-fold): an id-carrying pin resolves with
      * zero network reads, so a pin gone stale (its vault deleted and the
      * project re-allocated a new one) surfaces as the VERB's first repo-scoped
      * read failing rather than as a resolution failure. Call this with that
@@ -935,10 +935,10 @@ export class Gitvault {
      * an unauthorized caller learns).
      */
     async recoverStalePin(options) {
-        const [{ createGitvaultHttpTransport }, { GitvaultKeystore }, { recoverStaleGitvaultPin }] = await Promise.all([this.#publication(), this.#keystore(), this.#address()]);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
-        const transport = createGitvaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
-        const fresh = await recoverStaleGitvaultPin({
+        const [{ createVaultHttpTransport }, { VaultKeystore }, { recoverStaleVaultPin }] = await Promise.all([this.#publication(), this.#keystore(), this.#address()]);
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const transport = createVaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
+        const fresh = await recoverStaleVaultPin({
             keystore,
             transport,
             address: options.address,
@@ -953,7 +953,7 @@ export class Gitvault {
             handle,
             found: true,
             created: null,
-            terminal_loss_statement: GITVAULT_TERMINAL_LOSS_STATEMENT,
+            terminal_loss_statement: VAULT_TERMINAL_LOSS_STATEMENT,
             resolution: fresh,
         };
     }
@@ -970,22 +970,22 @@ export class Gitvault {
      * named `run402` is added.
      */
     async init(options) {
-        const [{ createGitvaultHttpTransport }, { GitvaultKeystore }, { createGitvault }] = await Promise.all([this.#publication(), this.#keystore(), this.#creation()]);
+        const [{ createVaultHttpTransport }, { VaultKeystore }, { createVault }] = await Promise.all([this.#publication(), this.#keystore(), this.#creation()]);
         const { parseMirrorDestinationUrl, formatMirrorDestination } = await this.#mirrorConfig();
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
-        const transport = createGitvaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const transport = createVaultHttpTransport(this.#client, { byoBackend: await this.#byoBackendResolver(keystore) });
         let byoWriteTarget;
         let byoDestinationAddress;
         if (options.byo) {
             const destination = parseMirrorDestinationUrl(options.byo.destination_url, { region: options.byo.region, endpoint: options.byo.endpoint });
             byoWriteTarget = { destination, ...(options.byo.credential ? { credential: options.byo.credential } : {}) };
             byoDestinationAddress = formatMirrorDestination(destination);
-            // gitvault-byo-primary-bucket task 3.1 (design D6) — probe BEFORE any
+            // vault-byo-primary-bucket task 3.1 (design D6) — probe BEFORE any
             // allocation request; a failed probe throws and nothing is created.
-            const { probeGitvaultByoDestination } = await this.#byoProbe();
-            await probeGitvaultByoDestination(destination, options.byo.credential);
+            const { probeVaultByoDestination } = await this.#byoProbe();
+            await probeVaultByoDestination(destination, options.byo.credential);
         }
-        const created = await createGitvault({
+        const created = await createVault({
             keystore,
             transport,
             org_id: options.org_id,
@@ -1005,7 +1005,7 @@ export class Gitvault {
                 ...(options.remote_url !== undefined ? { remote_url: options.remote_url } : {}),
             });
         }
-        // gitvault-byo-primary-bucket task 3.1/3.5 — read back the AUTHORITATIVE
+        // vault-byo-primary-bucket task 3.1/3.5 — read back the AUTHORITATIVE
         // storage_profile from the vault record rather than trusting what THIS
         // call requested: an idempotent replay against a pre-existing vault
         // (a different client_creation_id, a different machine) can legitimately
@@ -1037,7 +1037,7 @@ export class Gitvault {
             genesis_sha256: created.genesis_sha256,
             remote,
             deduplicated: created.how === "reconciled",
-            terminal_loss_statement: GITVAULT_TERMINAL_LOSS_STATEMENT,
+            terminal_loss_statement: VAULT_TERMINAL_LOSS_STATEMENT,
             storage_profile: storageProfile,
             byo_destination: byoDestination,
         };
@@ -1078,7 +1078,7 @@ export class Gitvault {
      */
     async scaffoldRemote(options) {
         const { hardenedGit } = await this.#snapshot();
-        const url = options.remote_url ?? gitvaultRemoteUrl(options.org_id, options.project_id);
+        const url = options.remote_url ?? vaultRemoteUrl(options.org_id, options.project_id);
         let createdRepository = false;
         let enclosingToplevel = null;
         // The scaffold acts on the APP ROOT only (first-deploy-agent-dx, design
@@ -1218,7 +1218,7 @@ export class Gitvault {
      * Append `/<relative path of nestedDir from toplevel>/` to the enclosing
      * repository's LOCAL `.git/info/exclude` — never `.gitignore`, which is
      * tracked content (the same discipline as `excludeMessagingCacheFromGit`
-     * in `gitvault-restore.ts`). Located via `rev-parse --git-path
+     * in `vault-restore.ts`). Located via `rev-parse --git-path
      * info/exclude` so a linked worktree resolves to its common dir. Creates
      * the file when absent; idempotent when the line is already there.
      * Returns whether the line is in place — `false` (never a throw) when the
@@ -1264,9 +1264,9 @@ export class Gitvault {
      * is stated verbatim exactly as for any other vault.
      */
     async status(options = {}) {
-        const { GitvaultKeystore } = await this.#keystore();
+        const { VaultKeystore } = await this.#keystore();
         const { listPendingOverrideJournals } = await this.#deploy();
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         let repoId = options.repo_id ?? null;
         let record = null;
         if (!repoId && options.project_id) {
@@ -1324,7 +1324,7 @@ export class Gitvault {
         let coveringRecipients = null;
         if (repoId && record) {
             try {
-                const coverage = await this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/envelope-recipients`, { context: "reading the gitvault envelope recipients" });
+                const coverage = await this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/envelope-recipients`, { context: "reading the vault envelope recipients" });
                 coveringRecipients = coverage.recipient_fingerprints.length;
             }
             catch {
@@ -1336,7 +1336,7 @@ export class Gitvault {
         if (keystorePresent && !canSign) {
             warnings.push({ kind: "read_only", message: "the signing key is missing from identity.json — this principal can decrypt and verify but cannot publish a new head" });
         }
-        if (record?.gitvault_policy === "grandfathered") {
+        if (record?.vault_policy === "grandfathered") {
             warnings.push({ kind: "policy_grandfathered", message: "activation does not require vault admission on this project; return it to `required` when the migration is done" });
         }
         // D7 (repo-first-onramp task 2.7): a vault that has accrued enough value
@@ -1349,13 +1349,13 @@ export class Gitvault {
         // claims terminal loss (dogfood item 2: the single-principal premise
         // behind `terminal_loss_risk` is provably false for this vault).
         if (record) {
-            const trip = gitvaultLossWarningTrip(record);
-            if (gitvaultLossWarningTripped(trip)) {
+            const trip = vaultLossWarningTrip(record);
+            if (vaultLossWarningTripped(trip)) {
                 if (isMultiPrincipal) {
-                    warnings.push({ kind: "keystore_backup_reminder", message: gitvaultKeystoreBackupReminderMessage(trip, coveringRecipients) });
+                    warnings.push({ kind: "keystore_backup_reminder", message: vaultKeystoreBackupReminderMessage(trip, coveringRecipients) });
                 }
                 else {
-                    warnings.push({ kind: "terminal_loss_risk", message: gitvaultLossWarningMessage(trip) });
+                    warnings.push({ kind: "terminal_loss_risk", message: vaultLossWarningMessage(trip) });
                 }
             }
         }
@@ -1369,8 +1369,8 @@ export class Gitvault {
         // `.run402/` — a pure read, computed alongside the pin.
         let messagingCacheExcluded = null;
         if (options.repo_dir) {
-            const { readPinnedGitvaultRepo } = await this.#address();
-            const p = await readPinnedGitvaultRepo(options.repo_dir);
+            const { readPinnedVaultRepo } = await this.#address();
+            const p = await readPinnedVaultRepo(options.repo_dir);
             pinned = p ? { repo_id: p.repo_id, resolved_from: p.resolved_from, room: p.room } : null;
             const { isMessagingCacheExcludedFromGit } = await this.#restore();
             messagingCacheExcluded = await isMessagingCacheExcludedFromGit(options.repo_dir);
@@ -1400,10 +1400,16 @@ export class Gitvault {
                 }
                 if (!url)
                     continue;
-                const parsed = parseGitvaultRemoteUrl(url);
+                let parsed;
+                try {
+                    parsed = parseVaultRemoteUrl(url);
+                }
+                catch {
+                    continue; // another scheme's remote — not a vault remote
+                }
                 if (!parsed)
                     continue;
-                if (gitvaultRemoteAddressForm(parsed) === "id") {
+                if (vaultRemoteAddressForm(parsed) === "id") {
                     // Id-form: the URL's second half IS the real project id — the
                     // pre-existing, always-correct comparison.
                     remote = { name, url, matches: project === null || parsed.project_id === project, reason: null };
@@ -1440,7 +1446,7 @@ export class Gitvault {
         else if (options.refs === true && !holdsRepoKey) {
             warnings.push({ kind: "refs_unavailable", message: "this machine does not hold K_repo for the vault, so its ref map cannot be decrypted here" });
         }
-        // gitvault-agent-envelopes D3/D5: a KEY-HOLDER's ordinary read is a
+        // vault-agent-envelopes D3/D5: a KEY-HOLDER's ordinary read is a
         // session start — enroll this keystore's key if absent and fulfil every
         // pending desired recipient once per process (best-effort, reported,
         // never folded into the observation above). `status` on a machine that
@@ -1464,7 +1470,7 @@ export class Gitvault {
         if (!record)
             nextActions.push({ action: "allocate the project's vault", command: "run402 repos create --project <project_id>" });
         else if (pending.length > 0)
-            nextActions.push({ action: `complete ${pending.length} unvaulted-override journal(s)`, command: "run402 repos snapshot" });
+            nextActions.push({ action: `complete ${pending.length} unvaulted-override journal(s)`, command: "run402 repos capture" });
         else if (record && !holdsRepoKey)
             nextActions.push({ action: "this machine holds no key for the vault — allocate resolves to the existing vault and is idempotent", command: "run402 repos create --project <project_id>" });
         return {
@@ -1497,12 +1503,12 @@ export class Gitvault {
             refs,
             head_target: headTarget,
             pins: { highest_authenticated: authenticated, highest_materialized: materialized },
-            gitvault_policy: record?.gitvault_policy ?? null,
+            vault_policy: record?.vault_policy ?? null,
             pending_overrides: pending.length,
             covering_recipients: coveringRecipients,
-            terminal_loss_statement: isMultiPrincipal ? null : GITVAULT_TERMINAL_LOSS_STATEMENT,
-            terminal_loss_detail: isMultiPrincipal ? null : GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT,
-            durability_statement: isMultiPrincipal ? GITVAULT_DURABILITY_STATEMENT : null,
+            terminal_loss_statement: isMultiPrincipal ? null : VAULT_TERMINAL_LOSS_STATEMENT,
+            terminal_loss_detail: isMultiPrincipal ? null : VAULT_TERMINAL_LOSS_DOCTOR_TEXT,
+            durability_statement: isMultiPrincipal ? VAULT_DURABILITY_STATEMENT : null,
             warnings,
             next_actions: nextActions,
         };
@@ -1520,7 +1526,7 @@ export class Gitvault {
      * charges with reproducing them ("the helper SHALL reproduce the exact set of
      * objects reachable from the declared canonical refs (`refs/heads/*`,
      * `refs/tags/*`, protocol-owned `refs/run402/*`), plus the `HEAD` target" —
-     * gitvault-client-surface, "Faithful helper"; `run402 gitvault push` is
+     * vault-client-surface, "Faithful helper"; `run402 repos capture` is
      * separately defined as "capture and push outside a deploy" under "Source
      * verbs"). The split is forced by §6.6: a dirty tree captures as a SYNTHETIC
      * commit that sits on no branch, so moving `refs/heads/main` onto it would
@@ -1536,8 +1542,8 @@ export class Gitvault {
      * against its expected manifest and reads the admitted head back from
      * storage. A 200 alone is never enough (§0 client obligations).
      */
-    async push(options) {
-        const [{ deployRefTransaction }, { captureSnapshot, gitvaultCommitLine }] = await Promise.all([this.#publication(), this.#snapshot()]);
+    async capture(options) {
+        const [{ deployRefTransaction }, { captureSnapshot, vaultCommitLine }] = await Promise.all([this.#publication(), this.#snapshot()]);
         const openedByAddress = options.address ? await this.resolveOrCreateAddress({ ...options, address: options.address, allow_create: true }) : null;
         const opened = openedByAddress ?? (await this.openOrCreate(options));
         const addressResolution = openedByAddress?.resolution ?? null;
@@ -1546,7 +1552,7 @@ export class Gitvault {
         let handle = opened.handle;
         const repoDir = options.repo_dir ?? process.cwd();
         const snapshot = await captureSnapshot({ dir: repoDir, ...(options.snapshot ?? {}) });
-        const line = gitvaultCommitLine(snapshot);
+        const line = vaultCommitLine(snapshot);
         options.onCommitLine?.(line);
         // An OFFLINE (id-carrying pin) resolution discovers a stale pin on this
         // first repo-scoped read — recover once and retry against the fresh
@@ -1580,28 +1586,28 @@ export class Gitvault {
         // above (already returned/committed) — a mirror failure is a named
         // pending finding reported BESIDE the vault result, on its own field.
         const mirrorPush = await this.#tryMirrorPush(handle.repo_id, handle.keystore);
-        // gitvault-byo-primary-bucket task 3.3 — the SAME non-blocking contract,
+        // vault-byo-primary-bucket task 3.3 — the SAME non-blocking contract,
         // fired right beside the mirror hook (skipped_no_mirror with no network
         // call for any managed vault or any machine with no local BYO config).
         const byoChainCopy = await this.#tryByoChainCopyPush(handle.repo_id, handle.keystore);
         // Deploy-time reconcile hook: fires on every successful push,
         // best-effort — a reconcile failure (including a read-only principal
         // with no signing key) is reported BESIDE the vault result, never a
-        // `push()` throw, same non-blocking contract as the mirror hook above.
+        // `capture()` throw, same non-blocking contract as the mirror hook above.
         const reconcileRecipients = await this.#tryReconcileEnvelopeRecipients(handle.vault);
-        // gitvault-multi-writer (task 5.7) — the SAME best-effort contract,
+        // vault-multi-writer (task 5.7) — the SAME best-effort contract,
         // fired right beside the encryption-recipient reconcile above: a fresh
         // push proves this session's own key is an active writer, so this is
         // the natural place a just-admitted member's own next push clears
         // whatever candidacy it left behind for OTHER pending members too.
         const writerReconcile = await this.#tryReconcileWriterAdmissions(handle.vault);
-        return { ...result, snapshot, gitvault_commit: snapshot.oid, gitvault_commit_line: line, mirror_push: mirrorPush, byo_chain_copy: byoChainCopy, reconcile_recipients: reconcileRecipients, writer_reconcile: writerReconcile };
+        return { ...result, snapshot, vault_commit: snapshot.oid, vault_commit_line: line, mirror_push: mirrorPush, byo_chain_copy: byoChainCopy, reconcile_recipients: reconcileRecipients, writer_reconcile: writerReconcile };
     }
     // ── Handoff / resume (kygit-handoff design D1-D10) ─────────────────────────
     /**
      * Mint a Handoff Key: capture a stash-shaped checkpoint (design D1),
-     * push it (retained, on no branch — {@link GITVAULT_DEPLOY_REF} carries
-     * it exactly like an ordinary `push()`, never `refs/heads/*`), seal the
+     * push it (retained, on no branch — {@link VAULT_DEPLOY_REF} carries
+     * it exactly like an ordinary `capture()`, never `refs/heads/*`), seal the
      * vault's current epoch key under a fresh `wrap_key`, and mint through
      * the gateway. The assembled `kgh1_…` key is returned exactly ONCE —
      * nothing here or downstream persists it.
@@ -1617,10 +1623,10 @@ export class Gitvault {
         const repoDir = options.repo_dir ?? process.cwd();
         const repoFile = handle.keystore.readRepo(handle.repo_id);
         if (!repoFile) {
-            throw new LocalError(`no local key material for ${handle.repo_id} — this principal is not yet a member with a materialized envelope (push once first)`, "minting a handoff", { code: "GITVAULT_VAULT_UNRESOLVED" });
+            throw new LocalError(`no local key material for ${handle.repo_id} — this principal is not yet a member with a materialized envelope (push once first)`, "minting a handoff", { code: "VAULT_UNRESOLVED" });
         }
         const kRepo = hexToBytes(repoFile.k_repo_hex);
-        // gitvault-multi-writer rev 47 (task 5.5, design D4): only an ACTIVE
+        // vault-multi-writer rev 47 (task 5.5, design D4): only an ACTIVE
         // WRITER may mint — the gateway enforces this authoritatively at mint
         // time (`403 HANDOFF_MINT_REQUIRES_WRITER`), but failing that late
         // would mean this call already paid for a checkpoint capture + push +
@@ -1632,20 +1638,20 @@ export class Gitvault {
         const identity = handle.keystore.readIdentity();
         const localWriterKeyId = identity?.signing_fingerprint ?? null;
         if (!localWriterKeyId || !repoFile.writer_set_pin?.writers.some((w) => w.writer_key_id === localWriterKeyId)) {
-            throw new LocalError("this keystore's signing key is not an admitted writer of this vault — minting a handoff requires an ACTIVE writer (design D4); an existing writer must add this key first (`run402 orgs members add` / repos access sync), or push once to reconcile if a pending admission already exists", "minting a handoff", { code: "GITVAULT_WRITER_NOT_ADMITTED" });
+            throw new LocalError("this keystore's signing key is not an admitted writer of this vault — minting a handoff requires an ACTIVE writer (design D4); an existing writer must add this key first (`run402 orgs members add` / repos access sync), or push once to reconcile if a pending admission already exists", "minting a handoff", { code: "VAULT_WRITER_NOT_ADMITTED" });
         }
         // The grant's `minted_role` must EXACTLY predict what the gateway's own
-        // role-attenuation (`services/gitvault/claims.ts mintHandoff`) will
+        // role-attenuation (`services/vault/claims.ts mintHandoff`) will
         // compute, or the grant fails VALIDATION_FAILED after this call has
         // already paid for the checkpoint push below — `predictMintedRole`
         // mirrors that formula against the SAME `ORG_ROLE_RANK` lattice
-        // `gitvault-writer-state.ts` already uses elsewhere in this codebase.
+        // `vault-writer-state.ts` already uses elsewhere in this codebase.
         const { predictMintedRole } = await this.#writerState();
         const vaultRecord = await this.get(handle.repo_id);
         const who = await this.#client.request("/agent/v1/whoami", { context: "resolving this principal's org role for the handoff grant" });
         const membership = who.memberships.find((m) => m.org_id === vaultRecord.org_id && m.status === "active");
         if (!membership) {
-            throw new LocalError(`this principal has no active membership on ${vaultRecord.org_id} — an active writer must also be an active org member to mint a handoff`, "minting a handoff", { code: "GITVAULT_ACCESS_DENIED" });
+            throw new LocalError(`this principal has no active membership on ${vaultRecord.org_id} — an active writer must also be an active org member to mint a handoff`, "minting a handoff", { code: "VAULT_ACCESS_DENIED" });
         }
         const grantMintedRole = predictMintedRole(options.role, membership.role);
         const snapshot = await captureHandoffSnapshot({
@@ -1686,7 +1692,7 @@ export class Gitvault {
         const handoffId = randomHandoffUuid();
         const { key, handoff_id_bytes, master_secret } = assembleHandoffKey(handoffId, randomBytes(32));
         const secrets = deriveHandoffSecrets(handoff_id_bytes, master_secret);
-        // gitvault-multi-writer rev 47 (task 5.5, design D4) — the MINTER's own
+        // vault-multi-writer rev 47 (task 5.5, design D4) — the MINTER's own
         // writer key signs `writer_admission_grant`, authorizing whoever redeems
         // this handoff to become a writer (D224/D225). This is a HARD
         // requirement distinct from the earlier `writer_set_pin` presence
@@ -1732,7 +1738,7 @@ export class Gitvault {
             // the pre-rotation generations too ("membership grants FULL history"),
             // and no rotation ever re-wraps old epochs to a principal that did not
             // exist then. Found live: a recipient redeemed a post-removal handoff
-            // and its clone died GITVAULT_EPOCH_NOT_OPENABLE at generation 1.
+            // and its clone died VAULT_EPOCH_NOT_OPENABLE at generation 1.
             epoch_keys: { ...(repoFile.epoch_keys ?? {}), [repoFile.epoch]: repoFile.k_repo_hex },
             checkpoint: { generation: pushResult.generation, commit_oid: snapshot.oid },
             note_schema: "kygit.handoff-note.v1",
@@ -1743,7 +1749,7 @@ export class Gitvault {
         // `project_id`, a verbatim `warning` sentence plus its machine-readable
         // `warnings[]` twin. Read those names exactly — an SDK-side spelling
         // that the gateway never sends surfaces as "role undefined" at the CLI.
-        const response = await this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(handle.repo_id)}/handoffs`, {
+        const response = await this.#client.request(`/vaults/v1/${encodeURIComponent(handle.repo_id)}/handoffs`, {
             method: "POST",
             body: {
                 handoff_id: handoffId,
@@ -1775,7 +1781,7 @@ export class Gitvault {
             expires_at: response.expires_at,
             // A slug-form remote is the one address the minter already knows;
             // an id-form one carries nothing a directory name should be built from.
-            vault: handoffVaultFromWire(response, options.address && gitvaultRemoteAddressForm(options.address) === "slug" ? `${options.address.org_id}/${options.address.project_id}` : null),
+            vault: handoffVaultFromWire(response, options.address && vaultRemoteAddressForm(options.address) === "slug" ? `${options.address.org_id}/${options.address.project_id}` : null),
             checkpoint: response.checkpoint,
             capture: {
                 modified_captured: snapshot.modified_captured.length,
@@ -1791,17 +1797,17 @@ export class Gitvault {
     /** List a vault's handoffs (ids, kind, state, role, expiry, redeemed_by — never the hash or envelope). */
     async listHandoffs(options) {
         const repoId = await this.#resolveRepoId(options);
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/handoffs`, { context: "listing handoffs" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/handoffs`, { context: "listing handoffs" });
     }
     /** Revoke a handoff (idempotent — a second revoke of an already-revoked/redeemed/expired row still answers `200`). */
     async revokeHandoff(handoffId, options) {
         const repoId = await this.#resolveRepoId(options);
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/handoffs/${encodeURIComponent(handoffId)}`, { method: "DELETE", context: "revoking a handoff" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/handoffs/${encodeURIComponent(handoffId)}`, { method: "DELETE", context: "revoking a handoff" });
     }
     // ── Invite / join (kygit-invite design D1-D10) ─────────────────────────────
     /**
      * Mint an Invite Key: capture a stash-shaped checkpoint exactly as
-     * {@link Gitvault.handoff} does (design D1), push it (retained, on no
+     * {@link Repos.handoff} does (design D1), push it (retained, on no
      * branch), register the INVITER's own presence in the invite's room
      * (design D4 — before the mint, so the row can carry
      * `inviter_presence_id`; a registration failure is reported and the mint
@@ -1821,16 +1827,16 @@ export class Gitvault {
      */
     async invite(options) {
         const [{ deployRefTransaction }, { captureHandoffSnapshot, snapshotCommitment }] = await Promise.all([this.#publication(), this.#snapshot()]);
-        const ho = await nodeOnly(() => import("../node/gitvault-handoff.js"), "invite");
+        const ho = await nodeOnly(() => import("../node/vault-handoff.js"), "invite");
         const { assembleInviteKey, deriveInviteSecrets, sealInviteEnvelope, assertInviteNoteHasNoSecret, buildWriterAdmissionGrant, deriveInviteWriterAdmissionSeed, INVITE_ENVELOPE_V2_KIND } = ho;
         const handle = options.address ? (await this.resolveOrCreateAddress({ ...options, address: options.address, allow_create: false })).handle : await this.open(options);
         const repoDir = options.repo_dir ?? process.cwd();
         const repoFile = handle.keystore.readRepo(handle.repo_id);
         if (!repoFile) {
-            throw new LocalError(`no local key material for ${handle.repo_id} — this principal is not yet a member with a materialized envelope (push once first)`, "minting an invite", { code: "GITVAULT_VAULT_UNRESOLVED" });
+            throw new LocalError(`no local key material for ${handle.repo_id} — this principal is not yet a member with a materialized envelope (push once first)`, "minting an invite", { code: "VAULT_UNRESOLVED" });
         }
         const kRepo = hexToBytes(repoFile.k_repo_hex);
-        // gitvault-multi-writer rev 47 (kygit-invite design D4): only an ACTIVE
+        // vault-multi-writer rev 47 (kygit-invite design D4): only an ACTIVE
         // WRITER may mint — the gateway enforces it authoritatively
         // (`403 INVITE_MINT_REQUIRES_WRITER`, carrying `request_writer_sync`),
         // but failing that late would mean this call already paid for a
@@ -1841,7 +1847,7 @@ export class Gitvault {
         const identity = handle.keystore.readIdentity();
         const localWriterKeyId = identity?.signing_fingerprint ?? null;
         if (!localWriterKeyId || !repoFile.writer_set_pin?.writers.some((w) => w.writer_key_id === localWriterKeyId)) {
-            throw new LocalError("this keystore's signing key is not an admitted writer of this vault — minting an invite requires an ACTIVE writer (the gateway's own refusal is INVITE_MINT_REQUIRES_WRITER); run `run402 repos access sync` from a live writer, or push once to reconcile if a pending admission already exists", "minting an invite", { code: "GITVAULT_WRITER_NOT_ADMITTED", details: { next_action: "request_writer_sync", command: "run402 repos access sync" } });
+            throw new LocalError("this keystore's signing key is not an admitted writer of this vault — minting an invite requires an ACTIVE writer (the gateway's own refusal is INVITE_MINT_REQUIRES_WRITER); run `run402 repos access sync` from a live writer, or push once to reconcile if a pending admission already exists", "minting an invite", { code: "VAULT_WRITER_NOT_ADMITTED", details: { next_action: "request_writer_sync", command: "run402 repos access sync" } });
         }
         // The grant's `minted_role` must EXACTLY predict what the gateway's own
         // role attenuation will compute (invite defaults to `developer` rather
@@ -1853,7 +1859,7 @@ export class Gitvault {
         const whoMints = await this.#client.request("/agent/v1/whoami", { context: "resolving this principal's org role for the invite grant" });
         const inviterMembership = whoMints.memberships.find((m) => m.org_id === vaultRecord.org_id && m.status === "active");
         if (!inviterMembership) {
-            throw new LocalError(`this principal has no active membership on ${vaultRecord.org_id} — an active writer must also be an active org member to mint an invite`, "minting an invite", { code: "GITVAULT_ACCESS_DENIED" });
+            throw new LocalError(`this principal has no active membership on ${vaultRecord.org_id} — an active writer must also be an active org member to mint an invite`, "minting an invite", { code: "VAULT_ACCESS_DENIED" });
         }
         const grantMintedRole = predictMintedRole(options.role ?? INVITE_DEFAULT_ROLE, inviterMembership.role);
         const snapshot = await captureHandoffSnapshot({
@@ -1912,7 +1918,7 @@ export class Gitvault {
         const inviteId = randomHandoffUuid();
         const { key, invite_id_bytes, master_secret } = assembleInviteKey(inviteId, randomBytes(32));
         const secrets = deriveInviteSecrets(invite_id_bytes, master_secret);
-        // gitvault-multi-writer rev 47 (kygit-invite design D4) — the MINTER's
+        // vault-multi-writer rev 47 (kygit-invite design D4) — the MINTER's
         // own writer key signs `writer_admission_grant`, authorizing whoever
         // redeems this invite to become a writer under its OWN key. Built and
         // SIGNED BEFORE the envelope is sealed ("no hash cycle: grant first,
@@ -1960,10 +1966,10 @@ export class Gitvault {
             writer_admission_grant_sha256: grantSha256Local,
         });
         // The wire shape mirrors the handoff mint's documented one (llms-full.txt
-        // "Handoff / resume", gitvault-invite spec): `role` (the minted role),
+        // "Handoff / resume", vault-invite spec): `role` (the minted role),
         // `repo_id` / `org_id` / `project_id`, `room`, a verbatim `warning`
         // sentence plus its machine-readable `warnings[]` twin.
-        const response = await this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(handle.repo_id)}/invites`, {
+        const response = await this.#client.request(`/vaults/v1/${encodeURIComponent(handle.repo_id)}/invites`, {
             method: "POST",
             body: {
                 invite_id: inviteId,
@@ -2015,14 +2021,10 @@ export class Gitvault {
         }
         const nextActions = [...(response.next_actions ?? [])];
         if (!nextActions.some((a) => a.type === "join_invite")) {
-            // design D9: "CLI-synthesized, the recipient's exact command" —
-            // rendered by DOOR, same as every other remote-facing command this
-            // module renders (`gitvaultRemoteScheme()` is the one place that
-            // decides `run402` vs `kygit`, per `RUN402_REMOTE_SCHEME`).
-            const door = gitvaultRemoteScheme();
+            // design D9: "CLI-synthesized, the recipient's exact command".
             nextActions.push({
                 type: "join_invite",
-                command: door === "kygit" ? `kygit join ${key}` : `run402 repos join ${key}`,
+                command: `run402 repos join ${key}`,
                 why: "Run this on the other agent's machine to redeem the invite.",
                 safe_to_auto_execute: false,
             });
@@ -2036,7 +2038,7 @@ export class Gitvault {
             kind: response.kind,
             minted_role: response.role,
             expires_at: response.expires_at,
-            vault: handoffVaultFromWire(response, options.address && gitvaultRemoteAddressForm(options.address) === "slug" ? `${options.address.org_id}/${options.address.project_id}` : null),
+            vault: handoffVaultFromWire(response, options.address && vaultRemoteAddressForm(options.address) === "slug" ? `${options.address.org_id}/${options.address.project_id}` : null),
             room: { organization_id: response.room?.org_id ?? repoFile.org_id, room_key: response.room?.room_key ?? roomKey },
             checkpoint: response.checkpoint,
             capture: {
@@ -2055,12 +2057,12 @@ export class Gitvault {
     /** List a vault's invites (ids, kind, state, role, room, expiry, redeemed_by — never the hash or envelope). */
     async listInvites(options) {
         const repoId = await this.#resolveRepoId(options);
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/invites`, { context: "listing invites" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/invites`, { context: "listing invites" });
     }
     /** Revoke an invite (idempotent — a second revoke of an already-revoked/redeemed/expired row still answers `200`). */
     async revokeInvite(inviteId, options) {
         const repoId = await this.#resolveRepoId(options);
-        return this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE", context: "revoking an invite" });
+        return this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/invites/${encodeURIComponent(inviteId)}`, { method: "DELETE", context: "revoking an invite" });
     }
     /**
      * Create this machine's wallet (the wallet file) when the credentials
@@ -2089,7 +2091,7 @@ export class Gitvault {
      * envelope supersedes the bearer one.
      */
     /**
-     * gitvault-multi-writer rev 47 (task 5.6, design D4/D5) — order: parse →
+     * vault-multi-writer rev 47 (task 5.6, design D4/D5) — order: parse →
      * ensure wallet → ensure identity → derive auth/wrap/admission → build
      * acceptance → redeem → verify grant → open envelope → check the grant
      * hash → persist repo file with `pending_writer_admission` → clone →
@@ -2112,14 +2114,14 @@ export class Gitvault {
      * "not yet a writer" refuses; here "already a writer" means skip.
      */
     async resume(options) {
-        const [ho, { GitvaultKeystore }, restore] = await Promise.all([this.#handoff(), this.#keystore(), this.#restore()]);
+        const [ho, { VaultKeystore }, restore] = await Promise.all([this.#handoff(), this.#keystore(), this.#restore()]);
         const { parseHandoffKey, deriveHandoffSecrets, deriveWriterAdmissionSeed, buildWriterAcceptance, openHandoffEnvelopeV2 } = ho;
-        const { cloneGitvaultRemote, applyHandoffCheckpoint, resolveResumeTargetDir, readGitCommitMessage, excludeMessagingCacheFromGit } = restore;
+        const { cloneVaultRemote, applyHandoffCheckpoint, resolveResumeTargetDir, readGitCommitMessage, excludeMessagingCacheFromGit } = restore;
         // parse
         const parsed = parseHandoffKey(options.key);
         // ensure wallet — A fresh machine has no wallet, and the redeem route
         // accepts ONLY a SIWX wallet signature (a control-plane session,
-        // delegate, or service key is refused HANDOFF_REDEEM_REQUIRES_WALLET —
+        // grant key, or service key is refused HANDOFF_REDEEM_REQUIRES_WALLET —
         // the keystore key the redemption publishes is what makes the recipient a
         // real key-holder). Nothing upstream creates the wallet for an
         // unpaid request, so `resume` does it here, exactly as `repos resume
@@ -2131,11 +2133,11 @@ export class Gitvault {
         await this.#ensureLocalWallet(options.onLine);
         // ensure identity — BEFORE redeem (D5): the acceptance below needs this
         // checkout's own signing key, which the redeem REQUEST body carries.
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const identity = keystore.ensureIdentity();
         const signingKeypair = keystore.signingKeypair(identity);
         if (!signingKeypair) {
-            throw new LocalError("this keystore has no local signing seed — resuming a gitvault-multi-writer handoff requires signing writer_acceptance with a full Ed25519 seed, which a read-only recovery identity does not hold", "resuming a handoff", { code: "VAULT_UNRECOVERABLE" });
+            throw new LocalError("this keystore has no local signing seed — resuming a vault-multi-writer handoff requires signing writer_acceptance with a full Ed25519 seed, which a read-only recovery identity does not hold", "resuming a handoff", { code: "VAULT_UNRECOVERABLE" });
         }
         const redeemerEncryptionPubkeyRaw = fromBase64url(identity.encryption_pubkey, "identity.encryption_pubkey");
         // derive auth/wrap/admission
@@ -2152,7 +2154,7 @@ export class Gitvault {
             redeemer_encryption_pubkey_raw: redeemerEncryptionPubkeyRaw,
         });
         // claim
-        const redeem = await this.#client.request(`/gitvault/v1/handoffs/${encodeURIComponent(parsed.handoff_id)}/redeem`, {
+        const redeem = await this.#client.request(`/vaults/v1/handoffs/${encodeURIComponent(parsed.handoff_id)}/redeem`, {
             method: "POST",
             // Base64url, per the documented wire contract (openapi: "Base64url — the
             // HKDF-derived auth_secret half of the parsed kgh1_ key"). The gateway
@@ -2193,7 +2195,7 @@ export class Gitvault {
         // open envelope — v2 (task 5.4): the v2 payload's own
         // writer_admission_grant_sha256 is what the next step cross-checks;
         // opening under the SAME v1/v2-requiring rule that refuses a
-        // pre-gitvault-multi-writer mint's envelope outright.
+        // pre-vault-multi-writer mint's envelope outright.
         const payload = openHandoffEnvelopeV2(parsed.handoff_id_bytes, secrets.wrap_key, redeem.sealed_envelope, redeem.envelope_kind);
         if (payload.repo_id !== vault.vault_id) {
             throw new LocalError("the opened envelope's repo_id does not match the redeem response's vault — refusing", "resuming a handoff", { code: "HANDOFF_ENVELOPE_INVALID" });
@@ -2207,18 +2209,18 @@ export class Gitvault {
             throw new LocalError(`the redeem response's writer_admission_grant (sha256 ${grantSha256}) does not match the hash sealed into the envelope at mint time (${payload.writer_admission_grant_sha256}) — refusing to activate under a substituted grant`, "resuming a handoff", { code: "HANDOFF_REDEEM_WRITER_KEY_MISMATCH", details: { expected: payload.writer_admission_grant_sha256, received: grantSha256 } });
         }
         // Genesis must be pinned before ANY materialize call can succeed
-        // (`GitvaultVault.genesis()` requires a keystore repo file — this is
+        // (`Vault.genesis()` requires a keystore repo file — this is
         // the one read that happens BEFORE one exists, via the transport
         // directly, mirroring `restoreRepoFromEnvelope`'s own signature check).
-        const { createGitvaultHttpTransport } = await this.#publication();
-        const transport = createGitvaultHttpTransport(this.#client);
+        const { createVaultHttpTransport } = await this.#publication();
+        const transport = createVaultHttpTransport(this.#client);
         const genesisBytes = await transport.getGenesis({ repo_id: vault.vault_id });
         if (!genesisBytes) {
             throw new LocalError("the vault has no admitted genesis", "resuming a handoff", { code: "CHAIN_BROKEN", details: { repo_id: vault.vault_id } });
         }
-        const genesis = parseGitvaultStrict(new TextDecoder().decode(genesisBytes));
-        if (!verifyGitvaultObject(genesis, genesis.creator_signing_pubkey)) {
-            throw new LocalError("vault_genesis signature does not verify", "resuming a handoff", { code: "GITVAULT_SIGNATURE_INVALID", details: { repo_id: vault.vault_id } });
+        const genesis = parseVaultStrict(new TextDecoder().decode(genesisBytes));
+        if (!verifyVaultObject(genesis, genesis.creator_signing_pubkey)) {
+            throw new LocalError("vault_genesis signature does not verify", "resuming a handoff", { code: "VAULT_SIGNATURE_INVALID", details: { repo_id: vault.vault_id } });
         }
         const genesisSha = sha256Hex(genesisBytes);
         // persist repo file with pending_writer_admission — BEFORE clone/chain
@@ -2245,14 +2247,14 @@ export class Gitvault {
         });
         const targetDir = await resolveResumeTargetDir(options.to, vault.address, vault.vault_id);
         options.onLine?.(`resuming into ${targetDir}`);
-        const remoteUrl = gitvaultRemoteUrl(vault.organization_id, vault.project_id);
-        await cloneGitvaultRemote(remoteUrl, targetDir);
+        const remoteUrl = vaultRemoteUrl(vault.organization_id, vault.project_id);
+        await cloneVaultRemote(remoteUrl, targetDir);
         // Local-only pins (design D10) — never a worktree file, never the
         // global active project. Reuses the SAME pin-writer every other
-        // gitvault resolution path uses, which also writes `r402.room`.
-        const { pinGitvaultRepo } = await this.#address();
+        // vault resolution path uses, which also writes `r402.room`.
+        const { pinVaultRepo } = await this.#address();
         const addressParts = vault.address ? vault.address.split("/") : null;
-        await pinGitvaultRepo(targetDir, vault.vault_id, addressParts && addressParts.length === 2 ? { org_slug: addressParts[0], repo_name: addressParts[1] } : undefined, { project_id: vault.project_id, org_id: vault.organization_id });
+        await pinVaultRepo(targetDir, vault.vault_id, addressParts && addressParts.length === 2 ? { org_slug: addressParts[0], repo_name: addressParts[1] } : undefined, { project_id: vault.project_id, org_id: vault.organization_id });
         // kygit-invite design D5: restore is kind-agnostic, so the same
         // `.git/info/exclude` write `join` performs happens on `resume` too —
         // best-effort, never a `resume()` throw.
@@ -2262,7 +2264,7 @@ export class Gitvault {
         catch {
             // Best-effort: an unwritable checkout still completes the resume.
         }
-        // verify chain — `open()` here mainly constructs the `GitvaultVault`
+        // verify chain — `open()` here mainly constructs the `Vault`
         // instance: its own `ensureRepoState()` (the cold-open restore path)
         // no-ops the instant it sees a repo file already on disk — and the
         // `saveRepo` call above just wrote one. The chain walk this method
@@ -2294,10 +2296,10 @@ export class Gitvault {
         // Clearing pending_writer_admission now that the activation head is
         // (or already was — the idempotent-skip case) admitted mirrors
         // writer_status flipping to "active" at the same moment, per this
-        // field's own doc comment in gitvault-keystore.ts.
+        // field's own doc comment in vault-keystore.ts.
         keystore.updateRepo(vault.vault_id, { pending_writer_admission: null });
         // reconcile principal envelope — the bearer envelope is superseded
-        // within minutes of use; run the same reconcile `push()` runs,
+        // within minutes of use; run the same reconcile `capture()` runs,
         // best-effort (never a `resume()` throw), NOW that this checkout is an
         // admitted writer and the reconcile's own wrap step is meaningful.
         const reconcile = await this.#tryReconcileEnvelopeRecipients(handle.vault);
@@ -2346,7 +2348,7 @@ export class Gitvault {
     /**
      * Join an Invite Key: parse (refusing a `kgh1_` handoff key by name,
      * pointing at `resume` — design D9) → ensure this machine has a wallet
-     * (design D5, mirroring {@link Gitvault.resume}'s own bare-wallet
+     * (design D5, mirroring {@link Repos.resume}'s own bare-wallet
      * backstop; the CALLER folds the fuller cold-start chain — wallet,
      * faucet, one x402 prototype payment — before invoking this, never
      * blocking the redemption itself) → redeem → open the sealed envelope → write
@@ -2360,14 +2362,14 @@ export class Gitvault {
      * the most recent messages for the arrival view.
      */
     async join(options) {
-        const [ho, { GitvaultKeystore }, { createGitvaultHttpTransport }] = await Promise.all([
-            nodeOnly(() => import("../node/gitvault-handoff.js"), "join"),
+        const [ho, { VaultKeystore }, { createVaultHttpTransport }] = await Promise.all([
+            nodeOnly(() => import("../node/vault-handoff.js"), "join"),
             this.#keystore(),
             this.#publication(),
         ]);
-        const restore = await nodeOnly(() => import("../node/gitvault-restore.js"), "join");
+        const restore = await nodeOnly(() => import("../node/vault-restore.js"), "join");
         const { parseInviteKey, deriveInviteSecrets, deriveInviteWriterAdmissionSeed, buildWriterAcceptance, openInviteEnvelope } = ho;
-        const { cloneGitvaultRemote, applyHandoffCheckpoint, resolveResumeTargetDir, readGitCommitMessage, excludeMessagingCacheFromGit } = restore;
+        const { cloneVaultRemote, applyHandoffCheckpoint, resolveResumeTargetDir, readGitCommitMessage, excludeMessagingCacheFromGit } = restore;
         const parsed = parseInviteKey(options.key);
         const secrets = deriveInviteSecrets(parsed.invite_id_bytes, parsed.master_secret);
         // Bare-wallet backstop, exactly like `resume` (design D5) — the claim
@@ -2379,7 +2381,7 @@ export class Gitvault {
         // below needs THIS checkout's own signing key, and the redeem REQUEST
         // body carries it. Nothing about the joiner's key is copied from the
         // inviter — the joiner generates it and pushes under it.
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const identity = keystore.ensureIdentity();
         const signingKeypair = keystore.signingKeypair(identity);
         if (!signingKeypair) {
@@ -2399,7 +2401,7 @@ export class Gitvault {
             redeemer_signing_seed: signingKeypair.seed,
             redeemer_encryption_pubkey_raw: redeemerEncryptionPubkeyRaw,
         });
-        const redeem = await this.#client.request(`/gitvault/v1/invites/${encodeURIComponent(parsed.invite_id)}/redeem`, {
+        const redeem = await this.#client.request(`/vaults/v1/invites/${encodeURIComponent(parsed.invite_id)}/redeem`, {
             method: "POST",
             // Base64url, per the documented wire contract — the gateway decodes
             // base64/base64url and substitutes 32 zero bytes for anything else,
@@ -2452,14 +2454,14 @@ export class Gitvault {
         // Genesis must be pinned before ANY materialize call can succeed — the
         // one read that happens BEFORE a keystore repo file exists, via the
         // transport directly (mirrors `resume`'s own signature check).
-        const transport = createGitvaultHttpTransport(this.#client);
+        const transport = createVaultHttpTransport(this.#client);
         const genesisBytes = await transport.getGenesis({ repo_id: vault.vault_id });
         if (!genesisBytes) {
             throw new LocalError("the vault has no admitted genesis", "joining an invite", { code: "CHAIN_BROKEN", details: { repo_id: vault.vault_id } });
         }
-        const genesis = parseGitvaultStrict(new TextDecoder().decode(genesisBytes));
-        if (!verifyGitvaultObject(genesis, genesis.creator_signing_pubkey)) {
-            throw new LocalError("vault_genesis signature does not verify", "joining an invite", { code: "GITVAULT_SIGNATURE_INVALID", details: { repo_id: vault.vault_id } });
+        const genesis = parseVaultStrict(new TextDecoder().decode(genesisBytes));
+        if (!verifyVaultObject(genesis, genesis.creator_signing_pubkey)) {
+            throw new LocalError("vault_genesis signature does not verify", "joining an invite", { code: "VAULT_SIGNATURE_INVALID", details: { repo_id: vault.vault_id } });
         }
         const genesisSha = sha256Hex(genesisBytes);
         // Write the repo file to the keystore BEFORE touching disk (design D5),
@@ -2484,18 +2486,18 @@ export class Gitvault {
         });
         const targetDir = await resolveResumeTargetDir(options.to, vault.address, vault.vault_id);
         options.onLine?.(`joining into ${targetDir}`);
-        const remoteUrl = gitvaultRemoteUrl(vault.organization_id, vault.project_id);
-        await cloneGitvaultRemote(remoteUrl, targetDir);
+        const remoteUrl = vaultRemoteUrl(vault.organization_id, vault.project_id);
+        await cloneVaultRemote(remoteUrl, targetDir);
         // The ROW's room key — a named room, or the project id when the mint
         // omitted one — is what makes `messages wait` in the joined checkout
         // address the right room with zero flags (design D5).
         const roomKey = redeem.room?.room_key ?? vault.project_id ?? "";
         // Local-only pins (design D5) — never a worktree file, never the global
-        // active project. Reuses the SAME pin-writer every other gitvault
+        // active project. Reuses the SAME pin-writer every other vault
         // resolution path uses, this time with the invite's OWN room key.
-        const { pinGitvaultRepo } = await this.#address();
+        const { pinVaultRepo } = await this.#address();
         const addressParts = vault.address ? vault.address.split("/") : null;
-        await pinGitvaultRepo(targetDir, vault.vault_id, addressParts && addressParts.length === 2 ? { org_slug: addressParts[0], repo_name: addressParts[1] } : undefined, { project_id: vault.project_id, org_id: vault.organization_id, room_key: roomKey });
+        await pinVaultRepo(targetDir, vault.vault_id, addressParts && addressParts.length === 2 ? { org_slug: addressParts[0], repo_name: addressParts[1] } : undefined, { project_id: vault.project_id, org_id: vault.organization_id, room_key: roomKey });
         // design D5/D9 risk list: `.git/info/exclude` rather than `.gitignore`
         // — the ignore file is part of the captured tree and touching it would
         // break exact-state on the first `git status`. Best-effort.
@@ -2505,7 +2507,7 @@ export class Gitvault {
         catch {
             // Best-effort: an unwritable checkout still completes the join.
         }
-        // verify chain — `open()` here mainly constructs the `GitvaultVault`
+        // verify chain — `open()` here mainly constructs the `Vault`
         // instance (its cold-open restore path no-ops the instant it sees the
         // repo file `saveRepo` just wrote). The chain walk this method needs
         // happens the FIRST time `submitWriterActivationHead` calls
@@ -2517,7 +2519,7 @@ export class Gitvault {
         // design D5: activate as a writer BEFORE `join()` returns, through the
         // SAME `add_writer_key` door `resume` drives — so the joiner's first
         // `git push` is an ordinary push under its OWN key, not a
-        // `GITVAULT_WRITER_NOT_ADMITTED` refusal. `added_writer.principal_id`
+        // `VAULT_WRITER_NOT_ADMITTED` refusal. `added_writer.principal_id`
         // names the redeemer's own control-plane principal, which the claim
         // response never carries (its `membership` block names the ORG), so
         // resolve it fresh here.
@@ -2552,7 +2554,7 @@ export class Gitvault {
             writerActivation = { outcome: "pending", writer_key_id: myWriterKeyId, reason: e instanceof Error ? e.message : String(e) };
         }
         // The bearer envelope is superseded within minutes of use — run the
-        // same reconcile `push()` runs, best-effort (never a `join()` throw),
+        // same reconcile `capture()` runs, best-effort (never a `join()` throw),
         // NOW that this checkout is an admitted writer and the reconcile's own
         // wrap step is meaningful.
         const reconcile = await this.#tryReconcileEnvelopeRecipients(handle.vault);
@@ -2675,7 +2677,7 @@ export class Gitvault {
             next_actions: nextActions,
         };
     }
-    /** Best-effort dual-push: catches EVERYTHING, including the lazy module import itself, so a mirror problem can never surface as a `push()` throw. */
+    /** Best-effort dual-push: catches EVERYTHING, including the lazy module import itself, so a mirror problem can never surface as a `capture()` throw. */
     /**
      * `EPOCH_ROTATION_REQUIRED` (D193) is left THROWN — never swallowed into a
      * silent auto-rotation — because this call site cannot legally decide the
@@ -2683,7 +2685,7 @@ export class Gitvault {
      * a rotation attempt must be fenced against: no shipped gateway route
      * exposes them for `reason:"member_removed"`/`"elective_rekey"`/
      * `"epoch_secret_exposed"` (verified against the live gateway route
-     * source — see `GitvaultVault.rotateEpoch`'s own doc comment). Submitting
+     * source — see `Vault.rotateEpoch`'s own doc comment). Submitting
      * a GUESSED pair would either fail loudly (`RECIPIENT_SET_MISMATCH`, the
      * honest outcome) or — worse — never be reachable at all for a fresh
      * counter row. Rather than let a caller decode `details.migration_required`/
@@ -2698,7 +2700,7 @@ export class Gitvault {
         if (!isRun402Error(e) || e.code !== "EPOCH_ROTATION_REQUIRED")
             return e;
         // Mirrors `epochRotationRequiredNextActions` in
-        // `../node/gitvault-deploy.ts` byte-for-byte (same three causes, same
+        // `../node/vault-deploy.ts` byte-for-byte (same three causes, same
         // three commands) — kept as a small standalone copy rather than a
         // shared import so this namespace-level module (isomorphic — Deno/Bun/V8
         // isolates, no Node-only imports) never has to pull in the Node-only
@@ -2711,14 +2713,14 @@ export class Gitvault {
             nextActions.push({ action: "run402 repos access revoke-key <principal_id>", why: "an org membership removal or key revocation is outstanding for this vault; a surviving writer's push completes a membership removal automatically (reason member_removed), so this push was refused because that rotation could not run here — an owner can rotate explicitly with this command (owner + step-up)" });
         if (details.exposure_outstanding)
             nextActions.push({ action: "run402 repos access declare-exposure", why: "this vault's own epoch secret has been declared exposed (owner + step-up)" });
-        return new LocalError(`this vault requires a rotate_epoch admission before an ordinary push is admissible (repo_id ${repoId})`, "pushing to gitvault", { code: "EPOCH_ROTATION_REQUIRED", details, next_actions: nextActions.length > 0 ? nextActions : undefined, cause: e });
+        return new LocalError(`this vault requires a rotate_epoch admission before an ordinary push is admissible (repo_id ${repoId})`, "pushing to vault", { code: "EPOCH_ROTATION_REQUIRED", details, next_actions: nextActions.length > 0 ? nextActions : undefined, cause: e });
     }
     /**
      * The capture-time copies a plain `git push` through the remote helper
-     * owes exactly as {@link push} and {@link deploy} do: the opt-in mirror
+     * owes exactly as {@link capture} and {@link deploy} do: the opt-in mirror
      * dual-push and, on a BYO vault, the signed-chain copy into the customer
-     * bucket (gitvault-byo-primary-bucket task 3.3). The helper publishes
-     * through `GitvaultVault.push` directly, so it calls this right after a
+     * bucket (vault-byo-primary-bucket task 3.3). The helper publishes
+     * through `Vault.push` directly, so it calls this right after a
      * generation lands. Same contract as the private hooks it composes:
      * best-effort, NEVER throws, never alters the push already committed —
      * each outcome is reported on its own field (`skipped_no_mirror` costs no
@@ -2739,12 +2741,12 @@ export class Gitvault {
         }
     }
     /**
-     * gitvault-byo-primary-bucket task 3.3 — the chain's every-push dual-write
+     * vault-byo-primary-bucket task 3.3 — the chain's every-push dual-write
      * into a BYO vault's own destination, mirroring {@link #tryMirrorPush}'s
      * exact contract byte-for-byte (best-effort, catches EVERYTHING, never
      * throws, never alters the vault outcome already committed above — a
      * chain-copy failure is a named pending finding reported BESIDE the vault
-     * result on its own field, never a `push()`/`deploy()` throw).
+     * result on its own field, never a `capture()`/`deploy()` throw).
      */
     async #tryByoChainCopyPush(repoId, keystore) {
         try {
@@ -2755,7 +2757,7 @@ export class Gitvault {
             return { attempted: false, outcome: "skipped_no_mirror", error: e instanceof Error ? e.message : String(e) };
         }
     }
-    /** Best-effort envelope-recipient reconcile: availability and local-policy failures never surface as a `push()` throw (mirroring {@link #tryMirrorPush}), but INTEGRITY verdicts do — `RECONCILE_FATAL_CODES` propagates tampering evidence instead of demoting it to `skipped_error` (round 3 blocker 2). */
+    /** Best-effort envelope-recipient reconcile: availability and local-policy failures never surface as a `capture()` throw (mirroring {@link #tryMirrorPush}), but INTEGRITY verdicts do — `RECONCILE_FATAL_CODES` propagates tampering evidence instead of demoting it to `skipped_error` (round 3 blocker 2). */
     async #tryReconcileEnvelopeRecipients(vault) {
         try {
             const result = await vault.reconcileEnvelopeRecipients();
@@ -2767,12 +2769,12 @@ export class Gitvault {
         }
     }
     /**
-     * gitvault-multi-writer (task 5.7) — best-effort writer-admission
+     * vault-multi-writer (task 5.7) — best-effort writer-admission
      * reconcile, the SAME non-blocking contract as {@link
      * #tryReconcileEnvelopeRecipients} beside it: availability failures
      * (network, an older gateway missing `pending_writers`/`signing_pubkey`,
-     * a CAS-conflict-exhausted admission) never surface as a `push()`/
-     * `deploy()`/`open()` throw — `GitvaultVault.reconcileWriterAdmissions()`
+     * a CAS-conflict-exhausted admission) never surface as a `capture()`/
+     * `deploy()`/`open()` throw — `Vault.reconcileWriterAdmissions()`
      * ALREADY returns an empty result rather than throwing for the ordinary
      * "I am not a writer yet" case, so `skipped_error` here is reserved for
      * genuinely unexpected failures (a transport fault mid-loop, a thrown
@@ -2794,14 +2796,14 @@ export class Gitvault {
         }
     }
     /**
-     * A REAL preview of what {@link push} would publish
-     * — never publishes anything, and never allocates. `run402 gitvault
-     * snapshot --dry-run` and `git-remote-run402`'s `option dry-run true` are
+     * A REAL preview of what {@link capture} would publish
+     * — never publishes anything, and never allocates. `run402 repos
+     * capture --dry-run` and `git-remote-run402`'s `option dry-run true` are
      * both thin adapters over this method.
      *
      * "Refusing beats fake success" (this file's own architectural law) governs
      * the shape of what happens when the vault does not exist yet: unlike
-     * {@link push}, this NEVER allocates one (push-to-create must not allocate
+     * {@link capture}, this NEVER allocates one (push-to-create must not allocate
      * on a dry run) — it resolves READ-ONLY (`open`/`resolveOrCreateAddress`
      * with `allow_create: false`), and when that resolution misses, returns
      * `allocation_needed: true` with every sizing field `null` rather than a
@@ -2812,15 +2814,15 @@ export class Gitvault {
      *
      * Everything else is the SAME real local pipeline `push` runs — capture,
      * pack building, sealing/encryption — computed by
-     * {@link import("../node/gitvault-publication.js").GitvaultVault.planPush},
+     * {@link import("../node/vault-publication.js").Vault.planPush},
      * which is what actually stops short of the two network mutations
      * (`uploadObjects`, `admitHead`). See its doc comment for what
      * `would_admit_generation` does and does not promise.
      */
-    async planPush(options) {
-        const { captureSnapshot, gitvaultCommitLine } = await this.#snapshot();
+    async planCapture(options) {
+        const { captureSnapshot, vaultCommitLine } = await this.#snapshot();
         const repoDir = options.repo_dir ?? process.cwd();
-        // READ-ONLY resolution — mirrors `push()`'s own dispatch on `address`,
+        // READ-ONLY resolution — mirrors `capture()`'s own dispatch on `address`,
         // but with `allow_create: false` and no `openOrCreate` fallback: a dry
         // run must never mutate the control plane, and allocation is the one
         // push-time mutation that happens before a single byte is built.
@@ -2836,14 +2838,14 @@ export class Gitvault {
             handle = null; // no vault to preview a push against yet
         }
         const snapshot = await captureSnapshot({ dir: repoDir, ...(options.snapshot ?? {}) });
-        const line = gitvaultCommitLine(snapshot);
+        const line = vaultCommitLine(snapshot);
         options.onCommitLine?.(line);
         if (!handle) {
             return {
                 base_generation: null, would_admit_generation: null, would_admit_generation_decimal: null,
                 form: null, refs: {}, head_target: null, objects: [], object_count: null,
                 encrypted_bytes: null, raw_bytes: null,
-                allocation_needed: true, snapshot, gitvault_commit: snapshot.oid, gitvault_commit_line: line,
+                allocation_needed: true, snapshot, vault_commit: snapshot.oid, vault_commit_line: line,
             };
         }
         const { deployRefTransaction } = await this.#publication();
@@ -2851,15 +2853,15 @@ export class Gitvault {
         const push = {
             transaction: deployRefTransaction(materialized.refs, snapshot.oid),
             head_target: snapshot.head,
-            protocol_refs: "allow", // same opt-in `push()` makes for the SAME move — see its doc comment.
+            protocol_refs: "allow", // same opt-in `capture()` makes for the SAME move — see its doc comment.
             ...(options.checkpoint ? { checkpoint: true } : {}),
         };
         const plan = await handle.vault.planPush(push);
-        return { ...plan, allocation_needed: false, snapshot, gitvault_commit: snapshot.oid, gitvault_commit_line: line };
+        return { ...plan, allocation_needed: false, snapshot, vault_commit: snapshot.oid, vault_commit_line: line };
     }
     /**
      * Compaction's transient-storage preflight
-     * (gitvault-compaction-headroom-preflight, design D1/D2).
+     * (vault-compaction-headroom-preflight, design D1/D2).
      *
      * Three postures, in order of information quality:
      *   1. the check answers "won't fit" → typed refusal, before any upload;
@@ -2890,11 +2892,11 @@ export class Gitvault {
         return this.#readCompactHeadroom(await this.#resolveRepoId(options));
     }
     /**
-     * Open this vault's compaction headroom grant directly (gitvault-checkpoint-cadence
+     * Open this vault's compaction headroom grant directly (vault-checkpoint-cadence
      * design D3) — `compact()` already does this internally; this standalone
      * entry point exists for callers that need to inspect or drive the grant
      * without also running a full compaction cycle (tests; a future
-     * operator/diagnostic surface). Throws `GITVAULT_COMPACTION_GRANT_ACTIVE`
+     * operator/diagnostic surface). Throws `VAULT_COMPACTION_GRANT_ACTIVE`
      * (409) verbatim when another compaction already holds this project's
      * grant.
      */
@@ -2910,7 +2912,7 @@ export class Gitvault {
     /**
      * The arithmetic, with no policy: the block, or `null` when unanswerable.
      *
-     * `effectiveLimitOverride` (gitvault-checkpoint-cadence design D3): when a
+     * `effectiveLimitOverride` (vault-checkpoint-cadence design D3): when a
      * compaction grant is active for this cycle, `compact()` passes the
      * grant's `effective_pool_limit_bytes` here so `ok`/`projected_transient_bytes`
      * reflect the RAISED limit — `pool_limit_bytes` itself always stays the
@@ -2973,8 +2975,8 @@ export class Gitvault {
             throw new LocalError(`compaction needs about ${mib(sourceBytes)} of transient headroom and the org's pooled storage has ${mib(Math.max(limitForMessage - poolUsed, 0))} free ` +
                 `(${mib(poolUsed)} used of ${mib(limitForMessage)}${effectiveLimit !== undefined ? ` — includes an active compaction grant raising the ${mib(poolLimit)} tier limit` : ""}; projected ${mib(projected)}). Compaction transiently holds BOTH the new checkpoint and the ` +
                 `not-yet-pruned history — roughly 2x source_bytes — until a prune completes. Free storage, raise the tier, or re-run with --force-headroom ` +
-                `(the platform's own quota enforcement stays authoritative either way).`, "preflighting gitvault compaction storage headroom", {
-                code: "GITVAULT_COMPACT_INSUFFICIENT_HEADROOM",
+                `(the platform's own quota enforcement stays authoritative either way).`, "preflighting vault compaction storage headroom", {
+                code: "VAULT_COMPACT_INSUFFICIENT_HEADROOM",
                 details: {
                     pool_used_bytes: poolUsed,
                     pool_limit_bytes: poolLimit,
@@ -2987,10 +2989,10 @@ export class Gitvault {
         }
         return { ...headroom, overridden: !ok && ignore };
     }
-    /** A 409 `GITVAULT_COMPACTION_GRANT_ACTIVE` refusal — another compaction already holds this project's grant. */
+    /** A 409 `VAULT_COMPACTION_GRANT_ACTIVE` refusal — another compaction already holds this project's grant. */
     #isCompactionGrantActive(e) {
         const err = e;
-        return Boolean(err && err.code === "GITVAULT_COMPACTION_GRANT_ACTIVE");
+        return Boolean(err && err.code === "VAULT_COMPACTION_GRANT_ACTIVE");
     }
     /**
      * Open this vault's compaction headroom grant, shared by `compact()` and
@@ -2998,7 +3000,7 @@ export class Gitvault {
      * objects into the vault and both need the same single-flight-per-vault
      * headroom slot. Four outcomes:
      *   - opened: the grant is returned, carrying `effective_pool_limit_bytes`.
-     *   - 409 `GITVAULT_COMPACTION_GRANT_ACTIVE`: another maintenance op (this
+     *   - 409 `VAULT_COMPACTION_GRANT_ACTIVE`: another maintenance op (this
      *     process, another process, auto-gc, or a manual `repos gc`) already
      *     holds this project's one-at-a-time grant — refuse rather than race
      *     it, surfaced as the identical single-flight-conflict `LocalError`
@@ -3017,7 +3019,7 @@ export class Gitvault {
         }
         catch (e) {
             if (this.#isCompactionGrantActive(e)) {
-                throw new LocalError(`another compaction is already in progress for this vault (its headroom grant expires ${e.details?.expires_at ?? "soon"}) — refusing to race it.`, context, { code: "GITVAULT_COMPACTION_IN_PROGRESS", details: { expires_at: e.details?.expires_at ?? null } });
+                throw new LocalError(`another compaction is already in progress for this vault (its headroom grant expires ${e.details?.expires_at ?? "soon"}) — refusing to race it.`, context, { code: "VAULT_COMPACTION_IN_PROGRESS", details: { expires_at: e.details?.expires_at ?? null } });
             }
             // 404/absent-route or any other failure: proceed ungranted.
             return null;
@@ -3035,14 +3037,14 @@ export class Gitvault {
      */
     async compact(options = {}) {
         const handle = await this.open(options);
-        // gitvault-checkpoint-cadence design D3: open the compaction headroom
+        // vault-checkpoint-cadence design D3: open the compaction headroom
         // grant BEFORE the preflight (which needs its raised limit) and before
         // any checkpoint is built or uploaded — same ordering rule as the
         // preflight itself. Outcomes are documented on
-        // {@link GitvaultNamespace.#openMaintenanceGrantOrConflict}.
-        const grant = await this.#openMaintenanceGrantOrConflict(handle, "opening the gitvault compaction headroom grant");
+        // {@link VaultNamespace.#openMaintenanceGrantOrConflict}.
+        const grant = await this.#openMaintenanceGrantOrConflict(handle, "opening the vault compaction headroom grant");
         // Everything from here on is bracketed by the grant's own lifetime —
-        // including the preflight's OWN possible throw (`GITVAULT_COMPACT_
+        // including the preflight's OWN possible throw (`VAULT_COMPACT_
         // INSUFFICIENT_HEADROOM`) — so a refusal still closes a grant this call
         // opened rather than leaking it until the gateway's hourly sweep.
         try {
@@ -3056,7 +3058,7 @@ export class Gitvault {
     /** The rest of `compact()`, run under an already-opened-or-skipped grant — split out so the grant's `finally` above covers every exit path, including the preflight's own throw. */
     async #compactAfterGrant(handle, options, grant) {
         // BEFORE any checkpoint is built or uploaded (that ordering is the whole
-        // point — see GitvaultCompactHeadroom).
+        // point — see VaultCompactHeadroom).
         const headroom = await this.#compactHeadroomPreflight(handle.repo_id, options.ignoreHeadroom === true, grant?.effective_pool_limit_bytes);
         const base = await handle.vault.materialize();
         let lease = null;
@@ -3098,7 +3100,7 @@ export class Gitvault {
         finally {
             if (lease) {
                 await this.#client
-                    .request(`/gitvault/v1/vaults/${encodeURIComponent(handle.repo_id)}/maintenance-leases/${encodeURIComponent(lease.maintenance_lease_id)}`, { method: "DELETE", body: { holder_token: lease.holder_token }, context: "releasing the gitvault maintenance lease" })
+                    .request(`/vaults/v1/${encodeURIComponent(handle.repo_id)}/maintenance-leases/${encodeURIComponent(lease.maintenance_lease_id)}`, { method: "DELETE", body: { holder_token: lease.holder_token }, context: "releasing the vault maintenance lease" })
                     .catch(() => undefined);
             }
             // The compaction headroom grant (if one was opened) is closed by the
@@ -3132,13 +3134,13 @@ export class Gitvault {
     async prune(options = {}) {
         const pub = await this.#publication();
         const prune = await this.#prune();
-        const { isRootEligibleForRemoval, GITVAULT_RETENTION_MIN_DAYS } = pub;
+        const { isRootEligibleForRemoval, VAULT_RETENTION_MIN_DAYS } = pub;
         const handle = await this.open(options);
-        // gitvault-byo-primary-bucket: prune deletion on a BYO vault is not
+        // vault-byo-primary-bucket: prune deletion on a BYO vault is not
         // shipped (the gateway's worker deletes from run402's own storage, which
         // holds none of this vault's payload; client-executed deletion is the
         // open design item), and the gateway refuses an intent by name
-        // (GITVAULT_BYO_PRUNE_NOT_SUPPORTED). Say so before any planning or
+        // (VAULT_BYO_PRUNE_NOT_SUPPORTED). Say so before any planning or
         // ceremony — a plan here would only invite a refused submit.
         const record = await handle.vault.transport.getVaultRecord({ repo_id: handle.repo_id });
         if (record.storage_profile === "byo") {
@@ -3148,7 +3150,7 @@ export class Gitvault {
                 retained_count: 0,
                 object_candidates: [],
                 deferred_object_count: 0,
-                blocked_reason: "this vault keeps its payload in your own bucket (storage_profile byo); run402 cannot delete from a bucket it holds no credential to, and client-executed prune deletion has not shipped — the gateway refuses a prune intent on a BYO vault by name (GITVAULT_BYO_PRUNE_NOT_SUPPORTED); compaction still works and superseded history stays in your bucket",
+                blocked_reason: "this vault keeps its payload in your own bucket (storage_profile byo); run402 cannot delete from a bucket it holds no credential to, and client-executed prune deletion has not shipped — the gateway refuses a prune intent on a BYO vault by name (VAULT_BYO_PRUNE_NOT_SUPPORTED); compaction still works and superseded history stays in your bucket",
                 intent_core: null,
                 intent_core_sha256: null,
                 attestation: null,
@@ -3173,8 +3175,8 @@ export class Gitvault {
                 reason: admittedAt === null
                     ? "this client cannot resolve the drop's effective_admitted_at, which RETAINS the root — expiry is permissive by design"
                     : eligible
-                        ? `dropped more than ${GITVAULT_RETENTION_MIN_DAYS} days before the cutoff; removable at the next checkpoint-bearing generation, then at the next successful prune`
-                        : `still inside the ${GITVAULT_RETENTION_MIN_DAYS}-day retention window`,
+                        ? `dropped more than ${VAULT_RETENTION_MIN_DAYS} days before the cutoff; removable at the next checkpoint-bearing generation, then at the next successful prune`
+                        : `still inside the ${VAULT_RETENTION_MIN_DAYS}-day retention window`,
             };
         });
         const rootView = {
@@ -3275,8 +3277,8 @@ export class Gitvault {
             // the SDK never signs an attestation it did not earn.
             retention_evolution_ok: rootsEvolution.ok && attestation.object_set_matches && attestation.ref_state_matches && attestation.retention_roots_matches,
             candidates_outside_roots_ok: outsideRoots,
-            implementation_id: prune.GITVAULT_SDK_VERIFIER_IMPLEMENTATION,
-            implementation_version: prune.GITVAULT_SDK_VERIFIER_VERSION,
+            implementation_id: prune.VAULT_SDK_VERIFIER_IMPLEMENTATION,
+            implementation_version: prune.VAULT_SDK_VERIFIER_VERSION,
         }, handle.vault.signer());
         const intent = prune.buildPruneIntent(core, [ours, options.submit.verifier_receipt], handle.vault.signer());
         // The submission writes ~8 KB of ceremony
@@ -3287,7 +3289,7 @@ export class Gitvault {
         // the SAME compaction headroom grant `compact()` uses (design D3, via
         // the shared `#openMaintenanceGrantOrConflict`) — opened before the
         // upload, closed in a `finally` regardless of outcome.
-        const grant = await this.#openMaintenanceGrantOrConflict(handle, "opening the gitvault compaction headroom grant for prune submission");
+        const grant = await this.#openMaintenanceGrantOrConflict(handle, "opening the vault compaction headroom grant for prune submission");
         let stored;
         try {
             await this.#uploadVerifierReceipts(handle, pub, [ours, options.submit.verifier_receipt]);
@@ -3320,11 +3322,11 @@ export class Gitvault {
     }
     /** Upload both receipts so the gateway can claim them at the intent's fence. */
     async #uploadVerifierReceipts(handle, pub, receipts) {
-        const { storedBytes, sha256Hex } = await import("./gitvault.crypto.js");
+        const { storedBytes, sha256Hex } = await import("./vault.crypto.js");
         const objects = receipts.map((r) => {
             const bytes = storedBytes(r);
             return {
-                path: pub.gitvaultPaths.verifierReceipt(r.object_id),
+                path: pub.vaultPaths.verifierReceipt(r.object_id),
                 object_kind: "verifier_receipt",
                 object_id: r.object_id,
                 bytes,
@@ -3363,7 +3365,7 @@ export class Gitvault {
                     continue; // identical bytes already landed — nothing to do
                 throw new LocalError(existing
                     ? `verifier receipt ${o.object_id} already exists in the vault with DIFFERENT bytes than this attempt's (stored sha256 ${existingSha256}, this attempt's sha256 ${o.sha256}) — the object id is burned and cannot be reused; re-plan the prune (new core, new nonce, new r402s-verify run).`
-                    : `verifier receipt ${o.object_id} was refused as an already-used id, but its stored bytes could not be read back to confirm they match — re-plan the prune.`, "uploading gitvault verifier receipts", { code: "GITVAULT_RECEIPT_ID_REUSED_DIFFERENT", details: { object_id: o.object_id, existing_sha256: existingSha256, this_attempt_sha256: o.sha256 } });
+                    : `verifier receipt ${o.object_id} was refused as an already-used id, but its stored bytes could not be read back to confirm they match — re-plan the prune.`, "uploading vault verifier receipts", { code: "VAULT_RECEIPT_ID_REUSED_DIFFERENT", details: { object_id: o.object_id, existing_sha256: existingSha256, this_attempt_sha256: o.sha256 } });
             }
             // Every reused id was confirmed identical to ours; anything NOT
             // reused (a genuinely new upload, or the other side of a partial
@@ -3374,7 +3376,7 @@ export class Gitvault {
     }
     /**
      * `VALIDATION_FAILED` with `details.reused_object_ids`
-     * (`services/gitvault/upload-sessions.ts`: "an object id in the manifest is
+     * (`services/vault/upload-sessions.ts`: "an object id in the manifest is
      * already used") — object ids a prior attempt already landed. `null` for
      * any other failure, so the caller rethrows it untouched.
      */
@@ -3439,16 +3441,16 @@ export class Gitvault {
      * bare "verified": `chain_verified_to_generation` and
      * `decryptable_to_generation` are reported separately and can genuinely
      * differ — the incident-shape truth ("chain verified to 10, decryptable
-     * to 7, `GITVAULT_EPOCH_NOT_OPENABLE` at epoch 2/rotation …") is exactly
+     * to 7, `VAULT_EPOCH_NOT_OPENABLE` at epoch 2/rotation …") is exactly
      * what this split makes representable. `refs`/`head_target`/
      * `pin_after.highest_materialized` all reflect `decryptable_to_generation`.
      *
-     * **gitvault-byo-primary-bucket task 3.3 (design D6).** For a
+     * **vault-byo-primary-bucket task 3.3 (design D6).** For a
      * `storage_profile: "byo"` vault, `fsck` ALSO adjudicates the customer's
      * own bucket against run402's signed chain — see {@link
      * #checkByoPresence} for the full contract (automatic, never a flag;
      * fails soft with no local credentials; throws
-     * `GITVAULT_BYO_OBJECT_MISSING` on a confirmed absence). A managed vault
+     * `VAULT_BYO_OBJECT_MISSING` on a confirmed absence). A managed vault
      * is byte-identical to before this task.
      */
     async fsck(options = {}) {
@@ -3457,10 +3459,10 @@ export class Gitvault {
         if (!repoId) {
             throw new LocalError(options.repo_id || options.project_id
                 ? "no vault is allocated for this project yet — nothing to fsck"
-                : "pass repo_id, or project_id to resolve it from the control plane", "running gitvault fsck", { code: "GITVAULT_VAULT_UNRESOLVED", details: { project_id: options.project_id ?? null } });
+                : "pass repo_id, or project_id to resolve it from the control plane", "running vault fsck", { code: "VAULT_UNRESOLVED", details: { project_id: options.project_id ?? null } });
         }
         const write = options.write ?? true;
-        // gitvault-agent-envelopes D5: fsck is observational — it never wraps an
+        // vault-agent-envelopes D5: fsck is observational — it never wraps an
         // envelope, in write mode or not. Investigating a suspicious pending
         // recipient must not complete the disclosure being investigated.
         const handle = await this.open({ ...options, repo_id: repoId, reconcile: "forbidden" });
@@ -3497,7 +3499,7 @@ export class Gitvault {
             chain_verified_to_generation: state.generation,
             decryptable_to_generation: decryptableToGeneration,
         });
-        // gitvault-byo-primary-bucket task 3.3 (design D6) — LAST, deliberately:
+        // vault-byo-primary-bucket task 3.3 (design D6) — LAST, deliberately:
         // everything above (chain verify + its pin persist, retained-refs
         // reconcile, open-proof submission) is real, valid work regardless of
         // what the customer's own bucket holds — the signed chain is run402-
@@ -3538,13 +3540,13 @@ export class Gitvault {
             evidence,
             resolvePrincipalId: async () => {
                 const who = await this.#client.request("/agent/v1/whoami", {
-                    context: "resolving this principal's identity for a gitvault proof-of-open submission",
+                    context: "resolving this principal's identity for a vault proof-of-open submission",
                 });
                 return who.principal?.id ?? null;
             },
             readerEntrypoint: async () => {
-                const { gitvaultReaderEntrypoint } = await this.#publication();
-                return gitvaultReaderEntrypoint("fsck");
+                const { vaultReaderEntrypoint } = await this.#publication();
+                return vaultReaderEntrypoint("fsck");
             },
             submit: (principalId, ekFingerprint, ev) => this.submitProofOfOpen(repoId, principalId, {
                 ek_fingerprint: ekFingerprint,
@@ -3555,9 +3557,9 @@ export class Gitvault {
         });
     }
     /**
-     * gitvault-byo-primary-bucket task 3.3 (design D6) — `repos fsck`'s
+     * vault-byo-primary-bucket task 3.3 (design D6) — `repos fsck`'s
      * wiring of the shipped read-half primitive
-     * {@link import("../node/gitvault-mirror.js").verifyByoObjectsPresent}.
+     * {@link import("../node/vault-mirror.js").verifyByoObjectsPresent}.
      * Thin wrapper over {@link computeByoPresenceOutcome} (the testable
      * decision function, factored out the same way {@link
      * computeOpenProofOutcome} is factored out of `#submitFsckOpenProof`)
@@ -3579,23 +3581,21 @@ export class Gitvault {
     /**
      * Wrap this vault's current epoch key to every org member who has
      * published an encryption key but has no `key_envelope` on this vault yet
-     * — gitvault-human-envelopes task 4.1's ADD-path workaround. See {@link
-     * import("../node/gitvault-publication.js").GitvaultVault.
+     * — vault-human-envelopes task 4.1's ADD-path workaround. See {@link
+     * import("../node/vault-publication.js").Vault.
      * reconcileEnvelopeRecipients} for the full design (TOFU pinning, the
      * gateway `public_key` gap, and why this is a workaround rather than the
      * eventual epoch-rotation design).
      *
-     * `run402 gitvault reconcile` has no `repos` equivalent — `reconcile` is
-     * a workaround, not a permanent verb — and answers `COMMAND_REMOVED`
-     * pointing at `repos access` for inspection. This method itself stays:
-     * `deploy()` runs it, best-effort,
+     * No CLI verb runs this directly — `repos access` is the inspection
+     * read. `deploy()` runs it, best-effort,
      * whenever a deploy lands a new generation in the vault — design D5's
      * "deploy time" hook, "the same 'one command every agent runs' argument
-     * that decided deploy-implies-capture." `push()` (capture-and-publish
+     * that decided deploy-implies-capture." `capture()` (capture-and-publish
      * outside a deploy) runs the identical hook after every successful
      * publish, for the vault-only-project cadence. See
      * `#tryReconcileEnvelopeRecipients` below for both call sites, and
-     * {@link Gitvault.access} for the READ half repo-surface-consolidation
+     * {@link Repos.access} for the READ half repo-surface-consolidation
      * ships in its place.
      */
     async reconcileEnvelopeRecipients(options = {}) {
@@ -3603,12 +3603,12 @@ export class Gitvault {
         return handle.vault.reconcileEnvelopeRecipients();
     }
     /**
-     * gitvault-multi-writer (task 5.7) — admit every eligible `pending_writers[]`
+     * vault-multi-writer (task 5.7) — admit every eligible `pending_writers[]`
      * candidate (active org membership at role developer+, a published,
      * possession-verified signing key, not yet in the writer set) via a fresh
      * `add_writer_key{"writer"}` head per candidate. This session's OWN key
      * must already be an active writer — see {@link
-     * import("../node/gitvault-publication.js").GitvaultVault.
+     * import("../node/vault-publication.js").Vault.
      * reconcileWriterAdmissions}'s doc comment for why that is checked
      * locally, once, rather than surfaced as N identical gateway refusals.
      *
@@ -3631,7 +3631,7 @@ export class Gitvault {
      * `rotation_attempt_descriptor`, submit the `rotate_epoch` head, verify
      * this principal's own envelope opens to the committed key (when it is
      * itself a recipient), and advance the local keystore's epoch pointer.
-     * See {@link import("../node/gitvault-publication.js").GitvaultVault.
+     * See {@link import("../node/vault-publication.js").Vault.
      * rotateEpoch}'s own doc comment for the full obligations and — load-
      * bearing — the confirmed gap in what the gateway exposes for
      * `recipient_state_version`/`recipient_revocation_version` outside the
@@ -3654,9 +3654,9 @@ export class Gitvault {
      */
     /**
      * The writer-capable rotation that completes an org membership removal
-     * (`reason:"member_removed"`, gitvault-multi-writer D6): counters come off
+     * (`reason:"member_removed"`, vault-multi-writer D6): counters come off
      * the envelope-recipients read, no declaration, no owner step-up — any
-     * surviving writer can run it. `push()` runs it automatically when the
+     * surviving writer can run it. `capture()` runs it automatically when the
      * gate names an outstanding removal; this is the explicit entry point
      * (`run402 orgs members rm` drives it on every vault the caller can).
      */
@@ -3693,19 +3693,19 @@ export class Gitvault {
     /**
      * `EPOCH_ROTATION_REQUIRED` from a `publishPinManifestUpdate` call names
      * the SAME three causes {@link #enrichEpochRotationRequired} decodes for
-     * `push()`, but the remedy is different: a manifest-only publish should
+     * `capture()`, but the remedy is different: a manifest-only publish should
      * fold into the NEXT `rotateEpoch` call via `pending_confirmations`
      * rather than run a separate migration/revocation/exposure rotation
      * first and publish again afterward — one admission instead of two, and
      * the only path that works at all while EVERY predecessor-confirmed
-     * principal is already exhausted (see `GitvaultVault.rotateEpoch`'s own
+     * principal is already exhausted (see `Vault.rotateEpoch`'s own
      * doc comment for the honest residual: this does not rescue a vault with
      * zero ever-confirmed principals, which needs an operator-side fix).
      */
     #enrichEpochRotationRequiredForPinManifest(e, repoId) {
         if (!isRun402Error(e) || e.code !== "EPOCH_ROTATION_REQUIRED")
             return e;
-        return new LocalError(`this vault requires a rotate_epoch admission before an ordinary pin-manifest publish is admissible (repo_id ${repoId}) — fold this SAME receipt into rotateEpoch({..., pending_confirmations: [{principal_id, ek_fingerprint, receipt}]}) instead of retrying this call`, "publishing a recipient_pin_manifest update", { code: "EPOCH_ROTATION_REQUIRED", details: e.details, next_actions: [{ action: "r.gitvault.rotateEpoch({..., pending_confirmations: [{principal_id, ek_fingerprint, receipt}]})", why: "the manifest publish rides the SAME head as the required rotation, which is EPOCH_ROTATION_REQUIRED's own escape valve — a standalone publish never is" }], cause: e });
+        return new LocalError(`this vault requires a rotate_epoch admission before an ordinary pin-manifest publish is admissible (repo_id ${repoId}) — fold this SAME receipt into rotateEpoch({..., pending_confirmations: [{principal_id, ek_fingerprint, receipt}]}) instead of retrying this call`, "publishing a recipient_pin_manifest update", { code: "EPOCH_ROTATION_REQUIRED", details: e.details, next_actions: [{ action: "r.repos.rotateEpoch({..., pending_confirmations: [{principal_id, ek_fingerprint, receipt}]})", why: "the manifest publish rides the SAME head as the required rotation, which is EPOCH_ROTATION_REQUIRED's own escape valve — a standalone publish never is" }], cause: e });
     }
     /**
      * `repos access` (repo-surface-consolidation D5/D10) — a READ-ONLY report
@@ -3713,15 +3713,15 @@ export class Gitvault {
      * surface exposes today. Never wraps, never mutates a `key_envelope` —
      * that mutating half stays {@link reconcileEnvelopeRecipients}, reachable
      * only through the deploy/push best-effort hooks until `access repair`
-     * ships (gated on `gitvault-human-envelopes`' epoch-rotation work). See
-     * {@link GitvaultAccessResult}'s doc comment for the honest gap this
+     * ships (gated on `vault-human-envelopes`' epoch-rotation work). See
+     * {@link VaultAccessResult}'s doc comment for the honest gap this
      * reports rather than invents.
      */
     async access(options = {}) {
         const repoId = await this.#resolveRepoId(options);
         const record = await this.get(repoId).catch(() => null);
         const orgId = record?.org_id ?? null;
-        // gitvault-agent-envelopes D3/D5: `access` is one of the ordinary reads a
+        // vault-agent-envelopes D3/D5: `access` is one of the ordinary reads a
         // KEY-HOLDER's session starts with — enroll this keystore's key if absent
         // and fulfil every pending desired recipient once per process, BEFORE the
         // roster below is read, so the roster reflects the fulfilment. Reported,
@@ -3731,8 +3731,8 @@ export class Gitvault {
         let enrollment = null;
         if (options.reconcile !== "forbidden") {
             try {
-                const { GitvaultKeystore } = await this.#keystore();
-                const probe = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+                const { VaultKeystore } = await this.#keystore();
+                const probe = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
                 if (probe.readRepo(repoId)) {
                     const handle = await this.open({ ...options, repo_id: repoId });
                     reconcileRecipients = handle.reconcile_recipients;
@@ -3747,10 +3747,10 @@ export class Gitvault {
             orgId
                 ? this.#client.request(`/orgs/v1/${encodeURIComponent(orgId)}/encryption-keys`, { context: "reading the org encryption-key directory" })
                 : Promise.resolve({ org_id: "", keys: [] }),
-            this.#client.request(`/gitvault/v1/vaults/${encodeURIComponent(repoId)}/envelope-recipients`, { context: "reading the gitvault envelope recipients" }),
+            this.#client.request(`/vaults/v1/${encodeURIComponent(repoId)}/envelope-recipients`, { context: "reading the vault envelope recipients" }),
         ]);
         const covered = new Set(coverage.recipient_fingerprints);
-        // `desired` is OPTIONAL on the wire (see GitvaultEnvelopeRecipientsResponse):
+        // `desired` is OPTIONAL on the wire (see VaultEnvelopeRecipientsResponse):
         // absent means an older gateway that predates this field — genuinely
         // unknown, not "no desired recipients." Distinguish "absent" from
         // "present and empty" via the array itself, not a boolean flag, so a
@@ -3770,8 +3770,8 @@ export class Gitvault {
         let pins = {};
         let ownFingerprint = null;
         try {
-            const { GitvaultKeystore } = await this.#keystore();
-            const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+            const { VaultKeystore } = await this.#keystore();
+            const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
             pins = keystore.readRepo(repoId)?.envelope_recipient_pins ?? {};
             ownFingerprint = keystore.readIdentity()?.encryption_fingerprint ?? null;
         }
@@ -3794,8 +3794,8 @@ export class Gitvault {
         const directoryFingerprints = new Set(directory.keys.map((k) => k.ek_fingerprint));
         // Removed members (desired status pending_removal) whose fingerprint is
         // STILL covered: real, continuing access that membership removal did not
-        // revoke, because gitvault v0 has no epoch-rotation mechanism yet. See
-        // GitvaultAccessResult's doc comment.
+        // revoke, because vault v0 has no epoch-rotation mechanism yet. See
+        // VaultAccessResult's doc comment.
         const staleAccess = (desiredList ?? [])
             .filter((d) => d.status === "pending_removal" && d.ek_fingerprint != null && covered.has(d.ek_fingerprint))
             .map((d) => ({ principal_id: d.principal_id, display_name: d.display_name, fingerprint: d.ek_fingerprint }));
@@ -3810,7 +3810,7 @@ export class Gitvault {
         // not orphaned/external, it is provably this machine, so it is broken
         // out into `this_keystore` instead of left to read as a misconfiguration.
         const unmatchedRaw = coverage.recipient_fingerprints.filter((fp) => !directoryFingerprints.has(fp) && !staleAccessFingerprints.has(fp));
-        // gitvault-agent-envelopes: THIS machine's keystore is reported for every
+        // vault-agent-envelopes: THIS machine's keystore is reported for every
         // principal type — enrolled or not, covered or not — never `null` for a
         // real keystore (only when there is no local identity at all). The
         // directory now lists agent keys too, so "own fingerprint in the
@@ -3837,7 +3837,7 @@ export class Gitvault {
                 ...(!covered.has(ownFingerprint) && publishState === "active"
                     ? { next_actions: [
                             { action: "run402 repos access", why: "poll — covered_on_this_vault flips true once a key-holder has wrapped this vault to your key" },
-                            { action: "ask a key-holder to run any gitvault operation (run402 repos view / git push)", why: "a key-holding client wraps every pending desired recipient on its next operation" },
+                            { action: "ask a key-holder to run any vault operation (run402 repos view / git push)", why: "a key-holding client wraps every pending desired recipient on its next operation" },
                         ] }
                     : {}),
                 ...(publishState === "rotation_required"
@@ -3856,7 +3856,7 @@ export class Gitvault {
                 "covered:true they still decrypt this vault until an owner runs `repos access repair` (or, for a targeted key, `repos access " +
                 "revoke-key`); see stale_access for exactly who, and next_actions for the exact command."
             : "the gateway did not report desired-recipient state (desired[]) for this vault_id — likely an older gateway than this SDK " +
-                "expects, so per-recipient envelope_state and stale_access are unavailable. history_scope is unavailable regardless: gitvault " +
+                "expects, so per-recipient envelope_state and stale_access are unavailable. history_scope is unavailable regardless: vault " +
                 "protocol v0 pins a single fixed epoch, so there is no per-epoch scope to report. This reports what the read surface has today: " +
                 "the org's directory of encryption-key-holding members, which of the vault's current envelope-recipient fingerprints match a " +
                 "directory entry (covered), and this machine's own local TOFU pin per principal when it has ever wrapped one (tofu_pin) — never a server-side fact.";
@@ -3895,31 +3895,31 @@ export class Gitvault {
      * `run402 deploy` is design D5's PRIMARY envelope-recipient reconcile hook
      * ("the same 'one command every agent runs' argument that decided
      * deploy-implies-capture") and design D6's primary dual-push mirror trigger
-     * — both fire HERE, not inside {@link runGitvaultDeploy} itself, mirroring
-     * {@link push}'s exact non-blocking contract: best-effort, NEVER throw,
+     * — both fire HERE, not inside {@link runVaultDeploy} itself, mirroring
+     * {@link capture}'s exact non-blocking contract: best-effort, NEVER throw,
      * NEVER alter the deploy outcome already resolved above, reported BESIDE it
      * on `mirror_push` / `reconcile_recipients`. They fire only when this
      * deploy actually landed a new generation in the vault
      * (`DEPLOYED_AND_VAULTED` / `DEPLOY_FAILED_VAULTED` — the outcomes carrying
      * a `generation`); the other three outcomes published nothing new, so
      * there is nothing to mirror or reconcile against ({@link
-     * import("../node/gitvault-mirror.js").mirrorPushForGeneration}'s own
+     * import("../node/vault-mirror.js").mirrorPushForGeneration}'s own
      * contract: "fires after an ordinary vault push/deploy produces a new
      * generation"). Both fields are therefore OMITTED — never a faked
      * `skipped_*` outcome — when no generation landed.
      */
     async deploy(options) {
-        const { runGitvaultDeploy } = await this.#deploy();
+        const { runVaultDeploy } = await this.#deploy();
         const handle = await this.open(options);
-        const result = await runGitvaultDeploy({ ...options, vault: handle.vault, repo_dir: options.repo_dir ?? process.cwd() });
-        // Same ordering push() uses (mirror, then reconcile) — sequential, not
+        const result = await runVaultDeploy({ ...options, vault: handle.vault, repo_dir: options.repo_dir ?? process.cwd() });
+        // Same ordering capture() uses (mirror, then reconcile) — sequential, not
         // Promise.all, so a reconcile failure can never be misread as a mirror
         // failure in a log line that assumed ordering. Extracted to a standalone
         // function so the outcome-gating is unit-testable with fake thunks,
-        // without standing up a live vault — see gitvault-deploy-hooks.test.ts.
-        const hooked = await attachGitvaultDeployHooks(result, () => this.#tryMirrorPush(handle.repo_id, handle.keystore), () => this.#tryReconcileEnvelopeRecipients(handle.vault));
-        // gitvault-byo-primary-bucket task 3.3 / gitvault-multi-writer task 5.7
-        // — composed AFTER, not inside, `attachGitvaultDeployHooks` (kept
+        // without standing up a live vault — see repos-deploy-hooks.test.ts.
+        const hooked = await attachVaultDeployHooks(result, () => this.#tryMirrorPush(handle.repo_id, handle.keystore), () => this.#tryReconcileEnvelopeRecipients(handle.vault));
+        // vault-byo-primary-bucket task 3.3 / vault-multi-writer task 5.7
+        // — composed AFTER, not inside, `attachVaultDeployHooks` (kept
         // untouched so its own unit-tested outcome-gating contract stays
         // byte-for-byte): the SAME "did this deploy actually land a generation"
         // gate `mirror_push`'s presence already encodes, so no new
@@ -3948,14 +3948,14 @@ export class Gitvault {
         const out = await handle.vault.restoreObjectsInto(options.target_dir);
         return { refs: out.refs, generation: out.generation, retained_refs: out.retained_refs };
     }
-    // ── degraded read (gitvault-byo-primary-bucket, design D4, task 3.4 — mirror half) ──
+    // ── degraded read (vault-byo-primary-bucket, design D4, task 3.4 — mirror half) ──
     /**
      * Wrap an ALREADY-RESOLVED vault read with degraded-read fallback: run
      * `options.attemptLive` (the caller's own live call — its
      * `vault.materialize()` for a `list`-shaped read, or
      * `vault.restoreObjectsInto(dir)` for a `fetch`-shaped one), and on a
      * network-class failure (never on an authorization refusal or any other
-     * 4xx — see `isNetworkClassGitvaultReadError`), fall back to the vault's
+     * 4xx — see `isNetworkClassVaultReadError`), fall back to the vault's
      * configured mirror via the SAME `r402s-recover` engine `recover()` uses.
      *
      * Deliberately takes an already-open `vault`/`keystore`/`repo_id` rather
@@ -3974,17 +3974,17 @@ export class Gitvault {
      * entirely: the original gateway error surfaces exactly as it always did.
      */
     async withDegradedRead(options) {
-        const { tryGitvaultDegradedRead } = await this.#degradedRead();
-        return tryGitvaultDegradedRead(options);
+        const { tryVaultDegradedRead } = await this.#degradedRead();
+        return tryVaultDegradedRead(options);
     }
     /**
-     * gitvault-byo-primary-bucket (design D4): the degraded read for the OPEN
+     * vault-byo-primary-bucket (design D4): the degraded read for the OPEN
      * itself. {@link withDegradedRead} wraps a handle's live read, but a plain
      * `git fetch`/`clone` needs the gateway once BEFORE any read — to open the
      * handle (enrollment, the vault record). When that open fails
      * network-class and this checkout already knows the vault — a pinned
      * `repo_id`, or the keystore's own project→repo file for an id-form
-     * address (gitvault-offline-clone-resolve) — the whole read is served from
+     * address (vault-offline-clone-resolve) — the whole read is served from
      * the vault's BYO destination or configured mirror, exactly as
      * `withDegradedRead` would have after a failed live read. `null` when this
      * cannot help (a non-network failure, no local identity for the vault, no
@@ -3992,13 +3992,13 @@ export class Gitvault {
      * Writes are never rerouted.
      */
     async degradedOpenFallback(input) {
-        const [{ isNetworkClassGitvaultReadError, tryGitvaultDegradedRead }, { GitvaultKeystore }, { readPinnedGitvaultRepo, resolveGitvaultAddress }, { createGitvaultHttpTransport }] = await Promise.all([this.#degradedRead(), this.#keystore(), this.#address(), this.#publication()]);
-        if (!isNetworkClassGitvaultReadError(input.error))
+        const [{ isNetworkClassVaultReadError, tryVaultDegradedRead }, { VaultKeystore }, { readPinnedVaultRepo, resolveVaultAddress }, { createVaultHttpTransport }] = await Promise.all([this.#degradedRead(), this.#keystore(), this.#address(), this.#publication()]);
+        if (!isNetworkClassVaultReadError(input.error))
             return null;
-        const keystore = new GitvaultKeystore({});
+        const keystore = new VaultKeystore({});
         let repoId = input.repo_id ?? null;
         if (!repoId) {
-            const pinned = await readPinnedGitvaultRepo(input.repo_dir).catch(() => null);
+            const pinned = await readPinnedVaultRepo(input.repo_dir).catch(() => null);
             repoId = pinned?.repo_id ?? null;
         }
         if (!repoId && input.address) {
@@ -4007,7 +4007,7 @@ export class Gitvault {
             // here for the same reason the open did, and that is the answer: no
             // local identity, nothing to serve from.
             try {
-                const resolution = await resolveGitvaultAddress({ keystore, transport: createGitvaultHttpTransport(this.#client), address: input.address, repo_dir: input.repo_dir, allow_create: false });
+                const resolution = await resolveVaultAddress({ keystore, transport: createVaultHttpTransport(this.#client), address: input.address, repo_dir: input.repo_dir, allow_create: false });
                 if (resolution.offline)
                     repoId = resolution.repo_id;
             }
@@ -4018,13 +4018,13 @@ export class Gitvault {
         if (!repoId)
             return null;
         try {
-            return await tryGitvaultDegradedRead({ attemptLive: () => Promise.reject(input.error), keystore, repo_id: repoId, out_dir: input.repo_dir });
+            return await tryVaultDegradedRead({ attemptLive: () => Promise.reject(input.error), keystore, repo_id: repoId, out_dir: input.repo_dir });
         }
         catch {
             return null;
         }
     }
-    // ── mirror (gitvault-mirror-and-recover, design D1/D2/D7) ─────────────────
+    // ── mirror (vault-mirror-and-recover, design D1/D2/D7) ─────────────────
     /**
      * Configure (or replace) the customer-owned mirror destination for one
      * vault. Client-side ONLY — the destination + credential NAME are written
@@ -4033,17 +4033,17 @@ export class Gitvault {
      * filesystem path needs none.
      */
     async mirrorSet(options) {
-        const [{ GitvaultKeystore }, { parseMirrorDestinationUrl, saveMirrorConfig }] = await Promise.all([this.#keystore(), this.#mirrorConfig()]);
+        const [{ VaultKeystore }, { parseMirrorDestinationUrl, saveMirrorConfig }] = await Promise.all([this.#keystore(), this.#mirrorConfig()]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const destination = parseMirrorDestinationUrl(options.destination_url, { region: options.region, endpoint: options.endpoint });
         return saveMirrorConfig(keystore, { repo_id: repoId, destination, ...(options.credential ? { credential: options.credential } : {}) });
     }
     /** Remove the mirror config for one vault. Never touches the mirror's own bytes (design: config removal ≠ data deletion). */
     async mirrorRemove(options = {}) {
-        const [{ GitvaultKeystore }, { removeMirrorConfig }] = await Promise.all([this.#keystore(), this.#mirrorConfig()]);
+        const [{ VaultKeystore }, { removeMirrorConfig }] = await Promise.all([this.#keystore(), this.#mirrorConfig()]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         return { repo_id: repoId, ...removeMirrorConfig(keystore, repoId) };
     }
     /**
@@ -4054,31 +4054,31 @@ export class Gitvault {
      * command. Both honesty statements (design D8) ride every response.
      */
     async mirrorStatus(options = {}) {
-        const [{ GitvaultKeystore }, { readMirrorConfig, formatMirrorDestination }, { openGitvaultMirrorBackend }, { verifyGitvaultMirror }] = await Promise.all([
+        const [{ VaultKeystore }, { readMirrorConfig, formatMirrorDestination }, { openVaultMirrorBackend }, { verifyVaultMirror }] = await Promise.all([
             this.#keystore(), this.#mirrorConfig(), this.#mirrorBackend(), this.#recovery(),
         ]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const config = readMirrorConfig(keystore, repoId);
-        const base = { repo_id: repoId, validity_not_freshness: GITVAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, keystore_still_required: GITVAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT };
+        const base = { repo_id: repoId, validity_not_freshness: VAULT_MIRROR_VALIDITY_NOT_FRESHNESS_STATEMENT, keystore_still_required: VAULT_MIRROR_KEYSTORE_STILL_REQUIRED_STATEMENT };
         const lastSuccessAt = config?.last_success_at ?? null;
         if (!config) {
-            // gitvault-mirror-default: the unconfigured branch stays gateway-blind
+            // vault-mirror-default: the unconfigured branch stays gateway-blind
             // by construction — it returns before ANY network call, finding included.
-            // `options.is_byo` is a caller-supplied hint (gitvault-byo-primary-bucket
+            // `options.is_byo` is a caller-supplied hint (vault-byo-primary-bucket
             // task 3.5) — NEVER derived here, which is what keeps this branch
             // network-call-free; `repos view` already has `storage_profile` from
             // its own `status()` read and passes it in.
             return {
                 ...base, configured: false, destination: null, credential_kind: null, mirrored_generation: null, newest_generation: null, is_current: null, closing_command: null,
                 last_success_at: lastSuccessAt,
-                finding: gitvaultUnmirroredFinding({ configured: false, last_success_at: lastSuccessAt, mirrored_generation: null, is_byo: options.is_byo }),
+                finding: vaultUnmirroredFinding({ configured: false, last_success_at: lastSuccessAt, mirrored_generation: null, is_byo: options.is_byo }),
             };
         }
         let mirroredGeneration = null;
         try {
-            const backend = openGitvaultMirrorBackend(config.destination, repoId, config.credential);
-            const report = await verifyGitvaultMirror(backend, { keystore });
+            const backend = openVaultMirrorBackend(config.destination, repoId, config.credential);
+            const report = await verifyVaultMirror(backend, { keystore });
             mirroredGeneration = report.recovered_generation;
         }
         catch {
@@ -4097,28 +4097,28 @@ export class Gitvault {
             mirrored_generation: mirroredGeneration, newest_generation: newestGeneration, is_current: isCurrent,
             closing_command: isCurrent === false ? "run402 repos mirror --backfill" : null,
             last_success_at: lastSuccessAt,
-            finding: gitvaultUnmirroredFinding({ configured: true, last_success_at: lastSuccessAt, mirrored_generation: mirroredGeneration, is_byo: options.is_byo }),
+            finding: vaultUnmirroredFinding({ configured: true, last_success_at: lastSuccessAt, mirrored_generation: mirroredGeneration, is_byo: options.is_byo }),
         };
     }
     /** List the vault's stored objects, diff against the mirror, fetch + hash-verify + write what's missing, in admission order. Resumable and idempotent. */
     async mirrorSync(options = {}) {
-        const [{ GitvaultKeystore }, { mirrorSync }] = await Promise.all([this.#keystore(), this.#mirror()]);
+        const [{ VaultKeystore }, { mirrorSync }] = await Promise.all([this.#keystore(), this.#mirror()]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         return mirrorSync(this.#client, repoId, { keystore });
     }
     /** Keyless integrity probe against the CONFIGURED mirror: discovery + chain verification + closure/absence adjudication, never decryption (`run402 repos fsck --mirror`). */
     async mirrorVerify(options = {}) {
-        const [{ GitvaultKeystore }, { readMirrorConfig }, { openGitvaultMirrorBackend }, { verifyGitvaultMirror }] = await Promise.all([
+        const [{ VaultKeystore }, { readMirrorConfig }, { openVaultMirrorBackend }, { verifyVaultMirror }] = await Promise.all([
             this.#keystore(), this.#mirrorConfig(), this.#mirrorBackend(), this.#recovery(),
         ]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const config = readMirrorConfig(keystore, repoId);
         if (!config)
-            throw new LocalError(`no mirror is configured for ${repoId}`, "verifying gitvault mirror", { code: "GITVAULT_MIRROR_NOT_CONFIGURED", details: { repo_id: repoId }, next_actions: [{ action: "run402 repos mirror <destination>" }] });
-        const backend = openGitvaultMirrorBackend(config.destination, repoId, config.credential);
-        return verifyGitvaultMirror(backend, { keystore });
+            throw new LocalError(`no mirror is configured for ${repoId}`, "verifying vault mirror", { code: "VAULT_MIRROR_NOT_CONFIGURED", details: { repo_id: repoId }, next_actions: [{ action: "run402 repos mirror <destination>" }] });
+        const backend = openVaultMirrorBackend(config.destination, repoId, config.credential);
+        return verifyVaultMirror(backend, { keystore });
     }
     /**
      * `r402s-recover` (design D4): rebuild a working git repository straight
@@ -4127,7 +4127,7 @@ export class Gitvault {
      * than one mirrored vault, pass `repo_id` explicitly. Recovery proves
      * validity, never freshness (both honesty statements ride every result).
      *
-     * gitvault-recovery-custody: a human member with no keystore recovers with
+     * vault-recovery-custody: a human member with no keystore recovers with
      * `member_bundle` (the exported `r402s-member-recovery-bundle/v1`, or the
      * mirror's own `member-recovery-bundles/` sidecar when omitted) +
      * `source_recovery_code`; a raw WebAuthn PRF output is NOT a supported
@@ -4135,22 +4135,22 @@ export class Gitvault {
      * pass `recovery_receipt` when there is no keystore holding one.
      */
     async recover(options) {
-        const [{ GitvaultKeystore }, { parseMirrorDestinationUrl }, { openGitvaultMirrorBackend, discoverMirroredRepoIds }, { recoverGitvaultMirror }] = await Promise.all([
+        const [{ VaultKeystore }, { parseMirrorDestinationUrl }, { openVaultMirrorBackend, discoverMirroredRepoIds }, { recoverVaultMirror }] = await Promise.all([
             this.#keystore(), this.#mirrorConfig(), this.#mirrorBackend(), this.#recovery(),
         ]);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         const destination = parseMirrorDestinationUrl(options.source, { region: options.region, endpoint: options.endpoint });
         let repoId = options.repo_id;
         if (!repoId) {
             const found = await discoverMirroredRepoIds(destination, options.credential);
             if (found.length === 0)
-                throw new LocalError(`${options.source} holds no mirrored vault (no source/<repo_id>/ prefix found)`, "recovering gitvault vault", { code: "GITVAULT_MIRROR_EMPTY", details: { source: options.source } });
+                throw new LocalError(`${options.source} holds no mirrored vault (no source/<repo_id>/ prefix found)`, "recovering vault", { code: "VAULT_MIRROR_EMPTY", details: { source: options.source } });
             if (found.length > 1)
-                throw new LocalError(`${options.source} holds ${found.length} mirrored vaults; pass repo_id to pick one`, "recovering gitvault vault", { code: "GITVAULT_MIRROR_AMBIGUOUS", details: { source: options.source, repo_ids: found }, next_actions: found.map((id) => ({ action: `recover --repo ${id}` })) });
+                throw new LocalError(`${options.source} holds ${found.length} mirrored vaults; pass repo_id to pick one`, "recovering vault", { code: "VAULT_MIRROR_AMBIGUOUS", details: { source: options.source, repo_ids: found }, next_actions: found.map((id) => ({ action: `recover --repo ${id}` })) });
             repoId = found[0];
         }
-        const backend = openGitvaultMirrorBackend(destination, repoId, options.credential);
-        return recoverGitvaultMirror({
+        const backend = openVaultMirrorBackend(destination, repoId, options.credential);
+        return recoverVaultMirror({
             backend, out_dir: options.out_dir, keystore,
             ...(options.recovery_receipt ? { recovery_receipt: options.recovery_receipt } : {}),
             ...(options.member_bundle ? { member_bundle: options.member_bundle } : {}),
@@ -4167,9 +4167,9 @@ export class Gitvault {
      * with no cache directory at all (a no-op).
      */
     async sweepObjectCache(options) {
-        const [{ GitvaultKeystore }] = await Promise.all([this.#keystore()]);
+        const [{ VaultKeystore }] = await Promise.all([this.#keystore()]);
         const repoId = await this.#resolveRepoId(options);
-        const keystore = new GitvaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
+        const keystore = new VaultKeystore(options.keystore_root !== undefined ? { rootDir: options.keystore_root } : {});
         keystore.sweepObjectCache(repoId);
     }
     // ── internals ─────────────────────────────────────────────────────────────
@@ -4178,90 +4178,90 @@ export class Gitvault {
             return options.repo_id;
         if (options.project_id)
             return (await this.forProject(options.project_id)).repo_id;
-        throw new LocalError("pass repo_id, or project_id to resolve it from the control plane", "opening the gitvault", { code: "GITVAULT_VAULT_UNRESOLVED" });
+        throw new LocalError("pass repo_id, or project_id to resolve it from the control plane", "opening the vault", { code: "VAULT_UNRESOLVED" });
     }
     #publication() {
-        return nodeOnly(() => import("../node/gitvault-publication.js"), "open");
+        return nodeOnly(() => import("../node/vault-publication.js"), "open");
     }
     #deploy() {
-        return nodeOnly(() => import("../node/gitvault-deploy.js"), "deploy");
+        return nodeOnly(() => import("../node/vault-deploy.js"), "deploy");
     }
     #keystore() {
-        return nodeOnly(() => import("../node/gitvault-keystore.js"), "open");
+        return nodeOnly(() => import("../node/vault-keystore.js"), "open");
     }
     #creation() {
-        return nodeOnly(() => import("../node/gitvault-creation-journal.js"), "init");
+        return nodeOnly(() => import("../node/vault-creation-journal.js"), "init");
     }
     #snapshot() {
-        return nodeOnly(() => import("../node/gitvault-snapshot.js"), "push");
+        return nodeOnly(() => import("../node/vault-snapshot.js"), "push");
     }
     #prune() {
-        return nodeOnly(() => import("../node/gitvault-prune.js"), "prune");
+        return nodeOnly(() => import("../node/vault-prune.js"), "prune");
     }
     #openOrCreate() {
-        return nodeOnly(() => import("../node/gitvault-open-or-create.js"), "openOrCreate");
+        return nodeOnly(() => import("../node/vault-open-or-create.js"), "openOrCreate");
     }
     #address() {
-        return nodeOnly(() => import("../node/gitvault-address.js"), "resolveOrCreateAddress");
+        return nodeOnly(() => import("../node/vault-address.js"), "resolveOrCreateAddress");
     }
     #mirror() {
-        return nodeOnly(() => import("../node/gitvault-mirror.js"), "mirrorSync");
+        return nodeOnly(() => import("../node/vault-mirror.js"), "mirrorSync");
     }
     #mirrorConfig() {
-        return nodeOnly(() => import("../node/gitvault-mirror-config.js"), "mirrorSet");
+        return nodeOnly(() => import("../node/vault-mirror-config.js"), "mirrorSet");
     }
     #mirrorBackend() {
-        return nodeOnly(() => import("../node/gitvault-mirror-backend.js"), "mirrorSet");
+        return nodeOnly(() => import("../node/vault-mirror-backend.js"), "mirrorSet");
     }
     #recovery() {
-        return nodeOnly(() => import("../node/gitvault-recover.js"), "recover");
+        return nodeOnly(() => import("../node/vault-recover.js"), "recover");
     }
     #handoff() {
-        return nodeOnly(() => import("../node/gitvault-handoff.js"), "handoff");
+        return nodeOnly(() => import("../node/vault-handoff.js"), "handoff");
     }
     #writerState() {
-        return nodeOnly(() => import("../node/gitvault-writer-state.js"), "handoff");
+        return nodeOnly(() => import("../node/vault-writer-state.js"), "handoff");
     }
     #restore() {
-        return nodeOnly(() => import("../node/gitvault-restore.js"), "resume");
+        return nodeOnly(() => import("../node/vault-restore.js"), "resume");
     }
     #degradedRead() {
-        return nodeOnly(() => import("../node/gitvault-degraded-read.js"), "list");
+        return nodeOnly(() => import("../node/vault-degraded-read.js"), "list");
     }
     #byoConfig() {
-        return nodeOnly(() => import("../node/gitvault-byo-config.js"), "init");
+        return nodeOnly(() => import("../node/vault-byo-config.js"), "init");
     }
     /**
-     * gitvault-byo-primary-bucket: the transport's `byoBackend` option — where
+     * vault-byo-primary-bucket: the transport's `byoBackend` option — where
      * THIS machine reads a BYO vault's payload from (its `byo/<repo_id>.json`
      * config; destination + credential NAME). One backend per vault per
      * transport; `null` for a vault this machine has no config for, so the
-     * transport refuses `GITVAULT_BYO_NOT_CONFIGURED` by name rather than
+     * transport refuses `VAULT_BYO_NOT_CONFIGURED` by name rather than
      * reporting a false absence. Managed vaults never reach it.
      */
     async #byoBackendResolver(keystore) {
-        const [{ readByoConfig }, { openGitvaultDestinationBackend }] = await Promise.all([this.#byoConfig(), this.#mirrorBackend()]);
+        const [{ readByoConfig }, { openVaultDestinationBackend }] = await Promise.all([this.#byoConfig(), this.#mirrorBackend()]);
         const cache = new Map();
         return (repoId) => {
             if (!cache.has(repoId)) {
                 // The RAW destination backend, keyed by the gateway's full
                 // `source/<repo_id>/…` key — the same pairing the write path uses
-                // (`openGitvaultDestinationBackend` + the session's `key`). The
+                // (`openVaultDestinationBackend` + the session's `key`). The
                 // repo-scoped backend the mirror engine opens would prefix
                 // `source/<repo_id>/` a second time.
                 const config = readByoConfig(keystore, repoId);
-                cache.set(repoId, config ? openGitvaultDestinationBackend(config.destination, config.credential) : null);
+                cache.set(repoId, config ? openVaultDestinationBackend(config.destination, config.credential) : null);
             }
             return cache.get(repoId);
         };
     }
     #byoProbe() {
-        return nodeOnly(() => import("../node/gitvault-byo-probe.js"), "init");
+        return nodeOnly(() => import("../node/vault-byo-probe.js"), "init");
     }
 }
 // ─── D7 — progressive terminal-loss warning (repo-first-onramp task 2.7) ────
 //
-// The §0 terminal-loss statement (`GITVAULT_TERMINAL_LOSS_STATEMENT`) never
+// The §0 terminal-loss statement (`VAULT_TERMINAL_LOSS_STATEMENT`) never
 // changes — this governs only PROMINENCE and CADENCE. A quiet stderr line
 // already runs at genesis (the one-shot receipt path in `push`/`openOrCreate`
 // callers). This is the OTHER half: once the vault has accrued enough value
@@ -4274,17 +4274,17 @@ export class Gitvault {
  * (an agent that pads one dimension to stay under a lone threshold). Shipped
  * as defaults; tunable in this ONE place, not a protocol contract.
  */
-export const GITVAULT_LOSS_WARNING_THRESHOLDS = {
+export const VAULT_LOSS_WARNING_THRESHOLDS = {
     generations: 10,
     source_bytes: 10 * 1024 * 1024,
     days_since_genesis: 14,
 };
 /**
- * gitvault-clone-scaling (bench P3): generations-since-checkpoint at or
+ * vault-clone-scaling (bench P3): generations-since-checkpoint at or
  * above this advises `run402 repos gc`. Same one-place-to-tune convention
- * as {@link GITVAULT_LOSS_WARNING_THRESHOLDS}; an advisory, never a gate.
+ * as {@link VAULT_LOSS_WARNING_THRESHOLDS}; an advisory, never a gate.
  */
-export const GITVAULT_CHECKPOINT_ADVISORY_GENERATIONS = 25;
+export const VAULT_CHECKPOINT_ADVISORY_GENERATIONS = 25;
 /**
  * Pure staleness computation over two 16-hex generations. TOTAL: garbage
  * or unknown coverage (`null`) yields `{0, advised: false}` — advisory
@@ -4294,7 +4294,7 @@ export const GITVAULT_CHECKPOINT_ADVISORY_GENERATIONS = 25;
  * `checkpoint_covers_through` doc), which is deliberately indistinguishable
  * from fresh here.
  */
-export function gitvaultCheckpointStaleness(input) {
+export function vaultCheckpointStaleness(input) {
     try {
         if (input.covers_through_generation === null)
             return { generations_since_checkpoint: 0, advised: false };
@@ -4304,7 +4304,7 @@ export function gitvaultCheckpointStaleness(input) {
         const newest = BigInt(`0x${input.newest_generation}`);
         const covered = BigInt(`0x${input.covers_through_generation}`);
         const since = newest > covered ? Number(newest - covered) : 0;
-        return { generations_since_checkpoint: since, advised: since >= GITVAULT_CHECKPOINT_ADVISORY_GENERATIONS };
+        return { generations_since_checkpoint: since, advised: since >= VAULT_CHECKPOINT_ADVISORY_GENERATIONS };
     }
     catch {
         return { generations_since_checkpoint: 0, advised: false };
@@ -4324,34 +4324,34 @@ export function gitvaultCheckpointStaleness(input) {
  * it, ever, in V0. What DOES now exist, one call site up in `status()`, is a
  * way to downgrade the COPY once tripped: a locally-provable read of the
  * vault's covering-recipient count (the same envelope-recipients read
- * `Gitvault.access` uses) can show this is no longer the single-principal
+ * `Repos.access` uses) can show this is no longer the single-principal
  * case the message below describes. See
- * {@link gitvaultKeystoreBackupReminderMessage} for that downgraded form.
+ * {@link vaultKeystoreBackupReminderMessage} for that downgraded form.
  */
-export function gitvaultLossWarningTrip(record, now = new Date()) {
+export function vaultLossWarningTrip(record, now = new Date()) {
     const generations = Number(record.admitted_generations ?? "0");
     const sourceBytes = Number(record.storage?.source_bytes ?? "0");
     const genesisAt = record.genesis_admitted_at ? new Date(record.genesis_admitted_at) : null;
     const daysSinceGenesis = genesisAt && !Number.isNaN(genesisAt.getTime()) ? (now.getTime() - genesisAt.getTime()) / 86_400_000 : null;
     return {
-        generations: Number.isFinite(generations) && generations >= GITVAULT_LOSS_WARNING_THRESHOLDS.generations,
-        source_bytes: Number.isFinite(sourceBytes) && sourceBytes >= GITVAULT_LOSS_WARNING_THRESHOLDS.source_bytes,
-        days_since_genesis: daysSinceGenesis !== null && daysSinceGenesis >= GITVAULT_LOSS_WARNING_THRESHOLDS.days_since_genesis,
+        generations: Number.isFinite(generations) && generations >= VAULT_LOSS_WARNING_THRESHOLDS.generations,
+        source_bytes: Number.isFinite(sourceBytes) && sourceBytes >= VAULT_LOSS_WARNING_THRESHOLDS.source_bytes,
+        days_since_genesis: daysSinceGenesis !== null && daysSinceGenesis >= VAULT_LOSS_WARNING_THRESHOLDS.days_since_genesis,
     };
 }
 /** Any composite metric tripped — the standing warning threshold itself. */
-export function gitvaultLossWarningTripped(trip) {
+export function vaultLossWarningTripped(trip) {
     return trip.generations || trip.source_bytes || trip.days_since_genesis;
 }
 /** Shared by both D7 message forms below — which threshold(s) tripped, in prose. */
-function gitvaultLossWarningReasons(trip) {
+function vaultLossWarningReasons(trip) {
     const reasons = [];
     if (trip.generations)
-        reasons.push(`≥${GITVAULT_LOSS_WARNING_THRESHOLDS.generations} generations`);
+        reasons.push(`≥${VAULT_LOSS_WARNING_THRESHOLDS.generations} generations`);
     if (trip.source_bytes)
-        reasons.push(`≥${Math.round(GITVAULT_LOSS_WARNING_THRESHOLDS.source_bytes / (1024 * 1024))} MB of source`);
+        reasons.push(`≥${Math.round(VAULT_LOSS_WARNING_THRESHOLDS.source_bytes / (1024 * 1024))} MB of source`);
     if (trip.days_since_genesis)
-        reasons.push(`≥${GITVAULT_LOSS_WARNING_THRESHOLDS.days_since_genesis} days since genesis`);
+        reasons.push(`≥${VAULT_LOSS_WARNING_THRESHOLDS.days_since_genesis} days since genesis`);
     return reasons;
 }
 /**
@@ -4362,10 +4362,10 @@ function gitvaultLossWarningReasons(trip) {
  * This is the SINGLE-PRINCIPAL form — use it only when the vault's
  * covering-recipient count is unknown or <= 1. Once a caller has locally
  * proven >= 2 covering recipients, its premise ("only one principal can open
- * it") is false; use {@link gitvaultKeystoreBackupReminderMessage} instead.
+ * it") is false; use {@link vaultKeystoreBackupReminderMessage} instead.
  */
-export function gitvaultLossWarningMessage(trip) {
-    const reasons = gitvaultLossWarningReasons(trip);
+export function vaultLossWarningMessage(trip) {
+    const reasons = vaultLossWarningReasons(trip);
     return (`this vault has accrued real value at risk (${reasons.join(", ")}) while only one principal can open it. ` +
         "Only a second principal — another keystore, or later a human envelope — demonstrably able to open the vault clears this warning; " +
         "this client cannot verify that yet, so it stands until you add one. No attestation or flag clears it.");
@@ -4373,22 +4373,22 @@ export function gitvaultLossWarningMessage(trip) {
 /**
  * D7's downgraded form (dogfood item 2): once `status()` has locally proven
  * this vault carries >= 2 covering recipients (via the same envelope-recipients
- * read `Gitvault.access` uses), the single-principal premise behind
- * {@link gitvaultLossWarningMessage} is false for THIS vault — printing it
+ * read `Repos.access` uses), the single-principal premise behind
+ * {@link vaultLossWarningMessage} is false for THIS vault — printing it
  * anyway would be a false terminal-loss claim. The composite threshold still
- * fires the SAME way (this function does not touch `gitvaultLossWarningTrip`/
- * `gitvaultLossWarningTripped` at all — a real value-at-risk signal is still
+ * fires the SAME way (this function does not touch `vaultLossWarningTrip`/
+ * `vaultLossWarningTripped` at all — a real value-at-risk signal is still
  * worth a reminder), but the copy switches to the protocol's own
  * keystore-qualified durability sentence instead of asserting single-principal
  * risk, and never claims terminal loss.
  */
-export function gitvaultKeystoreBackupReminderMessage(trip, coveringRecipients) {
-    const reasons = gitvaultLossWarningReasons(trip);
+export function vaultKeystoreBackupReminderMessage(trip, coveringRecipients) {
+    const reasons = vaultLossWarningReasons(trip);
     return (`this vault has accrued real value at risk (${reasons.join(", ")}), but it is covered by ${coveringRecipients} recipients today — not the single-principal case. ` +
-        `${GITVAULT_DURABILITY_STATEMENT} Back up this machine's keystore anyway: losing it does not lose the vault, but it does lose YOUR access to it.`);
+        `${VAULT_DURABILITY_STATEMENT} Back up this machine's keystore anyway: losing it does not lose the vault, but it does lose YOUR access to it.`);
 }
 /**
- * gitvault-mirror-default — the pure `vault_unmirrored` computation, in ONE
+ * vault-mirror-default — the pure `vault_unmirrored` computation, in ONE
  * place so doctor and `repos view` echo the same finding instead of each
  * deriving their own (the loss-warning pattern above). Present when no mirror
  * is configured, OR when one is configured but has no success evidence yet —
@@ -4398,68 +4398,60 @@ export function gitvaultKeystoreBackupReminderMessage(trip, coveringRecipients)
  * never blocking; every input is client-local or read from the CUSTOMER'S
  * mirror — nothing here touches the gateway.
  */
-export function gitvaultUnmirroredFinding(state) {
+export function vaultUnmirroredFinding(state) {
     if (state.configured && (state.last_success_at !== null || state.mirrored_generation !== null))
         return null;
     return {
         kind: "vault_unmirrored",
-        message: state.is_byo ? GITVAULT_BYO_UNMIRRORED_REMEDY_STATEMENT : GITVAULT_UNMIRRORED_FINDING_STATEMENT,
+        message: state.is_byo ? VAULT_BYO_UNMIRRORED_REMEDY_STATEMENT : VAULT_UNMIRRORED_FINDING_STATEMENT,
         setup_command: state.configured ? "run402 repos mirror --backfill" : "run402 repos mirror <destination>",
     };
 }
 /**
- * gitvault-byo-primary-bucket (design D4) — the ONE stderr line a degraded
+ * vault-byo-primary-bucket (design D4) — the ONE stderr line a degraded
  * chain/payload read prints: the fallback's own destination (never a
  * credential) plus the canonical, mechanism-only statement. `list`/`fetch`
  * degrading in the SAME `git-remote-run402` session each print their own
  * line (one per degraded READ, not one per session) — see
- * `Gitvault.withDegradedRead`'s own doc comment.
+ * `Repos.withDegradedRead`'s own doc comment.
  */
-export function gitvaultDegradedReadNote(source) {
-    return `degraded read from ${source.destination}: ${GITVAULT_DEGRADED_READ_STATEMENT}`;
+export function vaultDegradedReadNote(source) {
+    return `degraded read from ${source.destination}: ${VAULT_DEGRADED_READ_STATEMENT}`;
 }
-/**
- * The remote door (kygit-handoff design D8): `"run402"` (the canonical,
- * plumbing spelling — accepted forever) or `"kygit"` (what the
- * `@kychee/kygit` shim renders once it sets `RUN402_REMOTE_SCHEME=kygit`
- * before exec). The gateway never sees this — `address` and every registry
- * `next_actions` command stay `run402::`; only client-side RENDERING reads
- * it. Any other value falls back to `"run402"` rather than emitting an
- * unparseable scheme.
- */
-export function gitvaultRemoteScheme() {
-    return typeof process !== "undefined" && process.env?.RUN402_REMOTE_SCHEME === "kygit" ? "kygit" : "run402";
-}
-/** `<door>::<org_id>/<project_id>` — what `git-remote-run402`/`git-remote-kygit` resolves. */
-export function gitvaultRemoteUrl(orgId, projectId) {
-    return `${gitvaultRemoteScheme()}::${orgId}/${projectId}`;
+/** `run402::<org_id>/<project_id>` — what `git-remote-run402` resolves. */
+export function vaultRemoteUrl(orgId, projectId) {
+    return `run402::${orgId}/${projectId}`;
 }
 /**
- * `<door>::<org-slug>/<repo-name>` — the address-form remote builder
+ * `run402::<org-slug>/<repo-name>` — the address-form remote builder
  * (repo-first-onramp task 4, design D6). Same string shape as
- * {@link gitvaultRemoteUrl} (the wire slot admits both forms undiscriminated
- * — see {@link gitvaultRemoteAddressForm}); kept as its own named function so
+ * {@link vaultRemoteUrl} (the wire slot admits both forms undiscriminated
+ * — see {@link vaultRemoteAddressForm}); kept as its own named function so
  * a call site states which form it means rather than reusing the id-form
- * builder for a semantically different pair of arguments. Rendered by
- * {@link gitvaultRemoteScheme} (kygit-handoff design D8) — `run402 repos
- * create` renders `run402::`, `kygit create` renders `kygit::`.
+ * builder for a semantically different pair of arguments.
  */
-export function gitvaultRemoteUrlForRepo(orgSlug, repoName) {
-    return `${gitvaultRemoteScheme()}::${orgSlug}/${repoName}`;
+export function vaultRemoteUrlForRepo(orgSlug, repoName) {
+    return `run402::${orgSlug}/${repoName}`;
 }
 /**
- * Parse a `run402::<org>/<project>` OR `kygit::<org>/<project>` remote URL
- * (kygit-handoff design D8) into ONE canonical, scheme-less address — the
- * door never changes resolution, only rendering. `null` when it is neither.
+ * Parse a `run402::<org>/<project>` remote URL into its two address halves.
+ * `run402::` is the one remote scheme: `null` for anything that is not a
+ * `<scheme>::` address at all, and a typed `REMOTE_SCHEME_UNSUPPORTED`
+ * refusal naming the scheme for any other `<scheme>::` spelling.
  */
-export function parseGitvaultRemoteUrl(url) {
-    const m = /^(?:run402|kygit)::([^/]+)\/(.+)$/.exec(url.trim());
-    if (!m)
-        return null;
-    return { org_id: m[1], project_id: m[2] };
+export function parseVaultRemoteUrl(url) {
+    const trimmed = url.trim();
+    const m = /^run402::([^/]+)\/(.+)$/.exec(trimmed);
+    if (m)
+        return { org_id: m[1], project_id: m[2] };
+    const other = /^([A-Za-z][A-Za-z0-9+.-]*)::/.exec(trimmed);
+    if (other && other[1] !== "run402") {
+        throw new LocalError(`remote scheme '${other[1]}::' is not supported; the one vault remote scheme is run402::<org>/<name>`, "parsing a vault remote address", { code: "REMOTE_SCHEME_UNSUPPORTED", details: { scheme: other[1] } });
+    }
+    return null;
 }
-const GITVAULT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const GITVAULT_PROJECT_ID_RE = /^prj_/;
+const VAULT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const VAULT_PROJECT_ID_RE = /^prj_/;
 /**
  * Discriminate a parsed address's form (design D6, "resolved"): "org UUIDs
  * and `prj_` prefixes make slug-vs-id in the same slot unambiguous." Both
@@ -4469,8 +4461,8 @@ const GITVAULT_PROJECT_ID_RE = /^prj_/;
  * `prj_`-prefixed; anything else (an org slug half, or a bare repo-name half)
  * is slug-form. Resolution accepts either (task 4.3).
  */
-export function gitvaultRemoteAddressForm(address) {
-    return GITVAULT_UUID_RE.test(address.org_id) && GITVAULT_PROJECT_ID_RE.test(address.project_id) ? "id" : "slug";
+export function vaultRemoteAddressForm(address) {
+    return VAULT_UUID_RE.test(address.org_id) && VAULT_PROJECT_ID_RE.test(address.project_id) ? "id" : "slug";
 }
 /**
  * `SLUG_RELEASED` (a renamed/deleted org slug, still inside its ~90-day
@@ -4478,7 +4470,7 @@ export function gitvaultRemoteAddressForm(address) {
  * (design D6: "no redirects, deliberately"). `null` when `err` is not a
  * `SLUG_RELEASED` refusal.
  */
-export function gitvaultSlugReleasedInfo(err) {
+export function vaultSlugReleasedInfo(err) {
     const e = err;
     if (!e || e.code !== "SLUG_RELEASED")
         return null;
@@ -4495,11 +4487,11 @@ function isMissingCutoffRoute(e) {
  * "No vault exists for this address/project yet" — the same 404 shape as
  * {@link isMissingCutoffRoute}, named separately because the two mean
  * different things to their callers (an absent OPTIONAL route vs. an absent
- * RESOURCE). Used by {@link Gitvault.planPush} to distinguish "nothing to
+ * RESOURCE). Used by {@link Repos.planCapture} to distinguish "nothing to
  * preview a push against" from a genuine failure worth rethrowing.
  */
 function isVaultResolutionMiss(e) {
     const err = e;
     return Boolean(err && (err.status === 404 || err.code === "RESOURCE_NOT_FOUND" || err.code === "ROUTE_NOT_FOUND"));
 }
-//# sourceMappingURL=gitvault.js.map
+//# sourceMappingURL=repos.js.map