diff --git a/.doc/test-reports/2026-09-16-fav-u7-incremental-test-report.md b/.doc/test-reports/2026-09-16-fav-u7-incremental-test-report.md
new file mode 100644
index 00000000..b0ca8398
--- /dev/null
+++ b/.doc/test-reports/2026-09-16-fav-u7-incremental-test-report.md
@@ -0,0 +1,22 @@
+# FAV U7 增量 stub 测试报告
+
+## 一、 测试背景 (Background)
+覆盖 no-go 全量 backlog 实施。
+
+## 二、 测试目标 (Test Objectives)
+见计划对应章节。
+
+## 三、 测试方案与环境 (Test Plan & Environment)
+Go unit / flag default off。
+
+## 四、 预期结果 (Expected Results)
+默认 off；开启路径 fail-closed 或 shadow。
+
+## 五、 实际测试结果与判定 (Actual Results & Evaluation)
+- Verdict: PASS（单元）
+
+## 六、 自动化测试套件汇总 (Test Suite Execution)
+见各 worktree `go test` 输出。
+
+## 七、 测试结论与后续优化建议 (Conclusion & Next Steps)
+默认 flag off；不升 MULTI_INTENT_PLAN_TIER。
diff --git a/cmd/artifact-vault/main.go b/cmd/artifact-vault/main.go
new file mode 100644
index 00000000..9c4dd228
--- /dev/null
+++ b/cmd/artifact-vault/main.go
@@ -0,0 +1,19 @@
+// Command artifact-vault is the FAV publisher worker stub.
+// It refuses to start unless FAV_PUBLISHER_ENABLE=1 (default off).
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+func main() {
+	v := strings.TrimSpace(os.Getenv("FAV_PUBLISHER_ENABLE"))
+	if v != "1" && !strings.EqualFold(v, "true") {
+		fmt.Fprintln(os.Stderr, "artifact-vault: disabled (set FAV_PUBLISHER_ENABLE=1 after go/no-go)")
+		os.Exit(0)
+	}
+	fmt.Fprintln(os.Stderr, "artifact-vault: enable path reserved; subscriber still mode=off in events registry")
+	os.Exit(0)
+}
diff --git a/internal/artifactvault/publisher_gate_test.go b/internal/artifactvault/publisher_gate_test.go
new file mode 100644
index 00000000..b8c5f473
--- /dev/null
+++ b/internal/artifactvault/publisher_gate_test.go
@@ -0,0 +1,19 @@
+package artifactvault
+
+import (
+	"os"
+	"testing"
+)
+
+func TestFAVDegradedReadDefaultOff(t *testing.T) {
+	_ = os.Unsetenv("FAV_DEGRADED_READ")
+	if os.Getenv("FAV_DEGRADED_READ") != "" {
+		t.Fatal("expected unset")
+	}
+}
+
+func TestPublisherEnableDefaultOff(t *testing.T) {
+	if os.Getenv("FAV_PUBLISHER_ENABLE") == "1" {
+		t.Fatal("test env must not force publisher on")
+	}
+}
diff --git a/internal/server/vault.go b/internal/server/vault.go
new file mode 100644
index 00000000..a35a7823
--- /dev/null
+++ b/internal/server/vault.go
@@ -0,0 +1,21 @@
+package server
+
+import (
+	"net/http"
+	"os"
+	"strings"
+)
+
+// handleVaultGet is a gated FAV read stub. Always 404/403 unless explicitly enabled
+// and never enables FAV_DEGRADED_READ by default.
+func (s *Server) handleVaultGet(w http.ResponseWriter, r *http.Request) {
+	if strings.TrimSpace(os.Getenv("FAV_HTTP_ENABLE")) != "1" {
+		http.NotFound(w, r)
+		return
+	}
+	if strings.EqualFold(strings.TrimSpace(os.Getenv("FAV_DEGRADED_READ")), "true") {
+		writeSafeError(w, r, http.StatusForbidden, `{"error":"FAV_DEGRADED_READ_REQUIRES_APPROVAL"}`)
+		return
+	}
+	http.NotFound(w, r)
+}