@polymorphism-tech/morph-spec 8.47.0 → 9.1.0

package/src/lib/validators/verify-runner.js

@@ -1,41 +1,16 @@
-/**
- * Verify Runner — deterministic build+tests+validators+e2e cadence.
- *
- * v8 adds a DETERMINISTIC verification node that runs BEFORE the LLM judge
- * in the per-task loop: build + tests + validators (code, free) first; the
- * LLM judge is only invoked once verify passes. This is a BINARY gate
- * (pass/fail per node).
- *
- * The `e2e` node closes the last gap in that chain: build proves the code
- * COMPILES, tests prove units behave, validators read structure — none of
- * them prove the application RUNS. See e2e-check.js for why that distinction
- * is load-bearing rather than academic.
- *
- * Pure orchestration — reuses (never reimplements):
- *   - runBuildCheck()  from framework/hooks/shared/build-check.js
- *   - runTestSuite()      from src/lib/tasks/test-runner.js (one node)
- *   - resolveTestNodes()  from src/lib/tasks/test-nodes.js (the LIST of suites)
- *   - applyTaskScope()    from src/lib/tasks/test-scope.js (the task-scoped cut, #87)
- *   - runValidation()  from ./validation-runner.js
- *   - runE2eCheck()    from framework/hooks/shared/e2e-check.js
- *
- * @module verify-runner
- */
-
 import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, rmSync } from 'fs';
 import { join, resolve } from 'path';
 
-import { runBuildCheck, getBuildSteps } from '../../../framework/hooks/shared/build-check.js';
-import { runE2eCheck } from '../../../framework/hooks/shared/e2e-check.js';
+import { runBuildCheck, getBuildSteps, isDotnetStack } from '../../../framework/hooks/shared/build-check.js';
+import { composeProjectName, runE2eCheck } from '../../../framework/hooks/shared/e2e-check.js';
 import { buildComposeEnv } from '../e2e/compose-env.js';
 import {
-  runTestSuite, parseTestCount, compareTestCount, resolveTestTimeout, isZeroTestRun, mtpSummaryTotals,
+  runTestSuite, parseTestCount, compareTestCount, resolveTestTimeout, discoverDotnetSolution,
 } from '../tasks/test-runner.js';
 import {
   resolveTestNodes, parseTestFilter, nodeMatchesFilter, recordTestBaselines, morphConfigPath,
 } from '../tasks/test-nodes.js';
-import { applyTaskScope } from '../tasks/test-scope.js';
 import { runLinuxSuite, checkLinuxPreconditions } from '../tasks/linux-runner.js';
 import {
   EVAL_RUNNER, evalPreflight, evalNodeEnv, readEvalSummary, evalScenarioCount,
@@ -44,35 +19,16 @@ import {
 } from '../tasks/eval-node.js';
 import { runValidation } from './validation-runner.js';
 import { checkOutputsTraceability } from './traceability-check.js';
-import { getAbsoluteOutputPath } from '../../core/paths/output-schema.js';
 import { createHeavyGate } from '../heavy/gate.js';
 
-/** Default build timeout — dotnet cold build is slow; 30s (the Stop-hook default) is too short. */
+// A dotnet cold build is slow; the Stop-hook default of 30s is too short.
 const DEFAULT_BUILD_TIMEOUT = 120_000;
 
-// Validator issues surfaced in `feedback`, errors first; the full list stays on the node.
 const VALIDATOR_FEEDBACK_LIMIT = 10;
 
-/** Number of trailing output lines kept for feedback/reporting. */
 const OUTPUT_TAIL_LINES = 20;
 
-/** A narrowed run that proved ZERO tests ran (#87) — wording pinned by the plan. */
-const NARROWED_ZERO_TESTS = 'narrowed-zero-tests: o recorte executou 0 testes';
-const NARROWED_ZERO_TESTS_LINK = 'narrowed-zero-tests: um link do recorte executou 0 testes (bloco MTP com total: 0)';
-
-/** A narrowed run that exited green with no count anyone could read (#87): null is UNKNOWN, and unknown is never green. */
-const NARROWED_COUNT_UNKNOWN = 'narrowed-count-unknown: o recorte saiu verde sem contagem legível — '
-  + 'nada prova que algum teste rodou (desconhecido nunca vira verde)';
-
-/**
- * The caller asked for something impossible — not a red verification, a wrong
- * invocation. The distinction is the exit code: `verify` answers 1 for "the
- * code is not ready" and 2 for "this command cannot mean what you typed".
- *
- * It exists because `--filter` can select nothing. Running every suite (or,
- * far worse, none of them) and reporting green would be F30 restated as a
- * one-word typo — so the runner refuses instead of guessing.
- */
+/** A wrong invocation, not a red verification: `verify` exits 2 for it, 1 for "code not ready". */
 export class VerifyUsageError extends Error {
   constructor(message) {
     super(message);
@@ -82,44 +38,19 @@ export class VerifyUsageError extends Error {
 }
 
 /**
- * Run the deterministic verify cadence for a feature (or a single task within it).
- *
- * @param {string} projectPath - Project root directory
- * @param {string} featureName - Feature name
- * @param {string|null} [taskId] - Task ID for task-scoped verify, or null/undefined for feature scope
- * @param {Object} [options]
- * @param {number} [options.timeout] - Timeout in ms for the build AND tests nodes
- *   (default: 120000 for build; for tests, see resolveTestTimeout())
- * @param {boolean} [options.skipTests] - Skip the tests node
- * @param {boolean} [options.skipBuild] - Skip the build node
- * @param {boolean} [options.skipE2e] - Skip the e2e node
- * @param {boolean} [options.freshE2e] - Force a stack rebuild instead of reusing a warm one
- * @param {boolean} [options.recordBaseline] - Measure and write `expectedCount` back into
- *   `project.tests[]` — only from a run whose every test node is green (D8)
- * @param {boolean} [options.linux] - Run the test nodes inside a Linux container, on a COPY
- *   of the tree (see linux-runner.js for why a bind mount would prove nothing)
- * @param {string} [options.linuxImage] - Image override for --linux
- * @param {boolean} [options.full] - Task scope only: switch the recorte off and run every
- *   node whole (#87). A documented no-op at feature scope, which never narrows anything.
- * @param {Function} [options._runBuildCheck] - Injectable override for runBuildCheck (testing)
- * @param {Function} [options._runTestSuite] - Injectable override for runTestSuite (testing)
- * @param {Function} [options._runValidation] - Injectable override for runValidation (testing)
- * @param {Function} [options._runE2eCheck] - Injectable override for runE2eCheck (testing)
- * @param {Function} [options._checkOutputsTraceability] - Injectable override for checkOutputsTraceability (testing)
- * @param {Object} [options._heavyGate] - Injectable heavy-slot gate (testing); default is one per run
- * @returns {Promise<Object>} Aggregated verify result — see module docs for shape
+ * @throws {VerifyUsageError} on an invocation that cannot mean what was typed (exit 2)
  * @throws {HeavyBusyError} when no heavy slot (or RAM) freed within `heavy.waitTimeoutSec`
  */
-export async function runVerify(projectPath, featureName, taskId, options = {}) {
+export async function runVerify(projectPath, featureName, options = {}) {
   const gate = options._heavyGate ?? createHeavyGate({ projectPath, feature: featureName });
   try {
-    return await runVerifyGated(projectPath, featureName, taskId, options, gate);
+    return await runVerifyGated(projectPath, featureName, options, gate);
   } finally {
     gate.release();
   }
 }
 
-async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
+async function runVerifyGated(projectPath, featureName, options, gate) {
   const {
     timeout = DEFAULT_BUILD_TIMEOUT,
     skipTests = false,
@@ -130,7 +61,6 @@ async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
     refreshCache = false,
     linux = false,
     linuxImage = null,
-    full = false,
     _runLinuxSuite = runLinuxSuite,
     _exec = undefined,
     _runBuildCheck = runBuildCheck,
@@ -143,10 +73,8 @@ async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
   const stack = readStack(projectPath);
   const paths = readProjectPaths(projectPath);
 
-  // The suites are resolved ONCE, before anything is executed, because
-  // `--filter` has to be judged before the first second of build time is
-  // spent: a filter that matches nothing is a typo, and paying for a build to
-  // discover a typo is the worst of both outcomes.
+  // Usage errors are judged before the build: paying for a build to discover a typo
+  // is the worst ordering, and a refusal after the cache was touched leaves a half-rewritten tree.
   const testPlan = resolveTestNodes(projectPath);
   const filter = parseTestFilter(options.filter);
   if (filter && !testPlan.nodes.some((node) => nodeMatchesFilter(node, filter))) {
@@ -156,44 +84,23 @@ async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
     );
   }
 
-  // The task is read ONCE: its group picks the e2e applicability and, with its
-  // outputs, the test scope. One reader of tasks.json for verify, so the two
-  // can never disagree about the task.
-  const task = taskId ? readTask(projectPath, featureName, taskId) : null;
-
-  // `--record-baseline` is judged in the same breath, and for the same reason:
-  // discovering that there is nowhere to write AFTER running the whole fleet
-  // would charge the user a full suite for a usage error. `config.json` is
-  // never created here — this repository deliberately has none, and inventing
-  // one would break `doctor --full`.
   if (recordBaseline) {
-    const problem = baselineTargetProblem(projectPath, testPlan, { skipTests, taskId });
+    const problem = baselineTargetProblem(projectPath, testPlan, { skipTests });
     if (problem) throw new VerifyUsageError(problem);
   }
 
-  // `--refresh-cache` is judged in the same breath as `--filter` and
-  // `--record-baseline`, and for the same reason — but here the stake is higher
-  // than a wasted clock: a refusal AFTER the cache was touched would leave a
-  // half-rewritten tree behind. Same discipline as `finish --merge`, which
-  // validates the root BEFORE archiving.
   if (refreshCache) {
     const problem = refreshCacheProblem(projectPath, testPlan, filter, { skipTests });
     if (problem) throw new VerifyUsageError(problem);
   }
 
-  // `--linux` fails FAST and LOUD when Docker is missing (exit 2). Never a
-  // skip: "we could not check on Linux" reading as green is F35 itself.
+  // Missing Docker is a usage error, never a skip: "could not check on Linux" must not read as green.
   if (linux) {
     const problem = checkLinuxPreconditions({
       projectPath, skipTests, ...(_exec ? { exec: _exec } : {}),
     });
     if (problem) throw new VerifyUsageError(problem);
 
-    // The MORPH_EVAL_* channel carries ABSOLUTE host paths, and the container
-    // runs a COPY of the tree at /work — so those paths do not exist inside it.
-    // Refusing by name is the only honest answer: running the node anyway would
-    // fail with an unrelated message, and skipping it would be the green-over-
-    // nothing shape this feature exists to remove. The escape is named.
     const evalNode = testPlan.nodes.find(
       (node) => node.runner === EVAL_RUNNER && nodeMatchesFilter(node, filter)
     );
@@ -206,85 +113,63 @@ async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
     }
   }
 
-  // #87: at task scope the task's group picks the nodes and its outputs narrow
-  // the command inside each; test-scope.js DECIDES, this runner executes. The
-  // scoping happens ONCE, here, before runTestsNode, so the host loop and the
-  // `--linux` container receive the SAME scoped nodes (the container script is
-  // written from `node.command`) and preDecideRun/judgeRun stay the single copy
-  // of each rule for both. `--filter` was judged above on the ORIGINAL ids: a
-  // typo is a typo whatever the task. Feature scope gets the nodes back
-  // unchanged, because Gate 3 always runs every suite, whole.
-  const scoped = applyTaskScope({ projectPath, nodes: testPlan.nodes, task, taskId, filter, full });
-
   const nodes = {};
   const feedback = [];
 
-  // 1. build
   nodes.build = await runBuildNode({ projectPath, stack, paths, timeout, skipBuild, gate, _runBuildCheck });
   appendBuildFeedback(feedback, nodes.build);
 
-  // 2. tests — skipped entirely (no invocation) when build already failed.
-  // The tests node gets the SAME --timeout the user typed, but only when they
-  // typed one: `timeout` above is defaulted for the build, and passing that
-  // default down would silently outrank config.project.testTimeoutMs and the
-  // per-project scaling (see resolveTestTimeout()).
+  // Only a TYPED --timeout reaches the tests: the build default would outrank
+  // config.project.testTimeoutMs and the per-project scaling.
   const explicitTimeout = Number.isFinite(options.timeout) ? options.timeout : undefined;
+  const stackNodes = [];
   nodes.tests = await runTestsNode({
     projectPath,
-    testPlan: { ...testPlan, nodes: scoped.nodes },
+    testPlan,
     filter,
     skipTests,
     buildNode: nodes.build,
     timeout: explicitTimeout,
-    taskId,
     refreshCache,
     linux,
     linuxImage,
     gate,
+    stackNodes,
     _runTestSuite,
     _runLinuxSuite,
     _exec,
   });
-  // How the nodes were chosen, for whoever reads --json. It lives on the rollup
-  // and nowhere else: nodeStatuses() (verify.js) persists status strings only,
-  // so no part of the selection ever reaches feature.json.
-  nodes.tests.scope = scoped.summary;
-  appendTestsFeedback(feedback, nodes.tests);
+  if (stackNodes.length === 0) appendTestsFeedback(feedback, nodes.tests);
 
-  // 3. validators — ALWAYS runs, even on a red build (free static feedback).
   nodes.validators = await runValidatorsNode({ projectPath, featureName, _runValidation });
   appendValidatorsFeedback(feedback, nodes.validators);
 
-  // 4. e2e — the only node that runs the application. Like tests, it is not
-  // invoked at all on a red build: a stack that cannot compile cannot come up,
-  // and the docker output would bury the actual compile error.
-  nodes.e2e = await runE2eNode({
+  const e2e = await runE2eNode({
     projectPath,
     featureName,
-    taskId,
-    task,
     skipE2e,
     freshE2e,
     buildNode: nodes.build,
     gate,
     _runE2eCheck,
   });
+  nodes.e2e = e2e.node;
   appendE2eFeedback(feedback, nodes.e2e);
 
-  // 5. traceability — advisory-only, feature-scope only (see traceability-check.js
-  // for the recap-vs-outputs disagreement it flags, and what it deliberately
-  // cannot catch). Lives OUTSIDE `nodes` on purpose: `status` below is computed
-  // from `nodes` alone, so this can never flip build/tests/validators/e2e green
-  // to red — recap/outputs disagreement is a rastreabilidade signal, not a
-  // correctness gate.
-  const traceability = taskId
-    ? { status: 'skip', warnings: [], reason: 'task-scoped verify does not run traceability', citedCount: 0 }
-    : _checkOutputsTraceability(projectPath, featureName);
+  if (stackNodes.length > 0) {
+    nodes.tests = await runStackTestNodes({
+      projectPath, testsNode: nodes.tests, stackNodes, e2eNode: nodes.e2e, stackEnv: e2e.stackEnv,
+      timeout: explicitTimeout, gate, _runTestSuite,
+    });
+    appendTestsFeedback(feedback, nodes.tests);
+  }
+
+  // Outside `nodes` on purpose: status comes only from the nodes, so a traceability
+  // warning never turns red.
+  const traceability = _checkOutputsTraceability(projectPath, featureName);
 
   const status = Object.values(nodes).some((n) => n.status === 'fail') ? 'fail' : 'pass';
 
-  // Recording happens LAST and only from what actually ran — the number is a
-  // measurement of this invocation, never a value carried in from anywhere.
   const baseline = recordBaseline ? recordBaselineFrom(projectPath, nodes.tests) : null;
   if (baseline && !baseline.recorded) {
     feedback.push(`[baseline] não gravada: ${baseline.reason}`);
@@ -293,8 +178,6 @@ async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
   return {
     version: 1,
     feature: featureName,
-    task: taskId || null,
-    scope: taskId ? 'task' : 'feature',
     stack,
     status,
     nodes,
@@ -304,16 +187,29 @@ async function runVerifyGated(projectPath, featureName, taskId, options, gate) {
   };
 }
 
-// ============================================================================
-// Build node
-// ============================================================================
+/**
+ * A root `dotnet build` with no solution at the root fails MSB1003: build the
+ * repository's single solution instead, or say which candidates and which key decide.
+ */
+export function resolveDotnetBuild(projectPath, stack, paths = {}) {
+  if (!stack || !isDotnetStack(stack.toLowerCase()) || paths.backendPath) return { paths, hint: null };
+  const { target, candidates } = discoverDotnetSolution(projectPath);
+  if (target === '.') return { paths, hint: null };
+  if (target) return { paths: { ...paths, backendTarget: target }, hint: null };
+  const found = candidates.length ? `candidatos: ${candidates.join(', ')}` : 'nenhum encontrado abaixo dela';
+  return {
+    paths,
+    hint: `nenhum .sln/.slnx/.csproj na raiz (${found}): declare project.backendPath em .morph/config/config.json com a pasta da solução, relativa à raiz`,
+  };
+}
 
-async function runBuildNode({ projectPath, stack, paths = {}, timeout, skipBuild, gate, _runBuildCheck }) {
+async function runBuildNode({ projectPath, stack, paths: declaredPaths = {}, timeout, skipBuild, gate, _runBuildCheck }) {
   if (skipBuild) {
     return { status: 'skip', command: null, durationMs: 0, reason: 'requested', output: '' };
   }
 
-  const steps = getBuildSteps(stack, { cwd: projectPath, frontendPath: paths.frontendPath, backendPath: paths.backendPath });
+  const { paths, hint } = resolveDotnetBuild(projectPath, stack, declaredPaths);
+  const steps = getBuildSteps(stack, { cwd: projectPath, frontendPath: paths.frontendPath, backendPath: paths.backendPath, backendTarget: paths.backendTarget });
   if (steps.length === 0) {
     const reason = stack ? `no build command for stack "${stack}"` : 'no stack configured';
     return { status: 'skip', command: null, durationMs: 0, reason, output: '' };
@@ -330,7 +226,7 @@ async function runBuildNode({ projectPath, stack, paths = {}, timeout, skipBuild
     command,
     durationMs,
     reason: result.status === 'skip' ? 'no build command for stack' : null,
-    output: result.output || '',
+    output: [result.output, result.status === 'fail' ? hint : null].filter(Boolean).join('\n'),
   };
 }
 
@@ -341,34 +237,13 @@ function appendBuildFeedback(feedback, buildNode) {
   }
 }
 
-// ============================================================================
-// Tests node
-// ============================================================================
-
-/**
- * Run EVERY test suite the project declares, and roll the results up.
- *
- * Why a rollup instead of one node: defect F30. The resolver answered
- * "dotnet test", the 3.082 vitest tests of the same repository never ran, and
- * the gate reported green — a suite nobody could name is a suite that cannot
- * fail. `resolveTestNodes()` now returns the LIST, each entry runs with its own
- * command, cwd and clock, and every one of them appears in `runs[]`.
- *
- * `nodes.tests` deliberately stays an OBJECT with `status` (D6): verify.js and
- * the persisted stamp read `nodes.tests.status`, and turning a verification
- * defect into a shape defect is not progress. The plural detail lives in
- * `runs[]` beside it.
- *
- * @returns {Object} The rollup: `status`, joined `command`, summed `durationMs`,
- *   `source`, `environment` (null outside a container) and `runs[]`.
- */
+// Every declared suite runs and appears in `runs[]`; the rollup stays an object
+// with `status` because verify.js and the persisted stamp read `nodes.tests.status`.
 async function runTestsNode({
-  projectPath, testPlan, filter, skipTests, buildNode, timeout, taskId, refreshCache = false,
-  linux = false, linuxImage = null, gate, _runTestSuite, _runLinuxSuite = runLinuxSuite, _exec,
+  projectPath, testPlan, filter, skipTests, buildNode, timeout, refreshCache = false,
+  linux = false, linuxImage = null, gate, stackNodes = [], _runTestSuite, _runLinuxSuite = runLinuxSuite, _exec,
 }) {
   const { nodes, source } = testPlan;
-  // Kept readable for whoever only prints the string — the same join the
-  // fallback scan already used for a chain of test projects.
   const command = nodes.map((n) => n.command).filter(Boolean).join(' && ') || null;
   // A fresh `runs: []` per return — two rollups must never alias one array.
   const nothingRan = (reason) => ({
@@ -384,49 +259,58 @@ async function runTestsNode({
 
   if (linux) {
     const { runs, environment } = await runNodesInLinux({
-      projectPath, nodes, filter, taskId, timeout, linuxImage, gate, _runLinuxSuite, _exec,
+      projectPath, nodes, filter, timeout, linuxImage, gate, _runLinuxSuite, _exec,
     });
     return rollUpTestRuns(runs, { command, source, environment });
   }
 
   const runs = [];
   for (const node of nodes) {
+    if (node.e2e && !preDecideRun({ node, filter, projectPath, refreshCache })) {
+      stackNodes.push(node);
+      runs.push(emptyRunEntry(node));
+      continue;
+    }
     runs.push(await runOneTestNode({
-      projectPath, node, filter, taskId, timeout, refreshCache, gate, _runTestSuite,
+      projectPath, node, filter, timeout, refreshCache, gate, _runTestSuite,
     }));
   }
 
   return rollUpTestRuns(runs, { command, source });
 }
 
-/**
- * Run the executable nodes inside ONE Linux container and judge them with the
- * SAME rules the local path uses.
- *
- * The pre-decisions (invalid config, `--filter`, a node outside the task
- * scope, an e2e node at task scope)
- * happen HERE, before the container exists: a node that must not run must not
- * be written into the container script either, or the flag would quietly run
- * what the user filtered out. What the container returns — an exit code and an
- * output — is then handed to `judgeRun()`, the same function the host path
- * calls, so a count drop means a count drop in both environments.
- *
- * The tree the container executes is a COPY on its own filesystem, never the
- * bind mount: see linux-runner.js. That is the whole reason this path exists.
- */
+// No stack, no run: the skip carries the e2e verdict as reason AND warning, so the
+// suite never disappears behind a green rollup.
+async function runStackTestNodes({ projectPath, testsNode, stackNodes, e2eNode, stackEnv, timeout, gate, _runTestSuite }) {
+  const byId = new Map(stackNodes.map((node) => [node.id, node]));
+  const runs = [];
+  for (const run of testsNode.runs) {
+    const node = byId.get(run.id);
+    if (!node) { runs.push(run); continue; }
+    if (e2eNode.status !== 'pass') {
+      const reason = `a stack do e2e não está de pé (e2e: ${e2eNode.status}${e2eNode.reason ? ` — ${e2eNode.reason}` : ''}): nó e2e: true não roda sem ela`;
+      runs.push({ ...run, reason, warnings: [reason] });
+      continue;
+    }
+    runs.push(await runOneTestNode({ projectPath, node, filter: null, timeout, gate, env: stackEnv, _runTestSuite }));
+  }
+  return rollUpTestRuns(runs, { command: testsNode.command, source: testsNode.source, environment: testsNode.environment });
+}
+
+// Pre-decisions run before the container exists, so a filtered node is never written
+// into its script; results go through the same `judgeRun()` as the host path.
 async function runNodesInLinux({
-  projectPath, nodes, filter, taskId, timeout, linuxImage, gate, _runLinuxSuite, _exec,
+  projectPath, nodes, filter, timeout, linuxImage, gate, _runLinuxSuite, _exec,
 }) {
   const decided = new Map();
   const toRun = [];
   for (const node of nodes) {
-    const pre = preDecideRun({ node, filter, taskId, projectPath });
+    const pre = preDecideRun({ node, filter, projectPath });
     if (pre) decided.set(node.id, pre);
     else toRun.push(node);
   }
 
-  // One container, one clock: the ceiling is the sum of what each node would
-  // have been given locally, since they share the run.
+  // One container, one clock: the sum of each node's local timeout.
   const containerTimeout = toRun.reduce(
     (sum, node) => sum + resolveTestTimeout(projectPath, node, timeout), 0
   ) || undefined;
@@ -445,16 +329,13 @@ async function runNodesInLinux({
     if (decided.has(node.id)) return decided.get(node.id);
     const raw = byId.get(node.id);
     if (!raw) {
-      // The container answered about a fleet that does not include this node.
-      // Silence here would be a suite vanishing from the report.
       return { ...emptyRunEntry(node), status: 'fail', reason: 'o container não reportou este nó' };
     }
     if (raw.skipped) {
       return { ...emptyRunEntry(node), reason: raw.reason };
     }
     const result = raw.exitCode === null
-      // No exit code is NOT a pass: the container died before this node
-      // reported, and a green verdict over an unobserved suite is F30's shape.
+      // No exit code is NOT a pass: the container died before this node reported.
       ? { passed: false, output: raw.output || '', reason: raw.reason, exitCode: null }
       : { passed: raw.exitCode === 0, output: raw.output || '', exitCode: raw.exitCode };
     return judgeRun({ node, result, durationMs: raw.durationMs ?? 0 });
@@ -463,36 +344,24 @@ async function runNodesInLinux({
   return { runs, environment: suite.environment };
 }
 
-/**
- * Execute (or decline to execute) one node, always producing a `runs[]` entry.
- *
- * Nothing is ever dropped: a node that must not run says so with a reason, in
- * the place the reader is already looking. A suite that silently disappears
- * from the report is the defect this whole feature exists to close.
- */
 async function runOneTestNode({
-  projectPath, node, filter, taskId, timeout, refreshCache = false, gate, _runTestSuite,
+  projectPath, node, filter, timeout, refreshCache = false, gate, env = null, _runTestSuite,
 }) {
-  const decided = preDecideRun({ node, filter, taskId, projectPath, refreshCache });
+  const decided = preDecideRun({ node, filter, projectPath, refreshCache });
   if (decided) return decided;
 
-  // The eval channel: the CLI DICTATES where the cache, the dataset and the
-  // summary live, so the same xunit suite is runnable by `verify` without a
-  // second configuration path. `env` is undefined for every other runner, which
-  // keeps `runTestSuite` on exactly the path it had before.
   const evalChannel = node.runner === EVAL_RUNNER
     ? evalNodeEnv(node, projectPath, { refresh: refreshCache })
     : null;
-  // The summary path is fixed per node id and pid, and nothing else removes the
-  // file: one left there by an earlier run (an earlier verify in the same
-  // process, a recycled pid) was read as THIS run's, handing a harness that
-  // wrote nothing the old scenario count — and hiding an empty run behind it.
+  // The summary path is fixed per node id and pid: a file left by an earlier run
+  // would be read as this run's and hide an empty run behind the old count.
   if (evalChannel) discardFile(evalChannel.summaryPath);
 
   gate.enter('tests');
   const start = Date.now();
+  const childEnv = env || evalChannel ? { ...(env || {}), ...(evalChannel?.env || {}) } : null;
   const result = await _runTestSuite(projectPath, {
-    timeout, node, ...(evalChannel ? { env: evalChannel.env } : {}),
+    timeout, node, ...(childEnv ? { env: childEnv } : {}),
   });
   const entry = judgeRun({ node, result, durationMs: Date.now() - start });
   if (!evalChannel) return entry;
@@ -502,26 +371,12 @@ async function runOneTestNode({
   return judged;
 }
 
-/** Remove a scratch file the CLI owns; a file that is not there (or will not go) changes nothing. */
 function discardFile(path) {
-  try { rmSync(path, { force: true }); } catch { /* best effort — the next run removes it first */ }
+  try { rmSync(path, { force: true }); } catch { /* the next run removes it first */ }
 }
 
-/**
- * Second half of an eval verdict: what the SUMMARY says, on top of what the exit
- * code said.
- *
- * Two things the exit code cannot see:
- *   - the scenario COUNT, which is what `expectedCount` is compared against and
- *     what `--record-baseline` writes. Read ONLY from the summary: the `dotnet`
- *     extractor counts xunit cases, another unit — compared with (or recorded as)
- *     a scenario baseline it failed green runs as drops (#110, #117 review). No
- *     readable summary → **null, UNKNOWN, never 0** — an unreadable summary must
- *     not manufacture a count drop;
- *   - a suite that evaluated ZERO scenarios and exited 0. Nothing failed, because
- *     nothing ran: the guardrail-inert shape this repository has already paid to
- *     learn to detect.
- */
+// The scenario count comes ONLY from the summary (the dotnet extractor counts xunit
+// cases, another unit); no readable summary is null, UNKNOWN, never 0.
 function judgeEvalRun(entry, node, summaryPath) {
   const summary = readEvalSummary(summaryPath);
   const warnings = [...(entry.warnings || [])];
@@ -533,11 +388,8 @@ function judgeEvalRun(entry, node, summaryPath) {
   const verdict = compareTestCount(count, node.expectedCount);
   if (verdict.warning) warnings.push(verdict.warning);
 
-  // As falhas NOMEADAS entram no buffer de saida do no, e entram na FRENTE.
-  // `appendTestsFeedback` prefere `output` a `reason`, entao um nome so no
-  // `reason` nunca chegaria ao `feedback[]`; e a cauda do `dotnet` e ruido
-  // truncado exatamente onde o sumario ja tem a frase certa. Prepend, e nao
-  // substituicao, porque um crash do runner tambem vive nessa cauda.
+  // Named failures go into `output` (feedback prefers it to `reason`), prepended
+  // rather than replacing it because a runner crash also lives in that tail.
   const named = evalFailureLines(summary);
   const withNames = named.length > 0
     ? { ...entry, output: [...named, ...(entry.output ? [entry.output] : [])].join('\n') }
@@ -556,7 +408,6 @@ function judgeEvalRun(entry, node, summaryPath) {
   return { ...withNames, count, warnings };
 }
 
-/** The `runs[]` entry every path starts from — every field present, nothing implied. */
 function emptyRunEntry(node) {
   return {
     id: node.id,
@@ -564,82 +415,41 @@ function emptyRunEntry(node) {
     cwd: node.cwd,
     runner: node.runner,
     expectedCount: node.expectedCount,
-    // Always present, so no reader has to tell "absent" from "unknown" by
-    // optional chaining. **null is UNKNOWN, never 0** (D7).
+    // null is UNKNOWN, never 0.
     count: null,
     status: 'skip',
     durationMs: 0,
     reason: null,
     warnings: [],
     output: '',
-    // What the task-scope recorte did to this node (#87): `command` above is
-    // what actually ran, `selection.declaredCommand` what was declared. null at
-    // feature scope, where applyTaskScope leaves the key ABSENT; absent is read
-    // as null here so no reader has to tell the two apart.
-    selection: node.selection ?? null,
   };
 }
 
-/**
- * The verdicts that exist BEFORE anything is executed, or null when the node
- * has to run to be judged.
- *
- * Shared by the local loop and by `--linux`, so a node that must not run is
- * refused for the same reason and with the same words in both environments —
- * two copies of this ordering is how a filtered node ends up invisible in one
- * of them.
- */
-function preDecideRun({ node, filter, taskId, projectPath = '.', refreshCache = false }) {
+// Verdicts decided before execution, shared by the host loop and `--linux` so both
+// refuse for the same reason with the same words; null means the node must run.
+function preDecideRun({ node, filter, projectPath = '.', refreshCache = false }) {
   const entry = emptyRunEntry(node);
 
-  // The resolver already decided: invalid config (fail-closed, D4) or an
-  // explicit "no suites declared". Executing it would be asking a question that
-  // has been answered — and, for an invalid node, answering it wrongly.
   if (node.status) {
     return { ...entry, status: node.status, reason: node.reason };
   }
 
-  // Deliberately AFTER the pre-decided verdict above: `--filter` says "do not
-  // spend time on this suite", not "do not tell me my config is broken". An
-  // invalid node costs no clock and still reddens the gate (D4).
+  // After the pre-decided verdict on purpose: an invalid node costs no clock and
+  // still reddens the gate even when filtered out.
   if (!nodeMatchesFilter(node, filter)) {
     return { ...entry, reason: `filtered out (--filter ${filter.raw})` };
   }
 
-  // The task's group scoped this node out (#87). AFTER the filter on purpose:
-  // a node the user filtered out reports the filter, never a scope it was not
-  // judged by. BEFORE the e2e and eval checks: a node outside the task scope
-  // has nothing left to decide.
-  if (node.selection?.mode === 'out-of-scope') {
-    return { ...entry, reason: node.selection.reason };
-  }
-
-  if (node.e2e && taskId) {
-    return { ...entry, reason: 'e2e node runs at feature scope only' };
-  }
-
-  // The eval pre-flight lives HERE, beside the other pre-decisions, so the host
-  // loop and the `--linux` path refuse for the same reason with the same words.
-  // Its three cache verdicts are FAILURES, never skips: a skip over an unusable
-  // cache is a green gate above a verification that never happened. The only
-  // skip it produces is scope — an eval suite does not pay for itself inside the
-  // per-task loop, and the result Gate 3 reads is the feature-scoped one.
+  // A cache miss is a fail, never a skip: a skip would be green over nothing.
   if (node.runner === EVAL_RUNNER) {
-    const pre = evalPreflight(projectPath, node, { taskId, refresh: refreshCache });
+    const pre = evalPreflight(projectPath, node, { refresh: refreshCache });
     if (pre.status) return { ...entry, status: pre.status, reason: pre.reason };
   }
 
   return null;
 }
 
-/**
- * Turn ONE executor result into a `runs[]` entry — the count rule included.
- *
- * Called by both the local loop and the `--linux` container path on purpose:
- * a drop, a rise and an unknown count must mean the same thing whether the
- * suite ran on this host or inside a container. A second copy of this judgement
- * is how two environments start disagreeing about the same suite.
- */
+// The single count rule for host and container runs; a second copy makes them disagree.
 function judgeRun({ node, result, durationMs }) {
   const entry = emptyRunEntry(node);
 
@@ -647,8 +457,7 @@ function judgeRun({ node, result, durationMs }) {
     return { ...entry, durationMs, reason: result.reason || 'no test command detected' };
   }
 
-  // A timeout has no verdict to report: the tail of a truncated log reads like
-  // a passing run cut mid-sentence. Lead with what actually happened.
+  // A truncated log tail reads like a passing run cut mid-sentence: lead with the timeout.
   if (result.timedOut) {
     const tail = tailLines(result.output, OUTPUT_TAIL_LINES);
     return {
@@ -661,35 +470,19 @@ function judgeRun({ node, result, durationMs }) {
     };
   }
 
-  // How many tests actually ran, and how that compares to the recorded
-  // baseline. Read from the FULL output, before it is truncated to a tail —
-  // the summary line is the last thing a runner prints, but a red run's tail
-  // is chosen for the failures, not for the summary.
+  // Parsed from the FULL output, before truncation to a tail.
   const parsed = parseTestCount(result.output, node.runner);
   const count = parsed ? parsed.total : null;
 
-  // A narrowed run is PARTIAL by construction (#87): it has a verdict of its
-  // own, and the count rule below never sees it.
-  if (entry.selection?.mode === 'narrowed') {
-    return judgeNarrowedRun({ entry, node, result, durationMs, count });
-  }
-
-  // An eval node's unit is the SCENARIO (#110 part 2): its baseline is the
-  // summary's scenario count, and `judgeEvalRun` is the one that compares it.
-  // Comparing here too, with the extractor's count of xunit cases, failed a
-  // 24/24 run as "esperado 24, executado 2" — and `judgeEvalRun` only turns a
-  // pass into a fail, never the reverse.
+  // An eval node's unit is the SCENARIO, compared only by `judgeEvalRun`; the
+  // extractor's xunit-case count against that baseline would fail green runs.
   const verdict = compareTestCount(count, node.runner === EVAL_RUNNER ? null : node.expectedCount);
   const warnings = verdict.warning ? [verdict.warning] : [];
 
-  // A drop is the one count verdict that fails a node by itself: tests that
-  // used to run no longer do. A RISE never fails (D7) — the suite grows with
-  // every task, and failing on growth teaches deleting tests.
+  // Only a drop fails a node; a rise never does, or failing on growth teaches deleting tests.
   if (verdict.verdict === 'drop' && result.passed) {
     return { ...entry, status: 'fail', durationMs, count, warnings, reason: verdict.reason, output: '' };
   }
-  // Already red: the failing test is the better lead, so the drop travels
-  // beside it instead of overwriting the reason.
   if (verdict.verdict === 'drop') warnings.push(verdict.reason);
 
   return {
@@ -698,85 +491,13 @@ function judgeRun({ node, result, durationMs }) {
     durationMs,
     count,
     warnings,
-    // `test-build-failed` / `stale-binary`: the executor refused BEFORE any
-    // test ran, and the reason is the only thing worth reading. Without this
-    // the node would go red with a null reason and the reader would go hunting
-    // through a compiler log for a suite that never started.
+    // `test-build-failed` / `stale-binary`: refused before any test ran.
     reason: result.reason ?? null,
     output: result.passed ? '' : tailLines(result.output, OUTPUT_TAIL_LINES),
   };
 }
 
-/**
- * The verdict of a NARROWED run (#87): what `judgeRun` hands over instead of
- * its count rule. Reached from the host loop and from `--linux` alike, because
- * both go through `judgeRun`.
- *
- * Two things change, and both follow from "partial by construction":
- *
- *   - NO `compareTestCount`. `expectedCount` is the WHOLE suite's baseline: a
- *     recorte running 12 of 3.082 is not a drop, and a superset selection
- *     running more than the baseline is not a rise. Either comparison would
- *     report something about the suite that this run never measured.
- *   - a pass needs PROOF that tests ran. A filter that matches nothing exits 0
- *     under VSTest, and "zero tests, all green" is exactly the verdict issue #87
- *     must never buy. What counts as proof is the selection's `zeroGuard`
- *     (test-scope.js):
- *       `count`      only a parsed count > 0. **null is UNKNOWN, never green**;
- *       `mtp-exit-8` a parsed count > 0 proves it (the MTP summary is read in
- *                    pt-BR and en-US, #115); with no readable summary (another
- *                    locale), exit 0 does — MTP exits 8 on zero tests.
- *     A parsed 0 is refused under either guard: it is positive evidence. It is
- *     also what closes limit (f): with exit 8 IGNORED, MTP exits 0 over a
- *     summary that says `total: 0` (measured, mtp-ignore-exit-code-8-zero-tests.txt).
- *     In a narrowed `&&` chain the SUM would hide that link behind another's
- *     count, so under `mtp-exit-8` every MTP block is checked on its own — MTP
- *     prints one block per invocation (measured), and a `total: 0` block is red.
- *
- * A FAILED run is renamed `narrowed-zero-tests (…)` only when it carries the
- * runner's zero-test signature AND no count proves tests ran. A multi-project
- * VSTest output may print "No test matches…" for one project while another
- * ran and failed; that failure is the lead, never a zero. Anything else,
- * exit 9 included, keeps the executor's own raw reason: a project that imposes
- * `--minimum-expected-tests` is narrowed only with its floor lowered to 1 by
- * `-p:` (#114, test-scope.js), where a run with tests cannot exit 9 — so a 9
- * here is not ours to reinterpret.
- *
- * Every red leads its output with the verdict, like a timeout does: the
- * feedback line reads `output` before `reason`, and a tail alone would bury it.
- */
-function judgeNarrowedRun({ entry, node, result, durationMs, count }) {
-  const tail = tailLines(result.output, OUTPUT_TAIL_LINES);
-  const base = { ...entry, durationMs, count, warnings: [] };
-  const red = (reason) => ({ ...base, status: 'fail', reason, output: tail ? `${reason}\n${tail}` : reason });
-  const green = () => ({ ...base, status: 'pass', reason: result.reason ?? null, output: '' });
-  const ranTests = Number.isInteger(count) && count > 0;
-
-  if (result.passed) {
-    if (count === 0) return red(NARROWED_ZERO_TESTS);
-    if (entry.selection.zeroGuard === 'mtp-exit-8' && mtpSummaryTotals(result.output).includes(0)) {
-      return red(NARROWED_ZERO_TESTS_LINK);
-    }
-    if (ranTests) return green();
-    if (entry.selection.zeroGuard === 'mtp-exit-8' && result.exitCode === 0) return green();
-    return red(NARROWED_COUNT_UNKNOWN);
-  }
-
-  if (!ranTests && isZeroTestRun(result.output, node.runner, result.exitCode)) {
-    return red(`narrowed-zero-tests (${node.runner}, exit ${result.exitCode ?? 'desconhecido'}): o recorte executou 0 testes`);
-  }
-
-  return { ...base, status: 'fail', reason: result.reason ?? null, output: tail };
-}
-
-/**
- * Aggregate the per-node runs into the single node `verify` publishes.
- *
- * The rollup is pessimistic on purpose: ANY red run reddens it. A green
- * aggregate covering a red suite is F30 restated, so `some(fail)` is checked
- * before anything else. `skip` only survives when there is nothing else to
- * report — one green run among skips is a pass.
- */
+// Any red run reddens the rollup; one green run among skips is a pass.
 function rollUpTestRuns(runs, { command, source, environment = null }) {
   const failed = runs.filter((r) => r.status === 'fail');
   const status = failed.length > 0
@@ -790,13 +511,8 @@ function rollUpTestRuns(runs, { command, source, environment = null }) {
     reason: null,
     output: failed.map((r) => r.output).filter(Boolean).join('\n'),
     source,
-    // Where these suites ran. `null` is the local host; a container run says so
-    // by name and image, because a green from a container and a green from the
-    // host are otherwise indistinguishable in feature.json — and the next
-    // person would not know what was proven.
+    // null is the local host; a container run is named so feature.json says what was proven.
     environment,
-    // Named by suite: a warning that does not say WHICH baseline went stale
-    // sends the reader to read every one of them.
     warnings: runs.flatMap((r) => (r.warnings || []).map((w) => `${r.id}: ${w}`)),
     runs,
   };
@@ -810,17 +526,8 @@ function rollUpTestRuns(runs, { command, source, environment = null }) {
   return node;
 }
 
-/**
- * One feedback line per RED node, named by node id.
- *
- * The `[tests/{id}]` prefix replaces the old bare `[tests]`: with N suites, a
- * line that does not say which one failed sends the reader to the wrong repo
- * half.
- */
 function appendTestsFeedback(feedback, testsNode) {
-  // Warnings are emitted whatever the verdict — a stale baseline lives on a
-  // GREEN node by construction (the count rose), so a warning that only
-  // printed on failure would never print at all.
+  // Warnings print whatever the verdict: a stale baseline lives on a GREEN node.
   for (const run of testsNode.runs || []) {
     for (const warning of run.warnings || []) {
       feedback.push(`[tests/${run.id}] warning: ${warning}`);
@@ -835,31 +542,7 @@ function appendTestsFeedback(feedback, testsNode) {
   }
 }
 
-/**
- * Why `--refresh-cache` cannot mean what it says, or null when it can.
- *
- * Judged BEFORE the build node, and the ordering is the whole point: a refusal
- * that arrived after the cache was touched would leave a half-rewritten tree
- * behind. Same discipline `finish --merge` learned — validate the precondition
- * before the mutation, never after.
- *
- * Three refusals, all usage errors (exit 2), never verdicts:
- *   - no eval node declared: succeeding silently would teach the user to type a
- *     flag that does nothing;
- *   - `--skip-tests`: the two flags cancel each other, and the winner would be
- *     whichever the code happened to check first;
- *   - a filter that excludes every eval node: same shape as the first.
- *
- * The MISSING CREDENTIAL is deliberately NOT judged here: it is per node (each
- * declares its own `envFile`), so `evalPreflight` answers it — still before the
- * command runs, and still without touching the tree.
- *
- * @param {string} projectPath
- * @param {{nodes: Array}} testPlan
- * @param {{tokens: string[], raw: string}|null} filter
- * @param {{skipTests: boolean}} opts
- * @returns {string|null}
- */
+// The missing credential is judged per node by `evalPreflight`, not here.
 function refreshCacheProblem(projectPath, testPlan, filter, { skipTests }) {
   if (skipTests) {
     return '--refresh-cache com --skip-tests: as duas flags se anulam — a regravação da cache É a suíte de eval';
@@ -879,41 +562,9 @@ function refreshCacheProblem(projectPath, testPlan, filter, { skipTests }) {
   return null;
 }
 
-// ============================================================================
-// Baseline recording (--record-baseline)
-// ============================================================================
-
-/**
- * Why `--record-baseline` cannot run here, or null when it can.
- *
- * Judged BEFORE the build node, beside the `--filter` check, because both are
- * statements about a command that cannot mean what it says. Paying for a full
- * suite to be told there was nowhere to write the result is the worst possible
- * ordering.
- *
- * The refusal for a project with no `project.tests[]` is deliberate rather
- * than helpful: the nodes the fallback synthesizes are not declared anywhere,
- * so there is no entry to update, and writing one would mean this command
- * inventing the declaration it came to maintain. `config.json` is likewise
- * never created — the framework repository has none on purpose (creating it
- * breaks `doctor --full`), so the honest answer is a named usage error.
- *
- * A TASK id is refused first (#87): at task scope the runner narrows the nodes
- * AND the commands, so what it measures is a recorte, while `expectedCount` is
- * the whole fleet's number. `recordTestBaselines` refuses a measurement that
- * carries a selection (the second barrier), but paying for the recorte to
- * learn that is the ordering this function exists to prevent.
- *
- * @param {string} projectPath
- * @param {{ nodes: Array, source: string }} testPlan
- * @param {{ skipTests: boolean, taskId?: string|null }} opts
- * @returns {string|null}
- */
-function baselineTargetProblem(projectPath, testPlan, { skipTests, taskId = null }) {
-  if (taskId) {
-    return `--record-baseline é manutenção da frota: rode sem {task} (recebeu "${taskId}") — `
-      + 'no escopo de task o verify recorta nós e testes, e baseline de recorte não é baseline';
-  }
+// Never creates config.json nor a `project.tests[]` entry: fallback nodes have no
+// declaration to update, and inventing one is not this command's job.
+function baselineTargetProblem(projectPath, testPlan, { skipTests }) {
   if (skipTests) {
     return '--record-baseline com --skip-tests não mede nada — uma baseline vem de uma execução, não de uma omissão';
   }
@@ -928,20 +579,8 @@ function baselineTargetProblem(projectPath, testPlan, { skipTests, taskId = null
   return null;
 }
 
-/**
- * Turn a finished tests rollup into a baseline write, or into a refusal.
- *
- * D8 lives here: the number is only ever what a REAL run measured, and only
- * when every node of that run is green. A red run records nothing — writing a
- * lower count over a regression is how the regression becomes the new normal.
- * A PARTIAL run records nothing either: `--filter` and skips leave nodes
- * unmeasured, and a baseline covering half the fleet is a claim about the
- * other half that nobody made.
- *
- * @param {string} projectPath
- * @param {Object} testsNode - The rollup produced by runTestsNode()
- * @returns {{ recorded: boolean, reason: string|null, updates: Array, path?: string }}
- */
+// Only a run with EVERY node green records: a red run would freeze the regression,
+// a partial one would claim counts for nodes nobody measured.
 function recordBaselineFrom(projectPath, testsNode) {
   const runs = testsNode.runs || [];
   const refuse = (reason) => ({ recorded: false, reason, updates: [] });
@@ -957,24 +596,13 @@ function recordBaselineFrom(projectPath, testsNode) {
     );
   }
 
-  // The selection travels with the count so the WRITER can refuse a recorte
-  // (#87) — the second barrier behind baselineTargetProblem's usage error.
-  return recordTestBaselines(
-    projectPath,
-    runs.map((r) => ({ id: r.id, count: r.count, selection: r.selection ?? null }))
-  );
+  return recordTestBaselines(projectPath, runs.map((r) => ({ id: r.id, count: r.count })));
 }
 
-// ============================================================================
-// Validators node
-// ============================================================================
-
 async function runValidatorsNode({ projectPath, featureName, _runValidation }) {
   const start = Date.now();
 
-  // runValidation() prints chalk-formatted progress to stdout. verify emits
-  // JSON — silence console during the call and ALWAYS restore it, even if
-  // runValidation throws.
+  // runValidation() prints progress to stdout, which would corrupt verify's JSON.
   const originalLog = console.log;
   const originalWarn = console.warn;
   let validationResult;
@@ -1013,8 +641,7 @@ async function runValidatorsNode({ projectPath, featureName, _runValidation }) {
 }
 
 function appendValidatorsFeedback(feedback, validatorsNode) {
-  // A validator that could not check (reuse without a graph) is invisible in a
-  // green node; when the whole node skipped, its own line already says why.
+  // A validator that could not check is invisible in a green node otherwise.
   if (validatorsNode.status !== 'skip') {
     for (const s of validatorsNode.skipped || []) {
       if (s.unavailable) feedback.push(`[validators/${s.validator}] não rodou: ${s.reason}`);
@@ -1031,57 +658,51 @@ function appendValidatorsFeedback(feedback, validatorsNode) {
   }
 }
 
-// ============================================================================
-// E2E node
-// ============================================================================
-
-async function runE2eNode({ projectPath, featureName, taskId, task = null, skipE2e, freshE2e, buildNode, gate, _runE2eCheck }) {
+async function runE2eNode({ projectPath, featureName, skipE2e, freshE2e, buildNode, gate, _runE2eCheck }) {
   if (buildNode.status === 'fail') {
     return {
-      status: 'skip',
-      command: null,
-      durationMs: 0,
-      reason: 'build failed — the stack could not come up anyway',
-      output: '',
+      node: {
+        status: 'skip',
+        command: null,
+        durationMs: 0,
+        reason: 'build failed — the stack could not come up anyway',
+        output: '',
+      },
+      stackEnv: null,
     };
   }
 
   const config = readConfig(projectPath);
-  const taskGroup = task?.group ?? null;
   const gitCommonDir = resolveGitCommonDir(projectPath);
+  // Without the port block, two worktrees verifying at once collide on host ports.
+  const env = buildComposeEnv({ cwd: projectPath, config, featureName, gitCommonDir });
 
   const start = Date.now();
   const result = _runE2eCheck(projectPath, {
     config,
     featureName,
-    taskGroup,
-    scope: taskId ? 'task' : 'feature',
     gitCommonDir,
-    // The port block matters MORE here than in `e2e up`: this is the path that
-    // runs in the loop, and two worktrees verifying at once would otherwise get
-    // distinct container names and then collide on host port 3000 — a red gate
-    // over an infrastructure clash instead of a defect.
-    env: buildComposeEnv({ cwd: projectPath, config, featureName, gitCommonDir }),
+    env,
     skipRequested: skipE2e,
     forceFresh: freshE2e,
     beforeHeavy: () => gate.enter('e2e'),
-    // The stack stays up between verifies on purpose: cold-starting a .NET
-    // container per task is the difference between a usable loop and one
-    // nobody runs. `morph-spec e2e down` (and `finish`) tear it down.
+    countSpecs: (output) => parseTestCount(output, 'playwright')?.total ?? null,
+    // Cold-starting a .NET container per verify is too slow; `e2e down` and `finish` tear it down.
     keepUp: true,
   });
   const durationMs = Date.now() - start;
 
   return {
-    status: result.status,
-    command: result.command ?? null,
-    durationMs,
-    reason: result.reason ?? null,
-    output: result.output || '',
-    // Non-fatal findings (e.g. a compose with fixed ports at the ROOT, where
-    // nothing collides yet). Surfaced so the same compose does not fail
-    // unannounced the day the feature moves into a worktree.
-    warnings: Array.isArray(result.warnings) ? result.warnings : [],
+    node: {
+      status: result.status,
+      command: result.command ?? null,
+      durationMs,
+      reason: result.reason ?? null,
+      output: result.output || '',
+      count: Number.isInteger(result.count) ? result.count : null,
+      warnings: Array.isArray(result.warnings) ? result.warnings : [],
+    },
+    stackEnv: { COMPOSE_PROJECT_NAME: composeProjectName(featureName), ...env },
   };
 }
 
@@ -1096,41 +717,8 @@ function appendE2eFeedback(feedback, e2eNode) {
   }
 }
 
-/**
- * The task as verify needs it, or null when tasks.json or the task is missing.
- *
- * The ONE reader of tasks.json for verify: the group picks the e2e
- * applicability, group + outputs pick the test scope, and the command uses the
- * null to refuse an unknown task id.
- *
- * @param {string} projectPath
- * @param {string} featureName
- * @param {string} taskId
- * @returns {{ group: string|null, outputs: string[] }|null}
- */
-export function readTask(projectPath, featureName, taskId) {
-  try {
-    const tasksPath = getAbsoluteOutputPath(projectPath, featureName, 'tasks');
-    if (!existsSync(tasksPath)) return null;
-    const tasksJson = JSON.parse(readFileSync(tasksPath, 'utf8'));
-    const task = (tasksJson.tasks || []).find((t) => t.id === taskId);
-    if (!task) return null;
-    return {
-      group: task.group ?? null,
-      outputs: Array.isArray(task.outputs) ? task.outputs : [],
-    };
-  } catch {
-    return null;
-  }
-}
-
-// ============================================================================
-// Shared helpers
-// ============================================================================
-
-/** Read the project stack directly from config.json — never the stack-profile
- *  default (which falls back to 'unknown'→dotnet and would wrongly fire
- *  `dotnet build` on a greenfield JS project). */
+// Never the stack-profile default: it falls back to dotnet and would fire
+// `dotnet build` on a greenfield JS project.
 function readStack(projectPath) {
   try {
     const configPath = join(projectPath, '.morph', 'config', 'config.json');
@@ -1142,10 +730,6 @@ function readStack(projectPath) {
   }
 }
 
-/** Read frontend/backend sub-paths for a monorepo, so the build node can run
- *  each stack's build command from its own directory instead of assuming a
- *  single root (see getBuildSteps() in build-check.js). Absent in single-stack
- *  projects — every consumer treats missing paths as "use projectPath". */
 function readProjectPaths(projectPath) {
   try {
     const configPath = join(projectPath, '.morph', 'config', 'config.json');
@@ -1158,7 +742,6 @@ function readProjectPaths(projectPath) {
   }
 }
 
-/** Read the whole config.json — the e2e node needs `e2e` and `project` together. */
 function readConfig(projectPath) {
   try {
     const configPath = join(projectPath, '.morph', 'config', 'config.json');
@@ -1169,14 +752,8 @@ function readConfig(projectPath) {
   }
 }
 
-/**
- * Resolve the shared git dir, where the e2e freshness stamp lives — the same
- * location and rationale as the fleet env-registry (see env-allocator.js): it
- * is the one place every linked worktree of a repo shares, and writing there
- * can never dirty the `git status` the worktree-finish gates read.
- *
- * Fail-open: no git, no stamp — the cost is a rebuild, never a crash.
- */
+// The e2e freshness stamp lives in the common dir: shared by every worktree and
+// never dirties `git status`. Fail-open: no git costs a rebuild, never a crash.
 function resolveGitCommonDir(projectPath) {
   try {
     const common = execFileSync('git', ['rev-parse', '--git-common-dir'], {