create-cmp-cli 0.23.0 → 0.25.0

package/packages/harness/src/lib/evidence-level.mjs

@@ -29,92 +29,177 @@
 //     the inner loop, a signal rather than evidence, so a fast receipt must
 //     never be silently reused as if it were a full-lane result: pass the
 //     run's mode and "fast" derives null, always.
+//   - A PROFILE THAT SHIPS NO PLANTS EARNS NO RUNG — the badge floor. A ladder
+//     names rungs; plants are what prove the steps under them still bite. A
+//     profile with the second and not the first is a vocabulary nobody
+//     calibrated, and grading it says something about a lane that nothing
+//     checked. See "the badge floor" below for the episode and the argument.
 //   - The rung is COARSE by design. The per-step list (and the existing
 //     strength string) stays the fine print alongside it — steps that may
 //     SKIP for honest configuration absence (approvals unreviewed, no
 //     exported schemas) are visible there; only the always-run steps gate
 //     the desktop rungs, and only executed PASSes gate the device rungs.
 
-/** The scaffold profile's step set (verify.mjs stepsForProfile.scaffold). */
-const SCAFFOLD_CORE = [
-  "specCoverage",
-  "approvals",
-  "componentStories",
-  "reachability",
-  "e2eCoverage",
-  "archDoc",
-  "schemaHistory",
-  "build",
-  "unitTests",
-];
+// The Compose ladder that used to live here is qa/lib/profiles/cmp/ladder.mjs
+// (Stage 0 PR 3). This module derives a rung from WHATEVER ladder it is handed;
+// it carries no step names of its own and defaults to none — a profile that
+// declares no ladder earns no rung. The rung vocabulary above is one profile's
+// example, kept because it is the clearest statement of what a rung is for.
+//
+// WHERE THAT LADDER COMES FROM IS NOT THIS MODULE'S QUESTION, and saying it was
+// is how a defect hid: this comment used to name one of the two spellings a
+// profile may use (`evidenceLadder`, on the pack), which is the one the runner
+// happened to read while the Stop hook read the other. Resolving between them
+// is qa/lib/evidence-ladder.mjs's single job, and every caller goes through it.
+// The fields read below are the fields that resolution compares — the pairing
+// is derived from this source by test/evidence-ladder.test.mjs so the two
+// cannot drift.
 
-/** Steps every PASS must carry to claim even L0 — they run in every profile and never SKIP. */
-const L0_REQUIRED = ["build", "unitTests"];
+// ── THE BADGE FLOOR, AND WHY THE GRADER IS WHERE IT LIVES ───────────────────
+//
+// Until 2026-09-08 this module derived a rung from the ladder alone. Two
+// scratch adopters built by scripts/stage2-gate.mjs, differing in EXACTLY one
+// export — one shipping `plants`, one shipping none — ran the real lane and
+// both earned `L1 · every promise bound`. The twin that could calibrate nothing
+// was graded identically to the twin that could, against a guarantee that was
+// already binding (NORTH-STAR.md §8.9, §6.7, and §3's third *never*).
+//
+// The floor could have been enforced one layer out, in the lane runner, leaving
+// this function a pure ladder→rung derivation. It is here instead, because a
+// grader that can be called without the floor is a grader that WILL be: the
+// ladder's own two-spellings defect (§9.2) happened precisely because two
+// readers reached the same question by different routes and only one of them
+// was right. There is one grader, it takes the profile's plant declaration, and
+// a caller that does not pass one gets NO RUNG rather than an ungrounded one —
+// forgetting fails CLOSED, which is the only direction a floor may fail in.
+//
+// WHAT COUNTS AS PLANTS is deliberately not decided here. It is the
+// instrument's judgement, and asking qa/lib/plant-calibration.mjs is how the
+// grader and the instrument are kept from holding two definitions of the same
+// word — the `flowCitation`/`scanCitations` failure, which cost a gate nobody
+// was calibrating. That file also carries the argument for WHICH reading of
+// "calibrated" is implemented (structurally usable, not merely declared, and
+// not the observed reading, which no lane run can derive).
+import { plantCalibration } from "./plant-calibration.mjs";
 
 /**
- * The steps that distinguish full desktop evidence (L1) from the scaffold
- * checks. None of these can SKIP — they PASS or FAIL — so "PASSed" is exactly
- * "ran green".
+ * Derive the receipt's evidence rung AND the sentence explaining an absent one.
+ *
+ * TWO RETURNS, ONE DECISION. `evidenceLevel` below is this function's `.level`
+ * and nothing else — there is no second copy of the derivation — because the
+ * rung and the reason it is missing must never be able to disagree. The reason
+ * exists because "no rung, no explanation" is itself a defect this project has
+ * already paid for: a foreign author who declared their ladder in the seeded
+ * spelling got a green lane, no rung and not one word about why, and it took a
+ * gate written in another ecosystem to find it (NORTH-STAR.md §9.2).
+ *
+ * The `why` is NOT written to the receipt. A receipt records what was earned;
+ * this is a sentence for a human reading a lane, and putting it on the receipt
+ * would change the receipt's schema, which is a decision for an ADR rather than
+ * for this fix (fit-test question 5).
+ *
+ * @param {Array<{name: string, verdict: string}>} stepResults the lane's steps
+ * @param {string} [profile] the profile that was REQUESTED (scaffold | local |
+ *   ci | …) — recorded context only, never part of the derivation, and
+ *   deliberately never quoted in `why`: it names the RUN, not the pack, and a
+ *   message that confused the two would send a reader to the wrong file
+ * @param {{mode?: string, ladder?: object|null, plants?: object|null}} [opts]
+ * @returns {{level: {rung: string, name: string, satisfiedBy: string[]}|null, why: string|null}}
+ *   `why` is null exactly when `level` is not.
  */
-const L1_REQUIRED = ["releaseBuild", "conformance", "goldenTrees", "a11y"];
-
-/** On-device EXECUTION steps — the only steps that can earn L2. */
-const DEVICE_EXECUTION = ["e2eSmoke", "tokenDrift", "androidChecks"];
+export function gradeEvidence(stepResults, profile, { mode, ladder, plants } = {}) { // eslint-disable-line no-unused-vars
+  const none = (why) => ({ level: null, why });
+  if (mode === "fast") return none("no evidence rung: this run was `--fast`, the inner loop — a signal, never evidence");
 
-/** The one step that can lift L2 to L3. */
-const RELEASE_EXECUTION = "releaseSmoke";
-
-const RUNG_NAMES = { L0: "scaffold", L1: "desktop", L2: "device", L3: "release" };
+  // THE BADGE FLOOR IS ASKED FIRST, before the ladder, because it decides
+  // whether this profile may be graded AT ALL: a ladder over uncalibrated
+  // plants is a vocabulary for a claim nobody checked, so the ladder question
+  // is moot until this one is answered. Both absences are reported together
+  // when both apply — an author who fixes one and comes back for the other has
+  // been charged two round trips by a message that knew both answers.
+  const calibrated = plantCalibration(plants);
+  if (!calibrated.ok) {
+    const alsoNoLadder = !ladder || typeof ladder !== "object";
+    return none(
+      // The §6.7 citation is already inside `calibrated.reason`; repeating it
+      // here made the most-read line in the lane cite the same section twice.
+      `no evidence rung: ${calibrated.reason}. A profile ships plants its Rule 0 instrument can run — ` +
+        "`node qa/framework-check.mjs` — or it ships without a badge (§8.9)" +
+        (alsoNoLadder ? ", and this profile declares no `ladder` either, which alone earns no rung" : ""),
+    );
+  }
 
-/**
- * The Compose Multiplatform pack's ladder — the step names above, as one
- * object a pack hands to the spine. THE LADDER IS THE PACK'S, NOT THE SPINE'S
- * (2026-09-03): vendored into a Kotlin backend, these names graded its
- * strongest run — detekt, Konsist, gitleaks — as L0 "scaffold" and
- * made L1 unreachable by construction. A fixed-amount understatement is not
- * conservative, it is wrong, and receipts are where labels get quoted. So a
- * pack declares its ladder (`evidenceLadder` on createXSteps' return); a pack
- * that declares none earns no rung at all, which is the honest grade for a
- * ladder nobody has calibrated. Every field is a list of step names except
- * `release`, one name. `names` maps rung → label.
- */
-export const CMP_LADDER = Object.freeze({
-  scaffoldCore: Object.freeze(SCAFFOLD_CORE),
-  l0Required: Object.freeze(L0_REQUIRED),
-  l1Required: Object.freeze(L1_REQUIRED),
-  deviceExecution: Object.freeze(DEVICE_EXECUTION),
-  release: RELEASE_EXECUTION,
-  names: Object.freeze(RUNG_NAMES),
-});
+  // No ladder → no rung. There is no default: a rung is a claim in a
+  // profile's own vocabulary, and the spine has none to lend. `null` and
+  // `undefined` mean the same thing here — the pack declared nothing.
+  if (!ladder || typeof ladder !== "object") {
+    return none("no evidence rung: this profile declares no `ladder`, so there are no rungs to earn — which is the honest grade, not a failure");
+  }
+  const level = rungFor(stepResults, ladder);
+  if (level) return { level, why: null };
+  const steps = Array.isArray(stepResults) ? stepResults.filter((s) => s && typeof s.name === "string") : [];
+  const red = steps.filter((s) => s.verdict === "FAIL" || s.verdict === "ERROR");
+  if (red.length) {
+    return none(
+      `no evidence rung: ${red.map((s) => `${s.name} ${s.verdict}`).join(", ")} — a lane that failed, or that could not check, has no rung`,
+    );
+  }
+  const floor = (ladder.l0Required ?? []).filter((name) => !steps.some((s) => s.name === name && s.verdict === "PASS"));
+  return none(
+    `no evidence rung: this ladder's floor rung needs ${(ladder.l0Required ?? []).join(", ") || "(nothing)"} to PASS and ` +
+      `${floor.join(", ")} did not — a SKIP never earns a rung`,
+  );
+}
 
 /**
  * Derive the receipt's evidence rung from the lane's step results.
  *
+ * THE ONE GRADER. Everything that shows a rung derives it here or reads one a
+ * run of this function wrote onto a receipt; nothing recomputes it its own way.
+ *
  * @param {Array<{name: string, verdict: string}>} stepResults the lane's steps
  *   as recorded on the receipt (verdict PASS | FAIL | SKIP per step)
  * @param {string} [profile] the profile that was REQUESTED — recorded context
  *   only, never part of the derivation (see honesty rules above)
- * @param {{mode?: string}} [opts] the run's mode ("full" | "fast"). "fast"
- *   derives null unconditionally — the inner loop earns no rung (see honesty
- *   rules above). Absent/other values mean full.
+ * @param {{mode?: string, ladder?: object|null, plants?: object|null}} [opts]
+ *   the run's mode ("full" | "fast"), the PROFILE's resolved ladder
+ *   (qa/lib/evidence-ladder.mjs) and the PROFILE's `plants` declaration.
+ *   "fast" derives null unconditionally — the inner loop earns no rung.
+ *   Absent/other values for mode mean full; an absent `plants` means no rung,
+ *   because the badge floor fails closed (see above).
  * @returns {{rung: "L0"|"L1"|"L2"|"L3", name: string, satisfiedBy: string[]}|null}
- *   null when any step FAILed (a failed lane has no rung), when the run was
- *   fast-mode (the inner loop is never evidence), or when even the L0 floor
- *   was not earned. `satisfiedBy` lists the PASSed steps the rung counts as
- *   its evidence, in lane order.
+ *   null when the profile ships no usable plants (the badge floor), when it
+ *   declares no ladder, when any step FAILed (a failed lane has no rung), when
+ *   the run was fast-mode (the inner loop is never evidence), or when even the
+ *   L0 floor was not earned. `satisfiedBy` lists the PASSed steps the rung
+ *   counts as its evidence, in lane order. A caller that wants the SENTENCE for
+ *   an absent rung calls `gradeEvidence` and reads `.why` — same decision, one
+ *   implementation.
+ */
+export function evidenceLevel(stepResults, profile, opts = {}) {
+  return gradeEvidence(stepResults, profile, opts).level;
+}
+
+/**
+ * The ladder half of the derivation, once the badge floor has been cleared:
+ * which rung THESE steps earn under THIS ladder, and nothing about whether the
+ * profile was entitled to be graded. Private on purpose — `gradeEvidence` is
+ * the only caller, so the floor cannot be walked around from inside this file
+ * any more than it can from outside it.
+ *
+ * @param {Array<{name: string, verdict: string}>} stepResults
+ * @param {object} ladder
+ * @returns {{rung: string, name: string, satisfiedBy: string[]}|null}
  */
-export function evidenceLevel(stepResults, profile, { mode, ladder } = {}) { // eslint-disable-line no-unused-vars
-  if (mode === "fast") return null; // the inner loop derives no rung — ever
-  // `ladder` absent → the Compose ladder (every caller before packs declared
-  // one). `ladder: null` → the pack declares none: no rung, by decision.
-  if (ladder === null) return null;
-  const L = ladder ?? CMP_LADDER;
+function rungFor(stepResults, ladder) {
+  const L = ladder;
   const SCAFFOLD_CORE = L.scaffoldCore ?? [];
   const L0_REQUIRED = L.l0Required ?? [];
   const L1_REQUIRED = L.l1Required ?? [];
   const DEVICE_EXECUTION = L.deviceExecution ?? [];
   const RELEASE_EXECUTION = L.release ?? null;
-  const RUNG_NAMES = L.names ?? CMP_LADDER.names;
+  // A ladder without labels still grades — the rung id is its own label.
+  const RUNG_NAMES = L.names ?? { L0: "L0", L1: "L1", L2: "L2", L3: "L3" };
   const steps = Array.isArray(stepResults) ? stepResults.filter((s) => s && typeof s.name === "string") : [];
   // A failed lane has no rung — and a lane with a step that could not run
   // (ERROR) has none either: a rung is evidence, and "could not check" is not.

package/packages/harness/src/lib/feature-brief.mjs

@@ -50,6 +50,7 @@ import path from "node:path";
 
 import { computeInputsHash } from "./inputs-hash.mjs";
 import { CLAUSE_LINE_RE, scanCitations } from "./spec-coverage.mjs";
+import { requireSpecModel } from "./spec-model.mjs";
 
 export const FEATURES_DIR_REL = "docs/features";
 
@@ -197,7 +198,7 @@ export function parseFeatureBlock(markdown) {
         ...new Set(
           parsed.specs
             .filter((s) => typeof s === "string" && s.trim() !== "")
-            .map((s) => s.trim().replace(/^specs\//, "").replace(/\.spec\.md$/, "")),
+            .map((s) => s.trim().replace(/^[A-Za-z0-9_./-]*?specs\//, "").replace(/\.spec\.md$/, "")),
         ),
       ]
     : [];
@@ -223,10 +224,10 @@ export function parseFeatureBlock(markdown) {
  *   caller already has one (avoids re-parsing; same answer either way)
  * @returns {string[]} spec names, e.g. ["catalog", "entry-editing"]
  */
-export function pairedSpecNames(markdown, name, block) {
+export function pairedSpecNames(markdown, name, block, specsDir = "specs") {
   const declared = (block ?? parseFeatureBlock(markdown)).specs ?? [];
   if (declared.length > 0) return declared;
-  const fromHeader = specHeaderNames(markdown);
+  const fromHeader = specHeaderNames(markdown, specsDir);
   if (fromHeader.length > 0) return fromHeader;
   return [name];
 }
@@ -236,7 +237,7 @@ export function pairedSpecNames(markdown, name, block) {
  * paragraph — the line starting `**Spec:**` through the next blank line, so
  * later prose that merely MENTIONS a spec path never redirects the pairing.
  */
-function specHeaderNames(markdown) {
+function specHeaderNames(markdown, specsDir = "specs") {
   if (typeof markdown !== "string") return [];
   const lines = markdown.split("\n");
   const start = lines.findIndex((l) => /^\*\*Spec:?\*\*/.test(l.trim()));
@@ -244,7 +245,7 @@ function specHeaderNames(markdown) {
   const para = [];
   for (let i = start; i < lines.length && lines[i].trim() !== ""; i++) para.push(lines[i]);
   const out = [];
-  for (const m of para.join("\n").matchAll(/specs\/([A-Za-z0-9_-]+)\.spec\.md/g)) {
+  for (const m of para.join("\n").matchAll(new RegExp(`${specsDir}/([A-Za-z0-9_-]+)\\.spec\\.md`, "g"))) {
     if (!out.includes(m[1])) out.push(m[1]);
   }
   return out;
@@ -315,6 +316,25 @@ export function receiptAttestation(root) {
  *   shared scans (callers resolving many features pass these once)
  * @returns {object}
  */
+/**
+ * Where this stack's journey for `name` is written — the profile's flow
+ * directory when it declares one, else the tier's own name.
+ *
+ * Stage 0 PR 6c: the doneReason used to say "write the journey in
+ * qa/e2e/<name>.yaml" on every stack, which is a Maestro flow path. The
+ * sentence a human is told to act on must name a file their project could
+ * actually have.
+ * @param {import("./spec-model.mjs").SpecModel} model
+ * @param {string} name
+ * @returns {string}
+ */
+function journeyWhere(model, name) {
+  if (model.flows && model.flows.dir && model.flows.exts.length) {
+    return `write it in ${model.flows.dir}/${name}${model.flows.exts[0]} and cite the clause it proves`;
+  }
+  return `add a ${model.tiers.journey} test that cites one of its clauses`;
+}
+
 export function deriveFeatureStatus(root, brief, pre = {}) {
   let markdown = "";
   let readable = true;
@@ -330,24 +350,40 @@ export function deriveFeatureStatus(root, brief, pre = {}) {
   // The paired specs (walk-legibility L1): usually one, by filename; a brief
   // may name several. Clauses concatenate in declaration order — "done" means
   // every live clause across ALL of them is cited.
-  const specNames = pairedSpecNames(markdown, brief.name, block);
-  const specRels = specNames.map((n) => `specs/${n}.spec.md`);
+  // The MODEL first, because the spec directory is the profile's and this
+  // module used to hardcode `specs/`. A project declaring `"specs": "docs/specs"`
+  // — a legal, validated manifest field the lane's own scanner honours — had
+  // `deriveFeatureStatus` looking somewhere else entirely: specExists false,
+  // total 0, provenDone false forever, and the Features view telling a human to
+  // start writing a spec that already existed. The header of spec-coverage.mjs
+  // says these two readers exist so the Features view and the lane can never
+  // disagree about the same clause. They disagreed.
+  const model = pre.model ?? requireSpecModel(root);
+  const specNames = pairedSpecNames(markdown, brief.name, block, model.specsDir);
+  const specRels = specNames.map((n) => `${model.specsDir}/${n}.spec.md`);
   const specExists = specRels.every((rel) => fs.existsSync(path.join(root, rel)));
   const specRel = specRels.join(" + ");
-  const citations = pre.citations ?? scanCitations(root);
+  const citations = pre.citations ?? scanCitations(root, model);
   const citedIds = new Set(citations.map((t) => t.id));
-  // Which clauses a DEVICE journey proves: citations from qa/e2e flows (tier
-  // "e2e" — spec-coverage's tierForFile). A UI feature (screens: true) is not
-  // done until at least one of its live clauses is cited from a flow: JVM
-  // tests prove logic and structure, the flow proves the journey on a device.
-  const e2eCitedIds = new Set(citations.filter((t) => t.tier === "e2e").map((t) => t.id));
+  // Which clauses a JOURNEY proves: citations from the profile's journey tier
+  // (mobile: flows under qa/e2e). A UI feature (screens: true) is not done
+  // until at least one of its live clauses is cited from that tier: JVM tests
+  // prove logic and structure, the journey proves it on the target.
+  const journeyTier = model.tiers.journey;
+  const e2eCitedIds = new Set(citations.filter((t) => journeyTier && t.tier === journeyTier).map((t) => t.id));
   const clauses = specRels
     .flatMap((rel) => clausesOfSpec(root, rel))
     .map((c) => ({ ...c, cited: citedIds.has(c.id), e2eCited: e2eCitedIds.has(c.id) }));
   const live = clauses.filter((c) => !c.withdrawn);
   const covered = live.filter((c) => c.cited).length;
   const e2eCovered = live.filter((c) => c.e2eCited).length;
-  const needsJourney = block.screens === true && block.unrouted !== true;
+  // A journey is only required when the profile HAS a journey tier.
+  // `tiers.journey` is documented as nullable ("or null when this stack has no
+  // journey tier") and the citation filter above already yields nothing for
+  // null — but this condition never asked, so on a backend, a CLI or a library
+  // every feature with a surface was permanently un-done and the remedy printed
+  // was literally "add a null test that cites one of its clauses".
+  const needsJourney = block.screens === true && block.unrouted !== true && Boolean(model.tiers.journey);
 
   const receipt = pre.receipt ?? receiptAttestation(root);
   const provenDone =
@@ -384,7 +420,7 @@ export function deriveFeatureStatus(root, brief, pre = {}) {
         : live.length === 0
           ? `${specRel} has no live clauses — nothing is promised yet`
           : needsJourney && covered === live.length && e2eCovered === 0
-            ? `${covered}/${live.length} clauses cited, but none from a qa/e2e flow — a UI feature is proven on a device: write the journey in qa/e2e/${brief.name}.yaml and cite the clause it proves`
+            ? `${covered}/${live.length} clauses cited, but none from the ${journeyTier} tier — a feature with a surface is proven where it runs, not only on the host: ${journeyWhere(model, brief.name)}`
           : covered < live.length
             ? `${covered}/${live.length} clauses cited — ${live.length - covered} promise(s) have no citing test`
             : !receipt.present
@@ -404,6 +440,7 @@ export function deriveFeatureStatus(root, brief, pre = {}) {
 export function deriveAllFeatures(root) {
   const briefs = listFeatureBriefs(root);
   if (briefs.length === 0) return [];
-  const pre = { citations: scanCitations(root), receipt: receiptAttestation(root) };
+  const model = requireSpecModel(root);
+  const pre = { model, citations: scanCitations(root, model), receipt: receiptAttestation(root) };
   return briefs.map((b) => deriveFeatureStatus(root, b, pre));
 }

package/packages/harness/src/lib/flight-recorder.mjs

@@ -52,13 +52,44 @@ import fs from "node:fs";
 import path from "node:path";
 
 export const FLIGHT_JOURNAL_REL_PATH = "qa/flight-recorder.jsonl";
-export const FLIGHT_SCHEMA = "cmp-flight/1";
+// ADR-0007's principle, applied to the journal. The receipt's rename left this
+// behind, and the reason that ADR gave for deferring LOCK_SCHEMA — "it finishes
+// that journey with the package work" — does NOT carry over: a journal is
+// APPEND-ONLY and is never rewritten, so deferring it is deciding never. It is
+// committed in every stamped app, so a Go project's repo carried `cmp` on every
+// line of it. Nothing reads this field (readFlightJournal accepts any object),
+// so old entries and new ones coexist in one file and both stay readable.
+export const FLIGHT_SCHEMA = "prooflane-flight/1";
 
 // Below this many entries the report carries an explicit shortness note —
 // two entries are two facts, not a trend, and the report must say so rather
 // than let a reader infer a pattern from a journal that cannot support one.
 const SHORT_JOURNAL_FLOOR = 5;
 
+/**
+ * The highest rung recorded, said the only way it can honestly be said: with
+ * the pack that graded it.
+ *
+ * One pack — "L2 (pack cmp)". Several — each named, because §8.9 makes "the
+ * highest of an L2 and an L1 from different packs" a question with no answer.
+ * A rung whose entry predates pack recording is `unattributed`, never quietly
+ * credited to whichever pack is present.
+ *
+ * @param {{highestRung: string|null, highestRungByPack?: Record<string,string>}} device
+ * @returns {string} "" when nothing was recorded
+ */
+export function describeHighestRung(device) {
+  const byPack = device?.highestRungByPack ?? {};
+  const entries = Object.entries(byPack);
+  if (entries.length === 0) return "";
+  if (entries.length === 1) {
+    const [pack, rung] = entries[0];
+    return ` (highest evidence rung recorded: ${rung}, pack ${pack})`;
+  }
+  const parts = entries.sort(([a], [b]) => a.localeCompare(b)).map(([pack, rung]) => `${rung} (${pack})`);
+  return ` (highest evidence rung per pack — not comparable across them: ${parts.join(", ")})`;
+}
+
 /**
  * Shape one lane run into a journal entry. Pure — verify.mjs passes what it
  * already computed for the receipt, so the journal can never disagree with
@@ -71,6 +102,11 @@ const SHORT_JOURNAL_FLOOR = 5;
  * @param {{rung: string}|null} run.evidenceLevel the derived rung (or null —
  *   fast runs and FAILed lanes carry none, and the journal records that
  *   honestly rather than borrowing a rung from elsewhere)
+ * @param {{id: string}|null} run.pack WHICH PACK graded that rung. A rung is
+ *   comparable only within its pack (NORTH-STAR §8.9): a `cmp` L2 and a
+ *   backend pack's L2 are different claims. An entry that stored a rung with
+ *   no pack could not be compared to anything without inventing the missing
+ *   half, and `highestRung` below did exactly that across every entry.
  * @param {Array<{name: string, verdict: string, reason?: string}>} run.steps
  *   the lane's step results, verbatim
  * @param {string|null} run.sha parent HEAD at run time (null before git init)
@@ -82,7 +118,7 @@ const SHORT_JOURNAL_FLOOR = 5;
  *   (self-heals, fallbacks) — each a short verbatim description
  * @returns {object} one journal entry (JSON-serializable)
  */
-export function buildFlightEntry({ profile, mode, verdict, evidenceLevel, steps, sha, durationMs, onDeviceSteps, degraded }) {
+export function buildFlightEntry({ profile, mode, verdict, evidenceLevel, pack, steps, sha, durationMs, onDeviceSteps, degraded }) {
   const stepList = Array.isArray(steps) ? steps.filter((s) => s && typeof s.name === "string") : [];
   return {
     schema: FLIGHT_SCHEMA,
@@ -92,6 +128,10 @@ export function buildFlightEntry({ profile, mode, verdict, evidenceLevel, steps,
     mode,
     verdict,
     evidenceRung: evidenceLevel?.rung ?? null,
+    // The grader, beside the grade. Null on an entry that earned no rung, and
+    // on one written before packs were recorded — absent is honest, invented is
+    // not, and the summary below refuses to compare what it cannot attribute.
+    pack: typeof pack?.id === "string" ? pack.id : null,
     durationMs,
     // durationMs per step (additive, schema id unchanged — old entries stay
     // readable): the source for the lane's own "usually ~Ns" narration
@@ -231,11 +271,31 @@ export function summarizeFlightJournal(entries, { now = new Date() } = {}) {
 
   const fullRuns = runs.filter((e) => e.mode === "full");
   const deviceReached = runs.filter((e) => Array.isArray(e.deviceSteps) && e.deviceSteps.length > 0);
+  // THE HIGHEST RUNG, PER PACK — never across them.
+  //
+  // This used to take the maximum over every entry in the journal, which is a
+  // cross-pack comparison in a single line: if the journal held a `cmp` L2 and
+  // a backend pack's L1, it reported "L2" as though one number described both.
+  // §8.9 forbids exactly that, and the fix is not a smarter sort — it is
+  // refusing to put two incomparable claims in one ordering.
+  //
+  // An entry with a rung and no pack (written before packs were recorded)
+  // cannot be attributed, so it is counted under `null` and reported as
+  // unattributed rather than folded into whichever pack happens to be present.
   const rungOrder = { L0: 0, L1: 1, L2: 2, L3: 3 };
-  const highestRung = runs
-    .map((e) => e.evidenceRung)
-    .filter((r) => typeof r === "string" && r in rungOrder)
-    .sort((a, b) => rungOrder[b] - rungOrder[a])[0] ?? null;
+  const highestRungByPack = new Map();
+  for (const e of runs) {
+    const r = e.evidenceRung;
+    if (typeof r !== "string" || !(r in rungOrder)) continue;
+    const id = typeof e.pack === "string" ? e.pack : null;
+    const seen = highestRungByPack.get(id);
+    if (!seen || rungOrder[r] > rungOrder[seen]) highestRungByPack.set(id, r);
+  }
+  // The single-value form survives ONLY where the journal holds one pack, which
+  // is every project that has not changed profiles. With more than one it is
+  // null, and the per-pack map is the answer — a reader asking for one number
+  // over two packs is asking a question §8.9 says has no answer.
+  const highestRung = highestRungByPack.size === 1 ? [...highestRungByPack.values()][0] : null;
 
   // Longest stretch with no full lane — only computable BETWEEN two recorded
   // full runs. One full run is a date, not a stretch; the report says so
@@ -269,7 +329,7 @@ export function summarizeFlightJournal(entries, { now = new Date() } = {}) {
       lastAgoMs: lastFullAgoMs,
       longestGap: longestFullGap,
     },
-    device: { reachedRuns: deviceReached.length, highestRung },
+    device: { reachedRuns: deviceReached.length, highestRung, highestRungByPack: Object.fromEntries([...highestRungByPack].map(([k, v]) => [k ?? "unattributed", v])) },
   };
 }
 
@@ -338,7 +398,11 @@ export function renderFlightReport(summary, { malformed = 0 } = {}) {
 
   if (summary.device.reachedRuns > 0) {
     lines.push(
-      `device tier: reached in ${summary.device.reachedRuns} of ${summary.total} run(s)${summary.device.highestRung ? ` (highest evidence rung recorded: ${summary.device.highestRung})` : ""}`,
+      // A rung is shown WITH its pack, always — an unqualified "L2" is a claim
+      // about a grader nobody named (§8.9, §6.5). With more than one pack in
+      // the journal there is no single highest, and each is printed on its own
+      // rather than one being chosen to stand for both.
+      `device tier: reached in ${summary.device.reachedRuns} of ${summary.total} run(s)${describeHighestRung(summary.device)}`,
     );
   } else {
     lines.push("device tier: never reached in any recorded run (no device-tier step ever PASSed)");