create-cmp-cli 0.23.0 → 0.25.0

package/template/CLAUDE.md

@@ -4,19 +4,20 @@
 Generated by [create-cmp](https://github.com/kvdm-co-pilot/create-cmp) with a verification
 harness. Every AI session in this repo works under this contract.
 
-**Principles** (the full form, with the episode behind each, is create-cmp's
-`docs/PRINCIPLES.md`): derived, never claimed · prove the instrument before you read it · the
-layer you changed cannot certify itself · proof costs what the change costs and never runs
-silent · never wait on nothing · a signature binds content, a decision is closed · one record,
-read first. These govern every rule below; when a rule below and a principle disagree, the
-principle wins and the rule is the bug.
+**Principles** — derived, never claimed · prove the instrument before you read it · the layer you
+changed cannot certify itself · proof costs what the change costs · never wait on nothing · a
+signature binds content, a decision is closed · one record, read first. The full form with each
+episode is create-cmp's `docs/PRINCIPLES.md` (upstream, not shipped); when a rule below and a
+principle disagree, the principle wins and the rule is the bug.
 
 ## Definition of done
 
 Done means `node qa/verify.mjs` reports PASS and the receipt it writes
-(`qa/evidence/latest.json`) is in your commit. Claiming completion without a PASS receipt is
-a failure. SKIPped steps are recorded in the receipt; never present green-with-gaps as fully
-verified.
+(`qa/evidence/latest.json`) attests this tree — the hook checks the working tree by hash; commit
+it with your change so CI and reviewers hold the same proof. Claiming completion without a PASS receipt is
+a failure. SKIPped steps are recorded in the receipt, and a step that SKIPped for an environmental reason (no
+device, no bootable AVD) makes the receipt unusable as done-evidence — `qa/receipt-check.mjs` refuses
+it. Never present green-with-gaps as fully verified.
 
 **Verify in two tiers — the full lane is a checkpoint, not an inner loop.** It builds,
 tests, and gates the whole tree to produce the receipt, so it is slow by design; running it
@@ -29,15 +30,16 @@ once — when you believe the change is done.
   did-I-break-anything signal is free the way an IDE's errors-on-save are free; and
   `./gradlew :composeApp:desktopTest` for the unit tests your change touches. This is where
   you catch your own mistakes.
-- **Checkpoint — run once, at done:** `node qa/verify.mjs`. It writes the receipt; commit
+- **Checkpoint — run once, at done:** `node qa/verify.mjs`. It writes the receipt (a `--fast` run writes
+  `qa/evidence/latest-fast.json` instead, so the watcher can keep running); commit
   the receipt with your change. The Stop hook (`qa/receipt-check.mjs`) then confirms — with a
-  cheap hash check, not another lane run — that a valid receipt attests your commit, and CI
+  cheap hash check, not another lane run — that a valid receipt attests this tree, and CI
   re-runs the full lane on push. After a green checkpoint, do not re-run the lane unless you
   change the tree again.
 
 Humans get the same gate at push time: run `node qa/setup-hooks.mjs` once (after `git init`)
-to enable the shipped pre-push hook. It blocks a push whose committed receipt doesn't attest
-HEAD — the same cheap check, before code leaves the machine (`git push --no-verify` bypasses
+to enable the shipped pre-push hook. It blocks a push whose receipt doesn't attest
+the tree — the same cheap check, before code leaves the machine (`git push --no-verify` bypasses
 it; CI still enforces it).
 
 ## Specifications — behavior starts here
@@ -50,7 +52,7 @@ then implement. Durable tests cite their clause (`// SPEC: HOME-02`).
 prove that test could ever *observe* the promise. Add `[tier: device]` (or `[tier: e2e]`)
 after the id when the claim is about OS facts a host JVM cannot see — lifecycle, alarms,
 notifications, permissions, real navigation. `specCoverage` then requires a citation from
-`androidInstrumentedTest` or `qa/e2e` and FAILS without one, rather than accepting a
+`androidInstrumentedTest` or `qa/e2e` for `device`, from `qa/e2e` alone for `e2e`, and FAILS without one, rather than accepting a
 desktop test that is structurally blind to the claim.
 [`specs/app-base.spec.md`](./specs/app-base.spec.md) states the architecture and shell
 invariants the conformance gates enforce.
@@ -120,8 +122,9 @@ timezone), `DozeControl` (forced idle), `PermissionControl`, `ProcessControl`,
 the exemplar proves an `allowWhileIdle` alarm delivers from inside forced deep idle by
 nesting a clock warp in a Doze bracket. Exemplars: `PlatformBehaviorSeamTest`,
 `RuntimeStateSeamTest`. Each organ's header states what it does NOT reproduce; read it
-before claiming more than it proves. The lane's `androidChecks` step runs them when a
-device is attached; see `docs/TESTING.md`.
+before claiming more than it proves. The lane's `androidChecks` step runs them — the lane provisions its own device: an attached one, or a
+headless AVD it boots itself. `CMP_DEVICE=none` opts out, and that SKIP is environmental, so the receipt is
+then not done-evidence. See `docs/TESTING.md`.
 
 ## Evidence
 
@@ -136,9 +139,12 @@ one verified, attributed state — so committing each receipt is what builds the
 
 ## The lane is not yours to edit
 
-Every `.mjs` file directly under `qa/` and `qa/lib/` is **machine-owned**: harness code
-that is byte-identical in every create-cmp app and carries no app content at all. It
-belongs to `create-cmp-harness`, versioned independently of the engine that stamped this
+Every `.mjs` file directly under `qa/` and `qa/lib/`, every `.mjs` under
+`qa/lib/profiles/**` (this app's stack profile — its steps, tiers, ladder and device
+glue), and the declarations the lane reads (`qa/harness-manifest.json`,
+`qa/verified-surface.json`) are **machine-owned**: harness code that is byte-identical in
+every create-cmp app and carries no app content at all. It
+belongs to `prooflane-harness` (the name in your `qa/harness.lock.json`), versioned independently of the engine that stamped this
 app's shape, and `qa/harness.lock.json` records a sha256 of every one of those files.
 
 `node qa/verify.mjs` checks that lock first, on every run. Editing lane code fails the
@@ -147,7 +153,9 @@ honestly vouch for itself. Without that check the receipt was unfalsifiable in o
 specific way: force every step to PASS in `qa/verify.mjs` and the receipt still validated,
 since the edited file was simply part of the hashed input surface.
 
-**So: do not edit `qa/*.mjs` or `qa/lib/*.mjs`.** If the lane is wrong, the fix is
+**So: do not edit `qa/*.mjs`, `qa/lib/*.mjs`, `qa/lib/profiles/cmp/**`, `qa/verified-surface.json`, or
+`qa/harness-manifest.json`.** (A profile you wrote yourself under `qa/lib/profiles/<id>/` is yours; after
+editing it, `npx create-cmp-cli harness relock` re-takes the lock.) If the lane is wrong, the fix is
 upstream in the engine, not here. If you genuinely must fork it, know that
 `npx create-cmp-cli upgrade --harness` will replace the region and preserve your edits as
 `qa/harness-local.patch` for you to re-apply or upstream — nothing is lost, but the fork
@@ -161,7 +169,7 @@ Upgrading the lane is safe to do unattended — it touches no app content and no
 artifact:
 
 ```bash
-npx create-cmp-cli upgrade --harness
+npx create-cmp-cli upgrade --harness --yes   # without --yes it dry-runs and exits 0 — a silent no-op from a tool
 ```
 
 ## Approvals — governed artifacts need a human's sign-off
@@ -170,43 +178,17 @@ Some artifacts are **governed**: a human approves them, and the approval is boun
 artifact's content by hash (`qa/approvals.json`) — the evidence-receipt idea, applied to a
 human decision. The ordered walk is a **definition order**, not just an approval order:
 each artifact is the vocabulary the next is written in, so on a fresh app each step is a
-conversation that ends in an approval — the genesis walk, six conversations:
-
-The order encodes two disciplines: **behavior is spec-first** (the exemplar's clauses are
-confirmed before the slice is built) and **visuals are UI-first** (the design system and
-component vocabulary are distilled from the real screens, so they lock after the exemplar —
-a provisional palette carries the build until then).
-
-0. **Intent** — `specs/intent.md`, the root brief everything else traces to (purpose,
-   audience, platforms, brand feel, reference apps, first screens, **glossary**). Filled by
-   the `cmp-new` interview; the seed's placeholder prose is marked unfilled. Its
-   `## Glossary` section is lifted verbatim into `docs/ARCHITECTURE.md` §8 — write it there
-   in the exact form you want published.
-0.5. **First feature brief** — `docs/features/<exemplar>.md`, drafted from the interview's
-   "first screens" answer the moment intent is signed: the first feature's decisions and
-   their why, signed BEFORE its spec is written. Genesis runs the same decide → contract →
-   build loop as every later change; the app's first feature gets the same decide step
-   every later feature gets. (Express lane: skipped honestly, never fabricated;
-   placeholders earn a brief when they become real.)
-1. **Architecture + structure** — `specs/app-base.spec.md` **and**
-   [`docs/ARCHITECTURE.md`](./docs/ARCHITECTURE.md) (`cmp:generated` sections stripped
-   before hashing, so a mechanical regeneration never invalidates the approval — only an
-   authored-prose edit does).
-2. **Exemplar spec** — `specs/<exemplar>.spec.md`. Confirmed BEFORE the slice is built:
-   propose the clauses, get the human's yes, then implement to satisfy them (the same
-   discipline `add-feature` already enforces post-genesis).
-3. **Exemplar feature** — the **configured** exemplar's file set the `add-feature`
-   stamper clones from (see "Configurable exemplar"), built to the confirmed spec.
-4. **Design system** — `presentation/theme/Theme.kt`, `presentation/theme/Tokens.kt`.
-   Locked on the REAL exemplar: candidates render on real screens, never stubs. If the
-   lock changes the exemplar's look, reopen → re-approve it — that loop is the design,
-   not a failure.
-5. **Components** — every `presentation/components/*.kt` (a dynamic, sorted glob),
-   distilled from the screens per the inclusion rubric (`docs/ARCHITECTURE.md` §7). Once
-   approved, the registry is law: adding or changing a common component invalidates the
-   approval until a human re-approves.
-6. **Per-feature spec** — `specs/<feature>.spec.md`, one governed artifact per feature,
-   added as features land.
+conversation that ends in an approval — the genesis walk:
+
+The genesis order — intent → first feature brief → architecture + structure → exemplar spec →
+exemplar feature → design system → components → per-feature specs — is driven by the `cmp-new`
+interview and is over before this file is your working contract; `node qa/approve.mjs --status`
+prints every artifact and its state. Two disciplines survive it: **behavior is spec-first** (clauses
+confirmed before the slice is built) and **visuals are UI-first** (the design system and component
+vocabulary are distilled from real screens, so they lock after the exemplar — a provisional palette
+carries the build until then; if the lock changes the exemplar's look, reopen → re-approve it — that
+loop is the design, not a failure). Once approved, the component registry is law: adding or changing
+a common component invalidates the approval until a human re-approves.
 
 ### After genesis — every change is the same loop
 
@@ -219,114 +201,11 @@ understood the change to be, which lane it takes, and why, before any tool runs.
 can overrule the lane in a word; a silent route is a routing error even when the lane was
 right.
 
-**Grill before the brief** (the `grill-me` plugin skill; the rule holds without the plugin):
-on the brief lane, after the triage restatement and before a word of the brief is drafted,
-settle the load-bearing questions. Read what the repo already answers first — a signed brief
-or spec is a CLOSED decision: cite it, never re-ask it. Then ask the frontier of unsettled
-decisions as a numbered list, at most five per round, each with why it matters and a
-recommended answer — and WAIT for the answers before anything else. Stop when no remaining
-question would change the work; three rounds is the ceiling (more means the request needs
-splitting). Answers land in the brief — settled calls become **Decisions** with their why,
-the human's own calls the **Open decisions** section; the brief's signature closes them. The
-direct lane is not grilled (one inline question at most, only when the restatement cannot
-be made unambiguous); a bug fix or an emergency fix, never. While the grill is open, the
-chain's first step reads `settle the open questions` (declare it before the first round;
-re-declare when the answers reshape the steps).
-
-**Brief lane** — when the change carries **decisions a future contributor could plausibly
-"simplify" away** ("the day boundary is configurable, default 04:00 — not midnight") OR
-**blast radius into other governed artifacts**. After naming the lane:
-
-| Step | What |
-|---|---|
-| 1 | **Feature brief** — `docs/features/<name>.md`: the decisions with their why, research, rejected options, an **Open decisions** section until the human closes each. Signed BEFORE code. |
-| 2 | **Design** — iff the feature has a UI surface (`"screens": true`, or screen files exist): draft the screens on STUB data, register them in the PreviewRegistry, render, and STOP. The human judges the rendered screens and signs `feature-design:<name>`. Never ask a human to approve a described UI. |
-| 3 | **Contract** — reopen any signed spec the brief amends (`--reopen feature-spec:<surface> --reason "…"`); write the clauses where the behavior lives — about the form that now exists; the human signs |
-| 4 | Build the slice (`add-feature` / preview loop). Declared blast lands "as declared"; re-approve touched visual artifacts on rendered output (wiring the signed screens from stub to real state drifts `feature-design:<name>` — its re-approval is that pass) |
-| 5 | Prove — nothing to do: the lane's gates + receipt ARE the proof |
-| 6 | The human's `--accept` — enabled only at provenDone AND a signed design |
-
-**Direct lane** — everything else (bug fix, copy edit, tweak): confirm in chat, reopen →
-amend clause → re-approve if a signed contract is touched, build, lane once at done.
-Legacy features never get retro-briefs; spikes are ungoverned until they become real.
-
-**A brief's LOCATION is the governance opt-in**: every `docs/features/*.md` is a governed
-`feature-brief:<name>` artifact (hash-bound at signing; `<name>` pairs with
-`specs/<name>.spec.md`). `docs/proposals/` stays ungoverned. The brief carries at most one
-machine-read block, and it **declares — it never gates**:
-
-```json cmp:feature
-{ "touches": ["components", "design-system"], "screens": true }
-```
-
-`touches` is the declared blast radius — the artifact hashes already enforce; declaring
-lets the console show "components re-approval, as planned" instead of an unexplained
-failure, and surface **undeclared blast** when something drifted that no open brief
-accounted for. `screens: true` declares a UI surface: it holds the design gate
-(`feature-design:<name>` — the feature's own `presentation/<name>/*Screen.kt`, signed on
-rendered output) before any screen file exists; once files exist, disk is ground truth
-regardless. Both declare — neither gates.
-
-**Doneness is DERIVED, never claimed.** There is no `--deliver` and no checks block —
-deliberately (they existed and were removed as a weaker parallel truth). A feature is
-`provenDone` when, mechanically: its spec has live clauses **and** every one is cited by a
-test **and** the latest receipt is PASS **and** the receipt's `inputs.hash` attests the
-tree as it stands. `--status` and the console print the same one-line `doneReason` either
-way. What remains for humans is judgment: signing the brief (before code) and accepting
-the feature (after proof — "the proven thing is what I wanted"); `--accept` is refused
-until the derivation holds. Acceptance lives on the ledger row, never in the doc (the
-signed bytes must not move when the human accepts).
-
-| Command | What |
-|---|---|
-| `node qa/approve.mjs feature-brief:<name>` | the human signs the brief (before code) |
-| `node qa/approve.mjs --accept <name>` | the human's bookend; refused until provenDone |
-
-Editing a feature is the same brief **reopened** — `--reopen-feature <name> --reason "…"`
-reopens the brief + its spec + its design + the set it declared, as ONE recorded change;
-re-approval is one walk back. Every reopen **requires a `--reason`** (it walks back a
-signature; the signer reads why from the ledger itself) and is journaled with `via` — the
-append-only journal (`qa/approvals.log.jsonl`, printed by `--log`, shown in the console
-strip's History) is how "what happened while I was away" stays answerable.
-
-| Command | What |
-|---|---|
-| `node qa/approve.mjs --status` | Every governed artifact with live state (`unreviewed` / `approved` / `changed-since-approval` / `reopened`), short hash, mode badge |
-| `node qa/approve.mjs <artifact>` | Record approval — hashes the artifact's files now, stamps the time; also clears a `defaults-accepted` mode |
-| `node qa/approve.mjs --accept-defaults` | **Express lane**: approve every currently-resolvable artifact in one visible act, each stamped `"mode": "defaults-accepted"` — build now, walk the definition later. Unresolvable artifacts are skipped with the standard refusal printed. The ledger never pretends the defaults were designed. |
-| `node qa/approve.mjs --reopen <artifact> --reason "…"` | Move an *approved* artifact (shaped or defaults-accepted) back to `reopened` for deliberate redesign. `--reason` is REQUIRED and recorded (`reopenedAt`, `via`, `reason` — on the row and in the journal). Refuses unknown ids and anything not currently approved. |
-| `node qa/approve.mjs --reopen-feature <name> --reason "…"` | ONE recorded change: reopens the brief + `feature-spec:<name>` + `feature-design:<name>` + every declared `touches` artifact (each only if currently approved), all under one reason. |
-| `node qa/approve.mjs --log` | The governance journal — every approve/reopen/accept with when, which surface (`via`), and why. |
-
-With the create-cmp plugin, the same decisions can be made from the preview console
-(`preview {projectDir}`'s URL) — it calls the same library, so the CLI and the console
-never disagree. The console's rail is the human's work queue (colour = something waits
-on them), and a drifted artifact shows, in its own section, exactly **what changed
-against the signed bytes and which files are still exactly as signed**, with re-approval
-in place. An agent blocks on a pending decision with
-`approval_status {waitForDecision:true}`.
-
-The verify lane's `approvals` gate (a step like any other, in every profile) resolves each
-artifact's live status against `qa/approvals.json`:
-
-- **`unreviewed`** → SKIP with a warning line. Nothing fails until a human opts in by
-  approving.
-- **`reopened`** → SKIP with a warning line, exactly like `unreviewed`. Sanctioned redesign
-  never trips the gate; edits made while reopened are never drift. Re-approve when the
-  redesign lands.
-- **`approved`, hash still matches** → PASS.
-- **`approved`, hash no longer matches** → FAIL, naming the artifact and the re-approval
-  command. The artifact changed after sign-off — re-approve it or revert the change.
-  Invalidation is mechanical, like golden-tree drift, not a judgment call.
-
-That asymmetry is the point: **redesign is a decision; drift is an accident** — the ledger
-records which was which. A run with one reopened artifact and one drifted artifact FAILs
-naming only the drifted one.
-
-A gate FAIL fails the lane verdict, which fails `qa/receipt-check.mjs` (the Stop hook) by
-the same mechanism as any other FAIL — no separate enforcement to maintain. `add-feature`
-seeds each new feature's spec as `unreviewed` and prints the approval reminder; it never
-refuses to stamp over this.
+**Grill before the brief** (the `grill-me` plugin skill carries the procedure; the rule holds without the plugin):
+on the brief lane, after the triage restatement and before a word of the brief, settle
+the load-bearing questions — a signed brief or spec is a CLOSED decision: cite it, never re-ask it;
+ask the unsettled ones as a numbered list with a recommended answer each, and WAIT. Answers land in the brief's **Decisions** and
+**Open decisions**; the signature closes them. The direct lane is not grilled.
 
 ### Configurable exemplar — the DNA features are cloned from
 
@@ -381,19 +260,12 @@ which is worse than no chain. While the full check runs, the chain's observed li
 narrates the lane's own position (step, elapsed, usual cost) — quote THAT, never an
 estimate. The chain gates nothing; the walk stays the truth for doneness.
 
-**The studio is a standing check:** every injected context opens with a `[studio: …]`
-line. If it says DOWN or not running, restore it before proceeding — call the
-cmp-inspector `preview { projectDir }` tool (it starts a detached resident console
-that survives the session) — or, if the tools are absent, tell the human once. A
-missing window is a fault to heal, never something to work silently past.
-
-**While working — the header, then quiet:** open EVERY reply with the walk's one-line
-header — the exact `[chat header]` line the per-prompt inject delivers. Paste it
-verbatim, never compose it: it is the derivation's own string, so it cannot drift, and
-it persists in the transcript, which the statusline beneath the input box never does.
-After the header: one line per stage transition, nothing per-file. Stages carry their
-plain-words gloss on first mention ("Contract — agreeing what it promises"); quote the
-lane's cost only from the measured figure in the injected card, never an estimate.
+**While a walk is open, the per-prompt inject carries the running protocol** — the `[studio: …]`
+line (restore it if DOWN: the cmp-inspector `preview { projectDir }` tool, or tell the human once),
+the `[chat header]` to open every reply with, verbatim, and the `▲ ARRIVED, UNPLANNED` line for work
+that belongs to no open walk (default: after the current walk lands; one walk at a time). Render the
+injected lines, never your memory of them; with no walk open it delivers nothing and you write none
+of it. After the header: one line per stage transition, nothing per-file.
 
 **At every human gate — loud:** a full stop card, never a bare question — and the
 easiest act leads:
@@ -404,12 +276,6 @@ easiest act leads:
     → CLI fallback: <the command>   (or "reply approve" when no console is up)
     After this: <the remaining stages, and which ones stop for the human>
 
-**Arrivals:** work that belongs to no open walk (undeclared drift, a harness
-upgrade's rule-change reopens) is NEVER silently interleaved. Render
-`▲ ARRIVED, UNPLANNED — <what> · now, or after <current walk> lands?` and default to
-after. One walk at a time unless the human chooses otherwise — three unframed
-interleaved walks is precisely the session this rule exists to prevent.
-
 ## Comments — review feedback flows back through the agent
 
 Approvals are binding (they gate the verify lane); **comments are advisory** — a human's
@@ -523,14 +389,17 @@ conventions) · [`CONTRIBUTING.md`](./CONTRIBUTING.md) (workflow, Conventional C
 | `node qa/setup-hooks.mjs` | Enable the pre-push receipt gate (one-time, after `git init`) |
 | `./gradlew :composeApp:assembleDebug` | Android debug build |
 | `./gradlew :composeApp:assembleRelease` | Android release build — R8 + `lintVital`, the variant the lane's `releaseBuild` step proves. Produces an **unsigned** APK; signing needs a keystore, which is yours to create and keep out of the repo. |
-| `./gradlew :composeApp:hotRunDesktop --auto` | Desktop dev-client with hot reload |
 | `./gradlew :composeApp:connectedDebugAndroidTest` | Instrumented behavior tests on the attached device (the lane's `androidChecks` step) |
+| `node qa/framework-check.mjs` | GATE-RULES Rule 0: proves the lane returns both ways — PASS on the clean tree, FAIL by name on planted violations — in seconds, restoring every byte. Run it first in a repo whose harness is new or freshly upgraded. |
 | `node qa/verify.mjs --profile smoke` | The smallest end-to-end lane: every pure-Node gate, no Gradle, no device — seconds. Proves the framework *returns*, never the change (its receipt is refused as done-evidence). Run it first in any repo whose harness is new or freshly upgraded |
 | `node qa/verify.mjs --profile nightly` | Scheduled stage: everything `ci` proves with the determinism probe forced on. Proves the harness, never a change — its receipt (`stage: "nightly"`) is refused as done-evidence, exactly like `--fast`. Schedule it; never wait on it |
 | `node qa/verify.mjs --profile release` | Ship-time lane: everything `ci` proves plus the audit-cadence report (`auditCadence` — which androidMain subsystems changed since their last recorded `cmp-audit`; a nudge, never a gate) and the release-APK Maestro smoke (`releaseSmoke`) |
 | `node qa/verify.mjs --determinism` | Timezone determinism probe, alone: runs the JVM test tier twice under UTC-12 and UTC+14 and FAILs naming any test whose outcome differs — the dynamic net behind ARCH-13's static one. Opt-in inside a lane via `--profile ci --determinism`; never with `--fast`; writes no receipt on its own |
 | `node qa/record-audit.mjs <subsystem>` | Record that a `cmp-audit` of an androidMain subsystem happened (appends subsystem + HEAD sha + timestamp to `qa/audits.jsonl`; refuses dirty/unknown targets). `--list` shows every derived subsystem and its audit status |
 | `node qa/retrospective.mjs` | How this project actually uses its harness, from `qa/flight-recorder.jsonl` (appended by every lane run): fast vs full ratio, verbatim SKIP reasons grouped, whether the device tier is ever reached, longest stretch with no full lane. States only what the journal recorded |
+<!-- >>> cmp:feature dev-client -->
+| `./gradlew :composeApp:hotRunDesktop --auto` | Desktop dev-client with hot reload |
+<!-- <<< cmp:feature dev-client -->
 <!-- <<< cmp:feature harness -->
 <!-- >>> cmp:feature !harness -->
 # __APP_NAME__ — working guide

package/template/docs/TESTING.md

@@ -198,7 +198,7 @@ verbatim — the errors-on-save loop an IDE gives a human, for the agent. What i
 evidence. It runs the fast tier only, so nothing it produces can satisfy the done-gate,
 and every run says so in a standing footer; the checkpoint remains one deliberate full
 `node qa/verify.mjs` run. Coordination: it never launches while a verify lane
-(`.cmp-lane-in-progress`) or a preview-daemon render (`.cmp-render-in-progress`) holds the
+(`qa/.lane-in-progress`) or a preview-daemon render (`composeApp/build/.cmp-render-in-progress`) holds the
 project — it waits and coalesces, so watch mode, the preview daemon, and the lane can all
 be resident on one project without two Gradle invocations ever colliding. `--once` runs a
 single coordinated pass for scripting; `--json` emits one JSON object per run for

package/template/gitignore

@@ -16,6 +16,8 @@ build/
 
 # Verify-lane binary evidence (screenshots, reports, page sources). The RECEIPT
 # (qa/evidence/latest.json) IS committed — these artifacts are hashed into it instead.
+# A --fast run writes latest-fast.json: inner-loop feedback, never evidence, never committed.
+qa/evidence/latest-fast.json
 qa-artifacts/
 
 # iOS / CocoaPods / XcodeGen
@@ -44,6 +46,8 @@ qa/.plan.json
 # The closed-chain trail (drive-narration N5): local because it carries raw
 # human prompts — the committed journal for lane runs stays qa/flight-recorder.jsonl.
 qa/.plan-history.jsonl
+qa/.agent-hold.json
+qa/.lane-in-progress
 
 # Android signing. The keystore IS the app's identity on Android — it cannot be reissued —
 # and keystore.properties holds its passwords. Never committed, never in a sidecar diff.

package/template/qa/approve.mjs

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 // The approvals CLI — thin shell over qa/lib/approvals.mjs.
 //
-//   node qa/approve.mjs <artifact>          records approval (recomputes the artifact's
-//                                            hash now, stamps the time, writes qa/approvals.json)
+//   node qa/approve.mjs <artifact> [<artifact> …] --as "Name <email>"
+//                                            records approval (recomputes each artifact's
+//                                            hash now, stamps the time, writes qa/approvals.json).
+//                                            Sign every pending artifact in ONE command: each
+//                                            signature moves the receipt's input hash, so N
+//                                            separate signings cost N lane re-runs.
 //   node qa/approve.mjs --status            lists every governed artifact + live state
 //                                            (unreviewed / approved / changed-since-approval /
 //                                            reopened, + mode when set) + short hash
@@ -44,7 +48,7 @@ import {
   approveArtifact,
   getApprovalStatuses,
   getFeatureBoard,
-  isPackageResolvable,
+  isProjectGovernable,
   listGovernedArtifacts,
   readJournal,
   reopenArtifact,
@@ -118,17 +122,16 @@ if (args.includes("--status")) {
   process.exit(0);
 }
 
-// Write guard: refuse to RECORD approvals in a tree whose package is not
-// resolvable (the raw template / a pre-stamp tree). Approvals belong to a
-// generated project; writing qa/approvals.json into the template pollutes the
+// Write guard: refuse to RECORD approvals in a tree that cannot be governed —
+// no manifest, no loadable profile, or a tree the profile itself refuses (the
+// raw template, whose package is still a placeholder). Approvals belong to a
+// real project; writing qa/approvals.json into the template pollutes the
 // template itself. Read-only --status (above) stays available anywhere. Applies
 // to every write operation below (single approve, express lane, reopen).
 function refuseIfUnresolvable() {
-  if (isPackageResolvable(ROOT)) return;
-  console.error(
-    "error: this tree's package is not resolvable (composeApp/build.gradle.kts namespace is missing or still a placeholder) — " +
-      "this looks like the raw template or a pre-stamp tree. Approvals are recorded in a generated project; refusing to write qa/approvals.json here.",
-  );
+  const v = isProjectGovernable(ROOT);
+  if (v.ok) return;
+  console.error(`error: ${v.reason}`);
   process.exit(1);
 }
 
@@ -243,7 +246,7 @@ if (acceptFlagIdx !== -1) {
 if (args.length === 0) {
   const ids = listGovernedArtifacts(ROOT).map((a) => a.id);
   console.error(
-    'usage: node qa/approve.mjs <artifact> | --status | --log | --accept-defaults | --reopen <artifact> --reason "…" | --reopen-feature <name> --reason "…" | --accept <name>\n' +
+    'usage: node qa/approve.mjs <artifact> --as "Name <email>" | --status | --log | --accept-defaults | --reopen <artifact> --reason "…" | --reopen-feature <name> --reason "…" | --accept <name>\n' +
       `  valid artifacts: ${ids.length > 0 ? ids.join(", ") : "(none resolved in this project)"}`,
   );
   process.exit(1);
@@ -251,7 +254,27 @@ if (args.length === 0) {
 
 refuseIfUnresolvable();
 
-const artifactId = args[0];
+// EVERY artifact named in one command — one write, one invalidation.
+//
+// A signature changes qa/approvals.json's `status`, which the approvals gate
+// reads, so it legitimately moves the receipt's input hash. Signed one at a
+// time AFTER a green lane, that means N signatures invalidate the receipt N
+// times and cost N lane re-runs and N bookkeeping commits. Measured in
+// payment-blueprint's log on 2026-09-04: of 21 commits in one session, 8 were
+// "sign the approval" / "bind the receipt" with no product content, and every
+// code change cost two to three commits. It compounds as a repo accumulates
+// governed artifacts, which is what makes a session start fast and grind later.
+//
+// Two halves to the fix: sign them together (here), and sign BEFORE the final
+// lane run so the receipt you keep is already the one that covers the
+// signatures. `--reopen-feature` established the idiom — one recorded change,
+// not N commands.
+const artifactIds = args.filter((a, i) => !a.startsWith("--") && (i === 0 || !args[i - 1].startsWith("--")));
+// An unrecognised flag must still be REFUSED by name, never silently skipped:
+// filtering flags out is how `node qa/approve.mjs --delivr meal` would quietly
+// approve nothing and exit 0. Falling back to the first argument reproduces the
+// exact refusal an unknown verb has always produced.
+if (artifactIds.length === 0) artifactIds.push(args[0]);
 // The signer is REQUIRED, not optional: see approveArtifact's refusal. Parsed
 // here rather than defaulted from git config on purpose — `git config user.name`
 // is whatever the machine says, and an agent running on a developer's laptop
@@ -267,9 +290,14 @@ if (!approvedBy || approvedBy.startsWith("--")) {
   );
   process.exit(1);
 }
-const result = approveArtifact(ROOT, artifactId, { via: "cli", approvedBy });
-if (!result.ok) {
-  console.error(`error: ${result.reason}`);
-  process.exit(1);
+const results = artifactIds.map((id) => ({ id, result: approveArtifact(ROOT, id, { via: "cli", approvedBy }) }));
+const failed = results.filter((r) => !r.result.ok);
+for (const { id, result } of results) {
+  if (result.ok) console.log(`✓ approved ${result.artifact} — hash ${shortHash(result.hash)}, at ${result.approvedAt}`);
+  else console.error(`error: ${id}: ${result.reason}`);
+}
+if (results.length > 1) {
+  const signed = results.length - failed.length;
+  console.log(`\n${signed} signature${signed === 1 ? "" : "s"} in one write. Run the lane AFTER signing, not before — a signature moves the receipt's input hash, so signing after a green run costs you that run.`);
 }
-console.log(`✓ approved ${result.artifact} — hash ${shortHash(result.hash)}, at ${result.approvedAt}`);
+if (failed.length) process.exit(1);

package/template/qa/comments.json

@@ -1,4 +1,4 @@
 {
-  "schema": "cmp-comments/1",
+  "schema": "prooflane-comments/1",
   "comments": []
 }