create-cmp-cli 0.24.0 → 0.25.0

package/packages/harness/src/lib/{steps-cmp.mjs → profiles/cmp/steps-cmp.mjs}

@@ -20,35 +20,47 @@
 import fs from "node:fs";
 import path from "node:path";
 import { compareTokenDrift } from "./token-drift.mjs";
-import { evaluateApprovalsGate } from "./approvals.mjs";
-import { E2E_FLOW_DIR, TIERS_SATISFYING, clauseTierCoverage, listFlowFiles, scanCitations, scanSpecClauses, walkFiles } from "./spec-coverage.mjs";
+import { evaluateApprovalsGate } from "../../approvals.mjs";
+import { clauseTierCoverage, listFlowFiles, scanCitations, scanSpecClauses, walkFiles } from "../../spec-coverage.mjs";
+import { specModelFrom } from "../../spec-model.mjs";
+import { layout as cmpLayout, tiers as cmpTiers, reports, grammar as cmpGrammar } from "./declarations.mjs";
+import { RENDER_MARKER_FRESH_MS, RENDER_MARKER_NAME } from "../../lane-markers.mjs";
+
+// The scanner's model, built from this profile's own declarations — the pack
+// hands its facts to the core rather than round-tripping through the manifest.
+const SPEC_MODEL = (() => {
+  const r = specModelFrom({ id: "cmp", layout: cmpLayout, tiers: cmpTiers, grammar: cmpGrammar });
+  if (!r.ok) throw new Error(r.reason);
+  return r.model;
+})();
+/** Where the flows the lane runs live. */
+const E2E_FLOW_DIR = cmpLayout.flows.dir;
 import { evaluateComponentStoryParity } from "./component-stories.mjs";
 import { evaluateReachability } from "./reachability.mjs";
 import { evaluateE2eCoverage } from "./e2e-coverage.mjs";
-import { memoizeStep } from "./step-cache.mjs";
-import { changedWorkingTreePaths, deriveAffectedFilter } from "./affected-tests.mjs";
+import { memoizeStep } from "../../step-cache.mjs";
+import { changedWorkingTreePaths, deriveAffectedFilter } from "../../affected-tests.mjs";
+import { affected as cmpAffected } from "./affected.mjs";
 import { acquireDeviceLease, releaseDeviceLease, formatHolder } from "./device-lease.mjs";
-import { ARCH_DOC_REL_PATH, SECTION_IDS, regenerateArchDoc } from "./arch-doc.mjs";
-import { DETERMINISM_TIMEZONES, compareOutcomes, parseJUnitOutcomes } from "./determinism.mjs";
-import { evaluateAuditCadence } from "./audit-cadence.mjs";
-import { androidChecksOutcome, deviceLogIncidents, maestroOutcome, parseMaestroJunit } from "./step-outcomes.mjs";
+import { ARCH_DOC_REL_PATH, SECTION_IDS, regenerateArchDoc } from "../../arch-doc.mjs";
+import { DETERMINISM_TIMEZONES, compareOutcomes, parseReportOutcomes, reportFormatProblem } from "../../determinism.mjs";
+import { evaluateAuditCadence } from "../../audit-cadence.mjs";
+import { androidChecksOutcome } from "./android-checks.mjs";
+import { deviceLogIncidents, maestroOutcome, parseMaestroJunit } from "./maestro.mjs";
 import { ensureDevice, releaseDevice } from "./device-provider.mjs";
-import { checkHarnessIntegrity, describeIntegrity, LOCK_PATH } from "./harness-lock.mjs";
-import { stepDisplayName } from "./lane-runner.mjs";
-import { CMP_LADDER } from "./evidence-level.mjs";
+import { checkHarnessIntegrity, describeIntegrity, LOCK_PATH } from "../../harness-lock.mjs";
+import { stepDisplayName } from "../../lane-runner.mjs";
+import { CMP_LADDER } from "./ladder.mjs";
 
 /**
  * @param {object} ctx
  * @param {string} ctx.ROOT project root
  * @param {string} ctx.HERE the qa/ directory
- * @param {string} ctx.GRADLEW the wrapper invocation
- * @param {string} ctx.RERUN " --rerun" in full mode, "" in fast
  * @param {boolean} ctx.fast
  * @param {boolean} ctx.determinism
  * @param {string} ctx.profile
  * @param {"full"|"fast"} ctx.mode
  * @param {Function} ctx.sh subprocess helper (throws StepTimeout past the step's deadline)
- * @param {Function} ctx.shGradle sh + the KSP-collision self-heal
  * @param {Function} ctx.tryGit
  * @param {Function} ctx.tryGitLines
  * @param {string[]} ctx.DEGRADED_PATHS degraded-path activations the receipt reports
@@ -56,8 +68,112 @@ import { CMP_LADDER } from "./evidence-level.mjs";
  *   FAST_EXCLUDED_NAMES: string[], STEP_FN_BY_NAME: Record<string, Function>,
  *   stepDeterminism: Function, releaseLease: () => void}}
  */
+/**
+ * Is the inspector server in this app at all? `--no-inspector` deletes the
+ * androidDebug inspector sources (the feature manifest's paths), so the file
+ * that answers `/inspect/health` is simply not there. Asked BEFORE the lane
+ * touches a device: the 2026-09-08 context audit found this step booting a
+ * headless emulator first and only then discovering the endpoint it wanted to
+ * read was never shipped — a device paid for by every `--no-inspector` app,
+ * for a step that then SKIPped. Structural, so the receipt stays done-evidence.
+ */
+export function inspectorShipped(root) {
+  const base = path.join(root, "composeApp", "src", "androidDebug");
+  if (!fs.existsSync(base)) return false;
+  const stack = [base];
+  while (stack.length) {
+    const dir = stack.pop();
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (e.isDirectory()) stack.push(path.join(dir, e.name));
+      else if (e.name === "InspectorHttpServer.kt") return true;
+    }
+  }
+  return false;
+}
+
+
 export function createCmpSteps(ctx) {
-  const { ROOT, HERE, GRADLEW, RERUN, fast, determinism, profile, mode, sh, shGradle, tryGit, tryGitLines, DEGRADED_PATHS } = ctx;
+  const { ROOT, HERE, fast, determinism, profile, mode, sh, tryGit, tryGitLines, DEGRADED_PATHS } = ctx;
+
+  // ── Gradle is THIS profile's build tool ───────────────────────────────────
+  // The wrapper invocation, the integrity flag and the coexistence dance used
+  // to live in qa/verify.mjs and arrive through ctx — which meant the runner,
+  // the spine every stack shares, knew what Gradle is, where composeApp/build
+  // sits, and what a KSP cache collision looks like. Stage 0 PR 6a moved them
+  // here: the runner hands the pack a plain subprocess helper, and the pack
+  // wraps it with whatever its own toolchain needs.
+  const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";
+
+  // `--rerun` exists for evidence integrity: it stops Gradle's build cache
+  // replaying a PASS recorded against a different tree into a receipt that
+  // claims tests executed. That belongs to runs producing integrity-bearing
+  // artifacts — and a --fast run does not: its receipt already declares itself
+  // non-evidence (mode "fast", no evidence rung, refused by
+  // qa/receipt-check.mjs), so forcing execution there paid an integrity tax to
+  // protect an artifact with nothing to protect.
+  const RERUN = fast ? "" : " --rerun";
+
+  // ── Preview-daemon coexistence ───────────────────────────────────────────
+  // The preview daemon (the eyes) and this lane both spawn Gradle against this
+  // project and share <buildDir>/kspCaches, whose KSP incremental storage is
+  // single-owner — two concurrent builds throw "Storage for [...] is already
+  // registered" and one side dies. Three defenses, all automatic:
+  //   1. COORDINATE (this lane -> the daemon): the lane stamps its marker for
+  //      its duration (qa/.lane-in-progress, core state); the preview service
+  //      defers renders while it exists (mtime-bounded, so a crashed lane
+  //      never wedges the eyes for long).
+  //   2. COORDINATE (the daemon -> this lane), the symmetric half: the daemon
+  //      stamps its OWN marker for the duration of a render's Gradle build;
+  //      shGradle waits for it to clear (or go stale) before launching this
+  //      lane's own Gradle command — same mtime-bounded shape, so a crashed
+  //      daemon never wedges the lane for long either.
+  //   3. SELF-HEAL: a Gradle step that still hits the collision clears
+  //      kspCaches and retries once — the manual recovery that always worked,
+  //      automated.
+  // The render marker is the PROVIDER's, so it lives under this profile's own
+  // buildDir; qa/lib/lane-markers.mjs names the file and the freshness bound
+  // so the daemon and the lane can never disagree about either.
+  const KSP_COLLISION_RE = /Storage for \[[^\]]*\] is already registered/;
+  const BUILD_DIR = cmpLayout.buildDir;
+  const RENDER_MARKER = path.join(ROOT, ...BUILD_DIR.split("/"), RENDER_MARKER_NAME);
+  const RENDER_WAIT_TIMEOUT_MS = 3 * 60 * 1000; // give up waiting after this long regardless
+  const RENDER_WAIT_POLL_MS = 2000;
+
+  /**
+   * Defer this lane's next Gradle command while the preview daemon's render
+   * marker is present AND fresh (mtime younger than RENDER_MARKER_FRESH_MS).
+   * Polls every RENDER_WAIT_POLL_MS; gives up and proceeds anyway after
+   * RENDER_WAIT_TIMEOUT_MS, or the moment the marker disappears or goes stale —
+   * whichever comes first. A missing/unreadable marker returns immediately:
+   * this is a coexistence courtesy, never a hard dependency on the daemon.
+   */
+  function waitForRenderMarker() {
+    const deadline = Date.now() + RENDER_WAIT_TIMEOUT_MS;
+    for (;;) {
+      let stat;
+      try {
+        stat = fs.statSync(RENDER_MARKER);
+      } catch {
+        return; // no render in flight
+      }
+      if (Date.now() - stat.mtimeMs >= RENDER_MARKER_FRESH_MS) return; // gone stale
+      if (Date.now() >= deadline) return; // waited long enough — proceed regardless
+      sh(`sleep ${RENDER_WAIT_POLL_MS / 1000}`);
+    }
+  }
+
+  function shGradle(cmd, opts = {}) {
+    waitForRenderMarker();
+    const first = sh(cmd, opts);
+    if (first.ok || !KSP_COLLISION_RE.test(first.out)) return first;
+    console.error("· KSP cache collision (concurrent Gradle — the preview daemon?) — clearing kspCaches, retrying once");
+    fs.rmSync(path.join(ROOT, ...BUILD_DIR.split("/"), "kspCaches"), { recursive: true, force: true });
+    const retry = sh(cmd, opts);
+    retry.durationMs += first.durationMs;
+    retry.selfHealed = "ksp-cache-collision";
+    DEGRADED_PATHS.push("ksp-cache-collision: cleared kspCaches and retried the Gradle step");
+    return retry;
+  }
 
 // Recursive: desktopTest writes TEST-*.xml flat, but connected (instrumented) results
 // land one directory level down per device (build/outputs/androidTest-results/connected/
@@ -252,6 +368,29 @@ function stepHarnessIntegrity() {
   const r = checkHarnessIntegrity(ROOT);
   const base = { name: "harnessIntegrity", durationMs: Date.now() - started, harness: r };
 
+  // ADR-0010 — THE FLOOR, BEFORE THE STATUS. A region with no engine module
+  // reads `intact` and is telling the truth: it is unmodified since it was
+  // locked. It is simply not a lane, and a lane that is not there cannot vouch
+  // for anything.
+  //
+  // On an ordinary tree this cannot fire — a region with no qa/verify.mjs has
+  // nothing to run this check. It fires in the one mode ADR-0008 rejects: a
+  // lane running from OUTSIDE the region, over a project whose qa/ holds only
+  // declarations. There the lane runs, this step executes, and until now it
+  // returned PASS over a project carrying none of the code that produced the
+  // verdict — the residue that ADR predicted, in the row that exists to
+  // prevent exactly it.
+  if (r.vacuous) {
+    return {
+      ...base,
+      verdict: "FAIL",
+      reason:
+        `the harness region holds ${r.fileCount} file(s) and NONE of them is engine code — this is not a lane, so it cannot vouch for one. ` +
+        `A lane running from outside the region (node_modules) over a project whose qa/ carries only declarations produces exactly this: ` +
+        `install the lane into the tree (\`prooflane init\`, or \`prooflane upgrade\` to re-vendor it) so the code that issues the verdict is the code the receipt binds`,
+    };
+  }
+
   if (r.status === "intact") {
     return { ...base, verdict: "PASS", note: describeIntegrity(r) };
   }
@@ -290,16 +429,16 @@ function stepSpecCoverage() {
     return { name: "specCoverage", verdict: "SKIP", reason: "no specs/ directory in this project", durationMs: Date.now() - started };
   }
 
-  const clauses = scanSpecClauses(ROOT);
-  const tags = scanCitations(ROOT);
-  const searchDirs = [path.join(ROOT, "composeApp/src"), path.join(ROOT, "qa/e2e")];
-  const files = searchDirs.flatMap((d) => walkFiles(d, [".kt", ".kts", ".yaml", ".yml"]));
+  const clauses = scanSpecClauses(ROOT, SPEC_MODEL);
+  const tags = scanCitations(ROOT, SPEC_MODEL);
+  const searchDirs = SPEC_MODEL.citationRoots.map((rel) => path.join(ROOT, ...rel.split("/")));
+  const files = searchDirs.flatMap((d) => walkFiles(d, [...SPEC_MODEL.citationExts, ...(SPEC_MODEL.flows ? SPEC_MODEL.flows.exts : [])]));
 
   const citedIds = new Set(tags.map((t) => t.id));
   const orphanClauses = [...clauses.entries()].filter(([, c]) => !c.withdrawn).filter(([id]) => !citedIds.has(id));
   const orphanTags = tags.filter((t) => !clauses.has(t.id) || clauses.get(t.id).withdrawn);
 
-  const tiers = clauseTierCoverage(clauses, tags);
+  const tiers = clauseTierCoverage(clauses, tags, SPEC_MODEL);
 
   if (orphanClauses.length === 0 && orphanTags.length === 0 && tiers.unmetTier.length === 0) {
     // Tier visibility, still not a gate for UNDECLARED clauses (industry rule:
@@ -330,11 +469,18 @@ function stepSpecCoverage() {
   // failure than a missing one, and its message has to say WHY the citation it
   // can see does not count.
   for (const u of tiers.unmetTier) {
+    if (u.unknown) {
+      lines.push(
+        `  [${u.id}] ${u.file} — declares [tier: ${u.requiredTier}], a requirement this profile does not define. ` +
+          `Declared requirements: ${Object.keys(SPEC_MODEL.tiers.satisfying).join(", ")}. Fix the tag or declare the tier in the profile.`,
+      );
+      continue;
+    }
     const has = u.tiers.length ? `cited only from ${u.tiers.join(", ")}` : "cited by nothing";
     lines.push(
       `  [${u.id}] ${u.file} — declares [tier: ${u.requiredTier}] but is ${has}. ` +
         `A test on those tiers cannot observe this promise (no process lifecycle, no OS facts, no real device). ` +
-        `Add a citing test in ${TIERS_SATISFYING[u.requiredTier].join(" or ")} — and note that tier SKIPPING for want of a device ` +
+        `Add a citing test in ${SPEC_MODEL.tiers.satisfying[u.requiredTier].join(" or ")} — and note that tier SKIPPING for want of a device ` +
         `leaves this clause unproven, which is the point: "I could not check this" is a failure, not a quieter rung.`,
     );
   }
@@ -627,7 +773,7 @@ function stepUnitTests() {
     if (changed === null) {
       note = "full suite — git unavailable, cannot derive the change (fail open)";
     } else {
-      const filter = deriveAffectedFilter(changed);
+      const filter = deriveAffectedFilter(changed, cmpAffected);
       if (filter.mode === "filtered") {
         testsArgs = filter.patterns.map((p) => ` --tests "${p}"`).join("");
         note = `affected: ${filter.patterns.join(", ")} — ${filter.sourcePaths.length} changed source file(s)`;
@@ -720,12 +866,17 @@ function stepDeterminism() {
     };
   }
 
-  const resultsDir = path.join(ROOT, "composeApp/build/test-results/desktopTest");
+  const reportProblem = reportFormatProblem(reports);
+  if (reportProblem) return { name: "determinism", verdict: "ERROR", reason: reportProblem, durationMs: elapsed() };
+  const resultsDir = path.join(ROOT, reports.dir, "desktopTest");
   const legs = [];
   for (const { tz, label } of DETERMINISM_TIMEZONES) {
     const res = shGradle(`${GRADLEW} :composeApp:desktopTest${RERUN} --console=plain`, { env: { ...process.env, TZ: tz } });
     // Parsed NOW, before the next leg overwrites the same results directory.
-    const outcomes = parseJUnitOutcomes(resultsDir);
+    // The DISPATCHER, not one format's parser. A pack that named the JUnit
+    // reader directly would silently ignore its own `reports.format` the day a
+    // profile declared tap or ctrf — reading zero tests and calling it green.
+    const outcomes = parseReportOutcomes(resultsDir, { format: reports.format });
     legs.push({ tz, label, ok: res.ok, outcomes, tail: res.out.split("\n").slice(-8).join("\n") });
   }
   const [a, b] = legs;
@@ -757,7 +908,17 @@ function stepDeterminism() {
     };
   }
 
-  const diffs = compareOutcomes(a.outcomes, b.outcomes, labelA, labelB);
+  // WHICH STEP owns a test class is this stack's knowledge: Kotlin class-name
+  // conventions on the left, this pack's step names on the right. It lived in
+  // qa/lib/determinism.mjs until Stage 0 A3, where the core knowing four step
+  // names was stamping them onto other stacks' determinism diffs.
+  const attribute = (classname) => {
+    if (/GoldenTreeTest$/.test(classname)) return "goldenTrees";
+    if (/ArchitectureConformanceTest$/.test(classname)) return "conformance";
+    if (/A11yConformanceTest$/.test(classname)) return "a11y";
+    return "unitTests";
+  };
+  const diffs = compareOutcomes(a.outcomes, b.outcomes, labelA, labelB, attribute);
   if (diffs.length > 0) {
     const lines = [
       `Nondeterminism under timezone shift — the same tree produced different outcomes under ${labelA} vs ${labelB}. Something reads ambient time or zone past the ARCH-13 net (a library default, an uninjected clock, a golden that captures "today"):`,
@@ -830,6 +991,10 @@ function stepTokenDrift() {
   const started = Date.now();
   const elapsed = () => Date.now() - started;
 
+  if (!inspectorShipped(ROOT)) {
+    return { name: "tokenDrift", verdict: "SKIP", skipKind: "structure", reason: "inspector not shipped in this project (--no-inspector) — no endpoint to read, no device needed", durationMs: elapsed() };
+  }
+
   const device = ensureLaneDevice("tokenDrift");
   if (device) return { ...device, durationMs: elapsed() };
 
@@ -908,7 +1073,7 @@ function maestroGuards(name) {
   if (!fs.existsSync(path.join(ROOT, E2E_FLOW_DIR))) {
     return { name, verdict: "SKIP", skipKind: "structure", reason: "e2e harness not included in this project (--no-e2e)", durationMs: 0 };
   }
-  if (listFlowFiles(ROOT).length === 0) {
+  if (listFlowFiles(ROOT, SPEC_MODEL).length === 0) {
     return { name, verdict: "SKIP", skipKind: "structure", reason: `${E2E_FLOW_DIR}/ holds no flows (*.yaml) — nothing to drive`, durationMs: 0 };
   }
   if (!maestroAvailable()) {
@@ -944,7 +1109,7 @@ function maestroGuards(name) {
 const E2E_RUN_BOUND_MS = (flowCount) => 120_000 + 180_000 * Math.max(1, flowCount);
 
 function runMaestroSmoke(name, priorDurationMs) {
-  const flows = listFlowFiles(ROOT);
+  const flows = listFlowFiles(ROOT, SPEC_MODEL);
   const report = path.join(ROOT, "qa-artifacts", `maestro-${name}.xml`);
   fs.mkdirSync(path.dirname(report), { recursive: true });
   fs.rmSync(report, { force: true });
@@ -1347,6 +1512,14 @@ const STEP_FN_BY_NAME = {
   releaseSmoke: stepReleaseSmoke,
   releaseBuild: stepReleaseBuild,
 };
+// Where to look when one of THIS pack's steps blows its deadline. The spine
+// prints it verbatim and knows nothing about Gradle or adb (Stage 0 PR 6b.2);
+// marked on the step function, like `fn.layer`.
+const GRADLE_TIMEOUT_HINT = "A wedged Gradle daemon or a device that stopped answering are the usual causes; check `./gradlew --status` and `adb devices`.";
+for (const fn of [stepBuild, stepReleaseBuild, stepUnitTests, stepConformance, stepGoldenTrees, stepA11y, ...Object.values(STEP_FN_BY_NAME)]) {
+  if (typeof fn === "function") fn.timeoutHint = GRADLE_TIMEOUT_HINT;
+}
+
 for (const name of FAST_EXCLUDED_NAMES) {
   if (!STEP_FN_BY_NAME[name]) {
     // Drift guard: a new device-tier step must be mapped here or --fast would silently run it.
@@ -1356,11 +1529,40 @@ for (const name of FAST_EXCLUDED_NAMES) {
 }
 
   return {
+    // WHICH PACK this is. The receipt names it (verify.mjs → receipt.pack) so a
+    // cmp L2 and some other pack's L2 can never be mistaken for the same claim
+    // on the wire. The pack declares its own identity — the spine writes what it
+    // is told, never a name it assumed (docs/proposals/AGNOSTIC-HARNESS-
+    // ARCHITECTURE.md §8.1, Stage 0 PR 1). Versioned with the harness until the
+    // profile loader lands, so no `version` here yet: the spine pairs `id` with
+    // the lock's version.
+    id: "cmp",
     stepsForProfile,
     DEVICE_STEPS,
+    // The verdict line's strength phrase. The core prints what it is handed and
+    // nothing when handed nothing: "desktop-only" is THIS stack's word for the
+    // absence of a device, not the harness's word for the absence of anything.
+    // It used to be composed in verify.mjs, so a backend service with neither a
+    // desktop nor a device read "(desktop-only)" on every verdict it ever printed.
+    strengthLabel: (onDeviceSteps) => (onDeviceSteps.length ? `on-device: ${onDeviceSteps.join("+")}` : "desktop-only"),
     FAST_EXCLUDED_NAMES,
     STEP_FN_BY_NAME,
     stepDeterminism,
+    // The step whose failure makes every verdict behind it meaningless — for
+    // this stack, `./gradlew :composeApp:assembleDebug`. The spine stops the
+    // lane there (qa/lib/lane-runner.mjs's compileShortCircuit) and it used to
+    // find this step by the literal name "build", which is Gradle's word for
+    // the task and Gradle's word for the output directory, and nobody else's.
+    // Declared here so the spine reads a name instead of assuming one; the
+    // value is unchanged, so this lane stops exactly where it always did.
+    compileStepName: "build",
+    // The bounds on a step's derived deadline. These are the spine's historical
+    // fallback to the millisecond, so this lane does not move — but they are a
+    // judgement about how long a cold Gradle daemon plus an Android build can
+    // honestly take, and that judgement belongs to whoever owns the toolchain.
+    // Declared so the numbers have an owner rather than being inherited by
+    // every stack that never chose them.
+    stepDeadlines: { floorMs: 5 * 60_000, ceilingMs: 30 * 60_000 },
     // The ladder this pack's steps can earn (evidence-level.mjs). A pack that
     // returns none earns no rung — the spine never grades a pack by another
     // pack's step names.

package/packages/harness/src/lib/receipt-validate.mjs

@@ -6,7 +6,7 @@
 // tarball rather than the working tree.
 //
 // SINGLE SOURCE OF TRUTH: packages/receipts/src/receipt-validate.mjs in the
-// create-cmp repo (the `@create-cmp/receipts` package). The copy in a generated
+// create-cmp repo (the `prooflane-receipts` package). The copy in a generated
 // project's qa/lib/ is vendored byte-identical at scaffold time and pinned by
 // test/receipts-parity.test.mjs — edit the package source, then run
 // `node scripts/sync-harness.mjs`.
@@ -74,20 +74,31 @@ export function checkLaneVouching(receipt) {
       detail: `the receipt's verdict is PASS but ${failed.length} step(s) did not pass: ${names} — the row is the more specific truth`,
     };
   }
-  const integrity = steps.find((s) => s && s.name === "harnessIntegrity");
+  // THE ROW THAT VOUCHES IS THE ROW CARRYING THE VOUCHING DATA, not the row with
+  // a particular name. This found a step named exactly `harnessIntegrity` — a
+  // name the cmp pack chose, that `REQUIRED_EXPORTS` never mentions, and that a
+  // profile author has no way to discover. A green lane whose self-vouching step
+  // was spelled `harness_integrity` minted receipts that were invalid FOREVER,
+  // in every reader, and the refusal accused the lane of not vouching for
+  // itself. The `harness` object on a step row is what the schema already
+  // documents as the integrity check's own findings, so it is the honest key.
+  // The name is kept as a fallback for receipts written before rows carried it.
+  const integrity = steps.find((s) => s && s.harness && typeof s.harness === "object") ?? steps.find((s) => s && s.name === "harnessIntegrity");
   if (!integrity) {
     return {
       ok: false,
-      detail: "receipt has no harnessIntegrity row — nothing vouches that the lane's own code is the code that ran",
+      detail:
+        "no step on this receipt vouches for the lane — no row carries a `harness` object and none is named harnessIntegrity, " +
+        "so nothing attests that the lane's own code is the code that ran",
     };
   }
   if (integrity.verdict !== "PASS") {
     return {
       ok: false,
-      detail: `harnessIntegrity is ${integrity.verdict}, not PASS — the lane did not vouch for itself, so its PASS over the tree cannot be trusted`,
+      detail: `${integrity.name ?? "the integrity step"} is ${integrity.verdict}, not PASS — the lane did not vouch for itself, so its PASS over the tree cannot be trusted`,
     };
   }
-  return { ok: true, detail: "lane vouched for itself (harnessIntegrity PASS, no failing rows)" };
+  return { ok: true, detail: `lane vouched for itself (${integrity.name ?? "integrity step"} PASS, no failing rows)` };
 }
 
 export function evaluateReceipt(receipt, recompute) {
@@ -101,6 +112,33 @@ export function evaluateReceipt(receipt, recompute) {
     };
   }
 
+  // WHICH PACK GRADED THIS — ADR-0011. §8.9's comparability rule rests entirely
+  // on this field ("a `cmp` L2 and any other pack's L2 are different claims"),
+  // and until now no predicate read it: remove `pack` and a receipt kept its
+  // rung while losing the only thing that says what the rung is a rung OF.
+  //
+  // REFUSED, not flagged, and the cost is known. A receipt written before the
+  // field existed (2026-09-04) is refused too, because nothing in a receipt can
+  // tell "never had one" from "had one, and it was removed" — and of those two
+  // errors, accepting tampering is the one a predicate exists to prevent. The
+  // remedy is the one the binding check above already offers for the same class
+  // of staleness, and costs the same: re-run the lane.
+  //
+  // This is deliberately NOT the ADR-0007 case. There a label moved and no
+  // assertion changed, so invalidating old receipts would have been pure loss.
+  // Here the receipt is genuinely missing the field that makes its rung mean
+  // something — it is not being punished for a name, it is being asked for a
+  // claim it never made.
+  if (!receipt.pack || typeof receipt.pack.id !== "string" || receipt.pack.id.length === 0) {
+    return {
+      valid: false,
+      reason:
+        `receipt names no step pack — re-run the lane (attesting profile: ${profile ?? "unknown"}). ` +
+        `A rung is comparable only within its pack, so a receipt that does not name one cannot be compared to any other`,
+      profile,
+    };
+  }
+
   if (receipt.verdict === "FAIL") {
     return {
       valid: false,
@@ -146,12 +184,33 @@ export const DEFAULT_POLICY = {
   /** A receipt older than this no longer counts as fresh (hosted check only). */
   maxAgeMs: 30 * 24 * 60 * 60 * 1000, // 30 days
   /**
-   * Executed (non-SKIP) gates must report at least this much total wall time.
-   * A "PASS" receipt whose executed gates sum to less cannot attest a real
-   * lane run — the tell for replayed/cached or hand-written verdicts
-   * (evidence must attest execution, not results).
+   * An absolute wall-time floor for executed (non-SKIP) gates. `null` — OFF by
+   * default, and that is a decision rather than an omission.
+   *
+   * This was 5000, with the reasoning that a PASS receipt summing to less
+   * cannot attest a real lane run: the tell for a replayed/cached green or a
+   * hand-written verdict. That reasoning holds for a Gradle lane and is FALSE
+   * for a Go service, a Rust crate, a Python package or a TypeScript library,
+   * whose lanes honestly finish in hundreds of milliseconds. Those adopters
+   * were told their evidence was fabricated — the one accusation this product
+   * cannot afford to make wrongly.
+   *
+   * The number was not the defect. ONE receipt carries nothing that could
+   * justify any number: no start time, no top-level duration, no baseline —
+   * `generatedAt` is a timestamp, not an interval — so nothing on it can be
+   * cross-checked against anything else on it. A floor is therefore a fact
+   * about the STACK, and this module does not know the stack. It is the
+   * notary's to set, from data the notary has and the receipt does not: a
+   * lane that has taken thirty seconds every day for a month and today claims
+   * forty-two milliseconds is a real finding, and it is a finding about a
+   * HISTORY, not about a receipt.
+   *
+   * What is lost, said plainly: a hand-written receipt claiming small
+   * durations is no longer refused here. It was never much of a defence — a
+   * forger types a larger number — and every stack-independent check that
+   * does catch fabrication is untouched below.
    */
-  minExecutedMs: 5000,
+  minExecutedMs: null,
 };
 
 /**
@@ -176,9 +235,15 @@ export function checkFreshness(receipt, { now = Date.now(), maxAgeMs = DEFAULT_P
 }
 
 /**
- * Execution plausibility: do the executed (non-SKIP) gates report durations a
- * real lane run could produce? Catches replayed/cached greens and hand-edited
- * receipts whose numbers were never lived.
+ * Execution plausibility: did this lane execute anything, and are its numbers
+ * real numbers?
+ *
+ * Three refusals, all stack-independent and all about the SHAPE of the
+ * evidence rather than its size: a receipt with no steps, a receipt whose every
+ * step is a SKIP or an ERROR (neither measured anything), and a step whose
+ * duration is not a finite non-negative number. An absolute wall-time floor is
+ * a fourth check and is OFF unless a caller sets `minExecutedMs` — see
+ * DEFAULT_POLICY for why a default one is a claim about the stack.
  * @returns {{ok: boolean, detail: string, executedMs?: number, executedSteps?: number}}
  */
 export function checkExecutionPlausibility(receipt, { minExecutedMs = DEFAULT_POLICY.minExecutedMs } = {}) {
@@ -200,10 +265,13 @@ export function checkExecutionPlausibility(receipt, { minExecutedMs = DEFAULT_PO
     }
     total += step.durationMs;
   }
-  if (total < minExecutedMs) {
+  // Applied only when a caller supplies one. The message attributes the floor
+  // to whoever set it and states the measurement, rather than asserting that a
+  // fast receipt cannot be real — which this module has no way to know.
+  if (typeof minExecutedMs === "number" && minExecutedMs > 0 && total < minExecutedMs) {
     return {
       ok: false,
-      detail: `implausibly fast — executed gates report ${total}ms total, below the ${minExecutedMs}ms floor; a receipt this fast cannot attest a real lane run (evidence must attest execution)`,
+      detail: `executed gates report ${total}ms total, below this validator's configured ${minExecutedMs}ms floor — for a fast stack that may be honest, so treat it as a finding to explain rather than proof of fabrication`,
       executedMs: total,
       executedSteps: executed.length,
     };
@@ -247,7 +315,7 @@ export function validateReceiptForTree({ root, now = Date.now(), policy = {} } =
   if (receipt === null) {
     return {
       status: "missing",
-      reason: `no receipt at ${RECEIPT_REL_PATH} — this repo does not carry the create-cmp evidence harness (that is not a failure)`,
+      reason: `no receipt at ${RECEIPT_REL_PATH} — this repo does not carry the prooflane evidence harness (that is not a failure)`,
       checks: [{ id: "receipt-present", ok: false, detail: `no parsable receipt at ${RECEIPT_REL_PATH}` }],
       skips: [],
     };