create-cmp-cli 0.24.0 → 0.25.0

package/template/qa/framework-check.mjs

@@ -33,12 +33,13 @@
 // changes, because a crash mid-plant must never be able to lose your work.
 //
 // Which plants are possible is DERIVED from the tree (qa/lib/framework-check.mjs).
-// A project with no specs, no flows, or no Kotlin tests still gets the region
+// A project with no specs, no flows, or no test sources still gets the region
 // plants; each unavailable plant is reported WITH ITS REASON. Nothing here ever
 // prints PASS because it found nothing to do.
 
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -51,15 +52,22 @@ import {
   assessPlantRun,
   assessGreenRun,
   assessCalibrationCost,
+  assessBadgeFloor,
+  plantRow,
 } from "./lib/framework-check.mjs";
+import { plantCalibration } from "./lib/plant-calibration.mjs";
+import { evidenceLadderFor } from "./lib/evidence-ladder.mjs";
 import { listHarnessFiles } from "./lib/harness-region.mjs";
-import { listFlowFiles, scanCitations, walkFiles, DESKTOP_TIERS } from "./lib/spec-coverage.mjs";
+import { checkHarnessIntegrity, describeIntegrity, writeHarnessLock } from "./lib/harness-lock.mjs";
+import { listFlowFiles, scanCitations, walkFiles } from "./lib/spec-coverage.mjs";
+import { resolveSpecModel } from "./lib/spec-model.mjs";
+import { resolveHarnessManifest } from "./lib/harness-manifest.mjs";
+import { loadProfileSync } from "./lib/profile-loader.mjs";
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const RECEIPT_REL = "qa/evidence/latest.json";
 const SURFACE_REL = "qa/verified-surface.json";
 const README_REL = "README.md";
-const PLANTED_TEST_BASENAME = "CmpFrameworkCheckPlanted.kt";
 
 const argv = process.argv.slice(2);
 const flag = (n) => argv.includes(n);
@@ -188,45 +196,129 @@ function hookRefuses() {
 // ── Read the tree, decide what can be planted ───────────────────────────────
 
 function readSpecs() {
-  const dir = path.join(ROOT, "specs");
+  if (!SPEC_MODEL) return [];
+  const dir = path.join(ROOT, ...SPEC_MODEL.specsDir.split("/"));
   if (!fs.existsSync(dir)) return [];
   return fs
     .readdirSync(dir)
     .filter((n) => n.endsWith(".spec.md"))
     .sort()
-    .map((n) => ({ rel: `specs/${n}`, text: fs.readFileSync(path.join(dir, n), "utf8") }));
+    .map((n) => ({ rel: `${SPEC_MODEL.specsDir}/${n}`, text: fs.readFileSync(path.join(dir, n), "utf8") }));
 }
 
+// The scanner's model — the profile's layout and tiers. This runner plants
+// into specs, flows and test sources, so it has to know where they are; it
+// asks the profile, never a constant. A tree with no usable profile has no
+// spec plants to make, and says so per plant rather than guessing.
+const SPEC_MODEL_RESULT = resolveSpecModel(ROOT);
+// REFUSE FIRST. With no manifest there is no layout, so every plant that reads
+// the tree reported an honest-looking absence of files that exist: a project
+// with two specs and nine clauses was told "no spec files — nothing declares
+// behavior to plant against", four lines before the manifest refusal explained
+// the real problem. That is the exact failure harness-manifest.mjs names in its
+// own header as the reason there is no default profile, reproduced inside the
+// instrument built to prove the lane returns. A reader who cannot know the
+// layout says so and stops, rather than describing a tree it cannot see.
+if (!SPEC_MODEL_RESULT.ok) {
+  process.stderr.write(`\n${SPEC_MODEL_RESULT.reason}\n`);
+  process.exit(2);
+}
+const SPEC_MODEL = SPEC_MODEL_RESULT.model;
+
+// The SOURCE this profile's planted citations live in. A citation must sit on
+// a test, so two of the plants have to WRITE a test — in this stack's
+// language, with its test-declaration syntax, at a path it compiles. Everything
+// else about a plant is stack-free: the clause grammar and the citation marker
+// are the core scanner's, and which plants a tree can support is derived from
+// the tree. A profile that declares none simply ships without those two, said
+// out loud per plant (§5.2: no plants, no badge).
+const PROFILE_MODULE = (() => {
+  const manifest = resolveHarnessManifest(ROOT);
+  if (!manifest.ok) return null;
+  const loaded = loadProfileSync(ROOT, manifest.manifest.profile);
+  return loaded.ok ? loaded.profile : null;
+})();
+const PLANT_DECL = PROFILE_MODULE?.plants ?? null;
+
+// The SOURCE half of that declaration, which the two citation plants cannot do
+// without. Kept separate from the declaration itself because the other half —
+// which step observes which plant (`observedBy`) — costs a pack nothing to give
+// and must not be withheld by the absence of a Kotlin/Python/Go snippet it has
+// not written yet. Requiring all of it or none of it would mean a pack that
+// names its steps but ships no plant source still had cmp's spellings asserted
+// against it, which is the defect this reads the declaration to avoid.
+//
+// THE TEST FOR "ENOUGH TO PLANT WITH" USED TO BE THREE `typeof`s WRITTEN HERE.
+// It moved to qa/lib/plant-calibration.mjs the day the RUNG came to depend on
+// the same answer (NORTH-STAR §8.9 — a profile with no calibrated plants earns
+// no rung): the grader and the instrument asking that question separately is
+// how the same word ends up meaning two things in one tree, which is the
+// `flowCitation`/`scanCitations` episode this file already carries.
+const PROFILE_PLANTS = plantCalibration(PLANT_DECL).ok ? PLANT_DECL : null;
+const PLANTED_TEST_REL = (testDir) => `${testDir}/${PROFILE_PLANTS.testFileBasename}`;
+
 function readFlows() {
-  return listFlowFiles(ROOT).map((rel) => ({ rel, text: fs.readFileSync(abs(rel), "utf8") }));
+  if (!SPEC_MODEL) return [];
+  return listFlowFiles(ROOT, SPEC_MODEL).map((rel) => ({ rel, text: fs.readFileSync(abs(rel), "utf8") }));
 }
 
 /**
- * A directory that already holds a desktop-tier test, derived from the tree's
- * own citations rather than guessed from a package convention — an adopted
- * project's source layout is not ours to assume.
+ * A directory that already holds a host-only-tier test, derived from the
+ * tree's own citations rather than guessed from a package convention — an
+ * adopted project's source layout is not ours to assume.
  */
 function findTestDir() {
+  if (!SPEC_MODEL) return null;
   let tags = [];
   try {
-    tags = scanCitations(ROOT);
+    tags = scanCitations(ROOT, SPEC_MODEL);
   } catch {
     return null;
   }
-  const desktop = tags.find((tag) => DESKTOP_TIERS.includes(tag.tier));
-  if (desktop) return path.dirname(desktop.file);
-  // No citations yet: fall back to any directory holding a Kotlin test source.
-  const kt = walkFiles(path.join(ROOT, "composeApp/src"), [".kt"]).find((f) => /(commonTest|desktopTest)/.test(f));
-  return kt ? path.dirname(path.relative(ROOT, kt)) : null;
+  const hostOnly = SPEC_MODEL.tiers.hostOnly;
+  const cited = tags.find((tag) => hostOnly.includes(tag.tier));
+  if (cited) return path.dirname(cited.file);
+  // No citations yet: fall back to any source under a citation root that the
+  // profile's own tiering places on a host-only tier.
+  for (const rootRel of SPEC_MODEL.citationRoots) {
+    const hit = walkFiles(path.join(ROOT, ...rootRel.split("/")), SPEC_MODEL.citationExts).find((f) =>
+      hostOnly.includes(SPEC_MODEL.tiers.forFile(path.relative(ROOT, f))),
+    );
+    if (hit) return path.dirname(path.relative(ROOT, hit));
+  }
+  return null;
 }
 
-out(`framework check: bound=${BOUND_MS}ms per direction, profile=smoke (no Gradle, no device, no network)`);
+// `smoke` is the lane's cheapest profile: the steps that need no build tool, no
+// device and no network. Naming the build tool here ("no Gradle") was one
+// stack's word in the instrument that exists to prove this file has none — a
+// small lie, but in the one place that can least afford it.
+out(`framework check: bound=${BOUND_MS}ms per direction, profile=smoke (host-only steps: no build tool, no device, no network)`);
 
+// With no plant material the instrument cannot write a test, so the two plants
+// that need one are unavailable — reported by name, never quietly dropped.
 const tree = {
   specs: readSpecs(),
   flows: readFlows(),
   harnessLib: listHarnessFiles(ROOT).filter((rel) => rel.startsWith("qa/lib/")),
-  testDir: findTestDir(),
+  testDir: PROFILE_PLANTS ? findTestDir() : null,
+  // So the skip can name the REAL cause instead of blaming the tree.
+  plantsDeclared: Boolean(PROFILE_PLANTS),
+  // No `?? "e2e"` anywhere: the tier a plant declares is the profile's or absent.
+  unmeetableTier: PROFILE_PLANTS?.unmeetableTier ?? null,
+  // WHICH STEP CATCHES WHICH PLANT is the pack's word, exactly as the tier
+  // above is. There is no `?? "specCoverage"` here for the same reason there is
+  // no `?? "e2e"` there: a default is another stack's name asserted against
+  // this one, and lib/framework-check.mjs `observingStep` records what that
+  // cost. A pack that names none gets an assertion over the lane.
+  observedBy: PLANT_DECL?.observedBy ?? null,
+  flowsDir: SPEC_MODEL && SPEC_MODEL.flows ? SPEC_MODEL.flows.dir : null,
+  // What a citation LOOKS like is the profile's, never `#`. Without this the
+  // selector falls back to DEFAULT_GRAMMAR, which accepts `//` and `#` and so
+  // happens to serve C-family and YAML journeys — and silently refuses to
+  // select either flow plant for a stack whose comments start `--`, `;` or `%`.
+  // A plant that is never selected is a gate nobody is calibrating.
+  grammar: SPEC_MODEL ? SPEC_MODEL.grammar : null,
 };
 
 const { plants, unavailable } = selectPlants(tree);
@@ -235,6 +327,50 @@ if (!coverage.ok) die(coverage.reason);
 
 for (const u of unavailable) out(`  ⓘ  ${u.kind.padEnd(24)} not planted — ${u.reason}`);
 
+// A plant whose step this pack has not named is neither unavailable nor broken:
+// it asserts over the LANE instead of over one row, which is a real gate and a
+// blunter one (qa/lib/framework-check.mjs `observingStep`). It is said out loud
+// for the same reason every unavailable plant says why — and for one more. The
+// whole episode behind `observedBy` is that a requirement nobody can discover is
+// a requirement nobody meets: `harnessIntegrity` was undiscoverable and cost an
+// adopter a lane that could never mint a valid receipt (NORTH-STAR §9.1). A
+// declaration that only appears in a refusal repeats that, one level quieter. So
+// the instrument names it while everything is GREEN, which is the only moment
+// the reader is not already debugging something else.
+for (const p of plants) {
+  if (p.step || p.vouching) continue;
+  out(
+    `  ⓘ  ${p.kind.padEnd(24)} asserted over the whole lane — this profile's \`plants.observedBy\` names no step ` +
+      `for it; naming one narrows the assertion to that row`,
+  );
+}
+
+// ── The badge floor, planted (NORTH-STAR §8.9, §6.7; GATE-RULES Rule 1) ─────
+// "A profile with no calibrated plants earns no rung" is a guarantee, and until
+// 2026-09-08 nothing checked it: two scratch adopters differing in exactly one
+// export — one shipping `plants`, one shipping none — both earned L1. The floor
+// now lives in the grader (qa/lib/evidence-level.mjs), and a floor nobody
+// watches fail is a floor that quietly stops being there, so this plants the
+// violation it exists to catch and asserts the refusal.
+//
+// It runs BEFORE the dirty-tree check because it touches nothing: no file, no
+// lane, no receipt. That is also its limit and the line below says so — it
+// proves what the grader WOULD give this ladder, not that a lane ran.
+const badgeFloor = (() => {
+  const started = t();
+  const resolved = evidenceLadderFor(PROFILE_MODULE);
+  const assessed = resolved.ok
+    ? assessBadgeFloor({ ladder: resolved.ladder, plants: PLANT_DECL })
+    : { available: false, reason: resolved.reason };
+  return { ...assessed, ms: t() - started };
+})();
+if (badgeFloor.ok === false) die(badgeFloor.reason);
+out(
+  badgeFloor.available === false
+    ? `  ⓘ  ${"badge floor".padEnd(24)} not planted — ${badgeFloor.reason}`
+    : `  badge floor          ${String(badgeFloor.ms).padStart(5)}ms   ✓ this profile's ladder grades ${badgeFloor.rung} with its plants and NOTHING without them (grader only — no lane run)`,
+);
+
 // ── Refuse to start on a dirty tree ─────────────────────────────────────────
 // Everything this may write, named up front. A file with uncommitted changes is
 // a file whose bytes we would be gambling with if the process died mid-plant.
@@ -245,7 +381,7 @@ for (const p of plants) {
   if (p.target.flow) touched.add(p.target.flow);
   if (p.target.file) touched.add(p.target.file);
   if (p.target.declaration) touched.add(p.target.declaration);
-  if (p.target.testDir) touched.add(`${p.target.testDir}/${PLANTED_TEST_BASENAME}`);
+  if (p.target.testDir) touched.add(PLANTED_TEST_REL(p.target.testDir));
 }
 
 {
@@ -289,7 +425,7 @@ function plantFiles(plant) {
   if (plant.target.flows) rels.push(...plant.target.flows);
   if (plant.target.file) rels.push(plant.target.file);
   if (plant.target.declaration) rels.push(plant.target.declaration);
-  if (plant.target.testDir) rels.push(`${plant.target.testDir}/${PLANTED_TEST_BASENAME}`);
+  if (plant.target.testDir) rels.push(PLANTED_TEST_REL(plant.target.testDir));
   if (plant.target.nestInto) {
     for (const rel of plant.target.flows ?? []) rels.push(`${plant.target.nestInto}/${path.basename(rel)}`);
   }
@@ -300,9 +436,31 @@ function read(rel) {
   return fs.readFileSync(abs(rel), "utf8");
 }
 
-/** Every `# SPEC:` citation line neutralised — the flow stays valid YAML. */
-function stripCitations(text) {
-  return text.replace(/^#\s*SPEC:.*$/gm, "# (citation removed by the framework check)");
+/**
+ * Every citation line REMOVED — in whatever comment syntax this stack writes.
+ *
+ * This replaced a line that neutralised `^#\s*SPEC:` and wrote a `#` comment in
+ * its place, which is one stack's syntax twice over. It was survivable only
+ * while the plant selector was ALSO keyed to `#`: a `//`-citing project had
+ * both flow plants skipped, silently, and the two failures cancelled. Now that
+ * the selector reads the profile's declared marker, this one would be reached
+ * with a marker it cannot match — the citation would stay, the plant would not
+ * bite, and the instrument would report a framework defect that is its own.
+ *
+ * Removing the whole line rather than rewriting it is what makes this
+ * language-free: deleting a comment is safe in YAML, in every C-family flow, in
+ * Python and in Lua, whereas writing a replacement comment requires knowing the
+ * syntax. The marker is matched on the TRIMMED line, agreeing with
+ * `scanCitations` and with the selector about indented citations.
+ */
+function stripCitations(text, marker = SPEC_MODEL?.grammar?.citationMarker ?? /\bSPEC:/) {
+  // A profile could declare its marker with /g, which makes `.test()` stateful
+  // across calls. Rebuild without flags rather than trust the declaration.
+  const probe = new RegExp(marker.source);
+  return text
+    .split("\n")
+    .filter((line) => !probe.test(line.trim()))
+    .join("\n");
 }
 
 function applyPlant(plant) {
@@ -320,10 +478,7 @@ function applyPlant(plant) {
       // the clause exists, the tag exists, and nothing runs.
       const text = read(target.spec);
       write(target.spec, `${text.trimEnd()}\n- **${target.clause}** — Given a planted clause, Then a class-level tag must not count.\n`);
-      write(
-        `${target.testDir}/${PLANTED_TEST_BASENAME}`,
-        `// Planted by qa/framework-check.mjs — reverted automatically.\n\n// SPEC: ${target.clause}\nclass CmpFrameworkCheckPlanted {\n  val a = 1\n  val b = 2\n  val c = 3\n  val d = 4\n  val e = 5\n  val f = 6\n  fun helper() {}\n}\n`,
-      );
+      write(PLANTED_TEST_REL(target.testDir), PROFILE_PLANTS.unboundCitationSource(target.clause));
       break;
     }
     case PLANT_KINDS.TIER_UNMET: {
@@ -331,12 +486,9 @@ function applyPlant(plant) {
       const text = read(target.spec);
       write(
         target.spec,
-        `${text.trimEnd()}\n- **${target.clause}** [tier: e2e] — Given a planted device-only clause, Then a JVM citation cannot satisfy it.\n`,
-      );
-      write(
-        `${target.testDir}/${PLANTED_TEST_BASENAME}`,
-        `// Planted by qa/framework-check.mjs — reverted automatically.\n\nimport kotlin.test.Test\n\nclass CmpFrameworkCheckPlanted {\n  // SPEC: ${target.clause}\n  @Test\n  fun planted() {}\n}\n`,
+        `${text.trimEnd()}\n- **${target.clause}** [tier: ${target.unmeetableTier}] — Given a planted clause only the target can observe, Then a host-tier citation cannot satisfy it.\n`,
       );
+      write(PLANTED_TEST_REL(target.testDir), PROFILE_PLANTS.tierUnmetCitationSource(target.clause));
       break;
     }
     case PLANT_KINDS.FEATURE_WITHOUT_FLOW: {
@@ -429,8 +581,15 @@ try {
       }
     }
 
+    // NAME THE ROW THAT ACTUALLY WENT RED, not the one the plant asked for.
+    // For a plant whose step this pack did not declare those are different
+    // strings — the plant asked for nothing — and "undefined FAIL naming
+    // CART-01" is a line that makes a working run look broken. It is also the
+    // more useful line in every case: on a pack the reader does not know, this
+    // is where they learn which of their own gates is calibrated.
     const named = plant.names.length ? ` naming ${plant.names.join(", ")}` : "";
-    out(`  FAIL: ${plant.label.padEnd(28)} ${String(run.ms).padStart(5)}ms   ✓ ${plant.step} FAIL${named}`);
+    const observed = plantRow(run.receipt.steps, plant)?.name ?? plant.step ?? "the lane";
+    out(`  FAIL: ${plant.label.padEnd(28)} ${String(run.ms).padStart(5)}ms   ✓ ${observed} FAIL${named}`);
     revertPlant(plant);
   }
 
@@ -439,9 +598,21 @@ try {
     const first = plants[0];
     applyPlant(first);
     const r = runSmoke();
-    revertPlant(first);
     if (!r.receipt || r.receipt.verdict !== "FAIL") die("could not produce a FAIL receipt for the hook check");
+    // ASK THE HOOK BEFORE REVERTING. `revertPlant` restores RECEIPT_REL from
+    // what was on disk when this run started, so reverting first meant the hook
+    // was never shown the FAIL receipt the lane had just written. On a tree with
+    // no prior receipt the revert DELETED it and the hook refused because there
+    // was no receipt at all — green, for a reason that has nothing to do with
+    // this assertion. On a tree where the lane had already run, the revert put
+    // the earlier PASS back and the check failed on a working lane. Neither
+    // outcome tested "the Stop hook refuses a FAIL receipt". A check that cannot
+    // fail for its own reason is the exact defect this instrument exists to
+    // catch, which is why it is worth the four lines to say so. Found by the
+    // first non-Compose adoption, 2026-09-04. (`die` is safe here: every touched
+    // file is restored in the outer finally, plant reverted or not.)
     if (!hookRefuses().refused) die("the Stop hook did not refuse a FAIL receipt");
+    revertPlant(first);
     out(`  Stop hook            refuses a FAIL receipt ✓`);
   }
 
@@ -449,7 +620,19 @@ try {
   //    synthetic row over this tree's own valid hash, so only the skip is new.
   {
     const green = runSmoke();
-    if (!green.receipt || green.receipt.verdict !== "PASS") die("could not produce a PASS receipt for the device-tier hook check");
+    if (!green.receipt || green.receipt.verdict !== "PASS") {
+      // NAME THE STEPS. "could not produce a PASS receipt" told a reader that
+      // something was wrong and nothing about what, in the one place where the
+      // instrument has the whole receipt in hand. Evidence-or-silence applies to
+      // the instrument's own refusals too.
+      const bad = (green.receipt?.steps ?? [])
+        .filter((s) => s.verdict === "FAIL" || s.verdict === "ERROR")
+        .map((s) => `${s.name}: ${s.reason ?? s.verdict}`);
+      die(
+        `could not produce a PASS receipt for the device-tier hook check` +
+          (bad.length ? ` — ${bad.join("; ")}` : green.receipt ? ` (verdict ${green.receipt.verdict}, no failing step)` : " (no receipt at all)"),
+      );
+    }
     const planted = {
       ...green.receipt,
       profile: "local",
@@ -461,10 +644,57 @@ try {
     };
     write(RECEIPT_REL, JSON.stringify(planted, null, 2));
     const hook = hookRefuses();
-    if (!hook.refused || !/device tier did not run/.test(hook.stderr)) {
-      die(`the Stop hook did not refuse a receipt whose device tier was skipped for an environmental reason:\n${hook.stderr.slice(-400)}`);
+    // Stage 0 PR 6c: the refusal is stack-free — ANY step that skipped for an
+    // environmental reason blocks done, whatever it is called.
+    if (!hook.refused || !/a tier did not run/.test(hook.stderr)) {
+      die(`the Stop hook did not refuse a receipt whose tier was skipped for an environmental reason:\n${hook.stderr.slice(-400)}`);
+    }
+    out(`  Stop hook            refuses a skipped tier ✓`);
+  }
+
+  // 4b. THE VACUITY FLOOR (ADR-0010) — the one plant that cannot be made in
+  // this tree.
+  //
+  // Its violation is the ABSENCE of the engine, so planting it here would
+  // delete the files this instrument is running from: the lane would fail to
+  // START rather than fail by name, and a plant that proves the tree is broken
+  // proves nothing about the gate. So the region is built in a scratch
+  // directory, locked, and the refusal is watched there.
+  //
+  // The exception is granted for one reason and holds only while that reason
+  // does: this is the only gate whose violation removes the instrument that
+  // would observe it. A future gate wanting an out-of-tree plant must show the
+  // same property, not cite this one.
+  {
+    const started = Date.now();
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "vacuity-floor-"));
+    try {
+      fs.mkdirSync(path.join(scratch, "qa"), { recursive: true });
+      // A region of declarations and nothing else — ADR-0008's probe, exactly.
+      fs.writeFileSync(path.join(scratch, "qa", "verified-surface.json"), '{"surface":["src"]}\n');
+      fs.writeFileSync(path.join(scratch, "qa", "harness-manifest.json"), '{"schema":"harness-manifest/1"}\n');
+      writeHarnessLock(scratch, { version: "0.0.0-plant" });
+      const seen = checkHarnessIntegrity(scratch);
+      if (!seen.vacuous || seen.engineFiles !== 0) {
+        die(`the vacuity floor did not see an engine-free region: engineFiles=${seen.engineFiles}, vacuous=${seen.vacuous}`);
+      }
+      if (seen.status !== "intact") {
+        die(`the plant is only meaningful while the region reads intact — it read "${seen.status}", so the floor is being proved against the wrong state`);
+      }
+      // FAILING BY NAME is the requirement (§8.8), and the name has to reach a
+      // human. `describeIntegrity` is the shared voice every caller renders, so
+      // the plant watches THAT refuse — a flag nobody prints would be a gate
+      // nobody sees.
+      const said = describeIntegrity(seen);
+      if (!/not a lane/.test(said) || /files verified/.test(said)) {
+        die(`the vacuity floor is invisible to every caller that renders an integrity result: describeIntegrity said "${said}"`);
+      }
+      const ms = Date.now() - started;
+      cycles.push({ label: "vacuity floor", ms });
+      out(`  FAIL: region holds no engine     ${String(ms).padStart(5)}ms   ✓ intact but vacuous, and it SAYS so — ${seen.fileCount} file(s), 0 engine`);
+    } finally {
+      fs.rmSync(scratch, { recursive: true, force: true });
     }
-    out(`  Stop hook            refuses a skipped device tier ✓`);
   }
 
   // 5. Everything reverted, and it passes again — the plants were the only cause.
@@ -492,6 +722,10 @@ if (asJson) {
         verdict: "PASS",
         plants: plants.map((p) => ({ kind: p.kind, label: p.label, step: p.step })),
         unavailable,
+        // Reported beside the tree plants, never counted as one: it plants into
+        // the GRADER rather than into the tree, and a reader comparing plant
+        // counts across runs must not see this one move the number.
+        badgeFloor,
         cycles,
         totalMs: cost.totalMs,
         budgetMs: BUDGET_MS,

package/template/qa/harness-manifest.json

@@ -0,0 +1,10 @@
+{
+  "schema": "harness-manifest/2",
+  "profile": { "id": "cmp" },
+  "receipt": "qa/evidence/latest.json",
+  "architectureDoc": "docs/ARCHITECTURE.md",
+  "specs": "specs",
+  "citationRoots": ["composeApp/src", "qa/e2e"],
+  "approvals": "qa/approvals.json",
+  "packs": ["cmp"]
+}

package/template/qa/lib/a11y.mjs

@@ -21,7 +21,7 @@
 // Trees produced before the role/clickable/disabled contract extension are handled
 // gracefully: nodes without `clickable` are simply skipped, never crashed on.
 
-import { walk } from "./tree.mjs";
+import { walk } from "./profiles/cmp/tree.mjs";
 
 /**
  * Audit a tree for accessibility faults.