create-cmp-cli 0.24.0 → 0.25.0

package/packages/harness/src/framework-check.mjs

@@ -33,12 +33,13 @@
 // changes, because a crash mid-plant must never be able to lose your work.
 //
 // Which plants are possible is DERIVED from the tree (qa/lib/framework-check.mjs).
-// A project with no specs, no flows, or no Kotlin tests still gets the region
+// A project with no specs, no flows, or no test sources still gets the region
 // plants; each unavailable plant is reported WITH ITS REASON. Nothing here ever
 // prints PASS because it found nothing to do.
 
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -51,15 +52,22 @@ import {
   assessPlantRun,
   assessGreenRun,
   assessCalibrationCost,
+  assessBadgeFloor,
+  plantRow,
 } from "./lib/framework-check.mjs";
+import { plantCalibration } from "./lib/plant-calibration.mjs";
+import { evidenceLadderFor } from "./lib/evidence-ladder.mjs";
 import { listHarnessFiles } from "./lib/harness-region.mjs";
-import { listFlowFiles, scanCitations, walkFiles, DESKTOP_TIERS } from "./lib/spec-coverage.mjs";
+import { checkHarnessIntegrity, describeIntegrity, writeHarnessLock } from "./lib/harness-lock.mjs";
+import { listFlowFiles, scanCitations, walkFiles } from "./lib/spec-coverage.mjs";
+import { resolveSpecModel } from "./lib/spec-model.mjs";
+import { resolveHarnessManifest } from "./lib/harness-manifest.mjs";
+import { loadProfileSync } from "./lib/profile-loader.mjs";
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const RECEIPT_REL = "qa/evidence/latest.json";
 const SURFACE_REL = "qa/verified-surface.json";
 const README_REL = "README.md";
-const PLANTED_TEST_BASENAME = "CmpFrameworkCheckPlanted.kt";
 
 const argv = process.argv.slice(2);
 const flag = (n) => argv.includes(n);
@@ -188,45 +196,129 @@ function hookRefuses() {
 // ── Read the tree, decide what can be planted ───────────────────────────────
 
 function readSpecs() {
-  const dir = path.join(ROOT, "specs");
+  if (!SPEC_MODEL) return [];
+  const dir = path.join(ROOT, ...SPEC_MODEL.specsDir.split("/"));
   if (!fs.existsSync(dir)) return [];
   return fs
     .readdirSync(dir)
     .filter((n) => n.endsWith(".spec.md"))
     .sort()
-    .map((n) => ({ rel: `specs/${n}`, text: fs.readFileSync(path.join(dir, n), "utf8") }));
+    .map((n) => ({ rel: `${SPEC_MODEL.specsDir}/${n}`, text: fs.readFileSync(path.join(dir, n), "utf8") }));
 }
 
+// The scanner's model — the profile's layout and tiers. This runner plants
+// into specs, flows and test sources, so it has to know where they are; it
+// asks the profile, never a constant. A tree with no usable profile has no
+// spec plants to make, and says so per plant rather than guessing.
+const SPEC_MODEL_RESULT = resolveSpecModel(ROOT);
+// REFUSE FIRST. With no manifest there is no layout, so every plant that reads
+// the tree reported an honest-looking absence of files that exist: a project
+// with two specs and nine clauses was told "no spec files — nothing declares
+// behavior to plant against", four lines before the manifest refusal explained
+// the real problem. That is the exact failure harness-manifest.mjs names in its
+// own header as the reason there is no default profile, reproduced inside the
+// instrument built to prove the lane returns. A reader who cannot know the
+// layout says so and stops, rather than describing a tree it cannot see.
+if (!SPEC_MODEL_RESULT.ok) {
+  process.stderr.write(`\n${SPEC_MODEL_RESULT.reason}\n`);
+  process.exit(2);
+}
+const SPEC_MODEL = SPEC_MODEL_RESULT.model;
+
+// The SOURCE this profile's planted citations live in. A citation must sit on
+// a test, so two of the plants have to WRITE a test — in this stack's
+// language, with its test-declaration syntax, at a path it compiles. Everything
+// else about a plant is stack-free: the clause grammar and the citation marker
+// are the core scanner's, and which plants a tree can support is derived from
+// the tree. A profile that declares none simply ships without those two, said
+// out loud per plant (§5.2: no plants, no badge).
+const PROFILE_MODULE = (() => {
+  const manifest = resolveHarnessManifest(ROOT);
+  if (!manifest.ok) return null;
+  const loaded = loadProfileSync(ROOT, manifest.manifest.profile);
+  return loaded.ok ? loaded.profile : null;
+})();
+const PLANT_DECL = PROFILE_MODULE?.plants ?? null;
+
+// The SOURCE half of that declaration, which the two citation plants cannot do
+// without. Kept separate from the declaration itself because the other half —
+// which step observes which plant (`observedBy`) — costs a pack nothing to give
+// and must not be withheld by the absence of a Kotlin/Python/Go snippet it has
+// not written yet. Requiring all of it or none of it would mean a pack that
+// names its steps but ships no plant source still had cmp's spellings asserted
+// against it, which is the defect this reads the declaration to avoid.
+//
+// THE TEST FOR "ENOUGH TO PLANT WITH" USED TO BE THREE `typeof`s WRITTEN HERE.
+// It moved to qa/lib/plant-calibration.mjs the day the RUNG came to depend on
+// the same answer (NORTH-STAR §8.9 — a profile with no calibrated plants earns
+// no rung): the grader and the instrument asking that question separately is
+// how the same word ends up meaning two things in one tree, which is the
+// `flowCitation`/`scanCitations` episode this file already carries.
+const PROFILE_PLANTS = plantCalibration(PLANT_DECL).ok ? PLANT_DECL : null;
+const PLANTED_TEST_REL = (testDir) => `${testDir}/${PROFILE_PLANTS.testFileBasename}`;
+
 function readFlows() {
-  return listFlowFiles(ROOT).map((rel) => ({ rel, text: fs.readFileSync(abs(rel), "utf8") }));
+  if (!SPEC_MODEL) return [];
+  return listFlowFiles(ROOT, SPEC_MODEL).map((rel) => ({ rel, text: fs.readFileSync(abs(rel), "utf8") }));
 }
 
 /**
- * A directory that already holds a desktop-tier test, derived from the tree's
- * own citations rather than guessed from a package convention — an adopted
- * project's source layout is not ours to assume.
+ * A directory that already holds a host-only-tier test, derived from the
+ * tree's own citations rather than guessed from a package convention — an
+ * adopted project's source layout is not ours to assume.
  */
 function findTestDir() {
+  if (!SPEC_MODEL) return null;
   let tags = [];
   try {
-    tags = scanCitations(ROOT);
+    tags = scanCitations(ROOT, SPEC_MODEL);
   } catch {
     return null;
   }
-  const desktop = tags.find((tag) => DESKTOP_TIERS.includes(tag.tier));
-  if (desktop) return path.dirname(desktop.file);
-  // No citations yet: fall back to any directory holding a Kotlin test source.
-  const kt = walkFiles(path.join(ROOT, "composeApp/src"), [".kt"]).find((f) => /(commonTest|desktopTest)/.test(f));
-  return kt ? path.dirname(path.relative(ROOT, kt)) : null;
+  const hostOnly = SPEC_MODEL.tiers.hostOnly;
+  const cited = tags.find((tag) => hostOnly.includes(tag.tier));
+  if (cited) return path.dirname(cited.file);
+  // No citations yet: fall back to any source under a citation root that the
+  // profile's own tiering places on a host-only tier.
+  for (const rootRel of SPEC_MODEL.citationRoots) {
+    const hit = walkFiles(path.join(ROOT, ...rootRel.split("/")), SPEC_MODEL.citationExts).find((f) =>
+      hostOnly.includes(SPEC_MODEL.tiers.forFile(path.relative(ROOT, f))),
+    );
+    if (hit) return path.dirname(path.relative(ROOT, hit));
+  }
+  return null;
 }
 
-out(`framework check: bound=${BOUND_MS}ms per direction, profile=smoke (no Gradle, no device, no network)`);
+// `smoke` is the lane's cheapest profile: the steps that need no build tool, no
+// device and no network. Naming the build tool here ("no Gradle") was one
+// stack's word in the instrument that exists to prove this file has none — a
+// small lie, but in the one place that can least afford it.
+out(`framework check: bound=${BOUND_MS}ms per direction, profile=smoke (host-only steps: no build tool, no device, no network)`);
 
+// With no plant material the instrument cannot write a test, so the two plants
+// that need one are unavailable — reported by name, never quietly dropped.
 const tree = {
   specs: readSpecs(),
   flows: readFlows(),
   harnessLib: listHarnessFiles(ROOT).filter((rel) => rel.startsWith("qa/lib/")),
-  testDir: findTestDir(),
+  testDir: PROFILE_PLANTS ? findTestDir() : null,
+  // So the skip can name the REAL cause instead of blaming the tree.
+  plantsDeclared: Boolean(PROFILE_PLANTS),
+  // No `?? "e2e"` anywhere: the tier a plant declares is the profile's or absent.
+  unmeetableTier: PROFILE_PLANTS?.unmeetableTier ?? null,
+  // WHICH STEP CATCHES WHICH PLANT is the pack's word, exactly as the tier
+  // above is. There is no `?? "specCoverage"` here for the same reason there is
+  // no `?? "e2e"` there: a default is another stack's name asserted against
+  // this one, and lib/framework-check.mjs `observingStep` records what that
+  // cost. A pack that names none gets an assertion over the lane.
+  observedBy: PLANT_DECL?.observedBy ?? null,
+  flowsDir: SPEC_MODEL && SPEC_MODEL.flows ? SPEC_MODEL.flows.dir : null,
+  // What a citation LOOKS like is the profile's, never `#`. Without this the
+  // selector falls back to DEFAULT_GRAMMAR, which accepts `//` and `#` and so
+  // happens to serve C-family and YAML journeys — and silently refuses to
+  // select either flow plant for a stack whose comments start `--`, `;` or `%`.
+  // A plant that is never selected is a gate nobody is calibrating.
+  grammar: SPEC_MODEL ? SPEC_MODEL.grammar : null,
 };
 
 const { plants, unavailable } = selectPlants(tree);
@@ -235,6 +327,50 @@ if (!coverage.ok) die(coverage.reason);
 
 for (const u of unavailable) out(`  ⓘ  ${u.kind.padEnd(24)} not planted — ${u.reason}`);
 
+// A plant whose step this pack has not named is neither unavailable nor broken:
+// it asserts over the LANE instead of over one row, which is a real gate and a
+// blunter one (qa/lib/framework-check.mjs `observingStep`). It is said out loud
+// for the same reason every unavailable plant says why — and for one more. The
+// whole episode behind `observedBy` is that a requirement nobody can discover is
+// a requirement nobody meets: `harnessIntegrity` was undiscoverable and cost an
+// adopter a lane that could never mint a valid receipt (NORTH-STAR §9.1). A
+// declaration that only appears in a refusal repeats that, one level quieter. So
+// the instrument names it while everything is GREEN, which is the only moment
+// the reader is not already debugging something else.
+for (const p of plants) {
+  if (p.step || p.vouching) continue;
+  out(
+    `  ⓘ  ${p.kind.padEnd(24)} asserted over the whole lane — this profile's \`plants.observedBy\` names no step ` +
+      `for it; naming one narrows the assertion to that row`,
+  );
+}
+
+// ── The badge floor, planted (NORTH-STAR §8.9, §6.7; GATE-RULES Rule 1) ─────
+// "A profile with no calibrated plants earns no rung" is a guarantee, and until
+// 2026-09-08 nothing checked it: two scratch adopters differing in exactly one
+// export — one shipping `plants`, one shipping none — both earned L1. The floor
+// now lives in the grader (qa/lib/evidence-level.mjs), and a floor nobody
+// watches fail is a floor that quietly stops being there, so this plants the
+// violation it exists to catch and asserts the refusal.
+//
+// It runs BEFORE the dirty-tree check because it touches nothing: no file, no
+// lane, no receipt. That is also its limit and the line below says so — it
+// proves what the grader WOULD give this ladder, not that a lane ran.
+const badgeFloor = (() => {
+  const started = t();
+  const resolved = evidenceLadderFor(PROFILE_MODULE);
+  const assessed = resolved.ok
+    ? assessBadgeFloor({ ladder: resolved.ladder, plants: PLANT_DECL })
+    : { available: false, reason: resolved.reason };
+  return { ...assessed, ms: t() - started };
+})();
+if (badgeFloor.ok === false) die(badgeFloor.reason);
+out(
+  badgeFloor.available === false
+    ? `  ⓘ  ${"badge floor".padEnd(24)} not planted — ${badgeFloor.reason}`
+    : `  badge floor          ${String(badgeFloor.ms).padStart(5)}ms   ✓ this profile's ladder grades ${badgeFloor.rung} with its plants and NOTHING without them (grader only — no lane run)`,
+);
+
 // ── Refuse to start on a dirty tree ─────────────────────────────────────────
 // Everything this may write, named up front. A file with uncommitted changes is
 // a file whose bytes we would be gambling with if the process died mid-plant.
@@ -245,7 +381,7 @@ for (const p of plants) {
   if (p.target.flow) touched.add(p.target.flow);
   if (p.target.file) touched.add(p.target.file);
   if (p.target.declaration) touched.add(p.target.declaration);
-  if (p.target.testDir) touched.add(`${p.target.testDir}/${PLANTED_TEST_BASENAME}`);
+  if (p.target.testDir) touched.add(PLANTED_TEST_REL(p.target.testDir));
 }
 
 {
@@ -289,7 +425,7 @@ function plantFiles(plant) {
   if (plant.target.flows) rels.push(...plant.target.flows);
   if (plant.target.file) rels.push(plant.target.file);
   if (plant.target.declaration) rels.push(plant.target.declaration);
-  if (plant.target.testDir) rels.push(`${plant.target.testDir}/${PLANTED_TEST_BASENAME}`);
+  if (plant.target.testDir) rels.push(PLANTED_TEST_REL(plant.target.testDir));
   if (plant.target.nestInto) {
     for (const rel of plant.target.flows ?? []) rels.push(`${plant.target.nestInto}/${path.basename(rel)}`);
   }
@@ -300,9 +436,31 @@ function read(rel) {
   return fs.readFileSync(abs(rel), "utf8");
 }
 
-/** Every `# SPEC:` citation line neutralised — the flow stays valid YAML. */
-function stripCitations(text) {
-  return text.replace(/^#\s*SPEC:.*$/gm, "# (citation removed by the framework check)");
+/**
+ * Every citation line REMOVED — in whatever comment syntax this stack writes.
+ *
+ * This replaced a line that neutralised `^#\s*SPEC:` and wrote a `#` comment in
+ * its place, which is one stack's syntax twice over. It was survivable only
+ * while the plant selector was ALSO keyed to `#`: a `//`-citing project had
+ * both flow plants skipped, silently, and the two failures cancelled. Now that
+ * the selector reads the profile's declared marker, this one would be reached
+ * with a marker it cannot match — the citation would stay, the plant would not
+ * bite, and the instrument would report a framework defect that is its own.
+ *
+ * Removing the whole line rather than rewriting it is what makes this
+ * language-free: deleting a comment is safe in YAML, in every C-family flow, in
+ * Python and in Lua, whereas writing a replacement comment requires knowing the
+ * syntax. The marker is matched on the TRIMMED line, agreeing with
+ * `scanCitations` and with the selector about indented citations.
+ */
+function stripCitations(text, marker = SPEC_MODEL?.grammar?.citationMarker ?? /\bSPEC:/) {
+  // A profile could declare its marker with /g, which makes `.test()` stateful
+  // across calls. Rebuild without flags rather than trust the declaration.
+  const probe = new RegExp(marker.source);
+  return text
+    .split("\n")
+    .filter((line) => !probe.test(line.trim()))
+    .join("\n");
 }
 
 function applyPlant(plant) {
@@ -320,10 +478,7 @@ function applyPlant(plant) {
       // the clause exists, the tag exists, and nothing runs.
       const text = read(target.spec);
       write(target.spec, `${text.trimEnd()}\n- **${target.clause}** — Given a planted clause, Then a class-level tag must not count.\n`);
-      write(
-        `${target.testDir}/${PLANTED_TEST_BASENAME}`,
-        `// Planted by qa/framework-check.mjs — reverted automatically.\n\n// SPEC: ${target.clause}\nclass CmpFrameworkCheckPlanted {\n  val a = 1\n  val b = 2\n  val c = 3\n  val d = 4\n  val e = 5\n  val f = 6\n  fun helper() {}\n}\n`,
-      );
+      write(PLANTED_TEST_REL(target.testDir), PROFILE_PLANTS.unboundCitationSource(target.clause));
       break;
     }
     case PLANT_KINDS.TIER_UNMET: {
@@ -331,12 +486,9 @@ function applyPlant(plant) {
       const text = read(target.spec);
       write(
         target.spec,
-        `${text.trimEnd()}\n- **${target.clause}** [tier: e2e] — Given a planted device-only clause, Then a JVM citation cannot satisfy it.\n`,
-      );
-      write(
-        `${target.testDir}/${PLANTED_TEST_BASENAME}`,
-        `// Planted by qa/framework-check.mjs — reverted automatically.\n\nimport kotlin.test.Test\n\nclass CmpFrameworkCheckPlanted {\n  // SPEC: ${target.clause}\n  @Test\n  fun planted() {}\n}\n`,
+        `${text.trimEnd()}\n- **${target.clause}** [tier: ${target.unmeetableTier}] — Given a planted clause only the target can observe, Then a host-tier citation cannot satisfy it.\n`,
       );
+      write(PLANTED_TEST_REL(target.testDir), PROFILE_PLANTS.tierUnmetCitationSource(target.clause));
       break;
     }
     case PLANT_KINDS.FEATURE_WITHOUT_FLOW: {
@@ -429,8 +581,15 @@ try {
       }
     }
 
+    // NAME THE ROW THAT ACTUALLY WENT RED, not the one the plant asked for.
+    // For a plant whose step this pack did not declare those are different
+    // strings — the plant asked for nothing — and "undefined FAIL naming
+    // CART-01" is a line that makes a working run look broken. It is also the
+    // more useful line in every case: on a pack the reader does not know, this
+    // is where they learn which of their own gates is calibrated.
     const named = plant.names.length ? ` naming ${plant.names.join(", ")}` : "";
-    out(`  FAIL: ${plant.label.padEnd(28)} ${String(run.ms).padStart(5)}ms   ✓ ${plant.step} FAIL${named}`);
+    const observed = plantRow(run.receipt.steps, plant)?.name ?? plant.step ?? "the lane";
+    out(`  FAIL: ${plant.label.padEnd(28)} ${String(run.ms).padStart(5)}ms   ✓ ${observed} FAIL${named}`);
     revertPlant(plant);
   }
 
@@ -439,9 +598,21 @@ try {
     const first = plants[0];
     applyPlant(first);
     const r = runSmoke();
-    revertPlant(first);
     if (!r.receipt || r.receipt.verdict !== "FAIL") die("could not produce a FAIL receipt for the hook check");
+    // ASK THE HOOK BEFORE REVERTING. `revertPlant` restores RECEIPT_REL from
+    // what was on disk when this run started, so reverting first meant the hook
+    // was never shown the FAIL receipt the lane had just written. On a tree with
+    // no prior receipt the revert DELETED it and the hook refused because there
+    // was no receipt at all — green, for a reason that has nothing to do with
+    // this assertion. On a tree where the lane had already run, the revert put
+    // the earlier PASS back and the check failed on a working lane. Neither
+    // outcome tested "the Stop hook refuses a FAIL receipt". A check that cannot
+    // fail for its own reason is the exact defect this instrument exists to
+    // catch, which is why it is worth the four lines to say so. Found by the
+    // first non-Compose adoption, 2026-09-04. (`die` is safe here: every touched
+    // file is restored in the outer finally, plant reverted or not.)
     if (!hookRefuses().refused) die("the Stop hook did not refuse a FAIL receipt");
+    revertPlant(first);
     out(`  Stop hook            refuses a FAIL receipt ✓`);
   }
 
@@ -449,7 +620,19 @@ try {
   //    synthetic row over this tree's own valid hash, so only the skip is new.
   {
     const green = runSmoke();
-    if (!green.receipt || green.receipt.verdict !== "PASS") die("could not produce a PASS receipt for the device-tier hook check");
+    if (!green.receipt || green.receipt.verdict !== "PASS") {
+      // NAME THE STEPS. "could not produce a PASS receipt" told a reader that
+      // something was wrong and nothing about what, in the one place where the
+      // instrument has the whole receipt in hand. Evidence-or-silence applies to
+      // the instrument's own refusals too.
+      const bad = (green.receipt?.steps ?? [])
+        .filter((s) => s.verdict === "FAIL" || s.verdict === "ERROR")
+        .map((s) => `${s.name}: ${s.reason ?? s.verdict}`);
+      die(
+        `could not produce a PASS receipt for the device-tier hook check` +
+          (bad.length ? ` — ${bad.join("; ")}` : green.receipt ? ` (verdict ${green.receipt.verdict}, no failing step)` : " (no receipt at all)"),
+      );
+    }
     const planted = {
       ...green.receipt,
       profile: "local",
@@ -461,10 +644,57 @@ try {
     };
     write(RECEIPT_REL, JSON.stringify(planted, null, 2));
     const hook = hookRefuses();
-    if (!hook.refused || !/device tier did not run/.test(hook.stderr)) {
-      die(`the Stop hook did not refuse a receipt whose device tier was skipped for an environmental reason:\n${hook.stderr.slice(-400)}`);
+    // Stage 0 PR 6c: the refusal is stack-free — ANY step that skipped for an
+    // environmental reason blocks done, whatever it is called.
+    if (!hook.refused || !/a tier did not run/.test(hook.stderr)) {
+      die(`the Stop hook did not refuse a receipt whose tier was skipped for an environmental reason:\n${hook.stderr.slice(-400)}`);
+    }
+    out(`  Stop hook            refuses a skipped tier ✓`);
+  }
+
+  // 4b. THE VACUITY FLOOR (ADR-0010) — the one plant that cannot be made in
+  // this tree.
+  //
+  // Its violation is the ABSENCE of the engine, so planting it here would
+  // delete the files this instrument is running from: the lane would fail to
+  // START rather than fail by name, and a plant that proves the tree is broken
+  // proves nothing about the gate. So the region is built in a scratch
+  // directory, locked, and the refusal is watched there.
+  //
+  // The exception is granted for one reason and holds only while that reason
+  // does: this is the only gate whose violation removes the instrument that
+  // would observe it. A future gate wanting an out-of-tree plant must show the
+  // same property, not cite this one.
+  {
+    const started = Date.now();
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "vacuity-floor-"));
+    try {
+      fs.mkdirSync(path.join(scratch, "qa"), { recursive: true });
+      // A region of declarations and nothing else — ADR-0008's probe, exactly.
+      fs.writeFileSync(path.join(scratch, "qa", "verified-surface.json"), '{"surface":["src"]}\n');
+      fs.writeFileSync(path.join(scratch, "qa", "harness-manifest.json"), '{"schema":"harness-manifest/1"}\n');
+      writeHarnessLock(scratch, { version: "0.0.0-plant" });
+      const seen = checkHarnessIntegrity(scratch);
+      if (!seen.vacuous || seen.engineFiles !== 0) {
+        die(`the vacuity floor did not see an engine-free region: engineFiles=${seen.engineFiles}, vacuous=${seen.vacuous}`);
+      }
+      if (seen.status !== "intact") {
+        die(`the plant is only meaningful while the region reads intact — it read "${seen.status}", so the floor is being proved against the wrong state`);
+      }
+      // FAILING BY NAME is the requirement (§8.8), and the name has to reach a
+      // human. `describeIntegrity` is the shared voice every caller renders, so
+      // the plant watches THAT refuse — a flag nobody prints would be a gate
+      // nobody sees.
+      const said = describeIntegrity(seen);
+      if (!/not a lane/.test(said) || /files verified/.test(said)) {
+        die(`the vacuity floor is invisible to every caller that renders an integrity result: describeIntegrity said "${said}"`);
+      }
+      const ms = Date.now() - started;
+      cycles.push({ label: "vacuity floor", ms });
+      out(`  FAIL: region holds no engine     ${String(ms).padStart(5)}ms   ✓ intact but vacuous, and it SAYS so — ${seen.fileCount} file(s), 0 engine`);
+    } finally {
+      fs.rmSync(scratch, { recursive: true, force: true });
     }
-    out(`  Stop hook            refuses a skipped device tier ✓`);
   }
 
   // 5. Everything reverted, and it passes again — the plants were the only cause.
@@ -492,6 +722,10 @@ if (asJson) {
         verdict: "PASS",
         plants: plants.map((p) => ({ kind: p.kind, label: p.label, step: p.step })),
         unavailable,
+        // Reported beside the tree plants, never counted as one: it plants into
+        // the GRADER rather than into the tree, and a reader comparing plant
+        // counts across runs must not see this one move the number.
+        badgeFloor,
         cycles,
         totalMs: cost.totalMs,
         budgetMs: BUDGET_MS,

package/packages/harness/src/lib/a11y.mjs

@@ -21,7 +21,7 @@
 // Trees produced before the role/clickable/disabled contract extension are handled
 // gracefully: nodes without `clickable` are simply skipped, never crashed on.
 
-import { walk } from "./tree.mjs";
+import { walk } from "./profiles/cmp/tree.mjs";
 
 /**
  * Audit a tree for accessibility faults.

package/packages/harness/src/lib/affected-tests.mjs

@@ -14,11 +14,18 @@
 //     and the caller reports which case it was in the step's output and the
 //     receipt, so a filtered run can never be mistaken for the full suite.
 //   - The BLAST-RADIUS ESCAPE HATCH is mandatory: some paths fan out too
-//     widely to subset safely (build files rewire compilation, DI rewires
-//     object graphs, theme/tokens and shared components render into every
-//     screen, qa/ is the harness judging itself, and anything outside
-//     composeApp/src is by definition not a scoped source edit). Any one such
-//     change disables filtering for the run.
+//     widely to subset safely. qa/ is the harness judging itself — that one is
+//     the core's, on every stack. WHICH OTHER paths fan out, and how a changed
+//     source maps to a test filter, are facts about one build tool and one
+//     source layout, so they come from the PROFILE (Stage 0 PR 6d;
+//     profiles/cmp/affected.mjs). Any one broad-impact change disables
+//     filtering for the run.
+//
+// A profile that supplies no mapping gets `mode: "all"` with that as the
+// reason — fail open, said out loud. Vendored into a repo whose sources are
+// not under composeApp/src, the old hardcoded rules did something worse than
+// nothing: every path failed the layout test, so every fast run fell open to
+// the full suite with the optimisation silently off.
 //
 // Pure functions over path lists — git access is injected/separate so the
 // engine suite can test every branch with no repo state.
@@ -43,50 +50,37 @@ import path from "node:path";
 // first fell open to the full suite, visible only in one parenthetical.
 // Found by payment-blueprint's spine adoption (2026-09-03), where the same
 // line also landed in their locked region.
-export const LANE_OUTPUT_PREFIXES = ["qa/evidence", "qa-artifacts", "qa/flight-recorder.jsonl"];
+// qa/.lane-in-progress is the lane's own marker (qa/lib/lane-markers.mjs) —
+// present, untracked, for exactly the duration of the run that would read it.
+export const LANE_OUTPUT_PREFIXES = ["qa/evidence", "qa-artifacts", "qa/flight-recorder.jsonl", "qa/.lane-in-progress"];
 
 function isLaneOutput(p) {
   return LANE_OUTPUT_PREFIXES.some((prefix) => p === prefix || p.startsWith(`${prefix}/`));
 }
 
 /**
- * The mandatory blast-radius escape hatch: paths whose change fans out too
- * widely to subset the suite safely. Returns the human-readable category when
- * `p` is broad-impact, else null. Checked in order; the first match names the
- * reason.
+ * The core's own blast-radius rule, on every stack: a change under qa/ is the
+ * harness judging itself, so nothing may be subsetted by it.
  * @param {string} p POSIX relpath from the project root
  * @returns {string|null}
  */
-export function broadImpactReason(p) {
-  if (p.endsWith(".gradle.kts") || p === "gradle.properties" || p === "gradle/libs.versions.toml") {
-    return "build files rewire compilation";
-  }
-  if (/(^|\/)di\//.test(p)) return "DI rewires the object graph";
-  if (/(^|\/)theme\//.test(p)) return "theme/tokens render into every screen";
-  if (p.includes("presentation/components/")) return "shared components render into every screen";
+export function coreBroadImpactReason(p) {
   if (p === "qa" || p.startsWith("qa/")) return "qa/ is the harness itself";
-  if (!p.startsWith("composeApp/src/")) return "outside composeApp/src";
   return null;
 }
 
 /**
  * Derive the fast-mode unit-test filter from a list of changed paths.
  *
- * Mapping (deliberately simple and defensible): each changed `.kt` file under
- * composeApp/src contributes its package's last segment — the parent
- * directory name (`…/presentation/home/HomeViewModel.kt` → `home`, which the
- * template's package-mirrors-path conformance makes a package segment) — and
- * the union becomes Gradle `--tests "*<seg>*"` patterns matched against test
- * class FQNs. Coarse on purpose: `*home*` runs every test whose FQN mentions
- * the feature, which over-selects a little and under-maintains nothing.
- *
  * @param {string[]} changedPaths relpaths (either separator style) — tracked
  *   diffs plus untracked files, as from changedWorkingTreePaths()
+ * @param {{broadImpact: (p: string) => (string|null), patternsFor: (paths: string[]) => {patterns: string[], sourcePaths: string[]}}} [mapping]
+ *   the profile's rules (profiles/<id>/affected.mjs). Absent = no subsetting.
  * @returns {{mode: "filtered", patterns: string[], sourcePaths: string[]} |
  *   {mode: "all", reason: string, patterns: [], sourcePaths: string[]}}
  *   mode "all" ALWAYS carries the honest reason to report.
  */
-export function deriveAffectedFilter(changedPaths) {
+export function deriveAffectedFilter(changedPaths, mapping = null) {
   const paths = [...new Set((changedPaths ?? [])
     .filter((p) => typeof p === "string" && p.length > 0)
     .map((p) => p.split(path.sep).join("/")))]
@@ -97,32 +91,93 @@ export function deriveAffectedFilter(changedPaths) {
     return { mode: "all", reason: "no working-tree changes to scope by", patterns: [], sourcePaths: [] };
   }
 
+  // No mapping, no subsetting — and the reason says which half is missing, so
+  // a profile author sees the optimisation is off rather than wondering why
+  // the fast lane costs what the full one does.
+  if (!mapping || typeof mapping.broadImpact !== "function" || typeof mapping.patternsFor !== "function") {
+    return { mode: "all", reason: "this profile declares no affected-test mapping — every fast run tests everything", patterns: [], sourcePaths: paths };
+  }
+
   for (const p of paths) {
-    const broad = broadImpactReason(p);
+    const broad = coreBroadImpactReason(p) ?? mapping.broadImpact(p);
     if (broad) {
       return { mode: "all", reason: `broad-impact change — ${broad} (${p})`, patterns: [], sourcePaths: paths };
     }
   }
 
-  // Every remaining path is a scoped file under composeApp/src. Only .kt
-  // files map to test patterns; a change that maps to nothing (resources,
-  // manifests) falls open to the full suite below.
-  const ktPaths = paths.filter((p) => p.endsWith(".kt"));
-  const segments = new Set();
-  for (const p of ktPaths) {
-    const seg = path.posix.basename(path.posix.dirname(p));
-    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(seg)) segments.add(seg);
-  }
-
-  if (segments.size === 0) {
+  // Every remaining path is a scoped source edit by the profile's own reckoning.
+  // A change that maps to no pattern (resources, manifests) falls open below.
+  const { patterns, sourcePaths } = mapping.patternsFor(paths);
+  if (!Array.isArray(patterns) || patterns.length === 0) {
     return { mode: "all", reason: "changed files map to no test filter", patterns: [], sourcePaths: paths };
   }
 
-  return {
-    mode: "filtered",
-    patterns: [...segments].sort().map((s) => `*${s}*`),
-    sourcePaths: ktPaths,
-  };
+  return { mode: "filtered", patterns, sourcePaths: Array.isArray(sourcePaths) ? sourcePaths : paths };
+}
+
+/**
+ * Must the expensive tier run for this change?
+ *
+ * The most costly thing an agent does is run a device or journey tier — minutes
+ * of emulator, build and flow — to prove something about a change that tier
+ * cannot see. Running it anyway is not rigour, it is latency, and latency is
+ * how an agent ends up CLAIMING instead of deriving (G1, G2).
+ *
+ * THE DECLARATION IS OF IRRELEVANCE, NOT OF RELEVANCE, and getting that
+ * backwards turns this into the defect it prevents. The first version of this
+ * function asked "is any changed path under a root that FEEDS the tier?" and
+ * answered "not required" when none matched — an allowlist, so anything nobody
+ * thought to list was silently deferred. `cmp` declares
+ * `sourceRoots: ["composeApp/src"]`, which excludes `build.gradle.kts` and
+ * `gradle/libs.versions.toml` — both of which absolutely change what runs on a
+ * device. A dependency bump would have skipped the device tier and said so
+ * confidently (ADR-0009, "what would make this wrong").
+ *
+ * So: the tier RUNS unless every changed path is under something explicitly
+ * declared unable to affect it. A path nobody classified obliges the tier,
+ * which is the safe direction — being wrong toward running costs minutes, being
+ * wrong toward deferring costs a regression nobody saw.
+ *
+ * This does not skip anything; it answers a question and always carries the
+ * reason, so a caller can record it and a reader can disagree with it. An
+ * unrecorded skip is a lie; a recorded one is evidence.
+ *
+ * @param {string[]|null} changedPaths relpaths, or null when git could not say
+ * @param {{irrelevantRoots?: string[], tierName?: string}} [decl] paths declared
+ *   unable to affect the tier: a `dir/` prefix, or a `*.ext` suffix
+ * @returns {{required: boolean, reason: string, obliging: string[]}}
+ */
+export function deriveTierNeed(changedPaths, { irrelevantRoots = [], tierName = "the device tier" } = {}) {
+  if (!Array.isArray(changedPaths)) {
+    return { required: true, reason: `cannot tell what changed — ${tierName} runs`, obliging: [] };
+  }
+  const paths = changedPaths
+    .filter((p) => typeof p === "string" && p.length > 0)
+    .map((p) => p.split(path.sep).join("/"))
+    .filter((p) => !isLaneOutput(p));
+  if (paths.length === 0) {
+    return { required: true, reason: `no change to reason about — ${tierName} runs`, obliging: [] };
+  }
+  // The harness judging itself is always broad impact — the same rule the
+  // fast-lane filter uses, so the two cannot disagree about the same edit.
+  const core = paths.find((p) => coreBroadImpactReason(p));
+  if (core) {
+    return { required: true, reason: `broad-impact change — ${coreBroadImpactReason(core)} (${core})`, obliging: [core] };
+  }
+  const declared = (irrelevantRoots ?? []).filter((r) => typeof r === "string" && r.length > 0);
+  if (declared.length === 0) {
+    return { required: true, reason: `nothing is declared unable to affect ${tierName} — it runs`, obliging: paths };
+  }
+  const isIrrelevant = (p) =>
+    declared.some((r) => (r.startsWith("*.") ? p.endsWith(r.slice(1)) : p === r.replace(/\/$/, "") || p.startsWith(r.endsWith("/") ? r : `${r}/`)));
+  const obliging = paths.filter((p) => !isIrrelevant(p));
+  return obliging.length > 0
+    ? {
+        required: true,
+        reason: `${obliging.length} changed path(s) are not declared irrelevant to ${tierName}: ${obliging.slice(0, 3).join(", ")}${obliging.length > 3 ? ", …" : ""}`,
+        obliging,
+      }
+    : { required: false, reason: `every changed path is declared unable to affect ${tierName} (${declared.join(", ")})`, obliging: [] };
 }
 
 function defaultRunGit(args, root) {