Fix Architecture Violations reporting the inverse of reality

[abk1969]

Summary

CodeFlow's "Architecture Violations" detector (Parser.detectLayerViolations) reported the exact inverse of reality: healthy downward dependencies (a service using a foundational util) were flagged as violations, while genuine upward violations (a util reaching into a service) were silently missed. On a real project this surfaced as a wall of false "utils should not import from services" entries — one per caller of each shared module.

Root cause

The connection graph uses a documented convention (index.html, the Connection format comment): {source: fileDefiningFn, target: fileCallingFn} — source is the file that defines the called function (depended-upon), target is the file that calls it (the importer). detectLayerViolations read this backwards, treating source as the importer. Verified against the real analyzer in both directions: a healthy service → util dependency produced a false positive, and a genuine util → service violation produced nothing.

What changed

• Direction fix (primary): detectLayerViolations now treats target as the importer, matching the documented convention. Healthy downward deps no longer flag; genuine upward violations are correctly reported with accurate from/to attribution.
• Test-file exclusion (companion): the direction fix, combined with correct test-folder classification (below), would newly flag test files — which legitimately depend on every layer — as violators. Test files are excluded from the importer side using isArchitectureTestFile(path) || importerLayer === 'test'. Both classifiers are needed: isArchitectureTestFile covers *.test/*.spec files outside a tests/ dir; the test layer covers Python test_*.py, conftest.py, and test*-prefixed folders.
• detectLayer leading-slash tolerance (secondary): every folder pattern required a leading slash, so root-level layer folders (services/, ui/, lib/) never matched and fell through to utils. Normalized by prepending / to the path. No new folder vocabulary added.
• Coupling label correction (tertiary): the "Highly Coupled" issue was described "Files imported by 8+ others" (fan-in), but the metric counts fan-out (files a file imports). Corrected the description only — no behavioral change.

Each fix is backed by a test in the new tests/layer-violation-direction.test.mjs (VM-harness pattern matching tests/codeflow-golden.test.mjs).

Design doc: docs/superpowers/specs/2026-07-12-layer-violation-direction-design.md
Plan: docs/superpowers/plans/2026-07-12-layer-violation-direction.md

Known limitations (out of scope)

• No change to how the conns graph is built or to the {source, target} convention — other consumers (graph rendering, circular detection) rely on it; only the misreading consumer was fixed.
• detectLayer folder vocabulary is unchanged beyond leading-slash tolerance (e.g. next.config.mjs with a dot, or a bare db/ folder, still fall through to utils).
• Config (level 5) and VBA modules (level 5) importers reaching into a much higher layer remain flagged — niche, plausibly real smells, left as-is rather than expanding the exclusion speculatively.
• The coupling metric blends function-call edges (fan-out) and markdown-link edges (fan-in); the corrected label describes the dominant function-call case.

Test plan

• node --test from repo root — 42/42 pass (all pre-existing tests unchanged + 6 new in tests/layer-violation-direction.test.mjs)
• tests/codeflow-golden.test.mjs and tests/architecture-diagram.test.mjs stay green, unmodified (the repo has no root-level layer folders, so the detectLayer change can't shift its own self-scan)
• Verified in a clean git worktree (not just the working directory) to rule out local-state false positives, including the direction fix in both directions and the Python/test-folder exclusion

[vercel]

@abk1969 is attempting to deploy a commit to the braedonsaunders' projects Team on Vercel.

A member of the Team first needs to authorize it.

[braedonsaunders]

Reviewed the graph convention and the implementation, including the root-level layer normalization and test-importer guard. The full branch suite passes locally (42/42). The only failing status is Vercel contributor authorization, not a code/test failure. Approved for merge.