v0.21.0

The console follows the project's layout, and four spine defects the first non-Compose
adopter found are closed. No migration: every change is additive or a bug fix, and a Compose
app with no manifest behaves exactly as before.

Fixed

• --fast fell open to the full suite after the first lane run — in every Compose app.
  qa/flight-recorder.jsonl is appended by every run and committed, so it sat in the
  changed set as a modified file under qa/, which is the "harness itself" escape hatch.
  It is now a lane output (affected-tests.mjs), pinned by a planted test. Derived on a
  fresh scaffold before the fix: the journal in the changed set, filter mode all.
• A smoke run rewrote the README's evidence badge from a true L1 to "rung unrecorded".
  Smoke and nightly receipts are refused as done-evidence and now leave the badge alone,
  like --fast.
• The evidence ladder was the Compose pack's step names inside the spine. Vendored into
  a backend it graded the strongest run L0, L1 unreachable by construction. The ladder is now
  the pack's (createCmpSteps returns evidenceLadder; evidenceLevel takes ladder); a
  pack that declares none earns no rung. Compose apps: unchanged rungs.
• The release gate itself failed on timing. The bundle-boot test slept 700 ms + 1800 ms and
  read whatever had arrived; under npm publish on a loaded machine the bundle answered late
  and prepublishOnly went red on a healthy bundle. It now waits for the response, bounded
  at 20 s — the bound is the assertion, never a fixed sleep.
• A new top-level directory was silently unattested by the surface allowlist. The
  receipt now carries inputs.undeclared and the lane prints it — a report, never a gate,
  because the Compose default deliberately omits docs/, the README and the wrapper.

Added

• Project manifest for the console — qa/harness-manifest.json declares where a project
  keeps its receipt, architecture document, spec directory and citation roots (and which step
  packs it composes). The console read one layout — a create-cmp Compose app's — as constants,
  so the first spine adopter with its own (payment-blueprint: qa/evidence/receipt.json,
  ARCHITECTURE.md at the root, Kotlin under services/) got an Evidence pane, verdict history,
  audit trail, digest and Architecture page that said "not found" about files that existed. The
  layout is now resolved per project exactly like the verified surface: Compose default, manifest
  override, and a present-but-malformed manifest is refused with every problem named rather than
  silently defaulted. --status reports the layout in use; the rail names the manifest.
• Layer-tagged receipt rows — a step pack may tag a step function with the layer it proves
  (fn.layer = "backend"); the runner stamps it onto the receipt row and the Evidence page
  groups steps per layer with a per-layer tally. Backward compatible: untagged rows and receipts
  render exactly as before. The Compose pack tags spine / compose / device.
• Specs page bridges to the project's own scanner — when qa/lib/spec-coverage.mjs exports
  scanSpecClauses/scanCitations, the console renders their reading (the project's clause
  grammar and citation-binding rule), the same "bridge, never fork" stance it takes for
  approvals.mjs. The console's own scan remains the fallback.
• The receipt bridge reads a flat receipt schema (inputsHash/gitSha/timestamp) alongside
  the nested cmp-evidence/1 one.

Changed

• Approvals-bridge refusals for a library without reopenArtifact/acceptFeature no longer
  assume an "older scaffold": a step pack that does not govern reopen or briefs is the other,
  named, possibility.