From 3b0aa873230f7fde36538ffd84717449e847ddd0 Mon Sep 17 00:00:00 2001
From: Remon Panman <228601219+Tradebaas@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:17:59 +0200
Subject: [PATCH 1/2] feat(checks): a waiver is a number the owner sees, not a
 quiet pass

The gate that reads the floor table treats an answered class and a waived one the same way, which
is correct: a waiver is a stated, reasoned choice, and refusing to build over one would push
projects to lie in the table rather than use the form honestly. That is also what makes waiving
the cheap default, because until now nothing counted them anywhere the owner looks.

The floor is now derived once, in the file that already parses the contract, and reported in two
places from that one derivation: the enforcement line under checks/check.mjs, and its own line on
the board directly under the gates. Neither renders the table itself, so a waiver cannot show up
in one and not the other. The suite proves that by comparing the two outputs rather than asserting
each, the way the printed board was proved against the served one.

The wording carries its own limit, in the summary rather than behind the fold. Proven means a
workflow runs the command the stack file names, and nothing in this framework has looked at what
that command asserts. A folded board still has to say so, or the number alone reads as an audit
nobody performed.

A class whose command no workflow runs is counted as open, never as a waiver. The gate already
refuses both, and counting a dead command as a stated choice would launder a hole into a decision -
the one thing this line exists to prevent.

A project with no stack file reports nothing at all. Not started is not a floor of zero: it has not
been asked the six questions yet. The drill asserts both halves in a fresh copy, reading the floor
before the clearing takes the stack file away and finding nothing after it.

The gate and the report now share one read of the contract, because two parses of one table is
exactly the drift this story exists to prevent. Splitting that read also fixed a live defect it
introduced on the way: the design detector's half of the gate needs the workflow lines whether or
not a stack file exists, and briefly stopped getting them. The stack suite caught it.

Seven comments across four files still described a board of two lines under the shelves. This diff
makes that false, so they say the lines instead.

Groundwork reads 4 of 6 on its own floor, with builds and dependencies waived and their reasons
quoted from node.md.

Traces-to: SC-5
---
 checks/board-page.mjs       |   9 +--
 checks/board-shell.mjs      |   2 +-
 checks/board-strip.mjs      |  90 +++++++++++++++++++++++++----
 checks/board-strip.test.mjs | 103 +++++++++++++++++++++++++++++++--
 checks/board.test.mjs       |   4 +-
 checks/check-stack.mjs      |  75 ++++++++++++++++++++----
 checks/check.mjs            |   5 +-
 checks/check.test.mjs       | 110 +++++++++++++++++++++++++++++++++++-
 checks/drill.mjs            |  19 +++++++
 checks/enforcement.mjs      |  43 ++++++++++++++
 10 files changed, 426 insertions(+), 34 deletions(-)

diff --git a/checks/board-page.mjs b/checks/board-page.mjs
index d769690..22d6a19 100644
--- a/checks/board-page.mjs
+++ b/checks/board-page.mjs
@@ -1,12 +1,13 @@
 // The board: the whole project on one page. What it is for and what it is not, the round in
 // flight, six lanes with the cards in them, the four shelves that hold every document, and the
-// two lines that say whether the gates are armed and how the documents point at each other.
+// lines that say whether the gates are armed, how much of this project's own code they look at,
+// and how the documents point at each other.
 // Facts in, one page out - nothing is stored, nothing is generated ahead of time. Every lane,
 // count, blocker and next step comes from checks/work.mjs through the derivation
 // checks/progress.mjs already exposes, so moving one story's status line moves its card and no
 // second administration exists to keep in step (decision 0021).
-// The shelves are checks/shelves.mjs, the two lines checks/board-strip.mjs, the shell they render
-// in checks/board-shell.mjs; serving is checks/board-server.mjs and the file page
+// The shelves are checks/shelves.mjs, the lines under them checks/board-strip.mjs, the shell
+// they render in checks/board-shell.mjs; serving is checks/board-server.mjs and the file page
 // checks/board-document.mjs.
 // One derivation, two outputs (decision 0021): served on this machine, or printed as one
 // self-contained file (`--page`, E-01/F-04/S-05). The file is the picture of the repository at
@@ -118,7 +119,7 @@ const BOARD_WORDS = {
 
 // One object per language, so a caller asks once and gets the shell's sentences, the stand's
 // sentences, the shelves' and the board's own. Each set owns its own keys, and the merge is the
-// only place they meet. The two lines under the shelves gather their own, next door.
+// only place they meet. The lines under the shelves gather their own, next door.
 const boardWords = (lang) => ({
   ...shellWords(lang),
   ...(WORDS[lang] || WORDS.en),
diff --git a/checks/board-shell.mjs b/checks/board-shell.mjs
index 4196a7c..758e060 100644
--- a/checks/board-shell.mjs
+++ b/checks/board-shell.mjs
@@ -1,5 +1,5 @@
 // The page shell every page this board serves is built in: the look, and the safe ways project
-// text gets into it. The cards, the lanes, the sidebar, the two lines under them, a file page and
+// text gets into it. The cards, the lanes, the sidebar, the lines under them, a file page and
 // a notice all render through here, so the project has one design and one escaping rule rather
 // than six of each.
 // Split out of checks/board-document.mjs when the lanes arrived (E-01/F-04/S-03): a second page
diff --git a/checks/board-strip.mjs b/checks/board-strip.mjs
index 0e83773..901330c 100644
--- a/checks/board-strip.mjs
+++ b/checks/board-strip.mjs
@@ -1,20 +1,25 @@
-// The two lines under the shelves: how many gates are armed on this machine, and how the
-// project's documents point at each other. Each says its answer in one sentence and folds the
-// detail the reader behind it produces, so the board ends with two facts rather than two pages.
-// Both sentences are the readers' own (checks/enforcement.mjs, checks/links.mjs), quoted rather
-// than reworded: the terminal and the board must never word one fact differently.
+// The lines under the shelves: how many gates are armed on this machine, how much of this
+// project's own code any of them actually looks at, and how the project's documents point at
+// each other. Each says its answer in one sentence and folds the detail the reader behind it
+// produces, so the board ends with a handful of facts rather than a handful of pages.
+// Every sentence is a reader's own (checks/enforcement.mjs, checks/check-stack.mjs,
+// checks/links.mjs), quoted rather than reworded: the terminal and the board must never word one
+// fact differently. The floor line reads the same derivation the enforcement line prints, so a
+// waiver cannot show up in one place and not the other (E-02/F-01/S-03).
 // Moved here when the four shelves took the board and /overview was retired
 // (E-01/F-04/S-04); until then these were two of the six cards in checks/board-document.mjs.
 
 import { enforcementReport } from './enforcement.mjs';
+import { floorReport } from './check-stack.mjs';
 import { projectGraph, LINK_WORDS, HUB_MIN } from './links.mjs';
 import {
   shellWords, escapeHtml, sentence, pathName, list, folded, attempt,
 } from './board-shell.mjs';
 
-// Both lines report on the project as a whole rather than on one document, so the file each
+// Each line reports on the project as a whole rather than on one document, so the file each
 // names is the one that does the looking.
 const ENFORCEMENT_PATH = 'checks/enforcement.mjs';
+const FLOOR_PATH = 'checks/check-stack.mjs';
 const LINKS_PATH = 'checks/links.mjs';
 
 // The gates line's own framing. What is armed and what is not comes from the report.
@@ -49,16 +54,47 @@ const GATE_WORDS = {
   },
 };
 
-// The two reads this strip needs. Done before anything renders, so the page can ask git once
+// The floor line's own framing. The count comes from the derivation; the second sentence is the
+// limit, and it sits in the summary rather than behind the fold on purpose: a folded board still
+// has to say what "proven" does not buy, or the number alone reads as an audit nobody performed.
+// This line needs no served-or-printed split the way the gates line does: a floor is read off the
+// stack file and the workflows, both tracked, so it says the same thing wherever it is read.
+const FLOOR_WORDS = {
+  en: {
+    floorAnswer: (n, t) => `${n} of the ${t} risk classes are proven by a command that runs. `
+      + 'Proven means it runs, not that what it runs is any good.',
+    headWaived: 'Waived, on purpose and with a reason',
+    headOpen: 'Answered by nothing that runs',
+    waivedAs: (cls, form) => `${cls}, waived as ${form}`,
+    openWhy: 'A class here is either unanswered or answers with a command no workflow runs. The '
+      + 'gate refuses both; neither is a waiver.',
+    answeredIn: 'Answered in',
+  },
+  nl: {
+    floorAnswer: (n, t) => `${n} van de ${t} risicoklassen worden bewezen door een commando dat `
+      + 'draait. Bewezen betekent dat het draait, niet dat wat het draait deugt.',
+    headWaived: 'Vrijgesteld, bewust en met reden',
+    headOpen: 'Beantwoord door niets dat draait',
+    waivedAs: (cls, form) => `${cls}, vrijgesteld als ${form}`,
+    openWhy: 'Een klasse hier is niet beantwoord, of antwoordt met een commando dat geen enkele '
+      + 'workflow draait. De poort weigert allebei; geen van beide is een vrijstelling.',
+    answeredIn: 'Beantwoord in',
+  },
+};
+
+// The three reads this strip needs. Done before anything renders, so the page can ask git once
 // which of the names below it is allowed to open.
 export const readStrip = (root) => ({
   gates: attempt(() => enforcementReport(root)),
+  floor: attempt(() => floorReport(root)),
   graph: attempt(() => projectGraph(root)),
 });
 
-// Every file name these two lines will show, for that one ignore lookup.
+// Every file name these lines will show, for that one ignore lookup.
 export const stripPaths = (facts) => [
-  ENFORCEMENT_PATH, LINKS_PATH, ...(facts.graph.value?.documents || []).map((d) => d.path),
+  ENFORCEMENT_PATH, FLOOR_PATH, LINKS_PATH,
+  ...(facts.floor?.value?.files || []),
+  ...(facts.graph.value?.documents || []).map((d) => d.path),
 ];
 
 // ---------------------------------------------------------------- one line
@@ -95,6 +131,36 @@ function gatesDetail(signals, w) {
   return out.join('\n');
 }
 
+// What the six classes are answered with, for the reader who wants to know which hole they are
+// standing in. A whole floor produces nothing here, and the line stays a single sentence.
+function floorDetail(floor, w, opens) {
+  const out = [];
+  if (floor.waived.length) {
+    out.push(`<h3>${escapeHtml(w.headWaived)}</h3>`);
+    // The reason is the stack file author's own, never reworded here: it is the whole content of
+    // the waiver, and the board is quoting it rather than summarising it.
+    for (const x of floor.waived) out.push(`<p class="note">${sentence(`${w.waivedAs(x.cls, x.form)} - ${x.reason}`)}</p>`);
+  }
+  if (floor.open.length) {
+    out.push(`<h3>${escapeHtml(w.headOpen)}</h3>`);
+    out.push(list(floor.open));
+    out.push(`<p class="hint">${escapeHtml(w.openWhy)}</p>`);
+  }
+  if (!out.length) return '';
+  // Where the answers live, so the reader can go read the table rather than trust this summary.
+  out.push(`<p class="hint">${escapeHtml(w.answeredIn)} ${floor.files.map((f) => pathName(f, opens)).join(', ')}</p>`);
+  return out.join('\n');
+}
+
+// The floor line exists only once a stack does. A project that has not chosen one has not failed
+// to answer the six classes, it has not been asked yet, and a line reading "0 of the 6" would be
+// the board's own version of the false confidence this gate exists to remove.
+function floorLine(read, w, opens) {
+  if (!read || (!read.error && !read.value)) return '';
+  return line(w, read, (f) => w.floorAnswer(f.proven, f.total), (f) => floorDetail(f, w, opens),
+    FLOOR_PATH, opens);
+}
+
 // Which document points at which, so the question behind moving or deleting a file has an answer
 // before the move: what nothing points at can go, and what many documents lean on is a decision.
 function linksDetail(graph, w, opens) {
@@ -138,17 +204,21 @@ const linksAnswer = (graph, w) => (graph.documents.length
     + (graph.unresolved.length ? `${w.unresolved}: ${graph.unresolved.length}.` : w.noUnresolved)
   : w.noDocuments);
 
-// The two lines, in the project's own language. The word sets are gathered here rather than
+// The lines, in the project's own language. The word sets are gathered here rather than
 // handed in, so a caller cannot hand this file a set that words a gate differently than the
 // terminal does. `made` is the moment a printed board was made, and null on a served one: the
 // only thing that changes here is which of the two gate sentences is true.
 export function renderStrip(facts, lang, opens = () => false, made = null) {
   const w = { ...shellWords(lang), ...(GATE_WORDS[lang] || GATE_WORDS.en) };
+  const fw = { ...shellWords(lang), ...(FLOOR_WORDS[lang] || FLOOR_WORDS.en) };
   const lw = LINK_WORDS[lang] || LINK_WORDS.en;
   const armed = made ? w.armedThere : w.armedOf;
   return '<div class="strip">'
     + line(w, facts.gates, (s) => `${armed(s.filter((x) => x.armed).length, s.length)}.`,
       (s) => gatesDetail(s, w), ENFORCEMENT_PATH, opens)
+    // Directly under the gates, because it is the question the gates line invites: they are
+    // armed, and this is how much of this project's own code any of them looks at.
+    + floorLine(facts.floor, fw, opens)
     + line(w, facts.graph, (g) => linksAnswer(g, lw), (g) => linksDetail(g, lw, opens), LINKS_PATH, opens)
     + '</div>';
 }
diff --git a/checks/board-strip.test.mjs b/checks/board-strip.test.mjs
index 5c410dc..877d0f3 100644
--- a/checks/board-strip.test.mjs
+++ b/checks/board-strip.test.mjs
@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-// Self-test for the two lines under the shelves (checks/board-strip.mjs): how many gates are
-// armed on this machine, and how the documents point at each other. What is proven here is that
+// Self-test for the lines under the shelves (checks/board-strip.mjs): how many gates are armed
+// on this machine, how much of the project's own code any of them looks at, and how the
+// documents point at each other. What is proven here is that
 // each line leads with the answer in the reader's own words, keeps the whole working one click
 // behind it, and that a reader that fails costs the board one line rather than the page.
 // These were two of the six cards on the retired /overview page; the board they now sit on is
@@ -10,18 +11,23 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { visible } from './board-fixture.mjs';
 import { renderStrip } from './board-strip.mjs';
+import { formatFloor } from './enforcement.mjs';
 import { linkGraph } from './links.mjs';
 
-// The strip renders from two reads, each of which either produced a value or threw. A test hands
+// The strip renders from its reads, each of which either produced a value or threw. A test hands
 // them in directly, so no fixture on disk stands between an assertion and what it is about.
-const facts = (gates, graph) => ({
+// The floor read is left out entirely unless a test names one, which is also how a project that
+// has not chosen a stack reaches this function.
+const facts = (gates, graph, floor) => ({
   gates: gates instanceof Error ? { error: gates } : { value: gates },
   graph: graph instanceof Error ? { error: graph } : { value: graph },
+  ...(floor === undefined ? {} : { floor: floor instanceof Error ? { error: floor } : { value: floor } }),
 });
 const NO_GRAPH = linkGraph([]);
 const ARMED = [{ signal: 'hooks', armed: true, detail: 'core.hooksPath -> checks/hooks' }];
 
 const strip = (gates, graph, opens = () => false) => renderStrip(facts(gates, graph), 'en', opens);
+const stripF = (floor, gates = ARMED, graph = NO_GRAPH) => renderStrip(facts(gates, graph, floor), 'en');
 // One line off the strip, so an assertion is about the line it names and not about its neighbour.
 const lineOf = (html, n) => html.split('<section class="line">')[n].split('</section>')[0];
 
@@ -51,6 +57,95 @@ test('a machine with nothing armed says so, rather than saying nothing', () => {
   assert.doesNotMatch(text, /\bArmed the\b/);
 });
 
+// ---------------------------------------------------------------- the floor line
+
+// One floor, as the derivation in checks/check-stack.mjs hands it over: four classes answered by
+// a command a workflow runs, two waived on purpose, none left open.
+const FLOOR = {
+  total: 6,
+  proven: 4,
+  waived: [
+    { cls: 'dependencies', form: 'not applicable', reason: 'No third-party code ships here', path: 'docs/standards/node.md' },
+    { cls: 'renders', form: 'manual', reason: 'A named walkthrough by the owner before each release', path: 'docs/standards/node.md' },
+  ],
+  open: [],
+  files: ['docs/standards/node.md'],
+};
+
+test('the floor line leads with the count and says in the summary what proven does not buy', () => {
+  const html = lineOf(stripF(FLOOR), 2);
+  // The limit is in the summary and not behind the fold: a folded board still has to say it, or
+  // the number alone reads as an audit that nobody performed.
+  assert.match(html, /<summary><span class="ttl">4 of the 6 risk classes are proven by a command that runs\. Proven means it runs, not that what it runs is any good\.<\/span>/);
+  const text = visible(html);
+  assert.match(text, /Waived, on purpose and with a reason/);
+  // The reason is the stack file author's own words, quoted rather than summarised.
+  assert.match(text, /dependencies, waived as not applicable - No third-party code ships here/);
+  assert.match(text, /renders, waived as manual - A named walkthrough by the owner/);
+  // And the reader is pointed at the table itself rather than asked to trust this line.
+  assert.match(text, /Answered in/);
+  assert.match(text, /docs\/standards\/node\.md/);
+  assert.match(html, /From <code>checks\/check-stack\.mjs<\/code>/);
+});
+
+test('a whole floor is one sentence, with no working to show', () => {
+  const html = lineOf(stripF({ ...FLOOR, proven: 6, waived: [] }), 2);
+  assert.match(html, /6 of the 6 risk classes/);
+  assert.doesNotMatch(html, /<details>/);
+});
+
+test('a class nothing runs is named as open, never dressed up as a waiver', () => {
+  const text = visible(lineOf(stripF({ ...FLOOR, proven: 3, open: ['behaves'] }), 2));
+  assert.match(text, /Answered by nothing that runs/);
+  assert.match(text, /behaves/);
+  assert.match(text, /neither is a waiver/);
+});
+
+// Not started is not the same as failing, which is the rule the empty copy follows everywhere.
+test('a project with no stack file gets no floor line, rather than a floor of zero', () => {
+  for (const nothing of [null, undefined]) {
+    const html = stripF(nothing);
+    assert.doesNotMatch(visible(html), /risk classes/);
+    // The rest of the strip is untouched by a line that is absent.
+    assert.match(visible(lineOf(html, 2)), /no documents to read yet/);
+  }
+});
+
+// The seam this story exists for: one derivation, two outputs. Proven by comparing the two
+// renderings rather than asserting each, so a waiver cannot show up in one and not the other.
+test('the board and the enforcement line carry one floor, not two readings of it', () => {
+  const board = visible(lineOf(stripF(FLOOR), 2));
+  const terminal = formatFloor(FLOOR).join('\n');
+  assert.match(terminal, /4 of the 6/);
+  assert.match(board, /4 of the 6/);
+  for (const w of FLOOR.waived) {
+    assert.ok(terminal.includes(w.cls) && terminal.includes(w.reason), `the terminal drops ${w.cls}`);
+    assert.ok(board.includes(w.cls) && board.includes(w.reason), `the board drops ${w.cls}`);
+  }
+  // Both state the limit rather than implying a guarantee, in their own wording.
+  assert.match(terminal, /not that what it runs is any good/);
+  assert.match(board, /not that what it runs is any good/);
+});
+
+test('the floor line speaks the language the project set', () => {
+  const text = visible(renderStrip(facts(ARMED, NO_GRAPH, FLOOR), 'nl'));
+  assert.match(text, /4 van de 6 risicoklassen/);
+  assert.match(text, /Bewezen betekent dat het draait/);
+  // The class and the form keep the contract's own vocabulary in both languages: they are what
+  // the stack file literally says, and a translated key would send a reader looking for a row
+  // that is not there.
+  assert.match(text, /dependencies, vrijgesteld als not applicable/);
+});
+
+test('nothing a stack file says can execute as markup', () => {
+  const html = stripF({
+    ...FLOOR,
+    waived: [{ cls: '<script>alert(1)</script>', form: 'manual', reason: '<img src=x onerror=alert(2)>', path: 'p.md' }],
+  });
+  assert.doesNotMatch(html, /<script>alert|<img src=x/);
+  assert.match(html, /&lt;script&gt;/);
+});
+
 // ---------------------------------------------------------------- the link line
 
 test('the link line names what is load-bearing and folds the long lists behind their counts', () => {
diff --git a/checks/board.test.mjs b/checks/board.test.mjs
index fba5be8..99d4de1 100644
--- a/checks/board.test.mjs
+++ b/checks/board.test.mjs
@@ -4,7 +4,7 @@
 // routes in checks/board-server.mjs that reach them). What is proven here is that the page is a pure function of what is on disk - move one
 // status line and the card moves, add one document and it appears on a shelf, with no other edit -
 // and that a card says everything a person needs and nothing they do not.
-// The two lines under the shelves are proven in checks/board-strip.test.mjs, the file page and
+// The lines under the shelves are proven in checks/board-strip.test.mjs, the file page and
 // the server's own answers in checks/board-server.test.mjs, and what may be opened at all in
 // checks/board-path.test.mjs.
 // Run: node --test checks/board.test.mjs
@@ -337,7 +337,7 @@ test('the framing words follow the project language', () => {
   assert.match(html, /aria-label="Dit project"/, 'the sidebar names itself in it');
   assert.match(text, /Waarom we het bouwen/, 'and so do the subjects under it');
   assert.match(text, /Bord/, 'and the destinations beside them');
-  assert.match(text, /poorten op deze machine staan scherp/, 'and so do the two lines');
+  assert.match(text, /poorten op deze machine staan scherp/, 'and so do the lines under them');
   f.clean();
 });
 
diff --git a/checks/check-stack.mjs b/checks/check-stack.mjs
index 1a44e1b..7c9fa6c 100644
--- a/checks/check-stack.mjs
+++ b/checks/check-stack.mjs
@@ -24,7 +24,7 @@
 // false confidence this whole epic exists to remove, and the honest limit is written into the
 // epic rather than discovered later.
 
-import { existsSync, readdirSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 // A stack file is any standards document that is not the cross-stack floor and not a template:
@@ -77,21 +77,74 @@ const commandsIn = (answer) => [...answer.matchAll(/`([^`]+)`/g)].map((m) => m[1
 // never performs.
 const liveLines = (lines) => lines.filter((l) => !/^\s*#/.test(l));
 
+// One definition of "this command actually runs", so the gate that refuses a dead command and
+// the report that counts a proven class can never drift apart on what proven means.
+const isLive = (cmd, live) => live.some((l) => l.includes(cmd));
+const runsAll = (answer, live) => {
+  const wanted = commandsIn(answer);
+  return wanted.length > 0 && wanted.every((cmd) => isLive(cmd, live));
+};
+
+// The one read of the contract: which stack files this project declares, what each one's floor
+// table says, and which workflow lines are live to answer it. The gate below and floorReport()
+// both take their facts from here, which is what keeps the refusal and the count in step.
+// The two halves stay separate on purpose: a project with no stack file still has live workflow
+// lines, and the design detector's half of the gate is entitled to them.
+export function readFloors(root, lines) {
+  const standards = join(root, 'docs', 'standards');
+  const stacks = existsSync(standards) ? stackFiles(standards) : [];
+  const wfDir = join(root, '.github', 'workflows');
+  const live = existsSync(wfDir)
+    ? readdirSync(wfDir).filter((n) => /\.ya?ml$/.test(n))
+      .flatMap((name) => liveLines(lines(join(wfDir, name))))
+    : [];
+  const files = stacks.map((name) => {
+    const text = lines(join(standards, name)).join('\n');
+    return { rel: `docs/standards/${name}`, text, rows: floorRows(text) };
+  });
+  return { live, files };
+}
+
+// The shape of the floor, counted once for everyone who reports it: how many classes are proven
+// by a command that runs, which ones are waived and why, and which are neither. E-02/F-01/S-03.
+// It counts and never judges, exactly like the gate: whether the command that runs is any good
+// is a question no file in checks/ is entitled to answer.
+export function floorReport(root) {
+  const read = (p) => readFileSync(p, 'utf8').replace(/\r\n/g, '\n').split('\n');
+  const floors = readFloors(root, read);
+  // No stack declared is not started, not a floor of zero: this project has not been asked the
+  // six questions yet, so it has nothing to answer for.
+  if (!floors.files.length) return null;
+  const waived = [];
+  const open = [];
+  let proven = 0;
+  let total = 0;
+  for (const file of floors.files) {
+    for (const cls of CLASSES) {
+      total += 1;
+      const row = file.rows?.get(cls);
+      // An unanswered class, or one answered in a form the contract does not have, is open: the
+      // gate is already refusing it, and counting it as waived would launder a hole into a choice.
+      if (!row || !row.form || !row.answer || !FORMS.includes(row.form)) { open.push(cls); continue; }
+      if (row.form === 'command') {
+        if (runsAll(row.answer, floors.live)) proven += 1;
+        else open.push(cls);
+        continue;
+      }
+      waived.push({ cls, form: row.form, reason: row.answer.trim(), path: file.rel });
+    }
+  }
+  return { total, proven, waived, open, files: floors.files.map((f) => f.rel) };
+}
+
 export const stackChecks = ({ root, fail, lines }) => ({
   'stack-gates'() {
     // Another CI host is explicitly allowed (`stack` section 3: "or this host's equivalent"),
     // and whether CI exists at all is enforcement.mjs's report to make. One fact, one place.
     const wfDir = join(root, '.github', 'workflows');
     if (!existsSync(wfDir)) return;
-    const workflows = readdirSync(wfDir).filter((n) => /\.ya?ml$/.test(n));
-    const live = workflows.flatMap((name) => liveLines(lines(join(wfDir, name))));
-
-    const standards = join(root, 'docs', 'standards');
-    const stacks = existsSync(standards) ? stackFiles(standards) : [];
-    for (const name of stacks) {
-      const rel = `docs/standards/${name}`;
-      const text = lines(join(standards, name)).join('\n');
-      const rows = floorRows(text);
+    const { live, files } = readFloors(root, lines);
+    for (const { rel, text, rows } of files) {
       if (!rows) {
         fail(`${rel} declares a stack and carries no floor table, so nothing says how this project's own code is checked. Copy the table from docs/standards/TEMPLATE-STACK.md and answer all six classes: ${CLASSES.join(', ')}.`);
         continue;
@@ -113,7 +166,7 @@ export const stackChecks = ({ root, fail, lines }) => ({
             continue;
           }
           for (const cmd of wanted) {
-            if (!live.some((l) => l.includes(cmd))) {
+            if (!isLive(cmd, live)) {
               fail(`${rel} answers \`${cls}\` with \`${cmd}\`, and no workflow under .github/workflows/ runs it. A command nobody runs proves nothing: wire the stage, or change the answer to the form that is true.`);
             }
           }
diff --git a/checks/check.mjs b/checks/check.mjs
index a946d6e..d2e840c 100644
--- a/checks/check.mjs
+++ b/checks/check.mjs
@@ -17,7 +17,7 @@ import { parseBrief, parseManifest, manifestMatcher, isSpecPath, BRIEF_PATH, MAN
 // What counts as a link, and which files are this project's documents, are defined once and
 // read here and by the board.
 import { parseLinks, linkTargets, readDocuments, forTerminal, SKIP_DIRS } from './links.mjs';
-import { enforcementReport, formatReport } from './enforcement.mjs';
+import { enforcementReport, formatReport, floorFor } from './enforcement.mjs';
 // Gate families live in their own files, composed into the registry below: what a source file
 // may contain and how long it may be, the trace chain from brief to commit, whether a stack's
 // own gates are wired, and the config's self-gate, which also owns the third-party declaration.
@@ -418,6 +418,9 @@ if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.ur
   if (!process.env.CI) {
     try {
       for (const line of formatReport(enforcementReport(root))) console.log(line);
+      // The floor beside the signals: armed gates say nothing about how much of this project's
+      // own code any of them looks at. Silent until a stack is declared (E-02/F-01/S-03).
+      for (const line of floorFor(root)) console.log(line);
     } catch (e) {
       console.log(`enforcement: self-report crashed (${e.message}); the checks below still decide.`);
     }
diff --git a/checks/check.test.mjs b/checks/check.test.mjs
index 1b4e204..1a0d564 100644
--- a/checks/check.test.mjs
+++ b/checks/check.test.mjs
@@ -14,7 +14,8 @@ import { join } from 'node:path';
 import assert from 'node:assert/strict';
 import { runChecks, installHooks } from './check.mjs';
 import { needsHandoffNudge } from './handoff-nudge.mjs';
-import { enforcementReport, formatReport } from './enforcement.mjs';
+import { enforcementReport, formatReport, formatFloor } from './enforcement.mjs';
+import { floorReport } from './check-stack.mjs';
 import {
   fixture, expectClean, expectFail, withConfig, BASE_BUDGETS, tally, report,
 } from './check-fixture.mjs';
@@ -360,4 +361,111 @@ try {
   rmSync(fx.root, { recursive: true, force: true });
 }
 
+
+// --- the floor: the shape of the stack file's promise, counted once (E-02/F-01/S-03) ---
+// The derivation lives where the gate already parses the contract, so the terminal line and the
+// board read one function and cannot word the same floor two ways. What is proven here is the
+// counting, the not-started case, and the wording's honesty about what "proven" buys.
+
+const FULL_ROWS = {
+  builds: ['command', '`npm run build`'],
+  behaves: ['command', '`npm test`'],
+  analyzed: ['command', '`npm run lint`'],
+  dependencies: ['not applicable', 'No third-party code ships here, so there is nothing to audit'],
+  secrets: ['command', '`npm run scan`'],
+  renders: ['manual', 'A named walkthrough by the owner before each release'],
+};
+const RUNS_ALL = 'name: ci\njobs:\n  gate:\n    steps:\n      - run: npm run build\n      - run: npm test\n'
+  + '      - run: npm run lint\n      - run: npm run scan\n';
+
+const floorFile = (rows) => '# node\n\n## The floor\n\n'
+  + '| Class | The risk it covers | Form | Answer |\n|---|---|---|---|\n'
+  + Object.entries(rows).map(([cls, [form, answer]]) => `| \`${cls}\` | the risk | ${form} | ${answer} |`).join('\n')
+  + '\n\ndefer: renders is walked by hand. ceiling: a second surface. upgrade-when: a build step exists.\n';
+
+const withFloor = (rows = FULL_ROWS, workflow = RUNS_ALL) => ({ put }) => {
+  put('docs/standards/node.md', floorFile(rows));
+  put('.github/workflows/ci.yml', workflow);
+};
+
+function floorCase(label, mutate, check) {
+  const fx = fixture();
+  mutate(fx);
+  let out;
+  try {
+    out = floorReport(fx.root);
+  } catch (e) {
+    tally.failed.push(`${label}: derivation threw: ${e.message}`);
+    rmSync(fx.root, { recursive: true, force: true });
+    return;
+  }
+  rmSync(fx.root, { recursive: true, force: true });
+  try { check(out); tally.passed++; } catch (e) { tally.failed.push(`${label}: ${e.message}`); }
+}
+
+// Not started is not the same as failing, which is the rule the empty copy follows everywhere.
+floorCase('floor-no-stack-file', () => {}, (out) =>
+  assert.equal(out, null, 'a project with no stack file reports nothing, never a floor of zero'));
+floorCase('floor-templates-are-not-a-stack', ({ put }) => {
+  put('docs/standards/GLOBAL.md', '# cross-stack\n');
+  put('docs/standards/TEMPLATE-STACK.md', floorFile(FULL_ROWS));
+}, (out) => assert.equal(out, null, 'the template and the cross-stack floor are not a declared stack'));
+
+floorCase('floor-counts-proven-and-waived', withFloor(), (out) => {
+  assert.equal(out.total, 6, 'six classes, always');
+  assert.equal(out.proven, 4, 'four classes answered with a command that a workflow runs');
+  assert.equal(out.waived.length, 2, 'not applicable and manual are both waivers');
+  assert.deepEqual(out.waived.map((w) => w.cls).sort(), ['dependencies', 'renders']);
+  assert.equal(out.open.length, 0, 'nothing unanswered');
+  const dep = out.waived.find((w) => w.cls === 'dependencies');
+  assert.equal(dep.form, 'not applicable');
+  assert.match(dep.reason, /nothing to audit/, "the waiver carries the author's own reason");
+});
+
+// A command nobody runs proves nothing: the gate already refuses it, and the count must agree
+// with the gate rather than trusting the table.
+floorCase('floor-unrun-command-is-not-proven', withFloor(FULL_ROWS,
+  'name: ci\njobs:\n  gate:\n    steps:\n      - run: npm run build\n      # - run: npm test\n'
+  + '      - run: npm run lint\n      - run: npm run scan\n'), (out) => {
+  assert.equal(out.proven, 3, 'a commented stage does not prove its class');
+  assert.ok(out.open.includes('behaves'), 'a class whose command is dead is open, never waived');
+  assert.equal(out.waived.length, 2, 'and it is not quietly counted as a waiver either');
+});
+
+floorCase('floor-unanswered-class-is-open', withFloor({ ...FULL_ROWS, secrets: ['', ''] }), (out) => {
+  assert.ok(out.open.includes('secrets'), 'an unanswered class is open');
+  assert.equal(out.proven + out.waived.length + out.open.length, out.total, 'every class is accounted for');
+});
+
+// The line itself. One line when the floor is whole; the reasons named when it is not.
+{
+  const whole = formatFloor({
+    total: 6, proven: 6, waived: [], open: [], files: ['docs/standards/node.md'],
+  });
+  const holed = formatFloor({
+    total: 6,
+    proven: 4,
+    waived: [{ cls: 'dependencies', form: 'not applicable', reason: 'No third-party code ships here', path: 'docs/standards/node.md' },
+      { cls: 'renders', form: 'manual', reason: 'A named walkthrough by the owner', path: 'docs/standards/node.md' }],
+    open: [],
+    files: ['docs/standards/node.md'],
+  });
+  try {
+    assert.equal(whole.length, 1, 'a whole floor is one line');
+    assert.match(whole[0], /^floor: /, 'the line names itself, beside the enforcement line');
+    assert.match(whole[0], /6 of the 6/, 'the line leads with the count');
+    // The limit, stated rather than implied: a builder must not read this as an audit.
+    assert.match(whole[0], /runs, not that what it runs is any good/,
+      'the wording states what proven does not buy');
+    assert.equal(holed.length, 3, 'a waived class costs the line one line each');
+    assert.match(holed[0], /4 of the 6/);
+    assert.match(holed[1], /dependencies/);
+    assert.match(holed[1], /not applicable/);
+    assert.match(holed[1], /No third-party code ships here/);
+    assert.match(holed[2], /renders/);
+    assert.equal(formatFloor(null).length, 0, 'no stack file, no line');
+    tally.passed++;
+  } catch (e) { tally.failed.push(`floor-line: ${e.message}`); }
+}
+
 report('runner and document gate');
diff --git a/checks/drill.mjs b/checks/drill.mjs
index 983581c..149661f 100644
--- a/checks/drill.mjs
+++ b/checks/drill.mjs
@@ -65,6 +65,14 @@ async function hooksArmed(copy) {
   return mod.enforcementReport(copy).find((s) => s.signal === 'hooks').armed;
 }
 
+// The floor the copy reports about itself, derived by its own check-stack.mjs rather than this
+// tree's, on the same rule as hooksArmed above: a drift between the two has to fail here rather
+// than be papered over. Null is the honest answer for a copy that has not chosen a stack.
+async function floorOf(copy) {
+  const mod = await import(pathToFileURL(join(copy, 'checks', 'check-stack.mjs')).href);
+  return mod.floorReport(copy);
+}
+
 function walkFiles(dir, base = dir, out = []) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     const full = join(dir, entry.name);
@@ -165,6 +173,12 @@ export const STEPS = [
     // list of bullets changes without this step changing with it, twice.
     async run(ctx) {
       const at = (...p) => join(ctx.copy, ...p);
+      // The copy arrives carrying Groundwork's own stack file, so a floor is readable here.
+      // That is the half that keeps the assertion after the clearing honest: a report that was
+      // silent all along would pass it without meaning anything (E-02/F-01/S-03).
+      const before = await floorOf(ctx.copy);
+      must(before && before.total === 6 && before.proven > 0,
+        `the unpacked copy reports no floor from its own stack file: ${JSON.stringify(before)}`);
       for (const name of ['MASTER_PROMPT.md', 'MASTER_PROMPT.local.md']) {
         rmSync(at(name), { force: true });
       }
@@ -206,6 +220,11 @@ export const STEPS = [
         "Groundwork's own stack file survived the clearing, so the copy inherits a floor it did not choose");
       must(existsSync(at('docs', 'standards', 'TEMPLATE-STACK.md')),
         'the stack template went with it, leaving the copy no shape to write its own floor from');
+      // Not started is not the same as failing: a copy that has not chosen a stack reports no
+      // floor at all, never a floor of zero it was never asked to fill.
+      const after = await floorOf(ctx.copy);
+      must(after === null,
+        `a copy with no stack file reports a floor instead of nothing: ${JSON.stringify(after)}`);
       const checks = node(ctx.copy, ['checks/check.mjs']);
       must(checks.status === 0, `check.mjs failed after the clearing:\n${checks.stdout}`);
       return `${pairs.length} files blanked, denylist emptied, gates still green`;
diff --git a/checks/enforcement.mjs b/checks/enforcement.mjs
index 629014e..ca4b093 100644
--- a/checks/enforcement.mjs
+++ b/checks/enforcement.mjs
@@ -15,6 +15,9 @@ import { join } from 'node:path';
 // Whether the design method is installed, and at which version, is read where its install route
 // lives, so the report and the installer can never disagree about where the payload sits.
 import { designMethodSignal } from './design-method.mjs';
+// The floor's shape is derived where the gate already parses the contract, so the line below and
+// the board's own line are two renderings of one count rather than two readings of one table.
+import { floorReport } from './check-stack.mjs';
 
 // stderr is swallowed: "not a repo" or "key unset" are expected degraded states, not errors.
 const git = (root, args) => execSync(`git ${args}`, {
@@ -86,3 +89,43 @@ export function formatReport(signals) {
   }
   return lines;
 }
+
+// ---------------------------------------------------------------- the floor beside the signals
+
+// The four signals above are armed or not. The floor is a different kind of fact: how much of
+// this project's own code any gate actually looks at, which the four signals cannot tell you.
+// A waived class passes the gate on purpose (a stated, reasoned choice beats a project lying in
+// the table), so the only thing standing between a waiver and the cheap default is that it is
+// visible here every time the owner runs the checks. E-02/F-01/S-03.
+//
+// The wording carries its own limit. "Proven" here means one thing: a workflow runs the command
+// the stack file names. Nothing in this framework has looked at what that command asserts, and a
+// line that let a builder believe otherwise would be the false confidence this epic exists to
+// remove.
+export function formatFloor(floor) {
+  // No stack file is not a floor of zero. A project that has not chosen a stack has nothing to
+  // report here, which is the rule the empty copy follows everywhere else.
+  if (!floor) return [];
+  const { proven, total, waived, open, files } = floor;
+  const where = files.join(', ');
+  const counted = `${proven} of the ${total} risk classes`;
+  const holes = [
+    waived.length ? `waives ${waived.length}` : '',
+    open.length ? `leaves ${open.length} unanswered or unwired` : '',
+  ].filter(Boolean).join(' and ');
+  const lines = [`floor: ${where} proves ${counted} with a command CI runs`
+    + `${holes ? `, and ${holes}` : ''}. `
+    + 'Proven means the command runs, not that what it runs is any good.'];
+  for (const w of waived) {
+    lines.push(`  - ${w.cls} waived as ${w.form}: ${w.reason}`);
+  }
+  for (const cls of open) {
+    lines.push(`  - ${cls} is answered by nothing that runs: answer it with a live command, `
+      + 'or waive it in the form that is true.');
+  }
+  return lines;
+}
+
+// The floor for this root, or nothing when no stack is declared. One call for the CLI, so a
+// caller cannot report the floor without the derivation that owns it.
+export const floorFor = (root) => formatFloor(floorReport(root));

From 391846101d7e3e916c0c3f9a2331668e5f0a6fde Mon Sep 17 00:00:00 2001
From: Remon Panman <228601219+Tradebaas@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:20:42 +0200
Subject: [PATCH 2/2] refactor(checks): the CLI composes the floor line the way
 it composes the one above it

Review of the previous commit found a pass-through: floorFor(root) was one line forwarding to
formatFloor(floorReport(root)) and had exactly one caller. GLOBAL.md names that shape directly -
no layers that only forward to the next layer - and removing it makes the call site read like its
neighbour, which has always composed formatReport(enforcementReport(root)) in the open.

Traces-to: SC-5
---
 checks/check.mjs       | 6 +++---
 checks/enforcement.mjs | 7 -------
 2 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/checks/check.mjs b/checks/check.mjs
index d2e840c..1beeecf 100644
--- a/checks/check.mjs
+++ b/checks/check.mjs
@@ -17,13 +17,13 @@ import { parseBrief, parseManifest, manifestMatcher, isSpecPath, BRIEF_PATH, MAN
 // What counts as a link, and which files are this project's documents, are defined once and
 // read here and by the board.
 import { parseLinks, linkTargets, readDocuments, forTerminal, SKIP_DIRS } from './links.mjs';
-import { enforcementReport, formatReport, floorFor } from './enforcement.mjs';
+import { enforcementReport, formatReport, formatFloor } from './enforcement.mjs';
 // Gate families live in their own files, composed into the registry below: what a source file
 // may contain and how long it may be, the trace chain from brief to commit, whether a stack's
 // own gates are wired, and the config's self-gate, which also owns the third-party declaration.
 import { codeChecks } from './check-code.mjs';
 import { checkCommitMessage, traceChecks } from './check-trace.mjs';
-import { stackChecks } from './check-stack.mjs';
+import { stackChecks, floorReport } from './check-stack.mjs';
 import { configChecks, thirdPartyMatcher } from './check-config.mjs';
 
 // The commit-msg hook and the self-test have always imported this from here; it is authored in
@@ -420,7 +420,7 @@ if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.ur
       for (const line of formatReport(enforcementReport(root))) console.log(line);
       // The floor beside the signals: armed gates say nothing about how much of this project's
       // own code any of them looks at. Silent until a stack is declared (E-02/F-01/S-03).
-      for (const line of floorFor(root)) console.log(line);
+      for (const line of formatFloor(floorReport(root))) console.log(line);
     } catch (e) {
       console.log(`enforcement: self-report crashed (${e.message}); the checks below still decide.`);
     }
diff --git a/checks/enforcement.mjs b/checks/enforcement.mjs
index ca4b093..d0e5f74 100644
--- a/checks/enforcement.mjs
+++ b/checks/enforcement.mjs
@@ -15,9 +15,6 @@ import { join } from 'node:path';
 // Whether the design method is installed, and at which version, is read where its install route
 // lives, so the report and the installer can never disagree about where the payload sits.
 import { designMethodSignal } from './design-method.mjs';
-// The floor's shape is derived where the gate already parses the contract, so the line below and
-// the board's own line are two renderings of one count rather than two readings of one table.
-import { floorReport } from './check-stack.mjs';
 
 // stderr is swallowed: "not a repo" or "key unset" are expected degraded states, not errors.
 const git = (root, args) => execSync(`git ${args}`, {
@@ -125,7 +122,3 @@ export function formatFloor(floor) {
   }
   return lines;
 }
-
-// The floor for this root, or nothing when no stack is declared. One call for the CLI, so a
-// caller cannot report the floor without the derivation that owns it.
-export const floorFor = (root) => formatFloor(floorReport(root));