component-test migration (M1): regression and follow-up tracker

[lann]

Parent tracker for the adversarial review of the component-test migration (#274, follow-ups #300/#301), conducted post-merge with three independent review passes (maintainability/ergonomics, coverage deltas, CI/DX) plus measured old-vs-new timing. Every finding was validated against source (component-test read at the pinned rev); the census-gap and ratification findings were confirmed by two reviewers independently plus a direct read.

Context — what the migration got right (verified, for balance): cutover parity is exact (census fixtures byte-identical to the incumbent's final locks; probe tables/bodies, schedule logic, and the 1-in-20 straddle sample byte-identical); and the new stack gains matrix-check (a CI freshness gate the incumbent lacked), the decline-pair lint, per-case not-reached synthesis with trap attribution, dead-declaration errors, a ported mutation oracle, and the widened class-D gate. The e5e378e/f599fc3 aggregation wobble resolved coherently after upstream's hashes-are-provenance ruling; nothing ended weaker than pre-wobble.

Measured cost (local, warm, no browser): full gate 42.7s (incumbent, parallel targets) -> 70.7s (sequential targets + per-run transpile), while the wasmtime leg itself got 2x faster; CI common-case workflow wall roughly doubled, with the conformance job the critical path in every sampled run and zero artifact-cache hits in the sample (#307 has the tables).

P0 — substance

• conformance-ct: generated rows have no per-case inventory pin — the census function rides on CI matrix count diffs #302 generated rows have no per-case inventory pin; the census function rides on CI matrix count diffs
• conformance-ct: the S5 results-schema ratification premise does not hold for generated rows #303 the S5 results-schema ratification premise does not hold for generated rows (depends on / re-ratifies after conformance-ct: generated rows have no per-case inventory pin — the census function rides on CI matrix count diffs #302)
• component-test sibling checkout is a workspace-wide prerequisite; docs and setup.sh treat it as conformance-only #304 component-test sibling checkout is a workspace-wide prerequisite; docs and setup.sh treat it as conformance-only

P1 — workflow and cost

• conformance/README 'Growing the suites' omits the registration layer the migration added #305 "Growing the suites" omits the registration layer the migration added
• conformance-ct: committed matrices cannot be regenerated without Chrome; no CI-artifact fallback #306 committed matrices cannot be regenerated without Chrome; no CI-artifact fallback
• conformance-ct: gate wall time — sequential targets, per-run jco transpile, over-broad CI cache key #307 gate wall time: sequential targets, per-run jco transpile, over-broad CI cache key
• conformance-ct: ct-driver lacks --only; single-case runs are impossible on the wasmtime target #308 ct-driver lacks --only; single-case runs impossible on the wasmtime target

P2 — bundles by area

• conformance-ct: census-parity scaffolding needs an end state and a cleanup pass #309 census-parity scaffolding: end state + cleanup (ROWS divergence doc, preparsed mode, signing duplication, compare-census.py, build.rs stub note, probe idents)
• conformance-ct: validation-semantics deltas vs the incumbent runner (deselected, --missing typos, unscheduled streams) #310 validation-semantics deltas vs the incumbent runner (deselected, --missing typos, unscheduled streams)
• post-migration stale references: retired harness names in live docs and new code #311 stale references to the retired harness in live docs and new code
• conformance-ct: environment hygiene — sibling pin drift, cold-bootstrap margin, lock hash churn #312 environment hygiene: sibling pin drift, cold-bootstrap margin, lock hash churn

Deliberately excluded (tracked elsewhere): the jco-browser optional/missing-results handling and the live browser-run results viewer.

Suggested order: #302 first (it changes what #303's re-ratification can say, and its fix shape may come from upstream component-test); #304/#305 are cheap doc/setup fixes with outsized onboarding effect; #307's three items are independent mechanical wins.

[lann]

Status pass (2026-08-05). Ticked the closed P0/P1 items: #302/#303 (leaf-pinned lockfiles + S5 re-ratification, #324/#325), #304, #307, #308.

In flight as a PR chain:

• Post-migration housekeeping: true up live docs, record accepted semantics deltas, close the no-Chrome matrix gap #327 (housekeeping) — fixes conformance-ct: committed matrices cannot be regenerated without Chrome; no CI-artifact fallback #306, conformance-ct: validation-semantics deltas vs the incumbent runner (deselected, --missing typos, unscheduled streams) #310, post-migration stale references: retired harness names in live docs and new code #311 on merge; partial-comments left on conformance-ct: census-parity scaffolding needs an end state and a cleanup pass #309 and conformance-ct: environment hygiene — sibling pin drift, cold-bootstrap margin, lock hash churn #312 with what remains.
• conformance: close the coverage debt — x25519 encoded admission, ECDSA cross-hash KATs, SHA-1 provenance, demo SDK-module execution #328 (coverage debt, stacked on Post-migration housekeeping: true up live docs, record accepted semantics deltas, close the no-Chrome matrix gap #327) — fixes conformance: X25519 SPKI/JWK admission has no adversarial vectors; the ECDH analogues are vendored #283, vectors README: no provenance rows for the three SHA-1 files #284, conformance: ECDSA cross-hash pairings have no signature-verification coverage #276; guest SDK: six modules are executed by no gate (including rsa_oaep) #285 stays open scoped to rsa_oaep.rs (structurally blocked from the crypto-demo close: the provider withholds rsa-oaep-encrypt, so a demo executing it cannot compose — analysis on the issue).
• Add the algorithm-public-exponent getter to the four RSA-capable key resources #329 (algorithm-public-exponent getter, stacked on conformance: close the coverage debt — x25519 encoded admission, ECDSA cross-hash KATs, SHA-1 provenance, demo SDK-module execution #328) — no tracker item; resolves the componentize shim's JWK-recovery workaround.

Still open after the chain merges: #305 (unticked here — reopened-scope check may be warranted: the 'Growing the suites' registration steps were re-trued in #328 after #324 changed them), #309 (structural items), #312 (items 2–3), #285 (rsa_oaep only).