Add compound component state evidence

[changeroa]

Purpose

Add channel-specific, machine-validated compound component-state evidence for the two governed-local examples.

Scope

• Define closed component, fixture, state, capture-session, DOM, AX, runtime, and evidence schemas.
• Add editorial and terminal button scenarios with deterministic state, keyboard, and evidence tables.
• Bind Chromium interaction evidence to a sealed receipt and a closed 30-artifact set.
• Reject stale evidence, schema smuggling, replay/mixing, and channel substitution.

Non-goals

No aggregate WCAG, assistive-technology, brand, design-system, production-readiness, or independent-owner approval.

Verification

• Component semantics 34/34; artifact/session 36/36; generator 13/13.
• Consumer 86/86; profiles 26/26; runtime 10/10; runtime negatives 6/6.
• Independent functional and visual review: PASS/HIGH.

npm run test:component-state
npm run validate:component-state
npm run test:component-state:runtime-negative

Durable evidence: .omo/evidence/consumer-reference-roadmap-implementation/pr5/; authoritative run 29275890700.

Stack and rollback

Base is codex/roadmap-04-chromium-sentinel; merge sequentially after roadmap 04. Revert 7589f6b, then 5d28e06. The second commit is the published-CI path fix; history was not rewritten.

[changeroa]

ULW triage: changes requested.

Reviewed exact head 7589f6bfa65371c42387fa7fbf70bbd28d1d407c against exact base bb772d303c9dafea6e99d2c5713b4bd66e41a3bb with five review lanes, isolated root workflow, fresh Chromium runtime evidence, and dual visual QA.

What passed:

• Full clean-state workflow and generated drift checks.
• Component semantics 34/34, artifact/session 35/35, generator 13/13, runtime negatives 6/6.
• Fresh Chromium 10/10 scenarios and all 30 visual/DOM/AX artifacts.
• Both profile surfaces are complete and visibly distinct; DOM/AX/keyboard behavior matches the intended states.
• Actions and the Playwright container are SHA/digest pinned, and scope exclusions are honest.

Merge blockers:

1. Stale revision replay/source provenance. A prior-revision session can be re-finalized and validated at current head because receipt revision/source is never checked against a clean checkout. The committed evidence itself records base bb772d3, where this component-state implementation does not exist. Bind a deterministic source graph/tree digest, require a clean exact checkout, and regenerate evidence at a verifiable revision.
2. Visual substitution. PNGs carry no capture-time session/scenario/environment identity. Replacing editorial-action-focused.png with the unrelated 976×120 consumer-reference sentinel, then re-finalizing, produced ok:true and labeled it passed current-session evidence. Cross-session Linux→Darwin substitution also passes. Emit an identity-bearing visual sidecar/receipt at capture time and reject unrelated/cross-session images.
3. PNG integrity. The validator accepts a 24-byte signature/IHDR-only buffer that is not a decodable PNG. Perform a real decode/chunk-integrity check and add corrupted/fabricated PNG negatives.
4. Upload closure. Finalizer/validator close only runtime/, but CI uploads the whole evidence root. An unexpected top-level file was ignored with ok:true. Allowlist the exact root entries and reject top-level files/symlinks.
5. Claim parity. busy is declared in the visual channel, but the renderer/tests do not produce or assert an independent busy visual treatment. Render/assert it or scope busy to DOM/AX only.
6. Portability. Ten PR-owned MJS entrypoints use URL .pathname and break in space/non-ASCII checkout paths; use fileURLToPath.

Stack note: later PR #26 repairs several PR #24-local provenance/visual/path issues, but the unresolved #22 semantic-distinctness and #23 evidence-output/transitive-source/trust blockers still prevent cumulative merge.

Visual scope: the fresh screenshots themselves look correct; this failure is about whether the evidence contract can prove those pixels came from the claimed session/source. No WCAG, AT, brand, product-readiness, or owner-approval claim is implied.