fix core report inspection and vendored roots

packages/casan-harness/tests/phase10-traceability-tests.sh

@@ -90,6 +90,35 @@ set -e 2>/dev/null || true
   && pass "out-of-range line ref fails the gate (line-level)" \
   || fail "line ref did not fail as expected (rc=$RC)"
 
+echo ""
+echo "===== Plan-10 vendored consumer root ====="
+CONSUMER="$WORK/consumer"
+python3 - "$CONSUMER" <<'PY'
+import json
+import os
+import sys
+
+root = sys.argv[1]
+os.makedirs(os.path.join(root, "domain"), exist_ok=True)
+os.makedirs(os.path.join(root, "src"), exist_ok=True)
+os.makedirs(os.path.join(root, "tests"), exist_ok=True)
+with open(os.path.join(root, "domain", "requirement.md"), "w", encoding="utf-8") as handle:
+    handle.write("| FR-01 | Consumer root must resolve | required |\n")
+with open(os.path.join(root, "domain", "traceability-map.json"), "w", encoding="utf-8") as handle:
+    json.dump({"FR-01": {"code": ["src/app.py"], "tests": ["tests/test_app.py"]}}, handle)
+for relative in ("src/app.py", "tests/test_app.py"):
+    with open(os.path.join(root, relative), "w", encoding="utf-8") as handle:
+        handle.write("# consumer fixture\n")
+PY
+if CASAN_APP_ROOT="$CONSUMER" python3 "$S/traceability-matrix.py" \
+  --requirements "$CONSUMER/domain/requirement.md" \
+  --map "$CONSUMER/domain/traceability-map.json" \
+  --out "$WORK/consumer-traceability.json" --gate >/dev/null; then
+  pass "explicit consumer root wins over vendored harness location"
+else
+  fail "vendored traceability resolved files against the harness bundle"
+fi
+
 echo ""
 echo "===== TRACEABILITY SUMMARY: PASS=$PASS FAIL=$FAIL ====="
 [[ "$FAIL" -eq 0 ]] || exit 1