@deeeed/metamask-harness 0.48.0 → 0.49.0

package/site/assets/help-recipes.json

@@ -12,9 +12,21 @@
       "title": "Freeze the proof target",
       "instruction": "Work inside one isolated MetaMask checkout. Name the exact product version and acceptance criteria, repair harness-owned state, then verify or launch that checkout.",
       "details": [
-        "The tested build and current criteria are authoritative. A prior recipe pass is not current proof. Freeze source and installed dependencies during execution. Parallel workers need private dependency trees with matching manifests and lockfiles; installing through a shared node_modules symlink can change another run. Mobile catalog compatibility does not establish both iOS and Android runtime support; validate the selected transport.",
-        "Launching Extension preserves its wallet profile. Applying a fixture or resetting that profile is a separate explicit action. A session helper proves only its declared postcondition, not the selected account, provider, network, or funding; verify those separately before trading. Use account-aware balances: Hyperliquid unified accounts can use spot collateral even when clearinghouseState reports zero margin.",
-        "Choose state, visual, log, or performance evidence for each criterion before authoring the graph. A tool returning successfully proves only its own operation, not the task's claim."
+        "The tested build and current criteria are authoritative. A prior recipe pass is not current proof. Freeze source and installed dependencies during execution. Parallel workers need private dependency trees with matching manifests and lockfiles; installing through a shared node_modules symlink can change another run.",
+        "A session helper proves only its declared postcondition, not the selected account, provider, network, or funding; verify those separately before trading. Use account-aware balances: Hyperliquid unified accounts can use spot collateral even when clearinghouseState reports zero margin.",
+        "Choose state, visual, log, or performance evidence for each criterion before authoring the graph. A tool returning successfully proves only its own operation, not the task's claim.",
+        {
+          "text": "Mobile catalog compatibility does not establish both iOS and Android runtime support; validate the selected transport.",
+          "adapters": [
+            "mobile"
+          ]
+        },
+        {
+          "text": "Launching Extension preserves its wallet profile. Applying a fixture or resetting that profile is a separate explicit action.",
+          "adapters": [
+            "extension"
+          ]
+        }
       ],
       "commands": [
         "mm-harness doctor --fix",
@@ -26,15 +38,27 @@
       "title": "Discover the strongest starting point",
       "instruction": "Search the installed recipe and action catalogs, inspect exact schemas, and select the closest recipe before writing anything new.",
       "details": [
-        "A bundled recipe, including a Core recipe, is strong composable vocabulary, not authority for every future product version. Core actions use isolated controllers: pass account/network into each action instead of adding a no-op initialization node.",
-        "Prefer an existing recipe, then existing actions, then read-only CDP or controller inspection. Add shared vocabulary only after repeated need is proven.",
+        "A bundled recipe is strong composable vocabulary, not authority for every future product version.",
+        "Prefer an existing recipe, then existing actions, then read-only inspection. Add shared vocabulary only after repeated need is proven.",
         "Before declaring a capability unsupported, inspect both catalogs and the closest recipe's composition. A missing dedicated action may already be composed from UI actions. Read the returned schema, examples, and result_cases before authoring; do not treat guessed field names as empty capabilities.",
-        "Register a team library with --library team=/path/to/library-root, the directory containing recipes/. Use discovered recipe names in call.ref; the library alias names its source, not a recipe-name prefix. Confirm --describe reports the intended source and platform variant, then plan the complete composition. Discovery alone does not prove that child actions or parameter contracts work on this adapter."
+        "Register a team library with --library team=/path/to/library-root, the directory containing recipes/. Use discovered recipe names in call.ref; the library alias names its source, not a recipe-name prefix. Confirm --describe reports the intended source and platform variant, then plan the complete composition. Discovery alone does not prove that child actions or parameter contracts work on this adapter.",
+        {
+          "text": "Core actions use isolated controllers: pass account/network into each action instead of adding a no-op initialization node.",
+          "adapters": [
+            "core"
+          ]
+        }
       ],
       "commands": [
         "mm-harness actions --json",
         "mm-harness actions --action app.status --json",
-        "mm-harness actions --action ui.screenshot --json",
+        {
+          "text": "mm-harness actions --action ui.screenshot --json",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
         "mm-harness actions performance --json",
         "mm-harness run --list --json",
         "mm-harness run runner.smoke --describe --json"
@@ -50,42 +74,74 @@
         "CLI values are parsed as JSON when possible. For a numeric-looking string parameter, preserve JSON quotes, for example 'amount=\"15\"'; shell quoting 15 alone still produces a number.",
         "Do not parameterize away safety, assertions, cleanup, or the meaning of success. Never depend on hidden wallet, account, provider, network, page, port, or device state.",
         "A clean-market postcondition must check both sides. Keep side-specific open-state proof separate, and inspect the actual cancellation payload: filtering by side before canceling by symbol does not protect opposite-side orders. Map client receipt IDs to exchange IDs when they differ, checking account and market. Never infer ownership from any new order or widen cleanup to fix a failed assertion.",
-        "Asset symbols and test IDs may repeat across networks. Require an unambiguous observed row, or use a contract that accepts network/token identity; never infer chain, funding or ownership from a symbol alone.",
+        {
+          "text": "Asset symbols and test IDs may repeat across networks. Require an unambiguous observed row, or use a contract that accepts network/token identity; never infer chain, funding or ownership from a symbol alone.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
         "For catalog changes, verify membership and lifecycle flags as well as counts. A smaller list can hide valid delisted entries still needed by callers; distinguish unavailable trading metadata from missing historical identity.",
-        "Defaults must agree across callers and children. Keep consent and environment-specific values required when no safe default exists; a missing required input is not recipe drift. The current runtime resolves referenced inputs before branching, so an unselected branch does not hide an undefined parameter. Venue-key registration needs explicit account/key-slot ownership too. Pass account and network explicitly to isolated Core actions rather than assuming a preceding node selected them."
+        "Defaults must agree across callers and children. Keep consent and environment-specific values required when no safe default exists; a missing required input is not recipe drift. The current runtime resolves referenced inputs before branching, so an unselected branch does not hide an undefined parameter. Venue-key registration needs explicit account/key-slot ownership too."
       ],
-      "commands": []
+      "commands": [
+        "mm-harness run ./proof.recipe.json market=ETH --plan --json"
+      ]
     },
     {
       "id": "compose",
       "title": "Compose a readable graph",
       "instruction": "Use static call references for unchanged sub-journeys. Separate preparation, action, assertions, and evidence; add workflow.teardown when cleanup must run after success or failure.",
       "details": [
-        "Starting conditions are ordinary nodes at the beginning of workflow, not a preconditions field. Use idempotent ensure actions and independently assert their postconditions. Reopening a route may preserve filters or search state; establish the required view explicitly before sampling, and validate composition after a different journey changes it.",
+        "Starting conditions are ordinary nodes at the beginning of workflow, not a preconditions field. Use idempotent ensure actions and independently assert their postconditions.",
         "Inspect existing state before creating or cleaning fixtures. Establish only prerequisites required by the claim; a history or display check may already have usable records and need no trade or cleanup. Record the selected records and verify they still satisfy the proof boundary.",
         "Match history-query ranges to the dates of existing visible records before declaring fixtures missing. Sample only sections needed for change detection; fetch one-time corroborating history once, and count background calls as well as graph nodes.",
         "Actions translate UI, CDP, or controller operations. Recipes compose them. Product code owns business rules. Teams own specialized journeys in their libraries; the harness retains shared capabilities and a small set of composable examples.",
         "Put identical cross-adapter graphs in recipes/shared/<domain>/ and platform variants in recipes/<adapter>/<domain>/. Both keep the same domain.recipe name; an adapter variant takes precedence. Keep platform differences in actions when the journey is identical. Verify discovery, execution, and callers before removing duplicates.",
-        "Keep lifecycle transitions explicit. Check whether an observation tool activates or foregrounds the app; that behavior can invalidate a lifecycle claim even when the captured screen looks correct.",
-        "On source-dev Mobile, app.lifecycle launch, foreground, and restart already wait for the selected bridge and route. Use runtime_ready_timeout_ms to bound readiness and require_process_continuity for warm-resume claims. settle_ms is an explicit dwell period, not readiness proof. Unlock before a visual proof if the app protects locked-screen capture; never bypass that protection.",
+        {
+          "text": "Keep lifecycle transitions explicit. Check whether an observation tool activates or foregrounds the app; that behavior can invalidate a lifecycle claim even when the captured screen looks correct.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        {
+          "text": "On source-dev Mobile, app.lifecycle launch, foreground, and restart already wait for the selected bridge and route. Use runtime_ready_timeout_ms to bound readiness and require_process_continuity for warm-resume claims. settle_ms is an explicit dwell period, not readiness proof. Unlock before a visual proof if the app protects locked-screen capture; never bypass that protection.",
+          "adapters": [
+            "mobile"
+          ]
+        },
         "Measure executed nodes and elapsed time across nested calls, including setup and teardown. Include action-internal repetitions such as navigation cycles. Splitting a long graph into child files does not reduce work. Reuse a verified prerequisite within its valid scope, branch around already-satisfied setup, and keep broad coverage suites separate from the small journey a task needs.",
-        "Inspect scripts invoked by command nodes before running them. A read or stream label does not rule out signing, order placement or cleanup. Count the script's operations and verify its actual assertions; callback counts do not establish transport identity. Use a distinct output path for repeated invocations so one phase cannot overwrite another's evidence.",
+        "Inspect scripts and controller methods before running them. A read, get or stream label does not rule out signing, order placement or collateral settlement. Apply the normal approvals to those effects. Count actual operations and verify assertions; callback counts do not establish transport identity. Use a distinct output path for repeated invocations so one phase cannot overwrite another's evidence.",
         "Merge branch endings when their resolved action inputs and assertions are identical. Preserve the scenario identity in parameters; keep distinct endings when required evidence differs. Compare the selected operation sequences before claiming fewer checks or faster execution.",
         "Use summary.total for executed node count and summary.durationMs for engine duration. Measure CLI wall time separately when assessing speed; preparation and closeout can dominate a short recipe. The trace includes child nodes and their enclosing call; summing both durations double-counts the child work.",
         "Keep repository builds, unit suites, and release bookkeeping outside reusable runtime journeys. Run them separately when required and report both results; a runtime pass does not imply package acceptance.",
-        "Main and teardown graphs are disjoint. A cleanup node reached only through next may be skipped on failure. Capture the baseline in a completed read before mutation, guard restoration on that output, and restore only task-owned state. A missing or ambiguous baseline is unknown, not false. A failed mutation may have changed the product without returning output. Teardown cannot guarantee provider acceptance or survive a killed process."
+        "Main and teardown graphs are disjoint. A cleanup node reached only through next may be skipped on failure. Capture the baseline before mutation, guard restoration on that output, and restore only task-owned state. A missing or ambiguous baseline is unknown, not false. An interaction can complete after timeout or navigation away; check task-owned pending requests during cleanup. Teardown cannot guarantee provider acceptance or survive a killed process.",
+        {
+          "text": "Reopening a route may preserve filters or search state; establish the required view explicitly before sampling, and validate composition after a different journey changes it.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        }
       ],
       "commands": []
     },
     {
       "id": "author",
       "title": "Build and prove one node at a time",
-      "instruction": "Probe each unfamiliar action with call or a tiny action-to-end recipe. Use read-only CDP inspection only when declared actions cannot reveal the needed authoring detail, then consolidate the final proof from manifest-declared actions.",
+      "instruction": "Probe each unfamiliar action with call or a tiny action-to-end recipe. Use read-only inspection only when declared actions cannot reveal the needed authoring detail, then consolidate the final proof from manifest-declared actions.",
       "details": [
         "Plan after every structural change and preserve the first failing trace.",
         "A plan validates structure only. Probe a reused setup boundary against the current build with a short explicit timeout before a full journey; a bundled journey timeout is not a discovery budget.",
         "A later update cannot repair a failed initial-seed assertion. Preserve the initial sample and stop that wait instead of spending the remaining budget on a proof that cannot pass.",
-        "A CDP observation can help find the current route or selector; it is not final evidence unless the recipe records an allowed action and assertion for that signal."
+        {
+          "text": "A CDP observation can help find the current route or selector; it is not final evidence unless the recipe records an allowed action and assertion for that signal.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        }
       ],
       "commands": [
         "mm-harness call app.status --json",
@@ -101,7 +157,9 @@
         "Use either next or cases with default. call always uses next and a static ref; only call.params passes child inputs, and child output stays scoped under the call node.",
         "Graphs are acyclic. Put bounded polling inside actions, not backward edges. Each success path must prove its promised outcome. end.status supports pass, fail, or unknown; an unknown result is not proof of success."
       ],
-      "commands": ["mm-harness actions --action switch --json"]
+      "commands": [
+        "mm-harness actions --action switch --json"
+      ]
     },
     {
       "id": "quality",
@@ -114,14 +172,39 @@
         "Graph: no unconditional pass, generic intent, hidden start state, or opaque node that collapses preparation, action, assertion, evidence, and teardown.",
         "Assertion modes such as require_unchanged must fail before any corrective action. Verify the negative path leaves the inspected state untouched; an assertion must not repair the behavior it is supposed to test.",
         "Reuse structured reads with assert_output instead of adding a new domain action for every comparison: source names the earlier node, and assert can select $.matchingCount with operator eq and the expected parameter. A status-report action can succeed while reporting missing prerequisites; assert required values before the dependent action. Checking three rows exist does not prove there are exactly three, or that they belong to this task.",
-        "Evidence: inspect the recipe resolution, summary, trace, manifest, logs, and actual visual evidence. A filename or passing node is not visual proof. A container's presence does not prove its data loaded; tab content does not prove its selection indicator. Verify the values and visible state required by the claim.",
+        "Evidence: inspect the recipe resolution, summary, trace, manifest, logs, and actual artifacts. Verify the values and state required by the claim.",
         "For a change claim, compare the actual before/after values for the same subject. Two captures alone prove neither an update nor freshness. Preserve unchanged observations as unproven rather than retrying to obtain a pass.",
-        "Match capture to the claim. Extension ui.capture_surface records the browser document through Chrome, including below-viewport document content but not hidden nested-scroll contents or native dialogs. Keep viewport assertions separate, inspect every image, and preserve failed captures rather than reconstructing them from HTML.",
-        "Screenshots: establish the claimed state, capture it, and inspect the original file. If a displayed preview looks incomplete, verify stored pixels or local OCR before reporting a capture defect or changing code. Preserve genuine failed captures. Performance: define a measured window, exclude setup, and compare equivalent builds, devices, and lifecycle conditions; action duration alone is not app latency.",
+        {
+          "text": "Match capture to the claim. Extension ui.capture_surface records the browser document through Chrome, including below-viewport document content but not hidden nested-scroll contents or native dialogs. Keep viewport assertions separate, inspect every image, and preserve failed captures rather than reconstructing them from HTML.",
+          "adapters": [
+            "extension"
+          ]
+        },
+        {
+          "text": "Screenshots: establish the claimed state, capture it, and inspect the original file. If a displayed preview looks incomplete, verify stored pixels or local OCR before reporting a capture defect or changing code. Preserve genuine failed captures.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        "Performance: define a measured window, exclude setup, and compare equivalent builds, devices, and lifecycle conditions; action duration alone is not app latency.",
         "Retain samples and declared limits when a measurement fails. For memory growth, compare an equal-duration idle control before attributing it to navigation; do not raise the budget to make the run pass.",
         "Analytics: verify the collection destination and existing consent before capture. Changing participation or marketing consent requires operator approval and restoration of the prior settings; a recipe's hardcoded opt-in is not permission. Missing collection prerequisites are not missing product events.",
         "Flake risk: wait on observable state instead of sleeping, keep device and runtime identity explicit, and never overwrite a prior run's artifacts.",
-        "Mutation: require an independent state assertion and identity-bound receipt. Schedule authorized cleanup in teardown, verify its result, and report any residue. Testnet cleanup must not cancel another task's orders or close its positions."
+        "Mutation: require an independent state assertion and identity-bound receipt. Bind activity to that operation's accepted ID; an old row or nonzero count is insufficient. Opening and closing orders have different IDs. Schedule authorized cleanup in teardown, verify its result, and report any residue. Testnet cleanup must not cancel another task's orders or close its positions.",
+        {
+          "text": "An accepted order can fill before the UI updates. Preserve its receipt even when the expected resting-order assertion fails; one empty read does not prove cleanup. Check the read API's cache and freshness options before adding polling. Reconcile returned margin against the pre-placement balance. A successful close does not turn the original failed proof into a pass.",
+          "adapters": [
+            "extension"
+          ]
+        },
+        {
+          "text": "A filename or passing node is not visual proof. A container's presence does not prove its data loaded; tab content does not prove its selection indicator. Inspect the captured image and the values it needs to show.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        }
       ],
       "commands": [
         "mm-harness run ./proof.recipe.json --artifacts-dir temp/recipe-proof --json",
@@ -135,22 +218,92 @@
       "instruction": "Treat saved recipes as starting points, not compatibility guarantees. A failure starts diagnosis, not an automatic task stop. Preserve it, compare the current app with the task's acceptance criteria, and distinguish recipe drift from a product, harness, fixture, or live-dependency failure before repairing anything.",
       "details": [
         "The graph and evidence contract can be deterministic while the product, provider, account, or network outcome is not. Honest external rejection remains a valid result, not a reason to seek a green retry.",
-        "Trace the first failure through the exact action source and test the smallest causal explanation before filing or fixing a harness issue. Verify the visible screen as well as the route name; an old route identifier may now open a different screen. If a proposed fix outgrows the confirmed cause, preserve it separately and return to the minimal fix.",
-        "For blocked runtime proof, retain the target identity, build/app state, and first failing command and error. Reconcile later status snapshots with that evidence; they cannot establish that an earlier device was absent. Cold XCTest infrastructure belongs in explicit setup: consult agent-device help prepare using the same package, device and state directory. A preparation health check does not prove native snapshot or interaction latency.",
-        "A failed device-discovery probe is unknown availability, not proof that a simulator stopped. Inspect deviceDiscoveryErrors or DEVICE_DISCOVERY_FAILED and run its Next command before changing targets or restarting a runtime.",
-        "An RPC failure is not necessarily a credential or network failure. Distinguish an HTTP rejection from JavaScript execution errors and circuit-breaker cooldowns. Check build capabilities separately from remote rollout flags; do not reset a wallet to repair an unclassified failure.",
-        "For LavaMoat execution errors, inspect the effective bundled policy as well as the calling code. A nested method grant can change receiver binding. Reproduce the mechanism in isolation, then validate the owning product correction with LavaMoat still enabled; never replace fetch in the live worker to manufacture proof.",
-        "Use LaunchDarkly for feature rollout. Do not add local flag overrides to unblock validation. Match compile-time capabilities to the intended product build; if its remote rollout excludes the feature, report that prerequisite or request targeting from its owner.",
-        "For confirmed product-version drift, copy the closest recipe into the task and retain its working nodes. Adapt only the stale selector, route, input contract, or setup condition against current source and observed UI. Keep the task's acceptance criteria; do not rebuild a working journey or relax its proof to obtain a pass.",
-        "Inspect selection before toggling; skip already-satisfied setup. Visibility and a matching locator do not prove click readiness: a menu can move between press and release. Require an uncovered, stable target within the action budget, click once, then assert the result. If it fails, inspect the actual pointer target before changing locators. No fixed sleeps or repeated clicks.",
-        "Use test values distinct from the product's defaults so resets are observable. If an intentional transition reseeds a form, assert its documented reset contract using a recorded baseline; do not claim preservation because the chosen value happened to equal the default.",
-        "A loaded form shell is not a settled quote. Recheck every required preview condition after polling expires; stopping the wait must never turn missing fields into success. Verify this with a real unavailable-preview case and retain the failure.",
-        "After changing quote inputs, bind the returned quote to those inputs. A debounced request may leave the previous positive output and enabled CTA visible briefly; neither proves the new quote is ready. Inspect the capture too, and preserve stale/loading evidence instead of refreshing invisibly.",
-        "Native trees may include controls covered by developer or system overlays. Verify the screenshot before changing a selector; move or dismiss an overlay only as explicit setup and restore it afterward. Gesture path and delta values are offsets from the resolved start, not absolute endpoints; inspect the resolved coordinates and assert the resulting state.",
+        "Trace the first failure through the exact action source and test the smallest causal explanation before filing or fixing a harness issue. Check the product runtime too: security shims can change standard JavaScript behavior. Compute expectations independently from the verified contract, not host defaults. If a proposed fix outgrows the confirmed cause, preserve it separately and return to the minimal fix.",
+        "For blocked runtime proof, retain the target identity, build/app state, and first failing command and error. Reconcile later status snapshots with that evidence; they cannot establish the earlier runtime state.",
+        {
+          "text": "A failed discovery probe or native snapshot does not establish a stopped app or unsupported platform. Name the failing observation path. Inspect deviceDiscoveryErrors or DEVICE_DISCOVERY_FAILED and its Next command before restarting. Another supported observer must preserve the required visible identity, selection and ordering assertions.",
+          "adapters": [
+            "mobile"
+          ]
+        },
+        "An RPC failure is not necessarily a credential or network failure. Distinguish HTTP rejection, JavaScript errors and circuit-breaker cooldowns.",
+        {
+          "text": "If Chrome blocks an unpacked extension with ERR_BLOCKED_BY_CLIENT, inspect its status in that slot's chrome://extensions page before retrying app readiness. unsupportedDeveloperExtension can mean Developer mode is off. Use normal setup controls in the isolated QA profile; do not disable browser security, bypass policy, reset the wallet or treat a blocked page as a product failure.",
+          "adapters": [
+            "extension"
+          ]
+        },
+        {
+          "text": "For LavaMoat execution errors, inspect the effective bundled policy as well as the calling code. A nested method grant can change receiver binding. Reproduce the mechanism in isolation, then validate the owning product correction with LavaMoat still enabled; never replace fetch in the live worker to manufacture proof.",
+          "adapters": [
+            "extension"
+          ]
+        },
+        {
+          "text": "Use LaunchDarkly for feature rollout. Do not add local flag overrides to unblock validation. Match compile-time capabilities to the intended product build; if its remote rollout excludes the feature, report that prerequisite or request targeting from its owner.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        "For confirmed product-version drift, copy the closest recipe into the task and retain its working nodes. Adapt only the stale contract or setup condition against current source and observed behavior. Keep the task's acceptance criteria; do not rebuild a working journey or relax its proof to obtain a pass.",
+        {
+          "text": "Inspect selection before toggling; skip already-satisfied setup. Visibility and a matching locator do not prove click readiness: a menu can move between press and release. Require an uncovered, stable target within the action budget, click once, then assert the result. If it fails, inspect the actual pointer target before changing locators. No fixed sleeps or repeated clicks.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        {
+          "text": "Use test values distinct from the product's defaults so resets are observable. If an intentional transition reseeds a form, assert its documented reset contract using a recorded baseline; do not claim preservation because the chosen value happened to equal the default.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        {
+          "text": "A loaded form shell is not a settled quote. Recheck every required preview condition after polling expires; stopping the wait must never turn missing fields into success. Verify this with a real unavailable-preview case and retain the failure.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        {
+          "text": "After changing quote inputs, bind the returned quote to those inputs. A debounced request may leave the previous positive output and enabled CTA visible briefly; neither proves the new quote is ready. Inspect the capture too, and preserve stale/loading evidence instead of refreshing invisibly.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        {
+          "text": "Native trees may include controls covered by developer or system overlays. Verify the screenshot before changing a selector; move or dismiss an overlay only as explicit setup and restore it afterward. Gesture path and delta values are offsets from the resolved start, not absolute endpoints; inspect the resolved coordinates and assert the resulting state.",
+          "adapters": [
+            "mobile"
+          ]
+        },
         "Reconcile any earlier side effects before repeating a step; an unknown order or transaction outcome must not be resubmitted. Probe the repaired node with call or a small recipe, re-plan, then validate the full task-local recipe and affected callers. Continue the task when the repaired path is proven; report a blocker only when no supported, authorized path remains.",
         "Record the source recipe digest, tested product identity, repair, and fresh evidence. If the defect belongs to reusable harness code or bundled vocabulary, prepare a focused experimental-metamask-harness issue and open it when authorized. Put verified authoring lessons in version-matched harness help; keep task-specific evidence in the task and skills as thin workflow wrappers.",
         "Promote a repair only after it works on the tested version and current main, or declare and enforce its compatibility boundary.",
-        "Authoring guide: https://farmslot.io/docs/guides/write-a-recipe/ ; canonical field and graph contract: https://farmslot.io/docs/reference/recipe-protocol-v1/"
+        "Authoring guide: https://farmslot.io/docs/guides/write-a-recipe/ ; canonical field and graph contract: https://farmslot.io/docs/reference/recipe-protocol-v1/",
+        {
+          "text": "Verify the visible screen as well as the route name; an old route identifier may now open a different screen.",
+          "adapters": [
+            "mobile",
+            "extension"
+          ]
+        },
+        {
+          "text": "Cold XCTest infrastructure belongs in explicit setup: consult agent-device help prepare using the same package, device and state directory. A preparation health check does not prove native snapshot or interaction latency.",
+          "adapters": [
+            "mobile"
+          ]
+        },
+        {
+          "text": "Successful RPC does not prove asset discovery: for empty balances, inspect the active asset controllers and compare compiled capabilities with remote rollout flags. Harness or skills updates do not synchronize slot build fixtures; correct stale build settings at their source and rebuild explicitly without resetting the wallet.",
+          "adapters": [
+            "extension"
+          ]
+        }
       ],
       "commands": []
     }