@nurix/etna 0.19.41 → 0.19.42

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "c96b6524c5e6",
+    "fingerprint": "e47ee7aac58b",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/discover/codex/agents/api.toml

@@ -30,4 +30,28 @@ You collect a target's documented machine interface into `research/<target>/dime
 A one-paragraph headline (the API surface in a sentence) + endpoint-family counts + the auth model. Flag overlap with the packages/docs dimensions (the published SDK often wraps this API) and especially any drift vs. the session dimension's _observed_ wire surface, for synthesis.
 
 **Discipline:** the spec is the load-bearing artifact — capture it accurately, digest if huge. Redact any embedded keys/example tokens. A disabled-introspection or undocumented API is a finding, recorded as an Open question, not a guess.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the served spec **exactly as served** (`openapi.json` / SDL / introspection result) saved with `curl -o` — never a re-typed table; plus each probed endpoint's raw response body.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/codebase.toml

@@ -40,4 +40,28 @@ Return a **per-unit work-list** as a compact table so the main session can dispa
 Plus a one-paragraph headline of what the codebase reveals. The main session will dispatch readers that each write `raw/<unit>.md` (install/exports/key-files/architecture for that unit).
 
 **Discipline:** breadth over depth; digest large trees; never read or write secrets (scan `.env*`, config, fixtures for credentials and redact before quoting). An empty/over-large area is an Open question, not a guess.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the resolved manifests (`package.json`, `pyproject.toml`, lockfile summaries) and the structure map — the clone in `source/<target>/` is itself the artifact.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/community.toml

@@ -28,4 +28,28 @@ You collect a target's living signal into `research/<target>/dimensions/communit
 A one-paragraph headline (where the product is heading + its biggest acknowledged gap) + the top 3–5 themes. This feeds the competitive-positioning and product-features rollups.
 
 **Discipline:** themes over threads; cite representative examples, don't dump feeds. Respect rate limits and TOS. Mark anything paywalled/private as an Open question.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the changelog / issue / release payloads **as fetched** — JSON wherever an API exists (GitHub API, RSS, Featurebase/Canny), not only a themed digest.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/deployed-client-bundle.toml

@@ -50,4 +50,28 @@ Then Method / Findings (framework, build tool, route count, endpoint count — t
 Return a one-paragraph headline of what the deployed shell reveals — framework + build tool, route count, the shape of the API surface it calls, whether source maps were shipped (and the confidence that implies). **Cross-checks:** flag that `dimensions/_shared/api-path-catalog.md` and `dimensions/_shared/feature-flags.md` are the SHARED seam artifacts (§6, one physical file each) — `session`/`wire`/`distribution` append to the same files with `source: session | wire | distribution`, and evaluation owns the adaptive static-vs-observed diff. Surface any endpoint or flag that looks authed/internal but is statically declared in the unauth bundle — that gap is the dimension's highest-value output.
 
 **Discipline:** breadth over depth; digest large chunks, never paste them; check for a source map before string-mining (it upgrades confidence); REDACT every env value before any `raw/` write and log it in `_meta.redactions`; obey the seam rule — one canonical shared catalog name, never a private fork. An absent bundle, obfuscated route table, or missing source map is an Open question, not a guess.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the entry bundle itself (`curl -o raw/bundle.js`, gzip is fine) and any `.map` — the route table, API-path catalog and flag extracts are written **in addition**, never instead.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/distribution-artifacts.toml

@@ -55,4 +55,28 @@ Then write the per-type raw files that apply — `raw/{extension-manifest.md, el
 Return a **one-paragraph headline** of what the shipped client reveals — its declared hosts, permission surface, embedded vendor SDKs, and how much richer (or not) it is than the web app. The API paths and feature flags you appended feed the **seam rule (§6)**: your `dimensions/_shared/api-path-catalog.md` rows carry `source: distribution` so evaluation can run its adaptive diff against `deployed-client-bundle` (`source: bundle`), `session`, and `wire-capture`. The hosts and SDK list cross-check **infra-backend-fingerprint** (a host the binary calls that DNS/CT didn't surface is a finding); the runtime hosts also seed **wire-capture** targets (the binary says what it _might_ call; the capture says what it _does_).
 
 **Discipline:** EULA before extraction — restrictive license ⇒ Open question, never silent decompile. Manifests/strings only; no protected-logic reversing. Redact every embedded key before any `raw/` write (§7 rule 3). Digest large bundles (§5). A missing artifact type is a recorded gap, not a guess.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the manifests verbatim (`manifest.json`, `Info.plist`, `AndroidManifest.xml`) and the extracted file listing.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/docs.toml

@@ -32,5 +32,31 @@ You collect a target's docs into `research/<target>/dimensions/docs/`. Read `.cl
 
 A one-paragraph headline (the product's documented surface in a sentence) + the section list with page counts + anything that overlaps the api/packages dimensions (flag it so synthesis can cross-check).
 
-**Discipline:** distill, don't mirror. A 300-page docs site becomes a navigable map + the load-bearing content, not 300 verbatim files. Record paywalled/gated docs as Open questions.
+**Discipline:** distill **in addition to**, never instead of. Save each captured page's source form under `raw/pages/` (md or html, as fetched) — that is the evidence layer — and build the navigable map + load-bearing content as the narrative layer beside it (ingestion §5.1). A distilled section whose source page was never saved is unverifiable by the next run (§5.3).
+
+**Do not mirror the SITE:** A 300-page docs site becomes a navigable map + the load-bearing content, not 300 verbatim files. Record paywalled/gated docs as Open questions.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+each captured page's source form under `raw/pages/` (md or html, as fetched).
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/infra-backend-fingerprint.toml

@@ -61,4 +61,28 @@ Return a **one-paragraph headline** of the reconstructed backend — origin clou
 **Discipline:** read-only public recon — never scan, brute-force, or hit a non-public host; respect crt.sh/WHOIS rate limits and back off; redact any credential-shaped value before writing (contract §7 rule 3 — DSNs, verification tokens, embedded keys surfaced in headers/TXT). An unresolvable host or a missing sub-processor page is an Open question, not a guess.
 
 **Verify an absence before asserting it (contract §7 rule 10).** Before reporting any host as **NXDOMAIN / absent** — especially `api.<target>` or any host a sibling dimension (bundle / session / wire) reports actually hitting — re-resolve via a **second resolver** (`dig @1.1.1.1 <host>`, `dig @8.8.8.8 <host>`) **and** a direct `curl -sI https://<host>`. An HTTP 4xx/5xx response means the host **resolves** → report it **present**, not absent. A single negative resolver result is recorded as _tentative_, never stated as fact and never used to instruct sibling dimensions. Likewise, an _inferred_ backend engine (e.g. "looks like Hasura/Supabase from the CNAME") is phrased as an inference and yields to a runtime-observing dimension (`session`/`deployed-client-bundle`) that names the engine directly.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the raw `dig`, `crt.sh` and HTTP header responses as returned; the decoded table is the narrative layer beside them.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/packages.toml

@@ -27,4 +27,28 @@ You collect a target's installable artifacts into `research/<target>/dimensions/
 A one-paragraph headline (the package family in a sentence) + the package table + which packages are the core public API (so synthesis can anchor the SDK surface). Flag overlap with the docs api-reference and the codebase dimensions for cross-check.
 
 **Discipline:** the exports map + type defs are the load-bearing artifact — prioritize them over download-count trivia. Digest huge `.d.ts` to signatures. Redact any registry tokens.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+per package: the registry metadata JSON (`npm view <pkg> --json > raw/<pkg>.registry.json`, PyPI `/pypi/<pkg>/json`) and the `.d.ts` / exports surface as fetched.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/session.toml

@@ -38,4 +38,44 @@ Under `research/<target>/dimensions/session/`:
 A one-paragraph headline (the auth model + transport + the single most load-bearing wire finding) + the phase coverage + which passes ran. Flag drift between the _observed_ wire surface and the _published_ api/packages surface — that drift is the highest-value synthesis input. If Pass 2 was needed but not authorized, list the open write-side questions; never fabricate request bodies.
 
 **Discipline:** ethics first, always. Redact before writing. Confirm before any state change. No destructive actions. No exfiltration. A gap is an Open question, never a guess.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+≥3 verbatim envelopes as `raw/*.json` — the identity read, one canonical list read, and the primary write (request + response) — per ingestion §8.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
+
+## Visual capture (ingestion §5.5) — screenshot generously
+
+You drive a real browser, so you carry the visual-evidence obligation. **Capture continuously, not
+one-image-per-surface:** every surface, plus every materially different state within it — empty vs
+populated, modal/drawer open, dropdown expanded, error and validation states, permission/plan walls,
+loading/in-flight, and the before/after pair around any authorized state change.
+
+This is **not** scored — `screenshot_coverage` is a narrow Mode-5 floor. The beneficiary is the human
+reading this corpus weeks later for a purpose nobody anticipated. The product's past state is the one thing
+a later run genuinely cannot reproduce.
+
+**Redact in the DOM before the shutter** (`tradecraft.md` §1c) — a leaked pixel is undetectable afterwards.
+**Check the corners of the frame**, not just the content: support-chat widgets, toasts, presence avatars and
+member lists routinely carry *another human's* name and message. Then look at the saved image, and record
+`redacted: <what>` in `screens/_index.md` rather than a blanket zero-PII claim.
 '''

package/data/harnesses/discover/codex/agents/website.toml

@@ -33,4 +33,28 @@ You collect a target's public-facing site into `research/<target>/dimensions/web
 A one-paragraph headline (the positioning in a sentence) + the pricing tiers + the headline feature claims. Flag claims that should be cross-checked against the codebase/docs (marketing often over-claims) so synthesis can reconcile.
 
 **Discipline:** quote positioning verbatim; capture pricing precisely (numbers + limits); separate _claims_ from verified capability — the reconciliation happens in synthesis. Respect robots.txt and rate limits; this is read-only public crawling, not scraping at scale.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the raw HTML or extracted text per captured page, and the pricing table as structured data.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
 '''

package/data/harnesses/discover/codex/agents/wire-capture.toml

@@ -42,4 +42,44 @@ Then the captures + raw artifacts (per `discovery` Part C (wire-capture)):
 Return a **one-paragraph headline** of what the wire reveals — the real hosts contacted, the envelope/auth scheme, and the rung used (so the reader knows how much to trust it). Then a compact table of observed endpoints. **Flag the seam rule (§6):** every `api-path-catalog.md` row is `source: wire`, so evaluation can diff _actually-called_ (wire) against _statically-declared_ (`bundle` / `distribution-artifacts`) and _browser-observed_ (`session`) — a host or path the binary declares but the wire never hits is a finding, not noise; the inverse (called but undeclared) is a stronger one. If only rung 1 was authorized, say so and name what rungs 2/3 would unlock so the main session can request authorization.
 
 **Discipline:** lowest privilege first; never self-escalate the ladder; never install a CA or tap third-party traffic; never run Wireshark; redact every body before disk and log it in `_meta`. An unauthorized higher rung is an Open question, not an excuse to guess what the wire would show.
+
+---
+
+## Dump manifest (ingestion §5.3–5.4) — evidence before narrative
+
+**MUST land in `raw/` as verbatim, redacted files before this dimension may be `status: complete`:**
+the flow log itself (HAR or the tap's JSON export), not only the decoded narrative.
+
+Three rules bind this, and they override any instinct to summarise:
+
+1. **If you cite it, dump it (§5.3).** Every value that reaches your `_summary.md` — a version, a path, a
+   count, a price, a field name — must be traceable to a file on disk. **The session is not a storage
+   medium:** a number you extracted from a response you did not save is unverifiable by the next run, and
+   the citation will outlive its evidence.
+2. **Digest IN ADDITION, never INSTEAD (§5.1).** `raw/` is the evidence layer and may be unreadable;
+   `_summary.md` is the narrative layer. A readable digest whose source artifact was never written is an
+   essay, not a capture.
+3. **Size is a routing problem (§5.2).** Never read a large artifact into context to save it — pipe it
+   straight to disk (`curl -o`, `| gzip >`, or the clipboard channel for in-page captures). If you must
+   bound an unbounded source, record the bound in `_meta.sampling`. Context budget is never a reason to
+   discard evidence.
+
+**Self-check before returning:** count the verbatim files in `raw/`. Zero ⇒ the dimension is `partial`,
+regardless of how good the prose is.
+
+## Visual capture (ingestion §5.5) — screenshot generously
+
+You drive a real browser, so you carry the visual-evidence obligation. **Capture continuously, not
+one-image-per-surface:** every surface, plus every materially different state within it — empty vs
+populated, modal/drawer open, dropdown expanded, error and validation states, permission/plan walls,
+loading/in-flight, and the before/after pair around any authorized state change.
+
+This is **not** scored — `screenshot_coverage` is a narrow Mode-5 floor. The beneficiary is the human
+reading this corpus weeks later for a purpose nobody anticipated. The product's past state is the one thing
+a later run genuinely cannot reproduce.
+
+**Redact in the DOM before the shutter** (`tradecraft.md` §1c) — a leaked pixel is undetectable afterwards.
+**Check the corners of the frame**, not just the content: support-chat widgets, toasts, presence avatars and
+member lists routinely carry *another human's* name and message. Then look at the saved image, and record
+`redacted: <what>` in `screens/_index.md` rather than a blanket zero-PII claim.
 '''

package/data/harnesses/discover/harness.json

@@ -1,11 +1,11 @@
 {
   "harness": "discover",
   "name": "discover",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
-  "digest": "3272a670df3c"
+  "digest": "4ab9f67f0d67"
 }

package/data/harnesses/discover/rules/calibration.md

@@ -0,0 +1,219 @@
+# Calibration Reference — Blind Re-runs · Disposition · The Fleet Ledger
+
+The reference for the harness's **only external signal**. Everything else in this harness is self-assessment:
+collectors grade their own `confidence` and `completeness_pct`, Evaluation weights those self-grades, and
+Mode 5 scores the result against a checklist the same system authored. That loop can converge on a corpus
+that is confidently, well-provenanced, and wrong.
+
+**Calibration is the one procedure that can tell you whether any of it is true.** It re-derives claims a
+prior run published, blind, and records what survived.
+
+> **The measured position, as of 2026-07-28.** One target has ever been re-run (`emergent`, 2026-06-25 →
+> 2026-07-28). Of 16 claims re-tested: **7 refuted, 4 corrected, 5 confirmed** — a 44% flat-falsification
+> rate — and **4 of the 7 refutations came from lanes the prior run had graded `confidence: high`.** The
+> prior run had self-scored **88/100 "strong"** and `stopped_on: converged`.
+>
+> That is **n=1**. It is the entire empirical basis of this harness. Every rule in `.claude/rules/` is
+> currently a hypothesis with n=0 on any target it did not come from. The purpose of this file is to make
+> n grow.
+
+---
+
+## Two tiers — pick the one that will actually happen
+
+A metric too expensive to run leaves `n` at 1 forever. The cheap tier is the important one.
+
+| Tier | Cadence | Cost | What it measures |
+| --- | --- | --- | --- |
+| **A — Claim spot-check** | monthly | ~1 session, no full ingestion | the refutation rate, and whether `confidence` tracks truth |
+| **B — Full blind re-run** | quarterly, or when a rule set changes materially | a complete run | everything Tier A does, plus coverage drift and whether new rules changed behaviour |
+
+**Tier A is the default. Do not skip it waiting for capacity to do Tier B** — a monthly spot-check of 15–20
+claims across one target produces the regression that matters, and produces it twelve times a year.
+
+---
+
+## Selection — rotate, never choose
+
+**The target is selected by rotation, not by judgment.** Take the least-recently-calibrated target in the
+corpus root; break ties by oldest `captured_at`. Record the selection rule alongside the result.
+
+A human (or a run) choosing which target to re-check will choose the one it feels good about. That single
+substitution destroys the metric, because the sample stops being representative of the fleet and starts
+being representative of the harness's confidence — which is the very thing under test.
+
+---
+
+## THE BLIND RULE (this is what makes it evidence)
+
+**Capture first. Read the prior corpus only after your own observation is written down.**
+
+1. Select the target. **Do not open its corpus.**
+2. Draw the claim sample (below) — a list of *questions*, not answers. Someone or something other than the
+   re-deriving agent extracts the questions, or the questions are extracted mechanically from claim
+   anchors, so the sample carries no prior conclusions.
+3. **Re-derive each claim from the live product**, from scratch, recording what you observe and the method.
+4. **Only then** open the prior corpus and diff.
+
+> **This deliberately overrides `discovery.md` Step 00 for calibration runs.** Step 00 tells a run to find a
+> prior corpus, restore it, and reconcile against it — correct for a normal re-run, where the prior corpus
+> is a genuine corroboration lane and re-deriving everything from zero is waste. **It is wrong here.** A run
+> that reads the prior claim first will anchor on it: it will look for confirmation, find it, and report a
+> confirmation rate that measures its own suggestibility. Anchoring is the specific failure this protocol
+> exists to avoid, so for a calibration run Step 00 is deferred until after step 3, and the run records
+> `blind: true`.
+>
+> If a run cannot honestly attest that it re-derived before reading, it must record `blind: false` — and
+> the result is then a **consistency check, not a calibration**, and does not enter the ledger's refutation
+> rate.
+
+**Sampling the claims.** 15–20 per target, drawn to make the regression computable, not to be flattering:
+
+- **Stratify by the prior run's stated `confidence`** — roughly equal numbers of `high`, `medium`, `low`.
+  Without this the regression cannot be computed, and the regression is the point.
+- **Include the load-bearing ones** — claims a README headline rests on, and claims a reader would act on
+  (pricing, limits, guarantees, auth model, what the product can and cannot do).
+- **Include at least 3 negative claims** ("no public SDK", "no realtime layer", "not supported"). Negatives
+  are the harness's demonstrated weak spot: **5 of the 7 refutations in the one data point were negatives.**
+- **Exclude** anything whose truth cannot change and cannot be re-checked (a historical funding round).
+
+---
+
+## Disposition — five values, and the fifth is the one the old schema lacked
+
+Every sampled claim resolves to exactly one:
+
+| Disposition | Meaning | What it says about the harness |
+| --- | --- | --- |
+| **confirmed** | independently re-derived, same conclusion | the method worked |
+| **corrected** | right direction, wrong detail (a count, a version, a name) | the method worked; the reading was imprecise |
+| **refuted** | the claim was **wrong when it was made** | **the method failed — this is the signal** |
+| **stale** | the claim was **true when made; the product changed** | the method worked; the corpus has a shelf life |
+| **unverifiable** | cannot be re-checked now (surface gone, plan changed, gated) | no signal either way; excluded from the rate |
+
+> **`refuted` and `stale` are the distinction the original artifact had no slot for, and they mean opposite
+> things.** A high `refuted` rate means *the instrument is unreliable* and the rules need work. A high
+> `stale` rate means *the instrument is fine and the corpus decays* — which calls for shorter shelf-lives
+> and `volatility` tagging, not methodology changes. Conflating them makes the harness fix the wrong
+> problem. When you cannot tell which it is — no dated evidence either way — record **`refuted`**. The
+> conservative reading is the one that keeps the harness honest about itself.
+>
+> (Origin: `emergent/00-prior-run-reconciliation.md` — a genuinely good artifact whose section A had to be
+> titled *"REFUTED (prior claim was wrong, not merely stale)"* precisely because the schema gave it nowhere
+> else to put the distinction.)
+
+**The refutation rate** = `refuted ÷ (confirmed + corrected + refuted + stale)`. `unverifiable` is excluded
+from the denominator, and its count is reported so a shrinking sample is visible.
+
+---
+
+## The regression — the actual question
+
+For each calibration, record the disposition **against the prior run's stated confidence for that claim**:
+
+| prior confidence | n | confirmed | corrected | refuted | stale | refutation rate |
+| --- | --- | --- | --- | --- | --- | --- |
+| high | | | | | | |
+| medium | | | | | | |
+| low | | | | | | |
+
+**If `high` claims are refuted at a similar rate to `low` claims, the `confidence` field carries no signal
+and `ingestion.md` §3's method→confidence table is decorative.** That is the single most consequential thing
+this harness could learn about itself, and it is unknowable without this table.
+
+Also record refutation rate **by `method`** once n is large enough — that tells you which of the 17 methods
+in §3 are over-graded, which is directly actionable (a method's band gets lowered).
+
+---
+
+## Artifacts
+
+### Per calibration — `research/<target>/00-prior-run-reconciliation.md`
+
+Formalizes the shape `emergent` invented. **This file is part of the output contract** whenever a prior
+corpus exists.
+
+```markdown
+---
+target: <slug>
+reconciled_at: <YYYY-MM-DD>
+prior_run_date: <YYYY-MM-DD>
+prior_run_commit: <sha>
+prior_run_score: <n>
+tier: A | B                     # spot-check or full blind re-run
+blind: true | false             # false ⇒ consistency check only, excluded from the rate
+selection_rule: rotation        # or: named-by-user (record it either way)
+sampled: <n>
+confirmed: <n>
+corrected: <n>
+refuted: <n>
+stale: <n>
+unverifiable: <n>
+refutation_rate: <0-100>
+by_confidence:                  # the regression — REQUIRED
+  high:   { n: <n>, refuted: <n> }
+  medium: { n: <n>, refuted: <n> }
+  low:    { n: <n>, refuted: <n> }
+---
+
+## A. REFUTED — wrong when made        (claim · what was observed · lane that refuted it · prior confidence)
+## B. STALE — true when made, changed  (claim · what changed · evidence of the change being NEW)
+## C. CORRECTED — right, imprecise
+## D. CONFIRMED — independently re-derived
+## E. UNVERIFIABLE — and why
+## F. What this says about the METHOD  (which lanes/methods produced the refutations, and whether a
+                                        §3 confidence band should be lowered)
+```
+
+### Fleet-level — `research/_calibration/ledger.md`
+
+**The metric itself.** One row per calibration, accumulating across targets and time. This is the file to
+read when asking "does this harness work?" It is never rewritten, only appended to.
+
+---
+
+## What a result CHANGES (otherwise this is just bookkeeping)
+
+A calibration that produces a number and no action is theatre. Each outcome routes:
+
+| Finding | Action |
+| --- | --- |
+| A **method** shows a high refutation rate | lower its band in `ingestion.md` §3, and record the calibration as the origin |
+| **Negative claims** refute disproportionately | tighten the absence rules (`ingestion.md` §7 rule 10, `discovery.md` Part B) — the `blind_to:` direction |
+| `high` refutes ≈ as often as `low` | **the confidence field is not carrying signal** — this is a structural finding about the harness, and it goes to the user, not into a rule tweak |
+| A **rule added after the prior run** would have prevented a refutation | evidence the improvement loop works — record it, it is the only such evidence that exists |
+| A refutation recurs **after** a rule was added to prevent it | evidence a rule did **not** change behaviour; escalate to the user rather than adding another rule |
+| High **stale** rate | shorten shelf-life expectations and tag volatile claims; **not** a methodology problem |
+
+---
+
+## How to run one (Tier A, the monthly default)
+
+1. **Select** by rotation from `research/_calibration/ledger.md`. Record the target and the rule.
+2. **Extract the sample** mechanically — pull claim anchors from the target's `evaluation/*.md`, stratify by
+   the cited confidence, and write them as **questions with the answers stripped**.
+3. **Re-derive blind.** Do not open the corpus. Use whatever lanes the access vector allows; record method
+   and observation per claim.
+4. **Diff and disposition** each claim into the five values.
+5. **Write** `00-prior-run-reconciliation.md` (append a new dated section if one already exists — never
+   overwrite a prior calibration).
+6. **Append one row** to the fleet ledger, and update its running totals.
+7. **Route** every finding through the table above. Anything that becomes a rule change goes through the
+   normal Mode-5 approval gate.
+
+**Cost/state discipline is unchanged:** a calibration is read-only unless the user authorizes otherwise; a
+claim that can only be re-derived by spending money or mutating state is recorded `unverifiable` with the
+reason, never quietly exercised.
+
+---
+
+## How the harness uses this reference
+
+Calibration is a **cross-run process**, not a mode of a single run — nothing in Modes 1–5 triggers it, and it
+must not be folded into them (a run cannot calibrate itself; that is the circularity it exists to break).
+Mode 5 reads the fleet ledger as *context* when weighing a proposal — a rule contradicted by calibration
+data should not be promoted — but Mode 5 never writes to it.
+
+> **Do not attach calibration to the Mode-5 score.** The moment `refutation_rate` becomes a rubric input,
+> the run acquires an interest in the number, and the one uncorrupted signal in the system is gone. It
+> measures the **harness**, not the run. Publish it; never grade with it.

package/data/harnesses/discover/rules/tooling.md

@@ -0,0 +1,205 @@
+# Tooling Reference — Host Capability · Tiers · The Bright Line
+
+The reference for **Step 0** (`discover` harness, run once per corpus folder before Mode 1). Capture depth
+is bounded by host tooling most machines lack. This file carries the **tier lists** (what to recommend),
+the **ethics classification** (clean · gated · avoid), the **per-dimension gap map** (what a bare host
+cannot do), and the **install caveats** that have actually bitten.
+
+**Nothing here is ever installed automatically.** The harness detects what is present, recommends only what
+is missing, and records the result in `.claude/discover-tooling.json` so it never re-prompts in the same
+folder. The harness recommends; the user decides. A user who declines proceeds to Mode 1 on whatever is
+present — a missing capability is re-surfaced at the Mode 2 capability-gap checkpoint (`ingestion.md` §8),
+never silently degraded.
+
+A host almost always arrives strong on languages and package managers (node, pnpm, python, uv, cargo, gh,
+jq, ripgrep) and **bare on capture/analysis tooling**. That gap is the difference between a shallow capture
+and a deep one.
+
+---
+
+## The three classes (this is an ethics classification, not a convenience one)
+
+| Class | Meaning | Rule |
+| --- | --- | --- |
+| **clean** | passive / local-only; always in-bounds | recommend freely, offer the one-paste block |
+| **gated** | in-bounds **only** first-party / user-owned / opt-in — the user installs the CA, routes *their own* client, owns the keys | surface the command, **never run it for the user** |
+| **avoid** | crosses the harness bright line (active scanning, exploitation, third-party interception) | never recommend; listed so it is not added by reflex |
+
+The harness is for **spec-writing / integration / competitive analysis** — passive or first-party only,
+respecting TOS and robots (`ingestion.md` §7). No tool changes that; the gated ones simply need the user in
+the loop, exactly as `session` Pass-2 and `wire-capture` rung 3 do.
+
+---
+
+## Why this file matters more since the §5 rewrite
+
+`ingestion.md` §5 now requires **verbatim dumping** — the artifact lands on disk whole, and the digest is
+written *beside* it, never *instead* of it. The obvious objection is "a 6 MB spec is unusable." **These
+tools are the answer to that objection.** They are what make a verbatim corpus queryable, which is what
+makes dumping-not-digesting practical:
+
+| Instead of digesting… | Dump verbatim, then |
+| --- | --- |
+| a 6 MB OpenAPI spec → a hand-typed endpoint table | `curl -o raw/spec.json` → **spectral** to catalog, **oasdiff** to diff, **gron** to grep |
+| a 9 MB minified bundle → prose about the routes | `curl -o raw/bundle.js` → **webcrack** / **source-map-explorer** to read, **ast-grep** to query |
+| a HAR → a narrative of the calls | keep `raw/flows.har` → **gron** to flatten and grep |
+| a docs site → distilled sections only | keep the page sources → **trafilatura** / **pandoc** to render |
+| a package's exports → string-mined prose | `npm view --json` → **typescript + attw + publint**, **griffe** for Python |
+
+**A digest is a lossy compression you cannot undo; a verbatim artifact plus a query tool is lossless.**
+Recommend Tier 1 on that basis, not as a nice-to-have.
+
+---
+
+## Tier 1 — clean, install now (broad leverage)
+
+Highest-consensus, always in-bounds. Offer as one paste:
+
+```bash
+# Homebrew (CLI analysis + data-wrangling + web→text)
+brew install gron pandoc ast-grep scc universal-ctags oasdiff fd yq dasel monolith tokei sevenzip
+# Rust
+cargo install htmlq
+# Python (via uv — pipx is typically absent; uv tool install is the path)
+uv tool install trafilatura && uv tool install griffe
+# Node global (JS/TS surface + bundle de-obfuscation + spec lint)
+npm i -g webcrack source-map-explorer @arethetypeswrong/cli publint @electron/asar typescript @stoplight/spectral-cli
+# Headless browser for JS-rendered docs/marketing (clean — the user's own headless instance)
+npm i -g playwright && npx playwright install chromium
+```
+
+| Tool | Unlocks | Dimensions served |
+| --- | --- | --- |
+| **gron** | flatten any JSON → greppable/diffable `path = value` (specs, captures, manifests, HAR, configs) | **7** (codebase, api, session, bundle, infra, wire, cross-cutting) |
+| **trafilatura** | boilerplate-stripped main content + dates from HTML → clean markdown; feed/sitemap discovery | **4** (docs, website, community, infra) |
+| **pandoc** | deterministic HTML→GFM (headings, tables, code fences) at scale | 3 (docs, website, community) |
+| **ast-grep** | tree-sitter structural search/count across many files + langs (call sites, routes, exports) — catches what regex misses | 2 (codebase, bundle) |
+| **oasdiff** | structured breaking-vs-non-breaking OpenAPI diff — makes the published-vs-app-own diff machine-checked | 2 (api, cross-cutting) |
+| **webcrack** | un-minify / un-webpack / de-obfuscate SPA & Electron JS into readable modules | 2 (bundle, distribution) |
+| **scc** | instant LOC-by-language + complexity census of a fresh clone (JSON) — the codebase opening move | 1 (codebase) |
+| **universal-ctags** | real multi-lang JSON symbol index (the host's BSD ctags is broken for this) | 1 (codebase) |
+| **htmlq** | surgical CSS-selector extraction (pricing cards, feature tables) instead of regex | 1 (website) |
+| **source-map-explorer** | reassemble a shipped `.map` → original `src/` tree (the `source-map-reassembly` method) | 1 (bundle) |
+| **spectral** | validate/resolve an OpenAPI/AsyncAPI spec → structured endpoint/security/`$ref` catalog | 1 (api) |
+| **griffe** | extract a PyPI package's full public API (the `.d.ts` equivalent for Python) | 1 (packages) |
+| **@arethetypeswrong/cli + typescript + publint** | parse the real `.d.ts`/exports type graph + grade the publish surface (verbatim, not string-mined) | 1 (packages) |
+| **@electron/asar** | extract Electron `app.asar` → JS module tree (the distribution step the playbook names but cannot otherwise run) | 1 (distribution) |
+| **fd · yq · dasel · monolith · tokei · sevenzip** | gitignore-aware file discovery · YAML/XML/TOML query · RSS/XML→JSON · single-file page archive · LOC cross-check · multi-format extract | several |
+
+---
+
+## Tier 2 — gated, install when a run needs them (first-party / passive only)
+
+The capture lanes. In-bounds **only** for the user's own session, the user's own first-party clients, or
+passive sources. **Surface these; never run them for the user.**
+
+```bash
+brew install mitmproxy websocat grpcurl subfinder tlsx testssl jadx apktool
+npm i -g chrome-remote-interface get-graphql-schema
+# one-time, USER-RUN: expose a CDP port on the user's own Chrome (closes the WS-frame blind spot)
+#   open -na "Google Chrome" --args --remote-debugging-port=9222
+# mobile-only, the user's own device + explicit opt-in:  uv tool install frida-tools
+```
+
+| Tool | Unlocks | Ethics note |
+| --- | --- | --- |
+| **mitmproxy** | decode full HTTPS + WebSocket flows of any **first-party** client (CLI/desktop/mobile/SDK) — the `wire-capture` rung-3 keystone (`ingestion.md` §7.1) | user installs the CA and routes *their own* client only |
+| **chrome-remote-interface** | raw CDP → `Network.webSocketFrameReceived`/`Created`, SSE, full bodies — **captures the on-load WS frames the browser MCP's HTTP-only `read_network_requests` drops** | the user's own logged-in session |
+| **websocat** | curl-for-WebSockets: connect / frame / replay / hexdump a realtime endpoint outside the browser | first-party endpoint |
+| **grpcurl** | list services + invoke RPCs via gRPC server reflection → readable op/message catalog | first-party endpoint |
+| **get-graphql-schema** | introspect a first-party GraphQL endpoint → full SDL | first-party endpoint |
+| **subfinder · tlsx · testssl.sh** | passive CT/DNS subdomain breadth + structured TLS posture (vs hand-rolled crt.sh + openssl text) | passive aggregation; respect rate limits |
+| **jadx · apktool** | decompile Android `.apk`/`.dex` → Java + decode `AndroidManifest`/resources (capability map) | public binary; read the EULA first (`ingestion.md` §7.2) |
+| **frida-tools** | cert-pinning bypass to capture **the user's own** mobile client's wire | the user's own device + explicit opt-in only |
+
+> **The single biggest unlock for a realtime target** is `chrome-remote-interface` + a Chrome
+> `--remote-debugging-port` + `websocat` + `mitmproxy` together: they give `session`/`wire-capture` a real
+> WebSocket/SSE capture path instead of a client-side-remount workaround. The browser MCP's
+> `read_network_requests` is **HTTP-only** — that is *why* a realtime tap comes back empty until the remount
+> trick (`tradecraft.md` gotcha #13, `ingestion.md` §9.4). A CDP port removes the injection-timing problem
+> entirely rather than working around it.
+>
+> (Origin: Emergent — with no CDP port open, the run fell back to in-page taps. That worked, but a
+> post-boot `window.WebSocket` wrapper is structurally blind to a library socket opened at boot, and the
+> prior run published a false negative because of it.)
+
+---
+
+## AVOID — never recommend (this is the bright line)
+
+Out-of-bounds for a spec-writing / competitive-analysis harness. Listed so they are not added by reflex:
+
+- **`nmap`, `masscan`, `naabu`** — active port sweeps / service-version probing of remote hosts.
+- **`nuclei`** — template-based remote vulnerability scanning.
+- **`sqlmap`** — injection / exploitation.
+- **`amass` (active mode)** — active DNS brute-forcing. Its *passive* mode overlaps subfinder; prefer subfinder.
+- **`mitmproxy` or `frida` against a third party**, **`socat` as a public relay** — intercepting traffic the
+  user does not own is the line this harness will not cross.
+
+These stay absent **by design**. The recon ethics depend on it, and a tool absent from the host is a
+stronger guarantee than a rule telling the agent not to use it.
+
+---
+
+## Per-dimension gap map (what a bare host cannot do)
+
+| Dimension | Biggest capability gap on a bare host | Top addition(s) |
+| --- | --- | --- |
+| **codebase** | no LOC census, no AST search; the host's BSD ctags is broken for this | scc · ast-grep · universal-ctags (+ fd) |
+| **docs** | no HTML/MDX→md, no JS render → client-rendered docs come back empty | pandoc · trafilatura · playwright |
+| **packages** | the real `.d.ts`/exports surface is string-mined, not parsed | typescript + attw + publint · griffe (Py) · yq |
+| **api** | can fetch a spec but cannot lint / diff / introspect / exercise it | spectral · oasdiff · get-graphql-schema · grpcurl · websocat |
+| **website** | no JS render, no clean table/text extraction → misses pricing and feature grids | trafilatura · htmlq · playwright |
+| **community** | no clean changelog/blog→text, no RSS→JSON | trafilatura · pandoc · dasel |
+| **session** | **structurally blind to WebSocket/SSE frames** (HTTP-only MCP, no CDP port) | chrome-remote-interface · mitmproxy · websocat |
+| **deployed-client-bundle** | a minified/obfuscated blob stays opaque; no source-map reassembly | webcrack · source-map-explorer · ast-grep · gron |
+| **infra-backend-fingerprint** | shallow CT coverage, TLS posture by hand, sub-processor pages scraped raw | subfinder · tlsx · trafilatura (passive only) |
+| **wire-capture** | the keystone (mitmproxy) plus every non-browser replay/decode client is absent | mitmproxy · websocat · grpcurl |
+| **distribution-artifacts** | only CRX/Mach-O readable; no Electron or Android decoders | @electron/asar · jadx · apktool · webcrack · sevenzip |
+| **external-reputation / hiring-intel** | bot-walled review and ATS pages return 403 to plain fetch | playwright (own headless instance) · trafilatura · dasel |
+| **cross-cutting (synthesis)** | no structured diff for the N-way seam reconciliation; no out-of-band WS capture | gron · oasdiff · chrome-remote-interface · yq |
+
+---
+
+## Known install caveats (each of these has actually bitten)
+
+- **`webcrack` needs Node 22.** Its hard dependency `isolated-vm` is a native (node-gyp) addon that fails to
+  build against Node 26, and `--omit=optional` does not help — the dep is non-optional. Run it under a Node
+  22 LTS shim (`npx -y webcrack@latest …` in a Node-22 env), or lean on the already-clean
+  `source-map-explorer` (the preferred `source-map-reassembly` path whenever the SPA ships `.map` files)
+  plus `ast-grep`. De-obfuscating a **no-maps, minified** bundle is the only gap this leaves.
+- **`chrome-remote-interface` is a library, not a CLI.** It installs as a Node module and is invoked from a
+  script, not a shell binary. **Detect it with `npm ls -g chrome-remote-interface`, not `command -v`** — a
+  `command -v` probe reports it missing when it is installed, and the run then wrongly records a capability
+  gap.
+- **`pipx` is typically absent; use `uv tool install`** for Python CLIs (uv is present). Simpler than adding pipx.
+- **`playwright` is clean** — the user's own headless instance. It unblocks JS-rendered docs and marketing
+  for `docs` + `website` **without contending for the gated `session` Chrome**, which matters because the
+  browser is a singleton (`ingestion.md` §7 rule 9).
+
+---
+
+## How Step 0 uses this reference
+
+Once per corpus folder, before Mode 1. If `.claude/discover-tooling.json` exists, tooling was already
+reviewed here — **skip straight to Mode 1 and never re-prompt.** If it is absent:
+
+1. Read this file — the tier lists, the classification, the AVOID list.
+2. **Detect before recommending** — `command -v <tool>` per tool, and `npm ls -g <pkg>` for the Node
+   libraries that ship no binary (see the caveat above). Detection only; nothing is installed at this step.
+3. **Recommend only what is missing**, grouped **clean** (offer the Tier-1 one-paste block) vs **gated**
+   (surface the command, never run it). Never suggest anything on the AVOID list. If nothing is missing,
+   say so in one line.
+4. Write the state file so the harness never asks again in this folder:
+   ```json
+   { "checked": "<ISO date>", "present": ["gron", "pandoc"], "missing": ["mitmproxy"], "recommended": true }
+   ```
+
+The state file is **host-local** (tools live on the machine, not the repo) — gitignore it in a shared
+folder; delete it to force a fresh check after installing a batch. **This step never blocks a run.**
+
+> **Maintenance loop.** When a run hits a capability wall — a format nothing on the host can read, a
+> capture lane that needed a tool that was not listed, an install that failed in a new way — fold it back
+> in here: the tool into the right tier with its ethics class, or the failure into the caveats. This file
+> only stays useful if every new wall is recorded (the same loop `ingestion.md` §7.0 carries for redaction
+> patterns).

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.41",
+    "version": "0.19.42",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -41,5 +41,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "c96b6524c5e6"
+    "etnaFingerprint": "e47ee7aac58b"
 }