@orkestrel/scaffold 0.0.107 → 0.0.109

package/dist/host/agents/skills/orkestrel-harden/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: orkestrel-harden
-description: Research, audit, refactor, implement, centralize, test, document, and locally verify an individual Orkestrel TypeScript package to enterprise-grade production readiness under the repository's current AGENTS.md. Use when asked to fill missing or deferred capabilities, compare upstream or legacy implementations, salvage prior art, centralize source or test declarations, eliminate nested functions or superfluous wrappers, maximize declared @orkestrel dependencies—especially @orkestrel/contract—or add rigorous real-implementation and live-service tests. Select only the phases required by a narrow request; run the full workflow for production readiness or comprehensive hardening.
+description: Research, audit, refactor, implement, centralize, test, document, and locally verify an individual Orkestrel TypeScript package to enterprise-grade production readiness under the repository's current AGENTS.md. Use when asked to fill missing or deferred capabilities, compare upstream or legacy implementations, salvage prior art, centralize source or test declarations, eliminate nested functions or superfluous wrappers, maximize declared @orkestrel dependencies—especially @orkestrel/contract—or add rigorous real-implementation and live-service tests. Select only the phases required by a narrow request; run the full workflow for production readiness or comprehensive hardening. A guide, README, or TSDoc pass on one package runs the document phase alone.
 ---
 
 # Harden an Orkestrel package
@@ -11,10 +11,11 @@ description: Research, audit, refactor, implement, centralize, test, document, a
 
 ## Scripts
 
-| Script                 | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/discovery.ts` | `[--config vite.config.ts] [--projects a,b] [--json]`, run from the checkout root: let Vitest select each gate. Follow root npm script chains and forwarded arguments. Collect an unfiltered universe per config, mode, root, and directory, including the base config. For a root or directory without an explicit config, let Vitest resolve its config. Pass gate arguments verbatim and in order, including separator tokens; remove only reporter, output-file, coverage, color, cache, silent, UI, watch, run-mode, inspector, and standalone options, reading their spellings and arity from installed Vitest help. A listing that outlasts its time limit exits 2 naming its gate. Reuse identical listings and the universe for a gate with no arguments. Use `--filesOnly` for file selection; collect in full for name, tag, line, shard, allow-only, and strict-tag options. Add `--includeTaskLocation` to full listings and compare file, project, name, line, and column without folding browser names. Merge identities across units and retain repeated entries within a listing. Ignore bench, list, mergeReports, listTags, and clearCache invocations as gates. Accept a non-Vitest command that runs a test file directly. Flag partly ungated rows and undiscovered test files. Classify empty rows from Vitest listings; flag an empty project when a chain containing `>` names it, otherwise report a workbench. With `--projects`, let Vitest select the reporting scope and omit the undiscovered-file census. Retry a census when test files change in the workspace, gate roots/directories, or their `tmp/probes` workbenches; refuse changes during the retry. Read files, tests, gates, units, and marker counts in the result. Expect exit 0 with no findings, 3 with findings, 2 for missing Vitest, unsupported related commands, CLI/help/argument/listing/output failures, repeated test-file changes, or filesystem/JSON errors, and 64 on usage. Read the named gate and arguments when Vitest refuses a gate listing. |
-| `scripts/titles.ts`    | `--base REV [--root DIR] [--json] [--out FILE]`, run from the checkout root: list every literal `describe`, `it`, and `test` title of the `tests/**/*.test.ts` files at `REV` that the working tree's `tests/**/*.test.ts` files no longer carry as often, comparing exact title text. Balance each-table arguments over code tokens, skipping strings, templates, comments, and regex. Report a missing title that a working-tree `tests/**/*.ts` file holds as a string literal as moved, with that file. Expect exit 0 when no title is missing, 3 when one is, 2 on git, filesystem, lexical, or unbalanced each-argument refusal, and 64 on usage.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+Run each from the checkout root. Each script's opening comment owns its behavior.
+
+- `scripts/discovery.ts [--config vite.config.ts] [--projects a,b] [--json]` censuses which project collects each test file and which root script chain (a gate) reaches each project. It needs `npm ci` first. It flags a project whose tests no gate lists (ungated), a chained project that collects nothing (empty), and a test or spec file under `tests/` that no project collects and no `node` command runs (undiscovered). It reports without a flag the marker counts per file (`.todo`, `.skipIf`, `.runIf`, `.fails`, a `retry` or timeout option, a numeric timeout argument; `vitest/no-focused-tests` and `vitest/no-disabled-tests` refuse `.only` and `.skip`) and each workbench, an empty project no chain names. The reader rules every marker and reads the chain behind every workbench. Full collection passes `--staticParse=false` to evaluate runtime titles, setup modules, and shard selection. `--projects` lists only the named projects (an exact name never lists another; a name holding `*` or opening with `!` is a Vitest pattern and may reach beyond the names), exits 64 for a name no project matches without listing any other project, and skips the undiscovered scan. Exit 0 no flag, 3 a flag, 2 tool, listing, or option-table failure, 64 usage.
+- `scripts/titles.ts --base REV [--root DIR] [--json] [--out FILE.json|FILE.txt]` compares the `describe`, `it`, `test`, and `suite` titles of `tests/**/*.test.ts` against `REV`. It flags a title registered fewer times than at `REV` as missing, or as moved when another string literal in `tests/**/*.ts` spells it; the reader rules each moved row by reading its holder. It reports each registration whose title is no literal (dynamic), which the comparison cannot follow, and flags a file that registers fewer of them than at `REV` (lost dynamic). It cannot see a removed `.each` table row or a title registered through an alias such as a `test.extend` result. `--root` defaults to the working directory and may sit below the repository top; `REV` may not open with `-`. Exit 0 no missing or moved title and no lost-dynamic file, 3 any of them, 2 git, filesystem, or lexical refusal, 64 usage.
+- `scripts/measure.ts --rule ID [--options JSON] PATH...` counts one lint rule's hits over the named paths before the rule is enabled. It writes a variant config under `tmp/probes/lint/` that enables only that rule as an error beside the workspace's `plugins` and `jsPlugins` (so a `policy/` rule loads), runs the installed oxlint from the checkout root, and prints the total and the hits per file. A hit is a diagnostic whose code names the rule; another diagnostic, a parse error included, or a linter status other than a clean 0 or 1 refuses the count. `--options` is the rule's JSON options, an array spread after `error` or one value. The variant carries no `ignorePatterns` and no override, so it reads exactly the named paths. It needs `npm ci` first. Exit 0 no hit, 3 a hit, 2 the config or the linter cannot run or reports another diagnostic, 64 usage.
 
 ## Select the work lane
 
@@ -23,6 +24,7 @@ Choose the smallest lane that fully satisfies the request:
 - **Structural:** centralization, nested-function removal, wrapper cleanup, or test-infrastructure consolidation.
 - **Capability:** research and implement named missing behavior or upstream parity.
 - **Hardening:** perform the complete production-readiness workflow.
+- **Documentation:** a guide, README, or TSDoc pass on one package; it runs step 10 alone.
 
 A narrow structural request does not authorize unrelated API redesign. A hardening request does authorize fixing every verified in-scope defect and completing every in-scope deferred capability.
 
@@ -34,7 +36,9 @@ Load [centralization.md](references/centralization.md) for every structural lane
 
 Load [hardening.md](references/hardening.md) for the hardening lane and for any request involving concurrency, lifecycle pressure, security boundaries, real services/models, test discovery, or package inspection.
 
-Load [bindings.md](references/bindings.md) for a census or a sweep under `.claude/rules/typescript.md` § Bindings, together with [equivalence.md](references/equivalence.md).
+Load [document.md](references/document.md) for the documentation lane and for step 10 of every other lane.
+
+Load [bindings.md](references/bindings.md) for a census or a sweep under `.claude/rules/typescript.md` § Bindings, together with [equivalence.md](references/equivalence.md). Before a census item becomes a lint rule, count the rule's hits with `scripts/measure.ts`.
 
 Load [equivalence.md](references/equivalence.md) for a structural lane whose rewrite claims unchanged behavior, and cite it in the claims of the review that judges one.
 
@@ -44,19 +48,19 @@ Load [equivalence.md](references/equivalence.md) for a structural lane whose rew
 2. **Map before editing.** Trace public types, implementations, callers, tests, guides, exports, runtime boundaries, installed Orkestrel dependencies, and applicable legacy/upstream references.
 3. **Establish the intended contract.** Build a capability/defect matrix. Separate verified fact from inference. Mark each row implement, repair, retain, or exclude with a reason. The matrix is fixed at this step and is the campaign's definition of done: every later step serves a row, and work that serves no row belongs to the next campaign. The row set is fixed; the planned work that closes it is not. Re-baseline that work at each phase boundary per `.agents/orchestration.md`, which owns the step and its boundary with rescoping.
 4. **Design types first.** Update guide/spec intent and `*/types.ts` before implementation, under the root design laws. A contract that needs a compatibility shim is the wrong contract.
-5. **Implement completely.** Finish every in-scope branch and reuse the exact installed Orkestrel primitives whose semantics match. The root completion law decides what may not be left behind.
+5. **Implement completely.** Finish every in-scope branch and reuse the exact installed Orkestrel primitives whose semantics match.
 6. **Prove each defect before repairing it** per the defect rule in `AGENTS.md` § Work loop. A repair with no red-then-green record is unproven.
 7. **Consolidate.** Run the complete centralization and wrapper sweep. Update all call sites to the real symbol rather than leaving aliases or 1:1 delegates.
 8. **Challenge seams.** Add deterministic tests for invariants, boundaries, failures, lifecycle, cleanup, cancellation, concurrency, malformed or unexpected input, and resource pressure as applicable, under the test rules' real-implementation law.
-9. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, stable across the service's nondeterminism, and behaviorally meaningful. When the claim is that a foreign client can use this package, drive one representative real client end to end.
-10. **Document the final behavior.** Update the governing guide, examples, method tables, limitations, and parity coverage. Document architectural limits honestly.
+9. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, stable across the service's nondeterminism, and behaviorally meaningful. For a foreign-client claim, apply the seam row in [hardening.md](references/hardening.md) § Use real implementations.
+10. **Document the final behavior** per [document.md](references/document.md).
 11. **Audit completion.** Run `node .agents/skills/orkestrel-harden/scripts/discovery.ts` and rule on every flag and marker it reports, then inspect source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
 12. **Verify.** Run the repository-prescribed gates in order and inspect the generated outputs relevant to the request.
 13. **Review by the size gate, never by the author.** Run the review `.agents/orchestration.md` § Size gate names for the change, resolve every required finding, then rerun the affected scoped verification.
 
 ## Accept the result
 
-Do not accept “mostly complete,” “tests pass” without adequacy review, or a builder's self-report. Completion requires:
+Completion requires:
 
 - all requested capabilities implemented or explicitly proven out of scope;
 - red-then-green evidence for every repaired defect;
@@ -64,6 +68,6 @@ Do not accept “mostly complete,” “tests pass” without adequacy review, o
 - no unresolved centralization, wrapper, dependency-reuse, test-discovery, lifecycle, security, or text-integrity finding;
 - exact command evidence for every final gate.
 
-Completion is those conditions met, not the absence of anything further to find. When every row is closed and the gates are green, stopping is the correct action and the next campaign is the deliverable; a further pass over the same surface is a new instruction from the user, not a finding.
+Passing tests without an adequacy review, and a builder's self-report, are not completion evidence. When every row is closed and the gates are green, stop per `AGENTS.md` § Work loop.
 
-Report what changed, what evidence proves it, exact test/gate results, and any genuine residual risk. Do not call an in-scope omission “future work.”
+Report what changed, what evidence proves it, exact test/gate results, and any genuine residual risk.

package/dist/host/agents/skills/orkestrel-harden/references/bindings.md

@@ -15,28 +15,30 @@ Find candidates with the item's signatures, and rule each candidate by the item'
 - **Tool.** Run each signature with ripgrep's default engine, `rg -n`, and add `-U` where the item
   says a pattern spans lines.
 - **Ruling.** Treat a signature hit as a candidate, and rule it by reading its source. A text search
-  reports on text (`.claude/rules/quality.md` § Instruments); an AST pass over the TypeScript parser
-  is the exact instrument for `variables.assignments`.
+  reports on text (`.claude/rules/quality.md` § Instruments).
 - **Report.** Record each ruled candidate as `path:line`, the item's key, and the ruling.
 
 ## Run the controls
 
 Run an item's controls before trusting its clean result:
 
-1. Write each fixture of the item to a scratch file under `tmp/probes/census/`, named as the
-   fixture's label gives.
-2. Run the item's signatures over the scratch files, and record the hit lines of each file.
-3. Require every hit fixture to yield a candidate the reading keeps, and every clear fixture to yield
-   no candidate or only candidates the reading drops.
-4. Delete `tmp/probes/census/`.
+1. Run the `test:skills` script: `tests/agents/skills/orkestrel-harden/bindings.test.ts` reads this
+   document, compiles each signature as a JavaScript pattern, and matches each hit fixture against
+   its item's signatures, a `-U` signature over the whole fixture and the others line by line.
+   Repair a signature the test refuses before any later step.
+2. Read each hit fixture by the item's reading, and require it to keep a candidate. Write each clear
+   fixture of the item to a scratch file under `tmp/probes/census/`, named as the fixture's label
+   gives, and run the item's signatures over it. Require every clear fixture to yield no candidate or
+   only candidates the reading drops.
+3. Delete `tmp/probes/census/`.
 
 When a hit fixture yields no kept candidate, or a clear fixture yields a kept one, repair the
 signatures or the reading before you run the item over the checkout.
 
 ## Keys outside the census
 
-- Run no item for these keys: `variables.declarations`, `derivation.expression`,
-  `iteration.counter`, `try.helper`, `try.log`, `running.definition`, `lists.derived`, `logs.loop`,
+- Run no item for the **Variables** bullet; the lint rules it names decide it.
+- Run no item for these keys: `derivation.expression`, `iteration.counter`, `try.helper`, `try.log`, `running.definition`, `lists.derived`, `logs.loop`,
   `logs.scan`, `exemptions.reach`, `percall.entity`, `percall.lifetime`, `percall.relative`,
   `entity.home`, `entity.pointers`, `slots.route`, `slots.exclusions`, `resets.home`, `bound.read`,
   `bound.several`, `bound.selection`, `bound.latch`, `registry.clear`, `registry.scope`,
@@ -45,66 +47,6 @@ signatures or the reading before you run the item over the checkout.
   logs a `reduce` call returns. Read `bound.unit` through `bound.field`. Read `running.position`
   through `running.cell`, `bound.field`, and `registry.reads`.
 
-## `variables.assignments` (**Variables**)
-
-- **Precheck.** Run `\b(?:let|var)\s+[A-Za-z_$\[{]` first, and rule each hit in code, outside
-  comments and strings, under `variables.declarations`. Hold a parameter-only reading of this item
-  until every such declaration is ruled: after the precheck, a bare-identifier assignment can only
-  target a parameter, a `catch` binding, a declaration the precheck found, or a name TypeScript
-  refuses.
-- **Signatures.**
-  - Assignment statements: `(?:^|[;{}]\s*)\s*[A-Za-z_$][\w$]*\s*(?:[-+*/%&|^]|\*\*|<<|>>>?|\?\?|\|\||&&)?=[^=>]`.
-  - Guarded assignments: `(?:\)|\belse|=>)\s*[A-Za-z_$][\w$]*\s*(?:[-+*/%&|^]|\*\*|<<|>>>?|\?\?|\|\||&&)?=[^=>]`.
-  - Updates: `(?:^|[^.#\w$])[A-Za-z_$][\w$]*\s*(?:\+\+|--)` and `(?:\+\+|--)\s*[A-Za-z_$][\w$]*\b`.
-  - Destructuring targets: `^\s*\[[^\]]*\]\s*=[^=]` and `^\s*\(\s*\{[^}]*\}\s*=[^=]`.
-  - Declaration-free loop heads: `for\s*(?:await\s*)?\(\s*[A-Za-z_$][\w$]*\s+(?:of|in)\b`.
-- **Reading.** Keep a hit whose target resolves to a parameter of the enclosing function or to a
-  `catch` binding (**Variables**). Drop a parameter default on its own line, a public class field,
-  an enum member, a member update such as `++this.#count`, and a target the precheck found.
-
-Hit fixture, `variables.assignments.hit.ts`:
-
-```ts
-function normalizeName(name: string): string {
-	name = name.trim()
-	return name
-}
-
-function labelRow(label: string): string {
-	if (label === '') label = 'untitled'
-	return label
-}
-
-function mergeOverride(base: ProjectConfig, override?: ProjectConfig): ProjectConfig {
-	if (override !== undefined && 'command' in override && 'mode' in override) {
-		if (typeof override.mode !== 'string') {
-			throw new Error('The project invocation carries no string mode')
-		}
-		override = { mode: override.mode }
-	}
-	return override === undefined ? { ...base } : mergeConfig(base, override)
-}
-```
-
-Clear fixture, `variables.assignments.clear.ts`:
-
-```ts
-class Transport {
-	#count = 0
-
-	async readWithRetries(
-		url: string,
-		timeout: number,
-		spent: number[],
-		accept?: string,
-		binary = false,
-	): Promise<TextReadResult | BytesReadResult> {
-		const id = ++this.#count
-		return binary ? readBytes(url, timeout, spent, id) : readText(url, timeout, spent, id, accept)
-	}
-}
-```
-
 ## `running.carriers` (**Running values**)
 
 - **Signatures.**
@@ -196,12 +138,12 @@ Hit fixture, `running.cell.hit.ts`:
 
 ```ts
 function readLatest(
-	readings: readonly Reading[],
-	admit: (reading: Reading) => boolean,
-): Reading | undefined {
-	const latest: Reading[] = []
-	for (const reading of readings) {
-		if (admit(reading)) latest.splice(0, latest.length, reading)
+	samples: readonly Sample[],
+	admit: (sample: Sample) => boolean,
+): Sample | undefined {
+	const latest: Sample[] = []
+	for (const sample of samples) {
+		if (admit(sample)) latest.splice(0, latest.length, sample)
 	}
 	return latest[0]
 }
@@ -210,8 +152,8 @@ function readLatest(
 Clear fixture, `running.cell.clear.ts`:
 
 ```ts
-function readLast(readings: readonly Reading[]): Reading | undefined {
-	return readings.at(-1)
+function readLast(samples: readonly Sample[]): Sample | undefined {
+	return samples.at(-1)
 }
 ```
 
@@ -1523,7 +1465,7 @@ Clear fixture, `registry.form.clear.ts`:
 class ProcessSession {
 	readonly #goals = new Set<ProcessGoal>()
 	readonly #tickets = new Map<number, ParentTicket>()
-	#closing: Promise<void> | undefined
+	#shutdown: Promise<void> | undefined
 
 	async execute(goal: Goal, context: GoalContext): Promise<Product> {
 		if (this.#goals.size !== 0) throw new Error('The process cannot execute in its current state')
@@ -1537,8 +1479,8 @@ class ProcessSession {
 	}
 
 	close(): Promise<void> {
-		this.#closing ??= this.#close()
-		return this.#closing
+		this.#shutdown ??= this.#close()
+		return this.#shutdown
 	}
 
 	async #close(): Promise<void> {

package/dist/host/agents/skills/orkestrel-harden/references/centralization.md

@@ -57,14 +57,13 @@ isolated tests for declaration-only types, constants, barrels, or error definiti
 
 Before acceptance, prove:
 
-- no stray declarations remain in implementation files;
-- no non-exported or wrong-kind declaration remains in centralized files;
-- no prohibited nested function declaration or assignment remains;
+- `npm run lint:check` passes, which refuses a stray, unexported, or wrong-kind declaration in
+  `src/` and `app/`, and a prohibited nested function;
 - no duplicate or rename-only wrapper remains;
 - every move updated imports, barrels, guides, and tests;
 - test helpers are consolidated without over-generalizing one-off setup;
-- files are valid UTF-8 with no replacement characters, mojibake, unintended control
-  characters, or accidental trailing debris.
+- the policy sweep passes `.claude/rules/workspace.md` § Text integrity, and a reading of the diff
+  finds no mojibake or accidental trailing debris.
 
 Review the complete diff after formatting. Formatting cannot substitute for the structural
 sweep.

package/dist/host/agents/skills/orkestrel-harden/references/contract.md

@@ -1,5 +1,7 @@
 # Adopt `@orkestrel/contract`
 
+This reference governs adopting `@orkestrel/contract` in one package: the exact-package inspection, the overlap matrix, the wrapper-free refactor, and the strictness proofs.
+
 ## Inspect the exact installed package
 
 Never work from a remembered contract version or copied API list. Read:

package/dist/host/agents/skills/orkestrel-harden/references/document.md

@@ -0,0 +1,33 @@
+# Document one package
+
+This reference governs the guide pass for one package, `AGENTS.md` § Work loop step 6, which fixes when it starts. `.claude/rules/documentation.md` holds the law for guides, parity, and examples, and `.claude/rules/typescript.md` § Comments and API documentation holds the TSDoc shape. This file holds the steps and restates none of them.
+
+## Take the worklist
+
+1. Read the governing guide, the README, and the barrel of each environment the package publishes.
+2. Run `npm run test:guides`, read-only. Its drift report is the worklist for the Summary cells, titled examples, and tagline.
+3. List each export the change added, removed, or altered, and each guide section that names one.
+
+## Write each surface
+
+1. **Guide.** Update every guide the package owns: the `## Surface` and `## Methods` rows, patterns, limitations, and the `guides/README.md` indexes when a guide is added or removed.
+2. **README.** Set the pitch equal to the guide's tagline; keep the install and link lines in step with the shipped exports.
+3. **TSDoc.** Give each export the change touched the block `.claude/rules/typescript.md` § Comments and API documentation fixes, with fictional descriptive data in its `@example`.
+4. **Fences.** Import through the published specifier and run each example; read what it returns before writing the comment beside it.
+
+## Choose the rewrite direction
+
+Choose per drift row by the side you wrote in this pass.
+
+- Run `npm run test:guides -- --to guide` when the TSDoc block carries the wording to keep.
+- Run `npm run test:guides -- --to source` when the guide carries it.
+
+Run one direction at a time, then rerun the read-only command until the worklist is empty.
+
+## Read the prose last
+
+Re-read every changed sentence against what shipped, per `.claude/rules/documentation.md` § Parity. For each behavior claim, name the example or assertion that breaks when the claim goes false; add the assertion where none exists.
+
+## Close
+
+Run `npm run test:guides`, then the repository's format check, and report both exit codes with the guides, README, and files touched.

package/dist/host/agents/skills/orkestrel-harden/references/equivalence.md

@@ -30,7 +30,7 @@ reads:
 - `Array.from(source, mapper)` falls back to index access when `Symbol.iterator` is missing, so it
   returns where `for…of` threw a `TypeError`.
 - `source.values()` and the array methods read by index, so they accept a missing iterator and
-  bypass a replaced or closing one; `flatMap`, `filter`, `reduce`, `forEach`, `some`, and `every`
+  skip a replaced or closing one; `flatMap`, `filter`, `reduce`, `forEach`, `some`, and `every`
   skip a hole that `for…of` reads.
 - A spread copies every element first, so it reads past a hole or ahead of a throwing entry where
   the baseline threw at the earlier element.
@@ -44,5 +44,8 @@ yields more entries than `length` is truncated.
 
 Before a claim that a rewrite lost no test, run
 `node .agents/skills/orkestrel-harden/scripts/titles.ts --base REV`, where `REV` is the baseline
-revision. Restore each missing title, or rule its removal with the behavior it proved, and confirm
-each moved title by reading the registration that uses it.
+revision. Restore each missing title, or rule its removal with the behavior it proved. A moved row
+exits 3 like a missing one, because a literal that only spells the title (an assertion value, a data
+table) holds it too: read each moved title's holder, treat one that is no registration as missing,
+and add no exemption. The comparison cannot follow a dynamic row or see a removed `.each` table row;
+rule those by reading.

package/dist/host/agents/skills/orkestrel-harden/references/hardening.md

@@ -1,5 +1,7 @@
 # Production hardening
 
+This reference governs the hardening lane: the risk and seam matrix, real-implementation testing, live-service tests, lifecycle pressure, security paths, the test audit, and generated outputs.
+
 ## Build the risk and seam matrix
 
 List every boundary where assumptions can fail:
@@ -82,17 +84,19 @@ For every fetch, write, delete, extraction, path, protocol, or authentication bo
 
 ## Audit the tests themselves
 
-Run `node .agents/skills/orkestrel-harden/scripts/discovery.ts` for the discovery census: which project collects each file, which gate reaches each project, and where a file carries `.skip`, `.todo`, a conditional skip, a retry, or a timeout. Then verify:
+Run the discovery census, `scripts/discovery.ts` as `SKILL.md` § Scripts states (step 11 of the hardening lane): which project collects each file, which gate reaches each project, and where a file carries `.todo`, a conditional skip (`.skipIf`, `.runIf`), `.fails`, a retry, or a timeout. `vitest/no-focused-tests` and `vitest/no-disabled-tests` refuse `.only` and `.skip`. Then verify:
 
+- every intended test file is collected by the correct project, and the test counts and environments match the intent;
+- every project that collects tests has a gate: the census flags one no chain reaches as ungated, and a chained project that collects nothing as empty. A declared project that collects nothing and that no chain names is a workbench, reported without a flag; read the chain behind every workbench and rule it by its purpose, not by the exit code;
 - every flag the census reports is closed or ruled with a reason;
 - every marker it reports is justified;
-- no current-scope requirement is represented only by a todo;
-- assertions can fail for the defect they claim to catch;
+- no current-scope requirement is represented only by a todo or a placeholder;
+- assertions can fail for the defect they claim to catch, and fail rather than pass when their population is empty;
 - tests observe public outcomes rather than private implementation;
 - helpers do not reimplement production logic;
 - real cleanup runs even after assertion or setup failure.
 
-Collection evaluates every collected project's `setupFiles`, so the census runs each setup module's load-time work, and `--projects` narrows the report, never that listing. When a setup module contacts a live service at load, such as a `service` project's readiness gate in `tests/setupService.ts`, run the census only while an instance the run may contact is up and the service's address points at it; with the address on a closed port, that project's listing fails and the census exits 2 naming its gate.
+Collection evaluates the `setupFiles` of every project the census lists, so each listed project's setup module runs its load-time work; `--projects a,b` lists only the named projects, so a project outside the names never loads. When a setup module contacts a live service at load, such as a `service` project's readiness gate in `tests/setupService.ts`, run the census only while an instance the run may contact is up and the service's address points at it, or name the other projects with `--projects`; with the address on a closed port, a listed project's listing fails and the census exits 2 naming its gate.
 
 ## Inspect generated outputs
 

package/dist/host/agents/skills/orkestrel-harden/references/research.md

@@ -1,5 +1,7 @@
 # Research and capability audit
 
+This reference governs research for one package: the source order, focused reading, the capability matrix, and the conversion of evidence into design.
+
 ## Establish sources
 
 Use this source order: