@orkestrel/scaffold 0.0.33 → 0.0.35

package/dist/host/agents/orchestration.md

@@ -139,7 +139,7 @@ when the role file already pins it.
 | Creative design and alternatives         | `planner`                       | `planner`                     | Opus 5 (native / bridge)      |
 | Design-fit review and audit              | `reviewer`                      | `reviewer`                    | Opus 5 (native / bridge)      |
 | Objective analysis and correctness audit | `analyst`                       | `analyst`                     | GPT-5.6 Sol (bridge / native) |
-| Nontrivial implementation (objective)    | `codex` route `implementer`     | `implementer`                 | GPT-5.6 Sol (bridge / native) |
+| Nontrivial implementation (objective)    | `sol`                           | `implementer`                 | GPT-5.6 Sol (bridge / native) |
 | Nontrivial implementation (subjective)   | `implementer`                   | `implementer` route `opus`    | Opus 5 (native / bridge)      |
 | Bounded primary-source research          | `researcher`                    | `researcher`                  | Grok → Luna → Sonnet          |
 | Repository reconnaissance                | `scout`                         | `scout`                       | Grok → Luna → Sonnet          |
@@ -160,9 +160,8 @@ when the role file already pins it.
   has stepped past Grok. Record which step you are on.
 - `orkestrel` stays native because it carries the package catalog in its own role file. Sending its
   job to a bench means shipping that catalog across, which costs more than the bench saves.
-- One gap is open and recorded rather than improvised: the Sol implementer is still `codex` route
-  `implementer` while its Codex mirror has a named `opus` bridge. Closing it means deciding where
-  the shared Sol transport contract lives once two bridges follow it.
+- `codex` is the shared Sol transport contract, not a route. `analyst` and `sol` are the named
+  bridges; both bind that contract by reference and pin only their route and sandbox.
 - Opus and Sol roles use high effort. Native cheap-tier roles use low or medium. Bridge drivers use
   the cheapest tier that can run a CLI.
 - Never route orchestration or acceptance across a bridge.
@@ -202,6 +201,10 @@ Every role honours this floor. No dispatch may widen it.
   same class of defect through a new door, the search is following the frame rather than the
   defect. Bound the scope, then fan out independent lenses over disjoint slices in one pass.
   Parallelism is worth more here for the framing it breaks than for the wall-clock it saves.
+- Two lanes is the adversarial pass's FLOOR, not its shape. Where a subject has more seams than
+  two lanes can attack, fan out one lens per seam over disjoint slices, keep every lens blind and
+  clean-contexted, and number every slice's claims in one shared sequence. Change the lenses in a
+  successor round rather than repeating them.
 - Decompose by required context and independently verifiable acceptance criteria, not by task type.
 - Send instructions down fully specified. Return findings smaller than the context consumed.
 - Parallelize independent work. Serialize dependencies and shared-file contention.
@@ -366,10 +369,11 @@ The harness bridge names the concrete mechanism for each of these.
 - Send a decision taken mid-campaign to every unit already in flight whose brief it invalidates. An
   executor cannot see a change made after it was dispatched, so it writes the state its brief
   described and the defect surfaces as its own.
-- Treat brief and report files as unit evidence, not deliverables. Never commit them, and sweep
-  them when the campaign that produced them is accepted.
+- Treat the `tmp/` brief and report pair as ephemeral launch copies. **Bench laws** rule 4 owns
+  what is kept and what is swept; follow it there rather than deciding here.
 - Promote anything that must outlive the campaign into a durable artifact before the sweep — a
-  commit message, a guide, a rule, a retrospective. What is only in a swept file did not survive.
+  commit message, a guide, a rule, a retrospective. What is only in a swept file did not survive,
+  and a debrief that must quote the record verbatim has nothing to quote.
 
 ### Where campaign artifacts live
 
@@ -491,11 +495,17 @@ command that outlives the turn that started it. Every law here binds all of them
 - Write a multi-step chain to a script file and run the file. A chain composed inside one shell
   argument cannot be read back, corrected, or re-run, and the record of what actually ran is the
   argument text in a transcript rather than a file on disk.
+- On a Windows host this binds every program-carrying command, not only long ones. Heredocs,
+  `node -e`, `node -p`, `&&` chaining, and any argument carrying `${...}` trip the Git Bash
+  approval classifier and turn an unattended run into a manual approval prompt. Write the program
+  to a file, invoke the file, and keep each shell call one plain command.
 - Detach anything that must survive its launching shell with `setsid`. A backgrounded flow the
   harness reaps mid-step leaves the work half done and the exit status missing, and the reap looks
   identical to the step failing.
-- Size the cap from the observed high mark of comparable commands, plus an independently budgeted
-  gate allowance, plus explicit slack. Never size it from the estimate alone.
+- Size the cap yourself, from the observed high mark of comparable commands, plus an
+  independently budgeted gate allowance, plus explicit slack. Never size it from the estimate
+  alone. Never delegate it: a bridge starts with a clean context, holds no record of prior runs,
+  and can only guess. A cap-killed exec is indistinguishable from a real failure.
 - Run the first use of any CLI flag, subcommand, quoting form, or stdin combination in a throwaway
   probe. Never inside a dispatched unit or a publish chain.
 - A launch is not a launch until its record grows past its header. Confirm the log advanced beyond
@@ -575,9 +585,11 @@ transport.
 4. **Ephemeral streams, durable records.** A journal proves a bench is alive and recovers an
    interrupted session. Keep journals under `tmp/`, never commit them, and sweep them at acceptance
    after the final gate evidence is recorded. The **brief**, the returned **distillate**, the
-   **audit verdict**, and the **acceptance evidence** are not streams. Commit each one as its unit
-   is dispatched and as it returns, because each encodes knowledge that costs real money to
-   re-derive and none of it is reproducible from the diff.
+   **audit verdict**, and the **acceptance evidence** are not streams. Copy each into
+   `.orkestrel/<package>/` and commit it as its unit is dispatched and as it returns, then sweep
+   only the `tmp/` copy. None of it is reproducible from the diff, and a debrief has no primary
+   source without it. This rule owns retention for the whole contract; **Dispatch anatomy**
+   points here rather than answering it.
 
 ### Recovering a dark bench
 
@@ -641,6 +653,10 @@ and propagates as files rather than as a cascade.
   prove that target's gates still green. `repair` restores `tests/setupPolicy.ts` and
   `tests/policy.test.ts`, so a vendored-only release can turn a green target red. A target bumps
   only when its own published surface moved.
+- Keep a target's own Claude permissions in `.claude/settings.local.json`, never in the vendored
+  `.claude/settings.json`. `repair` restores the vendored copy, so a `defaultMode` or an `allow`
+  entry added there is reverted without warning and the operator loses grants they set
+  deliberately. Change the vendored file only here, in the host inventory.
 - Never edit a vendored file inside a target. `repair` restores it, so the edit is reverted and
   reports as drift in `scaffold audit`. In this repository those same files are the published
   `dist/host` surface, so editing one forces a bump, a publish, and a re-propagation across every

package/dist/host/agents/skills/orkestrel-build-application/references/application.md

@@ -35,8 +35,8 @@ include app/core so shared transport contracts have one host-independent owner.
 - Types, constants, helpers, validators, parsers, and factories live in their
   centralized kind files; an implementation file holds one class plus imports.
   `ApplicationServerRunner` lives alone in `ApplicationServerRunner.ts` and
-  `startApplicationServer` in `factories.ts`; `main.ts` owns no reusable
-  declarations.
+  `startApplicationServer` in `handlers.ts`, because `factories.ts` admits only
+  `create`-prefixed construction; `main.ts` owns no reusable declarations.
 - Enforcement is layered, and each layer owns exactly what it can express:
   - `.oxlintrc.json` `no-restricted-imports` owns **literal-string** declared
     package, alias, and conventional relative imports, in both directions.

package/dist/host/agents/skills/orkestrel-debrief/SKILL.md

@@ -16,7 +16,8 @@ Read the current files in this order:
    before auditing the agent/rule/skill/process layer;
    [field-testing.md](references/field-testing.md) before running or judging a live field
    pass of an agent-facing surface.
-4. `guides/README.md`, the governing guides for what the campaign built, and `ROADMAP.md`.
+4. `guides/README.md`, the governing guides for what the campaign built, and `ROADMAP.md` when
+   the repository keeps one.
 
 The user's current instruction wins. The debrief judges the artifact and the process that
 produced it; neither is exempt. Capture successes as deliberately as mistakes, and codify

package/dist/host/agents/skills/orkestrel-falsify/SKILL.md

@@ -75,6 +75,16 @@ nobody claimed.
   engine is dark; do not restate them here.
 - A round run with one lane is a deviation. Record it rather than glossing it. If an engine is
   unavailable, the remaining engine runs both lanes — it never drops one.
+- **Pair every finder with an independent refuter when the round fans out past two lanes.** The
+  refuter receives one slice's findings, never that finder's work, and is briefed to BREAK them
+  rather than to re-audit the subject. It reproduces each stated vector itself and defaults to
+  refuted when uncertain.
+- Refute on any of six grounds, and name which: the vector does not reproduce; the behaviour is
+  correct and documented; it is unreachable through the public API or a documented seam; it asks
+  for new capability rather than naming a defect; it restates a finding an earlier round
+  repaired; or its diagnosis is wrong — then CONFIRM with the correction.
+- Only a survivor earns a fix unit. An unrefuted finding is a hypothesis. The two scope grounds,
+  unreachable and new capability, are what keep a round from drifting into a redesign.
 - **Give every auditor the means to run its attacks.** A lens that can only read returns derivations,
   and a derivation reads exactly like a verdict — it will confirm a claim that one probe would break.
 - **Tell each auditor exactly where a probe may live, and verify that place works before you say it.**
@@ -87,8 +97,9 @@ nobody claimed.
   concurrent auditor a distinct filename that already satisfies the repository's test naming
   convention; never invent a prefix to dodge collisions, and never let two auditors claim one path. A
   probe left in the mirrored suite is discovered and fails a run nobody else caused.
-- **Run auditors concurrently only when their writes cannot collide.** Read-only lenses still write
-  probes; give each a distinct path and forbid whole-project runs, or serialize the round. **This binds
+- **Run auditors concurrently only when their writes cannot collide.** A lens that can execute
+  still writes probes; give each a distinct path and forbid whole-project runs, or serialize the
+  round. **This binds
   the orchestrator too:** a tree-wide gate run while a round is live sees the auditors' in-flight probes
   and reports a failure nobody caused. Wait for the round, or scope the command to paths no auditor
   owns. Never delete another executor's working file to make your own command pass.
@@ -97,7 +108,14 @@ nobody claimed.
   and where the pass cannot avoid it, naming it is what recovers the round. A clean pass on its own
   engine's work is the least valuable result a lane can return.
 - Supply the evidence the subject type requires, per the table above.
-- Auditors are read-only and spawn nothing.
+- Auditors edit no source and spawn nothing. Read-only describes the SUBJECT, never the lane's
+  tools.
+- **Read the lane's allowlist before writing its brief.** A lane with no write tool cannot create
+  a probe; a lane with no exec tool cannot run one or read `git`. Naming either stops the unit on
+  arrival over a detail the allowlist already settled.
+- Where the lane cannot execute, run the probe yourself, record its control and its output, and
+  supply that record as the lane's evidence. The Orchestrator produces, the lane rules. Never
+  widen a lane's tools to fit a brief.
 - Blind reports are **immutable**. Nothing an auditor returns is edited, merged, or revised — by
   anyone, including the auditor — once it has been returned.
 

package/dist/host/agents/skills/orkestrel-falsify/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: 'Falsify Finished Work'
+  short_description: 'Run an adversarial audit round that tries to break named claims'
+  default_prompt: 'Use $orkestrel-falsify to audit the work that looks finished: numbered falsifiable claims, blind lanes, independent refutation, reconciliation, one ruling.'

package/dist/host/agents/skills/orkestrel-falsify/references/brief.md

@@ -1,7 +1,7 @@
 # Writing the claims brief
 
-The brief decides the round. Every weak audit this process has produced was a weak brief read
-faithfully; every finding worth having came from a claim written sharply enough to be attacked.
+The brief decides the round. An auditor reads it faithfully, so a claim too vague to attack
+returns a confirmation that proves nothing. Write every claim sharply enough to be broken.
 
 ## Anatomy
 
@@ -48,11 +48,11 @@ A successor brief:
 - **states what changed in the brief itself**, so a reader can see which claims are new;
 - **adds claims that attack the previous round's own rulings.**
 
-That last one is the highest-yield idea in this process. A fix round makes _decisions_ — it rules
-that some input should be refused rather than carried, that some widening is deliberate, that some
-site is sound and needs no change. Those rulings are the freshest and least-examined surface in the
-package, and they were made by the engine least able to see their consequences. Write a claim for
-each one.
+Attack the previous round's rulings first. A fix round makes _decisions_ — that some input is
+refused rather than carried, that some widening is deliberate, that some site is sound and needs no
+change. Those rulings are the freshest and least-examined surface in the package, and the engine
+that made them is least able to see their consequences. Write a claim for each one. Expect a
+repair to carry the next defect; a round that finds them is converging, not failing.
 
 ## Claims that repeatedly find things
 

package/dist/host/agents/skills/orkestrel-falsify/references/reconcile.md

@@ -14,8 +14,7 @@ claim by hand, against the built output, before it enters a fix brief.
 **Build the hostile input outside the `try`.** A probe that wraps construction and invocation in one
 catch cannot distinguish _the subject threw_ from _my harness threw_ — a missing import, a wrong
 arity, a `require` in an ESM context all surface as the finding you were hoping to see. Construct
-first, let harness failures crash loudly, and only guard the call under test. Every campaign that has
-run this process has produced at least one finding that was the instrument failing.
+first, let harness failures crash loudly, and only guard the call under test.
 
 Reproduction produces three outcomes, and all three matter:
 
@@ -24,6 +23,10 @@ Reproduction produces three outcomes, and all three matter:
 - the finding **confirms but is bounded smaller** — real, and not where the auditor thought;
 - the finding **evaporates**, because the auditor's input could not exercise what it claimed to test.
 
+Separate a dead finding from a dead vector before evaporating anything. A reported vector the
+compiler rejects refutes the vector alone; re-derive one the types admit, and record which vector
+was actually tested.
+
 The same reproduction discipline applies to your own probes. A probe whose input cannot reach the
 code under test reports a pass that means nothing, and it will read exactly like a real pass.
 
@@ -101,6 +104,11 @@ Find the rule that fits both. It is usually about **agreement** rather than abou
 a reader reads, its answer must carry — and it dissolves the special cases rather than enumerating
 them.
 
+Measure a proposed fix before adopting it; it is itself a claim. Run it against the set it must
+not break, including every case an earlier round pinned. Where it fails that set, document the
+limit on the helper that owns it and pin the limit with a test that names it as one. A heuristic
+that trades one wrong answer for another fails quietly; a stated boundary does not.
+
 Where the choice is genuinely open, it is a design judgement with a subjective and an objective
 half, and it goes to a blind design pass before code. Ruling it unilaterally is how a fix round
 becomes the next audit's finding.

package/dist/host/claude/agents/analyst.md

@@ -43,9 +43,9 @@ Everything `.agents/orchestration.md`'s dispatch contract requires, plus:
 
 An audit or analysis unit is long work. **Do not launch it.** Draft the brief to
 `tmp/codex/<unit>-brief.md`, resolve the command per `codex.md`, and return the brief path, the
-exact resolved command, the journal path, and a cap recommendation. The Orchestrator launches it as
-a tracked background command under a hard cap, so the harness owns the lifecycle and a wedged bench
-dies loudly instead of silently. Never detach a run, poll, restart, or kill one.
+exact resolved command, and the journal path. The Orchestrator launches it as a tracked background
+command and owns the cap: it holds the record of prior runs, and you do not. Never detach a run,
+poll, restart, or kill one.
 
 A short bounded question on a live thread may use the MCP tools directly, per `codex.md`'s
 work-class rule. Persist the thread id the moment a response carries it.
@@ -53,7 +53,7 @@ work-class rule. Persist the thread id the moment a response carries it.
 ## Return
 
 The brief path, the resolved command, the journal path, the session id, and — once the Orchestrator
-reports the exec complete — Sol's answer verbatim, labelled untrusted and unaccepted.
+reports the exec complete — Sol's answer verbatim, labelled untrusted and unaccepted. Never a cap.
 
 Never edit, implement, reconcile, accept, commit, push, install, read a credential, or spawn any
 agent.

package/dist/host/claude/agents/codex.md

@@ -1,6 +1,6 @@
 ---
 name: codex
-description: 'GPT-5.6 Sol transport contract and the implementer route: writes one bounded unit in the main checkout as the sole serial writer. The analyst route has its own named role in `analyst`; this file remains the transport contract both routes follow. Never accepts its own output.'
+description: 'The GPT-5.6 Sol transport contract every Claude-side bridge follows: work class to transport, the exact exec form, journalling, session ids, and recovery. Reach a route by its own name — `analyst` for audit, `sol` for implementation. Never dispatched directly for work.'
 tools: Bash, Read, Grep, Glob, mcp__codex__codex, mcp__codex__codex-reply
 model: sonnet
 effort: low
@@ -52,9 +52,9 @@ never travel as shell arguments. Return the exact resolved command with a pointe
 
 `timeout <cap> codex exec --json -C <working-directory> --sandbox <route-sandbox> --model gpt-5.6-sol -c "model_reasoning_effort=\"high\"" --output-last-message tmp/codex/<unit>-last.md "Read and execute the brief at tmp/codex/<unit>-brief.md exactly. Your final message must be the report it specifies." < /dev/null > tmp/codex/<unit>.jsonl`
 
-- Return four things: the brief path, that resolved command, the journal path, and a cap
-  recommendation with its basis — the observed duration high mark for this work class,
-  plus an independently budgeted gate allowance, plus explicit slack.
+- Return three things: the brief path, that resolved command, and the journal path. Leave
+  `<cap>` unresolved — the Orchestrator owns it, per **Long-running commands → Launching**
+  in `.agents/orchestration.md`. You hold no record of prior runs.
 - Never launch, background, poll, sleep-loop, restart, or kill an exec.
 - Keep `< /dev/null`. A background-launched exec that inherits an open stdin pipe wedges
   before its first event, and only the cap ever surfaces it.

package/dist/host/claude/agents/grok.md

@@ -54,10 +54,10 @@ Write that chain to `tmp/cursor/run.sh` and run the file, so the resolution, the
 journalling are one artifact the next run reuses.
 
 Run that yourself only for a short bounded ask finishing in about two minutes. For anything
-longer your job ends at drafting: return the brief path, the exact resolved command, the
-journal path, and a cap recommendation — the observed duration high mark plus explicit
-slack — and let the Orchestrator launch it as a harness-tracked background command. Never
-detach a run and end your turn; an unowned run has no completion signal and no death notice.
+longer your job ends at drafting: return the brief path, the exact resolved command, and the
+journal path, and let the Orchestrator launch it as a harness-tracked background command under
+a cap it owns. Never recommend a cap — you hold no record of prior runs. Never detach a run and
+end your turn; an unowned run has no completion signal and no death notice.
 
 ## Brief and containment
 

package/dist/host/claude/agents/sol.md

@@ -0,0 +1,56 @@
+---
+name: sol
+description: 'GPT-5.6 Sol implementation of one bounded nontrivial unit, reached by name rather than by a remembered route. The objective mirror of the Opus `implementer`; favours constraint-heavy, mechanical-precision units. Never accepts its own output.'
+tools: Bash, Read, Grep, Glob, mcp__codex__codex, mcp__codex__codex-reply
+model: sonnet
+effort: low
+permissionMode: default
+---
+
+You are the named Claude-side bridge to the Sol `implementer`. You are a cheap driver: you prepare
+a dispatch and return what Sol said, labelled untrusted. You never implement, judge, reconcile, or
+endorse the result yourself.
+
+Read `.agents/orchestration.md` first.
+
+## Transport, sandbox, journalling, recovery
+
+`.claude/agents/codex.md` owns the Sol transport contract in full — work class to transport, the
+exact `codex exec` form, the journal and session-id discipline, the recovery ladder, and the
+Windows notes. **Read it and follow it.** It is not restated here; two copies of a transport
+contract drift, and the one you are not reading is the one that is right.
+
+This role pins the one thing that file leaves to the dispatch: **the route is `implementer`, and
+its sandbox is `workspace-write`.** A unit that needs no write is a misrouted unit — stop and
+report, do not switch routes.
+
+## What the brief must contain
+
+Everything `.agents/orchestration.md`'s dispatch contract requires, plus:
+
+- Owned files, shared and off-limits files, and the acceptance criteria that close using owned
+  files alone.
+- The `AGENTS.md` non-negotiables, the applicable rules, and the governing guide or spec. An
+  external delegate carries no exemption.
+- **Every authority the brief references must exist in the tree the exec is rooted in.** Check
+  before dispatch. A brief citing a file the executor cannot find delivers nothing while looking
+  like authority, and it fails silently.
+- The deviation contract, scoped: a conflict with the primary objective stops the unit; an
+  ancillary conflict is the executor's to decide, record, and carry on from.
+
+## Launching
+
+An implementation unit is long work. **Do not launch it.** Draft the brief to
+`tmp/codex/<unit>-brief.md`, resolve the command per `codex.md`, and return the brief path, the
+exact resolved command, and the journal path. The Orchestrator launches it as a tracked background
+command and owns the cap: it holds the record of prior runs, and you do not. Never detach a run,
+poll, restart, or kill one.
+
+Writing units are strictly serialized. Never run beside another writer in the same checkout.
+
+## Return
+
+The brief path, the resolved command, the journal path, the session id, and — once the Orchestrator
+reports the exec complete — Sol's answer verbatim, labelled untrusted and unaccepted. Never a cap.
+
+Never edit, judge, reconcile, accept, commit, push, install, read a credential, or spawn any agent.

package/dist/host/claude/rules/application.md

@@ -48,9 +48,11 @@ paths:
 - Give app/server process signals to a tested, explicitly stoppable,
   generation-safe runner whose stale failures cannot release a newer run.
 - Return the runner from convenience startup, so normal cleanup cannot be hidden.
-- `ApplicationServerRunner` lives alone in `ApplicationServerRunner.ts`. The
-  `startApplicationServer` convenience factory belongs in `factories.ts`. `main.ts`
-  invokes it and owns no reusable declarations or duplicated signal handling.
+- `ApplicationServerRunner` lives alone in `ApplicationServerRunner.ts`.
+  `startApplicationServer` belongs in `handlers.ts` beside the other process-lifecycle
+  functions, because `factories.ts` admits only `create`-prefixed construction and this
+  one starts a signal-owning resource. `main.ts` invokes it and owns no reusable
+  declarations or duplicated signal handling.
 - Do not add showcase, auth, storage, proxy, CSS framework, or other product
   policy unless the request requires it.
 - Test repeated lifecycle, concurrent calls, malformed environment input,

package/dist/host/claude/rules/documentation.md

@@ -22,7 +22,7 @@ Documentation is an enforced contract, not explanatory decoration. The Writing r
 - Read the matching spec/guide before code, form the intended design, then compare implementation. Existing code is a verification target, not ground truth.
 - `AGENTS.md` and its linked rules are the sole convention source. Do not create competing instruction copies in guides.
 - `guides/README.md` is the map: maintain both a concept index and a directory index. The concept index runs `spec ↔ source ↔ tests ↔ showcase` minus every column whose subject this workspace lacks, so an app-only workspace that publishes no library and builds no showcase still owes a full index over the columns it has.
-- `ROADMAP.md` is the sequenced plan of record. Each chunk reaches green before the next.
+- Where the repository keeps one, `ROADMAP.md` is the sequenced plan of record. Each chunk reaches green before the next.
 - A showcase is executable proof of public API. A missing demonstration is a missing feature, detectable by parity.
 - An integration surface's guide documents the validated hookup for each supported client: the exact commands run, the authentication and approval model that client needs, and the honest limit wherever a client cannot reach part of the surface.
 
@@ -33,7 +33,7 @@ Documentation is an enforced contract, not explanatory decoration. The Writing r
 - TypeScript, SCSS, Markdown, tests, and showcase remain aligned.
 - A parity failure identifies drift; never suppress or weaken the test.
 - A vendored dependency guide is a mirror. Its relative links address the upstream tree and resolve to nothing here, so they are outside local-link parity. Refresh a mirror rather than rewriting it: a rewritten copy is a translation, and no comparison against the fetched bytes can check it.
-- Falsify a prose claim the way you falsify a code claim. The parity test proves a name exists, never that a sentence about behavior is true, so run the example and read what it returns. A `// false` beside a call that returns `true` is a defect of the same kind as a wrong return value, and it reaches every consumer who installs the package.
+- Falsify a prose claim the way you falsify a code claim. The parity test proves a name exists, never that a sentence about behavior is true, so run the example and read what it returns. A `// false` beside a call that returns `true` is a defect of the same kind as a wrong return value, and it reaches every consumer who installs the package. That proof has a home: `tests/guides.test.ts` executes the flagship fences, per `.claude/rules/tests.md`. An ordered behaviour with no gate is not a gate.
 - Re-read the prose last, against what actually shipped. Where a change chose to document a limit rather than close it, the sentence was often drafted for the option that lost, or written more confidently than the code earns. Code rulings survive review because a test can break them; prose rulings survive because nothing tries.
 
 For behavioral interfaces/classes:

package/dist/host/claude/rules/patterns.md

@@ -128,3 +128,13 @@ Use four orthogonal contract mechanisms:
   - guard-valid input is never rejected by its parser;
   - every parsed result satisfies its guard.
 - Derive parser and guard from one source or test the round trip.
+
+### Foreign contracts
+
+A value returned by an interface another package publishes is FOREIGN data. Own it, validate what you dereference, and narrow nothing.
+
+- Enforce the published contract and no more: accept unknown members, accept any implementation the interface admits including a class instance, and check each member as its published type declares it. A member typed `number` is not checked as an integer.
+- Reserve the exact-record guard for a record this package owns. Over a foreign interface it refuses values the interface permits and fails closed on a valid implementation.
+- Narrow nothing in an ownership transform. Where the published contract is wider than the copy mechanism, seal the value in place rather than refusing it.
+- Own a foreign value at arrival, validate the owned copy, and read the foreign object exactly once. Read count is this package's decision, so no result may depend on it.
+- Validate only what the package dereferences from a union it must narrow. Own a wide foreign record it merely carries and leave it unvalidated. State that asymmetry on the option that admits the implementation.

package/dist/host/claude/rules/quality.md

@@ -24,12 +24,10 @@ paths:
 - Never end a row as "hardened further." Replace any evaluative phrase with the concrete condition that closes the row.
 - Record a finding outside the matrix against the row that owns it, for the next matrix. Do not reopen this one.
 
-## Run it, don't argue it
+## Probes before arguments
 
 A question a probe can settle is settled by the probe, whether or not anyone has disputed it. Reasoning decides what to run and what the result means. It does not replace the run.
 
-This is a habit for your own work first, and a rule about disagreements second. Most unverified beliefs are never challenged by anyone — they are simply built on.
-
 - Test your own assumptions before you rely on them. You do not need a disagreement to justify a probe. If you are about to depend on what a function returns, what a config resolves to, what a flag does, or whether a path is even reached, run it and find out.
 - Treat a long deliberation about behaviour as the signal to stop and run something. Deliberation that a ten-line probe would have ended is the most expensive habit in this process, and it is invisible because it feels like rigour.
 - Verify a belief before stating it, or label it as unverified. An unverified assertion put into context becomes a fact for everything downstream, including other agents, and correcting it later costs more than the check would have.
@@ -39,6 +37,7 @@ This is a habit for your own work first, and a rule about disagreements second.
 - Bound the search before starting it, and put the bound in the brief. Name the benchmark, the population, or the row that ends it. An investigation with no stated stopping condition runs until attention runs out. This includes the case where the honest answer is that the limit is inherent and belongs in documentation rather than in code.
 - Treat a negative probe as evidence about the probe until its input is shown to reach the code under test. A pass proves nothing if the vector never arrived. Instrument the path, assert an observable side effect, or drive it through a door you can see.
 - When a report names a defect and your reproduction comes back clean, assume first that your vector was weaker than theirs, and go get their exact vector. Treating a failed reproduction as a disproof is the most common way a true finding is lost.
+- A reported vector the compiler rejects refutes the VECTOR, never the finding. Where a claim asserts reachability through a typed API, compile the exact vector under the project's own settings; re-derive one the types admit before dropping the finding, and record which vector was actually tested.
 - Reproduce a reported defect's cause before instructing a fix from it. A real symptom can carry a wrong diagnosis, and a fix aimed at the stated cause edits the wrong file while the defect survives.
 - Do not read a result into a tool's failure to find your probe. "No tests found", an empty match, a skipped file, a runner that resolved nothing — these report on the harness, not the subject. Confirm the probe was collected and executed first.
 - Prefer an observation over a derivation, including your own. When a measurement and an argument disagree, the argument is wrong until the measurement is shown to be broken.
@@ -63,6 +62,7 @@ A review that reads a diff finds what the diff shows. A review that tries to bre
 - Draw the negative control from outside the population the instrument covers. Name the instrument's membership rule first, then pick a control that rule excludes. A control sampled from constructs the instrument already handles proves only that it discriminates among those constructs, and says nothing about the class it silently cannot reach.
 - State an instrument's coverage beside its result. A conclusion inherits the instrument's scope, not the question's. An unstated coverage claim is read as complete, and it never is. A search proves something about the paths it walked, so name them.
 - Match the instrument to the question. A text search reports on text, so a claim about declarations, call sites, or structure needs the compiler or a parser instead. A pattern written for one spelling of a construct reports on that spelling alone. A path check answers relative to the directory it runs from, so resolve the inputs against their own base before reading a miss as a finding.
+- Name the rival reading the instrument must exclude, and show it reports differently under that reading. Give independent measurements independent state: one counter shared across members reports read order and per-member read count identically, so a result consistent with both measured neither.
 - Report a question unanswered rather than answering it with a weaker instrument. A fallback that measures something adjacent returns a confident wrong answer, and nothing downstream can tell that answer from the real one — searching commit messages for a release when the question is where a version changed will match some release, just not the one asked about. Name the substitute and what it actually measures, or say the question is open.
 - State what the controls established and what they did not. An instrument certified only from the inside is trusted exactly where it has never been tested.
 - Treat a gap between what an instrument says it checks and what it actually matches as a defect in the instrument, not as a documented limit. A recorded blind spot buys trust only when everything outside it is genuinely covered.
@@ -80,7 +80,8 @@ A review that reads a diff finds what the diff shows. A review that tries to bre
 - Let reachability bound the fix. A defect reachable through the package's own shipped code or a documented extension seam falsifies its claim and is repaired now.
 - Document the obligation instead when a defect is reachable only through a hypothetical foreign implementation of a contract this package publishes. State it on the interface that owns it and prove the documentation. Do not build coordination machinery against a requirement nobody wrote down. Attacks are unlimited; reachable ones are not, and only the reachable set is a work list.
 - **Three rounds at one seam is the budget.** Repeated rounds against one seam are evidence about the design, not evidence of diligence. At the third round the next unit is a ruling — on the threat model, the mechanism, or the boundary — taken with the same adversarial pass a design gets, not a fourth repair.
-- Write the round count down when the seam opens, so it is a fact rather than a feeling. A seam that has consumed more rounds than the rest of the matrix combined has already answered the question.
+- Write the round count down in the capability/defect matrix row that owns the seam, when the seam opens, so it is a fact rather than a feeling. A seam that has consumed more rounds than the rest of the matrix combined has already answered the question.
+- State the ruling that ends a seam as three things: the invariant the code will obey, the constraint bounding it against over-correction, and the interface where a consumer meets the obligation. A ruling that names only the defect it replaces produces the opposite defect next round.
 - Give every behavioural audit the means to run its attacks. An auditor that cannot execute cannot falsify a behavioural claim: it returns derivations, and a derivation reads exactly like a verdict while being a different thing — it will confirm a claim one probe would break. Treat a report with no executed evidence as a review of the source, and label it as such.
 
 ## Ecosystem reuse

package/dist/host/claude/rules/tests.md

@@ -35,6 +35,7 @@ paths:
 - Measure an elapsed interval with `performance.now()`, never `Date.now()`. `Date.now()` returns whole milliseconds, so an interval built from two of its readings truncates at both ends and can under-report by a millisecond — enough to fail a boundary assertion against a timer that behaved correctly. `performance.now()` is monotonic and sub-millisecond, and it does not move when the wall clock does.
 - Give a conditional skip the mechanism that makes it inapplicable, cited, not the platform name alone. A test skipped on a platform is a test nobody re-examines; a test skipped because a named API rejects a named case is one anybody can re-check.
 - A regression test records the exact command and its failing count before the fix, and the same command's passing count after.
+- The revert that proves a repair reddens exactly the test that names the defect. Keep the import and collection graph valid while reverting, and confirm the named test was collected. A revert that reddens anything beyond that test broke the harness, and its count is not evidence.
 - Use `it.todo()` only for explicitly out-of-scope roadmap work, never to complete the current request. Every `.skip` or conditional skip has a narrow verifiable applicability reason.
 - Do not create test files solely for `constants.ts`, barrels, error definitions, or `types.ts`.
 - Run the narrowest relevant Vitest project during development; do not run the entire suite casually.
@@ -44,20 +45,24 @@ paths:
 A proof that covers the workspace instead of one module has a fixed location, so no package invents
 its own:
 
-| Path                         | Proves                                                                                                |
-| ---------------------------- | ----------------------------------------------------------------------------------------------------- |
-| `tests/policy.test.ts`       | Every source file obeys the syntactic coding and placement law                                        |
-| `tests/config.test.ts`       | Root configuration resolves its aliases, projects, and outputs, and the `configs/` leaves behind them |
-| `tests/guides.test.ts`       | Every documented API exists and every public API is documented                                        |
-| `tests/conformance.test.ts`  | Where this package drifts from the official tooling it tracks                                         |
-| `tests/distribution.test.ts` | The packed package installs and resolves through its public exports                                   |
-| `tests/integration.test.ts`  | The package's features work together end to end across environments                                   |
-| `tests/service/**/*.test.ts` | The live external services this package drives, driven for real                                       |
+| Path                         | Proves                                                                                                                         |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `tests/policy.test.ts`       | Every source file obeys the syntactic coding and placement law                                                                 |
+| `tests/config.test.ts`       | Root configuration resolves its aliases, projects, and outputs, and the `configs/` leaves behind them                          |
+| `tests/guides.test.ts`       | Every documented API exists, every public API is documented, and every executable fence returns what the guide says it returns |
+| `tests/conformance.test.ts`  | Where this package drifts from the official tooling it tracks                                                                  |
+| `tests/distribution.test.ts` | The packed package installs and resolves through its public exports                                                            |
+| `tests/integration.test.ts`  | The package's features work together end to end across environments                                                            |
+| `tests/service/**/*.test.ts` | The live external services this package drives, driven for real                                                                |
 
 - `.claude/rules/workspace.md` names the Vitest project each location belongs to.
-- The `guides` project runs in Node with the browser disabled. Its subject is
-  documented-name-to-real-export. A proof that renders a component and compares it against a
-  definition is a composition and belongs in an `integration.test.ts` scoped to its directory.
+- The `guides` project runs in Node with the browser disabled. Its subject is what the guide
+  claims: that every documented name resolves, and that every fence asserting a value returns
+  that value. A proof that renders a component and compares it against a definition is a
+  composition and belongs in an `integration.test.ts` scoped to its directory.
+- Transcribe each flagship fence and assert the values its comments claim. Name resolution is
+  not a behavioural proof, so a fence documenting a value the code contradicts passes every
+  parity assertion. Change a fence, change the transcription beside it.
 - `integration.test.ts` is a reserved filename at any level. It names a scope rather than a module,
   so the mirror rule does not reach it; its scope is the directory it sits in.
 - An integration test is an end-to-end test: it composes the package's own features and drives them