@orkestrel/scaffold 0.0.54 → 0.0.56

package/dist/host/AGENTS.md

@@ -128,6 +128,7 @@ Every file in the following table is a normative extension of this root. Read ev
 | `.claude/rules/application.md`   | App composition, entries, manifest safety, lifecycle, integration      |
 | `.claude/rules/browser.md`       | Vue/browser architecture and platform usage                            |
 | `.claude/rules/styles.md`        | SCSS/CSS centralization, tokens, mixins, layers, naming                |
+| `.claude/rules/portability.md`   | Host branching, paths, line endings, processes, terminals, OS claims   |
 | `.claude/rules/documentation.md` | Guides, parity, roadmap, showcase, examples                            |
 | `.claude/rules/writing.md`       | Developer prose: reports, replies, vocabulary, claims, structure       |
 | `.claude/rules/quality.md`       | Research, dependency reuse, hardening, completion, package inspection  |

package/dist/host/agents/orchestration.md

@@ -161,9 +161,12 @@ when the role file already pins it.
 - `implementer` names the harness's native implementation lane, so the token means Opus in Claude
   Code and Sol in Codex. An engine-named bridge — `sol`, `opus` — names the other engine. Read a
   role name against the harness you are running in, and state the engine anyway.
-- Give every role a file on both sides. The role file is where engine, effort, tools, permissions,
-  and charter are pinned, and the tool allowlist is what makes the read-only floor real. A role
-  with no file has nowhere to pin either.
+- Give every role a file in the scaffold checkout, under `.claude/agents/` and under
+  `.codex/agents/`. The role file is where engine, effort, tools, permissions, and charter are
+  pinned, and the tool allowlist is what makes the read-only floor real. A role with no file has
+  nowhere to pin either. The requirement is the canon repository's alone: a fleet target holds the
+  catalog agent and no other role, and a session that dispatches roles starts on scaffold and
+  attaches the target.
 - Reach every role by its own name. Do not rely on a remembered route.
 - `researcher`, `scout`, and `checker` are native lanes for jobs that belong to Grok first.
   Dispatch `grok` with their brief before using them, and use the native role only once the ladder

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -12,7 +12,24 @@ step that writes it.
 
 1. Re-pin the target's `@orkestrel/scaffold` devDependency and install, so the overwrite runs the
    current vendored host.
-2. Run `scaffold overwrite`.
+2. Run `scaffold overwrite`. One run repairs the `AGENTS.md` and `CLAUDE.md` pointers and deletes
+   every tracked copy the target still holds at an instruction-canon path. Prove the sweep with a
+   second `scaffold audit` that exits `0`.
+   - Where the target's `.claude/agents/orkestrel.md` carries a body outside the marker-bounded
+     table that differs from the floor copy the installed scaffold stages, delete the file and
+     commit the deletion before the run. `repair` restores the floor body and `catalog` refills the
+     table, so one visit leaves the current file and the committed deletion keeps the
+     uncommitted-work refusal from firing. Presence ownership never replaces present bytes and the
+     table rewrite touches only the marker-bounded region, which is why the deletion is the
+     migration.
+   - The deletion draws on what git tracks, so an untracked copy survives it, and the verb refuses
+     the whole run as uncommitted work while an unignored one stands. Commit that copy or delete it
+     by hand before re-running. `--dirty` clears the refusal and leaves the copy standing, and a
+     kept `.claude/rules` copy then reddens the target's own policy sweep: the pointer `AGENTS.md`
+     carries no rule map, so the copy has no row there and the sweep reports it. Delete the copy
+     rather than waiving past it.
+   - A copy the target git-ignores stays a `foreign` finding, so that target never reaches exit `0`
+     again. Keep a local MCP server registration outside the repository rather than at `.mcp.json`.
 3. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
    published.
 4. Run the full install.
@@ -22,7 +39,16 @@ step that writes it.
 
 Restore any unpublished tarball the target is holding before the quality gates run, per
 `.agents/orchestration.md` § Fixing a dependency before it publishes. A distribution proof run
-against a local tarball proves the local tarball.
+against a local tarball proves the local tarball. Stage an unpublished tarball with
+`npm install --no-save`, because a `file:` pin refuses the blueprint and the manifest keeps a
+registry range.
+
+Where a visit runs before scaffold itself publishes, run `scaffold overwrite --offline` and prove
+the sweep with `scaffold audit --offline`. The online verbs read vendored bytes from the published
+package, so an unpublished scaffold's visit otherwise writes the registry's older floor, and an
+online audit reports the floor-restored files as stale until the release. The `--offline` overwrite
+skips the catalog step and exits `1` with a note naming that refusal, so run the full
+`scaffold overwrite` after the release.
 
 Run visits in parallel slices of disjoint repositories, each slice strictly serial inside itself,
 reporting per target. Refuse a failed target, name it, repair it, and re-run it alone.

package/dist/host/claude/agents/orkestrel.md

@@ -9,8 +9,12 @@ permissionMode: dontAsk
 
 You are the read-only Orkestrel ecosystem reconciler. Spawn nothing and edit nothing.
 
-Read `.agents/orchestration.md` first. It owns the role set, the routing, and the
-dispatch contract. Then read `AGENTS.md`, applicable rules, the dispatch-named skill and
+Read the orchestration contract first. It owns the role set, the routing, and the
+dispatch contract. Resolve it against scaffold. In the scaffold checkout it sits at
+`.agents/orchestration.md`. A repository that installs scaffold reads it at
+`node_modules/@orkestrel/scaffold/dist/host/agents/orchestration.md`, or in a scaffold
+checkout beside that repository, as that repository's own `AGENTS.md` pointer names. Then
+read `AGENTS.md` itself, the applicable rules it names, the dispatch-named skill and its
 references, and the governing guides.
 
 Your job is reconciliation over supplied evidence, never collection. You have no shell
@@ -44,9 +48,9 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/abort`      | `0.0.8`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/agent`      | `0.0.18` | L5    | `@orkestrel/abort` `^0.0.7`, `@orkestrel/budget` `^0.0.7`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/database` `^0.0.11`, `@orkestrel/emitter` `^0.0.7`, `@orkestrel/queue` `^0.0.10`, `@orkestrel/timeout` `^0.0.7`, `@orkestrel/tool` `^0.0.11`, `@orkestrel/workflow` `^0.0.14`, `@orkestrel/workspace` `^0.0.5`    |
 | `@orkestrel/brief`      | `0.0.6`  | L4    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/interpret` `^0.0.11`, `@orkestrel/reason` `^0.0.8`                                                                                                                                                                                            |
-| `@orkestrel/browser`    | `0.0.13` | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/html` `^0.0.6`, `@orkestrel/websocket` `^0.0.10`                                                                                                                                                                                              |
+| `@orkestrel/browser`    | `0.0.14` | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/html` `^0.0.7`, `@orkestrel/websocket` `^0.0.10`                                                                                                                                                                                              |
 | `@orkestrel/budget`     | `0.0.8`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
-| `@orkestrel/console`    | `0.0.10` | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`                                                                                                                                                                                                                                                            |
+| `@orkestrel/console`    | `0.0.11` | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`                                                                                                                                                                                                                                                            |
 | `@orkestrel/contract`   | `0.0.13` | L0    |                                                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/csv`        | `0.0.5`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/database`   | `0.0.12` | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/indexeddb` `^0.0.9`, `@orkestrel/sqlite` `^0.0.9`                                                                                                                                                                                             |
@@ -56,7 +60,7 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/html`       | `0.0.7`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/indexeddb`  | `0.0.9`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/interpret`  | `0.0.11` | L3    | `@orkestrel/reason` `^0.0.8`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/template` `^0.0.5`                                                                                                                                                                                              |
-| `@orkestrel/lsp`        | `0.0.2`  | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/process` `^0.0.6`                                                                                                                                                                                                                             |
+| `@orkestrel/lsp`        | `0.0.3`  | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/process` `^0.0.6`                                                                                                                                                                                                                             |
 | `@orkestrel/markdown`   | `0.0.12` | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/html` `^0.0.7`                                                                                                                                                                                                                                                               |
 | `@orkestrel/mcp`        | `0.0.25` | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/process` `^0.0.6`, `@orkestrel/sse` `^0.0.5`, `@orkestrel/tool` `^0.0.12`, `@orkestrel/websocket` `^0.0.10`                                                                                                                                   |
 | `@orkestrel/middleware` | `0.0.17` | L2    | `@orkestrel/abort` `^0.0.7`, `@orkestrel/budget` `^0.0.7`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/timeout` `^0.0.7`                                                                                                                                                                                                 |
@@ -64,7 +68,7 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/ndjson`     | `0.0.8`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/ollama`     | `0.0.12` | L6    | `@orkestrel/agent` `^0.0.18`, `@orkestrel/budget` `^0.0.8`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/ndjson` `^0.0.8`, `@orkestrel/timeout` `^0.0.8`, `@orkestrel/tool` `^0.0.12`                                                                                                                                     |
 | `@orkestrel/pool`       | `0.0.8`  | L2    | `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                                                             |
-| `@orkestrel/probe`      | `0.0.8`  | L4    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/lsp` `^0.0.2`, `@orkestrel/mcp` `^0.0.25`, `@orkestrel/queue` `^0.0.10`, `@orkestrel/timeout` `^0.0.8`, `@orkestrel/tool` `^0.0.12`                                                                                                           |
+| `@orkestrel/probe`      | `0.0.9`  | L4    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/lsp` `^0.0.3`, `@orkestrel/mcp` `^0.0.25`, `@orkestrel/queue` `^0.0.10`, `@orkestrel/timeout` `^0.0.8`, `@orkestrel/tool` `^0.0.12`                                                                                                           |
 | `@orkestrel/process`    | `0.0.6`  | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                                                            |
 | `@orkestrel/program`    | `0.0.10` | L4    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.7`, `@orkestrel/qualifier` `^0.0.11`, `@orkestrel/rater` `^0.0.11`, `@orkestrel/reason` `^0.0.7`                                                                                                                                                              |
 | `@orkestrel/qualifier`  | `0.0.11` | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.7`, `@orkestrel/reason` `^0.0.7`                                                                                                                                                                                                                              |
@@ -73,7 +77,7 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/reason`     | `0.0.8`  | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`                                                                                                                                                                                                                                                            |
 | `@orkestrel/relation`   | `0.0.10` | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/database` `^0.0.12`, `@orkestrel/emitter` `^0.0.8`                                                                                                                                                                                                                           |
 | `@orkestrel/router`     | `0.0.11` | L2    | `@orkestrel/abort` `^0.0.7`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.7`                                                                                                                                                                                                                               |
-| `@orkestrel/scaffold`   | `0.0.53` | L3    | `@orkestrel/console` `^0.0.10`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/markdown` `^0.0.11`, `@orkestrel/process` `^0.0.6`, `@orkestrel/template` `^0.0.5`                                                                                                                            |
+| `@orkestrel/scaffold`   | `0.0.54` | L3    | `@orkestrel/console` `^0.0.10`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/markdown` `^0.0.12`, `@orkestrel/process` `^0.0.6`, `@orkestrel/template` `^0.0.5`                                                                                                                            |
 | `@orkestrel/sea`        | `0.0.11` | L3    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/process` `^0.0.6`                                                                                                                                                                                                                             |
 | `@orkestrel/server`     | `0.0.15` | L3    | `@orkestrel/abort` `^0.0.8`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/router` `^0.0.11`, `@orkestrel/timeout` `^0.0.8`                                                                                                                                                                 |
 | `@orkestrel/sqlite`     | `0.0.9`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
@@ -81,7 +85,7 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/supervisor` | `0.0.1`  | L5    | `@orkestrel/contract` `^0.0.11`, `@orkestrel/database` `^0.0.9`, `@orkestrel/emitter` `^0.0.6`, `@orkestrel/workflow` `^0.0.12`                                                                                                                                                                                           |
 | `@orkestrel/table`      | `0.0.3`  | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`                                                                                                                                                                                                                                                            |
 | `@orkestrel/template`   | `0.0.5`  | L2    | `@orkestrel/contract` `^0.0.13`, `@orkestrel/emitter` `^0.0.8`                                                                                                                                                                                                                                                            |
-| `@orkestrel/terminal`   | `0.0.12` | L3    | `@orkestrel/console` `^0.0.10`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/database` `^0.0.12`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/form` `^0.0.3`, `@orkestrel/sse` `^0.0.5`                                                                                                                                    |
+| `@orkestrel/terminal`   | `0.0.13` | L3    | `@orkestrel/console` `^0.0.11`, `@orkestrel/contract` `^0.0.13`, `@orkestrel/database` `^0.0.12`, `@orkestrel/emitter` `^0.0.8`, `@orkestrel/form` `^0.0.3`, `@orkestrel/sse` `^0.0.5`                                                                                                                                    |
 | `@orkestrel/test`       | `0.0.11` | L0    |                                                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/timeout`    | `0.0.8`  | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |
 | `@orkestrel/tool`       | `0.0.12` | L1    | `@orkestrel/contract` `^0.0.13`                                                                                                                                                                                                                                                                                           |

package/dist/host/claude/rules/architecture.md

@@ -106,6 +106,17 @@ kind. It reads declaration syntax and file name, never meaning.
   no bare collection literal.
 - It proves that no source, test, config, or script file carries an `eslint-disable` or
   `oxlint-disable` directive.
+- It proves that every `.claude/rules/*.md` file has a rule-map row in `AGENTS.md` and that every
+  row resolves to a file.
+- It proves the host portability rules that are path- or text-shaped over the populations
+  `POLICY_PORTABILITY_GLOB` and `POLICY_PORTABILITY_SOURCE_GLOB` name: no path segment carries a
+  Windows reserved device name, a character Windows refuses, a trailing dot or space, or a sibling
+  differing only by case; no `package.json` script names a `.sh` file; and no source in the parsed
+  population trims a payload before splitting it on `'\n'`, reads `os.EOL`, or imports `EOL` from
+  `node:os`.
+- It cannot write a filename the host refuses. A Windows host rejects `<`, folds a case collision
+  into one file, and turns `:` into an alternate data stream, so those boundaries are proven from a
+  path population rather than from written files.
 - It does not prove a collection is frozen. It reads the declaration, never the value a call
   returns, so `Object.freeze([…])` and any other call initializer are one syntax to it. The freeze
   obligation in the earlier kind-purity rules binds regardless; only the bare literal is mechanical.

package/dist/host/claude/rules/portability.md

@@ -0,0 +1,98 @@
+---
+paths:
+  - 'src/**/*'
+  - 'app/**/*'
+  - 'configs/**/*'
+  - 'tests/**/*'
+  - 'scripts/**/*'
+  - 'guides/**/*'
+  - 'package.json'
+  - '.gitattributes'
+  - '.github/workflows/*'
+---
+
+# Host portability rules
+
+Published source runs on Windows and Linux. Write one implementation that is correct on each host,
+or gate the host-specific branch on the host that needs it.
+
+Take the test half from `.claude/rules/tests.md`: it governs a host-varying property inside a test
+and the form of a conditional skip.
+
+## Host branching
+
+- Branch on a capability a runtime probe answers — a returned value, a thrown code, a present
+  member — wherever the difference is detectable.
+- Branch on `process.platform` only where the behavior is platform-defined, and name that fact in
+  the symbol's `@remarks`.
+- Put a platform-literal table — install root, executable suffix, toolchain name — inside a
+  `process.platform` branch, and read it on that platform alone.
+- Never flatten a correctly-gated host branch into a single path, and never relax a fail-closed
+  check to make one host pass.
+
+## Line endings
+
+- Split arrived text on `/\r\n|\n/`. Never split on `\n` alone, and never split on a bare `\r`.
+- Split first, then trim each line; trimming the whole payload leaves a `\r` on every line but the
+  last.
+- Frame a named protocol — HTTP, LSP, RFC 6455, NDJSON — with the terminator that protocol fixes,
+  and leave that terminator alone.
+- Emit `\n` from code this package owns. Never emit `os.EOL`.
+
+## Paths
+
+- Normalize each operand of a path comparison with the same normalizer before comparing.
+- Never case-fold a containment check. Fold a lookup key only by the file-name case sensitivity the
+  consumer declares, and fold the whole key when you fold at all.
+- Compose, split, and relativize a host path with `node:path`. Never concatenate a separator
+  literal.
+- Keep a storage key, an archive key, and a URI path slash-separated, and refuse `\` and a drive
+  prefix inside one.
+- Refuse the Windows reserved device names and the filename characters Windows rejects, on every
+  host.
+- Read the temporary directory from `os.tmpdir()`. Never write a `/tmp` literal in source.
+- Build a `file:` URI with `pathToFileURL`. Never format one from a path string.
+
+## Processes and executables
+
+- Resolve, spawn, and terminate a child through `@orkestrel/process` where the package declares it.
+- Where it is not declared, spawn `process.execPath` with a JavaScript entry. Never spawn a `.bin`
+  shim, and never add `shell: true` to reach one.
+- Take a resolver's first match only after splitting its output into lines and trimming each one.
+  `where` prints a match per line and can name a file that is not an executable.
+- Treat `fs.constants.X_OK` as an existence check on Windows, where `accessSync` passes on a plain
+  file. Confirm an executable by its name and its file type instead.
+- Read an `fs.constants` member before putting it in a flag word. Windows leaves `O_NOFOLLOW`
+  undefined, so `O_WRONLY | O_NOFOLLOW` refuses nothing there. Never polyfill the missing member:
+  compensate with a check the host supports, or record the limit.
+- Read `PROGRAMFILES`, `LOCALAPPDATA`, and `APPDATA` inside the win32 branch and `HOME` inside the
+  POSIX branch. Never read one host's root on the other.
+- Terminate a Windows child by its process tree. A `SIGTERM` handler never runs there, so gate every
+  cooperative-shutdown path on POSIX.
+- Treat a permission bit as advisory on Windows: a written mode does not round-trip
+  (`chmodSync(dir, 0o500)` reads back `0444` there), so assert modes only where a probe reports they
+  round-trip.
+- Retry an `EBUSY`, `ENOTEMPTY`, or `EPERM` removal inside a bounded budget, and report the failure
+  when the budget ends.
+
+## Terminals
+
+- Gate styling and interactivity on `isTTY`, `NO_COLOR`, and `FORCE_COLOR`, never on the platform.
+- Decode `\r`, `\n`, and `\r\n` from a key stream as the same key.
+- Never call a Windows console-mode API. Node exposes none, so record the unreached behavior as a
+  limit.
+
+## Scripts and packaging
+
+- Write every `package.json` script as a portable command: a Node invocation or an installed binary.
+  Never name a `.sh` file there.
+- Keep `#!/usr/bin/env node` on an npm bin. npm writes the Windows shim from it.
+- Keep an agent hook under `scripts/` in bash, and keep `.gitattributes` `eol=lf`.
+
+## Claims
+
+- Never describe the suite, the host, or CI as POSIX. Name the host and the date behind a reading.
+- Run the gate chain on each host a change claims, and record a reading that could not run as a
+  limit naming the host it needs.
+- Keep a POSIX-shaped `file:///` literal in a guide only as an opaque fictional identifier. Build
+  any example a reader executes with `pathToFileURL`.

package/dist/host/claude/rules/quality.md

@@ -60,6 +60,7 @@ A review that reads a diff finds what the diff shows. A review that tries to bre
 
 - An instrument is not evidence until it has failed. Pair every probe, comparison, or matrix with a negative control that must report failure, run under the same conditions. An identity check whose control reports "same" has measured nothing.
 - When a question about a TypeScript edit can supply a workspace project, a case of workspace files with a test, and a negative control naming its files, its test, the stage it must fail at, and why, call the `prove` tool the `probe` MCP server registers before relying on the answer. When the question supplies no project, no case, or no control, follow `.claude/rules/tests.md` § Probes and report the fallback instrument's own control and coverage.
+- When no `probe` server is registered in the session, register one outside the repository, in the harness's own local or user MCP scope — in Claude Code, `claude mcp add` outside project scope — naming the installed `node_modules/@orkestrel/probe/dist/bin/main.js` entry, and start it in the repository whose projects the question names, because the server fixes its workspace from its own working directory. The registration cannot live in the tree: a scaffold target holds no `.mcp.json` file, that path is instruction canon, and a copy at it reports as foreign drift on every `scaffold audit` run. Where the harness registers no server at all, treat the question as supplying no project and take the preceding rule's fallback.
 - Quote the closing line of the `prove` answer verbatim in every report, brief, and audit verdict that rests on the claim: the `receipt probe:<digest>:…` line when the case ran clean and the control broke exactly where the claim declared it would, and the `no receipt` line otherwise. A `no receipt` line leaves the claim unproved — report it with the stage that refused.
 - Read a receipt as evidence about its claim, never as a gate result. The gate chain still runs, and `verifier` still owns its result.
 - Draw the negative control from outside the population the instrument covers. Name the instrument's membership rule first, then pick a control that rule excludes. A control sampled from constructs the instrument already handles proves only that it discriminates among those constructs, and says nothing about the class it silently cannot reach.