@orkestrel/scaffold 0.0.59 → 0.0.61

package/dist/host/agents/skills/enterprise-bootstrap/references/inspection.md

@@ -0,0 +1,167 @@
+# Instruments
+
+Reach for an instrument here where a capture cannot settle the claim. Run every one with its negative
+control, in the same conditions, on the real compiled cascade the page loads. Treat an instrument
+whose negative control passes as broken and refuse its reading as evidence;
+`.claude/rules/quality.md` owns that law where it is present.
+
+Take each entry's property, population, reading, negative control, and coverage as written, and hold
+every entry to these rules.
+
+- **Report the population.** A reading carries the population it walked. An empty population fails
+  the run, because an extractor that quietly matched nothing satisfies every other assertion.
+- **Draw every negative control from outside the population.** Name the membership rule first, then
+  pick a negative control the rule excludes. Reject a negative control that rule admits.
+- **Enter a negative control through the same door the surface enters.** A negative control handed
+  straight to the reading tests the reading alone, so pair it with one appended to the tree, the stylesheet,
+  or the registry the instrument walks wherever the instrument has an extraction step.
+
+## Contents
+
+- [Authored class in the shipped cascade](#authored-class-in-the-shipped-cascade)
+- [Declared class combinations](#declared-class-combinations)
+- [Style escapes](#style-escapes)
+- [Token discipline](#token-discipline)
+- [Custom rule doing a utility's job](#custom-rule-doing-a-utilitys-job)
+- [Composited contrast in both themes](#composited-contrast-in-both-themes)
+- [One glyph, one meaning](#one-glyph-one-meaning)
+- [When an authored rule is already earned](#when-an-authored-rule-is-already-earned)
+
+## Authored class in the shipped cascade
+
+- **Property.** Every class token the surface's own templates and components author has a rule in
+  the compiled CSS the page loads.
+- **Population.** The class tokens the authored markup carries, read against every stylesheet the
+  page loads: the vendor build, each skin, and the project's own.
+- **Reading.** Subtract the tokens the loaded stylesheets define from the tokens the markup carries.
+  A remainder fails the run and names each token with the file that authored it. Report the token
+  population walked, and fail a run that walked none.
+- **Negative control.** A fed control and an appended control, each of which the reading must report.
+  Feed the first — a token no stylesheet defines — straight to the reading. Append the second through
+  the extraction door: an element built in the harness carrying that undefined token on an SVG
+  `class` attribute, added to the tree the reading walks. Each sits outside the population, which is
+  authored tokens the cascade resolves.
+- **Coverage.** The fed negative control covers the subtraction. The appended negative control covers the extractor,
+  and it is what fails a reading that never leaves the root or that drops SVG tokens by reaching for
+  `className`, where the value is an `SVGAnimatedString` rather than a string. Together they prove
+  authored tokens are a subset of the cascade. The instrument says nothing about a cascade rule
+  nobody authored, a token a build step or a script adds after the read, or whether a resolved rule
+  paints what the author intended.
+
+## Declared class combinations
+
+- **Property.** Every multi-utility chrome string the surface reuses is declared once by name with
+  the invariant it holds, and the markup carries no undeclared combination.
+- **Population.** The declared combinations, each with its name and its invariant, and every
+  multi-utility string the authored markup carries.
+- **Reading.** Match each string in the markup against the declared set. An undeclared combination
+  fails and names the element that carries it.
+- **Negative control.** A fed control and an appended control, each of which the reading must refuse.
+  Feed the first — a string one utility away from a declared combination — straight to the reading.
+  Append the second through the extraction door: an element built in the harness carrying that same
+  undeclared string on an SVG `class` attribute, added to the tree the reading walks. Each sits
+  outside the declared set.
+- **Coverage.** The fed negative control covers the match against the declared set. The appended negative
+  control covers the extractor, and it is what fails a reading that never leaves the root or that drops SVG
+  tokens by reaching for `className`. Together they prove reused chrome is declared. The instrument
+  does not prove a declared invariant is true, and it does not read a single utility used alone.
+- **Never substitute a cancellation heuristic.** A rule that flags a string for its utility count, or
+  for mixing categories, refuses the legitimate transparent read chrome that keeps a read view and an
+  edit view from reflowing.
+
+## Style escapes
+
+- **Property.** The surface's own markup carries no `style` attribute and no `<style>` element.
+- **Population.** The elements of a freshly mounted, undriven tree — the surface as authored, before
+  any interaction drives it.
+- **Reading.** Collect every element carrying an inline declaration or an embedded style element and
+  report it with its markup. Any hit fails.
+- **Exemptions, declared by name.** Exempt the framework's own runtime styles and name each exemption
+  in the instrument: a Bootstrap Modal, Offcanvas, Collapse, or Dropdown writes inline styles as it
+  runs, and a conditional-visibility directive such as `v-show` emits `style="display: none"` at
+  mount. Run the reading on an undriven tree, because a reading taken after a journey drives the
+  surface reports on the framework rather than on the author.
+- **Negative control.** An element carrying an inline declaration, built in the harness rather
+  than taken from the surface, fed to the reading. It sits outside the surface's own markup and the
+  reading must report it.
+- **Coverage.** The instrument reads authored markup at mount. It does not see a style a component
+  writes after the person interacts, a rule authored in a stylesheet, or an escape inside a
+  third-party component's own markup.
+
+## Token discipline
+
+- **Property.** No authored rule carries a literal color, and every custom paint resolves through a
+  token in each color mode the product ships.
+- **Population.** The project's own authored stylesheet rules, and the resolved value of each
+  custom-painted property in each color mode.
+- **Reading.** A literal color in an authored declaration fails. For each custom paint, read the
+  resolved value once per mode; a mode that leaves it unresolved fails, and so does a pair of modes
+  that resolve it identically where the design says the modes differ.
+- **Negative control.** A rule carrying a literal color, and a paint whose token the cascade does
+  not define, both fed to the reading rather than authored into the surface. Each sits outside the
+  population of authored rules that pass, and the reading must report both.
+- **Coverage.** The instrument covers authored rules and the paints it was given. It does not judge
+  whether the chosen token is the right one, and it reads no vendor rule and no inline declaration —
+  [Style escapes](#style-escapes) covers those.
+
+## Custom rule doing a utility's job
+
+- **Property.** Every authored selector expresses something no shipped utility expresses, or records
+  the reason the utility does not fit.
+- **Population.** The selectors in the project's own stylesheets.
+- **Reading.** For each selector, name the utility that would carry the same declarations. A selector
+  a shipped utility already expresses fails unless it carries the recorded reason.
+- **Negative control.** A rule restating a shipped utility exactly — a padding declaration matching
+  a spacing step — fed to the reading rather than authored into the stylesheet. It sits outside the
+  set of authored selectors that pass, and the reading must report it.
+- **Coverage.** The instrument reads declarations, not intent. A rule that does a utility's job
+  alongside something else passes it, so a person still reads the authored stylesheet.
+
+## Composited contrast in both themes
+
+- **Property.** Every pairing the surface paints meets its bar in every theme: 4.5:1 for anything
+  information-bearing, 3:1 for textless marks and the chrome that carries state.
+- **Population.** The pairings the surface renders, read per theme on the compiled cascade, with
+  every translucent layer composited. Exempt disabled controls, per [SKILL.md](../SKILL.md) →
+  Surfaces, color, contrast.
+- **Reading.** Composite the painted layers, read the ratio, and fail anything under its bar with the
+  pairing named. Take the mechanics from [bootstrap-reference.md](bootstrap-reference.md) → Measuring
+  the bars.
+- **Negative control.** An opaque pairing and a translucent stack, each of which the reading must
+  fail. Compose the opaque pairing in the harness at a ratio known to sit under the bar. Compose the
+  stack with a translucent layer over a floor, so its composited ratio sits under the bar while its
+  top layer read alone sits above it. Each is composed in the harness rather than taken from the
+  surface, so each sits outside the rendered population.
+- **Coverage.** The opaque pairing covers the ratio arithmetic. The translucent stack covers the
+  compositing step, and it is what fails a reader that takes the top layer's declared color and skips
+  the layers under it. Together they measure what rendered, in the themes and viewports the run
+  entered. A pairing that appears only in a state the run never reached is unmeasured, so name the
+  states the run covered beside the result.
+
+## One glyph, one meaning
+
+- **Property.** Each status meaning takes one glyph, each glyph serves one meaning, and every
+  registered glyph resolves in the icon set the product actually ships.
+- **Population.** The registry of meanings and glyphs the surface uses, and the shipped icon set.
+- **Reading.** A meaning registered twice, a glyph registered against two meanings, or a glyph the
+  shipped set does not resolve fails, each named.
+- **Negative control.** A registry entry binding a second meaning to a glyph already registered,
+  plus a glyph name the shipped set lacks. Both sit outside the registered set, and the reading must
+  report both.
+- **Coverage.** The instrument proves the registry is consistent and resolvable. It does not prove
+  the markup draws the registered glyph for the meaning it carries, so pair it with a capture of the
+  states that use marks.
+
+## When an authored rule is already earned
+
+Leave rung 4 to the developer, per [SKILL.md](../SKILL.md) → When custom CSS is justified. Write an
+authored rule without asking only when every one of these holds:
+
+- an instrument here reports the vendor cascade failing a stated bar — the focus ring under 3:1, the
+  status text under 4.5:1, the shipped component with no class for the state the surface must
+  show;
+- the rule cites that reading beside it, naming the instrument, the bar, and the value read;
+- the rule restores the bar and does nothing else;
+- the rule is written over `--bs-*` tokens, so both color modes move with the theme.
+
+Treat anything wider as a proposal: name what the rule would buy, and stop.

package/dist/host/agents/skills/enterprise-bootstrap/references/utilities.md

@@ -39,7 +39,7 @@ Prefer `bg-body-*` and `*-subtle` over `bg-white`/`bg-light` — they track `dat
 .rounded-0, .rounded-1, .rounded-2, .rounded-3, .rounded-4, .rounded-5
 ```
 
-For borders that must stay visible in both color modes, prefer `border-*-subtle` variants (theme-adaptive) over raw color borders.
+For borders that must stay visible in both color modes, prefer the `border-*-subtle` classes (theme-adaptive) over raw color borders.
 
 ### Colors (Text)
 
@@ -246,7 +246,7 @@ The composition traps in this group:
 ### Z-index
 
 ```css
-.z-n1, .z-0, .z-1, .z-2, .z-3    /* NOT responsive — no breakpoint variants exist */
+.z-n1, .z-0, .z-1, .z-2, .z-3    /* NOT responsive — no breakpoint classes exist */
 ```
 
 ## Spacing Scale

package/dist/host/agents/skills/orkestrel-debrief/SKILL.md

@@ -71,8 +71,8 @@ a practice that worked so it repeats.
 4. **Process retrospective.** Walk the campaign record for both failure and success:
    dispatches that deviated and why; recoveries that worked (codify the mechanism that
    saved them); estimates versus observed durations; audit rounds that caught real
-   defects versus rounds that churned; anything the orchestrator absorbed that should
-   have been dispatched or dispatched that it should have owned.
+   defects versus rounds that churned; anything the orchestrator absorbed that a dispatch
+   owned, or dispatched that the orchestrator owned.
 5. **Instruction-set audit.** Audit the agents, rules, skills, and orchestration
    contract themselves against the campaign record, using the adversarial method in
    [instruction-audit.md](references/instruction-audit.md). What confused an executor is

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -7,11 +7,12 @@ evidence-first treatment as any surface.
 ## Blind passes, one brief
 
 Run the subjective lane and the objective lane on the SAME brief, in parallel, neither
-seeing the other's answer before both return. `reviewer` holds the subjective lane and
-`analyst` holds the objective lane.
+seeing the other's answer before both return. `.agents/orchestration.md` § Engine
+assignment decides which engine and which role holds each lane, including under a dark
+bench; read the assignment there and name it in the dispatch.
 
 Each lane returns numbered findings, most severe first, and exactly one terminal line:
-`INSTRAUDIT <LANE>: <n> findings`. Each charter defaults to the `orkestrel-falsify`
+`INSTRAUDIT <LANE>: <finding ids, or none>`. Each charter defaults to the `orkestrel-falsify`
 verdict shape and takes a different shape the dispatch names, so name `orkestrel-debrief`
 in the dispatch and this shape binds.
 
@@ -25,9 +26,9 @@ record.
 
 ## The subjective lens list
 
-Held by `reviewer`. It judges coherence of the role model, charter voice, whether each
-role's job is one job, and whether the skill family reads as one system. This section is
-the lens list's only normative home, and the lane states its coverage against it.
+Held by the subjective lane. It judges coherence of the role model, charter voice, whether
+each role's job is one job, and whether the skill family reads as one system. This section
+is the lens list's only normative home, and the lane states its coverage against it.
 
 - **Role-job singularity.** Is each charter's work cohesive? A charter describing bundled
   jobs is either a role to split or a bundle no dispatch sends whole.
@@ -48,9 +49,9 @@ the lens list's only normative home, and the lane states its coverage against it
 
 ## The objective lens list
 
-Held by `analyst`. It runs evidence-only sweeps of the actual files and the campaign
-record. This section is the lens list's only normative home, and the lane states its coverage
-against it.
+Held by the objective lane. It runs evidence-only sweeps of the actual files and the
+campaign record. This section is the lens list's only normative home, and the lane states
+its coverage against it.
 
 - **Duplication diff.** Whole-line and obligation-level comparison across charters, rules,
   and skills. A charter that restates a rule drifts from it; a rule restated elsewhere has

package/dist/host/agents/skills/orkestrel-falsify/SKILL.md

@@ -72,13 +72,15 @@ nobody claimed.
   brief that points at a rule file, section, or guide the executor cannot find delivers nothing while
   looking like authority — and it fails silently, because an auditor does not report a heading it
   never saw. Check before dispatch; propagate the missing file rather than restating its contents in
-  the brief. This is the reason restatement felt necessary, and it is the wrong cure.
+  the brief. This is the reason restatement felt necessary, and it is the wrong cure. Where the
+  executor's tree carries a superseded vendored copy of an authority, take the stale-authority
+  branch in `references/brief.md` § "What not to put in a brief".
 - Run the **adversarial pass** on one identical brief: a subjective lane and an objective
   lane, each a fresh subagent with a clean context, blind to each other. Reconcile them yourself.
   `.agents/orchestration.md` owns lane definitions, engine assignment, and what happens when an
   engine is dark; do not restate them here.
-- A round run with one lane is a deviation. Record it rather than glossing it. If an engine is
-  unavailable, the remaining engine runs every lane — it never drops one.
+- `.agents/orchestration.md` § Execution loop owns which lanes a round runs and the deviation a
+  short round records; § Engine assignment owns the substitution.
 - **Pair every finder with an independent refuter when the round fans out past the subjective and
   objective lanes.** The
   refuter receives one slice's findings, never that finder's work, and is briefed to BREAK them
@@ -135,27 +137,35 @@ comparable; a round that invents its own cannot be read against the last one.
    | --------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | `CONFIRMED`     | attacked and it held                                                                   | as the Falsification law requires                                                                                                                             |
    | `BROKEN`        | falsified                                                                              | as the Falsification law requires — note it says _input, **state, or interleaving**_, so a concurrency claim is falsified by an interleaving, not by an input |
-   | `UNRESOLVED`    | cannot be decided from the evidence available                                          | what would settle it                                                                                                                                          |
+   | `UNRESOLVED`    | cannot be decided from the evidence available                                          | what would settle it; a claim whose only evidence is the writer's own report takes this value                                                                 |
    | `NOT-EVIDENCED` | a claim about a rendered or externally driven surface the supplied capture cannot show | which capture is missing                                                                                                                                      |
 
    `CONFIRMED` and `BROKEN` defer; only `UNRESOLVED` and `NOT-EVIDENCED` are this skill's, because
    the law does not name them. `BROKEN` and `UNRESOLVED` are **separate**: a claim nobody could
    decide has not been falsified, and it cannot supply the fields falsification requires.
-   `NOT-EVIDENCED` is the token the `analyst` and `reviewer` charters already require; it is kept,
-   not re-invented.
+   `NOT-EVIDENCED` is the auditing lanes' own token; it is kept, not re-invented.
 
 2. **Findings fitting no claim**, if any, each substantiated to the same standard as `BROKEN`.
 
-3. **One terminal line**, and only one:
+3. **Attacked and held**: the claims this round attacked and could not break, each with the attack
+   that failed, and the adjacent behaviour that looks like the defect and is correct. This is where
+   the next round reads what has already been tried, so a claim listed here without its attack is
+   worth nothing to it. A claim's own `CONFIRMED` line already carries the evidence that convinced
+   the auditor, so list here only the attacks no verdict line carries and the adjacent behaviour.
+
+4. **One terminal line**, and only one:
 
    ```text
-   VERDICT: PASS — <m> of <m> confirmed, no findings outside the claims
-   VERDICT: FAIL — <n> broken, <u> unresolved, <e> not-evidenced, <x> findings outside the claims
+   VERDICT: PASS
+   VERDICT: FAIL <claim numbers>; outside the claims: <finding ids>
    ```
 
-   **`PASS` requires every one of these to be true**: every claim `CONFIRMED`, nothing `UNRESOLVED`, nothing
+   The claim numbers are every claim that is not `CONFIRMED`. Write `none` in a slot the round
+   leaves empty, so a `FAIL` driven only by a finding outside the claims still names both.
+
+   **`PASS` requires all of this**: every claim `CONFIRMED`, nothing `UNRESOLVED`, nothing
    `NOT-EVIDENCED`, and no substantiated finding outside the claims. A single substantiated finding
-   forces `FAIL` no matter how the numbered claims landed — otherwise a round can report a real
+   forces `FAIL` however the numbered claims landed — otherwise a round can report a real
    defect and still emit the word that authorises the release.
 
 No process diary. No summary of what was read.

package/dist/host/agents/skills/orkestrel-falsify/references/brief.md

@@ -36,6 +36,21 @@ an executor inventing an answer and building on it silently.
 **The threshold.** State that a finding is worth more than a clean pass, and why: the alternative is
 a consumer finding it after publication, when the version is already spent.
 
+## The read-only audit lane's brief
+
+An audit lane writes nothing and runs nothing, so its brief carries fewer rows than a writing
+unit's. Give a lane every row § Anatomy names — the subject with the evidence
+§ "Evidence, by subject type" requires of each row it occupies, what the round decides, already
+established, the numbered falsifiable claims, the unknowns, and the threshold — plus its own
+**Role and lane** row (the role, its engine, and which lane it holds) and **Output** row (the
+verdict shape and its single terminal line). Review evidence folds into the subject.
+
+Omit the rows a writer needs and a lane cannot use: owned, shared, and off-limits files; the
+Execution line's writer form, keeping the sentence that the lane performs the assignment directly
+and spawns nothing; and acceptance criteria stated as gate commands. A lane that holds no shell
+cannot close a gate criterion, so a brief handing it one is asking for a ruling on the writer's
+report.
+
 ## The successor rule
 
 A re-run **amends**; it never restates. Rewriting a brief from scratch loses the shape of what has
@@ -71,7 +86,7 @@ repair to carry the next defect; a round that finds them is converging, not fail
   accumulated damage no single diff shows.
 - **"The self-declared sound-and-unchanged verdicts are sound."** A writer's table saying a site
   needed no change is a claim like any other, made by the party least able to test it. Require the
-  auditor to pick the ones it considers most likely wrong and actually attack them, and say how many.
+  auditor to pick the ones it considers most likely wrong and actually attack them.
 
 ## Instructions that change auditor behaviour
 
@@ -92,7 +107,10 @@ the brief, by the orchestrator.
 ## What not to put in a brief
 
 - Laws already binding from `AGENTS.md` and the rule files. Reference them; restating invites drift
-  between the copy and the original.
+  between the copy and the original. Where the executor's tree carries a vendored copy of an
+  authority the canon has since superseded, quote the landed text with its canonical path and mark
+  the quotation as superseding the vendored copy, because a bare reference resolves to the stale
+  copy the executor holds.
 - Any hint of what the other auditor is finding, or has found.
 - Your own hypothesis about where the defect is, beyond what the claims state. An auditor handed a
   suspect investigates the suspect and stops.

package/dist/host/agents/skills/orkestrel-harden-package/SKILL.md

@@ -47,7 +47,7 @@ Load [hardening.md](references/hardening.md) for the hardening lane and for any
 6. **Prove each defect before repairing it.** A repair begins with a test that fails for that defect: record the exact command and its failing count before the fix and the same command's passing count after. A repair with no red-then-green record is unproven.
 7. **Consolidate.** Run the complete centralization and wrapper sweep. Update all call sites to the real symbol rather than leaving aliases or 1:1 delegates.
 8. **Challenge seams.** Add deterministic tests for invariants, boundaries, failures, lifecycle, cleanup, cancellation, concurrency, hostile input, and resource pressure as applicable, under the test rules' real-implementation law.
-9. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, robust, and behaviorally meaningful. When the claim is that a foreign client can use this package, drive one representative real client end to end.
+9. **Use live services deliberately.** Put real external services/models in their dedicated project, require readiness, and make each request minimally sufficient, stable across the service's nondeterminism, and behaviorally meaningful. When the claim is that a foreign client can use this package, drive one representative real client end to end.
 10. **Document the final behavior.** Update the governing guide, examples, method tables, limitations, and parity coverage. Document architectural limits honestly.
 11. **Audit completion.** Inspect test discovery, `.todo`/`.skip`/conditional skip use, source/test helper duplication, exports, environment isolation, unexpected text corruption, and the entire diff.
 12. **Verify.** Run the repository-prescribed gates in order and inspect the generated outputs relevant to the request.

package/dist/host/agents/skills/orkestrel-harden-package/references/hardening.md

@@ -50,7 +50,7 @@ Keep live tests in a dedicated project with explicit readiness, setup, timeout,
 - For model tests, constrain temperature/seed/options when the real API supports it, but do not claim determinism the provider does not promise.
 - Increase context or workload incrementally only when the scenario requires it.
 - Test instruction precedence, long-context behavior, summarization, tool calls, scopes, and state transitions through observable outcomes.
-- Avoid redundant expensive calls; one request should prove one primary claim.
+- Avoid redundant expensive calls; one request proves one primary claim.
 
 Keep live projects outside the fast default suite when repository policy requires it, while making their explicit command authoritative for the campaign.
 

package/dist/host/agents/skills/orkestrel-harden-package/references/research.md

@@ -35,7 +35,7 @@ Include:
 
 - public and internal behavior needed by real consumers;
 - official upstream capabilities that fit the requested scope;
-- architectural limitations that cannot or should not be copied;
+- architectural limitations that cannot or must not be copied;
 - legacy features worth salvaging;
 - every `TODO`, deferred branch, placeholder, or documented omission in scope.
 

package/dist/host/agents/skills/orkestrel-polish-surface/SKILL.md

@@ -26,7 +26,10 @@ contract and this skill as the workflow. Preserve dirty and user-owned work.
 A claim about a rendered surface is proven by capture, never by reading the code that was
 supposed to produce it. Source-reading review passes a component that renders nothing.
 
-- The portfolio IS the review input: captures at both viewports and both themes, an
+- Generate the portfolio from the journey suite's capture family wherever a Vitest
+  browser project can drive the surface, and from a spawned harness only where none
+  can ([capture-harness.md](references/capture-harness.md)).
+- The portfolio IS the review input: captures at every viewport and every theme the surface declares, an
   accessibility snapshot, and an interaction log.
 - Source is corroboration for a mechanism, never the proof that the surface shows it.
 - A claim the portfolio cannot show is unproven, not passed. Say so.

package/dist/host/agents/skills/orkestrel-polish-surface/references/capture-harness.md

@@ -1,82 +1,103 @@
 # The capture harness
 
-The harness produces the only evidence the verdict lanes are allowed to judge. It is owned
-by the campaign owner, not by a review lane, and it is a throwaway instrument: written for
-this surface, kept honest, deleted or rebuilt when the surface changes.
+Take the portfolio from the journey suite's capture family wherever a Vitest browser project can
+mount and drive the surface. Build the spawned script this file describes only for a surface no such
+project can host — a served page, a foreign client, a process the runner cannot start inside a test.
+Choose one source per surface, and never judge a round against a portfolio that is part
+journey-generated and part spawned.
+
+- Read the `orkestrel-prove-journey` skill for how the journey run generates a portfolio. This file
+  adds only what the review requires of a portfolio and how a spawned harness produces one.
+- Own the spawned harness as the campaign owner. Never let a verdict lane write or edit it.
+- Treat the spawned harness as a throwaway instrument: written for this surface, rebuilt or deleted
+  when the surface changes.
 
 ## One call, one lifecycle
 
-Background processes started inside one tool call die with that call's process group, and a
-verdict round spent on a half-dead harness is a wasted round.
+Apply this section to a spawned harness only.
 
-- Write the harness as one self-contained script that spawns its own children, waits for
-  readiness, does the capture, and kills them before returning.
-- Never leave a child running across calls or expect one to survive its parent.
-- Give every child a pinned working directory: a process that resolves assets, config, or
+- Write the harness as one self-contained script that spawns its own children, waits for readiness,
+  does the capture, and kills them before returning.
+- Never leave a child running across calls or expect one to survive its parent. A process started
+  inside one tool call dies with that call's process group.
+- Give every child a pinned working directory. A process that resolves assets, configuration, or
   fixtures relative to the current directory dies silently when launched from elsewhere.
-- Pipe child standard error somewhere readable and print it on failure. A discarded stream
-  turns a one-line configuration refusal into a debugging round.
-- Wait on an observable readiness signal — a served response, a printed line, a health
-  probe — never on a fixed sleep.
-- Tear down on every exit path, including assertion and setup failure, so a failed capture
-  leaves no orphaned server, browser, or port.
+- Pipe child standard error somewhere readable and print it on failure.
+- Wait on an observable readiness signal — a served response, a printed line, a health probe — never
+  on a fixed sleep.
+- Tear down on every exit path, including assertion and setup failure, so a failed capture leaves no
+  orphaned server, browser, or port.
 
 ## Validate the seed before capturing
 
-Most "the surface is broken" verdicts trace back to a seed the surface legitimately
-refused.
+Apply this section to a spawned harness only. In the journey run the acceptance journey is the seed,
+and `orkestrel-prove-journey` fixes how it enters and what it may reach past.
 
-- Build seed payloads from the surface's own published contract, not from memory of it: a
-  near-miss field name produces an empty screen that looks exactly like a product defect.
-- Assert the seeded state is present before shooting: the row exists, the prompt is parked,
-  the list is non-empty.
-- Drive the surface through its real entry path so the captured state is one a user can
-  actually reach.
-- Reset to a known state between scenarios; a capture that inherits the previous scenario's
+- Build seed payloads from the surface's own published contract, never from memory of it; a
+  near-miss field name renders an empty screen that reads as a product defect.
+- Assert the seeded state is present before shooting: the row exists, the prompt is parked, the list
+  is non-empty.
+- Drive the surface through its real entry path, so the captured state is one a person can reach.
+- Reset to a known state between scenarios. A capture that inherits the previous scenario's
   selection, focus, or scroll proves nothing about either.
 
 ## Capture the full portfolio
 
-Every round produces all of it, for every scenario in scope:
-
-| Artifact               | Requirement                                                                            |
-| ---------------------- | -------------------------------------------------------------------------------------- |
-| Viewport captures      | The narrow and wide breakpoints the surface actually declares, not one convenient size |
-| Theme captures         | Every theme the surface ships, each at both viewports                                  |
-| Accessibility snapshot | The rendered accessible tree: roles, names, states, and focus order                    |
-| Interaction log        | Each scripted interaction, its trigger, and the observed result                        |
-| Console and error log  | Anything the page or process emitted during the run                                    |
-
-- Shoot the whole surface before selecting or focusing anything inside it; a capture taken
-  after a selection reports a duplicate or highlighted artifact that does not exist.
-- Start a keyboard walk from a neutral state, never from an already-focused control, or the
-  log will "prove" a broken order the user never sees.
-- Name artifacts so a verdict can cite one exactly: scenario, viewport, theme, step.
-- Keep the artifacts of each round beside its verdicts; a round judged against the previous
-  round's captures is not a round.
+Produce every artifact in the following table each round, for every scenario in scope. The Source
+column names what produces the artifact in the journey run; a spawned harness produces each one
+itself.
+
+| Artifact               | Source in the journey run            | What the artifact must show                                                           |
+| ---------------------- | ------------------------------------ | ------------------------------------------------------------------------------------- |
+| Viewport captures      | `place` across the declared variants | Every breakpoint the surface declares, never one convenient size                      |
+| Theme captures         | `place` across the declared variants | Every theme the surface ships, at every declared viewport                             |
+| Accessibility snapshot | `describeTree` and `describeFocus`   | The rendered roles, names, and states, and the focus order the walk took              |
+| Interaction log        | The journal's `steps`                | Each interaction, its trigger, and the result observed after it                       |
+| Console and error log  | The journal's `output`               | Everything the page emitted, including an uncaught error                              |
+| Statechart outcome     | The harness after a play-all run     | The terminal status, the passed, failed, and total tallies, and each row's own result |
+
+- Require the statechart outcome of every surface that declares the statechart family, and omit the
+  row only where the surface declares none.
+- Read the journey run's per-variant written artifact for the accessibility snapshot and the logs,
+  and cite the statechart harness by its deep link where a lane must watch the widget move rather
+  than read a still of it. `orkestrel-prove-journey` fixes what each holds and what each is named
+  for.
+- Shoot the whole surface before selecting or focusing anything inside it. A capture taken after a
+  selection reports a duplicate or highlighted artifact that does not exist.
+- Start a keyboard walk from a neutral state, never from an already-focused control, or the log will
+  report a broken order no person meets.
+- Name a spawned harness's artifacts so a verdict cites one exactly: scenario, viewport, theme,
+  step. The journey run's filename law already does this.
+- Keep the artifacts of each round beside its verdicts. A round judged against the previous round's
+  captures is not a round.
 
 ## Preflight before spending a round
 
-The campaign owner opens every artifact before dispatching a verdict lane:
+Open every artifact yourself before dispatching a verdict lane, whichever source produced it.
+Confirm each of the following:
 
 - each capture shows the scenario it claims, in the theme and viewport it claims;
 - the seeded state is visible;
 - the accessibility snapshot is non-empty and matches the captured screen;
 - the interaction log records the interactions the brief asked for;
+- the statechart outcome reads a terminal status, with a zero failed tally and a passed tally equal
+  to the total;
 - nothing in the console log indicates the harness, rather than the surface, failed.
 
-A portfolio that fails preflight is repaired before dispatch. A verdict round is the
-most expensive way to discover a harness bug.
+Repair a portfolio that fails preflight before dispatching it. Never spend a verdict round
+discovering a harness defect.
 
 ## Triage missing evidence to the harness first
 
-When a verdict returns a not-evidenced item, the harness is the first suspect and the
-surface is the second. In order:
+Treat a not-evidenced verdict item as a harness fault before treating it as a product finding. Work
+these in order:
 
-1. Confirm the artifact that should decide the item exists and is named as the brief said.
+1. Confirm the artifact that decides the item exists and is named as the brief said.
 2. Confirm the scenario reached the state the item is about.
 3. Confirm the seed and the entry path match the surface's real contract.
-4. Only then treat it as a product finding.
+4. Only then record it as a product finding.
 
-Every harness gap a round exposes is repaired before the recapture, and the repair is
-recorded with the round so the next portfolio is strictly better than the last.
+- Repair every harness gap a round exposes before the recapture, and record the repair with the
+  round.
+- Route a journey-run gap to the journey suite that owns it, and recapture from the repaired
+  journeys.