@orkestrel/scaffold 0.0.59 → 0.0.61

package/dist/host/agents/skills/orkestrel-prove-journey/references/layer.md

@@ -1,85 +1,112 @@
 # The journey layer
 
-Build every capability here before writing the first journey, and route every journey step through
-it. Treat a journey that works around a missing capability as a layer defect.
+Route every journey step through the published layer. Treat a journey that works around a missing
+capability by reaching for a selector as a layer defect.
 
-Implement the signatures below as a contract in the workspace's browser test setup module; never
-copy them as source. Name each helper for the human act it performs.
+## Import, never implement
+
+Import every journey helper from `@orkestrel/test/browser`. Write one of your own only where that
+package publishes none for the act.
+
+- Place a helper you write in the workspace's browser test setup module, export it from there, and
+  name it for the human act it performs.
+- Read the package's own exports before writing anything. A helper that renames a published one is a
+  defect under `AGENTS.md`, and a second implementation of one drifts from the first.
+- Code every journey against the vocabulary in this file, which is the published one. Diagnose a
+  target that stops resolving here, and fix it in the application.
 
 ## What it drives
 
-- Drive the real browser through the installed Vitest browser provider. Import its `page` locators
-  and `userEvent` from `vitest/browser`; the `@vitest/browser/context` specifier is deprecated and
-  is not the import a new layer uses.
-- Use the provider verbs for input: `click`, `keyboard`, `tab`, `type`, `clear`, `fill`, and
-  `selectOptions`. Use `page.viewport` and `page.screenshot` for captures, and the runner's file
-  command to read a written capture back.
-- Never dispatch a constructed event from the layer or from a journey. The centralized event
-  factories `.claude/rules/tests.md` prescribes serve unit tests whose subject is the handler; a
-  journey drives input through the provider verbs only.
-- Never let a helper take an element, a component instance, or a selector from the caller. Every
-  helper resolves its own target from role and accessible name.
+- Drive the real browser through the installed Vitest browser provider. The published verbs import
+  `page` and `userEvent` from `vitest/browser`; the `@vitest/browser/context` specifier is
+  deprecated and is not the import a workspace helper uses.
+- Never dispatch a constructed event from a journey. The published `createPointerEvent`,
+  `createDragEvent`, `typeInput`, and `commitInput` serve a unit test whose subject is the handler; a
+  journey drives input through `clickAccessible`, `clickAccessibleWithin`, `clickDisclosure`,
+  `typeAccessible`, `fillAccessible`, `pressKeys`, and `traverseAccessible` only.
+- Yield with `waitForFrame` where a step needs the browser to paint before the next reading. Never
+  guard a fact with a fixed delay.
+
+## Which helpers take an element
+
+A journey verb resolves its own target from role and accessible name, and refuses an element, a
+component instance, or a selector from the caller. A reader, a fixture builder, and a capture each
+take one, because their subject is a node the caller already holds.
+
+| Population                                                                                                                                                                                                                           | Takes an element |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------- |
+| `resolveAccessible`, `resolveRendered`, `clickAccessible`, `clickAccessibleWithin`, `clickDisclosure`, `typeAccessible`, `fillAccessible`, `pressKeys`, `traverseAccessible`, `readPerception`, `readPage`, `readFocus`, `readValue` | No               |
+| `readText`, `readRole`, `readName`, `readStates`, `describeTree`, `describeFocus`, `isReachable`, `isRendered`                                                                                                                       | Yes              |
+| `readContrast`, `readRing`, `readLayers`, `readBackdrop`, `readStyle`, `readToken`, `readPixels`, `readClasses`, `extractStyles`, `extractOrphans`, `readRows`                                                                       | Yes              |
+| `mount`, `typeInput`, `commitInput`, `captureFrame`, and a portfolio's `place`                                                                                                                                                       | Yes              |
+
+Never pass an element to a verb from a journey step. Read a step that would pass one as a missing
+verb, and add the verb instead.
 
 ## The resolver
 
-```ts
-resolveAccessible(name: string): HTMLElement
-resolveAccessible(role: string, name: string): HTMLElement
-```
+`resolveAccessible(name)` resolves across the published interactive roles, and
+`resolveAccessible(role, name)` resolves within exactly the named role. `resolveRendered` sits
+beneath it and applies the same match without the scroll, so an act does not fail on a target the
+act itself scrolls into view.
 
 - Match the accessible name exactly, never a substring.
-- Search a fixed set of interactive roles for the bare-name form, and exactly the named role for
-  the two-argument form.
-- Count a match as reachable only when every condition holds: it is connected; it passes a
-  visibility check that honours opacity and CSS; its box has non-zero width and height; its
-  `tabIndex` is at least zero; it matches neither `:disabled` nor `[aria-disabled="true"]`; and it
-  has no `[inert]` ancestor.
-- Scroll a wholly off-viewport target into view once, then measure reachability again. Count a
-  control a person can scroll to as reachable, and one that stays outside the viewport as
-  unreachable.
-- Give the layer a rendered-only resolver beneath the public one, and use it from the acting verbs
-  so a click does not fail on a target the act itself scrolls into view.
+- Read `ACCESSIBLE_ROLES` for the bare-name search set and `FOCUSABLE_SELECTOR` for what the layer
+  counts as focusable, rather than restating either list in a workspace.
+- Read reachability with `isReachable` and rendering with `isRendered` where a test needs the
+  condition rather than the throw. A reachable match is connected, passes a visibility check that
+  honours opacity and CSS, has a box with non-zero width and height, carries a `tabIndex` of at
+  least zero, matches neither `:disabled` nor `[aria-disabled="true"]`, and has no `[inert]`
+  ancestor.
+- Count a control a person can scroll to as reachable, and one that stays outside the viewport after
+  the scroll as unreachable.
 
 ### The failure voices
 
-Keep these distinct, and never merge any of them into one message.
-
-| Condition                                  | The voice it must throw                                          |
-| ------------------------------------------ | ---------------------------------------------------------------- |
-| No element carries the name                | `No interactive element has the accessible name "<name>"`        |
-| Every match fails a reachability condition | `Interactive target "<name>" is not visible and focus-reachable` |
-| Several matches are reachable              | `Interactive target "<name>" is ambiguous across <n> elements`   |
-| Still off-viewport after being scrolled to | `Interactive target "<name>" is unreachable after scrolling`     |
+Assert the one voice the case means. Never write an assertion that accepts more than one.
+
+| Condition                                        | The voice thrown                                                                      | Thrown by               |
+| ------------------------------------------------ | ------------------------------------------------------------------------------------- | ----------------------- |
+| No element carries the name                      | `No interactive element has the accessible name "<name>"`                             | `resolveRendered`       |
+| Every match fails a reachability condition       | `Interactive target "<name>" is not visible and focus-reachable`                      | `resolveRendered`       |
+| Several matches are reachable                    | `Interactive target "<name>" is ambiguous across <n> elements`                        | `resolveRendered`       |
+| Still off-viewport after being scrolled to       | `Interactive target "<name>" is unreachable after scrolling`                          | `resolveAccessible`     |
+| The region holds no reachable match              | `Interactive target "<name>" is not reachable inside "<region>"`                      | `clickAccessibleWithin` |
+| The region holds several reachable matches       | `Interactive target "<name>" is ambiguous across <n> elements inside "<region>"`      | `clickAccessibleWithin` |
+| No native disclosure is reachable under the name | `Native disclosure "<name>" is not visible and focus-reachable`                       | `clickDisclosure`       |
+| Several native disclosures carry the name        | `Native disclosure "<name>" is ambiguous across <n> elements`                         | `clickDisclosure`       |
+| Forward Tab never lands on the target            | `Interactive target "<name>" is not reachable through forward Tab traversal: <trail>` | `traverseAccessible`    |
+| The named region is hidden                       | `Named region "<name>" is not visible`                                                | `readPerception`        |
+| Several named regions carry the name             | `Named region "<name>" is ambiguous across <n> elements`                              | `readPerception`        |
+| The resolved control renders no value            | `Interactive target "<name>" does not carry a value`                                  | `readValue`             |
 
 - Report an absent control and a present-but-unreachable one as different findings: absence names
   a missing control, and unreachability names the interface gating one that exists.
-- Report ambiguity as a finding about the surface. Name the match count in the message, and
+- Report ambiguity as a finding about the surface. Quote the match count from the message, and
   re-target the journey by role or region.
+- Read the package's own voice table before asserting a message this file does not list. A workspace
+  that transcribes a voice by memory asserts a sentence the package does not throw.
 
 ## Role vocabulary
 
-Never infer a role from markup. Confirm the computed role in the browser whenever a target stops
-resolving.
+Never infer a role from markup. Confirm the computed role in the browser with `readRole` whenever a
+target stops resolving, and read the exposed name with `readName` and the exposed state with
+`readStates` beside it.
 
 - A `list`-bearing input computes `combobox`, not `textbox`. Attaching native suggestion machinery
   to a field is a role change: re-target every journey that names that field, and read a resolver
   miss immediately after such a change as this before treating the element as missing.
 - Always target a tab by its role. A tab and its panel collide on a bare name by construction,
   because the panel is labelled by its tab.
-- `<summary>` is exposed as a native disclosure rather than through a role the provider's role
-  locators accept. Give the layer a separate disclosure verb keyed to the summary's rendered text,
-  applying the same reachability conditions and its own failure voices.
+- Drive a `<summary>` with `clickDisclosure`, which applies the same reachability conditions and
+  throws its own voices. The provider's role locators do not resolve it, because it is exposed as a
+  native disclosure rather than through a role.
 
 ## Region-scoped resolution
 
-```ts
-clickAccessibleWithin(region: string, role: string, name: string): Promise<void>
-```
-
-- Provide this form for repeated short verbs such as `Add`, and for a control whose accessible name
-  is completed by a status the row renders.
-- Apply the same reachability conditions inside the region, and throw voices that name the region
-  as well as the target.
+Reach for `clickAccessibleWithin(region, role, name)` where a short verb such as `Add` repeats
+across a page, and where a rendered status completes a control's accessible name. It applies the
+same reachability conditions inside the region and names the region in every voice it throws.
 
 ## Input and traversal
 
@@ -88,44 +115,45 @@ clickAccessibleWithin(region: string, role: string, name: string): Promise<void>
 | `typeAccessible(name, text)` | Focus the field, select all, delete, then send real keystrokes. Escape the provider's key syntax in the text. |
 | `fillAccessible(name, text)` | Replace the value in one operation for text too long to type. The real element still publishes real input.    |
 | `pressKeys(keys)`            | Send a provider keyboard sequence for Enter, arrows, modifiers, and combinations.                             |
-| `traverseAccessible(name)`   | Move focus by forward Tab from wherever focus is, and return the target once focus lands on it.               |
+| `traverseAccessible(name)`   | Move focus by forward Tab from wherever focus is, and return the target after focus lands on it.              |
 
-- Count a traversal step only when focus actually lands on an element, and never charge the step
-  bound for a Tab that moved nothing.
-- End the traversal when focus revisits an element, which is one complete cycle of the tab order,
-  and throw the traversal's own voice, carrying the trail of what focus did reach. Keep a hard cap
-  above the cycle so a page with no tab order fails instead of hanging.
-- Re-resolve the target by role and name on every step, and never hold a node reference across
-  steps. A framework may replace the node between resolution and focus arrival.
-- Never call the browser's focus method to place focus.
+- Reach for `typeAccessible` where the keystrokes are part of what the journey claims, and
+  `fillAccessible` where the text is only a payload the person pastes.
+- Let `traverseAccessible` end the walk. It counts a step only where focus lands, stops at one
+  complete cycle of the tab order, carries the trail of what focus reached in its voice, and holds a
+  cap above the cycle so a page with no tab order fails instead of hanging.
+- Never call the browser's focus method to place focus, and never hold a node reference across
+  traversal steps. A framework may replace the node between resolution and focus arrival.
 
 ## Perception
 
-```ts
-readPerception(name: string): string
-```
+`readPerception(name)` returns the normalized `innerText` of exactly one visible named region,
+dialog, table, tab panel, alert, or status. Quote that text in assertions.
 
-- Return the normalized `innerText` of exactly one visible named region, dialog, table, tab panel,
-  alert, or status. Collapse whitespace runs to single spaces and trim.
 - Read `innerText`, never `textContent`: `innerText` applies CSS transforms and leaves out content
-  the layout hides. Quote that text in assertions.
-- Include descendant visually-hidden text, which a screen reader perceives and which a clip-based
-  hiding technique leaves in `innerText`.
-- Throw when the named region is absent, hidden, or ambiguous.
-- Give the layer a whole-page perception reader for cross-region sentences and the vocabulary
-  sweep, a focus reader that returns the active element's rendered text, and a value reader that
-  returns a resolved control's value. A perception assertion may quote that value: it is a rendered
-  fact rather than internal state.
+  the layout hides. Descendant visually-hidden text stays in, which is what a screen reader
+  perceives.
+- Reach for `readPage` for a cross-region sentence and the vocabulary sweep, `readFocus` for the
+  active element's rendered text, and `readValue` for a resolved control's rendered value. A
+  perception assertion may quote that value: it is a rendered fact rather than internal state.
+- Reach for `describeTree` and `describeFocus` where the subject is the accessible tree itself —
+  roles, names, states, and focus order. They are the accessibility snapshot a written artifact
+  composes ([decide.md](decide.md) → The rendered artifact).
 
 ## Mounting and cleanup
 
 - Mount the shipped root component with its real provisions and return an idempotent cleanup that
-  unmounts the app and removes its container.
+  unmounts the app and removes its container. Reach for the published `mount`, `render`, and `build`
+  where a fixture needs a node rather than the application.
 - Undo everything a journey changed after each test: unmount, destroy the session, reset the theme,
-  clear the keys the application persisted, and return the route to its entry. Never let a journey
-  inherit the previous journey's state.
+  return the route to its entry, and clear what the application persisted with `clearStorage` and
+  `removeDatabase`. Never let a journey inherit the previous journey's state.
+- Record what a journey did with `createJournal`, started inside the journey and stopped in a
+  `finally`. Its `steps` and `output` are the evidence a failing journey hands back, and the input
+  the run's written artifact composes.
 
 ## The capture hook
 
-Give the layer exactly one capture helper. [captures.md](captures.md) owns the registry, the
-variant matrix, and the proofs that read what it wrote.
+`createPortfolio` is the capture door and `place(state, element?)` is the hook.
+[captures.md](captures.md) owns the registry, the variant matrix, and the proofs that read what it
+wrote.

package/dist/host/agents/skills/orkestrel-prove-journey/references/statechart.md

@@ -0,0 +1,84 @@
+# The statechart family
+
+Declare one transition table, and give it to the automated run that asserts it and to the
+harness a person watches. Never write a second table for the harness.
+
+## Declare the table
+
+- Declare each transition as a `StateTransition` carrying its `name`, its `from` state, the `event`,
+  and its `to` state. Type it on the entity's own state and event unions, so a row naming a state the
+  entity does not have fails to typecheck.
+- Write one `StateScenario` per transition, carrying that `transition` plus `arrange`, `act`, and
+  `assert`. Each phase receives the context and the part of the transition it owns.
+- Put the scenarios in the workspace's browser test setup module. Put the table beside them until a
+  harness page ships; from then on declare it in the application's own constants module, typed on the
+  entity's unions, and import it from the page and from the setup alike, because a page cannot
+  import from `tests/` and a second table is what this reference forbids.
+- Declare a transition for every event the surface accepts in every state it accepts it, including
+  the event that leaves the state unchanged. A table that lists only the moves the happy path takes
+  proves the happy path.
+
+## Run the table
+
+- Run the table with `executeScenarios(scenarios, build)` from `@orkestrel/test`. It drives the rows
+  in the order they are written, builds a context per row, and stops at the first row that throws.
+- Run one row with `executeScenario(scenario, context)` where a single transition is the subject.
+- Build the context in `build`, which receives the row it is building for. That is what lets one
+  table mix fixtures.
+- Let the runner name the failure. It prepends the transition's `name` to whatever the row threw and
+  carries the original as the `cause`, so a bare assertion message still says which row failed.
+- Never assert the entity's internal state in `assert` where the transition is one a person drives.
+  Assert what the interface renders, through `readPerception`, `readValue`, or `readStates`.
+
+## Drive the act the way the transition happens
+
+- Drive `act` through the journey verbs — `clickAccessible`, `clickDisclosure`, `typeAccessible`,
+  `pressKeys`, `traverseAccessible` — for every transition a person can cause.
+- Drive `act` through the entity's own API only where the transition is the entity's rather than the
+  person's: a lifecycle event, a transport reply, a timer the surface owns.
+- Say which door each row used, in the row's `name`. A table that mixes the doors silently reads as
+  a set of user transitions and proves something else.
+
+## Build the harness a person watches
+
+Mount the harness on the same table. It stays in the repository that owns the surface: only
+`StateTransition`, `StateScenario`, `executeScenario`, `executeScenarios`, `STATECHART_ATTRIBUTES`,
+and `STATECHART_STATUSES` are published, and a workspace that spells a `data-statechart-*` string of
+its own has left the contract.
+
+- Render one play control per transition and one play-all control, each disabled while a run is in
+  flight.
+- Render a state badge carrying the entity's current state, an event log of what the entity emitted,
+  and a `role="status"` announcer that narrates each step in a sentence, so a screen reader and a
+  vision model both read the run without visual chrome.
+- Publish `STATECHART_ATTRIBUTES.status` on the harness root, and cycle its value through
+  `STATECHART_STATUSES`: `pending` before a run has a result for every row, `idle` standing ready,
+  `running` in flight, and `passed` or `failed` as the terminal reading. Publish
+  `STATECHART_ATTRIBUTES.passed`, `.failed`, and `.total` on the same element, so a gate finds the
+  harness and reads the tally from one node.
+- Publish `STATECHART_ATTRIBUTES.scenario` and `STATECHART_ATTRIBUTES.result` on each row, and
+  `STATECHART_ATTRIBUTES.state` on the element rendering the entity's current state.
+- Write every attribute from the map rather than from a literal. A harness that sets an attribute
+  the gate does not read fails silently as a run that never completes.
+- Deep-link one transition and the play-all run from the route, so a decision round names the exact
+  link it wants looked at ([decide.md](decide.md) → The rendered artifact).
+- Give the harness a demo step that leaves the widget in its most legible state after the run, for a
+  person or a vision model deciding on a look.
+- Pace the harness for a person to watch. The gate inherits that wall time, so budget the gate from
+  the row count and the pause rather than from a fixed timeout.
+
+## Gate the harness
+
+Prove the harness from the browser project, through the interface:
+
+- Mount the harness page and clear the route's query first, so a leftover deep link cannot start the
+  walk before the gate does.
+- Press the play-all control through `clickAccessible`, never through a constructed event and never
+  by setting the deep link.
+- Poll `STATECHART_ATTRIBUTES.status` until it reads `passed` or `failed`. Never assert it from one
+  read after the click.
+- Assert the status reads `passed`, the failed tally reads zero, and the passed tally equals the
+  total. Name the failing rows from `STATECHART_ATTRIBUTES.scenario` in the failure message, so a red
+  gate says which transition broke.
+- Assert the harness inventory before the rows: a page that mounted no transition passes every tally
+  assertion.

package/dist/host/agents/skills/orkestrel-prove-journey/references/styles.md

@@ -0,0 +1,87 @@
+# Proving what the browser resolved
+
+Prove a style from what the browser resolved on the mounted surface. The `enterprise-bootstrap`
+skill's [instruments reference](../../enterprise-bootstrap/references/inspection.md) names each
+instrument's property, its population, and the negative controls that must fail. Take those from
+there and the reading from here.
+
+## Assert the resolved value
+
+- Read one property with `readStyle(element, property)` and a length with `readPixels(element, property)`. A
+  class present in the markup and absent from the cascade resolves to nothing, and an assertion on
+  the class list passes on it.
+- Never substitute `findRule` for a resolved read. It proves a declaration exists, and another rule
+  may still win; reach for it where the stylesheet itself is the subject.
+- Compare a color through `matchesColor` or `parseCSSColor` rather than by string. A browser normalizes a color
+  expression, so a literal comparison fails on a value that resolved correctly.
+
+## Run per variant
+
+The run axis is fixed in [SKILL.md](../SKILL.md) → Read the variant once. The matrix family's own
+readings follow.
+
+- Apply each variant's `apply` and its `width` and `height` before the readings, and take every
+  reading for that variant before moving to the next.
+- Name the attribute the surface actually reads in `apply`; a Bootstrap surface switches on
+  `data-bs-theme`. An `apply` that sets another attribute leaves the run in the default theme, where
+  every reading passes.
+- Assert that the run read every declared variant. A matrix that silently walked one variant reports
+  a pass for the theme nobody exercised.
+- Report which variants a result covers beside it. A pairing that appears only in a state the run
+  never entered is unmeasured.
+
+## Contrast and focus chrome
+
+- Read a text pairing with `readContrast(element)`, which composites the painted ancestors to the first
+  opaque layer, so a translucent tint reads as a tint over what shows through it.
+- Pass `floor` only where the surface the stack really sits on is known, and pass `CANVAS_COLOR`
+  where the browser paints onto its own canvas. Omitting `floor` refuses a stack whose painted layers
+  are all translucent; take that refusal as the reading, because an assumed white canvas turns "this
+  surface declares no background" into a number that reads like a measurement.
+- Read focus chrome with `readRing(control)`, after focus arrived through `traverseAccessible`,
+  `pressKeys`, or a real click. Pass `worn` where the chrome is painted onto a second element such
+  as a label. It reports `undefined` for a control not matching `:focus-visible`, for the browser's
+  own automatic ring, and for a focus style that only repaints the fill — treat each as a finding
+  about the surface rather than as a pass.
+- Carry the negative controls the composited-contrast instrument names, in the same run and composed
+  in the harness rather than taken from the surface. An instrument whose negative control passes is
+  broken, and its readings are not evidence.
+- Reach for `measureContrast`, `measureLuminance`, `blendColor`, `readLayers`, and `readBackdrop`
+  only where the composite itself is the subject. Never re-derive `readContrast` from them.
+
+## The authored-class census
+
+Take the property, the population, and the negative controls from the instruments reference →
+Authored class in the shipped cascade. This is the reading.
+
+- Read the census as the difference between `readClasses(root)` of the mounted surface and
+  `readCascade()`. A token in the difference is a class the markup uses and no loaded stylesheet
+  declares.
+- Take `root` from the mounted surface, so the census covers what rendered rather than what a
+  template file spells.
+- Report what `readClasses` walked as the population, and fail a run that walked none.
+- Append the extraction-door negative control to that same `root`, so it reaches the difference
+  through `readClasses` rather than beside it.
+
+## Style escapes
+
+Take the property, the population, the named exemptions, and the negative control from the
+instruments reference → Style escapes. This is the reading.
+
+- Read escapes with `extractStyles(root)`, which returns the markup of every hit it found.
+- Take the reading before any journey drives the surface, because the population is the undriven
+  tree.
+- Append the harness-built negative control element to that same `root`, so it reaches the reading
+  through `extractStyles`.
+- Reach for `extractOrphans` where the finding is a child element rendered outside its required
+  parent, and `readRows` where the subject is a repeated row's rendered text.
+
+## Tokens
+
+- Read a token with `readToken(element, name)` where inheritance matters and `readRootToken(name)` where the
+  document declares it. The leading dashes are optional in each.
+- Compare values, never presence. An absent token and one declared empty both read as `''`, and a
+  `var()` naming an undeclared property resolves to the inherited color rather than refusing, so an
+  assertion on presence passes on a token nobody declared.
+- Read each token once per variant and assert the values differ where the design says the variants
+  differ. A pair of variants that resolves a token identically is a theme that did not switch.

package/dist/host/agents/templates/brief.md

@@ -10,6 +10,10 @@ copy `# Unit UNIT_ID — SHORT_SUBJECT`. Delete each italic reminder as you fill
 under, and leave no row blank: fill a row you cannot close with a named unknown label, and
 describe that label under § Unknowns with how the unit reports back on it.
 
+For a read-only audit lane, fill the rows
+`.agents/skills/orkestrel-falsify/references/brief.md` § "The read-only audit lane's brief" names
+and delete the rest of this template.
+
 ## Role and engine
 
 ROLE_NAME on ENGINE_NAME, reached as TRANSPORT.
@@ -73,7 +77,7 @@ answer around._
 _Grant a behaviour with the tests that pin it, a constant with every fixture and expectation derived
 from it, a template with the materialized copy the package generates from it, and a mechanism with
 the prose describing it: the comment beside the code it edits and the guide passage stating the
-behaviour it moves._
+behaviour it moves. A unit that moves a published symbol owns the package `README.md`._
 
 **Shared (report-only).** SHARED_FILES
 
@@ -84,21 +88,25 @@ edits nothing in this row._
 
 _Name each file the unit must not touch, and read every acceptance criterion against this row line by
 line. Grant the file a criterion needs, or strike that criterion. A file the change breaks that
-appears in no row of this section is unscoped._
+appears in no row of this section is unscoped. Never list `tmp/probe/` off-limits: it is the unit's
+probe home, and `.claude/rules/tests.md` puts every runtime probe there._
 
 **What asserts the state this change ends.** FILES_THE_RESULT_MAKES_FALSE
 
 _List every file the result makes false rather than every file that declares the thing changing: the
 test asserting the reversed behaviour, the fixture carrying the raised value, the golden digest over
 generated output, the consumer script naming the removed union member. Derive the list by running the
-suite; where you cannot run it, name the search's bound so the unit re-derives the list. End each
-entry in Owned, in Shared, or with a named carrier dispatched before this change ships._
+suite; where you cannot run it, name the search's bound so the unit re-derives the list. A rename's
+search bound is a word-boundary sweep over the old name followed by a case-insensitive sweep over
+its `-s`, `-ed`, and `-ing` inflections. End each entry in Owned, in Shared, or with a named carrier
+dispatched before this change ships._
 
 **Tools and limits.** ALLOWED_TOOLS, PERMISSION_LIMITS
 
 _Check the § Output mechanism and every acceptance criterion's verification method against this
 allowlist. A read-only lane writes no report file and runs no probe, so hand it the rendered evidence
-instead._
+instead. A rename moves the file with the shell's `mv`, never `git mv`; `git add -N` is permitted
+only to render diff evidence._
 
 ## Execution
 
@@ -138,8 +146,9 @@ criterion behind it. Where the change edits a file the repository vendors or dig
 regeneration step ahead of every gate that reads the generated artifact. Ask what the change does
 to every fact you measured, and fix each criterion to the state the unit finishes in. Close each
 criterion with owned files alone, and name the property the unit must change; record a consequence
-you expect to follow as an observation, never as a criterion. A scoped run over the unit's own
-owned files stays a legitimate criterion._
+you expect to follow as an observation, never as a criterion. A criterion that closes on an
+instrument's reading names that instrument's negative control and the class the control proves the
+instrument can see. A scoped run over the unit's own owned files stays a legitimate criterion._
 
 **Observations, not criteria.** TIMING_SENSITIVE_OR_WHOLE_SUITE_GATES
 

package/dist/host/agents/transports/claude.md

@@ -21,8 +21,10 @@ with the permission mode the route pins. Never substitute a fixed Claude model i
 
 Verify that the `claude` CLI resolves and is authenticated before first use. On either
 failure return it immediately with the fallback named, so the Sol main session records
-Opus unavailable for the round. Never install, authenticate, or substitute an API key,
-access token, or copied auth file.
+Opus unavailable for the round. Where the binary is absent, that report names the install
+command for the `claude` CLI, so the Orchestrator can put it to the user in the same turn
+it records the bench dark and re-probe when the user answers. Never install, authenticate,
+or substitute an API key, access token, or copied auth file.
 
 Journal every run: redirect --output-format stream-json to tmp/claude/<unit>.jsonl,
 which is gitignored, and record the session id. A bench unit with no journal ran on its

package/dist/host/agents/transports/codex.md

@@ -119,7 +119,7 @@ skill owns the value set and the terminal line. Point the brief at both; restate
 
 ## Implementer route
 
-Sandbox `workspace-write`, main checkout, sole serial writer from a clean committed
+Sandbox `workspace-write`, the checkout the route writes in, its sole serial writer from a clean committed
 baseline, with owned files, off-limits files, and a deviation contract. The brief forbids
 dependency installation, commits, pushes, publishing, credentials, destructive commands,
 shared-file edits, and tree-wide mutating gates.
@@ -147,6 +147,9 @@ negative tests is unaffected.
 
 - Verify `codex --version` before first use. On Windows `codex` resolves in Bash through
   the extensionless npm shim; if it does not, invoke `codex.cmd`.
+- Binary absent: report it so the Orchestrator can record the bench dark and, in the same turn,
+  name to the user the install command for `@openai/codex` and the bench it unblocks. The
+  Orchestrator re-probes when the user answers. Never install it yourself.
 - Binary present but authentication unavailable: report it so the Orchestrator can start
   device-auth recovery in the same turn. It backgrounds `codex login --device-auth` with
   output captured to `tmp/codex/login.log`, surfaces the verification URL and one-time code

package/dist/host/claude/agents/analyst.md

@@ -34,7 +34,9 @@ Everything `.agents/orchestration.md`'s dispatch contract requires, plus:
 - **Every authority the brief references must exist in the tree the exec is rooted in.** Check
   before dispatch. A brief citing a rule file or section the executor cannot find delivers nothing
   while looking like authority, and it fails silently — an auditor does not report a heading it
-  never saw. Propagate the missing file; do not restate its contents in the brief.
+  never saw. Propagate the missing file rather than restating its contents in the brief, and take
+  the stale-authority branch in `.agents/skills/orkestrel-falsify/references/brief.md` § "What not
+  to put in a brief" where the executor's tree carries a superseded vendored copy.
 - For an audit: the subject as numbered falsifiable claims, and the skill that fixes the verdict
   shape. The Falsification section of `.claude/rules/quality.md` owns the method and the evidence
   each verdict carries. The verdict shape defaults to `orkestrel-falsify`; a dispatch may name a

package/dist/host/claude/agents/application.md

@@ -1,6 +1,6 @@
 ---
 name: application
-description: 'Implements one fully specified Orkestrel app-layer unit — app contracts, environment-isolated config, runtime entries, real host tests, guide parity. Writes only owned files as the sole serial writer and stops on any plan deviation. Nontrivial app design belongs to GPT-5.6 Sol or Opus 5.'
+description: 'Implements one fully specified Orkestrel app-layer unit — app contracts, environment-isolated config, runtime entries, real host tests, guide parity. Writes only owned files in the checkout the unit writes as the sole serial writer and stops on any plan deviation. Nontrivial app design belongs to GPT-5.6 Sol or Opus 5.'
 tools: Read, Grep, Glob, Edit, Write, Bash
 model: sonnet
 effort: low

package/dist/host/claude/agents/builder.md

@@ -1,6 +1,6 @@
 ---
 name: builder
-description: 'Implements one small, fully specified, taste-free unit exactly as dispatched. Writes only owned files in the main checkout as the sole serial writer, validates narrowly, and stops on any plan deviation. Nontrivial implementation belongs to GPT-5.6 Sol or Opus 5.'
+description: 'Implements one small, fully specified, taste-free unit exactly as dispatched. Writes only owned files in the checkout the unit writes as the sole serial writer, validates narrowly, and stops on any plan deviation. Nontrivial implementation belongs to GPT-5.6 Sol or Opus 5.'
 tools: Read, Grep, Glob, Edit, Write, Bash
 model: sonnet
 effort: low
@@ -19,8 +19,8 @@ dispatch contract.
 
 - Before writing, read **AGENTS.md**, every applicable `.claude/rules/*.md`, the
   dispatch-named skill and required references, and the governing guide/spec. All bind you
-  as written there, and this charter restates none of them. An app-layer unit additionally
-  binds `.claude/rules/application.md` and `.claude/rules/workspace.md`.
+  as written there, and this charter restates none of them.
+- An app-layer unit belongs to `application`: stop and say so.
 - Write ONLY the owned files named in your dispatch. Shared or off-limits files are
   report-only: if one needs a change, RETURN the exact patch — never edit it.
 - NO tree-wide or mutating commands: never `format`, lint `--fix`, or `build`.

package/dist/host/claude/agents/checker.md

@@ -37,6 +37,11 @@ No judgment calls: a question that needs one becomes a **referral** — specific
 evidenced, addressed to the subjective lane when it is running and to the
 Orchestrator when it is not — never a guess and never a verdict of yours.
 
+Rule a claim whose only evidence is the writer's report `UNRESOLVED`, never
+`CONFIRMED`, whatever the brief says. A quoted command and exit code inside a
+report is the writer quoting itself, so it evidences nothing until a lane that ran
+the command supplies the reading.
+
 ## Output contract
 
 Return the shape fixed by the dispatch.

package/dist/host/claude/agents/grok.md

@@ -40,7 +40,8 @@ shim that answered once does not clear it, and when it does fire it leaves only
 `SetConsoleWindowTitle` trace — which reads as a bench that returned nothing rather than as a launch
 that never happened. The versioned entry has no console dependency and no such failure mode.
 
-Read an empty shim run as a launch failure until its log is checked for that trace.
+Read an empty shim run as a launch failure until its `.err` journal is checked for that
+trace.
 
 If nothing responds the bench is dark. Stop with a deviation naming the fallback from the root
 tedious-work ladder — Luna, then Sonnet. Never hand the reading to the Orchestrator, `planner`, or
@@ -48,14 +49,21 @@ tedious-work ladder — Luna, then Sonnet. Never hand the reading to the Orchest
 
 Create `tmp/cursor/` first. Write any brief longer than a couple of sentences to
 `tmp/cursor/<unit>-brief.md` and make the prompt a pointer to it; briefs never travel as
-fragile shell arguments. Every run journals its output, so the user can tail progress live
-and an interrupted run leaves its partial distillate on disk:
+fragile shell arguments. Every run journals its event stream, so the user can tail progress
+live and an interrupted run leaves its partial distillate on disk:
 
-`<resolved-entry> -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief or pointer>" | tee tmp/cursor/<unit>.log`
+`<resolved-entry> -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" --output-format stream-json "<pointer>" > tmp/cursor/<unit>.jsonl 2> tmp/cursor/<unit>.err`
 
 Write that chain to `tmp/cursor/run.sh` and run the file, so the resolution, the model, and the
 journalling are one artifact the next run reuses.
 
+The journal's first event is the `init` event, and its `session_id` is the run's recovery
+handle. The journal's `result` event carries the final answer. Return the journal path and
+that session id with the result, so the Orchestrator can confirm the bench ran. Read the
+`.err` file before calling a run empty; a launch that never reached the model leaves its
+trace only there. Resume an interrupted run through the CLI's `--resume` option, probed
+before its first use.
+
 Run that yourself only for a short bounded ask finishing in about two minutes. For anything
 longer your job ends at drafting: return the brief path, the exact resolved command, and the
 journal path, and let the Orchestrator launch it as a harness-tracked background command under
@@ -79,7 +87,9 @@ Return only:
 - `Question`: one line.
 - `Evidence`: concise facts with `file:line` or primary-source pointers.
 - `Distillate`: the smallest context the next engine needs.
-- `Unknowns`: unresolved facts, not recommendations.
+- `Unknowns`: unresolved facts, not recommendations, naming every input row the
+  distillate did not reach.
+- `Journal`: the journal path and the session id from its `init` event.
 - `Deviation`: unavailable CLI, model, or auth; command failure; dirty containment.
 
 Grok's output is evidence, never a decision or a verdict.