@orkestrel/scaffold 0.0.71 → 0.0.73

package/dist/host/codex/agents/opus.toml

@@ -1,5 +1,5 @@
 name = "opus"
-description = "Codex-side driver for the Claude `implementer` route — a bounded nontrivial unit, the subjective mirror of the Sol implementer. Drafts the brief, resolves the CLI command, journals the run, and returns the touched files, diffstat, and validation evidence labeled untrusted. Implements nothing itself and endorses nothing."
+description = "Codex-side driver for the Claude `opus` route — a bounded nontrivial unit, the subjective mirror of `sol`. Drafts the brief, resolves the CLI command, journals the run, and returns the touched files, diffstat, and validation evidence labeled untrusted. Implements nothing itself and endorses nothing."
 model = "gpt-5.6-terra"
 model_reasoning_effort = "low"
 sandbox_mode = "workspace-write"
@@ -12,8 +12,9 @@ This route pins `--permission-mode acceptEdits`, in the checkout the unit writes
 serial writer from a clean committed baseline.
 
 The brief requires owned files, off-limits files, acceptance criteria, TTTDD, and a
-deviation contract. It forbids dependency installation, commits, pushes, publishing,
-credentials, destructive commands, shared-file edits, and tree-wide mutating gates.
+deviation contract pointing the unit at .agents/orchestration.md § Deviation protocol. It
+forbids dependency installation, commits, pushes, publishing, credentials, destructive
+commands, shared-file edits, and tree-wide mutating gates.
 
 Verify that every authority the brief references exists in the tree the run is rooted in;
 propagate a missing file rather than restating it, and take the stale-authority branch in
@@ -21,7 +22,7 @@ propagate a missing file rather than restating it, and take the stale-authority
 tree carries a superseded vendored copy.
 
 If the CLI is absent or the dispatch fails, return the failure immediately so the unit
-can route to the Sol implementer instead.
+can route to `sol` instead.
 
 After the run returns, verify it with git status, the diff, and scoped validation, then
 return touched files, diffstat, validation evidence, and deviation state labeled

package/dist/host/codex/agents/orkestrel.toml

@@ -19,4 +19,9 @@ settle it, and stop; live collection belongs to a tool-capable lane or to the
 Orchestrator before this role is dispatched. Never edit, install, push, or spawn.
 Return exactly one requested shape: `Map`, `Health`, or `Work order`, as the Claude
 charter defines them. The embedded catalog is discovery data, never live state.
+
+Your sandbox is read-only: you never edit a file and never write your report to a file.
+Your final message IS the requested shape. A dispatch that names a report path for you is
+a dispatch defect — return the requested shape as your final message and name the defect
+in it.
 """

package/dist/host/codex/agents/planner.toml

@@ -22,5 +22,15 @@ that name it. A dispatch may name a skill that fixes a different return shape, a
 wins over this list. The brief forbids edits, commands, reconciliation, orchestration, and
 acceptance.
 
+The route holds the subjective lane by default and the objective lane whenever the round
+needs an engine that is not the one running that lane, including when the Sol bench is dark
+and when Sol wrote the work under audit.
+
+Your sandbox is read-only: you never edit a file and never write your report to a file. You
+therefore write neither the brief nor the journal. Return the brief text, its intended path,
+the resolved command, and the journal path, and the Orchestrator writes the brief and
+launches the run. A dispatch that names a report path for you is a dispatch defect — return
+your result as your final message and name the defect in it.
+
 Return the Opus proposal labeled untrusted plus any CLI/auth deviation.
 """

package/dist/host/codex/agents/researcher.toml

@@ -21,4 +21,8 @@ gaps named as gaps; no raw dumps, no process diary, nothing applied.
 
 Heavy repository-scale absorption is never yours. If a dispatch exceeds a bounded
 primary-source question, say so instead of absorbing it.
+
+Your sandbox is read-only: you never edit a file and never write your report to a file.
+Your final message IS the distillate. A dispatch that names a report path for you is a
+dispatch defect — return the distillate as your final message and name the defect in it.
 """

package/dist/host/codex/agents/reviewer.toml

@@ -11,8 +11,11 @@ in full; read it and follow it.
 This route pins `--permission-mode plan`.
 
 The brief names the lane the route holds, and requires the returned verdict to state
-which lane it held. The Claude charter enumerates the lenses of each lane, and a
-verdict returned under the objective lane holds those lenses in full. The brief
+which lane it held. The route holds the subjective lane by default and the objective
+lane whenever the round needs an engine that is not the one running that lane,
+including when the Sol bench is dark and when Sol wrote the work under audit. The
+Claude charter enumerates the lenses of each lane, and a verdict returned under the
+objective lane holds those lenses in full. The brief
 requires the `orkestrel-falsify` verdict shape and its single
 terminal line, unless the dispatch names a different skill that fixes one; file:line
 evidence on every required change; out-of-lane questions returned as referrals rather
@@ -21,5 +24,12 @@ the writer's report, whatever the brief says; and, for a rendered or externally
 surface, the capture portfolio as primary evidence with source as corroboration. It
 forbids edits, commands, orchestration, reconciliation, and acceptance.
 
+Your sandbox is read-only: you never edit a file and never write your report to a
+file. You therefore write neither the brief nor the journal. Return the brief text,
+its intended path, the resolved command, and the journal path, and the Orchestrator
+writes the brief and launches the run. A dispatch that names a report path for you is
+a dispatch defect — return your result as your final message and name the defect in
+it.
+
 Return the Opus audit labeled untrusted plus any CLI/auth deviation.
 """

package/dist/host/codex/agents/scout.toml

@@ -16,6 +16,9 @@ shape — deep reading and synthesis belong to the grok bench, quality judgment
 review roles; if the question needs either, say so instead of drifting into it. Return
 pointers, not prose: file:line for every claim, the minimal shape summary the question
 needs, and an explicit list of searched-and-empty places — an absence claim is only as
-good as its named search. Never edit, never run commands, never speculate past the
-evidence.
+good as its named search. Never speculate past the evidence.
+
+Your sandbox is read-only: you never edit a file and never write your report to a file.
+Your final message IS the answer. A dispatch that names a report path for you is a
+dispatch defect — return the answer as your final message and name the defect in it.
 """

package/dist/host/codex/agents/{implementer.toml → sol.toml}

@@ -1,5 +1,5 @@
-name = "implementer"
-description = "GPT-5.6 Sol implementation of one bounded nontrivial unit as the sole serial writer in the checkout the unit writes."
+name = "sol"
+description = "GPT-5.6 Sol implementation of one bounded nontrivial unit as the sole serial writer in the checkout the unit writes — the objective mirror of `opus`."
 model = "gpt-5.6-sol"
 model_reasoning_effort = "high"
 sandbox_mode = "workspace-write"
@@ -13,8 +13,7 @@ dependencies, edit shared files, suppress diagnostics, leave current-scope
 deferrals, use mocks, install, commit, push, publish, read secrets, run destructive
 commands, or run tree-wide mutating gates. Validate only owned scope. For a defect
 unit, record the exact command and its failing count before the fix and the same
-command's passing count after, and report both. Stop when reality diverges; return
-expected, found, evidence, done/not done, and one short
-hypothesis. Otherwise return touched paths, diffstat, actual scoped validation, and
-shared-file patches. Never spawn another agent or accept your own work.
+command's passing count after, and report both. Follow .agents/orchestration.md
+§ Deviation protocol. Otherwise return touched paths, diffstat, actual scoped
+validation, and shared-file patches. Never spawn another agent or accept your own work.
 """

package/dist/host/codex/agents/verifier.toml

@@ -12,4 +12,7 @@ npm run format:check; npm run lint:check; npm run check; npm run build; npm test
 Build outputs are allowed; never rewrite source or fix failures. Record each exit
 code, exact failure excerpt, owning path, overall GREEN/RED, and anomalies. Never
 spawn another agent. Return only the gate report.
+
+Follow .agents/orchestration.md § Permission floor for the discarding git commands. Read a
+dirty git status as the expected state.
 """

package/dist/host/codex/config.toml

@@ -25,11 +25,11 @@ instead of acting as the primary Orchestrator. Do not delegate or expand its sco
 
 Which local agent carries which engine, so the contract's routing resolves here. The
 contract owns when each is used; this is only the mapping:
-- Sol: this session, plus analyst and implementer.
+- Sol: this session, plus analyst and sol.
 - Cursor Grok: the grok bridge, read-only.
 - Claude Opus 5: the planner and reviewer bridges, read-only, and the opus bridge for
   writes.
-- Luna: researcher, scout, and checker.
+- Luna: distiller, researcher, scout, and checker.
 - Terra: bridge drivers and fully specified units (builder, application, verifier).
 """
 

package/dist/host/configs/policy.ts

@@ -365,8 +365,9 @@ export const POLICY_BANNED_TERMS: readonly PolicyTerm[] = Object.freeze([
  * Lists every substitution-table row a reader rules by sense, which no pattern matches.
  *
  * @remarks
- * Each row carries a permitted sense: a date value, a version value, a causal clause, and the name
- * a replication topology takes. The currency check proves each row is registered here.
+ * Each row carries a permitted sense: a date value, a version value, a causal clause, the name a
+ * replication topology takes, and a comparative or spatial relation. The currency check proves each
+ * row is registered here.
  */
 export const POLICY_JUDGED_TERMS: readonly string[] = Object.freeze([
 	'now',
@@ -374,6 +375,8 @@ export const POLICY_JUDGED_TERMS: readonly string[] = Object.freeze([
 	'latest',
 	'once',
 	'since',
+	'above',
+	'below',
 	'master',
 ])
 

package/dist/host/dotfiles/gitignore

@@ -39,6 +39,9 @@ tests/**/__screenshots__/
 test-results/
 playwright-report/
 
+# Packed dependency tarballs (they live under tmp/ and are never committed)
+*.tgz
+
 # Model files
 *.gguf
 

package/dist/host/guides/test.md

@@ -43,11 +43,12 @@ package holds one implementation of each and ships as a `devDependency`. Nothing
 production code. Source: [`src/core`](../src/core), [`src/browser`](../src/browser), and
 [`src/server`](../src/server).
 
-It has **zero runtime dependencies**, and no exported type here names an `@orkestrel/*` type. A
+This package runtime-depends on `@orkestrel/contract` for the outcome type `retryUntil` reads
+internally. That type is not re-exported. No exported type here names an `@orkestrel/*` type. A
 dependency on `@orkestrel/emitter` would install a second copy of it beside the one a consumer
 already pins, and the compiler reads two copies as two distinct types. A foreign type in a
 signature fails the other way, rejecting the consumer's own local value inside the consumer's own
-repository. The zero-runtime-dependencies contract holds both.
+repository. Those rules hold both.
 
 ## Install
 
@@ -110,31 +111,27 @@ member and `plus` introducing its call-signature members, and a type alias's own
 a union's arms escaped as `\|`. An extended interface's name comes before `plus`, with the members
 it adds after.
 
-| Type                       | Kind      | Shape                                                                                                  | Summary                                                                                                                                        |
-| -------------------------- | --------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| `WaitOptions`              | interface | `{ budget?, interval?, signal? }`                                                                      | Configures a bounded asynchronous wait with an elapsed-time limit, a delay between readings, and an abort signal.                              |
-| `RetryOptions`             | interface | `WaitOptions` plus `{ attempts? }`                                                                     | Configures a bounded retry, adding an optional producer-call limit to a bounded wait's bounds.                                                 |
-| `EventSubscriber`          | type      | `(listener) => cleanup \| void`                                                                        | Subscribes a listener to one event source.                                                                                                     |
-| `RecorderInterface`        | interface | `{ calls, count, handler }` plus `clear`                                                               | Records every call made to its handler.                                                                                                        |
-| `EventSourceInterface`     | interface | `{} plus on`                                                                                           | Subscribes handlers to a typed event source.                                                                                                   |
-| `RecorderMap`              | type      | `{ readonly [K in TName]: RecorderInterface<TMap[K]> }`                                                | Maps event names to recorders for their delivered argument tuples.                                                                             |
-| `Success`                  | interface | `{ success, value }`                                                                                   | Represents one operation that produced a value.                                                                                                |
-| `Failure`                  | interface | `{ success, error }`                                                                                   | Represents one operation that raised a failure instead of producing a value.                                                                   |
-| `Result`                   | type      | `Success<T> \| Failure<E>`                                                                             | Represents the outcome of one operation: the value it produced, or the failure it raised.                                                      |
-| `SignalInterface`          | interface | `{ controller, signal, count }`                                                                        | Holds a real abort signal and controller instrumented with its live abort-listener tally.                                                      |
-| `SignalRegistration`       | type      | `readonly [listener, installed, capture, cleanup]`                                                     | Represents one abort listener an instrumented signal installed, as its tally holds it.                                                         |
-| `ResourceFactoryInterface` | interface | `{ created, destroyed }` plus `create` / `destroy`                                                     | Represents a numbered resource factory with records of every creation and destruction.                                                         |
-| `TeardownInterface`        | interface | `{ count }` plus `add` / `destroy`                                                                     | Represents the cleanup a test adds as it goes and runs once, newest first, when it is done.                                                    |
-| `TeardownHandler`          | type      | `() => void \| Promise<void>`                                                                          | Represents the work one teardown entry performs when the list is destroyed.                                                                    |
-| `JSONValue`                | type      | `string \| number \| boolean \| null \| readonly JSONValue[] \| { readonly [key: string]: JSONValue }` | Covers any value JSON can represent, so a round trip through JSON preserves the type.                                                          |
-| `JSONSafe`                 | type      | `JSONSafe<T>`                                                                                          | Represents the JSON-safe projection of a type: every member JSON preserves, mapped to itself, and every member it does not, mapped to `never`. |
-| `HeadersSource`            | type      | `NonNullable<ConstructorParameters<typeof Headers>[0]>`                                                | Covers any value the host `Headers` constructor accepts.                                                                                       |
-| `StateTransition`          | interface | `{ name, from, event, to }`                                                                            | Represents one row of a statechart table: the entity's state before an event, the event, and the state that event must leave it in.            |
-| `StateScenario`            | interface | `{ transition }` plus `arrange` / `act` / `assert`                                                     | Drives one `StateTransition` through the three phases that prove it.                                                                           |
-
-Each interface's call-signature members are listed under [Methods](#methods). `Result` defaults `E`
-to `Error`, where `@orkestrel/contract` publishes the same name defaulting to `unknown`;
-[Limits](#limits) rules that divergence.
+| Type                       | Kind      | Shape                                                   | Summary                                                                                                                                        |
+| -------------------------- | --------- | ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `WaitOptions`              | interface | `{ budget?, interval?, signal? }`                       | Configures a bounded asynchronous wait with an elapsed-time limit, a delay between readings, and an abort signal.                              |
+| `RetryOptions`             | interface | `WaitOptions` plus `{ attempts? }`                      | Configures a bounded retry, adding an optional producer-call limit to a bounded wait's bounds.                                                 |
+| `EventSubscriber`          | type      | `(listener) => cleanup \| void`                         | Subscribes a listener to one event source.                                                                                                     |
+| `RecorderInterface`        | interface | `{ calls, count, handler }` plus `clear`                | Records every call made to its handler.                                                                                                        |
+| `EventSourceInterface`     | interface | `{} plus on`                                            | Subscribes handlers to a typed event source.                                                                                                   |
+| `RecorderMap`              | type      | `{ readonly [K in TName]: RecorderInterface<TMap[K]> }` | Maps event names to recorders for their delivered argument tuples.                                                                             |
+| `SignalInterface`          | interface | `{ controller, signal, count }`                         | Holds a real abort signal and controller instrumented with its live abort-listener tally.                                                      |
+| `SignalRegistration`       | type      | `readonly [listener, installed, capture, cleanup]`      | Represents one abort listener an instrumented signal installed, as its tally holds it.                                                         |
+| `ResourceFactoryInterface` | interface | `{ created, destroyed }` plus `create` / `destroy`      | Represents a numbered resource factory with records of every creation and destruction.                                                         |
+| `TeardownInterface`        | interface | `{ count }` plus `add` / `destroy`                      | Represents the cleanup a test adds as it goes and runs once, newest first, when it is done.                                                    |
+| `TeardownHandler`          | type      | `() => void \| Promise<void>`                           | Represents the work one teardown entry performs when the list is destroyed.                                                                    |
+| `JSONSafe`                 | type      | `JSONSafe<T>`                                           | Represents the JSON-safe projection of a type: every member JSON preserves, mapped to itself, and every member it does not, mapped to `never`. |
+| `HeadersSource`            | type      | `NonNullable<ConstructorParameters<typeof Headers>[0]>` | Covers any value the host `Headers` constructor accepts.                                                                                       |
+| `StateTransition`          | interface | `{ name, from, event, to }`                             | Represents one row of a statechart table: the entity's state before an event, the event, and the state that event must leave it in.            |
+| `StateScenario`            | interface | `{ transition }` plus `arrange` / `act` / `assert`      | Drives one `StateTransition` through the three phases that prove it.                                                                           |
+
+Each interface's call-signature members are listed under [Methods](#methods). `Result`, `Success`,
+and `Failure` come from `@orkestrel/contract` (mirrored at [`contract.md`](contract.md)) and are not
+re-exported; `retryUntil` reads `Result` internally.
 
 #### Constants
 
@@ -221,15 +218,15 @@ The fixture builders, the readers, and the field writers do take an element, and
 journey verb. `build` creates a node, `mount` attaches one, and `render` does both from
 markup or from a tag and its classes; `clearStorage` takes nothing at all, and `removeDatabase`
 takes a database name. The predicates, the element readers, and the describers name a node the
-caller already has — `isRendered`, `isReachable`, `readText`, `readRole`, `readName`, `readStates`,
-`describeTree`, `describeFocus`, `extractOrphans`, `readRows`, `readStyle`, `readToken`,
-`readPixels`, `readContrast`, `readLayers`, `readBackdrop`, and `readRing` — and each reads that
-node rather than acting on a target it was handed. `captureFrame` and `place` take an element as
-well, and photographing one is a reading too: neither moves focus, dispatches an event, or changes
-what the element renders. `typeInput` and `commitInput` are the exception, and it stays narrow: they
-write into the field they are given, as the synthetic counterpart of `typeAccessible` for a
-component that listens for `input`. The color leaves, the cascade readers, the pane verbs, and the
-whole-document readers take a value or nothing at all, so they name no target either.
+caller already has — `isRendered`, `isReachable`, `readHit`, `readText`, `readRole`, `readName`,
+`readStates`, `describeTree`, `describeFocus`, `extractOrphans`, `readRows`, `readStyle`,
+`readToken`, `readPixels`, `readContrast`, `readLayers`, `readBackdrop`, and `readRing` — and each
+reads that node rather than acting on a target it was handed. `captureFrame` and `place` take an
+element as well, and photographing one is a reading too: neither moves focus, dispatches an event,
+or changes what the element renders. `typeInput` and `commitInput` are the exception, and it stays
+narrow: they write into the field they are given, as the synthetic counterpart of `typeAccessible`
+for a component that listens for `input`. The color leaves, the cascade readers, the pane verbs,
+and the whole-document readers take a value or nothing at all, so they name no target either.
 
 #### Types
 
@@ -275,6 +272,7 @@ A `Shape` cell holds the constant's declared type.
 | `isOutsideViewport`     | function | `(rectangle: DOMRectReadOnly) => boolean`                                                               | Determines whether a rectangle lies wholly outside the browser viewport.                                                                                                                    |
 | `isRendered`            | function | `(element: Element) => boolean`                                                                         | Determines whether the accessibility tree presents one element at all.                                                                                                                      |
 | `isReachable`           | function | `(element: Element) => boolean`                                                                         | Determines whether a person can click one element where it sits.                                                                                                                            |
+| `readHit`               | function | `(element: Element) => Element \| undefined`                                                            | Reads the topmost element at one element's bounding-box centre.                                                                                                                             |
 | `clickAccessible`       | function | `(name: string) => Promise<void>` / `(role: string, name: string) => Promise<void>`                     | Clicks one visible, focus-reachable control by its accessible name through the browser provider.                                                                                            |
 | `clickAccessibleWithin` | function | `(region: string, role: string, name: string) => Promise<void>`                                         | Clicks one human-reachable control by role and accessible-name text inside a named region.                                                                                                  |
 | `clickDisclosure`       | function | `(name: string) => Promise<void>`                                                                       | Opens or closes one native details disclosure by its rendered summary.                                                                                                                      |
@@ -1188,24 +1186,24 @@ These hold across `src/core`, `src/browser`, `src/server`, and this guide.
     into a description of the markup. `build` creates a node, `mount` attaches one, `render` does
     both, `clearStorage` takes nothing at all, and `removeDatabase` takes a database name. The
     predicates, the element readers, and the describers do take a node —
-    `isRendered`, `isReachable`, `readText`, `readRole`, `readName`, `readStates`, `describeTree`,
-    `describeFocus`, `extractOrphans`, `readRows`, `readStyle`, `readToken`, `readPixels`,
-    `readContrast`, `readLayers`, `readBackdrop`, and `readRing` — and each is a reader of a node
-    the caller already has rather than a verb that acts on a target. `captureFrame` and `place` take
-    one as the subject of a photograph, which is a reading too: neither moves focus, dispatches an
-    event, nor changes what the element renders. `typeInput` and `commitInput` are the one pair that
-    acts on the element it is handed, and the exception is deliberately narrow: they are the
-    synthetic counterpart of `typeAccessible`, for a component that listens for `input` and a test
-    that already holds the field. Drive the field by name wherever the keystrokes are part of what
-    the journey claims. `readRing` is the case that makes the split explicit. It measures the focus
-    chrome a browser painted and never brings the focus about, so a journey reaches the control
-    through `traverseAccessible` or `userEvent.keyboard` from `vitest/browser` and then measures what
-    landed. The whole environment imports `vitest/browser` and DOM globals and nothing else — no
-    `src/core` import, no framework, no `node:*`, and no `import.meta.env`, so whether a run writes
-    captures is the consumer's decision through `PortfolioOptions.enabled` rather than an environment
-    variable this package reads. `vitest` is a peer dependency, so the provider the layer drives is
-    the one the consumer already installed, and the zero-runtime-dependencies contract's empty
-    `dependencies` is untouched.
+    `isRendered`, `isReachable`, `readHit`, `readText`, `readRole`, `readName`, `readStates`,
+    `describeTree`, `describeFocus`, `extractOrphans`, `readRows`, `readStyle`, `readToken`,
+    `readPixels`, `readContrast`, `readLayers`, `readBackdrop`, and `readRing` — and each is a
+    reader of a node the caller already has rather than a verb that acts on a target. `captureFrame`
+    and `place` take one as the subject of a photograph, which is a reading too: neither moves
+    focus, dispatches an event, nor changes what the element renders. `typeInput` and `commitInput`
+    are the one pair that acts on the element it is handed, and the exception is deliberately
+    narrow: they are the synthetic counterpart of `typeAccessible`, for a component that listens for
+    `input` and a test that already holds the field. Drive the field by name wherever the keystrokes
+    are part of what the journey claims. `readRing` is the case that makes the split explicit. It
+    measures the focus chrome a browser painted and never brings the focus about, so a journey
+    reaches the control through `traverseAccessible` or `userEvent.keyboard` from `vitest/browser`
+    and then measures what landed. The whole environment imports `vitest/browser` and DOM globals
+    and nothing else — no `src/core` import, no framework, no `node:*`, and no `import.meta.env`, so
+    whether a run writes captures is the consumer's decision through `PortfolioOptions.enabled`
+    rather than an environment variable this package reads. `vitest` is a peer dependency, so the
+    provider the layer drives is the one the consumer already installed, and the
+    zero-runtime-dependencies contract's empty `dependencies` is untouched.
 14. **The wait family polls only where nothing publishes an event.** The no-polling architecture law
     governs a product's idle wakeup: a running system parks on the event or the abort signal that
     fires. A test instrument is the other case. It waits on a fact another process produces — a file
@@ -1250,6 +1248,13 @@ These hold across `src/core`, `src/browser`, `src/server`, and this guide.
     narrow their own candidates and then keep the ones it accepts — so a journey meets one rule
     rather than near-copies of it. Neither asks about the viewport; `resolveAccessible` scrolls a
     wholly off-viewport target into view and measures that separately with `isOutsideViewport`.
+    `readHit` reads beside that pair rather than filtering with it. It hit-tests one point — the
+    element's own bounding-box centre — which is how it sees what neither predicate can: a cover
+    over a control they both accept, and a wrapped inline target whose centre falls between its line
+    boxes. No acting verb consults it, because it names a node rather than ruling, and `isReachable`
+    stays the one reachability filter the verbs apply. It is also the reader that needs the pair run
+    first, and [Bounds a shipped helper carries](#bounds-a-shipped-helper-carries) states what it
+    reports for an element that failed them.
 17. **A journal forwards every console call and swallows nothing.** A browser publishes no listener
     for its own output, so `createJournal` stands in front of the console and hands each call on to
     the channel that was there when `start` armed it. A run under a journal therefore prints exactly
@@ -1373,13 +1378,14 @@ or when a consumer appears the ruling did not consider.
 | A DOM element builder                                                                            | Ships   | It ships as `build` for the element and `mount` for the attachment, and `render` widened to take a tag and its class list as well as markup. A class list, a text, and an attribute map are what a fixture actually varies, and expressing that variation through markup means assembling a string. Nothing here assembles a tree one call at a time: a fixture with children is still written as markup.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | A surface digest — `describeSurface`                                                             | Refused | Its digest format is one workspace's policy about what a summary of a surface contains, and it is assembled from the excluded `extractControls` besides. `describeTree` and `describeFocus` publish the readings a digest is built from instead.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | A control extractor — `extractControls`                                                          | Refused | Generalized past its one caller it is a wrapper over `querySelectorAll` that adds no boundary, invariant, composition, or narrower contract, which is what the superfluous-wrapper rule refuses.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| A pointer-centre hit reading — `readHit`                                                         | Ships   | It ships as `readHit`. `extractControls` is the bar it has to clear, and it does: the centre computation composes a rectangle reading with a hit test, the `undefined` translation is this package's absence convention for a reader, and "the point is always this element's centre" is a materially narrower contract than `elementFromPoint`. `roughnotes` writes that composition inline in `App.test.ts`, `integration.test.ts`, and the `ContactForm`, `PaymentForm`, and `SubscribeForm` suites, each against the cover and the wrapped target `isReachable` cannot see.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | Text resolution by selector — `resolveText`                                                      | Refused | The journey-layer contract is the one it breaks: a journey verb resolves its own target from a role and an accessible name, and one that takes a selector turns a journey into a description of the markup. Taking a node the test already holds is a different thing, which is what the element readers do; `findRule` takes a selector because its subject is the stylesheet rather than a target to act on.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | A hand-driven timer — `terminal`, `toolbox`                                                      | Refused | `toolbox` runtime-depends on `terminal`, so the two are one implementation rather than independent demand. The shape is also `@orkestrel/terminal`'s published `TimerHandler`, which a copy here would redeclare unversioned and hand consumers a second incompatible type.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | A hand-driven clock — `mcp`, `middleware`                                                        | Refused | `AGENTS.md` bans replacing the host clock outright, so publishing one from the fleet's own test package would sanction across every workspace the substitution those rules refuse. `waitForDelay` waits on a real host timer and `waitForCondition` bounds a real elapsed interval with `performance.now()`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | A reserve-then-release port picker                                                               | Refused | It binds a port, closes it, and hands the number to a child that binds it again, and the window between that close and that rebind is a race another process on the host can win. Have the child bind `0` and report back the port it was given; `createLoopback` does exactly that for a server the test owns itself.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | An abort-signal wait — `waitForAbort`                                                            | Ships   | It ships as `waitForAbort`. Every bounded member still takes `WaitOptions.signal` and rejects with the signal's own reason, so a bounded wait needs nothing here; this answers the other case, where the abort is itself the fact the test waits for. It parks on a one-shot listener with no timer and no budget, so a signal that never aborts is the caller's own deadlock rather than a timeout this could name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | Abort-signal instrumentation                                                                     | Ships   | It ships as `createSignal`. A recorder handed to `addEventListener('abort', …)` still records what one listener heard; what no recorder can answer is how many listeners stand on the signal at this moment, which is the question a leak asks. The instrumented signal counts its own abort registrations, keyed by the original callback and the capture mode, so a helper that removes what it added proves the removal. A registration leaves the tally on removal, on a one-shot delivery, and when a signal scoping it aborts, which is what makes the reading a live tally rather than an install count.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| An outcome triple — a produced arm, a failed arm, and their union                                | Ships   | It ships as `Success`, `Failure`, and `Result`. The rule governing it permits a local declaration only where no declared dependency already carries one, and this package declares no runtime dependency at all, so it cannot import `@orkestrel/contract`'s. That buys a divergence a consumer holding both packages meets: the two `Success<T>` declarations carry identical members and so do the two `Failure<E>` declarations, while `@orkestrel/test`'s `Result<T, E = Error>` defaults its failure type to `Error` and `@orkestrel/contract`'s `Result<T, E = unknown>` leaves it `unknown`. No signature published here returns one — `retryUntil` reads the type internally — so a workspace holding both packages takes its outcome from `@orkestrel/contract` and reaches for this one only where the value came from this package.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| An outcome triple — a produced arm, a failed arm, and their union                                | Adopted | This package runtime-depends on `@orkestrel/contract` and imports `Result`, `Success`, and `Failure` from it rather than shipping a second copy. No signature published here returns one — `retryUntil` reads the type internally — and the names are not re-exported.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | A statechart transition table and its runner                                                     | Ships   | It ships as `StateTransition` and `StateScenario`, driven by `executeScenario` and `executeScenarios`, with `STATECHART_ATTRIBUTES` and `STATECHART_STATUSES` for the harness a browser workspace renders. `elements` and `veneer` each declare the field-identical pair of interfaces in their own setup file, so the fleet already writes this twice and a third copy drifts the moment one of them adds a phase. The runner ships in its walking form rather than its registering one: a package helper registers no test, so `describe` and `it.each` stay in the workspace and this drives whatever rows it is handed. The row's name is what a failure carries, because a table's rows run under one test name and a bare assertion message never says which row produced it. No published package declares a generic transition record or a closure-walking runner. `@orkestrel/workflow` names a task's behavior with a string and sequences structurally, so it neither takes a scenario's closures nor drives `arrange`, `act`, and `assert` in order, and adopting it would move this package off layer 0 and pull that package's whole runtime graph into every consumer's test install. `STATECHART_STATUSES` names a harness's reported run state rather than a task's derived status, so it does not restate `LifecycleStatus`. `STATECHART_ATTRIBUTES` is the fleet contract the journey skill's statechart reference fixes for every harness and every gate, so it is a mechanism the fleet shares rather than one suite's policy. |
 
 `ScratchInterface`'s own members were ruled the same way, and coherence rather than demand decided
@@ -1430,6 +1436,19 @@ the helper rather than to the host, and each names what to reach for instead.
   carrying no leading number — `'auto'`, `'none'`, `''` — reads as `0`, because none of them
   contributes a pixel to what a reader sees, so a caller cannot tell an unparsable value from a
   genuine zero. Read the text with `readStyle` where that distinction is the subject.
+- **`readHit` answers for one point, and a node it returns is no proof of a cover.** An element the
+  document does not render measures a zero rectangle at the origin, and a zero-area element measures
+  a point on its own edge, so each is hit-tested like any other point and names whatever paints
+  there — the surrounding container, or the document body for a rectangle collapsed at the origin —
+  while `contains` reads false. A cover painted with `pointer-events: none` is absent from the hit
+  test, so the reading names the element underneath it and the caller reads reachable for a cover a
+  person can see. An element inside a shadow tree retargets in an open root and a closed one alike:
+  the document-level hit test names the host, which the inner element does not contain. Run
+  `isRendered` and `isReachable` first, and ask `element.getRootNode()` for its own
+  `elementFromPoint` where the subject sits in a shadow tree. `undefined` carries the other silence:
+  a centre outside the viewport reads the same as a centre that reaches nothing, and
+  `isOutsideViewport` does not separate them, because it asks whether the whole rectangle misses the
+  viewport while this asks where one point lands.
 
 ## Patterns
 
@@ -2783,6 +2802,9 @@ Each entry names the contracts its file proves. The test names carry the cases.
   document no longer holds, a focusable SVG against an element from a foreign namespace, and the
   refused summary that proves it is the one filter the acting verbs apply; `isRendered` takes each
   removal a browser honours and, as the split from `isReachable`, a zero-size announced control.
+  `readHit` takes a centre that reaches the element itself, a reachable control under a cover that
+  the reading names instead, a soft-wrapped inline target whose two line rectangles leave the box
+  centre on its list item, and a control fixed outside the viewport, whose centre reaches nothing.
   Each acting verb takes its happy path and every voice it owns, including both
   region-scoped refusals and both native-disclosure ones; `clickAccessibleWithin` also takes a
   glyph-captioned control inside a region a glyph-carrying heading labels, which is the loose match