@orkestrel/scaffold 0.0.81 → 0.0.83

package/dist/host/AGENTS.md

@@ -16,14 +16,16 @@
 ## Project model
 
 ```text
-src/      published library: core, browser, server, optional styles
-app/      application: core, browser, server
+src/      published library: core, browser, server, optional styles, extension faces
+app/      application: core, browser, server, extension faces
 tests/    mirrors source; setup*.ts owns shared test infrastructure
 configs/  thin target wrappers around root Vite/TypeScript configuration
 ```
 
 - `core` is host-independent. Browser and server may import core; core imports neither; browser and server never import each other.
 - `app/core` is host-independent. `app/server` may import `app/core`, `src/core`, and `src/server`, never browser code. `app/browser` may import `app/core`, `src/core`, and `src/browser`, and reaches server behavior through shared contracts and transports only.
+- The browser surface is `src/browser`, `app/browser`, the journey, and the showcase; the styles surface is `src/styles` and its themes. An extension adds a face to a surface: the `vue` browser extension adds `src/vue` and `app/vue`, and a named styles extension adds `src/<name>`.
+- `src/vue` and each `src/<name>` may import `src/core` and `src/browser`. `app/vue` may import what `app/browser` may import, plus `app/browser` and `src/vue`. No extension face imports server code or another extension's face.
 - Published source never imports private app code.
 - Enforce boundaries with the toolchain (Oxlint import restrictions, scoped TypeScript projects, Vite graphs). Add no second parser for TypeScript, Oxlint, Vue, HTML, CSS, or Vite.
 - `tsconfig.json`, `vite.config.ts`, and each `*/types.ts` are their sources of truth. Keep structural files even when empty.
@@ -57,7 +59,7 @@ configs/  thin target wrappers around root Vite/TypeScript configuration
 - **Named discriminants.** Name the axis (`relationship`, `command`, `category`), never `kind` or `type`.
 - **Centralize by kind.** Types, constants, helpers, validators, parsers, factories, and errors live in their kind file. An implementation file holds one class plus imports.
 - **Export and test reusable logic.** Fold a trivial one-use helper into its caller or export it from its kind file and test it.
-- **No nested functions**, except an anonymous callback passed as an argument or returned as the result.
+- **No nested functions**, except a callback passed as an argument or returned as the result; `.claude/rules/architecture.md` § Functions and orchestration bounds the literal positions it climbs.
 - **Functional core, imperative shell.** Pure exported leaves; stateful orchestration as class methods. A method never forwards 1:1 to a helper.
 - **No superfluous wrappers.** A wrapper adds a boundary, invariant, composition, translation, lifecycle, or materially narrower contract, or it goes.
 - **Minimal public API.** Create or substantively expand a capability with its first real consumer; this gate applies at creation, never later. Expose an existing reusable capability through its environment barrel regardless of consumer count. Remove a symbol only when the capability itself must not exist. Prefer one minimal interface and one shared engine, with a native backend override only for a faster path.

package/dist/host/agents/orchestration.md

@@ -105,6 +105,7 @@ Every working file lives under the checkout's gitignored `tmp/`, in the director
 | `tmp/probes/`                              | runtime probes the `probe` Vitest project collects and the `probe` MCP server arms                 |
 | `tmp/type/`                                | the type stage's workspace mirror, owned by `@orkestrel/probe`                                     |
 | `tmp/captures/`                            | screenshots, resolved-style snapshots, and other capture portfolios                                |
+| `tmp/browsers/`                            | the journeys a `browse` server saves, their runs and captures, and its profiles under `.profiles/` |
 | `tmp/worktrees/`                           | worktrees the Orchestrator creates for a parallel writer                                           |
 
 ## .orkestrel layout

package/dist/host/agents/skills/orkestrel-harden/references/centralization.md

@@ -28,8 +28,8 @@ execution and must explain why sibling imports cannot work.
 | Defining recursive or compositional spine  | Class method, after extracting its pure leaves       |
 | Trivial and genuinely one-use              | Inline it into the caller                            |
 
-Never move logic into a nested function to evade centralization. An anonymous callback
-passed directly to another operation stays a callback, not a hidden helper declaration.
+Apply `.claude/rules/architecture.md` § Functions and orchestration to nested functions and
+callback positions.
 
 ## Hunt the wrapper
 

package/dist/host/agents/skills/orkestrel-journey/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: orkestrel-journey
-description: Prove a browser application the way a person uses it — real keystrokes, clicks, and Tab/Enter against only what is visible and reachable — through the journey layer @orkestrel/test/browser publishes, and generate the capture portfolio, the resolved-style matrix, and the statechart outcome from those same journeys. Use when accepting a UI build, proving an application end to end, deciding whether a surface is reachable by keyboard alone, proving what a screen refuses as well as what it does, proving the styles a browser actually resolved under each theme and viewport, driving a transition table through the interface and watching it run, auditing whether the interface speaks the user's vocabulary rather than the engine's, producing the screenshots a design review judges, routing a rendered question to an artifact a model can read, or whenever the only evidence a screen works is a test that drove it through JavaScript instead of through the interface.
+description: Prove a browser application the way a person uses it — real keystrokes, clicks, and Tab/Enter against only what is visible and reachable — through the journey layer @orkestrel/test/browser publishes, and generate the capture portfolio, the resolved-style matrix, and the statechart outcome from those same journeys. Use when accepting a UI build, proving an application end to end, deciding whether a screen is reachable by keyboard alone, proving what a screen refuses as well as what it does, proving the styles a browser actually resolved under each theme and viewport, driving a transition table through the interface and watching it run, auditing whether the interface speaks the user's vocabulary rather than the engine's, producing the screenshots a design review judges, routing a rendered question to an artifact a model can read, or whenever the only evidence a screen works is a test that drove it through JavaScript instead of through the interface.
 ---
 
 # Prove an application through human journeys
@@ -14,7 +14,8 @@ description: Prove a browser application the way a person uses it — real keyst
 3. [styles.md](references/styles.md) before asserting anything the browser resolved.
 4. [statechart.md](references/statechart.md) before declaring a transition or mounting the harness.
 5. [decide.md](references/decide.md) before routing a question to an instrument.
-6. The `*/types.ts` of every environment the journeys drive, plus the application's root component,
+6. [recorded.md](references/recorded.md) before judging a browser recording's run as evidence.
+7. The `*/types.ts` of every environment the journeys drive, plus the application's root component,
    route entry, and store contract.
 
 Treat a retained readiness verdict as evidence to re-verify against the current tip, never as a plan
@@ -23,25 +24,27 @@ each ruling was taken at.
 
 ## Declare the families
 
-Declare in the browser environment's `integration.test.ts` which families that surface carries, and
+Declare in the browser environment's `integration.test.ts` which families that screen carries, and
 assert in the always-on proofs that every declared family is present. A declaration names which
-families a surface owes. It never switches what a declared family proves.
+families a screen owes. It never switches what a declared family proves.
 
 | Family     | Declared                                                                                     | Proves                                                                 |
 | ---------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
 | Journey    | Always                                                                                       | Each user intent reaches its outcome through the interface             |
-| Refusal    | Always                                                                                       | Each control the surface withholds, through one exact failure voice    |
-| Matrix     | Where the surface ships more than one variant                                                | The values the browser resolved under each declared variant            |
+| Refusal    | Always                                                                                       | Each control the screen withholds, through one exact failure voice     |
+| Matrix     | Where the journey wrapper declares more than one variant                                     | The values the browser resolved under each declared variant            |
 | Statechart | Where a journey drives a transition of an entity carrying its own state and event vocabulary | Each declared transition, driven through the interface where it can be |
-| Transport  | Where the surface persists or restarts                                                       | Persistence, restart, and storage failure through real implementations |
+| Transport  | Where the screen persists or restarts                                                        | Persistence, restart, and storage failure through real implementations |
 | Capture    | Under the capture flag                                                                       | The registry times the variants, each registered file written to disk  |
 
-- Refuse a declaration that omits a family whose trigger the surface meets. Report the omission as a
+- Prove Matrix in the arrival journey `scaffold new` seeds while its wrapper declares more than one
+  variant: read one resolved value under each declared variant.
+- Refuse a declaration that omits a family whose trigger the screen meets. Report the omission as a
   scope finding and stop; never prove the remaining families around it.
 - Assert the declaration itself: a family listed with no proof, and a proof belonging to no listed
   family, each fail the run.
 - Bind the journey laws to every declared family, not to the journey family alone. A matrix reading
-  and a transport assertion reach their surface through the same verbs a journey reaches it through.
+  and a transport assertion reach their screen through the same verbs a journey reaches it through.
 - Change route and theme through the interface in the matrix family and the transport family. A
   family that navigates by calling the application's own router proves the router, and says nothing
   about the screen it reads afterwards.
@@ -92,9 +95,10 @@ start, and let it choose the capture destination, the matrix row, and the statec
 - Run the axis with `npm run test:journey`, which runs that wrapper and joins the `test` chain. Set
   `CAPTURE` to `1` in your own shell and run `npm run test:journey` again to write the frames; the
   root configuration reads that variable and provides it as `capture`.
-- Keep the journeys in `tests/app/browser/integration.test.ts`. Each variant project collects that
-  file alone, and the ordinary `app:browser` project excludes it while the axis is on, so a journey
-  written anywhere else runs in no variant.
+- Keep the journeys in `tests/app/browser/integration.test.ts`, and the journeys of the `vue`
+  extension's application in `tests/app/vue/integration.test.ts`, which `npm run test:journey:vue`
+  runs. Each variant project of a mode collects that file alone, and the application's ordinary
+  project excludes it while the axis is on, so a journey written anywhere else runs in no variant.
 - Loop every declared variant inside one run for the matrix family
   ([styles.md](references/styles.md) → Run per variant).
 - Render exactly one variant per run for the capture family
@@ -120,7 +124,7 @@ whose text names `vitest`, so a script naming another runner's configuration rai
   to `createPortfolio` when capture needs no additional synchronous document change. Never attach
   an asynchronous action to `CaptureVariant.apply` or re-resolve a covered theme control at capture
   time.
-- Where the surface has no theme control, prepare the theme through the attribute the surface
+- Where the screen has no theme control, prepare the theme through the attribute the screen
   reads. Use the optional `CaptureVariant.apply` hook only for a synchronous document change,
   such as setting that attribute. Treat its `() => void` contract as synchronous: `createPortfolio`
   invokes the hook without awaiting a returned promise.
@@ -194,15 +198,15 @@ await PORTFOLIO.place('home')
 5. **Generate the portfolio from the acceptance journeys.** Place each registered state inside the
    journey that reaches it, and never register a state no journey reaches.
 6. **Commit a value through an act a person performs:** `pressKeys('{Enter}')` on the focused
-   control, a Tab away, or a named button. Report a surface that commits on a timer, on an
-   unpredictable event, or only after work the person cannot observe as a surface finding, and never
+   control, a Tab away, or a named button. Report a screen that commits on a timer, on an
+   unpredictable event, or only after work the person cannot observe as a screen finding, and never
    work around it in the layer.
 7. **Type only what a person would.** Journeys carry trusted input; adversarial payloads belong to
    the transport family and the parser suites.
 8. **Perform every interaction step unconditionally.** Never gate a step on whether the control it
    is about to drive exists or is reachable, and never branch a journey on `readRefusal`. Let the
    resolver's failure voice name what the interface withheld. A guarded step passes whether or not
-   the control was there, so the run goes green on a surface that removed the control.
+   the control was there, so the run goes green on a screen that removed the control.
 
 ## Import the journey layer
 
@@ -231,7 +235,7 @@ placement and scope `.claude/rules/tests.md` fixes.
 
 - Enter through the real entry: mount the shipped root component with a real store and the route a
   person lands on, and let the application load itself.
-- Reach each surface's own controls through forward Tab traversal in at least one journey.
+- Reach each screen's own controls through forward Tab traversal in at least one journey.
 - Type keystroke by keystroke where the keystrokes are the subject; fill in one operation where the
   text is only a payload the person pastes.
 - Poll every fact the application produces asynchronously until it converges. Never assert one from
@@ -243,38 +247,38 @@ placement and scope `.claude/rules/tests.md` fixes.
   sentence and carry the replaced one in `absent`, so the reading that resolves carries one and not
   the other ([layer.md](references/layer.md) → The waits).
 - Assert the state a control announces beside every drive that sets it, and on an unselected
-  sibling. A control announcing state owes this assertion whether or not the surface carries the
+  sibling. A control announcing state owes this assertion whether or not the screen carries the
   statechart family.
 - After a confirmed destructive action, assert through trusted input that focus landed on a visible,
   announced location.
 - Assert the whole page's perception never matches the vocabulary the product does not speak —
   engine, schema, and implementation words the interface is supposed to translate.
-- Report a bare accessible name that answers for more than one reachable element on one screen as a surface
-  finding, and target through role or region until the surface is fixed.
+- Report a bare accessible name that answers for more than one reachable element on one screen as a screen
+  finding, and target through role or region until the screen is fixed.
 
-### The intents every surface owes
+### The intents every screen owes
 
-Write a journey for each of the following wherever the surface has that state. Take the expected
+Write a journey for each of the following wherever the screen has that state. Take the expected
 outcome from the product guide; this skill supplies the mechanism and invents no copy, no redirect,
 and no title scheme.
 
-| Intent            | The journey proves                                                              |
-| ----------------- | ------------------------------------------------------------------------------- |
-| Arrival           | The entry route renders its own screen, read through a named region             |
-| An unknown route  | What the application does with a route it does not carry, and what it says      |
-| An empty result   | What a query matching nothing renders, in the product's own words               |
-| The document name | The title each screen publishes, asserted per screen                            |
-| A render failure  | What a person reads when a component throws, rather than an unexplained surface |
+| Intent            | The journey proves                                                             |
+| ----------------- | ------------------------------------------------------------------------------ |
+| Arrival           | The entry route renders its own screen, read through a named region            |
+| An unknown route  | What the application does with a route it does not carry, and what it says     |
+| An empty result   | What a query matching nothing renders, in the product's own words              |
+| The document name | The title each screen publishes, asserted per screen                           |
+| A render failure  | What a person reads when a component throws, rather than an unexplained screen |
 
 - Report a missing outcome as a product finding, with its evidence site, rather than inventing the
-  copy the surface owes.
+  copy the screen owes.
 - Assert the title from `document.title` per screen, against the title the product guide names for
   that screen. Report a screen the guide gives no title as a product finding.
 
 ## Prove the refusals
 
-- Give every surface a refusal family: the controls a person must not reach in the state the
-  journey has put the surface in.
+- Give every screen a refusal family: the controls a person must not reach in the state the
+  journey has put the screen in.
 - Assert the exact failure voice the case means. Never write an assertion that accepts more than
   one voice ([layer.md](references/layer.md) → The failure voices).
 - Cover the restrictions the interface imposes on itself: a collapsed panel's field, a verb
@@ -296,11 +300,11 @@ and no title scheme.
   `QuotaExceededError`.
 - Prove the visible half in a journey: the failure sentence a person reads, and the retry control
   that clears it. A storage failure whose visible half is a control that silently does nothing is a
-  surface finding.
+  screen finding.
 - Assert restart by starting a second session over the same store and polling the restored value.
 - Take a stalled read to the application's own asynchronous store contract, never to `Storage`.
   `Storage` is synchronous, so a hanging read is not expressible against it and a fixture that fakes
-  one is proving a surface the application does not have.
+  one is proving a store contract the application does not have.
 
 ## Prove the styles
 
@@ -350,16 +354,16 @@ Completion requires all of:
 
 - every in-scope user intent reaching its outcome through the interface, with no step that reaches
   past it;
-- the intents every surface owes present wherever the surface has the state, each outcome taken from
+- the intents every screen owes present wherever the screen has the state, each outcome taken from
   the product guide and every missing one reported as a product finding;
-- keyboard-only reachability proven on every surface the journeys cover;
-- a refusal family per surface, each asserting one exact failure voice;
+- keyboard-only reachability proven on every screen the journeys cover;
+- a refusal family per screen, each asserting one exact failure voice;
 - the transport family declared separately, driven through real implementations, and convergent;
 - the declared families each proven, and the declaration itself asserted;
 - the matrix family read once per declared variant, each style reading carrying its published
   control from [styles.md](references/styles.md) → The published controls in the same run, and the
   contrast reading's control straddling its declared bar;
-- the authored-class census and the `extractStyles` reading taken on the mounted surface, each
+- the authored-class census and the `extractStyles` reading taken on the mounted screen, each
   reporting the population it walked;
 - the statechart table driven to a terminal status with no failed row, and the harness tally read
   from the object and from its markup;
@@ -378,5 +382,5 @@ block is the home of that limit and of the condition that reopens it. Cite that
 neither into a verdict.
 
 Report each journey by the intent it proves, the refusals it establishes, the states it placed, the
-variants it read, the statechart outcome it reached, and every surface finding the layer's refusals
+variants it read, the statechart outcome it reached, and every screen finding the layer's refusals
 exposed.

package/dist/host/agents/skills/orkestrel-journey/references/captures.md

@@ -51,12 +51,12 @@ The package already refuses these, so assert none of them again:
 
 Declare the state names once in the journey file, and build the portfolio from that declaration.
 
-- Name a state for its surface and its condition — `answer-partial`, `start-storage-failure`,
+- Name a state for its screen and its condition — `answer-partial`, `start-storage-failure`,
   `case-delete-confirmation`.
 - Register the states the design work actually needs, and place every registered one. Never leave a
   registered state unplaced.
 - Place a capture state from inside the journey that reaches it, immediately after the assertion
-  that proves the surface is in the condition that state names.
+  that proves the screen is in the condition that state names.
 - Record each placed name in the suite's own set in the same step that calls `place`. That set, not
   `placements`, is what the always-on placement proof reads.
 
@@ -117,7 +117,7 @@ after the click returns.
 - Take each frame after the paint settles. Reach for `waitForAnimations` on the element whose
   transition was running ([layer.md](layer.md) → The waits); a frame shot mid-transition pictures a
   state the interface never rests in.
-- Regenerate the whole matrix from the journeys after any surface change. Never judge a round
+- Regenerate the whole matrix from the journeys after any screen change. Never judge a round
   against a portfolio that is part old and part new.
 - Route review of the portfolio to the `orkestrel-polish` campaign, which owns preflight,
   verdicts, and reconciliation. This reference owns only how the journeys generate it.

package/dist/host/agents/skills/orkestrel-journey/references/decide.md

@@ -3,12 +3,13 @@
 Route a question by what judges the claim, before spending a round on it. Report a question no
 instrument here answers as open, and never answer it with the nearest instrument instead.
 
-| The claim is judged by                 | Route it to                                  |
-| -------------------------------------- | -------------------------------------------- |
-| A compiler, a linter, or a Node runner | The `prove` tool, with its negative control  |
-| A person's eye                         | The run's written artifact, named by variant |
-| A person watching a widget move        | The harness run's frames and its artifact    |
-| The browser's own resolved value       | The matrix family ([styles.md](styles.md))   |
+| The claim is judged by                           | Route it to                                                                                                                               |
+| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| A compiler, a linter, or a Node runner           | The `prove` tool, with its negative control                                                                                               |
+| A person's eye                                   | The run's written artifact, named by variant                                                                                              |
+| A person watching a widget move                  | The harness run's frames and its artifact                                                                                                 |
+| The browser's own resolved value                 | The matrix family ([styles.md](styles.md))                                                                                                |
+| A flow a model drove through the browser toolset | A recorded journey replayed through `@orkestrel/browser`, judged by the run's steps ([recorded.md](recorded.md)), never by the transcript |
 
 Never ask `prove` about pixels, and never ask a screenshot about types.
 
@@ -53,8 +54,8 @@ so a decision cites the exact file and reads it in one call.
 
 Compose each file from what the run already holds:
 
-- `describeTree` of the mounted surface, for the roles, names, and states a person meets.
-- `describeFocus` of the mounted surface, for the focus order the keyboard walk took.
+- `describeTree` of the mounted screen, for the roles, names, and states a person meets.
+- `describeFocus` of the mounted screen, for the focus order the keyboard walk took.
 - The resolved-style rows the matrix family read for that variant — the property, the element, and
   the value the browser returned.
 - The journal's `steps` and `output`, for what the run did and what the page said while it did it.
@@ -66,7 +67,7 @@ Rules the artifact obeys:
   combination nobody can reproduce.
 - Write one file per variant, never one file per journey. A decision is taken per variant, and a
   reader opening one file per journey pays a round trip per journey.
-- Regenerate the whole set after any surface change. Never judge a round against a set that is part
+- Regenerate the whole set after any screen change. Never judge a round against a set that is part
   old and part new.
 - Keep it out of version control.
 

package/dist/host/agents/skills/orkestrel-journey/references/layer.md

@@ -185,13 +185,13 @@ the capture voices in [captures.md](captures.md).
 
 - Report an absent control and a present-but-unreachable one as different findings: absence names
   a missing control, and unreachability names the interface gating one that exists.
-- Report ambiguity as a finding about the surface. Quote the match count from the message, and
+- Report ambiguity as a finding about the screen. Quote the match count from the message, and
   re-target the journey by role or region.
 - Assert a `DOMException` on its `name` as well as its message. A withheld storage operation raises
   `SecurityError` and a write past the quota raises `QuotaExceededError`, which is the pair a denied
   or full origin raises.
 - Never assert a `could not be resolved` sentence. Each one is narrowing the resolver needs under
-  `noUncheckedIndexedAccess`, and no surface reaches it.
+  `noUncheckedIndexedAccess`, and no screen reaches it.
 - Read a refused bound as a test defect rather than a finding. The wait family validates its budget
   and its interval and names the argument the caller passed, under the subject `Wait` or
   `Animation`.
@@ -211,7 +211,7 @@ the capture voices in [captures.md](captures.md).
   `fillAccessible` where the text is only a payload the person pastes.
 - Bring focus about first — through `traverseAccessible`, `clickAccessible`, or `typeAccessible` —
   and then press. The refusal is what `pressKeys` adds over the provider's own keyboard call: a key
-  sent to the body reaches no control, and every assertion after it reads a surface the key never
+  sent to the body reaches no control, and every assertion after it reads a screen the key never
   touched.
 - Escape the sequence yourself where the sequence is the subject. Reach for `typeAccessible` where
   the text is the subject and the key syntax is in the way.
@@ -245,7 +245,7 @@ the capture voices in [captures.md](captures.md).
 - Pass `absent: true` to `waitForState` where the claim is that the state went away, and read the
   returned states rather than taking a second reading afterwards.
 - Take `waitForState` as the published replacement for a settle keyed to a framework's own class
-  names. Where the control announces nothing, the finding is the surface's: give it `aria-expanded`,
+  names. Where the control announces nothing, the finding is the screen's: give it `aria-expanded`,
   `aria-pressed`, or `aria-busy` rather than reading the classes a stylesheet happens to use.
 - Take every style, contrast, and capture reading after `waitForAnimations` on the element whose
   paint was moving. A reading taken mid-transition reports an interpolated frame no state of the
@@ -274,7 +274,7 @@ the capture voices in [captures.md](captures.md).
   locators do not, because the platform exposes a native disclosure rather than a role.
 - Drive an ARIA disclosure as what it is: a button. Click it with `clickAccessible`, then settle it
   with `waitForState` on the state it announces.
-- Report a control that opens a panel and announces no state as a surface finding. Author
+- Report a control that opens a panel and announces no state as a screen finding. Author
   `aria-expanded` on it rather than settling on the classes its framework toggles.
 - Read a native summary's expansion with `readStates`, which reads the parent `details` element's
   own `open` where the summary declares no `aria-expanded`.

package/dist/host/agents/skills/orkestrel-journey/references/recorded.md

@@ -0,0 +1,77 @@
+# Recorded browser journeys
+
+Judge a journey a model recorded through `@orkestrel/browser` by the steps its replay ran, never by
+the transcript of the session that recorded it. Translate those steps into the journey layer before
+a run of them counts toward a family this skill declares.
+
+## The vocabulary
+
+```ts
+import { waitForText } from '@orkestrel/test'
+import {
+	clickAccessible,
+	fillAccessible,
+	pressKeys,
+	readPage,
+	readPerception,
+} from '@orkestrel/test/browser'
+```
+
+## What a recording holds
+
+- Read a recorded journey as one user intent kept as JSON: a `name`, a one-sentence `description`,
+  the `parameters` it declares, and `steps` that mirror the browser toolset's own tool calls.
+- Take an acting step's target from its role and exact accessible name. Read its record-time
+  `reference` and its `css` selector only as evidence for a refused resolution; a replay reads
+  neither, and a translated step carries neither.
+- Name each journey tool for its act: `record` starts a recording, `save` keeps it under its name,
+  `journeys` reads the listing, `edit` changes steps by id, `replay` runs, and `forget` discards the
+  journey with its runs.
+- Find a `browse` server's files under `tmp/browsers/`: the journey at `NAME/journey.json`, each
+  run at `NAME/runs/ID/run.json` beside that run's step captures, and the server's browser profile
+  under `.profiles/`. `NAME` is the journey's name and `ID` is the run id the store minted.
+- Register a `browse` server per `.claude/rules/quality.md` § Instruments.
+
+## Translate a step
+
+Translate each step through the following table. [layer.md](layer.md) owns each verb's contract.
+
+| Recorded step                                             | Journey layer                                                                |
+| --------------------------------------------------------- | ---------------------------------------------------------------------------- |
+| `click`                                                   | `clickAccessible(role, name)` with the step's role and name                  |
+| `type`                                                    | `fillAccessible(name, text)`, refused for a `combobox` or a `listbox` target |
+| `press`                                                   | `pressKeys(keys)`, with the chord translated                                 |
+| `wait`                                                    | `waitForText(description, read, text)`                                       |
+| `navigate`, `switch`, `dialog`, a page tool, `unresolved` | Refused                                                                      |
+
+- Refuse a `type` step whose target is a `combobox` or a `listbox`. The toolset selected an option
+  there, and `fillAccessible` replaces a field's text.
+- When a `type` step carries `submit`, follow the fill with `pressKeys('{Enter}')` on the same field.
+- Translate a `press` chord into the provider's key syntax: hold each modifier with `{Name>}`, send
+  the terminal key, and release the modifiers with `{/Name}` in reverse order. `Enter` becomes
+  `{Enter}`, and `Control+Shift+P` becomes `{Control>}{Shift>}P{/Shift}{/Control}`.
+- Scope the reader a `wait` step passes to `waitForText` per [layer.md](layer.md) § The waits:
+  `readPerception` over the region the sentence lands in, and `readPage` only where the claim is
+  about the whole page.
+- Refuse `navigate`: reach the page through the visible link or control that navigates, per
+  [layer.md](layer.md) § The named bans. Refuse `switch`, `dialog`, a page tool, and an `unresolved`
+  step, and report each as a step the layer has no verb for.
+
+## Judge a run
+
+- Feed a run's `steps` and `output` into the variant artifact ([decide.md](decide.md) § The
+  rendered artifact) as automation evidence, labelled with the journey name and the run id.
+- Discharge none of this skill's laws with a run until the workspace holds a trusted-input adapter
+  that drives the steps through the published verbs. A family stays open until a journey test
+  drives the translated steps.
+- Read a run whose `outcome` is `stopped` or `aborted` as the step it stopped at, and never as the
+  journey's outcome.
+
+## Review a recording
+
+Review a model's recording before a replay or a translation. The recorder keeps every action that
+completed, so the recording carries each detour and each repeated submission the model made.
+
+1. Read the listing `journeys` returns for the journey.
+2. Remove each detour and each repeated step through `edit` with the `remove` operation, by step id.
+3. Discard a recording that does not carry the intent through `forget`, and record it again.

package/dist/host/agents/skills/orkestrel-journey/references/statechart.md

@@ -36,7 +36,7 @@ import {
   `assert`. Each phase receives the context and the part of the transition it owns.
 - Put the scenarios and the table in the workspace's browser test setup module, and import them from
   there.
-- Declare a transition for every event the surface accepts in every state it accepts it, including
+- Declare a transition for every event the screen accepts in every state it accepts it, including
   the event that leaves the state unchanged. A table that lists only the moves the happy path takes
   proves the happy path.
 - Write the phases as module functions the whole table shares. Each phase reads its subject from its
@@ -184,7 +184,7 @@ it('walks the disclosure statechart', async () => {
 - Drive `act` through the journey verbs — `clickAccessible`, `clickDisclosure`, `typeAccessible`,
   `traverseAccessible`, `pressKeys` — for every transition a person can cause.
 - Drive `act` through the entity's own API only where the transition is the entity's rather than the
-  person's: a lifecycle event, a transport reply, a timer the surface owns.
+  person's: a lifecycle event, a transport reply, a timer the screen owns.
 - Say which door each row used, in the row's `name`. A table that mixes the doors silently reads as
   a set of user transitions and proves something else.
 
@@ -286,7 +286,7 @@ import it.
 
 - Name only the attribute contract such a page must honour: the names in `STATECHART_ATTRIBUTES`,
   the readings in `STATECHART_STATUSES`, and the tally on one root node.
-- Report the page itself as the repository owner's decision — which transitions a surface owes,
+- Report the page itself as the repository owner's decision — which transitions a screen owes,
   where the page is linked, and whether it ships at all.
 - Route a person who must watch the widget move to the harness run's own frames and its written
   artifact ([decide.md](decide.md) → The harness run), and name a deep link only where the workspace

package/dist/host/agents/skills/orkestrel-journey/references/styles.md

@@ -1,6 +1,6 @@
 # Proving what the browser resolved
 
-Prove a style from what the browser resolved on the mounted surface. The `enterprise-bootstrap`
+Prove a style from what the browser resolved on the mounted screen. The `enterprise-bootstrap`
 skill's [instruments reference](../../enterprise-bootstrap/references/inspection.md) names each
 instrument's property, its population, and its coverage. Take those from there, the reading from
 here, and the control from the builder this layer publishes for it.
@@ -75,12 +75,12 @@ readings follow.
   reads the whole matrix, where the capture family renders one variant per run.
 - Compose each variant's `apply` in the test, and apply it with the variant's `width` and `height`
   before the readings. Take every reading for that variant before moving to the next.
-- Name the attribute the surface actually reads in `apply`; a Bootstrap surface switches on
+- Name the attribute the screen actually reads in `apply`; a Bootstrap screen switches on
   `data-bs-theme`. An `apply` that sets another attribute leaves the run in the default theme, where
   every reading passes.
-- Reach for the application's own theme control where the surface ships one, and assert the state it
+- Reach for the application's own theme control where the screen ships one, and assert the state it
   announces. Setting the attribute directly proves the stylesheet; driving the control proves the
-  surface.
+  screen.
 - Assert that the run read every declared variant. A matrix that silently walked one variant reports
   a pass for the theme nobody exercised.
 - Report which variants a result covers beside it. A pairing that appears only in a state the run
@@ -102,7 +102,7 @@ provided.
   `pressKeys`, or a real click. Pass `worn` where the chrome is painted onto a second element such
   as a label. It reports `undefined` for a control not matching `:focus-visible`, for the browser's
   own automatic ring, and for a focus style that only repaints the fill — treat each as a finding
-  about the surface rather than as a pass.
+  about the screen rather than as a pass.
 - Reach for `measureContrast`, `measureLuminance`, `blendColor`, `readLayers`, and `readBackdrop`
   only where the composite itself is the subject. Never re-derive `readContrast` from them.
 
@@ -117,7 +117,7 @@ Take each reading's control from the builder this layer publishes for it.
 | `extractStyles` | `buildEscapes(permitted)` | An inline declaration, an embedded `<style>` element, and the sheet the id exempts     |
 | `readCensus`    | `buildCensus()`           | An HTML token and an SVG token, neither declared by any loaded stylesheet              |
 
-- Append each control's `root` to the same surface root the reading walks, take the reading, and
+- Append each control's `root` to the same screen root the reading walks, take the reading, and
   remove it afterwards. Every builder returns detached nodes and mounts nothing, so where the
   control is read is the caller's decision.
 - Assert on the fields the builder returns rather than on a token or a selector written down in the
@@ -134,12 +134,12 @@ Take each reading's control from the builder this layer publishes for it.
 Take the property, the population, and the coverage from the instruments reference → Authored class
 in the shipped cascade. This is the reading.
 
-- Read the census with `readCensus(root)`, which walks the mounted surface, reports `elements` as
+- Read the census with `readCensus(root)`, which walks the mounted screen, reports `elements` as
   the population it read, lists every `tokens` value the markup carries, and lists as `undeclared`
   the tokens no loaded stylesheet declares. It refuses a walk that read no element.
 - Assert on `elements` as well as on `undeclared`. An empty walk reports no undeclared token, and so
   does markup whose every class the cascade declares.
-- Take `root` from the mounted surface, so the census covers what rendered rather than what a
+- Take `root` from the mounted screen, so the census covers what rendered rather than what a
   template file spells.
 - Read `readClasses` and `readCascade` directly only where one side of the difference is the
   subject. `readCensus` is the reading, and re-deriving it drops the population it reports.
@@ -152,7 +152,7 @@ Take the property, the population, the named exemptions, and the coverage from t
 reference → Style escapes. This is the reading.
 
 - Read escapes with `extractStyles(root)`, which returns the markup of every hit it found.
-- Take the reading before any journey drives the surface, because the population is the undriven
+- Take the reading before any journey drives the screen, because the population is the undriven
   tree.
 - Append `buildEscapes(permitted).root` to that same `root`, so the control reaches the reading
   through `extractStyles`.

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -57,6 +57,10 @@ online audit reports the floor-restored files as stale until the release. The `-
 skips the catalog step and exits `1` with a note naming that refusal, so run the full
 `scaffold overwrite` after the release.
 
+When the target is the `@orkestrel/scaffold` package, expect the runner to record the overwrite step
+as skipped and to read the verify audit's foreign-path findings as expected; never run the `scaffold repair` or `scaffold overwrite` command
+against that checkout.
+
 Run visits in parallel slices of disjoint repositories, each slice strictly serial inside itself,
 reporting per target. Refuse a failed target, name it, repair it, and re-run it alone.
 

package/dist/host/agents/skills/orkestrel-publish/scripts/wave.ts

@@ -6,8 +6,11 @@
 // re-pin every @orkestrel range to the registry caret and install), commit (`git commit --only` of
 // the manifest and lockfile as the preparation commit), overwrite (`scaffold overwrite --json`, then
 // `scaffold audit` exiting 0; offline, an exit of 1 whose note names the catalog refusal is
-// accepted), verify (every declared range matches the registry), install, pins (the self-pin sweep
-// with --prior or the manifest version and every range the visit moved; hits are reported, not
+// accepted; on @orkestrel/scaffold itself both are skipped with a note, because the vendored host
+// is staged from that checkout), verify (`scaffold audit --json` prints the releases envelope and
+// every declared range matches the registry; on @orkestrel/scaffold itself an audit exit of 1 is
+// read as the expected foreign-path findings of its own canonical sources), install,
+// pins (the self-pin sweep with --prior or the manifest version and every range the visit moved; hits are reported, not
 // fatal), format, gates (format:check, lint:check, check, build, test), and compare (the rebuilt
 // dist against the published tarball, and the final runtime dependency set against the published
 // manifest `npm view NAME --json` serves; both readings are reported, not fatal). The summary
@@ -46,6 +49,9 @@ const RUNTIME_FIELDS: readonly string[] = ['dependencies', 'peerDependencies']
 const RANGE_FIELDS: readonly string[] = [...RUNTIME_FIELDS, 'devDependencies']
 const CATALOG = '.claude/agents/orkestrel.md'
 const OFFLINE_REFUSAL = "'catalog' does not take --offline"
+// The vendored host is staged from this package's checkout, so overwriting it from the host deletes
+// and replaces its own canon.
+const SCAFFOLD = '@orkestrel/scaffold'
 const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u
 // The checkout runs the `.ts` sources and a built twin under `dist/agents` runs `.js` siblings.
 const EXTENSION = extname(fileURLToPath(import.meta.url))
@@ -358,6 +364,7 @@ function runVerify(
 	scaffoldFile: string,
 	scaffoldPrefix: readonly string[],
 	offline: readonly string[],
+	own: boolean,
 ): void {
 	const audit = runStep(
 		runner,
@@ -367,6 +374,10 @@ function runVerify(
 		runner.target,
 	)
 	if (audit === undefined) return
+	// The audit reads the canonical sources of scaffold's own checkout as foreign paths and exits 1.
+	if (own && audit.status === 1) {
+		replaceLastStep(runner, 0, 'foreign-path findings are expected on the scaffold checkout')
+	}
 	const releases = readReleases(audit.stdout)
 	if (releases === undefined) {
 		replaceLastStep(
@@ -490,10 +501,17 @@ function runVisit(argv: readonly string[]): Visit | undefined {
 	if (selected.has('pin')) runPin(runner, scaffoldFile, scaffoldPrefix, offline)
 	if (selected.has('commit') && !failed(runner)) runCommit(runner)
 	if (selected.has('overwrite') && !failed(runner)) {
-		runOverwrite(runner, scaffoldFile, scaffoldPrefix, offline)
+		if (name === SCAFFOLD) {
+			recordStep(
+				runner,
+				'overwrite',
+				describeCommand(scaffoldFile, [...scaffoldPrefix, 'overwrite', '--json', ...offline]),
+				`skipped with its audit: ${SCAFFOLD} is the package whose checkout the vendored host is staged from`,
+			)
+		} else runOverwrite(runner, scaffoldFile, scaffoldPrefix, offline)
 	}
 	if (selected.has('verify') && !failed(runner)) {
-		runVerify(runner, scaffoldFile, scaffoldPrefix, offline)
+		runVerify(runner, scaffoldFile, scaffoldPrefix, offline, name === SCAFFOLD)
 	}
 	if (selected.has('install') && !failed(runner)) runNpmStep(runner, 'install', ['install'])
 	if (selected.has('pins') && !failed(runner)) {