@orkestrel/scaffold 0.0.90 → 0.0.92

package/dist/host/guides/pool.md

@@ -1,12 +1,13 @@
 # Pool
 
-> A typed resource pool with optional bounded capacity, unique ownership, FIFO settlement,
-> validated reuse, caller-owned cancellation, explicit cleanup failures, and a stable
-> event-driven teardown barrier.
+> A typed resource pool with optional bounded capacity, a warm floor, bounded loss recovery,
+> unique ownership, FIFO settlement, validated reuse, caller-owned cancellation, and explicit cleanup.
 
-The pool has no warm floor, eviction timer, acquire timeout, or polling loop. Every wait parks
-on a promise or a signal listener and wakes when a settlement reaches it, and the lifecycle
-hooks are the caller's, so the engine itself performs no I/O.
+The pool supports lazy creation or a warm floor, with no eviction timer, acquire timeout,
+or polling loop. Waits park on promises or signal listeners. An acquire rejects with
+`cleanup` when a floor retains a record, owns `min` records, has nothing idle, and has no
+refill or disposal pending, even with live leases. The lifecycle hooks are the caller's,
+so the engine itself performs no I/O.
 
 ## Surface
 
@@ -44,10 +45,10 @@ try {
 
 ### Classes
 
-| API         | Kind  | Summary                                                                                                                                                                                  |
-| ----------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `Pool`      | class | Represents a capacity-aware resource pool whose opaque ownership records preserve FIFO settlement, cancellation, exact lease release, and deterministic teardown under concurrent hooks. |
-| `PoolError` | class | Represents a stable, machine-readable pool failure that retains the original thrown value as its cause without unsafe coercion, alongside structured context.                            |
+| API         | Kind  | Summary                                                                                                                                                                                                                    |
+| ----------- | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Pool`      | class | Represents a resource pool with optional bounded capacity and a warm floor, whose opaque ownership records preserve FIFO settlement, cancellation, exact lease release, and deterministic teardown under concurrent hooks. |
+| `PoolError` | class | Represents a stable, machine-readable pool failure that retains the original thrown value as its cause without unsafe coercion, alongside structured context.                                                              |
 
 ### Guards
 
@@ -63,20 +64,20 @@ In a guard table a `Shape` cell holds the type the guard narrows to.
 
 A `Shape` cell holds an interface's data members as bare names in braces, `?` marking an optional member and `plus` introducing its call-signature members, and a type alias's own type literal with a union's arms escaped as `\|`.
 
-| API                | Kind      | Shape                                                          | Summary                                                                                                                                                     |
-| ------------------ | --------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `PoolCode`         | type      | `'invalid' \| 'destroyed' \| 'create' \| 'cleanup'`            | Names the machine-readable failure codes produced by `PoolError`.                                                                                           |
-| `PoolContext`      | interface | `{ value?, failures? }`                                        | Represents the structured context attached to a `PoolError`: the rejected input, or the distinct destroy-hook failures an aggregate cleanup collected.      |
-| `PoolErrorOptions` | interface | `{ code, cause?, context? }`                                   | Represents the construction options for `PoolError`: the stable code, an optional cause, and optional structured context.                                   |
-| `PoolEventMap`     | type      | `{ create, acquire, release, destroy }`                        | Represents the observable resource lifecycle events emitted by a `PoolInterface`.                                                                           |
-| `PoolToken`        | interface | `{ value } plus release`                                       | Represents a unique lease over one pool-owned resource record, exposing that record as a readonly `value` and returning it through an idempotent `release`. |
-| `PoolOptions`      | interface | `{ on?, error?, create, destroy?, validate?, max? }`           | Represents the resource lifecycle options for `Pool` and `createPool`: creation, destruction, validation, capacity, and observation.                        |
-| `PoolInterface`    | interface | `{ emitter, size, idle, active } plus acquire, clear, destroy` | Represents a FIFO resource pool with optional bounded capacity and deterministic teardown, exposing its record counts and a typed lifecycle emitter.        |
-
-`size` counts every owned record, including records being validated or destroyed. `idle`
-counts only immediately available records. `active` counts only leased records. An in-flight
-create reservation claims capacity but is not yet an owned record and therefore is not part
-of `size`.
+| API                | Kind      | Shape                                                                         | Summary                                                                                                                                                                            |
+| ------------------ | --------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `PoolCode`         | type      | `'invalid' \| 'destroyed' \| 'create' \| 'cleanup'`                           | Names the machine-readable failure codes produced by `PoolError`.                                                                                                                  |
+| `PoolContext`      | interface | `{ value?, failures? }`                                                       | Represents the structured context attached to a `PoolError`: the rejected input, or the distinct destroy-hook failures an aggregate cleanup collected.                             |
+| `PoolErrorOptions` | interface | `{ code, cause?, context? }`                                                  | Represents the construction options for `PoolError`: the stable code, an optional cause, and optional structured context.                                                          |
+| `PoolEventMap`     | type      | `{ create, acquire, release, destroy }`                                       | Represents the observable resource lifecycle events emitted by a `PoolInterface`.                                                                                                  |
+| `PoolToken`        | interface | `{ value } plus release, destroy`                                             | Represents a unique lease over one pool-owned resource record, exposing that record as a readonly `value` and ending it through an idempotent `release` or `destroy`.              |
+| `PoolOptions`      | interface | `{ on?, error?, create, destroy?, validate?, watch?, max?, min?, restarts? }` | Represents the resource lifecycle options for `Pool` and `createPool`: creation, destruction, validation, capacity, a bounded warm floor, and loss observation.                    |
+| `PoolInterface`    | interface | `{ emitter, size, idle, active } plus start, acquire, clear, destroy`         | Represents a FIFO resource pool with optional bounded capacity, a warm floor, loss recovery, and deterministic teardown, exposing its record counts and a typed lifecycle emitter. |
+
+`size` counts every owned record, including records being validated, destroyed, or retained
+after failed cleanup under `min`. `idle` counts only immediately available records.
+`active` counts only leased records. An in-flight create reservation claims capacity but is
+not yet an owned record and therefore is not part of `size`.
 
 ## Methods
 
@@ -85,22 +86,107 @@ The public call-signature members of `PoolInterface` and `PoolToken`; `Pool` imp
 
 #### `PoolInterface`
 
-| Method    | Returns                 | Summary                                                                                                                   |
-| --------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------- |
-| `acquire` | `Promise<PoolToken<T>>` | Queues the caller in FIFO order, validates an idle record or creates one, and settles queued acquires in that same order. |
-| `clear`   | `Promise<void>`         | Destroys the records that are idle at this call's synchronous snapshot.                                                   |
-| `destroy` | `Promise<void>`         | Tears down the pool permanently and returns its stable completion barrier.                                                |
+| Method    | Returns                 | Summary                                                                                                                            |
+| --------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `start`   | `Promise<void>`         | Fills the warm floor and resets the strikes of a spent floor; without a floor, resolves immediately.                               |
+| `acquire` | `Promise<PoolToken<T>>` | Queues the caller in FIFO order, validates an idle record or waits for a floor refill, and creates on demand only without a floor. |
+| `clear`   | `Promise<void>`         | Destroys the records that are idle at this call's synchronous snapshot and restores a started floor.                               |
+| `destroy` | `Promise<void>`         | Tears down the pool permanently and returns its stable completion barrier.                                                         |
 
 #### `PoolToken`
 
-The lease returned by `acquire`, with the operation that returns its record.
+The lease returned by `acquire`, with operations that return or dispose its exact record.
 
-| Method    | Returns | Summary                                                                                                             |
-| --------- | ------- | ------------------------------------------------------------------------------------------------------------------- |
-| `release` | `void`  | Gives this exact record back to the pool once; a repeat call, and a call after teardown took ownership, are no-ops. |
+| Method    | Returns         | Summary                                                                                                                     |
+| --------- | --------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| `release` | `void`          | Gives this exact record back to the pool once; a repeat call, and a call after loss or teardown took ownership, are no-ops. |
+| `destroy` | `Promise<void>` | Destroys this exact record instead of returning it; a repeat call, and a call after release, are no-ops.                    |
 
 ## Contract
 
+### Warm floor and loss
+
+Construction creates nothing. Set `min` to a positive safe integer and `restarts` to a
+non-negative safe integer, then call `start()`. `max` defaults to `min`; explicit values
+must equal each other. A missing restart bound, a bound without `min`, and a non-callable
+`watch` are invalid. The restart bound has no default.
+
+`start()` resolves when the pool owns `min` live records. Concurrent calls share the pending
+promise. Without `min`, it resolves immediately. Under `min`, queued acquires never cause
+creation, including before `start()` and during failed refills. The pool refills missing
+capacity after startup and cleanup, one create attempt at a time.
+Bound your `create` and `destroy` hooks. A create hook that never settles blocks every later
+refill, including the attempt owed to a lost leased record. A destroy hook that never settles
+keeps its record counted against `max` and blocks replacement of that record.
+
+`watch(value, signal)` runs once for each created record. A fulfillment, rejection, or
+synchronous throw declares loss while the record is live. The pool removes the record from
+service, disposes it, and refills if the bound permits. Rejections and synchronous throws
+reach `error(error, 'watch')` only while the record is live; a throwing error handler is
+isolated. Disposal aborts the watch signal before the destroy hook runs, including disposal
+through validation, clear, pool teardown, and token destruction.
+The watch must release its listeners when that signal aborts. Any settlement after the signal
+aborts is ignored, including rejection. A late or repeated loss cannot
+dispose a record twice. A lost record cannot be handed out after validation or from a ready
+result waiting behind an earlier caller. The pool disposes a lost leased record while its
+holder still holds the token. The holder learns of that loss from its own `watch` or `destroy`
+hook. After disposal, the token's `release()` and `destroy()` calls do nothing. During disposal,
+the first `destroy()` call waits for that cleanup attempt and rejects with `cleanup` if it fails.
+
+A failed refill adds a strike. Losing a record that has never been leased also adds a strike,
+including failed validation. Granting a lease resets the strikes only when the granted record
+was created after the last strike; successful creation alone does not. Granting an older healthy
+record leaves the strikes unchanged. An idle never-leased record that dies, refills, and dies
+again without a grant between those losses can spend the floor.
+When strikes exceed `restarts`, the floor is spent. With `restarts: 1`, the first failed
+create permits another attempt, and the second refuses the next attempt. `start()` rejects
+with `create` and the last cause; another `start()` resets the strikes. While the floor is
+spent, an acquire without an idle record rejects with `create` after pending refills and
+disposal settle. If the floor retains a record and owns `min` records, that acquire rejects
+with `cleanup` instead, even with live leases. A spent floor and a rejected `start()` still
+serve their live records. A loss without a thrown cause leaves that cause undefined.
+
+A record lost while leased earns one refill attempt even after the bound is spent.
+The credit becomes spendable only when successful disposal removes the record; failed disposal
+grants no credit. That attempt remains owed during a concurrent refill and never resets the strikes.
+Its failed create adds a strike; its success alone does not reset the strikes. Granting that
+replacement resets the strikes only if no strike occurred after its creation. A record that was leased
+and later released adds no strike when lost. `token.destroy()` disposes the exact leased
+record, waits for an existing cleanup attempt, and rejects with `cleanup` if disposal fails.
+A token ends once: after `release()` or `destroy()`, the other call does nothing. Repeating
+either call does nothing. A repeat `token.destroy()` after a `cleanup` rejection resolves
+while the record stays retained.
+
+Under `min`, a failed destroy hook leaves its record counted against `max` and excluded from
+idle and active counts. The pool never replaces that retained record or retries its destroy
+hook. The pool can run short; `start()` rejects with `cleanup` if retained records prevent
+filling. An acquire rejects with `cleanup` when the floor retains a record, owns `min` records,
+has nothing idle, and has no refill or disposal pending, even with live leases. The cause is
+the retained record's own cleanup failure. The terminal `destroy()` barrier
+reports the original cleanup failures. Without `min`, cleanup retains its lazy behavior and
+frees capacity after either hook outcome.
+
+This example warms an inert resource, explicitly loses its lease, and tears down the pool:
+
+```ts
+import { createPool } from '@orkestrel/pool'
+
+const pool = createPool({
+	create: () => new EventTarget(),
+	min: 1,
+	restarts: 1,
+	watch: (resource, signal) =>
+		new Promise<void>((resolve) => {
+			resource.addEventListener('loss', () => resolve(), { once: true, signal })
+			signal.addEventListener('abort', () => resolve(), { once: true })
+		}),
+})
+await pool.start()
+const token = await pool.acquire()
+await token.destroy()
+await pool.destroy()
+```
+
 ### Capacity and FIFO
 
 Every `acquire` receives its queue position before a create or validation hook starts. The
@@ -112,15 +198,18 @@ cannot overtake an earlier slow one. Capacity obeys:
 owned records + create reservations <= max
 ```
 
-`max` must be a positive safe integer. Omit it for an unbounded pool; `Infinity`, fractions,
-zero, negative values, and unsafe integers are invalid. Construction snapshots `max` once and
-validates it before retention, then snapshots `on` and `error` once each.
+`max` must be a positive safe integer. Omit both capacity options for an unbounded pool.
+`Infinity`, fractions, zero, negative values, and unsafe integers are invalid.
+Construction snapshots `max` once and validates it before retention, then snapshots `on`
+and `error` once each.
 
 Record phases are disjoint:
 
 ```text
 create reservation -> ready -> leased -> available -> validating -> ready
                                       \-> destroying -> removed
+                                                     \-> retained (failed cleanup with min)
+floor refill --------------------------> available
 ```
 
 Invalid validation, whether `false` or a thrown value, claims and cleans the record before a
@@ -148,16 +237,20 @@ eventual `destroy()` barrier.
 A token captures its exact opaque record, so `release()` is correct even when multiple
 records contain the same value. Release is idempotent and removes the lease synchronously.
 With a waiter, the record is validated before handoff. Without an assignable waiter, it
-becomes idle and emits `release`. Release after teardown ownership transferred is a no-op.
+becomes idle and emits `release`. Release after loss or teardown took ownership does nothing.
+The pool disposes a lost lease while its holder still holds the token; the holder learns of
+the loss through its own `watch` or `destroy` hook. After disposal, both token methods do nothing.
 
 `clear()` synchronously snapshots idle records and installs one cleanup promise per record
 before invoking the hook. Concurrent clears therefore own disjoint snapshots, and a lease
-released after a snapshot is taken is not part of it. Every claimed record stays in `size` until its
-hook attempt completes. Distinct failures are aggregated in a code-`cleanup` `PoolError`
-whose `context.failures` retains the original thrown values.
-Each claimed record's cleanup settlement independently wakes queued acquires after the
-destroy ledger transition, whether its cleanup hook succeeded or failed; a failed `clear()`
-still rejects its own aggregate cleanup barrier.
+released after a snapshot is taken is not part of it. Every claimed record stays in `size` during
+its hook attempt; failed cleanup under `min` retains it afterward. Distinct failures are
+aggregated in a code-`cleanup` `PoolError` whose `context.failures` retains the original thrown
+values.
+Each claimed record's cleanup settlement wakes queued acquires after the destroy ledger
+transition. A failed `clear()` rejects its own aggregate cleanup barrier; under `min`,
+the pool keeps a record whose cleanup fails counted against `max`, and successful cleanup
+restores a started floor.
 
 ### Destruction
 
@@ -165,7 +258,8 @@ still rejects its own aggregate cleanup barrier.
 rejects waiters, emits events, or invokes cleanup. Reentrant and repeated calls return that
 same object. Teardown invalidates idle, leased, and ready records, waits for create,
 validation, existing clear cleanup, and new cleanup activity, and disposes every late
-resource. Unresolved hooks keep the barrier pending without polling.
+resource. A pending `start()` rejects with `destroyed`. Unresolved create, validation, and
+destroy hooks keep the barrier pending without polling; aborted watches do not delay it.
 
 Cleanup already owned by an overlapping `clear()` is shared; its failure is reported to both
 the clear call and the destroy aggregate. Create failures that produced no resource do not
@@ -176,12 +270,12 @@ hook attempt, then the stable barrier resolves or rejects.
 
 `PoolError.code` is stable and lowercase:
 
-| Code        | Owner                                                                    |
-| ----------- | ------------------------------------------------------------------------ |
-| `invalid`   | Invalid explicit `max`, invalid acquire signal, or an internal boundary. |
-| `destroyed` | Acquire or clear attempted after terminal teardown began.                |
-| `create`    | The create hook failed for its bound acquire.                            |
-| `cleanup`   | Invalid-handoff, clear, or destroy cleanup failed.                       |
+| Code        | Owner                                                                               |
+| ----------- | ----------------------------------------------------------------------------------- |
+| `invalid`   | Invalid capacity, restart bound, watch hook, acquire signal, or internal boundary.  |
+| `destroyed` | Start, acquire, or clear attempted during terminal teardown.                        |
+| `create`    | A lazy create failed, or a floor refill bound was spent.                            |
+| `cleanup`   | Record disposal failed, including retained records blocking startup or acquisition. |
 
 The original thrown value is retained as `cause`; aggregate cleanup values are also in
 `context.failures`. Message construction and `isPoolError` avoid unsafe string coercion and
@@ -194,12 +288,12 @@ invokes listeners synchronously at each emission point. The `destroy` emission i
 one microtask after cleanup settlement so bound outcomes precede observer reentry. Events
 follow their ledger transitions:
 
-| Event     | Emission point                                                                                                                                                      |
-| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `create`  | After a fresh resource is inserted into the ownership ledger.                                                                                                       |
-| `acquire` | After the waiter promise receives its token and the record is leased.                                                                                               |
-| `release` | Only when the released or orphaned-ready record remains idle.                                                                                                       |
-| `destroy` | After the hook attempt and resource-ledger removal, one microtask after private cleanup settlement, while destroying ownership remains installed through the event. |
+| Event     | Emission point                                                                                                                                                                   |
+| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `create`  | After a fresh resource is inserted into the ownership ledger.                                                                                                                    |
+| `acquire` | After the waiter promise receives its token and the record is leased.                                                                                                            |
+| `release` | Only when a released, orphaned, or refilled record remains idle.                                                                                                                 |
+| `destroy` | After the hook attempt and resource-ledger removal or retention, one microtask after private cleanup settlement, while destroying ownership remains installed through the event. |
 
 Because listeners may synchronously reenter or destroy the pool, the engine checks terminal
 and waiter state after every awaited hook and every emit.
@@ -260,7 +354,8 @@ await pool.destroy()
   hooks, create continuation, abort boundaries, abort-listener detachment, exclusive
   invalid-cleanup waiter ownership, bounded and unbounded replacement, destroy-observer
   reentry ordering, concurrent clear, stable reentrant destruction, late resources,
-  aggregate failures, emitter ordering, and high contention.
+  aggregate failures, emitter ordering, high contention, warm floors, exact refill bounds,
+  retained cleanup failures, watch cancellation, lost-record handoff races, and owed lease refills.
 - [`tests/src/core/validators.test.ts`](../tests/src/core/validators.test.ts) — the public
   boundary guards alone: accepted and rejected maxima, and native versus hostile signals.
 - [`tests/src/core/factories.test.ts`](../tests/src/core/factories.test.ts) — factory
@@ -271,7 +366,8 @@ await pool.destroy()
   its declaration's description paragraph, the titled `Create a pool` fence against the
   `@example` block of that title (pinned so the titled pair cannot be retired silently), and the
   README pitch against this guide's tagline. It also runs the boundary-guard fence and asserts
-  the values its comments claim.
+  the values its comments claim. The floor fence is checked line for line in execution order
+  and runs with assertions for warming, token cleanup, and watch-listener removal.
 
 ## See also
 

package/dist/host/manifest.json

@@ -4,7 +4,7 @@
 			"storage": "AGENTS.md",
 			"destination": "AGENTS.md",
 			"executable": false,
-			"digest": "357cfbe336a026543ec68f3eb999f1094c3139d33331b0ba5f153352cef75fde"
+			"digest": "0f789cb1faea49ac3664d2246788ae160f7b036b42a8d5cc6f9618551442ed3b"
 		},
 		{
 			"storage": "LICENSE",
@@ -16,7 +16,7 @@
 			"storage": "agents/orchestration.md",
 			"destination": ".agents/orchestration.md",
 			"executable": false,
-			"digest": "92f3b30439a037c611972fd600c88b7c7a22dbf1e12e4d601762c58915e33ec9"
+			"digest": "b31dfd8ec22606bf3d98ca2f32241c7f43d2537be49400c4b801028b4178bac0"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/SKILL.md",
@@ -220,7 +220,7 @@
 			"storage": "agents/skills/orkestrel-falsify/SKILL.md",
 			"destination": ".agents/skills/orkestrel-falsify/SKILL.md",
 			"executable": false,
-			"digest": "44c5f28bab784f2218032ffb1172b2ff7d21ce7990ae05ee75dfa73564fda46f"
+			"digest": "257ac6f56380decb55cb0ab7f2c2285f34474ba1a4b2944609c04218f4c9d013"
 		},
 		{
 			"storage": "agents/skills/orkestrel-falsify/agents/openai.yaml",
@@ -376,7 +376,7 @@
 			"storage": "agents/skills/orkestrel-publish/references/window.md",
 			"destination": ".agents/skills/orkestrel-publish/references/window.md",
 			"executable": false,
-			"digest": "1debb388eba46e221f99a2518de5aa94ba04ffced781a855b4a305cafc7176c3"
+			"digest": "00c520a8a0a67b7a20813c374fee4339cdb9fb48ff3926eb87f44c8cef204e8a"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/scripts/compare.ts",
@@ -406,7 +406,7 @@
 			"storage": "agents/skills/orkestrel-scout/SKILL.md",
 			"destination": ".agents/skills/orkestrel-scout/SKILL.md",
 			"executable": false,
-			"digest": "cc3298e0b5bc22aeb72bb6fa9f9e006c6b5b8f8f9e439263900c90e9541bcfb5"
+			"digest": "e42e0b06a0cc647b8f13f7bf033ed6b2800e13e61298e9a0d2f2d22688e5011a"
 		},
 		{
 			"storage": "agents/skills/orkestrel-scout/agents/openai.yaml",
@@ -424,7 +424,7 @@
 			"storage": "agents/templates/brief.md",
 			"destination": ".agents/templates/brief.md",
 			"executable": false,
-			"digest": "2e00bf607e3d9776e7f5dbe095201544a7479be7ae3a8e8d8c8ff62f204c42c1"
+			"digest": "7f479c0f2cfed85d5535a392474f6fe1a0a6de40ba1dfc37c4dc9c5e91a25ba8"
 		},
 		{
 			"storage": "agents/transports/claude-cli.md",
@@ -442,7 +442,7 @@
 			"storage": "agents/transports/cursor.md",
 			"destination": ".agents/transports/cursor.md",
 			"executable": false,
-			"digest": "a49d5fe77163ee8afb17b8a407a9fa3fdb5a9365cf4130e115b4c368908b1c0b"
+			"digest": "2c3063adbac28be4942398dad5c004a083d6018de95042bb2ae1f48ecd4a3f35"
 		},
 		{
 			"storage": "claude/AGENTS.md",
@@ -454,7 +454,7 @@
 			"storage": "claude/agents/analyst.md",
 			"destination": ".claude/agents/analyst.md",
 			"executable": false,
-			"digest": "a8a0fef71442681fb3d1d0d859dcad61e65732135431cf8cedf3d2d1d8d7cbf0"
+			"digest": "e1d7e4202b293ff7d8d934e95d1c499845f0f49729180077f417864dc179c84b"
 		},
 		{
 			"storage": "claude/agents/astra.md",
@@ -484,7 +484,7 @@
 			"storage": "claude/agents/grok.md",
 			"destination": ".claude/agents/grok.md",
 			"executable": false,
-			"digest": "7796fe8f4488a39d7e6d45ab21bbc6a98be5d607d324961b2cae9d610cf08a2d"
+			"digest": "6798fabf3a71e9514d8f33d7c310b7f20647951a0b847b11eee96f4150fb3e83"
 		},
 		{
 			"storage": "claude/agents/opus.md",
@@ -496,19 +496,19 @@
 			"storage": "claude/agents/orkestrel.md",
 			"destination": ".claude/agents/orkestrel.md",
 			"executable": false,
-			"digest": "565dee392dced6c3e1e632295739eeb9465ca4828d26c18d02b57f106fdc5f38"
+			"digest": "36afc2242e9becbb7662aeece1b0f81a12162aacfd360a48a07a3ec7eaf7d639"
 		},
 		{
 			"storage": "claude/agents/planner.md",
 			"destination": ".claude/agents/planner.md",
 			"executable": false,
-			"digest": "87407ce9ea76fed0f6d37fa153a0ea0086296b0e78c93b66cfa90e071a847773"
+			"digest": "86cef178ce25c8c8e002ea69c2e1bf0e21494ac77417e2376c5584fa3ae0c8b7"
 		},
 		{
 			"storage": "claude/agents/researcher.md",
 			"destination": ".claude/agents/researcher.md",
 			"executable": false,
-			"digest": "85c534e529865bec3c475c810b049ab1dd81e433b08effe098689111729eaa5d"
+			"digest": "e5f0686f6bb1825fbf6006933e034c1ef882501792a93f690ac4bb059132e926"
 		},
 		{
 			"storage": "claude/agents/reviewer.md",
@@ -520,7 +520,7 @@
 			"storage": "claude/agents/scout.md",
 			"destination": ".claude/agents/scout.md",
 			"executable": false,
-			"digest": "29de324181e783eb73de4a8213e44621d730f43b06a361c6ba77660fbe79bf09"
+			"digest": "fa55e6ca6c89dae3bdf6f2faddf6beea0746b8714962a45a44999f7d8b5f7691"
 		},
 		{
 			"storage": "claude/agents/verifier.md",
@@ -556,13 +556,13 @@
 			"storage": "claude/rules/names.md",
 			"destination": ".claude/rules/names.md",
 			"executable": false,
-			"digest": "6606f4f8b219c6631029235f4081f29b055952a635e76477dfd6febdbe61afe2"
+			"digest": "e5d0221d31ab7eed5c9b4ec4537a827103f61dd90edc58029ff5dac024a6f4ac"
 		},
 		{
 			"storage": "claude/rules/patterns.md",
 			"destination": ".claude/rules/patterns.md",
 			"executable": false,
-			"digest": "0fc0301c96b6b7ee23a4c743dc1903b06cf15a296155d9634ead0e813d61f200"
+			"digest": "b17a9102761262e116416d3c5a0f78b16fa2c3598ba203d35bba7b93b7ccbf1b"
 		},
 		{
 			"storage": "claude/rules/portability.md",
@@ -574,19 +574,19 @@
 			"storage": "claude/rules/quality.md",
 			"destination": ".claude/rules/quality.md",
 			"executable": false,
-			"digest": "7b8b9b3a4f4ee586d96deeb0cdd4fc9da68da663742cb56c96f64b2230ba89e6"
+			"digest": "4a67842795882635436aa001a7ad1d0b2b6b81b9d8dd51730b8c37e65ebd367a"
 		},
 		{
 			"storage": "claude/rules/styles.md",
 			"destination": ".claude/rules/styles.md",
 			"executable": false,
-			"digest": "869f88c392b4795e47af881d668f4dc591e0c419229a843eb4105e38dfb6f831"
+			"digest": "ae1c97f23d71c53ef117b2cd661df6258712988ec86de6c60a1cbad4670eb996"
 		},
 		{
 			"storage": "claude/rules/tests.md",
 			"destination": ".claude/rules/tests.md",
 			"executable": false,
-			"digest": "5808e375cf559c6d51aa3a744bcea574613945629e66e304c3d2f338b2f7abc0"
+			"digest": "0a7cf69072de3fb89afdd580c4d3b728130862f6d6865a2ec02a4881ddb504fa"
 		},
 		{
 			"storage": "claude/rules/typescript.md",
@@ -604,7 +604,7 @@
 			"storage": "claude/rules/writing.md",
 			"destination": ".claude/rules/writing.md",
 			"executable": false,
-			"digest": "f18fad032d2b02533c1e66420109af16d4b48a151069a457f4a6458e2bc54588"
+			"digest": "7a115369ba2a79cf6362444f474a58d9094f06a7d2fdd501b454158ceabc5d07"
 		},
 		{
 			"storage": "claude/settings.json",
@@ -736,7 +736,7 @@
 			"storage": "codex/agents/researcher.toml",
 			"destination": ".codex/agents/researcher.toml",
 			"executable": false,
-			"digest": "d9f3e2e811fe3754e6d99c6d8abccc0a4b1f21dfe1986a31cdcb1b5308434a7b"
+			"digest": "c6d8288e49428aac8bfc253807631c6cb308cadc67ebd29a226887844c623ad7"
 		},
 		{
 			"storage": "codex/agents/reviewer.toml",
@@ -748,7 +748,7 @@
 			"storage": "codex/agents/scout.toml",
 			"destination": ".codex/agents/scout.toml",
 			"executable": false,
-			"digest": "d5059678fcb3788b60c505323c2f9950ce386a4bee4f9fe355afad3079cb3bd1"
+			"digest": "b79ed6467954fc01d83fb66d687cb2cd7e10ba2ee061c3a3b8946a5540222298"
 		},
 		{
 			"storage": "codex/agents/verifier.toml",
@@ -862,7 +862,7 @@
 			"storage": "guides/browser.md",
 			"destination": "guides/browser.md",
 			"executable": false,
-			"digest": "4dd8f7377b165d840dd3060f0af955458fff193612f833aadd04d37c34734afe"
+			"digest": "deec731bfc8733f880021cbf9a8cf450e51a93bc23f2f963fb3e1bf750554ba8"
 		},
 		{
 			"storage": "guides/budget.md",
@@ -982,7 +982,7 @@
 			"storage": "guides/pool.md",
 			"destination": "guides/pool.md",
 			"executable": false,
-			"digest": "2154e2b25047ef0b365286fee4348c65066bb9a51e8b4c8f4461745b908a49fe"
+			"digest": "c49d3d2d3d5a2dc4518a8cebb94c82ba2dbcdc03222d5ad3885df13c46dfe8e2"
 		},
 		{
 			"storage": "guides/probe.md",
@@ -2144,5 +2144,5 @@
 			]
 		}
 	],
-	"digest": "551ef9dbdc726896039afd3e7edc69321303f148e28cd711a6e4ba028dba2d46"
+	"digest": "09b047e9598599db3dca2e26b55b897293e600defd7c35147dbab8a771816c0b"
 }

package/dist/src/core/index.cjs

@@ -4,7 +4,7 @@ let _orkestrel_template = require("@orkestrel/template");
 let _orkestrel_emitter = require("@orkestrel/emitter");
 var package_default = {
 	name: "@orkestrel/scaffold",
-	version: "0.0.90",
+	version: "0.0.92",
 	description: "Scaffold workspaces with commands: new, audit, repair, catalog, and overwrite.",
 	keywords: [
 		"audit",
@@ -104,10 +104,10 @@ var package_default = {
 	},
 	devDependencies: {
 		"@microsoft/api-extractor": "^7.59.3",
-		"@orkestrel/browser": "^0.0.22",
+		"@orkestrel/browser": "^0.0.24",
 		"@orkestrel/guide": "^0.0.24",
 		"@orkestrel/html": "^0.0.12",
-		"@orkestrel/probe": "^0.0.19",
+		"@orkestrel/probe": "^0.0.20",
 		"@orkestrel/test": "^0.0.24",
 		"@types/node": "^26.6.4",
 		"@vitest/browser-playwright": "^4.1.11",
@@ -691,6 +691,7 @@ var BROWSE_UPSTREAM = Object.freeze([
 	"@orkestrel/html",
 	"@orkestrel/markdown",
 	"@orkestrel/mcp",
+	"@orkestrel/pool",
 	"@orkestrel/process",
 	"@orkestrel/router",
 	"@orkestrel/server",