{
  "name": "@oshun/workbench-kit",
  "$schema": "../../../node_modules/nx/schemas/project-schema.json",
  "sourceRoot": "libs/oshun/workbench-kit/src",
  "projectType": "library",
  "tags": ["scope:oshun", "layer:workbench-kit", "type:lib", "domain:neutral"],
  "targets": {
    "a11y-findings-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.3.d. What the accessibility gate can fail on, and what a failure says. THE RULE: AN IMPACT IS THE CHECKER'S SEVERITY JUDGEMENT AND A LEVEL IS THE STANDARD'S, AND EVERY GATE HERE IS KEYED ON THE FIRST AND NAMED FOR THE SECOND. Every gate in the estate fails on serious and critical and every one is called a WCAG 2.1 or 2.2 AA gate; against axe's own rule-to-check-to-impact chain, FIVE of the sixty-two rules the conformance selection runs can never produce a violation above moderate -- aria-deprecated-role, form-field-multiple-labels, html-xml-lang-mismatch, no-autoplay-audio and server-side-image-map -- so a real, detected, printed violation of any of them passes every gate. AND FOR TWO LEVEL A CRITERIA THAT IS THE ONLY RULE THERE IS: 3.3.2 Labels or Instructions and 1.4.2 Audio Control are scanned, found, printed and unenforceable, which the coverage map of S11.3.b would report as covered. The severity table is derived from the installed engine every run and the scan FAILS if the answer moves -- an axe release promoting no-autoplay-audio repairs the finding rather than falsifying it quietly. AND: A GATE THAT HAS NEVER FAILED IS A GATE NOBODY HAS TESTED -- libs/shared/testing/src/playwright/ holds axe.ts and index.ts and no spec, so the predicate that runs after 620 tests has never been shown to reject anything; the scan lists the directory rather than trusting the sentence. AND: A FIELD THE ENGINE ALREADY RETURNS IS NOT A MISSING FIELD, IT IS A DISCARDED ONE -- axe returns node.html on every violating node and both formatters drop it, so the DOM snippet survives only where seven specs attach the whole result as JSON. Two of six finding fields reach the reader. The cell's evidence is six DELIBERATE REGRESSIONS run against a reproduction of the estate's own predicate, three of which document a defect by passing a Level A violation on purpose; the scan fails if any stops behaving as recorded, INCLUDING if somebody repairs the gate, which is the outcome that should force the register rewritten. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/a11y-findings-scan.mjs"
      }
    },
    "a11y-waivers-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.3.e. The accessibility waiver schema, and why the estate has none. THE RULE: A WAIVER IS A DECISION ABOUT A FINDING, AND EVERY EXCLUSION IN THIS ESTATE IS APPLIED BEFORE THERE IS ONE. skipAxe prevents the scan, disableRules stops the rule running, a story parameter skips the story -- so across 247 opt-outs there is nothing to attach a proof, an owner or a date TO, because nothing was computed. The repair is not a longer skipAxe: it is to move the exclusion to the other side of the scan, run it always and suppress a NAMED finding on terms, with the consequence nobody will enjoy -- the day those become suppressions the estate learns what they were hiding. AND: THE SCHEMA ALREADY EXISTS IN THIS LIBRARY AND DOES NOT FIT, FOR THE REASON THAT MAKES IT GOOD. S2.11's gate-waivers.ts has every field the cell names and its first requirement is a runId, under a comment saying a waiver against a gate rather than a result is an exemption that outlives its reasons -- which is exactly what an accessibility exclusion is. Five of nine of its fields fit and four do not, named one by one so 'reuse S2.11' is a plan with a list. AND: A CLAIM ABOUT THE INSTRUMENT IS NOT A WAIVER -- JSDOM_UNEVALUABLE_RULES states that jsdom resolves no computed colours and names the Playwright lane as what settles the rule instead, which must never acquire an expiry, because a deadline on a fact about a runtime is a date that arrives and changes nothing. Three kinds, three different obligation sets, and the clock is an ARGUMENT so an expiry is tested rather than waited for. TRAP, caught by this scan against its own sibling: A MENTION IN PROSE IS NOT A USE -- counting lines gave 248 skipAxe opt-outs and one was a sentence in a spec's doc comment explaining that the file uses one; S11.3.a's register said 248 and now says 247, and both cells count the same way. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/a11y-waivers-scan.mjs"
      }
    },
    "acceptance-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.12.f. Grades the newest `acceptance-matrix.json` under `docs/releases/v1/verification/game-day` with the SHIPPED acceptance contract (`ACCEPTANCE_ASPECTS`, `acceptanceFaults`) and the SHIPPED recovery-point contract (`recoveryPointFaults`), neither of which had a caller outside `game-day.spec.ts`. The matrix is filled by `scripts/operations/v1-acceptance-drill.mjs`, which stands up a disposable estate in the regional-loss runbook's own topology — one box, an off-box repository, a clean recovery host — kills it, watches two independent observers, publishes a notice, restores in the runbook's declared order, lets the box come back, captures the recovered primary and fails back. On top of the contract it re-derives every aspect's outcome from the report's own measurements (a row flipped without touching a number fails), requires each row to cite a `[measurements.<path>]` that resolves and to state a quantity, times the runbook's own sentence about capturing before failing back, and re-reads every claim the matrix makes about the repository — the deployed compose's telemetry services and redis persistence, the backup script's forced checkpoint, the restore drill's PING-backed `redisRestoreVerified`, and the runbook's absent fencing step — so the day any of them moves, the matrix is describing an estate that no longer exists and this says so. Twenty-nine negative controls mutate the REAL matrix, the runbook, the deployed compose, the backup and restore scripts and the published document, and it exits 2 rather than reporting if any goes undetected.",
        "command": "npx tsx tools/acceptance-scan.mjs"
      }
    },
    "adapter-contracts-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.a. The five adapter subjects the cell names, and one idea in twelve shapes. THE RULE: THE SEAM IS EVERYWHERE AND THE CONTRACT IS NOWHERE. The estate injects now 784 times across the oshun and shared code in TWELVE distinct shapes -- three value types (string, Date, number) by two forms (a value or a getter) by two arities (required or optional), and EVERY ONE OF THE TWELVE IS IN USE: now: string 123, now: Date 105, now?: () => Date 102, now: () => Date 102, and so on down to now?: number four times. That is not a missing seam; it is a seam at almost every call site with no contract behind any of them, so a controllable clock has to be written once per shape and the cell's evidence line cannot even be asked because there is no adapter to ask it about. AND THERE ARE NAMES, PLURAL, FOR THE SAME THING: creative-autonomy exports type Clock = () => number AND type NowFn = () => number in the same domain, and neither is what the other 782 sites take. THE SECOND HALF IS ALREADY SOLVED SOMEWHERE ELSE: six libraries declare a ./testing subpath in their own package.json, which is exactly the explicit test-only entry point the cell asks for and is enforceable by the module boundaries eslint.config.js already declares -- and none of the five subjects has one. AND THE ESTATE'S OWN ANSWER AGAIN: ONE OF THE FIVE ALREADY HAS THE PORT -- assets/asset-store.ts declares AssetResolver, an AssetObjectStore that extends it, a resolveAssetObjectStore factory, and assetResolverFrom(download), a constructor that takes the one function a double has to supply, with a GeneratedArtifactObjectStoreFactory and an integration test beside it. Built, for one subject of five, while the BFF calls randomUUID 179 times with no seam at all. A NOTE ON HOW THAT WAS FOUND: this register first said the BFF touched no object storage, because a shell loop passed an escaped-alternation pattern to git grep -lE and got zero; the scan's positive control caught it, the same failure and the same catch as the pseudo-localiser in S11.6.c. A ZERO FROM A QUERY NOBODY POSITIVE-CONTROLLED IS NOT A MEASUREMENT. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/adapter-contracts-scan.mjs"
      }
    },
    "alias-resolution": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/alias-resolution.mjs"
      }
    },
    "announcement-instruments-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.5.a. The live regions in the two products, rebuilt tag by tag, and the primitive that already states the rule. THE RULE: AN ANNOUNCEMENT IS A CHANGE OBSERVED, AND EVERY ASSERTION IN THIS ESTATE READS A STATE AFTER THE FACT -- a region inserted together with its first message was never there to change, a polite one is silent on most pairings, and every test that checks the text is present passes. The estate already wrote that down: the LiveRegion primitive renders its container unconditionally with aria-atomic true and declares both invariants, and it has THREE usages -- a fixture host and two stories -- NONE shipping, against 808 hand-rolled live elements of which 25 set aria-atomic and 464 are gated by the conditional they sit directly inside. AND THE 464 ARE NOT 464 DEFECTS: 313 are alert or assertive, which readers announce on insertion; 151 are polite and are filed as needing exercising, because what settles one is an observation this module does not make. The suites aim ONE of six instruments at a region: 112 role queries, 23 politeness assertions, 3 atomic assertions, and four MutationObservers of which not one is on a live region -- one samples chip paint, one hides the Next dev overlay, one times a cold start, and the fourth is a comment explaining that it samples INSTEAD of observing. A COMPUTED PROPERTY IS NOT AN ATTRIBUTE: role=status IS polite and atomic and getAttribute('aria-live') returns null for all 331 of them, so each fact declares the capability it needs and each instrument what it provides. This scan copies none of the numbers: it walks every JSX opening tag with brace-depth tracking, classifies each region, re-reads the primitive's invariants from its own source, and re-counts the suites while skipping comment lines -- which is how it caught the register's own 113th role query being a comment about Next's route announcer. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/announcement-instruments-scan.mjs"
      }
    },
    "announcement-storms-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.5.d. The five storm requirements, the five announcers that would have to meet them, and the policy that already exists one layer away. THE RULE: A STORM POLICY THAT GROUPS WHAT YOU WILL READ LATER SAYS NOTHING ABOUT WHAT IS SPOKEN NOW. S7.19.b already groups and deduplicates event storms, sizes a group over DISTINCT EVENT IDS, states its distinct-target count and names seven kinds that may never be collapsed -- and it operates on the notification FEED, a list somebody opens. An announcement is a moment, and none of that policy is on the announcement path. AND FIVE ANNOUNCERS ANSWER ONE QUESTION THREE WAYS: should an identical message speak again? Three say YES on purpose (useLiveAnnouncer clears and re-sets after a tick, the shell's announce clears and writes on the next frame, KeyboardTriageReviewSurface bumps an id); ONE says no BY ACCIDENT -- StudyWorkbench is setAnnouncement(message) with no id and no timer, so React bails out on an equal string, which is deduplication nobody chose and the estate's only implementation of it; and the LiveRegion primitive is a container, not a queue. Repeating is right when the same thing happened again and wrong when it is still true, and nothing distinguishes them. NO ANNOUNCER HAS A RATE LIMIT, and the two most-called are on repeat paths: KeyboardTriageReviewSurface announces on EVERY arrow move through a review queue. THE MOST GLOBALLY AVAILABLE ONE IS CALLED BY NOBODY AND WOULD FAIL SILENT IF IT WERE -- announceRef?.(message) on a nullable module singleton, mounted app-wide from layout.tsx, zero importers. AND ZERO EVENT STORM TESTS: storm, rapid, burst and flood across 5,264 suite files yield a comment about announcement tone, a mass-share 429 guard, and a character named Kaelen Stormweaver. This scan cuts each implementation out of its own source and derives every flag from the code -- timer, cleared timer, ceiling, unconditional region, optional call, setState identity -- and counts each announcer's call sites the way its own callers reach it, which is how it caught eleven of StudyWorkbench's calls being attributed to a module function nothing imports. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/announcement-storms-scan.mjs"
      }
    },
    "anti-mock-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.d. Grades the anti-mock evidence register against the estate. The contract's rule is that each of the parent's five masquerades is a claim about what did NOT happen -- no request left the browser, no query ran, nobody created that row in this run, nothing was asked, nothing has been observed since the build -- and a response only records what did, so a detector needs a positive trace rather than a predicate over the answer. The scan re-derives four counts of absence, all of which rot silently: response.serverAddr(), the one instrument that answers whether a real server produced the response, is called NOWHERE while fromServiceWorker() is called twelve times across ten files and every call asserts toBe(true), so the instrument is in the estate's hands aimed the other way; the kit's synthetic boundary (SYNTHETIC_SEGMENT_PREFIX, findSyntheticValues with a declared depth bound, assertNoSyntheticValues, SyntheticValueError) has no consumer under apps/ and none of the substitution producers S11.2.c named carries the prefix; no build id, commit sha or bundle timestamp reaches any response from apps/oshun/web or apps/oshun/bff; and waitForRequest / page.on('request') appear in fourteen files under apps/oshun/web/e2e against one across the two exemplar journey suites. It also quotes BASE.7.d out of the ledger, because the refusal to grade empty-success by the shape of the answer rests on that task asking for a legitimate empty to be exercised and allowed to stand. Fails on drift; reports the five-class matrix. Thirteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/anti-mock-scan.mjs"
      }
    },
    "api-inventory-gate": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/api-inventory-gate.mjs"
      }
    },
    "api-ui-matrix-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.g. THE RULE: THE TABLE ANSWERS WHAT TO DO NEXT AND THE MATRIX ASKS WHAT TO SAY. FAULT_TABLE classifies all eleven provider fault classes and its entries carry exactly SIX fields -- faultClass, retryability, family, outcomeUnknown, mayHaveBeenCharged, isRefusal -- and every one is a decision THIS SYSTEM makes rather than something a CALLER is told. Of the six API fields this cell names, exactly ONE is a lookup: retry metadata, through retryability, which is a Retryability from errors.ts so the two vocabularies already agree. The other five are DECIDED here: the table names an ErrorFamily, which is coarser than an RpcStatus (`provider` covers a throttle, a timeout and a safety refusal, and those are resource-exhausted, deadline-exceeded and failed-precondition); there is no error code; a correlation id belongs to the REQUEST so it can never come from a table keyed by fault class; and a UI state is a presentation decision the table is right not to hold. That is not a defect -- it is a statement about where the matrix has to come from, and this cell is where those decisions get written down in the open rather than by whichever component renders first. THE ONE RULE THAT IS NOT A CHOICE: NO FABRICATED RESULT. A call whose outcome is unknown MAY have produced a result and MAY have been billed, so a screen that renders one is showing something nobody computed; the matrix carries per row what the UI shows AND whether that presentation can contain a result, and a partial result is allowed exactly when it is MARKED partial. No refusal row offers a retry, because a retry button on a refusal is S11.11.e's prompt-around loop with a person clicking it. AND THE STATUS CANNOT DECIDE THE SCREEN: `internal` carries THREE screens (retrying, failed, result) and resource-exhausted carries two for opposite remedies -- a throttle is waited out and a budget is not, which is why malformed/lexical and malformed/semantic share a fault class and a status and differ in CODE. If every status mapped to one screen this matrix would be an elaborate lookup table, and no-status-carries-two-screens says so. 12 rows over 6/6 injected families, every value taken from the estate's own vocabularies. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/api-ui-matrix-scan.mjs"
      }
    },
    "archive-determinism": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/archive-determinism.mjs"
      }
    },
    "archive-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.a. THE RULE THAT SURVIVED THREE REFUTATIONS: A KIND CHECK AND A TARGET CHECK ARE DIFFERENT CHECKS, AND ONLY ONE CAN BE ASKED HERE -- ObservedFileEntry is { path, kind, linkCount } with NO field for where a link points, so 'no links at all' is the only expressible policy. I set out to report three gaps and the estate has all three: specialFileFaults refuses links BY KIND; collisionFaults TAKES the destination and models ext4/NTFS/APFS, so NFC/NFD is unicode-fold-collision on APFS and nothing on ext4; and a name resolving inside the root gets dot-dot-segment and NOT escapes-its-own-root. AN OBSERVATION AND A REFUSAL ARE DIFFERENT FINDINGS, AND A READER THAT COUNTS THEM TOGETHER INVENTS A DEFECT -- this scan did until it was corrected. THE CHECKERS EXIST AND NOTHING FED THEM THE HOSTILE INPUT, so the corpus is the deliverable: 15 recipes over 13 hazards. AN ARCHIVE FIXTURE THAT IS SAFE TO COMMIT IS NOT THE ARCHIVE YOU NEED -- a bomb, a million entries, a 2000-deep path and a device node are RECIPES built at run time, never files; 4 of 15 must never be committed. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/archive-fixtures-scan.mjs"
      }
    },
    "artifact-rehash-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/artifact-rehash-race.mjs"
      }
    },
    "async-announcements-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.5.c. The async state matrix -- eleven subjects by two phases -- and the tone the outcome decides. THE RULE: A PROGRESS ANNOUNCEMENT AND ITS RESULT ARE TWO BRANCHES OF ONE CONDITIONAL, SO THEY ARE TWO NODES AND NOT ONE REGION SPEAKING TWICE; whether the progress message was ever spoken before the result replaced it is an ORDERING claim and no read of the final DOM contains one, so 11 of the 22 cells are marked unfillable from source and handed to the change observer S11.5.a found nobody aims. THE DECIDABLE HALF: TONE FOLLOWS THE OUTCOME, NOT THE SUBJECT. Progress is polite -- interrupting a reader mid-sentence to say Saving is worse than waiting -- a success is polite, and a failure the user's own action produced is assertive, because a polite failure queues behind whatever is being read and lands after they have moved on. AND THE ESTATE IS GOOD AT IT: of 464 conditionally-rendered live regions, 180 are gated on a failure condition and 175 are alert or assertive. The deliverable is the FIVE that are not, named with the gate that renders them -- and ONE OF THE FIVE IS RECORDED AS DEFENSIBLE rather than counted, because NotificationsCenterPanel announces a disclosed outage, an ambient page state, which is exactly what polite is for; inflating four to five would cost the register the thing that makes it useful. THE THIRD: aria-busy IS NOT AN ANNOUNCEMENT. It tells a reader to hold off while a subtree updates and says nothing itself; the products carry 216 aria-busy tags and EXACTLY ONE is on a live region -- StudyRouteBoundary, which sets it only while loading and keys its politeness to its own role, and is right. A register that counted aria-busy as progress coverage would report 216 announcements that do not exist. This scan rebuilds all of it tag by tag, re-derives each region's gate and tone from the source, and fails if a named site is not found or an unnamed one is. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/async-announcements-scan.mjs"
      }
    },
    "at-reconciliation-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.5.f. The AT matrix, EMPTY ON PURPOSE, and what reconciling a speech log against a DOM assertion actually means. THE RULE: THE CELL ASKS FOR SOMETHING THIS HOST CANNOT DO, AND THE HONEST ANSWER IS THE MATRIX WITH NOTHING IN IT. NVDA, JAWS and Narrator are Windows; VoiceOver is Apple's; TalkBack is Android's; Orca needs a desktop session with a speech service -- no reader can be driven from this repository's test host, and nothing in this repository drives one: speechLog and speech-log appear nowhere outside this cell's own family, and the estate's only register of readers is a six-name array inside an Iris bridge policy, which is a declaration and not a driver. So all 36 cells are unobserved and NOT ONE IS FILLED IN FROM MEMORY, because what a reader does with an inserted polite region is a fact about a program nobody here has run, and writing it down because it is widely believed would be the exact thing the rest of S11.5 exists to catch. WHAT IS REAL: the six QUESTIONS, imported from the siblings that could not answer them rather than restated, each carrying who RAISED it and who OWNS it -- not the same cell, and conflating them makes a register that reads as if a cell deferred a question to itself. The PAIRS, because a reader is tested against a browser and the tree that reaches it is the browser's. The RECONCILIATION, which is not did-they-match: a DOM assertion passing while the reader is silent has THREE meanings -- the assertion was wrong, the reader does not support the pattern, or the pattern is ambiguous and both are defensible -- and collapsing them into fail tells nobody what to change; the reverse, a reader speaking where the DOM said nothing, is always the assertion being wrong. AND WHAT A SPEECH LOG HAS TO BE: time-ordered on a clock alignable with the page's own events, because otherwise the message was spoken cannot be told from the message was spoken after the user navigated away. The scan checks only what CAN be checked here: that the estate's own reader register still holds these six, that nothing outside this family captures a speech log, and that no cell has acquired an utterance without an observation. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/at-reconciliation-scan.mjs"
      }
    },
    "audit-integrity-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node, and with no build dependency: the subject is `@oshun/audit-platform`, whose package.json declares \"main\": \"./src/index.ts\", so what a consumer resolves IS the TypeScript source. The harness drives the real HashChainedAuditEventStore, RetentionPolicyService and EvidenceExportService through the eleven lifecycle actions S10.7.g names.",
        "command": "npx tsx tools/audit-integrity-scan.mjs"
      }
    },
    "axe-policy-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.3.a. What the accessibility harness is pinned to, across the eight places in the V1 estate where an axe run is configured. THE RULE: A TAG IS A QUERY, NOT A POLICY. The estate upgraded to WCAG 2.2 by adding two tags to two helpers, and the query is run here against the engine's own rule table rather than trusted: the six declared tags are worth 56, 3, ZERO, 2, ZERO and 1 rules, so fifty-nine of the sixty-two come from the 2.0 terms alone, the 2.1 upgrade is worth two rules and the 2.2 upgrade one. wcag21a is the sharper half because every site declares it and its only rule, label-content-name-mismatch for 2.5.3 Label in Name, ships experimental and is dropped by axe's own defaults. AND THE ONE RULE 2.2 BUYS SHIPS SWITCHED OFF: target-size carries enabled false, axe consults that flag only when the include list is empty, so naming the tag turns it on and asking for EVERYTHING does not -- the tenant-admin fixture calls analyze() with no tags, gets eighty-nine rules including thirty best-practice ones, and is the only site in the estate that misses the 2.2 rule. The derivation reproduces axe's matchTags and is checked against five selections measured in a real Chromium (61, 62, 1, 0, 89); it fails if the installed engine stops producing them, so an engine bump re-opens the measurement instead of quietly falsifying it. AND: THE GATE AND THE HELPER ARE NOT THE SAME HARNESS -- the automatic afterEach runs on 620 specs at the 2.1 set while the 2.2 set is reached by 54 explicit calls, and the reach numbers are counted every run. AND: THE DIMENSION NOBODY STATES HAS A PRICE PAYABLE IN CRITERIA -- one of eight sites states a flag policy, and what the other seven inherit removes the only rule the engine has for 1.2.1, 1.3.4 and 2.5.3, all three of which then come back as inapplicable. Seventeen negative controls, including one that confirms 2.5.8 is NOT reported as lost because the helpers recover it, and one that confirms silence about the browser is not reported because no harness can answer it. Exits 2 if any control goes undetected.",
        "command": "npx tsx tools/axe-policy-scan.mjs"
      }
    },
    "blob-storage": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/blob-storage.mjs"
      }
    },
    "bom-reconciliation": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/bom-reconciliation.mjs"
      }
    },
    "boundary-fixtures": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/boundary-fixtures.mjs"
      }
    },
    "build": {
      "executor": "@nx/js:tsc",
      "outputs": ["{options.outputPath}"],
      "options": {
        "outputPath": "dist/libs/oshun/workbench-kit",
        "main": "libs/oshun/workbench-kit/src/index.ts",
        "rootDir": "libs/oshun/workbench-kit/src",
        "tsConfig": "libs/oshun/workbench-kit/tsconfig.lib.json",
        "assets": []
      }
    },
    "bundle-confinement": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/bundle-confinement.mjs"
      }
    },
    "bundle-path-adversarial": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/bundle-path-adversarial.mjs"
      }
    },
    "c2pa-signing": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/c2pa-signing.mjs"
      }
    },
    "canary-leak": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/canary-leak.mjs"
      }
    },
    "cancellation-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.e. THE RULE: A CANCEL AFTER THE EFFECT AND BEFORE THE COMMIT DOES NOT STOP ANYTHING -- IT LOSES THE RECORD OF SOMETHING THAT ALREADY HAPPENED. jobs.ts gets the hard part right: requestCancel refuses a cancel with no reason ('indistinguishable from a bug in the caller, and the job it killed cannot be told apart from one that failed') and keeps `cancelling` as a state with a real duration, because 'collapsing the two tells the operator the effects have stopped at the exact moment they have not, and they act on that'. regionFaults is there too with the best fault in the module: a noncancellable region longer than the lease 'turns a safety mechanism into the failure it was protecting against'. MEASURED: JobRecord has NINETEEN fields and exactly one is about how far the worker has got -- a job-level `state` -- so all four positions inside `running` get ONE answer from the state machine and cost four different things. The sharpest is after-success-before-commit: cancelling there stops nothing, because the work is done and the money moved, and what the cancel destroys is the RECORD -- the job then looks cancelled to everybody while its effect stands, which is the reverse of every other cancellation hazard and why `stop` cannot be the answer everywhere. SHIPPED: WORKER_POSITIONS, POSITION_RULES mapping each to one of the estate's own three cancellation-point actions (a checkpoint write is CONTINUED, not stopped, because a half-written checkpoint is read on resume and believed), and cancelAt which calls requestCancel FIRST -- verified at all six positions, since a reasonless cancel is refused wherever the worker is and a terminal job is terminal whatever the worker thinks it is doing. Only a `cancelling` answer reaches the position. 10 fixtures, 8/8 races, 6/6 positions, 3/3 actions, 4 settled by state and 6 by position, 3 compensations. Two costs cannot arrive through a positioned decision and the module SAYS WHICH POSITIONS and why, rather than carrying an exclusion list with no reason attached. TENTH unreachable fault kind removed, and the pattern is now stated as a rule: A FAULT KIND MUST RANGE OVER THE INPUT; a statement about a module's own constants is an INVARIANT and belongs in a sweep where it can fail. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/cancellation-fixtures-scan.mjs"
      }
    },
    "catalog-bypass-scan": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/catalog-bypass-scan.mjs"
      }
    },
    "clock-adapter-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.b. A controllable clock -- wall time, monotonic time, timers, zones, timeouts and backoff -- and unlike its neighbours this cell ships a WORKING THING rather than a register, because S11.7.a measured 784 injections of now in twelve incompatible shapes with no contract behind any of them. THE RULE THAT DECIDES THE DESIGN: A WALL CLOCK AND A MONOTONIC CLOCK ARE TWO CLOCKS, AND A TIMEOUT MEASURED ON THE WRONG ONE IS NOT A TIMEOUT. Wall time is what a user sees and it can move BACKWARDS -- an NTP correction, a manual change, a VM resuming from a snapshot -- and monotonic time cannot. So a duration is measured on the monotonic clock, a deadline is displayed on the wall clock, setWallClock moves wall time alone and advance moves both: a test can produce the NTP step that breaks a naive timeout, which is the only way anybody ever finds one. The suite drives exactly that: after a backwards step of an hour and six seconds of real time, the monotonic deadline has expired and the wall comparison still has 3,599,000ms to go. THE SECOND: ADDING TWENTY-FOUR HOURS IS NOT ADDING A DAY. In a zone with daylight saving a physical day is 23 or 25 hours twice a year, so localParts answers local wall time through Intl.DateTimeFormat -- the platform's own tables -- and the suite advances across the real Europe/London boundary on 2026-03-29 and reads 0 to 60 minutes of offset, with a scan control that FAILS if this platform's tables do not put a change there, because a DST test on stale tables asserts nothing. THE THIRD: ADVANCE MUST BE EQUIVALENT TO TIME PASSING -- a timer scheduled by a callback running during the advance is due inside the same window if its deadline falls there, timers run in due order with ties by insertion, and the clock stops at each timer's own due time so a callback reading the clock sees the instant it was scheduled for rather than the destination. AND JITTER IS A PARAMETER RATHER THAN A CALL TO A RANDOM SOURCE, because a backoff schedule a test cannot reproduce is one nobody can assert about. The module patches NO globals -- a port is taken as an argument, not installed -- and the scan checks that, and that it reads no real clock. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/clock-adapter-scan.mjs"
      }
    },
    "co-allocation-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/co-allocation-race.mjs"
      }
    },
    "consumer-contract-gate": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/consumer-contract-gate.mjs"
      }
    },
    "contention-constraints-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.e. The ten constraint kinds under contention. THE RULE: A CONSTRAINT UNDER CONTENTION IS ENFORCED BY WHOEVER HOLDS THE LOCK, AND FIVE OF THESE TEN HAVE NO LOCK BECAUSE THEY HAVE NO ROW -- check, outbox, inbox and legal-hold have no model at all (78 TS files mention a legal hold; the datamodel has no column), so 6 of 10 can be contended. unique=103 @@unique, foreign=19 @relation, lease=a row lock, idempotency=Redis configured in production. THE FINDING: THE ESTATE CONTAINS ITS OWN ANSWER AND APPLIES IT ON ONE PATH ONLY. intent-store.ts takes SELECT ... FOR UPDATE and checks its compare-and-set inside the transaction (8 FOR UPDATE sites across 4 files); durable-snapshot-store.ts, which holds V1 admin state, reads the version, adds one and upserts with where: { id } -- and the delegate type declares where: { id: string } with no updateMany, so the fix cannot be expressed through the port. MEASURED LIVE: eight concurrent save() calls at one partition ALL SUCCEEDED and the row ended at VERSION 1 -- seven lost updates, and the version says one save happened. A VERSION COLUMN NOT IN THE WHERE CLAUSE IS A COUNTER, NOT A LOCK. A ONE-WRITER RACE IS NOT A RACE: the scan fails rather than reports if fewer than two writers succeed. NO SERVER IS EXIT 1. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/contention-constraints-scan.mjs"
      }
    },
    "context-manifest-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.b. The five rendering contexts a baseline is taken in, and the one every harness list leaves out. THE RULE: THE ONE THEME THE CELL NAMES AS ITS OWN CASE IS THE ONE EVERY HARNESS LIST OMITS. The product declares THREE Lilith variants -- cream, cream-hc and dusk -- as a union type with a matching guard in LilithThemeBootstrap.tsx, and cream-hc is the HIGH-CONTRAST one with its own block in globals-v2.css. The inspect harness lists two. The assistant visual spec carries its OWN COPY of the same useTheme helper and lists the same two. So the theme whose entire purpose is contrast is the one no visual baseline is ever taken in, and a contrast regression in it changes no committed pixel. THE SECOND, AND IT IS S11.3.f ARRIVING FOR A SECOND CONTROL FAMILY: THE INSTRUMENT EXISTS, IT IS GOOD, AND IT IS AIMED AT THE GALLERY. forced-colors is answered by 13 shipping stylesheets and ELEVEN browser harnesses emulate forcedColors active, with their own docs explaining what must stay distinct under it -- and every one of the eleven mounts a FIXTURE HOST. The six visual-regression specs that capture a product page emulate it ZERO times. prefers-reduced-motion is answered in 45 shipping files, emulated by three harnesses and by ONE visual spec, for the good reason that freezing animation is what makes a capture stable -- which also means the no-preference rendering is the one never captured. prefers-color-scheme is answered in four files and turned by no visual spec at all. A stylesheet that answers a media query no capture emulates is a branch no baseline has ever rendered. AND A DENSITY REGISTER EXISTS AND IT IS A FIXTURE'S: the cell's three densities are exactly the union in primitiveBaselinesHost.tsx, while the word density carries three other vocabularies in this estate. WHAT IS RIGHT, TWICE: both theme helpers refuse to plant the attribute from an init script, because the default theme is the attribute's ABSENCE, and both verify the theme took, because without that check a both-themes pass can silently inspect the same theme twice -- a positive control arrived at independently, and the second time by copying the first. This scan re-reads the variant union from the product, re-reads both helpers' own lists, and counts every media context twice: files that ANSWER the query and specs that EMULATE it. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/context-manifest-scan.mjs"
      }
    },
    "cost-attribution-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node, and with no build dependency: the subjects are `@oshun/gpu-dispatcher` and `@oshun/creative-orchestrator`, whose package.json files declare \"main\": \"./src/index.ts\", so what a consumer resolves IS the TypeScript source. The harness drives the real UsageTracker, CostTracker, priceUsage and reconcileProviderInvoice through the twelve absence scenarios S10.8.c names, and carries a legacy arm reproducing the pre-S10.8 behaviour so the scan can be seen to detect something rather than only ever printing clean.",
        "command": "npx tsx tools/cost-attribution-scan.mjs"
      }
    },
    "cost-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.f. TWO INDEPENDENT RULES. THE FIRST: A BUDGET CARRIES ITS UNIT AND THE ESTIMATE COMPARED AGAINST IT DOES NOT. SpendBudget has a unit field and reserve(budgets, estimate, ...) takes ONE BARE NUMBER and compares it to every scope's remaining room. MEASURED with a tenant budget in US cents and a provider budget in vendor credits: an estimate of 40 is RESERVED -- forty cents charged against a fifty-credit budget -- and an estimate of 100 is REFUSED for being over fifty credits, while the ten-thousand-cent tenant budget it should have been checked against is untouched. The refusal message PRINTS the unit: the code knows units exist at the moment it declines to compare them. reserveInUnits refuses the comparison instead, with `incomparable` as a FOURTH outcome rather than a refusal, because refused says the budget is out of room and waiting will help while incomparable says nobody can tell and waiting will not -- collapsing them sends an operator to look at a budget that is fine. THE SECOND: A RESERVATION IS A PROMISE TO SPEND AND EVERY PATH THAT ENDS WITHOUT A SETTLEMENT HOLDS IT FOR EVER. settle(reservationId, estimated, actual) takes no budget and no time and returns a REPORT; nothing in limits.ts assigns to a budget's reserved field (0 assignments) and a reservation has no expiry -- the exception has an expiresAt, the reservation does not. So the S11.11.a case arrives here: a call whose outcome is unknown has no actual and never will, settle can never be called, and the budget shrinks by one estimate every ambiguous call -- which is the failure mode a retry budget exists to survive. SHIPPED: Money (an amount WITH its unit), reserveInUnits as a precondition rather than a replacement (it calls the estate's reserve once the units agree), a Reservation with holdsUntil, and resolveReservation with four endings -- settled, released, expired and still-held, the last reported rather than treated as an ending because an unresolved reservation is exactly what this module exists to make visible. A kill switch is kept distinct from an empty budget, because a system that models the switch by zeroing a ceiling tells somebody their budget ran out when it did not. 10 fixtures, 7/7 aspects, 4/4 endings, 2 decided today across units, 1 held for ever. ONE FAULT KIND WAS REMOVED for being unreachable AND malformed -- its guard asked whether an EMPTY ledger reports room -- and became three swept ledger invariants, the third of which is this cell's own opening defect arriving at the other end of the module: a total across units names no unit rather than adding cents to credits. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/cost-fixtures-scan.mjs"
      }
    },
    "curation-determinism": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/curation-determinism.mjs"
      }
    },
    "database-harness-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.a. Provisioning an isolated database, and reporting what the schema actually is rather than what a harness hoped it would be. THE RULE: A HARNESS THAT PROVISIONS LESS THAN PRODUCTION IS TESTING SOMETHING ELSE, AND ONE THAT CLAIMS MORE IS WORSE. The scan creates oshun_harness_<run>, points the BFF's real tryConnectPostgres at it via OSHUN_STUBS_DATABASE_URL so the PRODUCTION bootstrapSchema runs -- the DDL itself, not a copy -- reads pg_catalog for what that left behind, and drops the database. THE READING: PostgreSQL 16.14, 24 tables, 24 primary keys, 110 indexes, 1 unique constraint, 0 foreign keys, 0 check constraints, 0 policies, 0 triggers, 0 tables with row security. A harness that faithfully provisions production's constraints, policies and triggers therefore provisions almost none of them -- which is the answer to the cell, and it is a fact about the estate rather than about the harness. ISOLATION IS A PROPERTY OF THE CONTAINER, NOT OF THE CLEANUP: a separate database rather than a truncate, dropped in one statement, with assertDroppable refusing every name outside oshun_harness_* because this server also holds oshun_dev and nine other databases belonging to other work. AND AN ABSENT SERVER AND A CLEAN SCHEMA PRODUCE THE SAME SILENCE, so no server is exit 1, never a pass. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/database-harness-scan.mjs"
      }
    },
    "degradation-plan-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node, and with no build dependency: the subjects are `@oshun/rate-limit`, `@oshun/http-client` and `@oshun/resilience`, whose package.json files declare \"main\": \"./src/index.ts\", so what a consumer resolves IS the TypeScript source. The harness drives the real GracefulRateLimiter, InMemoryRateLimiter and both circuit breakers through the twenty conditions under which a degraded answer cannot be told from an authoritative one, and carries a legacy arm reproducing the pre-S10.10 behaviour so the scan can be seen to detect something rather than only ever printing clean. Exits non-zero if the legacy arm ever scores as well as the kit arm, which would mean the harness has stopped measuring.",
        "command": "npx tsx tools/degradation-plan-scan.mjs"
      }
    },
    "double-booking-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/double-booking-race.mjs"
      }
    },
    "duplicate-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.b. THE RULE: decideClaim RETURNS `claimed` TO BOTH RACERS, AND THE ESTATE NAMES THE LAYER THAT DECIDES THAT RACE FOR REVISIONS AND NOT FOR IDEMPOTENCY KEYS. idempotency.ts answers most of this cell already and answers it well: IdempotencyScope is five fields plus a target with a note on what dropping each one costs, and decideClaim COMPARES THE DIGEST BEFORE THE STATE, because 'a stored record in completed with a different request digest is not a replay -- it is a caller reusing a key for something else, and returning the stored result reports success for something that never ran, to somebody who will never look again.' So altered-payload-under-the-same-ID, this cell's sharpest item, is covered; inbox.ts answers it a second time at line 319. WHAT IS NOT ANSWERED IS CONCURRENCY, AND THE MODULE IS RIGHT NOT TO ANSWER IT. Measured by calling it: two callers who arrive before either has written both see no record and BOTH get `claimed`. A pure function over an existing record cannot see a concurrent one and pretending it could would be worse. The race is decided by a uniqueness constraint at the storage layer -- and the estate says exactly that, in this very module, about a DIFFERENT constraint: unique-sequence-per-entity, layer table, 'this is the constraint that decides an append-only race, and a SELECT-then-INSERT does not.' CONSTRAINT_PLACEMENT holds eight entries and every one is a REVISION constraint; not one names the idempotency scope, while scopeKey already produces the exact six-tuple such an index would be over. SHIPPED: SCOPE_PLACEMENT, stating that layer in the same shape the estate uses, with the same sentence and none of the words changed; and 6 delivery pairs over 5/5 arrival kinds producing 5/5 outcomes, of which exactly ONE leaves both callers claimed. A SEVENTH FAULT KIND THAT NO INPUT COULD REACH was removed and became an asserted invariant -- and it caught a real bug on the way in: it compared scopeKey(scope).length to the column count, and scopeKey returns a JSON STRING, so it was comparing twenty-four characters to six columns. Two quantities that are not the same KIND of thing, compared because both are numbers. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/duplicate-fixtures-scan.mjs"
      }
    },
    "eligibility-toctou": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/eligibility-toctou.mjs"
      }
    },
    "envelope-generators-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.a. THE RULE: A GENERATED ENVELOPE THAT IS INVALID FOR TWO REASONS TESTS NEITHER -- every mutation declares the ONE ParseErrorCode it exists to provoke, and a rejection with a different code is rejected-for-the-wrong-reason, a failure rather than a pass. BOUNDARY-VALID IS THE LARGEST INPUT THAT MUST SUCCEED: envelopes of exactly MAX_ENVELOPE_BYTES must parse, because > and >= behave identically on everything else. THE MEASUREMENT: the golden corpus holds 57 hand-authored cases and, sorted by the six dimensions the cell names, reads field 18, version 4, kind 3, size 3, order 3, ENCODING 0 -- and provokes 7 of the 14 declared error codes. THE FINDING: all four encoding mutations (lone surrogate, NUL, bidi override, NFD/NFC pair) are ACCEPTED today, because each is a string in a string-typed field. The scan re-derives every corpus number and re-runs all 15 mutations against every accepted golden through the real parsers -- 245 applications -- reporting the verdict distribution rather than a pass count. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/envelope-generators-scan.mjs"
      }
    },
    "evidence-bundle-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.f. Grades the capture registers against the two Playwright configs. S11.2.f asks for eight artifacts per step and per failure, and presence is the easy half. THE RULE: AN ARTIFACT OF THE RETRY IS NOT AN ARTIFACT OF THE FAILURE. Both configs set trace: 'on-first-retry' beside screenshot: 'only-on-failure', which capture two different executions of the same test -- the screenshot during the attempt that failed, the trace during the one after it -- and nothing in either bundle says which artifact came from which attempt. The retry budget is PARSED out of each config, both arms of the ternary, rather than trusted, because the whole result turns on the number: outside CI it is zero, so on-first-retry never fires and the Tara suite produces no trace and no video at all on the machine where a failure is being read, leaving exactly one of the eight artifacts describing the failure. AND: AN IDENTIFIER YOU DID NOT CHOOSE ARRIVES TOO LATE -- the BFF reads x-correlation-id, four files under testing/e2e/tests/api read one back off a RESPONSE, none sets one on a request, and the read is guarded by the very value it asserts about. The setter check matches the header as an object KEY rather than by name, because matching the name finds the readers and reports the repair as already done, which this scan did on its first run. AND: A FIXED PATH IS NOT AN ADDRESS WHEN SEVEN PROJECTS SHARE IT -- base.page.ts writes a screenshot outside testInfo to a path derived from a caller label alone, and the config declares seven projects over fullyParallel: true. Fails on drift; reports the artifact matrix twice, for CI and for a laptop, because those are different answers. Fourteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/evidence-bundle-scan.mjs"
      }
    },
    "execution-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.12.e. Grades the newest `execution-report.json` under `docs/releases/v1/verification/game-day` with the SHIPPED execution contract (`executionFaults`, `derivedOutcome`, `rotationFaults`), whose only callers before this were spec fixtures. The report is produced by `scripts/operations/v1-game-day-execute.mjs`, which stands up a disposable estate, seeds it, backs it up, writes rows the backup does not contain, injects a real fault, POLLS for detection, restores and compares the census — so all five quantities are read from the clock rather than supplied. On top of the contract it refuses a detection latency of zero (the shape S10.11 found in all ten rollback records: a number written rather than measured), a restore that finished before it started, and a report that does not say what estate it ran against. The rotation gap is declared in BOTH directions against the plan document: a class this estate can inject that was left out fails, and a class the plan calls unrehearsable that the rotation nonetheless exercised fails too.",
        "command": "npx tsx tools/execution-scan.mjs"
      }
    },
    "exhaustion-alert-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node, and with no build dependency: the subjects are `@oshun/agentic-studio` and `@isis/llm-providers`, whose package.json files declare \"main\": \"./src/index.ts\", so what a consumer resolves IS the TypeScript source. The harness drives the real checkBudget, buildUsageMeterCard, evaluateObservation, QuotaTracker and checkBudgetAlert through the seventeen conditions under which an alert fails to warn anybody before hard exhaustion, and carries a legacy arm reproducing the pre-S10.9 behaviour so the scan can be seen to detect something rather than only ever printing clean. Exits non-zero if the legacy arm ever scores as well as the kit arm, which would mean the harness has stopped measuring.",
        "command": "npx tsx tools/exhaustion-alert-scan.mjs"
      }
    },
    "expand-contract-rehearsal-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.f. THE RULE: A MIGRATION THAT DROPS NOTHING AND AN APPLY THAT DROPS SIXTEEN THINGS ARE THE SAME DEPLOY. The 35 V1 migration files hold ZERO destructive operations and ZERO data statements -- every one is an expand, and that is a property of THE FILES. Production applies a computed diff instead: against a production-shaped database it is 86 statements of which 16 are destructive (13 DROP TABLE, 1 DROP INDEX, 2 dropped constraints), on tables no migration mentions. The destructive-op guard cannot see it twice over -- it globs libs/<domain>/database, and even correctly aimed it reads the FILES, where there is nothing to find. A GUARD THAT READS WHAT WAS WRITTEN CANNOT SEE A DESTRUCTION THAT IS COMPUTED. NO RESUME POINT AND NO REVERSAL, both structural: the script has no BEGIN and no COMMIT so psql runs 86 statements in autocommit, migrate diff never writes a _prisma_migrations row, and there are zero down migrations. 1 of 4 phases is performed deliberately; 0 of 5 conditions are rehearsed and 2 of those cannot be. The scan re-counts the files, rebuilds a production-shaped database, and re-measures the script the deploy would apply. NO SERVER IS EXIT 1. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/expand-contract-rehearsal-scan.mjs"
      }
    },
    "feature-flag-completeness-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.14.b. Grades the flag completeness report -- the fifteen attributes S10.14.b names plus code/config references, reconciled across the SIX declaration sites this estate has where S10.14.a found two -- against the source. Re-derives a SCHEMA rather than a count, in both directions: a field the report grades an attribute out of that a type no longer declares, and a lifecycle field appearing in any of the six sites, both fail, because either one silently makes ten findings stale. Re-reads the owner of every shared key across all three registries, so the recorded disagreement fails whether it is FIXED or JOINED by another. Re-measures the central finding: three exported `useFeatureFlag(key, fallback)` functions with identical signatures, and which of them a non-test file imports. Fails on drift; reports the estate. Fifteen negative controls -- one of which caught the register searching for its own subjects and finding itself -- and it exits 2 if any goes undetected.",
        "command": "npx tsx tools/feature-flag-completeness-scan.mjs"
      }
    },
    "feature-flag-expiry-alert-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.14.d. Grades the expiry-alert register -- the deadline, the recipient and the escalation payload an alert needs -- against the estate. Its central refusal is that a duration with no origin is not a deadline: three experiments carry maxDurationDays 28/21/14 with startDate null, and resolveDeadline declines to substitute `now`, because an unanchored duration defaulted to the moment of asking recedes exactly as fast as it is approached. The clock is a parameter, so the instant that matters is reachable. Re-derives both stopping conditions (minSampleSize becomes a predicate; maxDurationDays has no reader anywhere and durationDays is copied into the report and interpolated into a markdown line), and checks that no directory resolves a team label and no site has a field for a backup. Grades the estate's one flag runbook step as three CLAIMS, each re-derived by the method its kind implies: the location by reading release-taxonomy.ts, the operation by enumerating the studio flag route's verbs, the precondition by searching for a changed-at field. Quoted clauses are searched for in the runbook, because a register that refutes a sentence nobody wrote is stale even when the estate is not. Fails on drift; reports the estate. Fourteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/feature-flag-expiry-alert-scan.mjs"
      }
    },
    "feature-flag-integrity-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.14.c. Grades the flag integrity run -- the ten conditions the cell names, classified by the EVIDENCE each needs, so that the four which are properties of a run report `undetectable` rather than clean in an estate where nothing emits an evaluation. Recounts the thirteen boolean environment gates in both directions and re-reads each one's POLARITY from the source, which is where the unsafe-default finding lives and is one character from its opposite; an `!==` inside a guard clause is an `equals` gate written inside-out, so the polarity of a call site is the operator combined with what the branch does. Every `undetectable` rests on an absence, so each is searched for: an emitter appearing in the evaluation route, a client starting to parse `results`/`errors`/`partial`, a date field appearing on a flag. Fails on drift; reports the estate. Sixteen negative controls -- two of which caught the register finding its own subjects, once through a path prefix and once because `grep -h` had stripped the path the filter needed -- and it exits 2 if any goes undetected.",
        "command": "npx tsx tools/feature-flag-integrity-scan.mjs"
      }
    },
    "feature-flag-inventory-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.14.a. Grades the flag inventory -- the five sources S10.14.a names, split into those that may DECLARE a flag and the one that may only WITNESS it, and the 24 flags this estate actually has -- against the two registry literals, the config gates, and the three sources it says yield nothing. Recounts every number from the source: both registries are parsed, and each config gate's production reader count is measured with test files excluded, which is the whole basis of the two gates only a test still remembers. Three claims are ABSENCES and each is searched for: no flag provider is a dependency, nothing in the evaluation route records an evaluation, and an override still cannot introduce a key the registry does not declare -- the one thing the estate gets exactly right about dynamic values. Fails on drift; reports the estate. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/feature-flag-inventory-scan.mjs"
      }
    },
    "feature-flag-release-readiness-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.14.e. RUNS THE GATE over a flag manufactured to fail it, every time, and exits non-zero if the gate lets it through -- which is what S10.14.e means by its evidence line, `deliberate stale flag test`: a readiness check that has never refused a release is indistinguishable from one whose predicate is true, and reading it cannot tell them apart. The specimen carries two defects so that losing either check stays visible. Also re-derives the three claims the register's unexhibitable conditions rest on -- no declaration site has an expiry field, gate-definitions.ts names no flag, and renewalChain/validateWaiverGrant still exist -- because an `indeterminate` that has become wrong lets a real stale flag ship. The two exhibitable conditions are recounted from S10.14.c's gate register rather than restated, so the two lists cannot drift apart. Fails on drift; reports the estate. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/feature-flag-release-readiness-scan.mjs"
      }
    },
    "feature-flag-removal-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.14.f. Grades the removal plan -- the seven cleanup classes the cell names plus the one it does not, and the lifecycle state between them. Its central claim is an UNREACHABILITY resting on three independent facts, each re-derived every run: the web client persists overrides to localStorage, loadOverrides adopts every key with no membership test, and resolve consults the overrides ahead of the remote value and the default. Repair any one and the copy stops outliving the flag. Also re-derives the one compiler-enforced cleanup (ConsumerShellFeatureFlagId is a union of six and `requiredFlags` names a member), the absence every blocked lifecycle transition rests on (nothing emits a flag evaluation), and the homonym gap that justifies refusing a name-matched site. EVERY quoted site is re-read verbatim in the file it cites -- a control caught three paraphrases on the first run, which is the whole argument for the check. Fails on drift; reports the estate. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/feature-flag-removal-scan.mjs"
      }
    },
    "fixture-expectations-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.g. THE RULE: FIVE OF THESE SIX EXPECTATIONS CANNOT BE VIOLATED BY A FIXTURE, AND ALL SIX CAN BE VIOLATED BY WHAT RUNS IT. Written as a matrix of fixtures times expectations this grades six greens and says nothing: MEASURED, all 239 modules under src import ZERO capabilities -- no node:fs, no node:child_process, no node:net, no database client -- so a frozen array cannot fail to clean up, cannot open a socket, cannot exceed a bound it never allocates. Grading it on those is not a weak test, it is not a test, and the green is a property of the KIND of thing being graded. The subject is wrong, and naming the right one is the cell. WHAT ACTUALLY RUNS THEM: 97 scans -- 89 read the filesystem, 68 spawn a subprocess, 9 need a database, 0 make an outbound call, 4 WRITE. TWO LIVE DEFECTS FOUND AND FIXED. (1) game-day-scan mkdtemp'd on every call, four calls a run, with no rmSync anywhere in the file: 88 directories and 2.4 MB had accumulated, measured by counting the temp directory before and after a run. Now removed in a finally, and the scan re-measures the count across a real run rather than grepping for rmSync -- a grep would pass on a file that calls it in a branch nothing reaches. (2) SEVEN diagnostics across the six corpora are built from their own input; six use a lookup key or a hand-written corpus id, and ONE received a hostname chosen by whoever is being defended against and QUOTED it. asTheResolverSeesIt now reports the length instead. WHETHER ECHOING BYTES IS A DEFECT DEPENDS ON WHO CHOSE THE BYTES, and a check asking 'does the message contain the input' cannot tell: applied to all seven a redaction rule strips the identifier out of every useful error in the kit; applied to none it misses the one. AND PROVENANCE IS NOT CARRIAGE -- the first register had one field for both and went on reporting a leak after the fix, because the site still RECEIVES hostile bytes permanently and no longer QUOTES them. Persistence has three values, not a boolean, because a cleansUp flag marks the two tracked evidence writers as failures and they are correct. TRAP, FIFTH TIME THIS SECTION: the writer census flagged THIS scan, because the pattern naming the writing functions appears as a regex literal inside it; both the writer and the network censuses are now decided by what a file IMPORTS. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/fixture-expectations-scan.mjs"
      }
    },
    "fixture-mode-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.c. Grades the fixture-gate register against the estate it describes. Half of S11.2.c is already built -- S7.3.c's FixtureLabelling with seven fault kinds, REQUIRED_LABEL_SURFACES, source and version, dismissibility and a non-colour cue -- and its first field is `fixtureActive: boolean`, which nothing outside capability-banner.spec.ts has ever supplied. The scan re-derives why: seventeen *_FIXTURE constants in one BFF file split ten/two/two/one/two across five gates whose deciders are the deployment, nobody, a dependency's health and one line of in-process code handed `includeFixture: allowFixtures()`, so not one is the request; forty-five get*Fixture() functions with a non-test call site under apps/oshun/web/src of which exactly ONE writes a `source: 'fixture',` the DOM can show (the trailing comma is load-bearing -- types.ts declares the union and a declaration announces nothing); forty-five distinct x-oshun-* request headers the BFF reads and none about substitution; and useCapabilityProbe setting two of the nine LIVE_CLAIM_ORIGINS under a comment that says why it can never name the other seven. Counted by how each gate is WIRED rather than by its shape, 49 of the estate's 69 substitutable subjects can answer a production request. Fails on drift; reports the class-by-class opt-in matrix. Fourteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/fixture-mode-scan.mjs"
      }
    },
    "focus-assertions-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.4.a. The six focus claims the cell names plus the history it asks be kept, and what it takes to establish each. THE RULE: A SEARCH FOR AN ELEMENT IS NOT AN ASSERTION ABOUT AN ORDER. The estate's strongest keyboard-reachability check presses Tab up to EIGHTY times until the assistant composer reports itself focused and then asserts that it was reached -- which establishes reachability, 2.1.1, and says nothing about 2.4.3 Focus Order, which is a claim about the sequence. The eighty is read out of the loop rather than remembered, because the point is that nothing on the page produced it: a surface with a longer focus order fails, and the message says the element was not reached rather than that the budget ran out. AND: TAB IS A MOVE AND AN ASSERTION IS A CLAIM -- 14 of the estate's 19 Tab presses are followed by a type() rather than an expect(), so if focus lands elsewhere the text arrives in the wrong field and the failure names neither focus nor order. AND THE ONE THAT STINGS: THE CORRECT RESOLVER EXISTS IN THIS REPOSITORY AND IS SERVED TO THE PRODUCT. apps/oshun/bff/src/studio/focus-order-store.ts computes the real Tab traversal -- positive tabIndex first ordered by index then document position, then tabIndex 0 in document order, negatives programmatic-only, disabled and hidden skipped, the positive-index anti-pattern flagged -- and is exposed at /v1/admin/studio/focus-order for a designer to inspect a component with. resolveFocusOrder has exactly two importers, the route that serves it and the store that defines it, and NO suite uses it to check the product's own focus order. AND: FOCUS HISTORY IS WHAT MAKES A FAILURE READABLE, and the estate records none. Against the estate: 4 of 7 claims observed at all, ONE established, 0 behind a shared helper, and the focus indicator checked zero times. Twelve negative controls, including one confirming a step-and-assert walk DOES establish an order so the rule is not a blanket refusal; exits 2 if any goes undetected.",
        "command": "npx tsx tools/focus-assertions-scan.mjs"
      }
    },
    "follow-up-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.12.g. Grades the newest `follow-up-register.json` under `docs/releases/v1/verification/game-day` with the SHIPPED follow-up contract (`followUpFaults`), whose only callers before this were spec fixtures. On top of it: every owner must be a contact in the shipped dependency register and, when the entry names a dependency, one of THAT dependency's owners -- so a name cannot be invented to satisfy the field; every deadline must equal `raisedAtMs + policy(severity)`, so a row cannot be quietly given six more weeks; every closure citing a retest must match a record in `follow-up-retests.json` whose verdict is `fixed` and whose finishing instant IS the register's `retestedAtMs`, so a closure is backed by a run rather than by a merged diff; every finding the acceptance matrix emitted must appear here under its own id or an alias; and every backlog reference, evidence path and runbook id must resolve. The operator-facing `docs/runbooks/v1-follow-up-register.md` is graded against the JSON CELL BY CELL -- state, severity, owner, deadline and the tally sentence under the table -- because the reader acts on the severity and the date, not only on the word `closed`. Twenty-seven negative controls mutate the REAL register AND the REAL document, and it exits 2 rather than reporting if any goes undetected. `OSHUN_FOLLOW_UP_NOW_MS` injects the clock so the overdue path is reachable before a deadline passes.",
        "command": "npx tsx tools/follow-up-scan.mjs"
      }
    },
    "fuzz-invariants-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.e. THE RULE: AN INVARIANT YOU CANNOT OBSERVE CANNOT BE ASSERTED, AND ASSERTING IT ANYWAY IS THE DEFECT. Each of the twelve invariants records the observation it requires, and checkInvariants returns FOUR verdicts: held, violated, UNOBSERVABLE (the seam is not wired) and VACUOUS (the subject cannot violate it). Reporting either of the last two as held is how a suite claims coverage it does not have. MEASURED over 29 inputs from the S11.9.b and S11.9.d corpora against the real parseEnvelopeJson: 6 held, 0 violated, 3 unobservable (bounded-memory, bounded-depth, bounded-logging), 3 vacuous (no-ssrf, no-traversal, no-partial-side-effect) -- SIX OF TWELVE ACTUALLY CHECKED, reported as mostly-unchecked. A STABLE TYPED REJECTION IS A CLAIM ABOUT TWO RUNS, so runTwice is built in rather than left to a caller who might skip it. A CRASH AND A HANG ARE THE SAME OBSERVATION FROM DIFFERENT SIDES, so the deadline is part of the observation. PURITY BOUNDS EFFECTS, NOT WORK: bounded-time and bounded-memory are not vacuous for a pure subject. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/fuzz-invariants-scan.mjs"
      }
    },
    "fuzz-schedule-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.g. THE RULE: A CHECK THAT NOTHING SCHEDULES IS A CHECK NOBODY RUNS. 82 verify:operations scripts were declared and 8 were named by any workflow -- 74 worked and nothing ran them. A TIER IS DECIDED BY WHAT A CHECK NEEDS: 8 of 90 scans open a database and cannot run in a job that has none; the other 82 read files. OWNER ROUTING WITH ONE OWNER IS NOT ROUTING -- 94 CODEOWNERS rules, one owner. The deliverable is the schedule: .github/workflows/v1-workbench-kit-verification.yml partitions BY PATH at run time so a new scan is scheduled without being filed, runs files-only on every PR and the database tier nightly with a postgres service, and carries no continue-on-error and no || true. THE FIRST HONEST RUN FOUND NINE FAILING SCANS: three genuine estate drift from commits on main, five instances of A REGISTER THAT COUNTS ITS OWN FAMILY (five members, four carrying prose, one living outside the kit directory), and one real crash in shipped kit code where a typed module gained fields its untyped .mjs probe never got. All repaired; all 83 file-only scans pass. Six negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/fuzz-schedule-scan.mjs"
      }
    },
    "game-day-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node: the harness EXECUTES the in-tree control `scripts/isis/run_runpod_disaster_recovery_gameday.sh` through the drill-script seam it already has, and imports the kit module's TypeScript source. Seventeen conditions under which a game day that established nothing is indistinguishable from one that established that the estate recovers, with a legacy arm reproducing the pre-S10.12 aggregation (`pass: all(.[]; .status != \"fail\")` and `.isReadOnly // true`, which returns true for every input) so the scan can be seen to detect something rather than only ever printing clean. Requires jq, the same way the estate's drills do. Exits non-zero if the legacy arm ever scores as well as the kit.",
        "command": "npx tsx tools/game-day-scan.mjs"
      }
    },
    "golden-manifest-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.13.b. THE RULE: A GOLDEN IS A PROMISE THAT SOMETHING HAS NOT CHANGED, AND ProfileFixture CARRIES NO HASH. golden-round-trip.ts gets the CLASSES exactly right -- all seven this cell names -- and fixtureRegistryFaults makes seven checks worth having, including the two best: a profile with NO refused fixture (a registry where nothing is declined has never shown the validator can decline) and a fixture with no reason, because 'a fixture that starts passing names the rule'. MEASURED on ProfileFixture's EIGHT fields: 0 hash fields, 0 licence fields, and golden-round-trip.ts does not use Sha256Hex anywhere. Both are things this cell names -- 'licensed source and immutable hashes' -- and both have a vocabulary elsewhere in the estate: bill-of-materials.ts exports ASSERTION_STATES, and its four values are exactly right for a licence because they separate 'we checked and there is none' from 'nobody looked'. WHY THE HASH MATTERS MORE THAN IT LOOKS: a golden's entire job is to fail when something changed, and without one the registry records that a fixture EXISTS and never that it is the SAME fixture -- so a golden edited in place goes on passing, and the run that should have caught the change is the run that was changed to accept it. AND WHY THE LICENCE IS NOT A FORMALITY: a golden's content is MATERIAL, redistributed in every clone and every container image, and a fixture whose source nobody recorded cannot be shown to be redistributable at all. SHIPPED: GoldenEntry with a contentHash, a recomputedHash and a LicensedSource, and a worked manifest of 14 entries over the 2 exported profiles and all 7 classes -- which the ESTATE'S OWN fixtureRegistryFaults accepts, the first time anything has handed that checker a registry, with a positive control confirming it really does object when no fixture is expected to be refused. 8 fault kinds. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/golden-manifest-scan.mjs"
      }
    },
    "golden-round-trip": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/golden-round-trip.mjs"
      }
    },
    "golden-runner-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.13.a. THE RULE: THE RUNNER PRODUCES BYTES AND THE CHECKERS CONSUME DESCRIPTIONS, AND FIVE OF THE SEVEN DESCRIPTIONS HAVE NO PRODUCER. TWO ASSUMPTIONS ABOUT THIS ESTATE TURNED OUT TO BE WRONG AND BOTH ARE RECORDED. The first was that nothing performs a golden run: tools/golden-round-trip.mjs is 472 lines and performs a REAL one -- it writes artefact bodies, serialises a manifest, archives with GNU tar, hashes real bytes, and repeats the whole build under shuffled input order, touched mtimes, a Turkish locale, a Kiritimati time zone, a 0077 umask and interleaved writes, comparing tar HEADERS as well as digests and asserting that localeCompare disagrees with byte order first so the locale axis is known to be live. It extracts each archive and rebuilds FROM THE EXTRACTED BYTES, byte-identical. And it reports honestly that 'platform' cannot be varied on one machine, NAMING it as never perturbed rather than dropping it from the axis list. The second was that golden-round-trip.ts is only registers: it has SEVEN checkers that map one-to-one onto this section's seven cells. WHAT IS ACTUALLY TRUE IS NARROWER AND CHECKABLE: the runner calls TWO of the seven -- archiveReproducibilityFaults and goldenCoverageFaults -- and the other five take descriptions of a run that nothing produces, with BuildGolden and RebuildComparison having ZERO producers outside the module, its spec and the barrel. SHIPPED: a GoldenRunner contract with one stage per UNFED checker, each stage's return type named as the type that checker takes, so the API is READ OFF the checkers rather than designed -- if a checker's input changes, the stage that feeds it stops compiling. Every stage is required, because a checker handed nothing reports nothing, which is indistinguishable from a clean run. The IDENTITY PROMISE is part of the contract because this cell names it: a semantic promise with no documented difference is a byte promise somebody was not confident enough to make, and a byte promise that documents one contradicts itself. AND THERE IS NOTHING TO PLUG INTO: EXTENSION_POINTS offers stage-model, gate, block, preview, inspector, importer and publisher, and no golden-runner. That fault is reported on every run and IS the finding. The scan RECOUNTS which checkers the shipped runner calls from its source rather than reading the register. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/golden-runner-scan.mjs"
      }
    },
    "graph-admission": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/graph-admission.mjs"
      }
    },
    "hierarchy-cycle-race": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/hierarchy-cycle-race.mjs"
      },
      "dependsOn": ["build"]
    },
    "history-constraints": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/history-constraints.mjs"
      }
    },
    "id-adapter-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.c. Seeded and scripted identifiers, shipped as a working implementation. THE RULE: A PREDICTABLE IDENTIFIER THAT REACHES PRODUCTION MUST SAY SO. A seeded id generator is a security defect wearing a test double's clothes -- if the same seed gives the same identifiers then a guessable session id, invite token or object key is the whole game, and the usual answer, it only exists in tests, is a claim about a wiring nobody checks. So it is answered twice: EVERY IDENTIFIER IS MARKED (they begin 7e57, hex for test) with assertNotATestId as a fail-loud seam for the paths that MINT an id, and the odds of a real UUID carrying the marker by chance are STATED -- 1 in 65,536 -- because a marker treated as a proof is a false negative waiting to happen. AND THE MARKED IDS ARE STILL VALID UUIDS: version nibble 4, variant bits 10xx, the right dashes, because a double producing id-1 would pass every test and fail against a uuid column, a parser or a router, hiding exactly the bugs it exists to find. A SCRIPT THAT RUNS OUT HAS TO SAY SO: createScriptedIds throws on exhaustion rather than wrapping, which would turn one extra id into a silent collision, or returning undefined, which would surface three layers away. AND A COLLISION IS SOMETHING A TEST WANTS -- a script may repeat, because making two things collide is often the reason to script ids at all, so scriptedCollisions REPORTS the repeats for the author rather than refusing them. Determinism is SplitMix64 over a 64-bit state, written out in eight lines of BigInt so the sequence is pinned to this file and cannot move under a dependency bump. The scan pins a GOLDEN VECTOR for seed 42, runs ten thousand identifiers checking distinctness, shape and marker, checks all four legal variant nibbles appear, and confirms the module reaches for no real randomness -- which caught its own comment-stripper reporting a JSDoc line that NAMES crypto.randomUUID in prose. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/id-adapter-scan.mjs"
      }
    },
    "idempotency-contention": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/idempotency-contention.mjs"
      }
    },
    "importer-roundtrip": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/importer-roundtrip.mjs"
      }
    },
    "inbox-idempotency": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/inbox-idempotency.mjs"
      }
    },
    "interaction-helpers-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.4.c. The twelve complex interactions the cell asks for helpers for, and the registers a helper needs first. THE RULE: YOU CANNOT WRITE A HELPER FOR A SET YOU CANNOT ENUMERATE. For exactly one of the twelve -- dragging -- this cell builds the register, and it takes a JSX parser: walk every opening tag, track brace depth so a handler body full of angle brackets does not end it early, and ask whether THAT tag carries a drag affordance. For the other eleven the word is not the thing: 'review' appears 9,779 times across the two products and 'compare' 1,384, and neither is a count of an affordance. AND THE ONE REGISTER EARNS ITS KEEP IMMEDIATELY: S11.3.b filed 2.5.7 Dragging Movements as waiting on an input nobody produces -- the operations performed by dragging -- and this IS that input. Nine product elements carry draggable or onDragStart; ONE has an onKeyDown on the same element, three have an arrow handler or a move control elsewhere in their file, and FIVE have none of the three anywhere in the file they live in: two in WidgetSidebar and one each in TaraSceneEditor, AreteSevenHabitsSystem and AreteVisionBoard. THOSE FIVE ARE CANDIDATES AND NOT VERDICTS, because an alternative can live in a sibling and a drag can be essential -- so the verdict is needs-exercising, and what settles it is the helper this cell asks for driven by the instrument S11.3.b measured as aimed at a gallery. AND: A HELPER WITHOUT A PATH IS NOT A TEST GAP, IT IS A PRODUCT GAP -- the command palette has a path and no helper, nine keyboard drives written out at each site; a WidgetSidebar reorder has no path, and filing it as a missing helper would put it in the wrong queue. AND, MEASURED AND SMALL: press('Shift+Arrow) appears ZERO times in the V1 suites while two products declare aria-multiselectable. The scan rebuilds the register from the products every run and fails if it and the module disagree. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/interaction-helpers-scan.mjs"
      }
    },
    "isolation-paths-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.d. The nine read and write paths, and the write path that leaks. THE RULE: A PATH WITH NO TENANT BOUNDARY CANNOT PASS A TENANT-ISOLATION TEST, AND REPORTING IT GREEN IS THE DEFECT -- 7 of 9 paths are served, 5 scope by tenant, 2 (blob-ref, job) have no repository, the audit path has no tenantId at all, and the export path is a per-user subject-access bundle. A REQUIRED PARAMETER IS NOT AN APPLIED PREDICATE, so the scan drives the REAL ContractPersistenceService against a REAL database with one natural key held by two tenants. THE FINDING: THE WRITE PATH LEAKS. put() looks up by @@unique([tenantId, contractSchema, sourceRecordId]) and creates with id from the contract payload, and id String @id is a primary key that is not tenant-scoped -- so the second tenant is refused with P2002. DurationBucketSchema.id is a five-value enum, so the first tenant to persist a duration bucket blocks every other tenant for ever. 91 of 147 models carry the shape; 99 contracts are registered. read, search, history and event HOLD, proved against a real collision built underneath the repository because the repository cannot make one. The scan compares the write verdict to the register in BOTH directions, so a fix trips it too. NO SERVER IS EXIT 1. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/isolation-paths-scan.mjs"
      }
    },
    "job-fencing": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/job-fencing.mjs"
      }
    },
    "journey-helpers-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.e. Grades the journey-helper register against the two exemplar suites. Every helper S11.2.e names is the same shape -- do a thing, then wait until it has happened -- so the reusable part is the waiting, and a helper is only as good as the signal it stops on. THE RULE: a signal whose truth condition is an ABSENCE is satisfied soonest by the thing that never happened; waitForLoadState('networkidle') cannot tell everything-arrived from nothing-was-requested because those are the same observation. It is reached from 23 call sites across the Tara suite's page objects, eight of them in auth.page.ts, so the most common step in every authenticated journey stops on it. AND: a wait that swallows its timeout is a sleep -- base.page.ts has three catches and the difference is the point, isVisible being a PREDICATE that returns false (correct) while waitForLoadingComplete and waitForToastDismiss catch a hidden-state wait and return as if it had arrived, at thirty and ten seconds. The scan re-derives the whole waiting census across both suites -- toBeVisible 683, toHaveURL 61, networkidle 26, and one call site apiece for page.on('console'), page.on('pageerror'), page.on('request') and waitForResponse, with expect.poll and waitForRequest at zero -- so S11.2.e's network-and-console-capture family is four call sites, and neither recorder writes anywhere the run keeps. Fails on drift; reports the nine-family matrix. Thirteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/journey-helpers-scan.mjs"
      }
    },
    "journey-provisioning-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.b. Grades the provisioning contract against the estate it describes. Its central claim is a BROKEN EDGE -- this estate has a real account provisioner and a real tenant provisioner and nothing that gets an actor from one to the other -- and the argument is four facts, each re-derived every run. buildAuthSession writes scopes: ['domain:*'] as a literal for every session the customer auth store issues and it is the ONLY scopes literal in that file; hasTenantOperatorScope asks for admin:* or admin:workspace:tenant-console; createDevAuthToken is `dev.` plus base64url of the payload, unsigned, and areDevTokensAllowed refuses it 401 dev_tokens_disabled in production, so the one available route to the tenant boundary exists in exactly one kind of environment; and TenantOnboardingStore has onboardDurably and no removal of any kind. Also checks the cross-process control that no single file shows: the dev seeder assigns OSHUN_DEV_AUTO_VERIFY_EMAIL in the Next process, customer-auth-store reads it in the BFF process, forwardJsonRequest puts a fetch between them, and apps/oshun/bff/project.json's dev target sets the variable itself, which is why the mistake is invisible. And it re-reads the CLEANUP_TEST_DATA branch of testing/e2e/setup/global-teardown.ts statement by statement, because a body appearing there closes a gap the register would otherwise go on reporting. Fails on drift; reports the subject-by-act matrix. Fourteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/journey-provisioning-scan.mjs"
      }
    },
    "journey-readiness-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.g. The gate that says whether the two exemplar journeys can be run live with fixtures disabled, and the evidence that they CANNOT -- which is why S11.2.g is the one cell of the family left unchecked. THE RULE: 'WITH FIXTURES DISABLED' AND 'PROVISIONED THROUGH REAL BOUNDARIES' ARE SATISFIABLE IN DISJOINT ENVIRONMENTS, and both halves are DERIVED. fixtureFreeEnvironments reads S11.2.c's gate register and returns nothing: forty-nine of the estate's sixty-nine substitutable subjects serve in production, two through a route helper that evaluates no condition at all and forty-seven behind a dependency's silence that no environment suppresses. tenantReachableEnvironments reads S11.2.b's register and returns non-production only, because the tenant provisioner wants an admin scope and the only route to one is an unsigned dev. token that areDevTokensAllowed refuses in production. Both exemplar journeys require a tenant, so the intersection is empty -- and the counterfactual is computed too: repair the unconditional gates and the fixture-free environment becomes production, which is exactly where the tenant boundary closes, so the second blocker survives the first repair. Seven preconditions, one owned by each cell of S11.2.a-g, each resolved by calling that cell's own resolver over that cell's own register rather than from a table kept here, so the gate moves when a blocker clears rather than when somebody remembers to edit it. Re-reads both halves of the contradiction from source every run, and fails if a suite ever claims to be a live exemplar journey while the gate still refuses -- a suite claiming live in an estate that cannot be live is S11.2.d's masquerade at the level of a whole file. Thirteen negative controls, including one that hands the gate verdicts that all hold and confirms the green branch works, because against this estate that branch is unreachable and a gate whose pass has never run is the mirror of a check that cannot fail.",
        "command": "npx tsx tools/journey-readiness-scan.mjs"
      }
    },
    "journey-scaffold-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.2.a. Grades the live-journey scaffold contract against the two suites it describes. Its central claim is a SIDEDNESS -- a substitute installed in the Playwright process is invisible to the application, so the badge the application renders can only ever announce a substitution the application performed itself -- and the argument is four live facts, each re-derived every run and each repairable by somebody who has never heard of the module. apps/tara/web/e2e/fixtures.ts overrides the built-in page fixture and installs seven context.route handlers that all ten specs receive and none can decline, while the same file receives skipAxe from libs/shared/testing as [false, { option: true }]: a declinable accessibility check beside an undeclinable interception, which is the whole argument that the repair was available and not taken. apps/tara/web/e2e/auth.setup.ts plants a session with addInitScript and confirms it by reading the same localStorage key back, while the suite's only real login is setup.skip(true). testing/e2e's setup logs 'creating empty auth state' and returns GREEN when TEST_USER_EMAIL is unset, and its globalSetup console.warns a failed health check and continues. And /operator/metis labels its OWN fixture fallback through data-operator-metis-oneroster-source, typed 'fixture' | 'bff' -- the register's one positive result and the proof the conclusion is structural rather than a complaint. Also recomputes from the tree, never from the register: the seven interceptions, the ten specs receiving them, the zero importers of FixtureBadge's family outside its own directory, the zero attachments in either suite, and the zero opt-in switches under any of seven plausible names. Fails on drift; reports the matrix. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/journey-scaffold-scan.mjs"
      }
    },
    "key-helpers-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.4.b. The eight key helper families the cell names, and the one the runner cannot reach. THE RULE: A HELPER FAMILY IS DEFINED BY THE INPUT IT CAN PRODUCE, AND NEITHER OF THE RUNNER'S TEXT APIS CAN PRODUCE THE ONE THAT MATTERS. Measured in a real Chromium: keyboard.type then press('Enter') gives isComposing false and no composition event; keyboard.insertText fires an input and NO keydown for its text at all; only a CDP session's Input.imeSetComposition produces compositionstart, compositionupdate, and a following keydown carrying isComposing TRUE. imeSetComposition and CompositionEvent appear nowhere in this repository, and the capability is not missing -- the estate already opens CDP sessions in four places. WHAT THAT COSTS, COUNTED BY WALKING EACH input and textarea OPENING TAG rather than by asking whether a FILE mentions both: 29 text-entry elements carry an inline onKeyDown acting on Enter, among them the shell's universal search, the assistant composer and Arete's journal, and isComposing, keyCode 229 and compositionstart appear ZERO times in product code. For a user typing Japanese -- one of the eight launch locales -- pressing Enter to confirm an IME candidate fires every one of them. The count is the EXPOSURE and not the defect count, and the difference is the point: without the mechanism a safe handler and an unsafe one are the same observation. AND: THE ESTATE'S ONLY KEY HELPER IS A SEARCH AND THERE ARE TWO OF THEM WITH TWO BUDGETS -- a local tabTo with maxTabs 24 and an inline loop with 80, both read out of their loops, neither derived from a page. AND: A TEXT API THAT SKIPS THE KEY EVENT CANNOT EXERCISE A KEY HANDLER, which is what insertText is for and against. Six of eight families exercised, ONE behind any helper at all, and that one lives inside a spec file. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/key-helpers-scan.mjs"
      }
    },
    "keyboard-guard-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.4.d. This target IS the static half of the guard the cell asks for. THE RULE: force true DOES NOT MAKE THE CLICK LAND, IT MAKES THE FAILURE SILENT. Measured in a real Chromium on a button under a full-page overlay: a plain locator.click REFUSED, timing out on the receives-events actionability check; the same click with force true dispatched a real mouse event at the target's coordinates and THE COVERING ELEMENT received it, the target's handler never ran, and the call RESOLVED SUCCESSFULLY. So each of the estate's 39 forced clicks is a call that cannot fail for the one reason it was almost certainly added, and that can silently activate a different control -- and that actionability check is the nearest thing the estate has to an automatic detector of an obscured control, since S11.3.f measured 2.4.11 as having no instrument aimed at the products. AND: IN THIS RUNNER A POINTER CALL AND A COORDINATE CLICK ARE THE SAME CALL -- a click on an element at (50,60) 100x40 dispatched a trusted event at exactly (100,80), so there is no non-coordinate click in the API and the cell's two items collapse into one. AND: THREE OF THE SIX DETECTIONS ARE STATICALLY DECIDABLE AND THREE ARE NOT, so the guard runs three and hands three to a runtime fixture rather than pretending: it deliberately does NOT report the 759 evaluate calls, most of which read document.activeElement, and does not call 1,345 test ids inaccessible, because that is a question about the element each resolves to. AND: THE GUARD HAS NO SCOPE -- nothing declares a keyboard suite, and keyboard-only appears in three test titles, one journey registry entry, some typed text and some prose, so the parent's evidence line has no subject. AND THE LINE IS NECESSARY AND NOT SUFFICIENT: the one test that names itself keyboard-only has zero pointer calls, zero forced clicks and zero test ids, and calls .focus() once -- a method call reaches anything at tabindex minus one, so it has assumed what it exists to prove. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/keyboard-guard-scan.mjs"
      }
    },
    "keyboard-journeys-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.4.e. The gate that says whether the nine critical acts can be run keyboard-only, and the evidence that they cannot -- which is why S11.4.e is left unchecked. THE RULE: A JOURNEY IS SOMETHING THE USER DOES AND THE REGISTER ENUMERATES PLACES THEY GO. The estate keeps a good critical-journey register with a keyboardOnly coverage dimension, fourteen entries, every one carrying a citation with a file, a title fragment and a sentence of evidence -- and its fourteen entries are SURFACES. Not one of the cell's nine acts appears in it: coverage of every place is not coverage of any act. AND: A CITATION IS A CLAIM THAT CAN BE CHECKED. S11.4.d built a guard and reported that nothing declared a keyboard suite for it to run over; this register IS that scope, eight distinct tests named by file and title, and running the guard over them shows FOUR OF EIGHT DO NOT HOLD -- the Control+K palette test opens the palette with a chord and then clicks five palette items; home-keyboard-focus-path presses NO KEY AT ALL, asserting that tabindex is -1 and then 0, which is reading the attribute that decides the tab order instead of walking it; and two set focus by method call, once and six times. AND THE GATE REFUSES FOR REASONS THE SIBLINGS ALREADY MEASURED, none about writing a test: no helper for any of the twelve complex interactions, no keyboard path at all for reorder, move or range selection, one of seven focus claims established, and the only key helper a Tab search local to one spec. Every precondition is resolved by calling the owning cell's own register, so the gate moves when a blocker clears. TRAP, committed by this cell and caught by its own controls: registerNames used includes and reported the register as naming the `save` act, because a surface is called library-SAVEd-continuity -- a substring is not a name. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/keyboard-journeys-scan.mjs"
      }
    },
    "lease-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.a. THE RULE: A TYPE THAT MAKES A BAD STATE UNREPRESENTABLE ALSO MAKES IT UNINJECTABLE, AND FAULT INJECTION IS THE ONE PLACE THAT MATTERS. jobs.ts is 1,929 lines and the best-argued module in this library. Its first decision is this cell's subject -- 'a worker whose lease expired does not know its lease expired: it was paused, the coordinator handed the job to somebody else, and then it wakes up and writes. Expiry protects the QUEUE; only a monotonically increasing token, checked at the WRITE, protects the DATA.' Its third decision creates the problem this module solves: 'effect-then-checkpoint REPEATS the effect on resume, which idempotence answers; checkpoint-then-effect SKIPS it, and nothing anywhere reports a stage that was never run. CHECKPOINT_ORDERINGS has no checkpoint-first member.' MEASURED: exactly two members and the dangerous third absent by design. That is right for production and it means the silent failure CANNOT BE WRITTEN DOWN -- no fixture can put a system into the state whose whole danger is that nothing reports it. So the corpus carries INJECTABLE_ORDERINGS, deliberately wider, with productionCannotExpress marking the extra member; the two are never merged, and the scan checks that NOTHING outside this cell imports the wider list, because the day it becomes a production type is the day the constraint stops holding. SECOND MEASUREMENT: claimJob has ZERO callers outside a spec -- the lease machinery is complete, argued and driven by nothing, the same shape S11.10.a found for the archive checkers. SHIPPED: EXPIRY_POSITIONS x orderings -> POSITION_COSTS, where the SAME position costs a REPEAT under one ordering and a SKIP under the other and only the repeat is visible; wouldBeAccepted, which refuses an EQUAL token as firmly as a lower one because two workers holding the same token is the state fencing exists to prevent; 9 fixtures over 6/6 events, 4/4 positions, 4/4 loss kinds. The dead-worker fixture records that it proves NOTHING alone -- a dead worker never writes, so a system with no fencing at all passes it -- and the clock-skew fixture shows the verdict depends on tokens rather than on either clock. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/lease-fixtures-scan.mjs"
      }
    },
    "lint": {
      "executor": "@nx/eslint:lint",
      "options": {
        "lintFilePatterns": ["libs/oshun/workbench-kit/**/*.ts"]
      }
    },
    "locale-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.c. The six content shapes a baseline should be taken in, and the determinism that has to hold while it is. THE RULE: A 505-LINE BIDI LIBRARY WITH NEUTRAL PROTECTION, AND NO BASELINE RENDERS ONE RIGHT-TO-LEFT PIXEL. rtlLayout.ts names ten surfaces and ten direction policies, maps physical properties to logical ones, and carries assertNoPartialMirroring, findUnprotectedNeutrals and protectNeutralIn -- which IS the mixed-bidi mechanism, the thing that stops a neutral character between an English run and an Arabic one landing on the wrong side. Two product files import it and NO visual baseline is captured in dir=rtl. AND THE SAME SHAPE AGAIN: localizationChecks.ts is 404 more lines with pseudoLocalize, isPseudoLocalized, expansion bands and a per-language expansion table, driven by a conformance spec, with ZERO product importers. Two libraries, 909 lines, one spec each, two files in the product between them. A NOTE ON HOW THAT WAS FOUND, BECAUSE IT IS THE CELL'S OWN LESSON: this register first said pseudo-localisation did not exist -- a grep for pseudo that excluded CSS pseudo-elements returned the BFF's redaction PSEUDONYMS, and reading the head of that list was enough to conclude there was nothing there. The scan's positive control, the word is present so the zero is not a broken query, is what caught it. A ZERO FROM A QUERY NOBODY POSITIVE-CONTROLLED IS NOT A MEASUREMENT. AND THE DETERMINISM HALF: THERE IS ONE CLOCK FREEZE IN THE ESTATE AND IT IS A PRIVATE FUNCTION IN ONE SPEC -- freezeTime is declared at line 308 of shell-first-impression-visual.spec.ts, called once, exported nowhere, and the other five visual specs do not freeze time at all; data is stubbed by whatever each spec felt like, seven route stubs in one and none in another; and nothing pins a font or an image, so a baseline taken before a webfont loads and one taken after are different pixels for the same markup. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/locale-fixtures-scan.mjs"
      }
    },
    "log-leak-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node, and with no build dependency: the subject is `@oshun/logging`, whose package.json declares \"main\": \"./src/index.ts\", so what a consumer resolves IS the TypeScript source. A harness that exercised a compiled artifact would be testing something nobody imports -- which is not hypothetical, since this library shipped tracked logger.js beside logger.ts until S10.6 and its whole spec had been running against the stale copy.",
        "command": "npx tsx tools/log-leak-scan.mjs"
      }
    },
    "malformed-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.c. THE RULE: THE SIX FAULT FAMILIES ARE A SEQUENCE, NOT A SET, AND correctionAllowed TAKES A SET. structured-output.ts is 1,471 lines and covers nearly everything this cell names -- scanJsonSource for syntax, envelopeFaults for schema/version/discriminator/extra fields, resultSemanticFaults for units, citations, entity scope, cross-field invariants and links (refusing javascript:, data:, vbscript: and file:), preParseFaults for truncation and filter refusal, and a repair layer that will not let a repaired answer pass as an original. CORRECTABLE_FAMILIES is [lexical, envelope] with a rationale worth quoting: 'a model told that citation did not resolve returns one that does, and the second answer is worse than the first because it now looks correct.' WHAT IS MISSING IS THE JOIN: outside the barrel, scanJsonSource, preParseFaults and resultSemanticFaults have ZERO callers, and correctionAllowed takes a family array that NOTHING ANYWHERE PRODUCES. And the order is the whole thing, because a document that did not parse has no envelope and a wrong envelope has no coherent result -- so a classifier that unions everything reports facts derived from a document that was never valid. TWO COSTS, MEASURED: the union CHANGES THE VERDICT on one case (a trailing comma plus a bad citation -- ordered stops at lexical and permits a retry, the union salvages the comma, reads the citation out of the salvage, and refuses), and it CHANGES THE REASON on three (a truncated body is one fault ordered and three unioned, two of them read from a fragment; the verdict agrees and the log does not). A CORRECTION: the first version reported SIX blocked corrections, and that was an artefact of this cell's own context naming a trust zone that does not exist, so every case fired the same semantic fault. The real number is ONE. The scan now checks the baseline FIRST. LIVE FINDING: EnvelopeContract lists requiredFields and allowedFields and NO TYPES, so title: 42 passes the envelope -- verified by calling it, with a positive control that the same checker does refuse a wrong discriminator. TOOL CALLS ARE THE ONE GENUINE GAP (the word appears once in structured-output.ts): a tool call is a REQUEST, not a field, and its arguments are the model's text arriving at something that will act on them. TRAPS: the scan's family-array query found ITSELF (sixth instance -- pattern now assembled at run time), and a typed space inside a template literal landed as a RAW NUL BYTE that made the module binary to grep, caught by the scan's own NUL check. 15 cases, 11/11 kinds, 4 rungs. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/malformed-fixtures-scan.mjs"
      }
    },
    "manifest-relations-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.c. THE RULE: A RELATIONSHIP IS BROKEN BY CHANGING ONE SIDE, AND A BUILDER THAT REGENERATES BOTH CANNOT PRODUCE ONE. bundleAssemblyFaults compares five inputs and every fault is a disagreement between two of them, so a generator that derives the manifest from the layout only ever produces different VALID bundles. consistentTuple builds the valid five-tuple -- the thing the estate has only inside a spec file -- and each break edits exactly one input. BREAKING ONE EDGE MUST PRODUCE EXACTLY ONE FAULT, and expectedFaults is a SET because a rename is inherently two facts. THE FINDINGS: three of the ten relationships are NEVER COMPARED -- entries are matched by path and only the DIGEST is compared, so the manifest's kind is unchecked; the external-ref branch reads the LAYOUT's field and never the manifest's; and producedBy/producedAt are never read, so a manifest may credit anybody and the assembly passes. Those are declared as expectedFaults: [] so the register states the gap, and the scan fails in BOTH directions if that changes. The estate's 16 manifest fixtures are each a lone manifest with nothing to disagree with. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/manifest-relations-scan.mjs"
      }
    },
    "manifest-schema-drift": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/manifest-schema-drift.mjs"
      }
    },
    "mask-review-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.e. The mask review, and the tolerance nobody reviews. THE RULE: THE MASK IS THE PART THAT IS REVIEWED AND THE TOLERANCE IS THE PART THAT IS NOT. The estate masks and it masks WELL: two of six visual specs pass a mask, both through a named helper, and both say what they cover and why -- unstableRegions is headed Regions whose CHANGE is not a regression and carries a comment per selector (the greeting says Good morning or Good evening without anything having regressed; the diagnostics blocks are ids and counters put behind a disclosure precisely because they are not member copy; the account chip carries a seeded name encoding a timestamp). That is exactly what the cell asks for, and a mask keeps the layout so everything around those regions still has to match. AND THEN THERE ARE NINETY-ONE PIXEL TOLERANCES CARRYING SEVEN DIFFERENT NUMBERS, NONE OF THEM NAMED -- 0.02 thirty-five times, 0.03 eighteen, 0.01 seventeen, 0.001 sixteen, and 0.004, 0.015 and 0.05 once or twice. A tolerance is UNBOUNDED IN LOCATION: it forgives a difference of any nature anywhere in the capture as long as it is small, so unlike a mask it cannot be reviewed region by region, and the only thing that would make one reviewable is a name saying what it is for. The estate HAS such a name -- VISUAL_THRESHOLD, three tiers with a comment each -- as a const inside one spec of another domain, reachable by no V1 spec. AND THE MATRIX MAKES THE THIRD THING VISIBLE: THE TOLERANCE IS WHAT EACH SPEC PAYS FOR THE CONTROLS IT DOES NOT HAVE. No two of the six control the same things: tables-and-details pins viewport, locale, timezone UTC and reduced motion, disables animations, AWAITS document.fonts.ready so baseline and replay paint with the same font, masks a register of volatile selectors -- and needs ONE tolerance; design-system controls nothing and carries TWENTY; pages controls one thing and carries FORTY-SEVEN. Every control removed is bought back as slack, and slack is the suppression nobody can review. TRAP RECORDED IN THE SCAN: git grep -- 'apps/oshun/*/e2e' matches NOTHING here and returns zero rather than an error, and an earlier draft of this register concluded from those zeros that the estate masked nothing, set no tolerance and disabled no animation -- the exact opposite of the truth. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/mask-review-scan.mjs"
      }
    },
    "media-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.b. THE RULE: 'EXECUTES' IS NOT A PROPERTY OF A FILE, IT IS A PROPERTY OF WHAT OPENS IT. EXECUTABLE_MEDIA_TYPES lists the four an operating system runs; a media pipeline's opener is a browser or a viewer, and MEASURED against the estate's sniffer an SVG with a <script>, an HTML file with one, and a PDF carrying /JavaScript ALL come back executable: false -- the first two matching no signature at all. THE CURRENT SAFETY IS ACCIDENTAL: they are refused as unrecognisable, which works because the sniffer does not know what an SVG is, so adding an SVG signature turns the refusal into an acceptance. The scan fails if one appears. A DIMENSION IS A NUMBER IN A HEADER AND THE ALLOCATION HAPPENS BEFORE ANYTHING VERIFIES IT: a 33-byte PNG header declaring 65535x65535 is 17 GB of RGBA, and maxByteSize bounds 33. declaredPixels returns NULL rather than zero for a non-PNG, and the ordinary 1920x1080 control lives in the same 33 bytes so the check is shown to discriminate. 11 cases over 8 hazards. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/media-fixtures-scan.mjs"
      }
    },
    "metadata-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.d. THE RULE: A FIELD CALLED 'COMMENT' IS INPUT, AND ITS NAME IS THE WHOLE REASON NOBODY TREATS IT AS ONE. And THE HAZARD IS IN THE PAIR (BYTES, CONSUMER) -- the fourth time this section has met that shape, after a reader deciding a format, an opener deciding what executes, and a destination deciding a collision. '=1+1' is inert in HTML and a live formula in a CSV export; a newline forges a log record and does nothing in a caption. Every payload names the sinks it is dangerous in AND the sinks it is inert in, and the two must PARTITION the sink set exactly: a sink in neither list is one nobody considered, and that must not look like a safe one. No payload is dangerous everywhere or nowhere. A NUL is filed as a WRITE THAT CANNOT HAPPEN, because PostgreSQL refuses it -- the upload succeeds and the row does not. THE SIZE OF A METADATA FIELD IS NOT BOUNDED BY THE SIZE OF THE FILE: XMP is XML inside an image, and a 2 kB JPEG can carry two thousand levels of nesting. The NUL is built with an escape and the scan checks this cell's own files for raw ones, because a literal NUL makes a file binary to grep. 11 payloads, 6/6 classes, 8/8 fields, 8/8 sinks. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/metadata-fixtures-scan.mjs"
      }
    },
    "migration-paths-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.b. The migration paths, the states they start from, and the drift nothing looks for. THE RULE: A MIGRATION PATH IS A MECHANISM PLUS A STARTING STATE. Four paths: CI's migrate deploy from empty (ordered, recorded); production's migrate diff from a live database (reads none of the 35 files, writes no history); database.yml's drift check over twelve libs/<domain>/database schemas; and the BFF's 24 CREATE TABLE IF NOT EXISTS + 9 ADD COLUMN IF NOT EXISTS on every connect. Only ONE of the three named starting states -- empty, prior supported version, production-like snapshot -- is exercised by anything. MEASURED LIVE: applying all 35 migrations to an empty PostgreSQL 16.14 database and diffing against schema.prisma exits 2 with 73 statements over 17 of 147 tables, 25 SET DATA TYPE, two foreign keys dropped and never put back, and one CREATE TABLE for v1_cross_cutting_gold_set_entry -- a model the generated client has a delegate for and no migration creates. The drift check that would catch it globs libs/<domain>/database and V1 is at libs/oshun/persistence. All three migrate-diff invocations pass flags the pinned Prisma 7 removed; database.yml reports the resulting argument error as \"Schema drift detected\", naming a defect it was never able to test for. The scan re-derives every number and measures the drift against a real server: NO SERVER IS EXIT 1. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/migration-paths-scan.mjs"
      }
    },
    "navigation-announcements-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.5.e. The seven navigation facts and the several mechanisms each one has. THE RULE: THE SAME FACT HAS A DIFFERENT MECHANISM IN EVERY PATTERN, AND A REGISTER THAT LOOKS FOR ONE OF THEM REPORTS THE OTHERS AS ABSENT. Where am I in this list is aria-setsize/posinset in a listbox or tree, aria-rowcount/rowindex in a grid, and a live region stating the visible range in a plain scrolling list -- ALL THREE CORRECT. This cell was one grep from a false finding: aria-setsize appears in six files and none of them virtualizes, which reads as every virtualized surface being silent until you look. Of three real virtualized surfaces, TWO answer position BY TWO DIFFERENT MECHANISMS -- VirtualList with an srOnly region saying Showing items N to M of TOTAL, DataTable with rowcount as the TOTAL and rowindex ABSOLUTE -- and the compare matrix answers by none. AND overscan IS NOT A VIRTUALIZATION MARKER: seven files match it, three virtualize, two are non-JSX helpers, and two are other trades -- a cinematography workspace's BROADCAST overscan safety and a drone panel's FRUSTUM overscan cushion. ONE OF THE SEVEN IS THE FRAMEWORK'S AND THE ESTATE'S ONLY INTERACTION WITH IT IS AVOIDING IT: Next renders div role=alert id=__next-route-announcer__ and speaks the new page's title on every client navigation, and the estate's only two mentions are comments explaining that a locator had to be scoped to p[role=alert] so as not to collide with it. AND overlay.tsx EXPORTS A CORRECT Popover AND ModalDialog AND NOTHING THAT SHIPS USES EITHER -- the popover reads document.activeElement at OPEN time and restores only if the saved element isConnected, because focus() on a detached element does nothing and says nothing about it; the dialog uses showModal() so the inertness is the platform's. Eight call sites, all specs and stories, zero shipping, against 54 files that hand-roll role=dialog and five that restore focus at all. This scan re-counts every mechanism from the products with prose and non-shipping files excluded, decides virtualization by what a file DOES, and re-reads both invariants verbatim -- which is how it caught the register quoting one without its backticks. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/navigation-announcements-scan.mjs"
      }
    },
    "negative-corpus-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.b. THE RULE: A NEGATIVE CORPUS STORED AS OBJECTS CANNOT HOLD HALF THE CASES IT NAMES. {\"kind\":\"command\",\"kind\":\"event\"} parses to ONE key, last-wins, before any parser runs -- so a corpus entry written as an object has had the defect removed before it reached disk. Same for precision above 2^53, -0, NaN, a leading BOM, and escaped key forms. 5 of the 13 categories are text-only and 7 of the 18 cases do not survive object storage. The corpus is therefore JSON Lines holding the envelope as a STRING, and the scan PROVES the format matters: it writes the corpus, reads it back byte-identical, then stores the same cases as objects and requires exactly 7 to have changed. FINDINGS: the duplicate TENANT is accepted with the last winning; the duplicate KIND silently re-routes to another parser before validation; a large integer is accepted with a different value than was sent; an escaped lone surrogate is accepted. __proto__ arrives as an own key and { ...parsed } keeps it while Object.assign({}, parsed) drops it AND changes the prototype. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/negative-corpus-scan.mjs"
      }
    },
    "ordering-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.c. THE RULE: ORDER IS A FACT ABOUT A SEQUENCE, AND A DEPENDENCY IS A FACT ABOUT TWO. inbox.ts's decideOrdering is complete and well argued for what it covers -- five dispositions and the note that carries the design: 'A GAP IS NOT A LOSS UNTIL IT IS OLD. Position 5 arriving with 4 unseen is almost always 4 still in flight, so 5 is held; treating the gap as a loss immediately turns every reordering into an incident.' Four of this cell's seven items are answered by it: a sequence gap is hold-for-gap, a late predecessor is the same thing named from the other end, a reordered INDEPENDENT event is apply-out-of-order when its kind declares commutes WITH A REASON (the estate requires the reason, because 'an unexplained true is what somebody set to stop the queue filling up'), and a stale version is ignore-superseded. MEASURED: OrderingRequest has SEVEN fields and every one is about ONE SUBJECT'S ONE SEQUENCE. Called with a dependent event that is position 1 on its own subject and whose predecessor lives on another, it returns `apply` -- and it is RIGHT, because on its own sequence it IS the next position and no field could name the other subject. FOURTH TIME THIS SECTION HAS MET THIS SHAPE (S11.9.b duplicate keys, S11.9.c relationships, S11.10.c collisions), so it is a shape. SHIPPED: Dependency, AppliedThroughBySubject, and decideWithDependencies which asks the ESTATE'S question first and the cross-sequence one second -- deliberately, because a dependency does NOT override a gap: an event whose own predecessor is missing holds for that regardless, and a superseded event stays superseded. The dependency check only ever turns an apply into a hold. Unmet dependencies are reported even when the within-sequence answer already holds, because the two release at different moments and a consumer knowing only the first would release too early. 8 fixtures, 7/7 hazards, 6/6 dispositions against the estate's 5, and THREE decided differently once a second sequence is in scope -- the dependent event, the replayed tombstone and the partition reorder, all three of which the estate answers `apply`. A fixture with a SATISFIED dependency is the positive control, without which a decider that held everything carrying a dependency would look correct. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/ordering-fixtures-scan.mjs"
      }
    },
    "outbox-atomicity": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/outbox-atomicity.mjs"
      }
    },
    "outbox-dispatch": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/outbox-dispatch.mjs"
      }
    },
    "partial-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.d. THE RULE: A PARTIAL FACT MUST BE ROUNDED TO A WHOLE ONE IN EITHER DIRECTION, AND BOTH DIRECTIONS ARE WRONG. The estate is careful about WHOLLY absent facts and this credits it: costOf throws on a missing price ('a missing price is a refusal, not a zero') and totalCost throws on a null usage ('a partial sum wearing a total's clothes'). What has no representation is a fact that arrived HALF REPORTED. MEASURED: Usage is two REQUIRED numbers with no nulls, so a provider that reports its input count and dies before its output count -- what a cut stream looks like -- has two encodings and both destroy information. outputTokens: 0 prices at 0.003, which is EXACTLY what a call that genuinely produced no output costs; usage: null makes totalCost throw and discards the input count that DID arrive. The honest answer is neither: at least 0.003, upper bound unknown. SHIPPED: PartialUsage with nullable counters and costRange returning a floor and a ceiling that may be ABSENT, with `measured` separate from the bounds so a dashboard can add up what it knows and say how much of the total is a floor. SECOND: createScriptedProvider writes `safety: step.safety ?? 'allowed'`, so A PROVIDER THAT SAID NOTHING ABOUT SAFETY IS RECORDED AS HAVING ALLOWED THE CONTENT -- the default asserts the answer most likely to be acted on, and SAFETY_VERDICTS has no fourth value. readSafety adds not-reported and permitsUse refuses it. THIRD: an inconsistent status is not a bad value -- no single field can be inconsistent with itself -- it is FOUR CHANNELS DISAGREEING (transport, body, finish-reason, stream-terminator), and the only way to see it is to read them all and keep the disagreement. A FOURTH CHANNEL VERDICT THE CORPUS FOUND BY BEING WRONG: finishReason 'length' was first filed as a FAILURE, so every truncated-but-successful response came back inconsistent -- while the fixture's own prose said it dissents about COMPLETENESS rather than about success. says-it-was-cut-short is that distinction, and consistency is now a question about success while incompleteness is a second question. 9 fixtures, 8/8 aspects, 4/4 channels, 4/4 verdicts; 5 disagree, 2 incomplete, 5 carry no safety verdict, 5 unpriceable with 0.0105 the estate would report as measured. THREE FAULT KINDS THAT COULD NEVER FIRE became swept invariants over 25 usages, with a positive control -- the same defect and fix as S11.11.a and .b. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/partial-fixtures-scan.mjs"
      }
    },
    "path-pairs-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.c. THE RULE: A HAZARD THAT NEEDS TWO INPUTS CANNOT LIVE IN A CORPUS OF ONE -- the third time this section has met that shape, after a corpus of objects that cannot hold a duplicate key and a corpus of lone manifests that cannot disagree with anything. The estate already had 27 single-path vectors covering 9 of the cell's 10 categories, including a real script-mixing check for confusables. THE ONE GAP WAS LENGTH: A CORPUS OF HOSTILE CHARACTERS HAS NO ENTRY FOR 'TOO MANY ORDINARY ONES', and the two vectors added here hold nothing wrong at all -- 300 ordinary letters and 40 ordinary components -- against checkers that already fired and had never been given a case; the corpus's longest path was 32 characters. THE PAIRWISE HALF: measured against the estate's three destinations, body.json/body.json. collides on NTFS alone, README.md/readme.md on NTFS and APFS, and NFC/NFD cafe on APFS alone -- and NO pair is dangerous everywhere, which is the control, because one that were would belong in the single-path corpus. readPair returns BOTH lists so 'harmless everywhere' and 'never tested' cannot look alike. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/path-pairs-scan.mjs"
      }
    },
    "plan-capture-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.g. THE RULE: A PLAN TAKEN WITH SEQUENTIAL SCANS DISABLED CANNOT REPORT A SEQUENTIAL SCAN -- AND WHETHER THAT IS COSTING ANYTHING TODAY IS A SEPARATE QUESTION THAT HAS TO BE MEASURED. The estate's validate-explain-checks.ts derives 294 EXPLAIN checks over 98 tables from 99 contracts and runs them LIVE in CI -- and issues SET enable_seqscan = off and SET enable_sort = off first, with no comment. Since the check asserts the required INDEX NAME is in the plan, a query that would sequentially scan in production is forced onto an index and passes. MEASURED: running all three query patterns against a freshly migrated database with the planner left alone produces ZERO sequential scans and the plans are IDENTICAL either way -- so the narrowing is real and currently costs nothing, which refuted the assumption I started from. Both numbers are recorded and the scan fails if they ever diverge, in either direction. 1 of 4 captures is taken where it runs: slow queries are configured in the RDS module and not in the deployed compose; the lock panel plots a Prometheus metric and the deployed estate runs no exporter; and schema readiness has nothing to compare against because migrate diff never writes a _prisma_migrations row. NO SERVER IS EXIT 1. Ten negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/plan-capture-scan.mjs"
      }
    },
    "plan-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.12.d. Runs the SHIPPED plan contract (`planFaults`, `planCoverageFaults`) against the SHIPPED plans in `docs/runbooks/v1-game-day-plan.md`, and runs both against the estate. The contract grades a plan's SHAPE — a reversal that also runs on abort, a presentation the scenario's impairment can produce, an abort somebody named can call — and cannot see whether the control it grades EXISTS. So the scan adds three bindings the contract has no seam for: every control id a plan names is implemented by `scripts/operations/v1-fault-control.mjs` and claims the presentation the driver MEASURED; every dependency a control targets maps to a service in `infra/hetzner/docker-compose.yml` (the DEPLOYED compose, not `docker/docker-compose.yml`, which describes a different estate and is what the S10.12.a register cites); and every scenario declared unrehearsable is re-checked against that compose, so the day somebody deploys a signing service the declaration is false and this says so. Twelve negative controls mutate the REAL statement, each first asserting the unmutated statement does not already carry the finding, and it refuses to report if any goes undetected.",
        "command": "npx tsx tools/plan-scan.mjs"
      }
    },
    "probe-controls": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/probe-controls.mjs"
      }
    },
    "production-scan": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/production-scan.mjs"
      }
    },
    "provider-adapter-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.d. A scripted provider -- chunks, results, usage, cost, safety, errors, delays, cancellation, and the outcome nobody can observe -- with exact request capture. THE RULE: AN UNKNOWN OUTCOME IS A THIRD RESULT, NOT AN ERROR. A provider call can succeed, fail visibly, or have the connection drop AFTER the request was accepted and before the answer arrived -- and that third case is neither: the work may have happened, been billed and been recorded upstream, and this side cannot tell. A double that models it as an error teaches every consumer to treat it as it-did-not-happen, and the consumer then retries a generation that already completed, which is the bug the case exists to find. WHAT THE ESTATE ALREADY HAS AND WHERE IT STOPS: libs/iris/agents/core declares AgenticProvider with complete(request, signal?: AbortSignal), so CANCELLATION IS ALREADY IN THE CONTRACT and the assistant factory takes an injectable env documented as such -- but its error taxonomy is PROVIDER_ERROR, UNKNOWN_TOOL, DUPLICATE_TOOL, INVALID_REQUEST and NONE OF THEM IS THE AMBIGUOUS OUTCOME, so a dropped connection arrives as a plain provider error and reads as safe to retry; and Promise<AgenticCompletion> is all-or-nothing, with no way to say four chunks arrived and then the connection died, so the partial output somebody may already have shown a user is not in the result at all. A COST IS A MEASUREMENT TIMES A PRICE AND A MISSING PRICE IS A REFUSAL: costOf throws rather than returning zero, because a cost of zero is a number a dashboard will happily add up and the sum of a hundred unpriced calls is a confident nought; totalCost refuses a call with no usage rather than skipping it, because a partial sum wears a total's clothes; and an unknown outcome reports no usage BY CONSTRUCTION, so it cannot be priced. EXACT REQUEST CAPTURE MEANS EXACT -- the request is recorded unmodified and undefaulted, including the field somebody added by accident and the system prompt that grew a trailing newline. DELAYS ARE ADVANCED ON S11.7.b's CLOCK rather than slept, so a 30-second provider is a case worth testing and not worth waiting for. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/provider-adapter-scan.mjs"
      }
    },
    "publish-saga": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/publish-saga.mjs"
      }
    },
    "quarantine-blast-radius": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/quarantine-blast-radius.mjs"
      }
    },
    "query-plans": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/query-plans.mjs"
      }
    },
    "queue-adapter-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.e. A scripted queue -- delivery, order, duplicates, leases, heartbeats, retries, cancellation, dead-letters and a worker that dies. THE RULE: A LEASE IS A CLAIM WITH AN EXPIRY, AND A QUEUE CANNOT TELL A DEAD WORKER FROM A SLOW ONE. Everything difficult follows from that: when a lease runs out the queue does not know whether the worker crashed, lost its network or is simply slower than somebody guessed, so it REDELIVERS, and now two workers may hold the same message. That is at-least-once delivery, it is not a defect, and a double that cannot produce it cannot test the only part of the consumer that matters -- so expireLeases hands the message to whoever asks next with the SAME id and an incremented attempt, and says nothing to the worker that had it. THE SECOND, AND IT IS THE ONE THAT BITES: A DEAD-LETTER POLICY COUNTS DELIVERIES, NOT FAILURES. A message whose worker dies five times was never nacked once -- nobody reported anything -- so a policy keyed on failures never fires and the message circulates for ever while every dashboard shows zero errors. maxAttempts is therefore compared against the DELIVERY count, and the scan drives that sequence end to end: three deliveries, ZERO rejections, one dead-letter. THE THIRD: A HEARTBEAT EXTENDS A CLAIM AND DOES NOT DISCHARGE ONE, and it is capped by maxLeaseTotalMs measured from when the claim was granted -- without the cap, a worker that heartbeats for ever holds a message hostage and the only difference between it and a careful one is patience. AND ORDER IS PER PARTITION, NEVER GLOBAL: a partition with a message in flight offers nothing, so its order holds across a redelivery, while different partitions interleave -- a consumer that assumed global order sees a different sequence on the second run, which the scan's second sequence produces. Time is S11.7.b's clock, so a lease that expires in real seconds is a test that takes none. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/queue-adapter-scan.mjs"
      }
    },
    "queue-invariants-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.f. THE RULE: AN INVARIANT SUITE OVER FIXTURES CHECKS THE DECISIONS, NOT THE SYSTEM -- AND SAYING WHICH IS WHICH IS THE WHOLE VALUE OF IT. The cell asks for nine assertions and this adds a tenth, decision-agreement, because it is the structural property the whole of S11.12 rests on. S11.12.a-.e built five corpora of FAULTS, and a fault fixture is a DESCRIPTION of a situation rather than a RUN of a system -- so FOUR of the ten are evaluable here and SIX are not, and the difference is not a matter of effort. A fixture saying 'the lease expired after the effect and before the checkpoint' carries no effect that could be applied twice, no audit row and no money. REPORTING THAT IS THE POINT: this reuses S11.9.e's four verdicts -- held, violated, unobservable, vacuous -- because an invariant that could not be evaluated must not look like one that was and passed, and a suite of ten greens over four evaluable properties is the shape of a check nobody has ever seen fail. OBSERVABLE: monotonic-state (5 cases -- every stale fencing token refused, every terminal job answered as terminal), preserved-checkpoint (9 -- every skipped effect silent and every repeat loud), no-false-success (24 across three corpora), decision-agreement (29 -- every added decision asked the estate FIRST and never contradicted it). UNOBSERVABLE, each with what it would need: idempotent authoritative and external effects, monotonic progress, correct result, correct audit, correct cost. 67 cases examined in total, recomputed by the scan FROM THE CORPORA rather than read from the results. ELEVENTH unreachable fault kind removed under the rule S11.12.e stated. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/queue-invariants-scan.mjs"
      }
    },
    "reclamation-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/reclamation-race.mjs"
      }
    },
    "recovery-journey-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.g. THE RULE: A REPLAY IS AUTHORIZED BY A CAPABILITY AND MADE SAFE BY A RECONCILIATION, AND ONLY THE FIRST IS CHECKED. Both halves exist in the estate, in different files, and nothing joins them. THE RECONCILIATION HALF IS EXCELLENT: mayRetryAfterUnknown's table is the best writing in the library on the subject -- 'reconcile and INDETERMINATE -> refuse. This is the cell people fill in with retry because the alternative needs a person, and it is the cell that produces the duplicate charge' -- and ReconciliationProbe is keyed by the IDEMPOTENCY KEY rather than a local id, 'because after a connection loss the local id may never have been written'. THE AUTHORIZATION HALF IS GOOD TOO: every dead-letter action is gated on a capability and refuses not-authorized, already-resolved, inputs-purged, inputs-moved and nothing-has-changed. AND THE REPLAY ITSELF IS CAREFUL, which NARROWS this cell's finding: planDeadLetterReplay PRESERVES THE JOB IDENTITY AND THE IDEMPOTENCY KEY, because 'minting a new job id forces one of two wrong moves', so a replay whose first attempt COMPLETED is caught by the idempotency record. WHAT REMAINS, MEASURED: planDeadLetterReplay takes no probe and consults no reconciliation; DeadLetter carries failureKind (which can be unknown-outcome) and NO record of whether the effect landed; and mayRetryAfterUnknown is called ZERO times from jobs.ts. The gap is precisely the unknown outcome -- the one place the key does not help, because an attempt that died between applying its effect and writing its record leaves no record for the key to find, which is S11.12.b's finding arriving here. SHIPPED: RECOVERY_STEPS asking authorization, then record state, then reconciliation -- in that order, because telling an unauthorized operator the effect already landed is itself a disclosure, and a probe is a request to somebody else. 10 fixtures, 3/3 steps, 4/4 outcomes, 3/3 reconciliation results; 3 refused by the estate alone, 3 allowed by it and stopped here, 0 duplicates. TRAPS, three in one scan and all the same kind: a guessed function name matched nothing and the check PASSED against an empty string; a non-greedy match to the first newline-brace stopped at the INLINE PARAMETER TYPE's brace and read 239 characters of signature; and a slice to the next export ran INTO the following section's banner comment, whose word 'reconciling' reversed the answer. A boundary too late is as wrong as one too early. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/recovery-journey-scan.mjs"
      }
    },
    "refusal-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.e. THE RULE: THE DETECTOR IS KEYED ON WHO REFUSED, AND WORKING AROUND A REFUSAL IS THE SAME ACT WHOEVER MADE IT. provider-lifecycle.ts has the best writing in this library on the subject -- 'an automatic re-ask with different wording after a safety refusal is not error handling: it is the system looking for a phrasing that gets the answer that was declined, run at machine speed with nobody in the sequence' -- and real machinery under it: AttemptRecord carries a promptDigest so the comparison is possible, refusalFaults reports four kinds, FAULT_TABLE marks the three refusal classes retryability no. TWO MEASUREMENTS THAT FIT TOGETHER BADLY. FIRST: all eleven PROVIDER_FAULT_CLASSES are things a PROVIDER does, so a refusal made by THIS SYSTEM -- an entitlement check, a withdrawn consent, a rights holder's terms, a local policy engine -- leaves faultClass null and refusalFaults SKIPS IT ON ITS FIRST LINE. Verified by calling it with the identical attempt pair twice: a provider refusal then a reworded prompt gives ['prompt-changed-after-a-refusal'], and a LOCAL refusal then the same rewording gives []. The same act, and the second is arguably worse because it is the refusal this system is answerable for. SECOND: humanInitiated is the one exemption the rule grants -- 'a person who reads a refusal and edits their request is doing something the system should support; the fault is the loop that does it without them' -- and it is declared, READ ONCE, and SET BY NOTHING. So the only legitimate way past a refusal has no producer and the forbidden way is undetectable whenever the refusal was local: what is reachable is exactly the thing the rule was written to stop. SHIPPED: REFUSAL_ORIGINS, LOCAL_REFUSAL_CLASSES (deliberately NOT a subset of ProviderFaultClass -- adding them would say a provider can refuse on our entitlement rules), an origin-blind worksAround that keeps the estate's humanInitiated exemption exactly, and APPEAL_ROUTES with per-route producers. 7 fixtures: origin-blind catches 4 and the estate catches 1, so THREE WORKAROUNDS ARE INVISIBLE TODAY, and 3 of 3 appeal routes have no producer. Those three faults are reported on every run and they ARE the finding; the corpus itself is clean. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/refusal-fixtures-scan.mjs"
      }
    },
    "release-lock-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/release-lock-race.mjs"
      }
    },
    "remote-payloads-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.d. THE RULE: A POLYGLOT IS A FACT ABOUT A SET, AND THE DECIDER TAKES A SCALAR. sniffMediaType returns FOUR facts (matches, leading, polyglot, executable) and correctly flags the canonical GIF+zip polyglot via a scanning trailing-zip signature at offset -1. decideContent correctly checks the SNIFFED type and quarantines a mismatch. AND THEY CANNOT BE JOINED WITHOUT LOSS: ResponseObservation carries sniffedMediaType as one string. Measured across all three collapses against a policy accepting image/gif: leading -> ACCEPTED, first-match -> refused, trust-declared -> ACCEPTED, and ALL THREE discard the polyglot flag; none can quarantine. sniffedMediaType has ZERO producers and decideContent ZERO callers outside a spec, so the collapse has never been written down. THREE OF THE SIX DEFECT CLASSES ARE NOT ABOUT THE PAYLOAD: ambiguous, polyglot and version-skew are properties of a relationship between the bytes and whoever reads them. 11 payloads over 10/10 kinds and 6/6 defect classes. The scan re-derives the signature table and re-runs the collapse experiment, failing in BOTH directions. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/remote-payloads-scan.mjs"
      }
    },
    "replay-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.12.c. Runs the SHIPPED replay contract (`replayFaults` over `REPLAY_SUBJECTS`) against the SHIPPED procedures in `docs/runbooks/v1-reconciliation-and-replay.md`, and runs both against the repository. The contract grades a procedure's SHAPE — bounded window, lease fence, an external authority for an effect the outside world saw — and cannot see whether the store it names is a real store, whether a subject declared absent is still absent, or whether the entry point its verification depends on still exists. So the scan adds the estate binding: every named table exists in the migration root it declares (which caught the estate's one real fencing token being in the aphrodite schema rather than V1's), every snapshot store key exists as a literal in production source, every entry point exists and is named in the prose, and every declared absence is re-checked against the whole V1 schema so the day V1 grows an outbox the document is wrong and this says so. Two declared gaps fail in both directions. Nine negative controls mutate the REAL statement and it exits 2 rather than reporting if any goes undetected.",
        "command": "npx tsx tools/replay-scan.mjs"
      }
    },
    "restore-consistency-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "Run through tsx rather than node: the harness imports both the repaired in-tree control (`scripts/operations/v1-restore-reconcile.mjs`) and the kit module's TypeScript source. Sixteen conditions under which a restore that brought back nothing is indistinguishable from one that brought back everything, with a legacy arm reproducing the pre-S10.11 reconciler so the scan can be seen to detect something rather than only ever printing clean. Exits non-zero if the legacy arm ever scores as well as the kit arm.",
        "command": "npx tsx tools/restore-consistency-scan.mjs"
      }
    },
    "restore-transaction": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/restore-transaction.mjs"
      }
    },
    "retry-exhaustion-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.12.d. TWO RULES, AND THEY ARE THE SAME MISSING INPUT SEEN TWICE: HISTORY. THE FIRST: A CLASSIFICATION THAT DOES NOT COUNT CANNOT RECLASSIFY. classifyJobFailure takes TWO arguments -- a failure and an effect delivery -- and there is no third that could carry a count, so dependency-unavailable is after-backoff on attempt 1 and on attempt 50 and this cell's first two items, transient repeats and permanent reclassification, are the SAME ANSWER from it. That is not a defect: a classifier over one failure cannot count, and one that guessed from a single failure would be guessing. What is missing is a caller that keeps the count. THE SECOND: `defer` PROTECTS THE QUEUE FROM ITS OWN JOBS AND NOTHING PROTECTS A DEPENDENCY FROM THE QUEUE. JobRetryContext carries queueRunning and queueConcurrency -- the QUEUE'S OWN capacity -- and nothing about the health of what the job calls, so five hundred jobs failing on one broken dependency each back off and each return. The estate's own note explains the mechanism and the same sentence applies with none of the words changed: 'a deferred job must not burn an attempt or reserve budget for one. Folding capacity into retry is how a busy hour quietly consumes every job's attempt allowance and leaves a queue full of jobs that are out of attempts and were never actually run.' SHIPPED: FailureHistory, reclassify (which keeps the classifier's answer as `classified` and reports the DIFFERENCE, hardens only after-backoff and only in one direction, and files a repeated failure with the SAME payload as after-change rather than after-remediation because nobody fixes the dependency, somebody changes the input), and decideAgainstDependency reusing capability-state.ts's three circuit positions -- where a defer never burns an attempt and the half-open PROBE does, because it is a real request that really ran. The estate's best rule is kept intact: an unknown outcome with an at-most-once effect is after-remediation AND is not deferred by an open circuit, because the question is not whether the dependency is well, it is whether the effect happened. 11 fixtures, 8/8 hazards, 3/3 reclassifications, 3 changed by history, 2 deferred for the dependency, 4 past a ceiling. Two more fault kinds that could never fire became swept invariants over 192 combinations with positive controls. TRAP: the scan's check for the estate's note found nothing until it flattened the wrapped block comment -- a zero from a query nobody wrap-proofed is not a measurement. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/retry-exhaustion-fixtures-scan.mjs"
      }
    },
    "review-dimensions-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.f. The eight things a baseline review is supposed to catch, and the two a screenshot can actually decide. THE RULE: A PIXEL DIFF NOTICES A DIFFERENCE AND CANNOT NAME ITS KIND. TWO are a screenshot's own -- card and chrome drift, and a font or icon change, are differences in appearance with NO structural signature: same box, same roles, same geometry, different picture, and the estate's 74 baselines are exactly the right instrument. THREE are geometry -- overflow is scrollWidth greater than clientWidth, clipping is a box outside its container, overlap is two boxes intersecting -- each a DECISION that comes with the number that made it, which a diff image never has. The estate agrees: its visual-QA register carries an evidenceKind field and THE TWO CLAIMS IT MARKS AS LAYOUT ASSERTIONS ARE BOTH ABOUT HORIZONTAL SPILL, with a comment saying to use them only for viewport-fit claims whose primary evidence is measured geometry -- so the answer exists and is applied to one geometric dimension of three, while 397 suite files already touch a geometry API. TWO have a better instrument elsewhere in this estate and it is aimed elsewhere: contrast is axe's color-contrast rule, which S11.3.f measured as pointed at the primitive gallery, and focus is S11.4.a's, which measured one of seven focus claims established. AND ONE IS INVISIBLE TO A SCREENSHOT ENTIRELY: aria-pressed flipping changes NO pixel unless the styling depends on it, and a semantic state that no longer matches the visual one is exactly the defect worth catching -- so NO THRESHOLD, HOWEVER LOW, BRINGS IT INTO A PICTURE. What that means for the signature the cell asks for: a signed baseline matrix is a claim that somebody looked at these eight things, six of them are decided by an instrument other than the picture, and a signature over the pixels alone covers two. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/review-dimensions-scan.mjs"
      }
    },
    "revision-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/revision-race.mjs"
      }
    },
    "route-boundaries-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.e. Grades a boundary by its TERMS rather than by its rules: only the conjuncts a caller cannot set are the boundary. Two estate results, re-derived every run. shouldBypassStudioIsisBoundaryForE2E turns off the SS24.11 hard block over 87 AAA-only pages and names four conditions -- path, query, env var, and isLocalhostRequest, which reads request.nextUrl.hostname and is therefore derived from the Host header that next.config.mjs does not pin -- so exactly ONE of the four is a boundary. And apps/oshun/web/src/app/studio/generation/living-scene/page.tsx is in PUBLIC_PATHS, renders data-living-scene-route-entitlement-gate=route, and builds its whole access context from six x-oshun-* request headers that the proxy copies verbatim and never sets, strips or validates -- a self-declared gate with no uncontrolled term, while the same header name is production-gated one layer down in the BFF. The scan re-reads the bypass conjunction term by term, checks the proxy still touches no x-oshun header, checks the route is still public and consults no session, checks the BFF asymmetry still exists, and measures coverage: 88 of 503 mounted /studio/* routes are under the boundary prefix. Fails on drift; reports the estate. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-boundaries-scan.mjs"
      }
    },
    "route-collisions-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.d. Detects duplicate effective method/path/host, alias collisions and redirect cycles, over EFFECTIVE routes rather than paths. Its central claim is that /metis/upload has three rules and one runs: the release-scope gate at stage 2 claims every path under /metis while the domain is deferred, so metisUploadAliasResponse at stage 7 and the page beneath it are DORMANT -- they agree on /metis/byom today and nothing can find out if they stop, because no request reaches either. That rests on four facts re-derived every run: metis is still deferred, DEFERRED_DOMAIN_ROUTE_PREFIXES still contains the bare prefix that makes the gate claim /metis/..., the seven proxy stages still appear in the order the register places them, and both dormant rules still name the same target. Also re-derives the two-hop chain the proxy collapses on purpose (/news -> /domains/veritas -> /release-scope/veritas, emitted as one 307 because a 301 would bake a deferred URL into a browser cache) and recomputes the alias-collision set against the build manifest. Fails on drift; reports the estate. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-collisions-scan.mjs"
      }
    },
    "route-contract-gate": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/route-contract-gate.mjs"
      }
    },
    "route-discovery-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.b. Checks the extracted route discovery and normalization against the ONE other implementation of it in this repository -- the framework's. It walks the real 901-file apps/oshun/web/src/app tree and demands exact agreement with .next/app-path-routes-manifest.json in both directions over all 772 routes; nothing else here can settle whether the route-group deletion, catch-all arity, private-directory rule, metadata-file category and two reserved routes are right. That manifest is a gitignored build output, so the check SKIPS and says so when it is absent rather than passing quietly. Also re-derives the estate shape the module claims (1 route group, 3 optional catch-alls, 0 parallel slots), both ends of the Tara difference against the real directory and the real route map -- the two undeclared pages are the claim that rots, since adding them to the map would leave the register reporting a closed gap -- and the ancestor rule over the six Vite src/pages trees that look like route trees and are not. Fails on drift; reports each snapshot. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-discovery-scan.mjs"
      }
    },
    "route-integrity-inputs-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.a. Grades the route-integrity harness contract against the estate it describes. Its central claim is a NON-NESTING -- described, mounted, reachable and advertised are four independent predicates -- and the argument is three live surfaces, each re-derived every run: /domains/tara is a directory with children and no page.tsx that the [domainId] sibling routes anyway; /studio/isis holds 87 first-level segments each with a page module behind an EMPTY allow-list that isAaaOnlyRoute negates, so none of them renders; and studio.study removes a nav entry while route resolution stays aware of the path. Repair any one and the corresponding separation is gone. Also re-derives the five absences the register reports -- above all that parseRouteDescriptor has no production caller, since the day one appears four checks stop being unsupplied -- the ownership catch-all and the single-valued domains.json owner set the unowned verdict rests on, the 4-of-87 sample the reachability supply really covers, and that the Tara route-integrity spec still reads nothing but the source tree. EVERY quoted site is re-read verbatim in the file it cites, and an untracked producer has its own untrackedness checked instead. Fails on drift; reports the estate. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-integrity-inputs-scan.mjs"
      }
    },
    "route-metadata-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.f. Grades the eight metadata classes S11.1.f names (both compounds split) by HOW a route would come by a value, not by whether one exists. Its two measurements are recounted from apps/oshun/web/src/app every run: the eight classes are absent from every route, AND the metadata slot beside them is nearly full -- 651 of 720 pages export a metadata object carrying title, description, alternates, robots, openGraph, twitter and keywords, a crawler brief without exception. Either half alone reads differently, which is why both are checked. Also re-derives the CODEOWNERS catch-all that makes owner resolve for all 720 routes by DEFAULT, so unknown-owner is not a state this estate can be in and a resolution count is the wrong instrument; the six classes with no producer, failing the day a route declares one; and the single canonical of 614 that differs from its own path. Fails on drift; reports the estate. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-metadata-scan.mjs"
      }
    },
    "route-mounting-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.c. Compares what the source describes against what the framework mounts, on the real estate. Its central claim is a CLASSIFICATION: five patterns in apps/oshun/web answer for more than one path, three refuse an unrecognised input locally (a named validator plus notFound), one delegates the refusal to an upstream, and /workspace/[[...path]] refuses nothing -- so it is the one region where a deleted route cannot be detected as missing. Every part is re-derived: the notFound guard on each locally-bounded absorber, its absence on the unbounded one, that the workspace zone still holds zero static routes (the only reason the check means anything there), that no static route sits inside any dynamic pattern's zone, and the six of nineteen OSHUN_APP_LINK_PATHS claims that resolve to nothing -- recomputed from the build manifest rather than trusted. The deliberate missing-route test runs HERE against the real 772-route mounted set, not a fixture. Also pins the two guards that compare that register to a copy of itself. Fails on drift; reports the estate. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-mounting-scan.mjs"
      }
    },
    "route-suite-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.1.g. Prints what the whole of S11.1 was building: four checks by three domains, and for every cell that cannot run, the input class that blocks it -- ordered by how many cells each missing input would unblock, so a reader starts with the one that unblocks twelve rather than the one that unblocks one. Its report IS the deliverable. It guards three claims from the source: the two archetypes really carry the metadata the register says (seven descriptors, each stating an owning capability, contract version, lifecycle, audience set, host, scope binding and data classification, each built through parseRouteDescriptor under expectOk); the Tara route map still states five fields and none of those seven, so the asymmetry this cell rests on has not changed; and every diff entry names a file that exists, because a diff nobody can open is a report and this cell was asked for a diff. Also refuses two archetypes that share a route path, since two domains that agree are one fixture twice. Fails on drift; reports the matrix, including especially the cells that cannot run. Six negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/route-suite-scan.mjs"
      }
    },
    "router-vocabulary-scan": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/router-vocabulary-scan.mjs"
      }
    },
    "runbook-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.12.b. Runs the SHIPPED runbook contract against the SHIPPED documents: every `docs/runbooks/*.md` carrying the `<!-- oshun:runbook -->` marker publishes its structured statement as a fenced JSON block, and this grades it with `runbookFaults`, `missingRunbookSections` and `runbookCoverageFaults`. Until it existed those four were called only by `game-day.spec.ts` against hand-built fixtures, so every fault a real runbook can carry was unfalsifiable. Refuses an undeclared finding, a declared finding that stopped firing (a gap that closed while the document still describes it), a registered scenario with no runbook, two runbooks for one scenario, a silent section, and a dependency id the prose never mentions. Runs eight negative controls against the real statements first and exits 2 rather than reporting, if any control goes undetected.",
        "command": "npx tsx tools/runbook-scan.mjs"
      }
    },
    "scan-matrix-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.3.c. The matrix an accessibility scan is supposed to cover -- route, state, theme, density, viewport, locale -- against the line through it the estate actually scans. THE RULE: EVERY AXIS IS SETTABLE FROM A TEST AND FIVE OF THE SIX ARE NEVER SET. Counted over every accessibility-named spec in web and admin: zero set a theme, zero set a locale, zero set a density, zero carry the @mobile tag the Playwright config uses to reach the second viewport -- and the config's own comment says each spec runs on exactly one project. Nothing is out of reach: the theme and the locale are localStorage, the density is an attribute, the viewport is a project. The design tokens ship FOUR themes including two high-contrast ones and no scan runs under any but the default; the launch locales are EIGHT including two right-to-left, applyLocaleToDocument sets documentElement.dir from the locale, and no accessibility scan has ever run right-to-left. AND: A CELL IS COVERED BY A SCAN WHOSE COORDINATES ARE KNOWN, AND NO SCAN HERE RECORDS ITS OWN -- the sharpest line of it is that the web signoff suite scans / twice, once at load and once with the notifications drawer open, and the two records are byte-identical because a route is all either carries. AND: A CONSTANT YOU DID NOT CHOOSE IS A CONFOUND -- the web fixtures pin reducedMotion to reduce suite-wide for a good and documented reason, which fixes an axis at the value most users are not in, while the admin fixtures pin nothing, so the two suites scan opposite values of one condition and neither declares it. AND: ROWS ARE NOT CELLS -- the admin key-workspaces table is seventeen rows over TEN paths with /analytics the subject of seven, rows that differ only in which test id they wait for before scanning the whole document, and the scan is not narrowed to that element. THE REDUCTION: the full product of the declared values is thousands of scans, so the plan covers every axis value once and every INTERACTING PAIR once, with a named mechanism per pair and nothing else -- a pair with no mechanism is not in the plan. Eighteen negative controls, including one that confirms the state pairs close only because ONE route declares ONE overlay, which is what separates a weak plan from a missing input. Exits 2 if any control goes undetected.",
        "command": "npx tsx tools/scan-matrix-scan.mjs"
      }
    },
    "semantic-assertions-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.3.f. The index of assertions that have to be written by hand, and what each of them can actually settle. THE RULE: A CUSTOM SEMANTIC ASSERTION THAT READS THE DOM IS CHECKING THE INPUT, AND EVERY ONE OF THE ESTATE'S PRODUCT-LEVEL ASSERTIONS DOES -- 29 toHaveAttribute('aria-...') assertions, 50 role queries, and ZERO reads of the accessibility tree across every accessibility-named spec in web and admin. An aria-labelledby is what the author wrote and the accessible name is what the user agent computed; an aria-labelledby pointing at an element not in the document produces a widget with no name and the attribute assertion passes. One layer down the estate opens a CDP session, calls Accessibility.getFullAXTree, and carries a fault named property-written-in-the-dom-that-the-tree-does-not-carry -- exactly the case the twenty-nine cannot see by construction. AND: A CUSTOM ASSERTION IS NEEDED MOST WHERE AXE REPORTS SUCCESS. Of the three reasons a checker cannot prove something, only no-rule is visible; could-not-decide is axe's third outcome and 37 of the 62 running rules can return it, so part of this very index is published once per run and seven of eight sites throw it away; inapplicable-by-construction is the rule reporting the same word it uses for a page that could not have violated the criterion. AND: A CAVEAT IS NOT A PASS -- the fifty role queries compute a name in the test process rather than the browser and reach no relationship, so they are their own row; and no channel strictly settles a widget pattern, because the protocol carries neither aria-posinset nor aria-setsize, which is a limit of the instrument. AND: the estate's only product-level geometry calls use the channel that settles obstruction and measure a TOUCH TARGET, so the entry is filed under no subject rather than under the one its channel happens to match. Zero of four subjects settled at the product layer. Eleven negative controls, including one confirming that aiming the tree instrument at the products would settle one; exits 2 if any goes undetected.",
        "command": "npx tsx tools/semantic-assertions-scan.mjs"
      }
    },
    "shortcut-collisions-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.4.f. The seven branches the two products bind a key on, re-derived from their own conditions. THE RULE: A MODIFIER GUARD IS PART OF THE CHORD, AND TWO OF THE SHELL'S FOUR BRANCHES DO NOT WRITE ONE -- Alt+digit and Alt+A exclude ctrl, meta and shift; Alt+/ and bare Escape exclude nothing, and Ctrl+Alt is AltGr on Windows, which four of the eight launch locales hold to type @ and backslash and euro and tilde, and VoiceOver's own modifier on macOS, held before every VO command. AND THE SAME SHAPE ONE LEVEL DOWN: A GUARD PROTECTS THE BRANCH IT IS WRITTEN INSIDE -- the player's isInteractiveKeyboardTarget early return is inside its k/Space branch, so ArrowLeft and ArrowRight, five lines below it and outside it, scrub the audio while the caret is in a text field. The estate has exactly one text-target guard, it is correct, and it covers two of that handler's four keys. AND THE SHELL'S FOURTH BRANCH IS BARE Escape CALLING blur() ON document.activeElement, which is also how a user dismisses an IME candidate window -- S11.4.b measured that keydown as carrying isComposing true and keyCode 229, read by no product handler. This scan does not copy any of that: it cuts each branch out of its source by matching brackets, derives the required and excluded flags from the condition, derives the keys from the key comparisons (and the digit branch's five from the LENGTH of its own route array), and reads the text guard from the branch BODY. Three claim policies across three owners, 22 faults, 5 of 7 branches colliding, all four sources reached, and no remap path anywhere in either product. Fifteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/shortcut-collisions-scan.mjs"
      }
    },
    "shrinking-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.9.f. THE RULE: A SHRINK IS ONLY VALID IF THE SMALLER CASE FAILS FOR THE SAME REASON. Measured on the estate's own case: 548 bytes failing invalid-field shrinks under a 'does it still fail' predicate to TWO BYTES, {}, which fails as UNKNOWN-KIND -- a different defect reported with total confidence. Under a same-signature predicate it reaches 18 bytes and keeps invalid-field, refusing 3 candidates for drift. So shrink() takes a predicate returning a FAILURE SIGNATURE, not a boolean. A REPRODUCER IS A CLAIM SOMEBODY ELSE CAN RUN and four of its five fields are about the runner. A SHRINK CAN BE NO MORE PRECISE THAN THE FAILURE THE SUBJECT REPORTS: the 18-byte case has NO schemaVersion rather than a zero one, because the parser answers both identically, and a finer signature reaches the same text -- the fix is a subject that distinguishes. A PROMOTED FIXTURE THAT STOPS FAILING MUST SAY SO: replay returns no-longer-reproduces rather than passing. The scan minimizes all 13 failing cases (6170 bytes saved), emits the corpus, reads it back, replays every entry, and re-runs the two-predicate comparison. Seven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/shrinking-scan.mjs"
      }
    },
    "smoke": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/packed-consumer-smoke.mjs"
      }
    },
    "soft-binding-recovery": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/soft-binding-recovery.mjs"
      }
    },
    "state-baselines-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.d. The state baseline index -- four surfaces by eight states -- read out of the baselines' own filenames. THE RULE: A BASELINE SUITE PHOTOGRAPHS THE STATE THE PRODUCT IS IN WHEN NOTHING IS WRONG. The estate has 74 unique baselines and FIVE of them name a state: page-404-desktop, page-error-desktop, page-home-loading-desktop, page-loading-skeleton-desktop and page-explore-offline-mobile. The other sixty-nine are a surface at rest -- home, explore, library, activity, profile, each domain, each search-result kind, the assistant in two themes. Those are worth having, and they are also the state a regression is least likely to reach first, because the settled view is the one every developer already looks at. AND ONE OF THE FOUR SURFACES THE CELL NAMES HAS NO BASELINE AT ALL: shell has eleven, workspace two, inspector one, and STATUS NONE -- which the cell asks for because a status surface is where a degraded or conflicted system says so. AND IT IS AN INDEX RATHER THAN A COUNT BECAUSE THE MISSING STATES ARE THE DEAR ONES: loading, error and degraded are reachable with a route stub, which these specs already write; empty needs a deliberately empty fixture; CONFLICT NEEDS TWO WRITERS AND A VERSION THAT LOST; DESTRUCTIVE NEEDS AN IRREVERSIBLE ACT THAT MUST NOT HAPPEN; and a complex visualisation is only complex with enough data to be. Every state missing from the index needs a built fixture and every state present is one a route stub can produce -- a fact about the cost of the capture rather than about anybody's diligence. This scan rebuilds the index from the committed filenames, because A FILENAME IS THE ONLY PLACE A CAPTURE SAYS WHAT IT CAPTURED: a test title can say loading state and photograph a settled page, and the filename is what the comparison keys on. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/state-baselines-scan.mjs"
      }
    },
    "step-up-race": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/step-up-race.mjs"
      }
    },
    "storage-adapter-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.f. A scripted object store -- bytes, versions, hashes, ranges, latency, partial reads, corruption, eventual consistency, permissions and failure. THE RULE: A WRITE THAT SUCCEEDED IS NOT A WRITE YOU CAN READ. An eventually consistent store answers a put with a success and then, for a while, answers a get with the PREVIOUS version, or with nothing at all if the object is new -- and every consumer that writes and immediately reads back is either correct about that or has a bug that appears under load and nowhere else. setConsistency makes the window explicit and advanceReplication closes it, so a test can put a consumer inside it on purpose. THE SECOND: A STORE THAT CANNOT LIE CANNOT TEST A CHECKSUM. Corruption is the failure a hash exists for, and a double that always returns what it was given lets a consumer skip verification for ever and pass every test -- so corrupt() returns ALTERED BYTES WITH THE ORIGINAL HASH, which is exactly what a silently damaged object looks like and exactly what a consumer comparing them will catch. THE THIRD: PARTIAL AND RANGE ARE DIFFERENT THINGS AND ONLY ONE IS AN ERROR. A range read is the caller asking for bytes 100-199 and getting them, with its own arithmetic to get wrong; a partial read is the caller asking for the whole object and the connection ending early, so the bytes are a PREFIX OF THE TRUTH and nothing says so -- a double that modelled them the same way would teach a consumer to treat a truncated body as a successful short read, which is how a half-written file gets committed. THE HASH IS FNV-1a OVER 64 BITS AND IS NOT CRYPTOGRAPHIC: it is written out so the values are pinned to this file, it detects the accidental corruption a store produces, and it detects nothing an adversary produces -- said in the module and checked by the scan, because a test-double digest quietly used as an integrity guarantee is a defect with no symptom. Latency is advanced on S11.7.b's clock. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/storage-adapter-scan.mjs"
      }
    },
    "subject-data-map-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.b. Grades `ESTATE_DATA_MAP` -- 24 locations covering every one of the fan-out's 16 deletion services, all six state classes the off-box backup captures, and the archive itself -- against the four lists that already enumerate this estate, each READ from the file that owns it: the deletion service ids, the state classes (which live in a jq filter inside a shell script and so are invisible to any import), the export scopes, and the contracts library's 28 artifact scopes. Re-derives each service's eraser factory from `buildBffDeletionErasers` and fails if the map describes it wrongly or claims a deletion for a store built through `createNoSubjectDataEraser`; binds the archive's window to the backup script's own RETENTION_DAYS. Fails on drift and malformation; REPORTS coverage findings without failing, because those are the estate's gaps rather than the map's. Fourteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-data-map-scan.mjs"
      }
    },
    "subject-erasure-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.e. Grades the erasure register -- the two fence conventions this estate keeps (35 stores retain the account id, 23 a digest, clean split), the consent-withdrawal cascade, the four rehydration sources, and the run an account_full deletion really is -- against the stores that erase, the buses that replay and the compose file that decides what exists. The headline is a claim about a SHAPE rather than a symbol, so the scan reads the fence RESTORE assignments themselves and fails the day one becomes a union: a fence is a field of the same snapshot document as the rows, and every restore replaces it, so a restore from before an erasure returns the data and un-remembers the deletion. Four other claims are ABSENCES (nothing reads storageBlockedAt, nothing advances a cascade job, no search index is deployed, the deletion state store has no eraser of its own) and each is searched for. Fails on drift; reports the estate. Fifteen negative controls -- one of which already corrected a named example in this register -- and it exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-erasure-scan.mjs"
      }
    },
    "subject-export-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.d. Grades the export register -- the twenty artifact scopes a customer export can resolve with their categories, formats and collectors; the bundle a run really produces; the eleven things S10.13.d asks an export to be; and the four stores whose rows are about two people -- against the surface that assembles and serves a bundle. Half the register's claims are ABSENCES (nothing encrypts, no purpose anywhere, no csv renderer, no query filters by tenant) so each is searched for rather than remembered, and the headline is a COMPARISON: `redactSubjectDurably` pseudonymises only the subject's own field while `getExportRecord` a hundred lines up copies the entry whole, so both bodies are read out of the same source. Then RUNS the shipped contract over the transcribed bundle and reports what it finds. Fails on drift; reports the estate's gaps without failing. Twenty-two negative controls -- one of which already falsified a claim in this register -- and it exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-export-scan.mjs"
      }
    },
    "subject-lifecycle-matrix-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.h. Grades the lifecycle matrix -- the eight scenarios S10.13.h names, each split across the paths it can arrive on, with reachability as an axis SEPARATE FROM and prior to exercise -- against the mechanisms it names and the tests it cites. Both of its interesting values are ABSENCES, so each is searched for: every cited test file is opened (a matrix naming a test nobody can open is the defect it exists to prevent), and the two unreachability claims are checked against the source -- `legalHolds` has no mutator, no action route and no released hold outside a seed literal, so nobody can place or lift the one instrument that genuinely blocks a deletion; and no escalation exists anywhere in the subject-request path, so there is nothing to escalate from. Fails on drift; reports the estate. Eleven negative controls -- one of which caught a search that was reading a generated Prisma client -- and it exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-lifecycle-matrix-scan.mjs"
      }
    },
    "subject-orchestration-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.c. Grades `ESTATE_ORCHESTRATIONS` -- the four things this repository really runs when a subject asks: the admin deletion workflow (eight named stages and nothing that executes one), the customer deletion fan-out, the admin DSAR erasure cascade and the customer export -- against the sources that run them. Re-derives the stage list, the writers of a stage transition (a route, its store and an operator's form; a fourth would be an executor), the caller set of the only sequential fan-out, the ORDER of the cascade and the hold check inside `executeDsarErasureForSubject` and the arguments the latter is not given, both scope filters and what each drops, and the accepted archive immutability modes that make a `backup_purge` stage unperformable. Then RUNS the shipped contract over the plan an `account_full` deletion really is and reports what it finds, including the eight mapped locations it neither reaches nor excludes and the seven of nine data classes it cannot be asked about. Fails on drift; reports the estate's gaps without failing. Twenty-one negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-orchestration-scan.mjs"
      }
    },
    "subject-receipt-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.g. Grades the receipt register -- the four states S10.13.g names, the two parties whose outcome has to be reconciled, the disclosure risk every sentence carries, and the three receipt-shaped artifacts this repository issues -- against the types that define them. The headline is a statement about three vocabularies AND three audiences at once, so each status union is read from its own source, the signature fields are re-derived from the attestation type, and the compliance receipt's call sites are enumerated to check it still goes only to a log line: the only receipt with a word for data deliberately KEPT is the one nobody receives, and the only one that is signed has no such word. Then RUNS the shipped contract over the receipt a subject really gets. Fails on drift; reports the estate. Eleven negative controls -- one of which caught the register counting its own file -- and it exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-receipt-scan.mjs"
      }
    },
    "subject-request-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.a. Grades `ESTATE_REQUEST_SHAPES` -- the register of every type in this repository that models a data-subject request -- against the source those types are declared in. Each field the register says carries an element must exist in the interface today; each element it says a type LACKS is searched for by indicator pattern and the declared absence fails the day it stops being true; `hasProductionCaller` is re-derived by searching every non-test TypeScript file, with a file declaring its OWN type of that name counted as a homonym rather than a caller (nine types here are called `DeletionRequest`), and an undeclared homonym is a failure because a question asked by name answers about all of them. Reports how many of the twelve elements S10.13.a names are carried by a type anything outside a test reaches. Nine negative controls mutate the REAL register and it exits 2 rather than reporting if any goes undetected.",
        "command": "npx tsx tools/subject-request-scan.mjs"
      }
    },
    "subject-retention-exception-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S10.13.f. Grades the retention-exception register -- the ten elements an exception has to record, the 23 categories an operator can select, the 10 the compliance purge asks about, and the 28 partitions really wired into it -- against the schema an operator fills in and the purge that is supposed to be stopped by it. The headline is an EQUALITY BETWEEN TWO LISTS in different packages joined by a field typed `readonly string[]`, so nothing in the type system will notice them diverging: six words are in both, and 16 of the 28 partitions are purged under `review_package` or `evidence_pack`, which no exception can name. It also checks a DEFAULT rather than a symbol -- an unparseable effectiveUntil resolves to null and the filter reads null as unbounded, so a typo becomes a permanent hold -- and searches for each of the four elements the register declares absent. Fails on drift; reports the estate. Twelve negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/subject-retention-exception-scan.mjs"
      }
    },
    "target-readback": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/target-readback.mjs"
      }
    },
    "tenant-isolation": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/tenant-isolation.mjs"
      }
    },
    "tenant-isolation-matrix": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/tenant-isolation-matrix.mjs"
      }
    },
    "tenant-seeds-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.8.c. Seed builders for two tenants that collide on purpose. THE RULE: A COLLIDING ID IS THE ONLY FIXTURE THAT CAN CATCH A QUERY THAT FORGOT ITS TENANT -- with distinct ids, a query missing AND tenant_id = $1 returns the right row anyway and the assertion passes. The schema permits the collision by design: 99 tenant-scoped compound keys, and goal3_stub_scim_user is PRIMARY KEY (tenant_id, external_id). TRANSACTIONAL AND NONTRANSACTIONAL DECIDE WHO CAN SEE THE DATA: a transactional seed is invisible to any other connection, so a subject driven through its real HTTP surface sees an empty database and passes because nothing was found. isolationVerdict RETURNS inconclusive rather than a pass when the plan holds no collision or the reader found nothing. THE ESTATE: 8 database-backed suites, 1 naming two tenants, ZERO tables written under two tenants, 26 deleteMany cleanups, 1 transaction -- and the two-tenant suite's tenants are namespaces for unrelated subjects. The scan re-derives every number AND drives the instrument against a real server: it seeds a real colliding pair, runs a tenant-scoped reader and a tenant-BLIND one, and requires the first to read tenant-scoped and the second to read leaks -- if a query with no tenant predicate does not leak, the fixture did not collide and every other reading is worthless. NO SERVER IS EXIT 1. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/tenant-seeds-scan.mjs"
      }
    },
    "test": {
      "executor": "@nx/vite:test",
      "options": {
        "config": "libs/oshun/workbench-kit/vitest.config.ts",
        "passWithNoTests": false
      }
    },
    "test-only-boundary-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.7.g. The boundary between what ships and what tests it, and the two different questions it takes to hold one. THE RULE: A DEPENDENCY RULE READS WHAT SOMEBODY WROTE AND A BUNDLE SCAN READS WHAT ARRIVED. A no-restricted-imports rule matches the SPECIFIER at an import site -- exactly right for a developer typing a test-only path into a production file, and blind to the case where nobody typed it: a production module imports a barrel, the barrel re-exports a helper, and the helper imports the builders, with every site in that chain spelled legally. WHAT THE ESTATE ALREADY HAS IS EXEMPLARY: S1.13.e bans @oshun/workbench-kit/testing* repository-wide, adds a SECOND rule for the relative ../testing/ spelling the specifier pattern cannot see, explains why it uses the @typescript-eslint rule rather than the core one (flat config resolves by last match and a repo-wide core block would silently replace the per-directory ones), and NAMES WHAT IT DOES NOT COVER -- spec files are globally unlinted, so the ban is enforced by every-linted-file-is-production rather than by a carve-out. And it is PROVED: tools/test-only-import-fixtures.mjs writes a real TypeScript file, runs the repository's own ESLint over it, and checks BOTH HALVES, because a rule that also refuses the allowed spelling is not a rule -- which is precisely the deliberate invalid import this cell asks for. WHERE IT STOPS IS THE MEASUREMENT: SIX libraries publish a ./testing subpath and ONE is banned. The other five publish a test-only entry point with nothing stopping a production file importing it -- the rule is not weak, it is scoped to one package while the convention is used by six. AND THE BUNDLE HALF DOES NOT EXIST: oshun-web-bundle-monitor.yml WEIGHS the bundle -- size analysis, a budget, a failure if over -- and A BUDGET IS NOT A CONTENT SCAN. A test builder that adds four kilobytes passes comfortably, and did-the-forgery-kit-ship is not a question a number in kilobytes answers. This scan deliberately does NOT re-run the existing prover: writing a second tool that made the same invalid import would be a copy claiming to be a check. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/test-only-boundary-scan.mjs"
      }
    },
    "test-only-imports": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/test-only-import-fixtures.mjs"
      }
    },
    "throttle-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.b. THE RULE: A BACKOFF COMPUTED FROM THE ATTEMPT NUMBER IS A GUESS, AND THE PROVIDER SENT THE ANSWER. provider-lifecycle.ts has a genuinely good retry surface -- full-jitter backoff with the randomness supplied, a per-window retryShareCeiling with an excellent note on why per-request bounds turn a partial outage into a full one, ten ordered refusals, throttle and quota as distinct classes. MEASURED BY CALLING IT: RetryContext has EIGHT fields and not one is what the provider said, and backoffDelayMs(attempt, budget, jitter) takes three arguments and none is a Retry-After -- so a 429 saying 'come back in 60 seconds' and a 429 with no header get the SAME delay. With a five-attempt budget a caller burns EVERY ATTEMPT after 31.0s of waiting; against a Retry-After of 60s all five are refused again before the window opens, the budget is spent, and the load is added at exactly the moment the provider is shedding it. providerRetryDecision answers a sixty-second instruction with 999 MILLISECONDS. THE SECOND, AND IT IS WHY ONE FIELD WOULD NOT DO: A RETRY-AFTER IS A DURATION AND A QUOTA RESET IS AN INSTANT, AND JITTER MEANS THE OPPOSITE THING TO EACH. A duration is measured from each caller's own response, so a thousand callers throttled across a second come back spread across a second and jitter is a nicety. A reset instant is the SAME MILLISECOND for everyone, so they arrive together and the first thing the provider gets after restoring capacity is everything it refused while it was down -- jitter is the whole mechanism, and it must land AFTER the instant, because arriving early at a reset is not early, it is a refused request. The SAME HEADER in its date form behaves like the reset and not like its own duration form. AND A CIRCUIT IS NOT A BUDGET: circuit appears nowhere in provider-lifecycle.ts, and a share ceiling bounds how much of a window may be retries while a circuit stops asking and then asks ONE question -- a probe that EXPECTS to fail, so charging it to a caller's attempt budget spends a real user's retry on a health check. 8 fixtures, 6/6 aspects, 5/5 signal kinds, 21 attempts wasted by guessing. TWO FAULT KINDS THAT COULD NEVER FIRE were removed and became swept invariants (312 waits), the same defect and the same fix as S11.11.a. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/throttle-fixtures-scan.mjs"
      }
    },
    "timeout-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.11.a. THE RULE: `unknown` IS NOT SOMETHING A PROVIDER RETURNS -- IT IS WHAT THE CALLER WRITES DOWN WHEN IT STOPS WAITING. The estate says so itself: OUTCOME_MEANS.unknown reads 'this side cannot tell', and ProviderScriptStep lets a fixture author write outcome: 'unknown', which puts the caller's ignorance in the provider's mouth. MEASURED BY DRIVING createScriptedProvider, not reading it: (1) delayMs is advanced ONCE, BEFORE the chunk loop -- three chunks after a 30s delay all arrive at monotonic 30000, so every scripted delay is structurally a FIRST-BYTE delay and a gap BETWEEN chunks, which is the whole of an idle timeout, cannot be written; (2) nothing anywhere compares elapsed time to a deadline, so a step with delayMs 3600000 and outcome ok returns ok, with its text and its usage, after a scripted hour -- and 'the provider succeeded and the caller had already given up' has no way to occur; (3) a scripted unknown returns usage null, which is CORRECT for the caller and is the whole problem, because the PROVIDER's ledger -- which does know what it billed -- has no representation at all. SHIPPED: ProviderLedger (what the provider did, with per-chunk arrival times and what it will bill) and CallerRecord (every field DERIVED by observe from those arrivals against the caller's own deadlines). Nothing declares the caller's outcome, because the moment a fixture can, the interesting cases stop being distinguishable. 8 fixtures, 6/6 points, 4/4 moments, 18,980 billed output tokens no caller recorded. FOUR AGREEMENT CLASSES, GRADED OVER THE CORPUS: the first version graded EVERY fixture on whether the ledgers disagree and reported four defects against four CORRECT fixtures -- when the provider itself does not know, both sides writing unknown is right. Then the fallback swallowed a clean success as shared ignorance, so agreed-it-succeeded exists as the positive control. AND A FAULT KIND THAT COULD NEVER FIRE: 'the caller wrote failed after acceptance' had the exact negation of the one branch that writes failed as its condition. It is now an OBSERVER invariant swept over 375 ledgers -- where the sweep promptly refuted it as first stated, because a provider that reports an explicit failure inside every deadline HAS told the caller the work did not happen. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/timeout-fixtures-scan.mjs"
      }
    },
    "transport-fixtures-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.f. THE RULE: A TRANSPORT HAZARD IS A TRANSFER THAT NEVER ENDS, AND EVERY OBSERVATION THE ESTATE CAN MAKE IS A RECORD OF ONE THAT DID. Six of the eight hazards this cell names are not responses at all -- a slow-loris header dribble, a body arriving one byte a minute, an endless stream, a chunked encoding that never sends its terminating zero: each is a socket still open, still making progress by any measure the far side controls, never finishing. MEASURED against fetching.ts: FetchTimeouts declares 6 phase bounds and ALL SIX ARE READ ONLY INSIDE validateFetchPolicy, WHICH COMPARES THEM TO EACH OTHER -- not one is ever compared to an elapsed measurement, because no function in the estate takes one. FetchBounds declares 5 and THREE HAVE NO READER AT ALL (compressedBytes, archiveEntries, archiveDepth), so five gigabytes on the wire that decompress to four kilobytes is ACCEPTED by decideContent -- verified by calling it -- because the decompressed bound and the ratio are both satisfied and the bound written for exactly this case is never read. FETCH_REFUSALS declares 11 and fetching.ts returns 4; six more are the host's through GuardedFetchSeam, which is legitimate for a seam; and `timeout` IS PRODUCED BY NOTHING IN THE REPOSITORY, because nothing hands anyone an elapsed time. FetchOutcome is fetched|refused with no third state, and ResponseObservation's four fields are all TOTALS with no declared length, so a chunked lie has nothing to disagree with. SHIPPED: TransferProgress, the observation the estate cannot make, and decideInFlight, the first producer of `timeout` here, phase-aware because ninety seconds in headers and ninety in body are refused by different clauses. Nine cases over nine hazards. A THIRD DECIDABILITY, from-neither, WHICH THIS CORPUS FOUND BY BEING WRONG: the TLS host mismatch was filed as in-flight and the register reported it not-abandoned, because decideInFlight keeps waiting on it and is RIGHT to -- every bound is satisfied and the deciding fact, the name on the certificate, is in no type here. Retuning a threshold until it abandoned would have shipped a check over a fact it never read. AND A CHECK THE CORPUS NEEDED: caught-by-a-different-bound. Three cases were written with numbers that abandoned for a reason other than the bound their own prose named; all three passed, greenly, demonstrating something weaker than they claimed. A number that agrees with a verdict is not a number that agrees with the reason. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/transport-fixtures-scan.mjs"
      }
    },
    "typecheck": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "tsc --noEmit -p tsconfig.lib.json && tsc --noEmit -p tsconfig.spec.json"
      }
    },
    "url-spellings-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.10.e. THE RULE: A SPELLING IS A BYPASS ONLY AGAINST A GUARD THAT SEES IT -- the third consecutive cell to land on that shape, after a destination deciding a collision (S11.10.c) and a sink deciding what a comment is (S11.10.d). SSRF_CORPUS is 21 good targets and it does not record WHERE THE GUARD STANDS, so runCorpus cannot ask. MEASURED: put all 21 through Node's own URL parser and EIGHT reach a post-parse guard in a spelling the corpus does not contain -- 127.1, 2130706433 and 0177.0.0.1 rewritten to 127.0.0.1 (so against a post-parse guard those three test nothing), ::ffff:127.0.0.1 and ::ffff:169.254.169.254 rewritten into hex as [::ffff:7f00:1] and [::ffff:a9fe:a9fe], and ::1, fe80::1 and fc00::1 handed over bracketed. THE DEMONSTRATION: build the most literal guard a deployment could write from that corpus -- membership in it -- and run the corpus against that ONE guard at both vantage points. Nothing gets through as-written; FIVE forbidden addresses get through as-resolved. Nothing about the corpus or the guard changed between those runs, only where the guard stands, and runCorpus cannot express that. THE PARSER CREATES SPELLINGS TOO: circled digits are IDNA compatibility variants, so a name with no digit and no dot in it resolves to 169.254.169.254; a tab inside a host is STRIPPED, joining two labels a reader sees as separate; userinfo puts a friendly name where every reader looks and the metadata endpoint where the socket goes; and a hash makes a trailing at-sign decoration, so somebody who has learnt the userinfo trick reads that one backwards. AND NORMALIZING IS NOT ENOUGH: 127 with U+3002 IDEOGRAPHIC FULL STOP separators is unchanged by NFKC and still has no dot in it, while the resolver sees 127.0.0.1 -- so NORMALIZE BY PARSING, NOT BY NORMALIZING. Every declared reach is verified against the parser rather than trusted, which caught two typos in this corpus as first written. 12 spellings, 5/5 classes, both vantage points exercised, each spelling's foolsAt and inertAt partitioning the vantage-point set so that a vantage point nobody considered cannot look like one where the spelling is known to be inert. Eight negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/url-spellings-scan.mjs"
      }
    },
    "validation-announcements-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.5.b. The five validation events the cell asks for, sorted by what actually has to happen. THE RULE: A LIVE REGION ANNOUNCES ARRIVALS, aria-relevant DEFAULTS TO additions text, SO ONE OF THE FIVE IS SILENT BY CONSTRUCTION AND ANOTHER CANNOT BE OBSERVED AT ALL. Summary and control-error are arrivals; focus-movement is a MOVE the platform announces for free with no region involved; resolution is a DEPARTURE, because removing the error node is a removal and the default relevant does not include removals, so the only way to speak it is a positive message that turns it back into an arrival; and correction is a SUPPRESSION -- the requirement is that nothing is re-announced on every keystroke, and an absence cannot be read out of a final state. A SUMMARY IS A PATTERN, NOT A WORD: searched as the word, ErrorSummary looks present in 5 files and every hit is a job record's lastErrorSummary column; searched as the pattern -- a form-level error list whose entries link to their fields -- there are ZERO, against 507 onSubmit handlers. AND THE ESTATE CONTAINS THE ANSWER AGAIN: accessibilityHooks.tsx exports useErrorAssociation, which ties a control to its message with aria-invalid, aria-describedby and role=alert so it is announced when it appears and drops the association when there is no error, and it has ZERO callers; useLiveAnnouncer keeps stable atomic polite and assertive regions and clears-then-sets so an identical message still reads as a change, and it has ONE; useFocusTrap and useRovingTabIndex have none. THE READING: 1 of 5 fixtures runnable, and it is focus-movement -- the only one of the five nobody has written, since the suites hold 71 focus assertions and NOT ONE of them is in a test that also touches an invalid control. This scan re-reads the hooks, re-counts every caller outside the defining file while skipping prose, walks the products' JSX for aria-invalid tags and their descriptions, and re-counts the suites. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/validation-announcements-scan.mjs"
      }
    },
    "verify-abstraction-review": {
      "//": "S11.24.b — abstraction quality. AN ABSTRACTION IS A CLAIM ABOUT MORE THAN ONE CASE, AND EVERY ONE OF THE SEVEN CONCERNS IS A WAY OF HAVING ONLY ONE. None of the seven is a property of a token, so a grep count answers none of them: each is a relation, and the register reads pairs. THE HEADLINE: 48 of 341 subpath exports are imported at all, ALL 48 BY EXACTLY ONE PROJECT, and the whole kit is consumed by TWO -- apps/oshun/web and apps/oshun/bff, neither of them Tara. A CONSUMER IS NOT A FILE, IT IS A PROJECT: 39 of the 48 are reached from several files inside one project, which a file count reports as reuse. AND ONE NAME MEANS MORE THAN ONE THING 123 TIMES -- LIFECYCLE_FAULTS is declared in EIGHT modules with eight disjoint member lists of 3/6/8/8/9/11/11/14, and 44 such names are ALSO served by the root entry point, so `import { X } from '@oshun/workbench-kit'` and `from '@oshun/workbench-kit/<module>'` are two values under one name and the type system cannot object because each door is separately consistent. AND A TARA PATH IN A DATUM IS A CITATION; ONE A FUNCTION READS IS A LEAK -- 0 Tara names in a type, 20 modules naming Tara at all, and only 7 leakage. AND A DEFAULT IS UNSAFE FOR ITS DIRECTION, NOT FOR BEING A DEFAULT: 150 resolve toward an answer nobody computed, and 33 modules answer two absences in OPPOSITE directions from one bag. AND `unknown` IS NOT AN ESCAPE HATCH, IT IS THE OPPOSITE. noUncheckedIndexedAccess is OFF, so 31 union-keyed tables type a miss as a hit. 3 of 4 stated extension invariants are enforced; the fourth is answered at the call site. 39 spec tests; scan PASSES with 30 negative controls, ten of them silence controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/abstraction-review-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-accessibility-diff": {
      "//": "S11.23.c — the accessibility diff. A FINDING COUNT IS A NUMERATOR, AND WITHOUT THE DENOMINATOR A COUNT GOING DOWN IS AMBIGUOUS BETWEEN 'FEWER PROBLEMS' AND 'LESS WAS EXAMINED'. Before 40, after 12 looks like a very good change and is equally consistent with a page that now fails to load, a route removed from the crawl, a component rendering nothing, or a scan that timed out. The run shows the SAME 40->12 drop read four ways and only 2 of the 4 are an improvement. The denominator is checked BEFORE the numerator, so more findings over less examination still reads as less-was-examined -- the conservative and correct choice, since an improvement that only appears when less is looked at is not one. AND ONLY 2 OF THE 9 SUBJECTS ARE COUNTS: an announcement is a TEXT, focus is an ORDER (the same focusables in a different order is a different experience with an identical count), a visual baseline is an IMAGE, themes and locales are SETS. Subtracting two numbers is the wrong operation for seven of nine. AND A DIFF NEEDS A BEFORE: 2 of 566 subject files record a violation count, and 2 rows need a screen reader that is not present on this machine -- two different reasons a row cannot be diffed, kept apart. 23 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/accessibility-diff-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-accessibility-matrix": {
      "//": "S11.22.f — the accessibility matrix. AN ACCESSIBILITY MATRIX HAS TWO KINDS OF ROW, and the kind a machine cannot fill is where the things automation cannot see live. 5 of 8 rows are a machine's job; manual, screen-reader and semantic-parity need a person with an assistive technology, and they are not the leftovers -- a control with a perfect accessible name that announces at the wrong moment passes every automated check ever written. AND A ROW HAS A THIRD AND FOURTH STANDING: whether the instrument it needs is present WHERE THE RUN HAPPENS. Measured on this machine: no screen reader (orca/nvda/voiceover absent), so screen-reader and semantic-parity are instrument-absent-on-this-machine; @axe-core/playwright IS installed and 38 files in the repository use it, 0 of them in the subject, so an unfilled automated row is a statement about the SUBJECT. TWO ABSENCES, TWO DIFFERENT MEANINGS, and a matrix reporting them the same way has told a reader nothing. 4 of 8 rows covered; a matrix claiming all eight and calling itself complete produces 5 findings. The automated row counts IMPORTS of the runner rather than mentions of the word, after the first run called two files that merely say 'axe' filled. 21 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/accessibility-matrix-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-adapter-compatibility": {
      "//": "S11.21.c — the adapters and the tests that go round the back. AN ADAPTER PRESERVES A SHAPE FOR SOMEBODY, AND A TEST THAT IMPORTS THE IMPLEMENTATION HAS WALKED PAST THE ADAPTER TO CHECK IT. Two measurements, each of which moves the answer. WHO CONSUMES: 31 published specifiers measured against 81,743 source files repo-wide -- 3 consumed from outside Tara (13 import sites), 11 inside-only, and 17 imported by NOTHING anywhere. So 'without changing consumer imports' has a real subject of 3 specifiers, and a compatibility test for the other 17 asserts a shape against itself. HOW THE TESTS REACH IT: 106 Tara spec files, 2 imports through a public specifier and 135 through a relative path into the implementation -- 1.5%. Only 2 of 106 spec files could fail if an adapter stopped re-exporting something. That is a comparison with both sides out of the same box wearing different clothes: the point of an adapter is that the public name and the implementation may differ, and a test that reads the implementation has removed the only difference it was there to detect. 14 of 31 exports need a compatibility test and 1 is backed by one that could fail. 23 spec tests; scan PASSES with 15 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/adapter-compatibility-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-api-profiles": {
      "//": "S11.16.a — API load profiles. THE ESTATE HAS EVERY DIMENSION A LOAD PROFILE WOULD BE BUCKETED BY, AND NO PROFILE. limits.ts has RATE_DIMENSIONS (sustained-rate, burst, and five concurrency kinds) and BUCKET_KINDS (actor, tenant, route, client-class, trust-tier), which is complete -- but a rate rule is a CEILING and a mix is a DISTRIBUTION OF ARRIVALS, and neither derives from the other: measured here, the eight operations exhaust SIX different resources first, so two mixes at one rate exhaust different things. Defines the SHAPE of the three mixes and REFUSES to state proportions -- there is no telemetry in this repository to take them from, and a written-down guess would be validated against itself by every later run. A CAUTION THE SCAN KEEPS FRESH: 'distribution' in capacity-plugins.ts means CONTENT DELIVERY (channel slots, egress, delivery), so searching for it and concluding arrival distributions are modelled would be wrong.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/api-profiles-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-baseline-publication": {
      "//": "S11.23.g — publishing the comparison. 'ZERO UNEXPLAINED OR EXPIRED' IS TWO CONDITIONS AND THE SECOND ARRIVES WITHOUT ANYBODY DOING ANYTHING. A regression is unexplained until somebody explains it -- a state a person changes. An EXPIRED one is different in kind: an explained regression carries an exception, the exception carries an expiry, and the expiry passes on its own. The report was TRUE when published and becomes FALSE while nobody edits it, which is the only way a document goes wrong with no author. The run reads the SAME report at four instants and it moves from clean to has-expired-exceptions with 0, 1, 1 and 2 blocking -- so a publication check that runs once has verified the only moment at which the property was guaranteed to hold. AND 'SIGNED' IS NOT 'CHECKSUMMED': 1 of 3 attestations is a signature, carrying S11.20.g's finding rather than accepting a digest under a signature's name, because a reader takes the word for the claim. AND A BASELINE REPORT IS WHAT FUTURE COMPARISONS ARE MEASURED AGAINST, so an unfixed regression published into one STOPS BEING A REGRESSION -- the next comparison finds nothing wrong, correctly, against a baseline that already contains it. An exception with no expiry is left to S11.23.f rather than counted twice. 24 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/baseline-publication-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-build-gates": {
      "//": "S11.22.e — the nine gates. A GATE IS A THING THAT CAN STOP YOU, AND THERE ARE THREE WAYS IT CANNOT: it does not exist, it runs on another subject, or it has a documented bypass. The last two look exactly like a working gate from outside. MEASURED ON THIS REPOSITORY: 3 of 9 can stop a change. 4 run on another subject -- dependency-boundary, test-fixture and secret-scan all resolve to workbench-kit registers, and bundle to a v3 script. 1 does not exist (package). 1 has a documented bypass: SKIP_TYPECHECK=1, named in 52 lines of the last 200 commit messages, so the escape hatch is exercised rather than hypothetical -- and this session took it on every commit, with the reason stated each time. AND SEQUENTIALLY IS THE OTHER HALF: a run that stops at gate two has said NOTHING about gates three to nine, so the three outcomes are ran-and-passed, ran-and-failed and never-ran-because-an-earlier-gate-stopped, and only the first counts green. The bypass is attributed by PROXIMITY after the scan's first run wrongly blamed SKIP_TYPECHECK for the stub scan, which shares the same hook file and has no bypass at all. 19 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/build-gates-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-build-golden": {
      "//": "S11.13.c — the build runner. Re-takes the count this cell rests on: the number of checked-in expected values in tools/golden-round-trip.mjs, which is zero, so every comparison that tool makes is between two values it computed itself moments apart. That detects nondeterminism and cannot detect a change to the builder. Projects the four aspects the estate's BUILD_GOLDEN_ASPECTS names, compares each against a checked-in literal, and runs the result through the estate's own buildGoldenFaults — the first producer of BuildGolden since that checker was written.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/build-golden-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-canvas-parity": {
      "//": "S11.17.b — canvas/table parity. A GRAPH'S POSITION IS COMPUTED AND MEANS NOTHING; A CANVAS'S POSITION IS AUTHORED AND IS THE CONTENT, AND THE ESTATE HAS ONE DOCTRINE AND IT IS THE GRAPH'S. The scan CALLS both halves rather than arguing: spatialMeaningFaults reports position-mapped-to-a-coordinate-column for a table that answers position with an x column -- right for a layout, wrong for a board a person arranged -- and compareGraphs classifies a box dragged across the page as significance=presentation, handing a non-visual reader the sentence '1 difference (0 to the work, 1 to its presentation).' On an authored canvas that sentence is false. The repair is one bit of provenance, POSITION_ORIGINS, not a new algorithm. PRESENT AND SYNCHRONIZED ARE TWO QUESTIONS and the second sorts itself by where the state lives: objects, positions and edits are read from one model by both renderings and cannot drift, and a SELECTION is held by each rendering, so it is the only subject a test can catch -- reconcileSelection is the joint and it already exists. The canvas anchor names WHAT and never WHERE.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/canvas-parity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-compare-budgets": {
      "//": "S11.15.e — compare budgets. EVERY SECOND IN THE COMPARE MODULE IS A COORDINATE IN THE CONTENT, NOT A DURATION OF THE WORK: atSeconds is documented as a frame sampling position so two rates can be aligned, durationSeconds is how long the media is, windowSeconds is an RMS analysis window. Six duration identifiers extracted from comparisons.ts and diff.ts, all classified, ZERO about the work -- so a 3D alignment taking forty seconds and one taking forty milliseconds produce the same `computed` status. AND THERE IS NO STATUS FOR TOO LARGE: COMPARISON_STATUSES has five values and none declines for size, so a size-limited comparison falls to `partial`, which says some of it was computed and reads as incidental rather than declined -- and compare is the operation whose cost grows with the SQUARE of its input. CREDIT: COMPARE_ADAPTERS covers all six content kinds with media split into image, video and audio, which is the right split.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/compare-budgets-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-comparison-equivalence": {
      "//": "S11.23.a — the comparison manifest. 'EQUIVALENT' IS A CLAIM ABOUT TWO RUNS, AND SOME OF THE TEN THINGS THIS CELL NAMES CANNOT BE EQUAL BETWEEN TWO RUNS AT ALL. Three kinds: equal-by-construction (routes, states -- read from one tree), equal-if-pinned (6 of them), and NEVER-EQUAL-ONLY-BOUNDABLE (network, clock). Two runs happen at two different instants by definition; that is not an exception that arose, it is the guaranteed case, and a manifest listing it beside a genuinely unexpected difference has flattened the two. A manifest asserting all ten equal produces exactly 2 findings; an honest one with bounds produces 0. AND A BOUND WITHOUT A MEASUREMENT IS A WISH -- a number, an observation and a unit are all required, because the only thing a reader can do with a bound is compare it to something. THE CLOCK IS RE-MEASURED HERE rather than cited from S11.22.a: 461 direct platform reads across 110 of 566 subject files against 0 across 339 kit modules with the same detector, so the clock is BOTH unpinnable in this subject AND guaranteed to differ. A manifest asserting clock equivalence would be wrong twice. 20 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/comparison-equivalence-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-correctness-review": {
      "//": "S11.24.d \u2014 the correctness review. A DOUBT NEEDS A NAME, A PRODUCER AND A READER, AND THEY FAIL SEPARATELY. The cell names six properties and five of them are answered the same way: find out which state you are in and act on it. AN UNKNOWN OUTCOME IS NOT A SIXTH HAZARD, IT IS THE FAILURE OF THE PRECONDITION THE OTHER FIVE ARE ANSWERED WITH \u2014 a retry is safe when you know the effect was partial, an idempotency key protects a replay when you know the key was recorded, a recovery needs a state known to be good, and when the system cannot tell, all of them degrade to a guess at once. 6 of 7 properties presuppose that observation. A STATE AND A FAULT KIND ARE JUDGED BY OPPOSITE TESTS, and the whole measurement turns on it: a STATE is live when something BRANCHES on it, because a value stored and never consulted behaves identically to its confident neighbour; a FAULT KIND is live when something PRODUCES it, because a detector emits it and branching on one would be the odd thing to do. Applying the branch test to fault kinds called four of the estate's best-detected faults inert, including three PUBLISH_RECONCILIATION_FAULTS named exactly for mishandling an unknown outcome \u2014 a defect in the instrument reported as a defect in the estate, and caught only by opening the files. MEASURED: 5 of 8 subjects hold a doubt and act on it. jobs.ts is the exemplar and states the rule itself \u2014 'unknown is not failed', keeps 'never started' apart from 'outcome unknown', and carries a separate lower retry ceiling whose answer DEPENDS on whether the effect is idempotent. THE THREE THAT CANNOT: cache has NO MODULE in the kit at all; dual-write-divergence has 5 alphabets and migration-paths has 3, and not one member between them names an undeterminable outcome \u2014 in the two places doubt is structural, since a dual write is exactly where one side lands and the other is unknown, and a half-applied migration is none of START_STATES' four. That is the worst of the standings and the hardest to see, because nothing is missing from any file. AND A DEAD MEMBER IS A FINDING WHATEVER ITS NEIGHBOURS DO: blobs' STALENESS.unknown is assigned at one site and read by nothing, and provenance-inspector's RIGHTS_HINTS.unknown appears exactly once in the whole module, in its own declaration. Both sit beside a working sibling that would have hidden them at subject level. 21 spec tests; scan PASSES with 16 negative controls, four of them silence controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/correctness-review-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-trust-review": {
      "//": "S11.24.e — the trust review. AN ESTATE WANTS ZERO OF A HAZARD AND SOME OF A POWER, AND THE TWO ARE ANSWERED BY OPPOSITE INSTRUMENTS. The cell's seven slots are nine concerns (both slash-pairs split) and one question splits them: is zero the goal? Six are hazards answered by a DETECTOR; cost, override and human approval are POWERS answered by a CEILING — and the cell's own wording says so, because it says BOUNDARIES, and a boundary is what you give a thing you want some of. A DETECTOR PROVES ITSELF BY FIRING; A CEILING CANNOT, because a power exercised inside its limit and a power with no limit leave THE SAME RECORD. So a ceiling is judged by its PATHS, never by its rule. AND A FAULT KIND IS A PROPERTY OF A RECORD, SO THE WAY PAST A CEILING IS TO LEAVE NONE — no alphabet, however long, reaches a path that writes nothing. MEASURED: all six hazards have a detector that fires, 43 of 43 fault kinds produced; and 0 of 3 powers have a ceiling that binds every path it censused. The estate is perfect exactly where it could check its own work and imperfect exactly where it could not. a11y-waivers says it best about its own case — skipAxe is 'a boolean fixture option ... there is no field on it to carry anything and no finding for a field to be about', over 247 opt-outs. catalog-write-paths admits 2 of 10 closures that name an intention (documented-convention, code-review) rather than a mechanism, and names the write channel that 'leaves no application record at all'. build-gates carries has-a-documented-bypass, 'the honest kind of hole and it is still a hole'. limits.BYPASS_KINDS walks 2 of the 6 limit categories its own module declares. cost-accounting.dispatchVerdict is the exemplar: it refuses at the point of use with 5 named refusals, one of them for the unreserved path. AND THE RULE AND ITS ROUTES ARE FILED APART — override keeps its ceiling and its two path censuses in three different modules. 30 spec tests; scan PASSES with 21 negative controls, four of them silence controls, two driving the hazard/power split BOTH WAYS on the same facts.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/trust-review-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-quality-review": {
      "//": "S11.24.f — the quality review. A QUALITY THE VALUE CARRIES TRAVELS WITH IT; A QUALITY AN INSTRUMENT VISITS IS ONLY AS REAL AS THE LAST VISIT. The cell names six qualities and then asks something it asks of nothing else in the review — whether the harness can detect a REGRESSION — and that clause is not a seventh quality, it is the reason the other six are grouped. EACH OF THE SIX FAILS BY PRODUCING A PERFECTLY VALID VALUE: an inaccessible button is a valid button, an untranslated string is a valid string, a leaked field is a valid field, a degraded answer is a valid answer. Validity is what all six failures HAVE, so no validator finds any of them. MEASURED: 5 of 6 qualities are answered by making the VALUE carry the fact — ResolvedText returns the locale asked for AND the locale it came from; publicError and projectFor CONSTRUCT the safe shape because 'deletion is a blocklist'; degradation-plans requires the returned value to name the field that says it is a fallback and the consumer that branches on it; service-objectives requires the ratio to carry the denominator the failing system chose. The estate made the same move five times under five names and never named the move. ONE quality — accessibility — is answered by a VISIT, which is not a mistake because no type holds 'this label is meaningful'; but 1 of the 4 ways a visit stops being evidence has NO instrument in any accessibility module: run-on-another-subject, which build-gates names explicitly and attributes to 'S11.21.e's accessibility scripts'. AND THE PROTECTION IS INVERSE TO THE INVISIBILITY OF THE FAILURE: 13 identifier brands with a unique symbol, a strict parser and no unsafe cast — the failure the first test would have caught — against 94 of 102 quality-bearing field declarations typed as bare string, where a substitution is indistinguishable from the real thing. errors.validateMappings guards at RUNTIME, in one module, a hazard the TYPE permits at all 24 bare messageKey declarations. THE SCAN CAUGHT MY OWN INSTRUMENT FIRST: three cited sentences and one carrier name came back stale because the prose wraps across lines with a comment prefix in the middle — a defect in the instrument that would have been reported as a defect in the estate. 24 spec tests; scan PASSES with 18 negative controls, two of them silence controls, two driving the carried/visited split BOTH WAYS on the same facts.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/quality-review-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-finding-ledger": {
      "//": "S11.24.g — the finding ledger. A FIX IS RETESTABLE AND A DECISION IS NOT, and the cell's three resolutions split on exactly that line. `question` IS NOT A SEVERITY — it is the absence of one, so it is kept off the ordered scale. AND WHAT MUST BE RESOLVED BEFORE A FREEZE IS DECIDED BY WHERE THE FINDING IS, NOT BY HOW BAD IT IS: a major finding in a private helper can ship and be fixed next week; a MINOR question about a public signature cannot, because the freeze makes the answer permanent. AND A ROW IS NOT EVIDENCE THAT A FINDING EXISTS — every row cites something this scan re-checks against the source, because a ledger is the one artefact in this review with an incentive to be wrong. MEASURED: 13 rows over the six cells that found something, 21 distinct citations all re-checked; 8 major, 3 questions, 2 minor; 7 on the public API. 10 must close before the freeze and 10 ARE OPEN, so the ledger is NOT closed and S11.24.g stays unchecked. A LEDGER CANNOT CLOSE ITSELF: every remaining resolution is either a public API change (a renamed two-door name, a product that should be a sum, a widened union so a throwing plugin has a typed refusal — PLUGIN_VIOLATION_KINDS has no member for one and all 46 describe declaration defects) or an act outside this kit (a revoked privilege, a repo-wide noUncheckedIndexedAccess), and both are what S11.24.h exists to ratify. The one closed row is closed by a decision the deciding cell already RECORDED; no decision is invented here, because an owner agreeing that a cost is acceptable is an act a scan cannot perform. 21 spec tests; scan PASSES with 18 negative controls, four of them silence controls, two driving the freeze trigger BOTH WAYS on the same row.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/finding-ledger-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-two-door-names": {
      "//": "S11.24.g / ledger row B1 — the ratchet on two-door names. ONE NAME, TWO LEGAL DOORS, TWO DIFFERENT VALUES, AND THE TYPE SYSTEM CANNOT OBJECT, because each door is separately consistent. This does NOT fix the existing set and says so: which of eight LIFECYCLE_FAULTS is 'the' one is a per-name design decision, and removing a name from the barrel breaks whoever imports it. What it does is stop the count going UP. MEASURED at install: 179 duplicate declarations across 125 names, 123 carrying DIFFERENT members, 46 of those ALSO served by the root entry point — that last set is where two legal imports give two values. AND THE REVIEW MODULES ARE HELD AT ZERO: S11.24's own eight modules contributed EIGHT collisions when written (SURFACES was declared twice, by two modules written in the same session, with entirely different members), and a review that grows the defect it reports has no standing to report it; all eight were renamed. THE FIRST VERSION OF THIS RATCHET WAS BROKEN AND A POSITIVE CONTROL CAUGHT IT: it counted colliding NAMES, so a ninth declaration of a name already declared eight times did not move the number and the scan passed. A RATCHET THAT COUNTS THE NAMES CANNOT SEE A NEW COLLISION ON AN OLD NAME, which is the likeliest way the next one arrives. It now counts duplicate DECLARATIONS, and the baseline is measured rather than guessed — the first guess was 176 against a real 179. Two controls: a ninth declaration of an existing name FAILS, and a brand-new unique name does not.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/two-door-names-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-contract-parties": {
      "//": "S11.22.d — the contract, and the document only one side has. A CONTRACT IS BETWEEN TWO PARTIES; A CONTRACT TEST THAT ONLY ONE PARTY RUNS IS A UNIT TEST WITH A LONGER NAME. Four standings, and the fourth is the one this estate is in: shared-by-both-parties, read-by-one-party, read-by-nobody, and GENERATED-FROM-A-SOURCE-THAT-IS-ABSENT. That last is the interesting failure -- a generated client is a snapshot of a specification at the moment somebody ran the generator, and if the specification is not in the repository the snapshot cannot be REGENERATED, so drift (the tenth suite this cell names) is invisible in the very artefact that exists to detect it. MEASURED: 21 openapi specifications in the repository and ZERO for the subject, stated beside the reader that found the 21. The generated client declares 14 paths; the provider carries 16 route modules -- two counts of one surface disagreeing is the cheapest possible demonstration that no shared document is enforced. 4 of 5 JSON schemas are mentioned by no source file anywhere. 0 of 8 artefacts bind both parties, so 0 of 10 suites have one, and a report claiming all ten produces 16 findings. 18 spec tests; scan PASSES with 13 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/contract-parties-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-credential-corpus": {
      "//": "S11.14.a — the valid corpus. The cell asks for embedded, sidecar AND LEDGER fixtures, and the estate is right that only two of those are places a credential is embedded: EMBEDDING_MECHANISMS has no ledger because a credential is not embedded in one, and the estate already says so in the type system -- ExternalWitness carries ledgerHoldsCredentialForDigest, read only on the branch where credentialPresent is false. So A LEDGER-RECOVERABLE CREDENTIAL IS NEVER valid-and-trusted; the estate calls it stripped, a soft-binding match partially-recoverable, and the same absence with no witness missing. Three answers, re-derived every run by handing each fixture's report to the estate's own credentialState.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/credential-corpus-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-deletion-gate": {
      "//": "S11.21.g — the deletion gate. AN IMPORT GRAPH ANSWERS 'WHO IMPORTS THIS BY NAME' AND A DELETION ASKS 'WHAT BREAKS'; those differ by every reference that is not a static import. 7 reference kinds: 4 break, 2 go stale, 1 is unknowable. A DOC TAG GOES STALE AND A MANIFEST ENTRY BREAKS THE BUILD, and both look identical to a text grep -- every mention of @tara/content/api in this repository is an @module JSDoc tag, and @tara/api-client appears inside a describe() string. AND WHEN A SPECIFIER IS ASSEMBLED AT RUNTIME NO STATIC GRAPH CAN ANSWER: 243 such sites beside 2,671 literal ones across 81,755 files, including import(`./messages/${locale}/tara.json`) and a verified `return import(moduleName)`. But ONLY THE ONES THAT COULD REACH THE SUBJECT COUNT -- 225 of the 243 here -- because a gate blocking on ./messages/${locale}.json would block every deletion forever, which is a gate that has stopped answering rather than one being careful. AND A GATE IS ONLY AS WIDE AS WHAT IT SEARCHED: a claim over 5 directories from a search over 1 is refused before anything else. Two of the four verdicts are unknowable, and both outrank safe. The reader strips comments and requires expression position, after its first version counted a function signature and a doc comment as dynamic imports. 23 spec tests; scan PASSES with 20 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/deletion-gate-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-delta-attribution": {
      "//": "S11.23.d — attributing a delta. A SIGNIFICANCE TEST SAYS THE DIFFERENCE IS REAL; IT SAYS NOTHING ABOUT WHAT CAUSED IT. S11.23.b separates noise from everything else and stops there; the other five classes are all 'the difference is real' and differ in their CAUSE, which the samples do not record. 1 of 6 is settled by the samples (noise), 2 need evidence the run does not contain (tool: a toolchain version change; environment: a machine or image change), 1 needs a record written BEFORE the run (intent -- a semantic change explained after a number moves is indistinguishable from a regression with a good story), and 2 are the RESIDUE. SO A REGRESSION IS WHAT IS LEFT, which is not a weakness of the method but what attribution IS: the register's job is to rule things out in order, and one that jumps to 'regression' has skipped that. The run walks all 96 combinations of the four pieces of evidence against the six classes: 19 support the attribution made, every class is supported by SOME combination and none by all of them, and with a toolchain change present only the tool attribution stands. 23 spec tests; scan PASSES with 13 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/delta-attribution-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-dependency-surface": {
      "//": "S11.19.a — the dependency surface. A GATE IS THE INTERSECTION OF WHAT BLOCKS AND WHAT IS COVERED. Credit: the pipeline is substantial -- pnpm audit with a documented baseline, OSV recursively over the tree, gitleaks, trufflehog, syft/grype SBOM, cosign, build-provenance attestation. The release gate REQUIRES 3 of the 4 scanners and says in a comment that OSV is informational, which is honest labelling. WHAT IT MEANS IS THE FINDING: pnpm audit reads a pnpm lockfile and nothing else, so OSV is the only scanner that sees a Cargo.lock, a poetry.lock or a go.mod -- and it cannot fail the build. Measured: 6 of 7 present ecosystems have NOTHING blocking reading them (94 Cargo, 34 python, 3 Go, 156 Dockerfiles, 102 .uplugin, 2 .csproj). Both halves are defensible alone and the intersection is empty. The required-jobs list is PARSED from the workflow, not restated. AND REACHABILITY IS NEITHER A DATABASE NOR A LOCKFILE QUESTION: it is a property of the import graph, computable offline, and nothing computes it -- so an advisory against a package nothing imports and one on the login path arrive at the same severity in the same report.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/dependency-surface-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-dual-write-divergence": {
      "//": "S11.21.d — one call path at a time. A DUAL WRITE IS ONE ACT WRITTEN TWICE, AND FOUR OF THE FIVE THINGS THIS CELL ASKS TO PRESERVE COUNT ACTS. The state is the easy one: write the same value to both stores and they agree. Revision, idempotency, events and audit are LEDGERS -- write once through two paths and a revision advances twice, a key is consumed twice, every consumer gets the event twice, and the trail says the person did it twice. So the state can converge perfectly while every ledger diverges, and a row-by-row store comparison reports on 1 of 5 facts: the one that was never in danger. AND DIVERGENCE IS FOUND BY READING BOTH, WHICH IS THE ONE THING A CUTOVER NEVER DOES -- serving from the old side then the new side never reads both, so a compare read that serves nobody is required. CREDIT: the estate already knows this. MIGRATION_PHASES is PARSED from protection.ts, never restated, and its `verify` sits exactly between the backfill and the read switch; it also carries backfill-without-dual-write, the silent one. MEASURED ON TARA: all 16 hand-written prisma mutations are in 2 seed scripts and there are 0 mutating route handlers, so in the subject as it exists there is no application call path to migrate -- with a positive control, since the reader DID find writes. 24 spec tests; scan PASSES with 17 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/dual-write-divergence-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-failure-triage": {
      "//": "S11.22.h — triage and staleness. A RERUN THAT PASSES IS THE SAME OBSERVATION FOR A FIX AND FOR A FLAKE; what tells them apart is whether anything CHANGED in between. With nothing changed and a passing rerun, 'fixed' is indistinguishable-from-a-flake and 'a-flake' is established -- the same observation, two stories, and the answer alphabet has three members so neither overreach is available. 2 of 20 (disposition, changed, passed) combinations are established by a rerun. An environment problem and a known limitation are claims about the world outside the test and are settled by running it again in NO combination. AND CALLING SOMETHING A FLAKE IS A DECISION: it says the failure was not about the code, a claim about every future run made from one, so it owes a count and something to look at. 'NO STALE RESULT' IS S11.20.d WEARING DIFFERENT CLOTHES: the run drives the check with the REAL HEAD and a REAL earlier commit, and of three linked reports all green, one is current, one is stale-from-another-commit and one records no commit at all. A URL to a green report looks the same whichever commit produced it -- and a green report is the one nobody re-reads. 21 spec tests; scan PASSES with 13 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/failure-triage-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-finding-index": {
      "//": "S11.19.f — the evidence index. A LINK TO RAW EVIDENCE THAT EXPIRES IS A FINDING THAT BECOMES UNCHECKABLE ON A SCHEDULE. The cell requires a raw evidence link on every row and the estate produces exactly that -- 94 artifact uploads, 91 with a retention. Measured: 4 kept for ONE day, 29 for seven, 36 for fourteen, 19 for thirty, 3 for ninety. So a finding raised today with an exception granted for a quarter points at a report that stops existing before the first review, and the row still HAS a link, which is worse than an empty field because an empty field is obviously empty. Not an argument for longer retention -- storage costs money and old scan output ages badly -- but an argument that the retention is part of the FINDING, which is what exception-that-outlives-its-evidence says. AND A VERSION IS THREE VERSIONS: the same tool on the same commit against a different advisory database gives a different answer, and only the third explains a finding appearing with no code change. Exploitability is separate from severity because a queue sorted by the wrong one wastes the week, and S11.19.a measured that nothing computes reachability, so it arrives from a person.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/finding-index-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-fix-closure": {
      "//": "S11.23.e — closing a fix. A FOCUSED RERUN IS A CHECK ON THE FIX; A COMPLETE RERUN IS A CHECK ON THE FIXER. The cell asks for focused THEN complete and the order is the whole instruction: the focused rerun answers 'did this number come back', which is fast and right to run first and cannot answer whether the change that moved that number moved anything else -- the question the complete rerun exists for, and the one a person under time pressure stops before reaching. THREE ANSWERS, not two: closed, the-fix-worked-and-nothing-else-was-checked, not-closed. The middle one is a TRUE statement about a REAL result and it is not closure, and reporting it as closure is how a fix for one regression ships another. AND THE COMPLETE RERUN HAS TO BE THE ONE AFTER THE FIX -- a green complete comparison from before it describes a tree that no longer exists, so the run drives that with REAL commits rather than two invented strings. AND A FIX IS NOT A FIX UNTIL SOMETHING CHANGED: a regression that disappears with no change was not fixed, and calling it fixed removes the record that would have said the metric is unstable. Four fixtures, one properly closed; a report claiming all four produces 3 findings. 21 spec tests; scan PASSES with 13 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/fix-closure-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-fixture-reachability": {
      "//": "S11.18.d — fixtures in the production dependency graph. A DEPENDENCY ON A FIXTURE IS NOT A DEFECT; A PATH FROM A NAME THAT PROMISES SOMETHING ELSE IS. S11.18.a recorded this class as unreachable by a grep because it is a property of the GRAPH; this cell is the graph -- 305 modules, 623 sibling edges, walked breadth-first so the reported path is the SHORTEST one, which is the edge somebody can cut. A kit publishing 25 fixture modules as entry points BY NAME is honest and they are LISTED, not reported: without that distinction the report is 25 findings that are all correct behaviour and nobody reads the 26th. The finding is queue-invariants -> lease-fixtures: a name that promises invariants, delivering fixture data. AND THE MARK EXISTS AND NOTHING APPLIES IT: synthetic.ts ships SYNTHETIC_SEGMENT_PREFIX, syntheticMark() and isSyntheticId, which anti-mock names a POSITIVE-TRACE instrument, and 0 of 25 fixture modules import it -- so no fixture can produce a marked value, whatever happens at runtime. Interception is recorded as answerable only by a RUN, with a register fault that fires if it ever claims a static detector.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/fixture-reachability-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-freshness-recompute": {
      "//": "S11.20.d — recomputing freshness. A LABEL SAYS WHEN SOMEBODY LOOKED; FRESHNESS IS WHETHER ANYTHING MOVED SINCE. Credit: staleness.ts is one of the best things in the kit -- 27 named mutations over 8 dependency kinds, each with `invalidates` AND a REQUIRED `why` on BOTH answers, 10 of them saying false with reasons, because an unexplained false is a judgement somebody made to stop the queue filling up and afterwards there is no way to tell the two apart. Its doc names the case that justifies the subsystem: a provider repoints a stable model name at new weights and every gate answered by that model is now answering a different question. THE ALPHABET IS SHORTER THAN THE ESTATE: 5 of the cell's 10 input classes have NO dependency kind -- contract, schema, corpus, fixture, standard -- and each is load-bearing here (ScoreProvenance already VERSIONS the corpus it cannot register a mutation for; WCAG 2.2, BS.1770-4 and C2PA were all leaned on in this section). A kind that does not exist cannot have a mutation registered against it. The verdict `unknowable-no-kind-for-a-dependency` is what keeps this honest: fresh would mean nothing was watching. 10 mutants, one per class, over a baseline checked FIRST.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/freshness-recompute-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-golden-update-gate": {
      "//": "S11.13.g — the coverage gate. Its first half is done: goldenCoverageFaults walks the SHIPPED registry and asks what coverage exists for each, and the tool already calls it with WORKED_BUNDLE_PROFILES. The second half has no vocabulary at all -- rationale, reviewedBy and updateReason appear nowhere in the golden modules. A GOLDEN THAT CAN BE UPDATED BY EDITING IT IS A GOLDEN THAT RECORDS WHATEVER THE LAST RUN DID. Gates an update on source, rationale and review, all three, because any two let the third through. And the gate can SEE an update: the scan reads the current recorded literals out of build-golden.ts and the previous ones out of `git show HEAD:`, with a synthesised edit as a control proving a change would be seen.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/golden-update-gate-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-graph-parity": {
      "//": "S11.17.c — graph/list parity. A BOOLEAN SAYS A LIST EXISTS; IT DOES NOT SAY THE LIST AGREES WITH THE PICTURE. This is the one pair the estate already answers, and it answers most of it very well: nodeParityFaults and edgeParityFaults compare fact by fact over 23 kinds, relationshipCommandFaults over 10, and the scan drives both -- silent on an honest pair, loud on a doctored one. But pathListed and impactListed are BOOLEANS: the scan puts one path listed in the wrong order to viewportFaults (0 findings) and to pathParityFaults (4), the same path on the same day. The estate's own detail names the comparison it is not making. AND THE GROUP TREE IS DECLARED, CYCLE-CHECKED, AND FLATTENED TO ONE LABEL ON BOTH SIDES: groupParents is a real tree and both renderings carry groupLabel: string | null, so they AGREE and both are silent, and GRAPH_SURFACES has no tree for the one subject whose shape is a tree. The register names its estate fault kinds rather than counting them, and the scan asserts the attributions PARTITION each estate list.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/graph-parity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-green-emission": {
      "//": "S11.20.f — emitting green. NAMING WHAT IS WRONG AND SAYING WHAT TO DO ABOUT IT ARE DIFFERENT ACTS, AND ONLY ONE HAS BEEN DONE AT SCALE: the run counts 754 fault and blocker alphabets carrying 6,592 distinct kinds, and ONE map joining a kind to a remedy, with 11 rows -- 0.17%. Widening the key side to anything at all finds one more map, which turns out to say what a subject REQUIRES rather than what fixes it, so the figure is about the estate and not about a regex. Credit: capacity-plugins names five remedies that each say WHO acts, including nothing-the-requester-can-do, the honest one nobody writes; authorization withholds a remediation for a concealed object because describing one confirms the object. THE FIVE ZERO-CONDITIONS ARE NOT ONE LIST: only missing and stale are cleared by running something, so 're-run the pipeline' is the wrong answer for three of five and for the one actually holding the release -- no pipeline produces an approval. Six negative fixtures, each raising its OWN condition, plus a clean control, because five detectors that fire on everything pass all five. And the gates come out as they went in, checked against the BEFORE, because preservation is a claim about what the emitter did NOT do. 29 spec tests; scan PASSES with 16 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/green-emission-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-import-parity": {
      "//": "S11.13.d — the import runner. The estate's importer-roundtrip.mjs already drives import, preflight, migrate and validate for real, and its CONTROL 4 is the loss report; persist and cleanup appear zero times in it, and so does every one of the eight parity dimensions. Produces the first ParityComparison the repo has ever had, with the second side read off an EXTRACTED tree so bothSidesRead is computed. Measures that the format can carry four of the eight dimensions and reports the other four in three different ways, because a format with no field, a field nothing writes and a value that was lost are three different facts.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/import-parity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-integration-reality": {
      "//": "S11.22.c — the word 'real'. A TEST IS A REAL INTEGRATION TEST IF IT FAILS WHEN THE DEPENDENCY IS ABSENT; that is the whole definition and it is the one nobody checks. Four relations, not two, and the fourth is the expensive one: connects-to-a-real-one fails without it; uses-a-double passes either way, which is CORRECT for a unit test and is not integration; skips-when-absent REPORTS GREEN; never-touches-it does not reach it. A skipped test and a passing test are the same colour in every summary. MEASURED: 0 of 106 Tara spec files carry live-connection machinery, against 2 of 325 kit spec files with the same detector, so the zero is a fact about the subject. 0 of 11 subjects are covered by a test that would fail without the dependency; 8 use a double; 3 -- host, tenant, replay -- are not mentioned by any spec at all. A report claiming all 11 produces 14 findings. provesIntegration and failsWhenAbsent are deliberately the SAME predicate: the property that makes a test an integration test IS failing without the thing, and two functions that happen to agree would invite one to drift. 19 spec tests; scan PASSES with 13 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/integration-reality-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-interaction-budgets": {
      "//": "S11.15.b — interaction budgets. A POTENTIAL IS NOT A LATENCY: max-potential-fid, total-blocking-time and interactive are all LOAD metrics, and max-potential-fid is an estimate from the longest task during load on a page NOBODY INTERACTED WITH -- a bound on the page's capacity to be slow, not a measurement of any interaction. AND THE ASSERTIONS EXIST WHERE THE BUDGETS DO NOT: measured across all 176 e2e-inspect specs, FOURTEEN toBeLessThan bounds in the whole suite, several of which are not times at all, every genuine one a literal in the spec that asserts it. Nothing says what the budget for a KIND of interaction is, so unbudgeted and untested render identically. CREDIT: phase-7-4-long-run.spec.ts has a real PerformanceObserver on longtask and a requestAnimationFrame loop, honest that not every engine exposes longtask. Invents no numbers; a fault kind fires if a digit appears in the register.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/interaction-budgets-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-invalid-corpus": {
      "//": "S11.14.c — the invalid corpus. The cell asks for nine invalid variants WITH SEPARABLE CAUSES, and separability is a property of the REPORT, not the state: computed by calling credentialState for each, SEVEN of the nine are separable (only TWO by the state alone -- chain and revocation -- the other five needing the report) and TWO are not, because structurally-invalid and schema-invalid share the one check the estate has for both. VALIDATION_CHECKS has no schema check; the module says 'schema' once. A corrupt manifest and one that parses and violates its schema get the same answer, and they are different failures with different repairs. The kit already tells them apart FOR THE OTHER MANIFEST: manifest-schema.ts has a registered schema with a pinned ajv validator. Deliberately does NOT widen VALIDATION_CHECKS, which a shipped UI reads.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/invalid-corpus-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-job-profiles": {
      "//": "S11.16.b — job load profiles. EVERY DIMENSION OF A JOB MIX IS MODELLED SOMEWHERE, AND THE JOB'S OWN KIND IS A STRING. Credit is broad: jobs.ts carries expectedAttemptSeconds so short and long are one measured axis; job-graphs.ts is 1,076 lines of parent and child with closed FAILURE_POLICIES and CANCELLATION_PROPAGATIONS, and it IMPORTS JobState from jobs.ts so the two are joined rather than parallel; capacity-plugins.ts carries gpuCount on RenderWorkerLoad so a GPU demand is a quantity rather than an adjective; and PRIORITY_BAND is validated with an out-of-band job REFUSED. But JobRecord.type is a bare string with ZERO comparisons against it -- measured, with a positive control that the same search finds the priority comparisons that do exist -- so five of the twelve kinds are free text, two spellings are two kinds, and a mix over them cannot be checked against what ran. NOT a complaint about `string`: a queue owning a closed union would be edited by every team that adds a job. What is missing is that nobody else owns the catalogue either.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/job-profiles-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-journey-artifacts": {
      "//": "S11.22.g — the journey artefacts. AN ARTEFACT OF THE RETRY IS NOT AN ARTEFACT OF THE FAILURE. Whether a browser run can be investigated depends on TWO settings read separately and meaningful only together: the capture policy and the retry count. PARSED from the real apps/tara/web/playwright.config.ts: `retries: process.env.CI ? 2 : 0` with `trace: 'on-first-retry'`, `video: 'on-first-retry'` and `screenshot: 'only-on-failure'`. LOCALLY retries is 0, so there is never a first retry and NO trace or video is produced at all -- 1 of 3 artefacts describes the failure. IN CI retries is 2, so both ARE produced, from a DIFFERENT EXECUTION than the screenshot: if the failure was a race, the trace is of the case that worked. One bundle, two events, presented as one. Three answers, not two, and a-different-execution is the expensive one because it LOOKS like evidence. AND FIXTURE MODE IS A CLAIM ABOUT WHERE THE DECLARATION IS: of 11 e2e files, 0 declare it where the substitute is INSTALLED and 0 where the journey is READ. A title cannot reach the other side of the glass, so only the installed kind can be wrong in a way that fails. 19 spec tests; scan PASSES with 15 negative controls. This reproduces S11.2.f's finding independently, in a different configuration file.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/journey-artifacts-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-licence-surface": {
      "//": "S11.19.b — the licence surface. AN SBOM IS A BILL OF SOFTWARE, AND FOUR OF THE NINE THINGS THIS CELL NAMES ARE NOT SOFTWARE. Credit: sbom-and-sign.yml generates a real SBOM in both CycloneDX and SPDX from syft, scans it with grype, signs it with cosign and attaches a build-provenance attestation -- both formats carry a licence field per component, so for PACKAGES this question is answered. A font is licensed, an image is licensed, an audio file is licensed, and a model weight is licensed on terms usually stricter than any code in the tree; none is a package, so syft enumerates none of them and neither SBOM has a component to attach a licence to. Measured: 545 tracked files carry terms and appear in no SBOM component (448 media, 85 data, 9 fonts, 3 ONNX weights). AND THE ROOT HAS A LICENSE AND NO NOTICE: Apache-2.0 is what this repository GRANTS, and a NOTICE is what it OWES -- section 4(d) requires a redistributed work to carry the NOTICE contents of what it derives from. 1 of 2 required attribution artifacts present.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/licence-surface-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-lifecycle-corpus": {
      "//": "S11.14.e — the lifecycle corpus. FIVE LIFECYCLE POSITIONS COMPUTED, AND NOTHING JOINS THE FUNCTION THAT KNOWS TO THE FUNCTION THAT DECIDES. validityAtSigning returns valid-now, valid-at-signing, expired, not-yet-valid and unknown-without-a-timestamp -- all five reachable and driven here -- while credentialState takes a ValidationReport on which the whole certificate lifecycle is ONE CheckOutcome. Measured: expired, not-yet-valid and unknown-without-a-timestamp all arrive as `expired`, and CREDENTIAL_STATES has no not-yet-valid at all. The estate's own reason for keeping revoked and expired apart -- they 'go to different people with different urgency' -- applies exactly: a not-yet-valid certificate is a CLOCK problem routed to whoever handles renewals. Two of the six subjects (consent/rights, manifest retention) are modelled a module away and not here, and the scan verifies those modules really contain what they are named for.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/lifecycle-corpus-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-load-manifest": {
      "//": "S11.16.c — the load manifest. EIGHT OF THE NINE DIMENSIONS ARE ALREADY MODELLED: nine PAYLOAD_LIMIT_KINDS including the decompression RATIO a zip bomb exploits, nine COMPLEXITY_DIMENSIONS covering pagination and search, PROVIDER_FAULTS, cost classes and units -- and the part that makes 'production-like' real rather than aspirational, the deployed estate declares 26 memory and cpu limits in infra/hetzner/docker-compose.yml and contention-constraints-scan.mjs ALREADY READS THAT FILE. KEY SKEW IS THE ONE DIMENSION WITH NO VOCABULARY, AND THE WORD THAT SOUNDS LIKE IT MEANS A CLOCK: all eleven `skew` identifiers in the kit are classified and none is about load, so a manifest cannot say one tenant owns most of the traffic -- and a run over uniform keys tests the limits and never tests the BUCKETING that exists to survive skew. Second misleading word in S11.16 after `distribution`.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/load-manifest-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-load-measurements": {
      "//": "S11.16.e — the load measurements. EVERY MEASUREMENT IS MODELLED AND THE DEPLOYED ESTATE EMITS NOTHING. service-objectives.ts has seven SLI classes -- with queue-age and correctness as classes of their own, which is right -- and six OBSERVATION_POINTS naming WHERE a measurement is taken, which is the thing most systems leave implicit. Measured on infra/hetzner/docker-compose.yml: 33 service blocks and ZERO of seven telemetry markers (prometheus, opentelemetry, otel, statsd, metrics, grafana, jaeger), with a positive control that the same search finds them in a probe that has them. So all six observation points are equally unavailable. THIS EXPLAINS THE REST OF S11.16: .a could state no traffic proportion because nothing observes traffic, .c found no key-skew vocabulary because a skew is something you notice by measuring, and .d could drive only a pure limiter. THE ESTATE CAN DECIDE AND CANNOT OBSERVE.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/load-measurements-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-load-scenarios": {
      "//": "S11.16.d — the load scenarios, and REAL RUN RESULTS. A LIMITER RUN PROVES THE DECISION AND NOT THE SURVIVAL: five of the ten scenarios are driven through the estate's own consume with a counter shared across the sequence, and five are not, because a soak needs a clock and a worker loss needs a worker. WHAT THE RUN SHOWED: single-tenant abuse is first refused on the TENANT bucket -- five actors each under the actor limit, stopped by the tenant bucket, which is the rotation bypass the estate names, closed and demonstrated; the quiet tenant is served in full while the loud one is refused. AND WHAT IT FOUND THAT THE REGISTER DID NOT PREDICT: RateRule.windowSeconds IS TOLD TO THE CALLER AND NEVER USED TO DECIDE -- every read of it is on the retryAfterSeconds line, and Counter.current takes NO INSTANT, so the count only ever goes up and the recovery scenario admits NONE of its arrivals.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/load-scenarios-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-migration-freeze": {
      "//": "S11.21.a — freezing Tara. A FREEZE IS A PROMISE THAT A VALUE WILL NOT CHANGE, AND YOU CANNOT MAKE THAT PROMISE ABOUT A VALUE NOBODY HAS. The cell names 8 aspect classes and treats them as one list; the run reads all 8 off the real estate and finds four KINDS of baseline, only one of which can show that a slice broke something. 5 of 8 are an artifact a program reads -- 31 package exports, 30 routes, 24 prisma models, 106 specs, 1 file declaring a schema. 3 are frozen in name only: PERFORMANCE has 4 files that measure and no recorded number outside a spec (an instrument is not a baseline); ACCESSIBILITY has 5 files and 15,226 bytes of caption validator and SkipLink -- accessibility FEATURES, and a feature is not a baseline; FIXTURES POLICY has the word in 25 files, 6 of them the Playwright test-fixture sense, and no policy anywhere. Same spelling, different word. Every absence carries a POSITIVE CONTROL showing the reader finds what IS there (10 exports in the accessibility files). compareAspect has THREE answers because an undetectable aspect reported as unchanged says a slice was checked when nothing checked it. 23 spec tests; scan PASSES with 13 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/migration-freeze-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-migration-slices": {
      "//": "S11.21.b — ordering the slices. AN ORDER IS A LINE, REVERSIBILITY IS A GRAPH, AND THE GRAPH PEOPLE LOOK AT IS THE WRONG ONE. An import edge is one way two slices share; both editing the same file is another, and only the first shows up in a dependency graph. Measured on the real estate: 12 Tara projects with 5 import edges, so 0 of 45 slice pairs are ordered by a dependency -- and 12 of 45 are entangled by a shared file, 25 of 566 files touched by more than one slice. An import graph would call all 12 independent. Only 3 of 10 slices survive as reversible alone. AND THE SLICE LIST DESCRIBES THE KIT, NOT TARA: the same detectors find branded-ids 0 in Tara and 7 in the kit, capability/route 1 and 91, lifecycle/gates 3 and 89, provider/trust 2 and 13 -- 1 absent and 3 thin. The kit column is the POSITIVE CONTROL: an absence measured with a detector that finds nothing anywhere is a broken detector, and shell-ui reading 159 in Tara against 2 in the kit shows the reference is not simply larger. You cannot order a slice with nothing to migrate; that is introducing the concern, and there is nothing to roll back to. 28 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/migration-slices-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-packet-reproducibility": {
      "//": "S11.20.g — reproducing a packet. A DIGEST ANSWERS 'DID THE BYTES CHANGE'; GENERATOR DRIFT IS THE CASE WHERE THE BYTES CHANGED AND THE EVIDENCE DID NOT, WHICH ONE DIGEST CANNOT SAY. Two runs differ for three completely different reasons -- the evidence moved, the generator was upgraded, or the generator is not deterministic -- and only the third is a defect. So there are two digests and a generator identity, and compareRuns returns reproduced, generator-drift, nondeterministic-generator or evidence-changed. MEASURED, AND THE ESTATE IS EXCELLENT AT THE HARD HALF: zero clock or random reads in executable code across 309 kit modules, with a POSITIVE CONTROL on the comment stripper because a grep that finds nothing and a grep that cannot see produce the same output; the 5 raw matches are all doc comments describing the defect. Credit: build-golden NAMES its per-run provenance fields rather than dropping them quietly. THE GAP: 69 modules carry a digest, 9 name what produced the thing, and 5 of 68 do both once this register excludes itself -- so a checksum here is a fact about bytes with no fact about the code that wrote them. The checksum is FNV-1a 64-bit, a real named algorithm, cross-checked against sha256 over 84 comparisons with 0 disagreements, and it is NOT a signature: it meets 1 of 4 things a signature is asked for, and no digest computed by the process that produced the bytes can meet the other three. 36 spec tests; scan PASSES with 18 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/packet-reproducibility-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-packet-validator": {
      "//": "S11.20.c — the packet validator. A VALIDATOR THAT CHECKS THE RECORD CANNOT CHECK THE WORLD. The cell lists 15 checks in one sentence and they are three kinds: 11 answerable from the record alone (so there is no excuse for skipping them), 3 needing the artifact PRESENT on this machine, and 1 -- did the recorded command produce the recorded result -- knowable only by doing it again at the cost the original cost, which is not a validation. The run digests a REAL evidence file and validates the same entry twice: with the world present, 14 passed and it may be called validated; with the world absent, all 11 internal checks still PASS and it may not. A packet full of internal passes is internally consistent, which is worth something and is not what 'validated' sounds like. Every check returns a result including `unchecked` -- a validator that omits what it could not run produces a report where absence looks like success.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/packet-validator-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-parity-contract": {
      "//": "S11.17.a — the shared parity contract. PARITY IS A TWO-SIDED CLAIM AND ALMOST EVERY PIECE THE ESTATE HAS DESCRIBES ONE SIDE. Credit first: graph-views has a complete parity audit (encoding.carries against semanticColumn, canvasGesture against semanticControl, walking the encodings ACTUALLY IN USE) and it answers for ONE of the five pairs, because two of its four inputs are nodeColumns and edgeColumns and a waveform has neither. domain-views adds two more, and reconcileSelection is the one piece that transfers unchanged -- it takes ids, so the scan calls it for a timeline, a waveform and a scene graph. The required non-visual alternative carries CONTENT, not facts: a SemanticNode is four fields over eleven document kinds, so order and hierarchy survive and an identity, a unit, a status and an instant arrive as characters -- present, spoken, and unassertable. Four facets are outside the signature (toSemanticNodes is a function of the model; a selection is a state of the view) and two need no parity at all, because ProjectionState is decided above both renderings. SemanticNode states three rules about itself and NOTHING CHECKED ANY OF THEM: semanticNodeFaults is the first checker and 2 of the 4 shipped renderings leak a translation key.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/parity-contract-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-performance-significance": {
      "//": "S11.23.b — comparing metrics statistically. TWO NUMBERS ARE NOT A DISTRIBUTION: one before and one after is a subtraction, and the difference is the change PLUS the noise with nothing separating them. What separates them is the SPREAD, so this computes the smallest difference the samples could distinguish -- Welch's standard error times a two-sided 95% Student's t critical value -- and refuses to call anything below it a regression. THE t VALUES MATTER AT THE n THIS ESTATE USES: apps/tara/web/lighthouserc.js collects numberOfRuns 3, and Welch's df are never below min(n)-1, so this takes 2, where t is 4.303 against a normal 1.96 -- an interval MORE THAN TWICE as wide. Using the normal value would call noise significant, which is the error this cell exists to prevent. The run shows the smallest detectable difference at n = 1, 2, 3, 5, 10, 30, 100 and works two comparisons at n=3 whose means BOTH move exactly 70ms: in the noisy one that is indistinguishable-from-noise (detectable 210.8ms), in the repeatable one it is a regression (detectable 7.0ms). FOUR VERDICTS, and two of them are not 'no change' -- too-few-samples-to-say is what a run with n below two reports instead of a number. The scan CAUGHT MY OWN FIXTURE ERROR: the first pair showed 35ms and 70ms, so the demonstration did not demonstrate what it claimed. 27 spec tests; scan PASSES with 15 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/performance-significance-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-post-run-integrity": {
      "//": "S11.16.g — the post-run integrity report. THE PROPERTY THAT CANNOT BE VIOLATED IS THE ONE NOTHING IMPLEMENTS: PRIORITY_BAND is real and validated and nothing selects the next job -- no dequeue, no scheduler, no ordering -- so a priority inversion is a statement about an order that does not exist. Not violated and not upheld, and collapsing those two would credit an absence as a guarantee. TWO PROPERTIES ARE VERIFIED BY CALLING THE ESTATE: scopeKey puts tenantId FIRST so two tenants cannot collide (structurally impossible, not merely unlikely, with a control that the probe reports a real collision), and decideClaim returns already-completed for a repeat rather than executing twice. Starvation was DRIVEN in S11.16.d. Three of six completely established; false success is partial because both checkers read DESCRIPTIONS of a run, and after load the likely false success is one nothing described.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/post-run-integrity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-provider-fabrication": {
      "//": "S11.18.b — provider fabrication. THE SCAN LOOKS FOR THE WORD; THE DEFECT IS A SHAPE. The estate's pattern is a good grep for ADMISSIONS -- 'in production, this', 'would use', 'placeholder', 'TODO:' -- and it works because developers write those down honestly. The four fabrications this cell names contain none of them: a catch returning {ok:true}, a guard on a missing apiKey returning {configured:true}, a binding of new InMemoryProvider(), and a function that takes an input and returns 0.92. THE RUN PUTS ONE FIXTURE THROUGH BOTH INSTRUMENTS: the estate's OWN pattern (parsed from the shell script, not copied) reports ZERO, the structural detectors report FOUR. Neither instrument subsumes the other and the estate has one of them. The detectors run a lexical pre-pass that blanks comments and string bodies while PRESERVING every offset and newline, so a reported line is a real line; the approximation and its limits are written down. Every detector is silent on the honest shape -- a typed failure, a rethrow, a not_configured throw, a configured:false, a zero-argument constant, a function that uses its argument. Swept over 302 kit production sources: 1 finding, verified by hand as a correct decision with its reason on the line.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/provider-fabrication-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-readiness-generator": {
      "//": "S11.20 (parent) — the release-readiness generator itself. The parent asks for an IT: a thing that refuses to produce a green packet when required evidence is missing or stale. Seven sub-cells built the pieces and none of them is the IT. COMPOSING THEM IS WHERE THE PIECES STOP AGREEING: .d produces 4 freshness verdicts and .f names 5 zero-conditions, and unknowable-no-kind-for-a-dependency is NOT ANY OF THE FIVE. Calling it fresh reports a check nothing performed; calling it stale claims a change nobody observed; so it is filed as blocking with the reason recorded in UNMAPPABLE_VERDICTS rather than picked quietly in a switch. Likewise the resolver's 5 failing outcomes map to 3 conditions, not 1, because they need different people. THE SCAN RUNS THE THING: a baseline that IS green first -- a generator that refuses everything satisfies the parent's sentence and is useless -- then 9 withdrawals one at a time, each refusing green for its own reason, covering 5 of 5 conditions. THE SCAN CAUGHT A DEFECT IN THIS MODULE: `failed` was unreachable because the expected digest was read off the ref being checked, both sides out of the same box; the manifest-side digest is now a separate input. Plus a deterministic seal that moves on a generator change with identical evidence, and all 7 sub-cell scans invoked rather than trusted. 26 spec tests; scan PASSES with 12 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/readiness-generator-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-readiness-manifest": {
      "//": "S11.20.a — the readiness manifest. A REQUIREMENT SET RESOLVED FOR A RELEASE ID IS A SET RESOLVED FOR A NAME. Credit: the substrate is mostly there -- gate types, per-stage severities, a RequiredEvidence carrying maxAgeSeconds AND invalidatedBy, and UNAVAILABLE_BEHAVIOURS with no `pass` (absent as a TYPE, with the reason written). AND THE PER-RELEASE SET ALREADY EXISTS: publish-eligibility.RequirementResolution has a releaseId, the destination it was resolved FOR, the bindings, the requirements, and an `excused` map where every kind deliberately not required carries its reason. THIS CELL WAS WRITTEN ASSUMING NO SUCH SET EXISTED AND ITS OWN SCAN REFUTED THAT ON THE FIRST RUN. What survived is sharper: the set carries a releaseId and bindings and NO commit and NO artifact digest, so two builds of one release id resolve the same requirements -- S11.19.g's artifact-mismatch one level down -- and `resolvedAt` is a TIME, not a version, so a packet assembled against a shorter list looks exactly as complete as one assembled against a longer one. The manifest adds four things to a shape that mostly exists: the commit and digest, a version of the requirement SET, a dependency graph, and a stop policy.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/readiness-manifest-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-readiness-truth": {
      "//": "S11.20.e — the truth tables. A WAIVER IS NOT A PASS, AN N/A IS NOT A PASS, A PERSON SAYING YES IS NOT EVIDENCE, AND EACH IS EASIER TO OBTAIN THAN THE THING IT REPLACES. Credit: the estate is good at this -- gate-panel keeps blocks/waived/satisfied/unknown as four counts and faults on unknown-counted-as-satisfied; gate-runs returns 'waived' rather than folding it into a pass. THE MEASUREMENT: 18 alphabets in the kit name evidence, 89 distinct members, 3 of 153 pairs sharing anything -- and RequiredEvidence.evidenceType is typed `string`, so the class a gate requires belongs to no alphabet at all and the rule this cell asks for cannot be STATED where requirements are defined. 14 distinct ways to say 'we did not check' across 122 of 2499 alphabets, 32 of which put one beside a pass. The register answers with two tables: 6 states x 3 policies, and a substitution matrix false off the diagonal except for 2 written-down exceptions out of 72 pairs, with nothing at all satisfying an approval. 37 spec tests; scan PASSES with 15 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/readiness-truth-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-rebuild-identity": {
      "//": "S11.13.f — the round-trip runner. CONTROL 6 of golden-round-trip.mjs is a real rebuild through real tar, and it re-reads only the BODIES: the rebuild is `{...input, body: readFileSync(...)}` over the ORIGINAL inputs, handed the ORIGINAL resolved layout. The paths, slots, ordinals and declared digests are exactly what an import must reconstruct, and keeping them means the rebuild cannot fail on them. Here rebuildFrom takes a ReconstructedState and no second argument. Demonstrated with an archive carrying one file no manifest entry names: rebuilt from the original layout it is byte-identical, rebuilt from the manifest it is not. Also declares the identity promise BundleProfile has no field for, without which rebuildFaults reports profile-that-promises-no-identity-at-all for every profile in the estate.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/rebuild-identity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-regression-exception": {
      "//": "S11.23.f — the approved exception. AN EXCEPTION IS A DECISION TO SHIP SOMETHING WORSE; THE FIELDS MAKE IT REVIEWABLE AND THE APPROVALS MAKE IT SOMEBODY'S. The cell names ten things and the tenth is not one field: 'named product/accessibility/performance approval' is THREE approvals by three people with three jobs, and an exception carrying one signature has one person's judgement standing in for all three. That is not pedantry about headcount -- a performance approver can say a 200ms regression is acceptable for this feature and cannot say it is acceptable for a person using a screen reader, because that is a different question about different users with a different answer. AND AN EXCEPTION WITHOUT AN EXPIRY OUTLIVES ITS REASONS: every field describes a moment, and one never revisited becomes a permanent property of the system nobody chose. The instant is an ARGUMENT, never a clock read, so the same exception judged at two moments gives two reproducible answers. AND A COMPENSATING CONTROL IS A THING THAT EXISTS -- 'we will monitor it' is a sentence and a control is something that ACTS, the same distinction S11.20.f drew about remediation. An approval naming a role rather than a person is a fault too: a role cannot be asked about it afterwards. 9 withdrawals from a COMPLETE exception cover all 7 fault kinds, each attributable to the one thing taken away. 20 spec tests; scan PASSES with 14 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/regression-exception-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-release-gate": {
      "//": "S11.19.g — the release gate. THE GATE ASKS WHETHER THE SCANNER SUCCEEDED; IT DOES NOT ASK WHAT THE SCANNER FOUND. release-gate asserts needs.<job>.result == success for 3 jobs, which is a fact about a JOB: one that ran, reported 156 reviewed high/critical advisories and exited zero because they are baselined is success, and so is one that found nothing. THE BASELINE IS NOT THE DEFECT -- it carries a schema version, an audit level, an explicit scope and a reviewedAt, and V1 paths still block -- the defect is that 'the gate passed' and 'there are no high or critical advisories' are different statements and the output supports only the first. AND ONE THING IT GETS RIGHT BY CONSTRUCTION: staleness cannot arise, because it waits through needs inside ONE run, so nobody can hand it yesterday's answer. The cell asks for proof by deliberate fixture, so there are six -- one per condition, each differing from a passing control in exactly ONE way so a block is attributable -- and the run drives the control first (it must pass, or every block below is free), then all six, requiring each to block FOR ITS OWN CONDITION.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/release-gate-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-review-manifest": {
      "//": "S11.24.a — the review manifest, and this is a review OF THIS KIT. AN ENTRY POINT IS REACHED BY AN IMPORTER OR BY A RUNNER, AND A REGISTER'S RUNNER IS ITS SCAN. Applying an import graph to a register and calling the result dead code is the S11.21.g mistake made in the other direction, so reachability has FOUR states and three of them are fine. MEASURED ON THE KIT ITSELF, over 81,803 source files repo-wide: of 340 subpath exports, 48 are imported from outside the kit, 177 are run by a scan, ZERO are BOTH, and 115 ARE REACHED BY NOTHING -- a public name with nothing behind it, indistinguishable from a working one to every check that reads the export map. The zero is itself a finding: the kit has split cleanly into code somebody uses and registers something runs, with no module doing both. AND THE SEVEN ASPECTS ARE NOT SEVEN LISTS -- 5 distinct shapes across 7 aspects, since a public export is a NAME, a consumer is a FILE SOMEWHERE ELSE, a dependency DIRECTION is a property of a PAIR, and a runtime boundary is a claim about where code may run. AND A CONSUMER COUNT IS A WHOLE-REPOSITORY CLAIM, so a manifest whose search was narrower than the estate it describes is refused. 20 spec tests; scan PASSES with 12 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/review-manifest-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-route-budgets": {
      "//": "S11.15.a — route budgets. CREDIT: apps/oshun/web/lighthouse-budget.json is not a document about budgets, it is the file Lighthouse CI enforces -- three path entries with six timings, five resource sizes and four request counts, run three times per route behind a real authenticated session. Twelve of the thirteen dimensions this cell names are already enforced there, each traced by the scan to a metric really in the file. EVERY NUMBER IN THAT FILE IS ONE POINT IN A TWO-DIMENSIONAL SPACE: lighthouserc.cjs sets preset 'desktop' and one throttle, with no formFactor and no mobile config anywhere, so 'by device and network' has no second value to be 'by'. AND MEMORY IS THE ONE DIMENSION NO LIGHTHOUSE BUDGET CAN CARRY -- resourceSizes is bytes over the wire, not bytes resident -- so a route leaking 200MB passes every line. The register copies NO numbers out of the budget file and has a fault kind that fires if one appears.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/route-budgets-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-sast-surface": {
      "//": "S11.19.d — the SAST surface. CODEQL'S REACHABILITY IS REAL AND IT STOPS AT THE LANGUAGE BOUNDARY. Credit: codeql.yml runs +security-extended,security-and-quality -- the wide suite, not the default -- on every push, PR and a weekly cron, and CodeQL is a DATAFLOW engine, the one instrument in the pipeline with genuine reachability. THE PATHS ARE NOT THE GAP: 50,482 of 51,512 non-test TypeScript files are inside its roots (98.0%). THE LANGUAGE IS: matrix.language is [javascript-typescript] alone, over a tree with 9,306 Rust, 3,556 Python, 2,871 C/C++ and 269 C# files -- and cargo clippy -D warnings is a correctness lint, not a taint analysis. AND THE BOUNDARY IS CROSSED CONSTANTLY: 361 files hand a value to a subprocess and 656 reference a native binding, so the engine is right about everything it can see and returns nothing about the step across. TWO OF THE ELEVEN CATEGORIES ARE NOT LANGUAGE DEFECTS: which argument is a tenant and which field is personal data are facts about THIS estate that no shipped pack has ever seen. The vocabulary for tenant exists (TenantId, scopeKey) and there are ZERO .ql files.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/sast-surface-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-save-budgets": {
      "//": "S11.15.c — save budgets. THE SAVE PIPELINE IS MODELLED AS A SEQUENCE OF STATES AND CARRIES NO CLOCK. block-editors.ts models it properly -- seven autosave states covering every stage this cell names, durability separated into stores that survive a reload and stores that do not, and saved-shown-before-the-commit guarding the difference between telling a writer their work is safe and it being safe. But measured: ZERO duration-shaped names in the whole module, with a positive control that the same search finds many in jobs.ts. All eight AUTOSAVE_FAULTS are about order, presence, durability or a COUNT -- retryAttempts and retryCeiling are counts, so five attempts with no delay and five over four minutes are the same observation. A save reaching `saved` thirty seconds after the keystroke passes every check. The estate spent its checks on the worse failure, which is right; the timings are what is missing.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/save-budgets-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-scan-report": {
      "//": "S11.18.g — the signed scan report. A SIGNATURE SAYS WHO WROTE A NUMBER; IT SAYS NOTHING ABOUT WHETHER THE NUMBER IS RIGHT. The run EXECUTES all eight scans (the estate's own plus S11.18.a-f and S11.17.g), collects exit codes, digests a canonical preimage that covers the REVIEW STATE, signs it with a freshly generated ed25519 key, verifies it, and shows one altered field breaks verification. THE ZERO THIS CELL ASKS FOR DOES NOT EXIST: the estate's own whole-repo stub scan reports 3,341 actionable hits, and the report says so -- refusing to publish an honest non-zero would be the defect this section is about, committed by the cell that closes it. AND INDEPENDENT IS A FACT ABOUT WHO. The report carries unreviewed-because-the-producer-is-the-only-party as a VALUE, and reportFaults refuses any zero-blocker report whose reviewer is its own producer. bundle is the one instrument the cell names that nothing exercises, for the reason S11.18.a measured. A scan that did not run is not a scan that found nothing, and a report holding one may not claim zero at all.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/scan-report-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-scan-scope": {
      "//": "S11.18.a — the stub scan's scope. A SCAN'S SCOPE IS THE SET OF FILES IT CAN OPEN, AND THIS ONE OPENS THIRTEEN SUFFIXES. Credit: scripts/stub-indicator-scan.sh is real and runs -- pre-commit hook, whole-PR CI job, a separate silent-random job, a nightly trend and a per-PR comment; three modes; an inline allow-list carrying a REASON; tests excluded BY RULE with the argument written down; and an R100 rename carve-out learned from a directory move that re-litigated every pre-existing hit. It caught this session twice on the word 'would'. THE FINDING IS THE EXTENSION LIST: measured over 136,871 tracked files, 66,488 are in scope and 5,172 out-of-scope files carry code somebody runs -- 3,638 of them .mjs, which is what every verification tool in this initiative and every generator under scripts/ is written in, INCLUDING THIS SCANNER. A fabricated result inside the machinery that produces evidence is invisible to the scan that exists to find fabricated results. Configuration (.json, .yaml, .tf) is unreachable, and generated code and built bundles are excluded by path -- right for a pre-commit hook, wrong for this cell's question, because the bundle is the only artifact that runs in front of a person. The suffix list and the exclusions are PARSED from the shell script, so the day somebody adds .mjs the register is wrong out loud.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/scan-scope-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-scan-triage": {
      "//": "S11.18.f — the triage schema. A SUPPRESSION WITH A REASON AND NO EXPIRY IS PERMANENT. The estate's allow-list is the right SHAPE and the narrowest available -- an end-of-line comment suppressing exactly its own line, travelling with the code it excuses -- and it carries ONE of the six fields this cell asks for. MEASURED OVER THE WHOLE REPOSITORY: 8,129 markers across 3,234 files; 24 carry an owner (0.3%), 27 a linked proof (0.3%), TWO carry no reason at all, and ZERO carry an expiry. All 8,129 are permanent. 206 promise a future in prose and give no date -- 'until the real pipeline lands', 'V2-deferred' -- which is the expiry field written where nothing can read it. AND BREADTH IS A PROPERTY OF THE DIRECTIVE: of 1,603 eslint-disable directives, 763 are FILE-SCOPED block comments, which excuse every line that will ever be added to that file, and they are run through the same schema rather than merely counted -- a number printed beside a schema is not a number judged by it. The expiry check takes the instant as an ARGUMENT (the newest commit date, not the clock) so two runs of one tree agree.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/scan-triage-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-scene-parity": {
      "//": "S11.17.f — 3D/metadata parity. A MATRIX IS SIXTEEN NUMBERS AND A READER NEEDS A PLACE. Credit: StagePrim is a real USD prim -- path, type, local transform, topology, material binding, variant selections, references, strongest composition arc, joint count, attributes -- and STAGE_COMPARISON_FAULTS is 7 kinds of hard-won care, including topology-identical-but-winding-reversed, the bug that renders black and compares as no change. Transform.matrix is 'Local to the parent, never world' and that is the RIGHT choice; it also means a table row cannot say where anything is. worldTransform composes the chain (proved, not assumed: a 3-deep fixture whose answer a person can predict, [11,2,0]) and refuses rather than substituting an identity for a missing ancestor. readTransform gives a place and a size and refuses to name a rotation on a sheared matrix. A SELECTION IS NOT A CHOICE UNTIL YOU KNOW WHAT ELSE WAS AVAILABLE: variantSelections is Record<string,string> and NOTHING holds the options. AND ANIMATION IS A RATE AND A JOINT COUNT -- no time sample anywhere, so a rigged character standing still and one that moves are the same row.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/scene-parity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-score-fabrication": {
      "//": "S11.18.c — score fabrication. A PROVENANCE IS A CLAIM ABOUT WHERE A NUMBER CAME FROM, AND EVERY CHECK IN THE ESTATE IS ABOUT ITS SHAPE. scores.ts is one of the best-modelled things in the kit -- 8 non-value states with not-applicable and unsupported marked NOT COUNTED, a provenance naming evaluator, corpus, model, provider, preprocessing, policy, input hash, run and instant, and 19 violation kinds down to an uncertainty interval that excludes its own value. The scan BUILDS a reading produced by dividing a length, puts it through the estate's own validateVector with a provenance naming a model, and gets 0 violations of 19 -- the record is impeccable -- then reads the PRODUCER and reports the heuristic. Four detectors, none catchable by a word: a judgement defaulting to a passing value, a heuristic over length or a hash presented as an evaluation, a verdict computed in the component that draws it (no evaluator, no corpus, no policy, no run), and an absence resolved to a number when 8 states exist for it. THE SWEEP OVER 303 KIT SOURCES FOUND THREE FALSE POSITIVES AND EACH ONE TIGHTENED A DETECTOR: a counter keyed by verdict.owner, a credit lookup, and provider-registry's unprobed-provider branch whose retryHelps:true was read as a claim of success -- code whose own detail says reporting it as healthy is the failure that state exists to prevent. Now 0.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/score-fabrication-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-scrolling-budgets": {
      "//": "S11.15.f — virtualized scrolling budgets. THE VIRTUALIZATION MODEL IS ABOUT WHAT THE WINDOW MISREPRESENTS, NOT WHAT IT COSTS. data-tables.ts S7.5.h gets the correctness right and its numbered rules are the best in the kit -- a selection that only counts rendered rows is a lie virtualization tells; aria-rowcount is the TOTAL, not the window; print and export need the nonvirtual path -- covering this cell's accessibility, focus and selection dimensions as CORRECTNESS, which is the right way. AND renderedRowCount IS RECORDED AND COMPARED TO NOTHING: the number virtualization exists to keep small sits on the observation, is printed into a fault detail beside the total, and no check asks whether it is too big -- so a table that virtualizes correctly by all six rules and renders nine thousand rows passes every one. Zero durations and zero memory names in the module, both with positive controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/scrolling-budgets-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-search-budgets": {
      "//": "S11.15.d — search budgets. THE SEARCH STACK BUDGETS EVERYTHING EXCEPT HOW LONG A SEARCH TAKES, and this is the best-budgeted part of the estate: query-grammar.ts scores a query BEFORE running it with per-field cost multipliers and refuses it with complexity-budget-exceeded (this cell's expensive-query rejection, implemented); staleToleranceSeconds bounds how out of date an index may be; and a real backoff schedule governs re-indexing. AND A COMPLEXITY BUDGET IS A BOUND ON WORK, NOT ON TIME -- work is a proxy for time only when the machine is not busy, so a query well under budget on a loaded shard is slow and nothing notices. Measured: ZERO latency-shaped names across the three search modules, with a positive control that the same search finds many in service-objectives.ts. first-result and full-result are separate stages because the estate's own TOTAL_EXACTNESS admits a lower-bound total.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/search-budgets-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-security-review": {
      "//": "S11.24.c \u2014 the adversarial security review. A SECURITY DECISION IS ONLY AS BINDING AS THE WEAKEST LINK BETWEEN THE SUBJECT AND THE VERDICT, and reviewing fifteen dimensions one module at a time asks the same question fifteen times and misses the shape. Three links: HOW THE FACT ARRIVES, HOW THE DECISION IS SHAPED, WHAT THE VERDICT CAN SAY \u2014 one finding under each, and each link has a state that LOOKS like the fault and is not. TAKING THE ANSWER IS RIGHT WHEN THE DECIDER CANNOT COMPUTE THE QUESTION: tenancy.ts argues correctly for taking stageIsImmutable as a flag rather than comparing against the word 'published', because the kit cannot know a domain's stage names. It then takes sameTenant the same way \u2014 and a TenantId is a type the kit itself brands, so the decider holds both values. THE ESTATE CONTAINS ITS OWN ANSWER: authorization.ts compares a tenant 4 times and its header calls the re-compare after a scoped resolver 'the single most valuable line in the module', while the module named for tenancy is handed the answer as a boolean. A DECISION THAT CARRIES NO SUBJECT IS A POLICY FUNCTION, NOT A LEAK \u2014 6 of the 7 verdict types carrying a nullable field carry a reason, an error or an audit record, which are ABOUT the decision rather than subject to it. The seventh, AuthorizedLoad, is a product where LoadOutcome seventy lines above it is a sum: one null check yields the metadata and the verdict beside it was never read. AND THE SAME DECISION BINDS AT ONE DISPOSITION AND NOT ANOTHER \u2014 authorizeObject withholds the metadata at conceal and at unavailable, correctly, and returns it on whatever the rules decided, so a caller denied for not being assigned receives the owner, the full assignee list, the team, the classification and the sensitivity classes. THE HALF THAT WORKS IS WHAT MAKES THE OTHER HALF HARD TO SEE. AND A MEMBER NAME IS NOT THE FIELD IT NAMES: CHALLENGE_BINDINGS is 7 members iterated from data \u2014 the best shape in the estate for this, since a binding that stops being checked is a deletion from a list \u2014 and nothing in it names the nonce, so a nonce mismatch is filed under 'actor', which bindingValue maps to actorId. The refusal is CORRECT and is reported as something that did not disagree. 26 spec tests; scan PASSES with 20 negative controls, nine of them silence controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/security-review-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-secret-surface": {
      "//": "S11.19.c — the secret surface. A SCANNER THAT FINDS NOTHING AND A SCANNER THAT IS NOT RUNNING PRODUCE THE SAME REPORT; A CANARY IS THE ONLY THING THAT TELLS THEM APART, AND THERE IS NONE. Credit: gitleaks and trufflehog both run on every release, both with fetch-depth 0 so both read the whole HISTORY -- the half that matters most, because deleting a secret does not unpublish it -- and the gate requires both. AND TRUFFLEHOG RUNS --only-verified, a deliberate and defensible answer to alert fatigue, which also means a secret is reported only when the credential could be CONFIRMED LIVE: 4 of the 6 kinds this cell names cannot be verified by anybody (a private key has no endpoint, a signed URL would have to be USED to check, a certificate and a pattern match authenticate nothing), so none of them fails the build. Neither half is a defect alone; writing both down is what stops 'the secret scan passed' being read as 'there are no secrets'. 4 of 8 surfaces are not present on the runner when the scan happens. A CANARY MUST NOT BE A WORKING CREDENTIAL is the first requirement, checked by an explicit invalidating marker rather than by guessing at shape, because the cost of guessing wrong is a live credential in a git history.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/secret-surface-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-semantic-mutation": {
      "//": "S11.17.g — the semantic mutation report, and the half that was not performed. A CHECK THAT HAS NEVER FAILED IS A CHECK NOBODY HAS TESTED: .b-.f each assert their comparison stays SILENT on an honest pair, which is the cheap half. This runs 33 mutations across all five view pairs -- a fact dropped, a fact altered, an action removed -- and requires each comparison to report. 33 of 33 killed, and a SURVIVOR would be printed by name rather than counted. THE GUARD THAT MAKES A KILL MEAN ANYTHING: before any mutation runs the unmutated alternative must report NOTHING, and runMutations THROWS on a noisy baseline rather than returning outcomes somebody would read as coverage. Positive controls both ways: a blind checker produces a survivor, and a noisy baseline is refused. The keyboard half is decidable and checked. THE SCREEN-READER HALF WAS NOT PERFORMED: 6 readers declared, 0 runnable here, 0 of 5 binaries on PATH (measured on the host at run time, not read from a register), AT_MATRIX 0 of 36 cells observed. Recorded as unobserved, not as a pass.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/semantic-mutation-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-slice-lanes": {
      "//": "S11.21.e — the seven lanes. A SUITE GIVES YOU A VERDICT AND THE CELL ASKS YOU TO COMPARE BEHAVIOUR. A green suite before and after says the same assertions still hold, which is compatible with every behaviour they do not mention having changed; comparing behaviour needs a RECORDED OUTPUT. 2 of 7 lanes produce only a verdict. AND A LANE IS A TARGET ON A PROJECT WHILE A SLICE CUTS ACROSS PROJECTS: 7 lanes x 12 Tara projects = 84 cells, and 17 run on the project in question. 4 of 7 lanes -- contract, integration, accessibility, stub-scan -- run on NO Tara project. A LANE THAT EXISTS SOMEWHERE ELSE IS NOT A LANE FOR THIS SUBJECT: verify:operations:v1-a11y-findings and two siblings are real and green and every one points at libs/oshun/workbench-kit/tools, so running them after a Tara slice reports on a codebase the slice did not touch. Coverage therefore has FOUR answers, including unknown-what-it-runs-against for a script whose target cannot be read out of its command -- folding that into 'runs elsewhere' would assert something nobody measured, which is the defect this register exists to catch, one level up. Only 2 of 7 lanes both run here AND produce something a before and an after can be held against. 25 spec tests; scan PASSES with 16 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/slice-lanes-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-slice-rollback": {
      "//": "S11.21.f — rolling a slice back. A ROLLBACK GOES BACKWARDS IN CODE AND FORWARDS IN DATA. Deploying the previous build returns the code; it does not un-write the rows the new build wrote while it was live, and it does not un-tell the consumers that adopted the new shape. 2 of 4 dimensions are a genuine undo (code, configuration), 1 moves forward only (data), 1 is somebody else's decision (consumers). SO THE ROLLBACK TEST FOR DATA IS NOT 'UNDO IT' -- it is whether the PREVIOUS code reads rows the new code wrote. MEASURED: Tara has ONE migration directory, and repository-wide there are 189 forward .sql steps and ZERO reverse steps, with a positive control showing the same reader found the 189. Prisma migrate is forward-only, so for the persistence slice old-code-over-new-rows is the only meaning rollback has. AND A MIXED DEPLOYMENT IS TWO CLAIMS: old reads new AND new reads old. A plan that asserts one has asserted the half that gets tested by accident, because every row that existed before the deploy was written by the old code. Removal is a claim about TIME and needs a window that has ELAPSED, not one that exists. 24 spec tests; scan PASSES with 15 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/slice-rollback-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-state-matrix": {
      "//": "S11.14.g — the state matrix, and the scalar this whole section measured. Every cell of S11.14 found the same shape: credentialState returns ONE state and everything a reader would act on differently arrives flattened. Reads the seven dimensions SIDE BY SIDE and names, per failing check, which dimension a valid-and-trusted headline is covering up -- 3 of 10 checks. CREDIT: the estate already names this failure, one-badge-instead-of-the-matrix, and validationSurfaceFaults is called for real by the browser tool; RenderedCheck and RenderedCredentialState had NO producer, and this is one. TWO OF THE SEVEN ARE NOT CHECKS: policy is answered by nothing at all (third sighting of rights/consent having no home), and recovery reads the witness, correctly. AND ONE CHECK THE SEVEN HEADINGS DO NOT NAME: manifest-structure, reported rather than forced into a dimension it does not belong to.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/state-matrix-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-stripped-corpus": {
      "//": "S11.14.f — the stripped corpus. A SOFT BINDING IS A SEARCH AND softBindingRecovered IS A BOOLEAN: a perceptual match returns nothing, one thing, or SEVERAL, and several is this cell's ambiguity. Computed: one match and several matches produce the same state AND the same witness, while ZERO matches IS distinguishable -- the positive control that makes the collapse a measurement. AND THE FIELD NAME DECIDES THE OTHER HALF: ledgerHoldsCredentialForDigest is keyed ON THE DIGEST, so only channel-strip -- metadata removed, pixels untouched -- leaves a ledger able to answer. The other five change the bytes, so the key is a different key, and a corpus that tested stripping with one strip-only fixture would find the ledger works and stop.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/stripped-corpus-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-success-fabrication": {
      "//": "S11.18.e — fabricated success. A SUCCESS IS A CLAIM THAT SOMETHING HAPPENED, AND EVERY FABRICATION HERE REPORTS A DIFFERENT, EARLIER EVENT INSTEAD: dispatch is 'we asked', a 2xx is 'the server answered', an empty value is 'nothing came back', a build value is 'it was true when we compiled', optimism is 'we expect it to', a caught error is 'we stopped looking'. That framing makes six shapes one cell and gives every finding a repair -- report the event you actually have -- so the substituted event travels IN the finding. Two of the six are already anti-mock masquerade classes (empty-success, build-time-guess) and the register says which, checked against the estate's own list, so neither instrument is credited with the other's reach. The run shows all six on one fixture and ZERO on the honest rewrite of the same six functions, because a detector only shown firing has not been shown to be quiet.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/success-fabrication-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-supply-chain-surface": {
      "//": "S11.19.e — the supply chain. A POLICY THAT LIVES ONLY IN THE PATTERN OF PAST DECISIONS CANNOT BE VIOLATED, ONLY DEPARTED FROM UNNOTICED. Credit, and two controls are excellent: the installer verifies an integrity hash on effectively every resolution, and onlyBuiltDependencies names 35 packages permitted to run an install script beside ignore-scripts=false -- the strongest single control here, because an install script runs arbitrary code on every machine that installs. AND THE ACTION PINNING IS A REAL POLICY NOBODY WROTE DOWN: all 4 commit-pinned references are third parties that install a toolchain or scan code, which is a sound rule applied consistently -- and the pattern is DERIVED from the references rather than asserted, because asserting it would be a claim about intent. It exists nowhere, so 10 other security-sensitive references are on movable names, including sigstore/cosign-installer (the signing tool the whole chain rests on) and anchore/sbom-action@v0. THE CLEAREST PROOF: dtolnay/rust-toolchain is SHA-pinned in one workflow and @stable in another -- the same action, two treatments, in one repository.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/supply-chain-surface-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-tamper-corpus": {
      "//": "S11.14.b — the tamper corpus. Measured by failing each of the estate's ten VALIDATION_CHECKS one at a time: TEN CHECKS REACH SIX STATES, and THREE fail without moving the state at all (timestamp, assertion-support, ingredient-availability) -- each of them correctly, since an unsupported assertion must not invalidate a credential, an unfetchable ingredient says nothing about the signature over what is there, and a timestamp is load-bearing only once a certificate has expired. So A TAMPER CORPUS THAT ASSERTS ON THE STATE IS BLIND TO THREE OF THEM. The thirteen targets this cell names collapse to FIVE distinguishable routes, with EIGHT of them on the signature alone. The ledger record is the one target no check reaches, reported as outside-the-validators-reach rather than as a passing tamper.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/tamper-corpus-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-test-kinds": {
      "//": "S11.22.b — the four kinds. COVERAGE IS A CLAIM ABOUT WHICH LINES RAN, and the cell names four test kinds because each finds a class of defect the others cannot -- no line number distinguishes them. Run one example over a function and every line is covered; run a thousand and the number does not move. CREDIT: Tara has 2,866 test cases and 4,270 assertions across 106 spec files, and ZERO files declare a case and assert nothing -- the classic way a coverage number rises without anybody checking anything is absent. THE MEASUREMENT: 72 of 106 files are example-only, 33 render components, 1 carries a known-value vector, and ZERO use a property-based generator. The kit column is the control -- the same property detector finds 1 file there, so the Tara zero is a fact about Tara. A suite made of examples has line coverage and no input-space coverage, and that is invisible in every report this cell asks for. A known-value test is the only kind that can catch the whole system being consistently wrong, because its truth comes from outside the repository. 17 spec tests; scan PASSES with 12 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/test-kinds-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-threshold-assertions": {
      "//": "S11.16.f — the threshold assertions, and the cell the parent's evidence clause is really about. 'ACTIVATES BEFORE EXHAUSTION' IS A COMPARISON BETWEEN TWO NUMBERS IN DIFFERENT UNITS, AND NOTHING CONVERTS. The left side is real and CALLED by the scan: the rate limit admits exactly its permitted count and checkPayload refuses a body over its limit. The right side is real and READ from the deployment: 26 declared memory limits, actual bytes for the processes that would die. The bridge is one quantity -- how much of a resource a request costs -- and the estate has the UNIT for it (COST_UNITS includes memoryByteSeconds, cpuMilliseconds, storageByteSeconds) and no value, because filling it in is a measurement and S11.16.e found nothing emits one. So the assertion is not merely unmade, it is UNMAKEABLE, and precisely one missing quantity blocks it. Backpressure, which the parent names, is implemented by nothing: a limit REFUSES a request and backpressure SLOWS a producer.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/threshold-assertions-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-timeline-parity": {
      "//": "S11.17.d — timeline/list parity. THE TIMELINE MODELS SPANS WITH LABELS, AND TWO OF ITS OWN SIX TRACK KINDS ARE NEITHER. Credit in quantity: timelineParityFaults is the best parity check in the repository, comparing a drawn clip with its row over 13 kinds by real arithmetic -- the drawn x against timeToPixels(start) within a device pixel, the width against the duration, the end timecode against start plus duration in the contract's own frame rate -- and the scan DRIVES it, silent on an honest clip and loud when the rectangle moves 40px. But A MARKER IS AN INSTANT WITH A MEANING HELD AS A BARE NUMBER: TimelineDocument.markers is readonly number[], so a marker has no id, no label, no row and no operation, while 3 keyboard commands move a reader between them and SNAP_TARGETS includes marker -- navigable and unreadable. AND AN AUTOMATION POINT IS A VALUE AT AN INSTANT WITH NO VALUE: every 'readonly value' in 3,236 lines is a boolean, and none of the 13 operations changes a number. Both would pass a picture-versus-table check because NEITHER rendering has the fact.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/timeline-parity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-traceability-resolver": {
      "//": "S11.20.b — the traceability resolver. RESOLVING TO A NAME RESOLVES TO WHATEVER IS THERE NOW. A requirement resolving to evidence/scans/dependency.json is satisfied by whatever that path holds when somebody looks; one resolving to a digest is satisfied by one sequence of bytes and nothing else. Both look resolved in a packet and only the second is still true tomorrow -- the same rule S11.19.e found in the workflows, one level up, so the targets are distinguished by TYPE rather than by a convention about where evidence lives. Measured: 1,238 tracked evidence files and ZERO named by a digest. A RESOLVER THAT CANNOT FAIL IS A LOOKUP TABLE, so the failures are the content: nothing, another class, a mutable name, a digest that does not match, and an artifact two requirements both claim. AND A CLASS MISMATCH IS THE ONE THAT LOOKS FINE -- a runbook requirement resolved to a passing test has an id, an artifact and a digest, and a packet counting resolved requirements counts it, and a test does not tell anybody what to do at three in the morning.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/traceability-resolver-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-trend-report": {
      "//": "S11.15.g — the CI trend report. THREE RUNS CANNOT PRODUCE A p75, A p95 AND A WORST THAT DIFFER: with three sorted samples and nearest-rank quantiles the median is rank 2 and p75, p95 and worst are all rank 3 -- one observation under three names. Derived rather than asserted: distinctStatisticsAt computes it for any n, and runsNeededForDistinctStatistics derives that TWENTY runs are needed for all four, which is also where a variance estimate becomes meaningful. AND temporary-public-storage IS NOT A BASELINE: nothing keeps a previous run, so every assertion is against a CONSTANT, and a route that was 400ms and is now 1700ms passes because the budget is 1800ms. A constant catches a route that became bad; a baseline catches one that is becoming bad. CREDIT: the repetitions are real and the gate asserts against the MEDIAN, not the best or the last.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/trend-report-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-unknown-corpus": {
      "//": "S11.14.d — the unknown corpus. A TRUST LIST THAT ANSWERS FROM A CACHE IS NOT A TRUST LIST THAT ANSWERED: the estate has `unavailable` for 'could not ask' and NOTHING for 'asked something out of date'. Computed, not asserted: a live lookup, a fresh cache and a six-month-old cache produce the same state AND the same report faults, because a stale cache returns an answer so its outcome is a pass. trust-results.ts has EXPIRY_STATES one module away and the credential validator does not use it. CREDIT: the estate's one defence is the sharpest check in the module -- unavailable-revocation-treated-as-a-result reads the DETAIL STRING, not the outcome, and fires when an unreachable revocation carries a message reading 'not revoked', 'good' or 'valid'. Verified silent on an honest detail and loud on a lying one.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/unknown-corpus-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-verification-pins": {
      "//": "S11.22.a — the verification manifest. A PIN IS A PROMISE THAT A VALUE WILL BE THE SAME NEXT TIME, AND THAT PROMISE NEEDS SOMEWHERE TO STAND. A commit pins itself, dependencies pin through a lockfile, a browser through a version -- but 6 of the 12 inputs this cell names need a SEAM in the code, and writing an instant in a manifest pins nothing unless every read of the current time goes through something that can be given it. MEASURED WITH THE SAME DETECTOR ON TWO ESTATES: Tara reads the platform 491 times across 113 of 566 files (103 Date.now, 358 argless new Date, 27 Math.random, 3 performance.now) against 0 across 331 kit modules, so the number is a fact about Tara and not about the detector. 5 Tara files carry anything resembling a clock seam. A fixtures policy switch: 0. So the manifest can honestly call 10 of 12 pinned, with clock recorded-but-not-enforced and fixtures unpinnable. The detector strips comments AND quoted strings, after its first version counted a register whose prose says 'a constant, never new Date()' -- a register of source text tripping a detector that reads source text. Template literals are left alone because an interpolated clock read executes. 22 spec tests; scan PASSES with 16 negative controls.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/verification-pins-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-verify-runner": {
      "//": "S11.13.e — the verify runner. The matrix had SEVEN aspects, this cell names EIGHT, and the missing one is the one the estate already had a checker for: bill-of-materials.ts has ten external-component kinds and nine faults with externalComponentFaults deciding them, and golden-round-trip.ts did not contain the string 'dependenc' anywhere. `dependency` is added to VERIFICATION_ASPECTS and wired to that checker. Runs all eight aspects in BOTH directions -- sixteen runs against real estate functions, a real sha256 and a real P-256 key pair -- and requires each refusal to trip the fault its binding names, because a refusal for the wrong reason is an acceptance wearing the right answer.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/verify-runner-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "verify-waveform-parity": {
      "//": "S11.17.e — waveform/transcript parity. A RANGE IS TWO INSTANTS AND EVERY TIME ANCHOR IN THE ESTATE HOLDS ONE: temporal is {timeBase, position} and range is {blockId, start, end} -- two offsets inside a block of TEXT -- so across 8 anchor kinds a span of TIME has no name and cannot be commented on or linked to. That is the structural reason S11.17.a recorded range as described by neither rendering. AND THE LOUDNESS SERIES IS COMPUTED AND DISCARDED: integratedLoudness is real BS.1770-4 and returns ONE number, so the same two seconds arranged loud-then-quiet and quiet-then-loud measure 0.0002 LU apart -- the scan runs both. Seventeen block values were computed on the way and are a local variable. computed-and-discarded is a state of its own here because a missing return value and a missing design are hours apart. momentaryLoudnessSeries returns them, built from the estate's exported kWeight and channel weights so the arithmetic cannot drift, ungated and named as MOMENTARY loudness.",
      "executor": "nx:run-commands",
      "options": {
        "command": "tsx libs/oshun/workbench-kit/tools/waveform-parity-scan.mjs",
        "cwd": "{workspaceRoot}"
      }
    },
    "viewport-manifest-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.a. The seven viewport cases, the three manifests that already exist, and the citation that is off by one character. THE RULE: A CITATION IS A STRING MATCH, AND A DASH IS NOT A DASH. libs/oshun/design-language/src/visual-qa.ts is a GOOD register -- nineteen claims, each naming the shell track, surface, UX claim, Playwright spec, TEST TITLE, state id, viewports, evidence kind, capture artifact and whether it blocks, with eighteen blocking and its own doc saying the mappings exist so they can be queried and required at signoff. Every one names a spec file that EXISTS. FOUR name a test title that does. TWELVE MORE resolve the moment ' - ' is read as ' — ': the register writes a hyphen-minus and the specs write an em dash, so the test is there and the citation cannot find it, and a validator taking the register at its word reports twelve missing tests that are not missing. Three are genuinely absent. AND A BASELINE CARRIES THE PLATFORM THAT MADE IT: Playwright stamps -{project}-{platform} onto every snapshot name, and the committed baselines are 67 chromium-darwin and 16 chromium-linux -- a run on a platform with no baseline does not fail the comparison because there is nothing to compare, so the same suite is a regression test on a Mac and a baseline WRITER everywhere else. AND THREE MANIFESTS EXIST AND THE SIX VISUAL-REGRESSION SPECS USE NONE OF THEM, declaring their viewports inline instead -- forty-nine literal sizes in one file, thirty in another -- while mobile-large is named by the manifest and claimed by nothing. Of the cell's seven cases, three are declared and three are exercised AND THEY ARE NOT THE SAME THREE: zoom-reflow is declared in the inspect harness and driven nowhere, orientation is driven by the mobile Detox suite and declared nowhere, and persistent scrollbar, software keyboard and panel arrangement are neither. This scan re-resolves all nineteen citations against the specs they name, expanding the <viewport> template and stripping the platform stamp before looking for an artifact -- a check that skipped either would report thirteen missing baselines that are committed. Eleven negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/viewport-manifest-scan.mjs"
      }
    },
    "visual-approval-gate-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.6.g. The visual approval gate, and the five independent reasons the one job that names it cannot fail. THE RULE: A GATE THAT CANNOT FAIL IS NOT A GATE. Nothing in this repository gates a baseline change at all -- not the pre-commit hook, which locks V2 binary assets and ratchets six conventions and says nothing about a .png, and not any workflow. And the one CI job named Visual Regression is inert FIVE TIMES OVER, each confirmed against the file that carries it: (1) the step ends in || true, so its exit code is discarded; (2) the target it runs, test:visual, is declared in ZERO project.json files, so run-many matches nothing; (3) none of the six V1 visual specs is behind that target anyway, they run under e2e; (4) the artifact upload is if: failure(), and a job that cannot fail never uploads, so a human cannot review what a human is not shown; (5) the upload globs name __snapshots__ and visual-diff while Playwright writes <spec>.spec.ts-snapshots -- the 34 __snapshots__ directories that exist hold VITEST TEXT SNAPSHOTS and visual-diff exists nowhere. Three of the five would each stop the job alone. That count is the deliverable: a reader who sees the || true and deletes it will conclude the gate now works, and it will still be running a target nothing declares over specs that are not behind it. AND THE SAME JOB IS WHY THE PLATFORM SPLIT MATTERS: it runs on ubuntu-latest and 16 of 83 committed baselines carry that stamp, so even a working comparison would find no baseline for most captures and WRITE one rather than fail. What a gate would have to do is recorded rather than implemented -- notice a baseline change, require a reason, require a linked implementation, and FAIL when either is missing -- and three of those four are decidable from a diff and a commit message. Nine negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/visual-approval-gate-scan.mjs"
      }
    },
    "wcag22-coverage-scan": {
      "executor": "nx:run-commands",
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "//": "S11.3.b. The six criteria WCAG 2.2 adds at A and AA, each mapped to a method that is DERIVED rather than assigned. THE RULE: THE METHOD FOLLOWS FROM THE SHAPE OF THE EVIDENCE, NOT FROM HOW HARD THE CRITERION FEELS. How much has to be in evidence at once -- one document in one state, one across several, or more than one document -- separates automated from journey; whether the instrument can produce a definite pass or only a definite fail is what manual is actually for. Run it and the six split one to five: target size is the only one a scanner over a still document can reach, which is exactly and independently why it is the only one axe has a rule for, and the scan fails if those two derivations ever disagree. THE VEIN: THE ESTATE ALREADY OWNS THE TECHNIQUE FOR THE HARDEST THREE AND POINTS IT AT THE LAYER WITH NO PRODUCTS IN IT -- S7.21.f drives a browser, opens a Popover and compares bounding boxes for 2.4.11, walks every operation for a non-drag path for 2.5.7, and measures a target floor for 2.5.8, all against a bundled gallery of nineteen primitives, while the workbench applications get a static scanner whose rule set contains one of the three. Aiming those controls at the products is computed as a counterfactual and moves 2.4.11 to covered without any new technique, and does NOT move 2.5.7, whose input has no producer -- a second obstacle and a different job. AND: ITERATING IS NOT RELATING. Six web routes and seventeen admin workspaces are visited under an accessibility test and both loops are over TESTS, so N verdicts about N pages and none about a pair, which is the only shape 3.2.6 accepts. AND: A DELEGATION NOBODY CATCHES IS AN ABOLITION -- the primitive layer hands 3.2.6, 3.3.7 and 3.3.8 up in its own registers, this is the layer they were handed to, and across the whole V1 estate those three criterion numbers appear only in the module that handed them up. TRAP, caught by the scan's own controls: a criterion number is a substring of a version number, `Phase 69.3.2.6` is not 3.2.6, a word boundary does not help because the preceding character is a dot -- and the fix is NOT symmetric, since a dot to the right is usually a full stop and guarding both sides alike rejected `see 2.5.8.`. Fourteen negative controls; exits 2 if any goes undetected.",
        "command": "npx tsx tools/wcag22-coverage-scan.mjs"
      }
    },
    "withdrawal-fanout": {
      "executor": "nx:run-commands",
      "dependsOn": ["build"],
      "options": {
        "cwd": "libs/oshun/workbench-kit",
        "command": "node tools/withdrawal-fanout.mjs"
      }
    }
  }
}