Deepen Bombadil scenario exploration

.github/workflows/npm-publish.yml

@@ -275,7 +275,7 @@ jobs:
           const minimumPackedBytes = 140_000;
           const maximumPackedBytes = 180_000;
           const minimumUnpackedBytes = 650_000;
-          const maximumUnpackedBytes = 750_000;
+          const maximumUnpackedBytes = 810_000;
           const maximumMetadataBytes = 250_000;
           const expectedName = "@hraness/direct";
           const expectedVersion = process.env.EXPECTED_VERSION;

README.md

@@ -12,9 +12,9 @@ state with predictable local fixtures. it does not click through the browser
 or test the systems it replaces.
 
 ```sh
-bun add --dev @hraness/direct@0.7.6
+bun add --dev @hraness/direct@0.7.7
 # or
-npm install --save-dev @hraness/direct@0.7.6
+npm install --save-dev @hraness/direct@0.7.7
 ```
 
 [Install @hraness/direct from npm](https://www.npmjs.com/package/@hraness/direct) ·
@@ -53,7 +53,7 @@ Copy this prompt into Codex, Claude Code, or another coding agent:
 
 ```text
 Use $direct to install hraness/direct from
-the npm registry at the exact 0.7.6 version. Follow the repository README, add
+the npm registry at the exact 0.7.7 version. Follow the repository README, add
 `@hraness/direct` to devDependencies only, and verify that the production
 dependency graph excludes Direct. Do not add a fixture composition until I
 ask.
@@ -69,7 +69,7 @@ Pin the public npm package to an exact immutable version:
 ```json
 {
   "devDependencies": {
-    "@hraness/direct": "0.7.6"
+    "@hraness/direct": "0.7.7"
   }
 }
 ```
@@ -218,7 +218,7 @@ A quiet probe means the declared deterministic work settled. It does not prove t
 | `@hraness/direct/web` | Atomic browser installation, with low-level bridge and firewall escape hatches | Browser only |
 | `@hraness/direct/tooling/browser-verification` | Protocol-bound bridge reads, bounded agent-browser commands, local server leases, and artifact writes | Bun 1.3.14 with Node APIs |
 | `@hraness/direct/tooling/bombadil-campaign` | Direct property and conservative action factories for a Bombadil specification | Bombadil 0.7.2 specification compiler |
-| `@hraness/direct/tooling/bombadil` | Local server ownership, native Bombadil lifecycle, trace attestation, replay, and diagnostic artifacts | Bun 1.3.14 with Node APIs |
+| `@hraness/direct/tooling/bombadil` | Local server ownership, native Bombadil lifecycle, serial campaign matrices, trace attestation and summaries, replay, and diagnostic artifacts | Bun 1.3.14 with Node APIs |
 | `@hraness/direct/tooling/bundle-boundary` | Deterministic emitted-file scans and exact versioned-wire evidence | Bun 1.3.14 with Node APIs |
 
 The tooling subpaths are development-only. They are built separately from the
@@ -264,6 +264,7 @@ export * from "@antithesishq/bombadil/browser/defaults/properties";
 
 const direct = createDirectBombadilProperties();
 export const direct_safe_actions = createDirectBombadilActions();
+export const direct_startup_contract = direct.startupContract;
 export const direct_exact_contract = direct.exactContract;
 export const direct_stable_catalog = direct.stableCatalog;
 export const direct_no_declared_violations = direct.noDeclaredViolations;
@@ -275,7 +276,34 @@ path, and any additional safe actions. Call `runDirectBombadilFuzz` from
 `@hraness/direct/tooling/bombadil` in a small Bun wrapper. The runner accepts
 only an explicit local HTTP origin, starts an argv-only server command, invokes
 the exact native 0.7.2 binary, attests the bounded trace with Direct's canonical
-parsers, writes pass or failure artifacts, and releases its owned processes.
+parsers, writes pass or failure artifacts plus a compact exploration summary,
+and releases its owned processes. Use `runDirectBombadilFuzzMatrix` when a
+product owns several scenarios; it runs them serially and requires one exact
+campaign selector for replay.
+
+Startup is the only repairable contract phase. It must reach one exact Direct
+observation within ten seconds. From that sample onward, activation identity,
+route, scenario, catalog, and zero declared violations are immediate safety
+invariants; only quiescence remains bounded liveness.
+
+Keep liveness formulas time-bounded. Prefer guarded product actions with
+explicit weights over unrestricted browser actions, and name small JSON
+snapshots that expose semantic state without retaining page content. Run short
+12–30 second campaigns while editing and longer 60–300 second matrices in a
+scheduled diagnostic lane. Inspect and replay a retained failing trace, then
+promote the smallest readable failure to a deterministic product regression.
+When a campaign must exercise an interaction, require a named product value to
+change after the intended action kind, as well as after a non-Wait action, so
+bootstrap, idle, prerequisite, and unrelated transitions do not satisfy the
+exploration policy. Attribution requires adjacent exact Direct observations;
+it is temporal response evidence rather than proof of causality.
+If the full product snapshot includes viewport dimensions, put that requirement
+on a separate interaction snapshot without viewport fields and require an
+opposite-size `SetViewport` independently. Latch the first ready product state
+for initial-world properties so later actions cannot repair a bad initial state.
+The raw trace remains authoritative and may contain screenshots, URLs, typed
+text, accessible labels, and local paths; treat it as potentially sensitive.
+Summary counts and hashes help triage exploration but are not Direct coverage.
 See [Verification](./docs/verification.md#run-a-bounded-bombadil-campaign) for
 the complete configuration and proof limits.