The orchestration got written down

The analysis tooling was in good shape and the running of it was not written down anywhere. Build a module, fetch it out of the VM, start an emulator, pull the report out of a stream it shares with the emulator's own logging, notice which call did not return, exclude it, go again - done by hand twenty-odd times and living entirely in the head of whoever was doing it.

That is the exact failure docs/DECISIONS.md exists to prevent, applied to procedure instead of reasoning, and it went unnoticed for as long as it did because the part that was written down was working well.

Three scripts (D050):

Measured, not asserted. run-emulator.ps1 gave Records: 554, Ended: True, Crashes: 0. sweep.ps1 went 180 → 209 → 554 COMPLETE in three rounds, finding and stepping over 040-file/open-rejects-null and 080-video/flip-rate-rejects-bad-handle without anyone watching. harvest-nids.ps1 read 96 logs for 389 pairs, then re-ran for 389 pairs and 0 new - idempotent, and the corpus keeps its provenance header.

Surprises, both environmental and both expensive:

build/ was not writable from the host. The VM mounts this repository and had created that directory as root, leaving Everyone:(RX) - so the host could not write into its own build directory. The error says only "Access to the path is denied", with nothing pointing at ownership. Reports now go to reports/.

Windows PowerShell turns a native command's stderr into an ErrorRecord. multipass transfer warns about permissions it cannot set on a Windows target, copies the file correctly, and under ErrorActionPreference = Stop that warning ends the script. The fix is to relax the preference around the call and assert by Test-Path, which is the thing actually being claimed.

Also: Select-String -SimpleMatch takes a literal pattern, so regex-escaping it first searches for the backslash. Zero matches, no error. Worth making that mistake only once.

docs/TOOLING.md was stale in a way that says something. Its script section claimed scripts/ held three, listed four, and the directory held sixteen. Rewritten and grouped by where the work happens rather than by file extension, which is the only reason there are two kinds of script here at all.

verify.sh: 86 tool tests, lints clean, all three targets, derivation agrees, payload refused as it should.