Owner ruling #26. `capability.rs::check_cell` took the declared outcome
form as BOTH the entry-point selector and the answer, so "the `ckc test`
entry, stopping before it runs" had no expressible form: a `lower:` or
`codegen:` declaration routed the cell to `ckc run`, where `test fn`
bodies are inert and the cell would have recorded a vacuous `runs:`.
Every test-path boundary that stops before running was therefore
unpinnable, and the fact lived in prose — which is what the matrix
exists to kill.

The block gains one optional FIRST line, orthogonal to the outcome:

    # capability

    entry: test
    lower: WithMutTarget

`test` is the only admitted value. `run` is the implicit default and is
NOT writable — `entry: run`, or any other value, is a fixture parse
error; values extend when a real entry point needs them, never
speculatively. A `tests:` outcome already implies the test entry (the
tally is observable nowhere else), so writing the line beside it is
refused as redundant: one spelling per fact.

Orthogonality is structural, not documented. `ck_cktest` now models a
cell as `CapabilityCell { entry, outcome }` — every `Capability` form is
reachable under either `Entry`, and `CapabilityCell::new` normalizes the
one combination that cannot exist. The harness selects the observer from
`declared.entry()` alone and pairs the observed outcome back with that
entry, so the reconciliation report prints the WHOLE block to write
rather than half of it (a moved test-entry cell can no longer be
"fixed" by silently re-homing it onto the run path). Strictness is
untouched in both directions: the observer still reports the REAL stage
the compiler stopped at.

Cells added (CELL_COUNT 344 -> 346; BROKEN and UNMARKED unchanged at
39 / 149) — a PAIR over one byte-identical page, which is the
mechanism's proof and the discriminator:

- a_test_body_that_does_not_lower_stops_the_test_entry — WORKS,
  `entry: test` + `lower: WithMutTarget`. A record-valued `with mut`
  inside a top-level `test fn`. The first fact in the matrix the old
  selector could not express.
- a_test_body_that_does_not_lower_is_inert_on_the_run_path — BY DESIGN,
  `runs: 42`. The same page under the run entry: the body is never
  lowered, so the app runs to 42. If the run path ever emitted test
  bodies this cell would stop being a run at all.

Both retire together when the M4 ownership checker lands and
record-valued `with mut` lowers.

The 3c-ii workaround cells pinned at `fn main` are untouched — they are
valid facts about `fn main`. Probed with the real CLI before authoring:
`ckc run` -> exit 42, `ckc test` -> "lowering failed: the `with mut`
target ... does not lower yet", same project, same stdlib.

tests/README.md and tests/capability/README.md carry the two-axis
contract; the harness module doc records it as the ADR.

Gates: `cargo fmt --check` clean; `cargo clippy --all-targets -D
warnings` clean, 0 warnings; `cargo test --workspace` exit 0 — 1482
passed / 0 failed / 1 ignored across 93 binaries; capability 2 passed
(346 cells reconciled); ck_cktest 43 passed.

@@ -434,0 +645,4 @@
+        let test = parse(src).unwrap();
+        let blessed = render_blessed(&test, "capability");
+        assert!(blessed.contains("# capability\n\nentry: test\nlower: WithMutTarget\n"));
+        assert_eq!(parse(&blessed).unwrap().capability, test.capability);