Require bounded normal, failure and recovery journey checks

.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "A 54-phase technology-neutral audit taxonomy, plus domain overlays for the failure classes generic checklists cannot cover",
-    "version": "1.8.1"
+    "version": "1.9.0"
   },
   "plugins": [
     {
       "name": "audit-protocol",
       "source": "./",
       "description": "Audits a code change against a 54-phase failure taxonomy and reports what it did not check, not just what it found. Domain overlays run first and force critical-path treatment.",
-      "version": "1.8.1",
+      "version": "1.9.0",
       "author": {
         "name": "sturec5"
       },

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "audit-protocol",
   "description": "Audits a code change against a 54-phase failure taxonomy and reports what it did not check, not just what it found. Domain overlays run first and force critical-path treatment.",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "author": {
     "name": "sturec5"
   },

AUDIT_PROTOCOL.md

@@ -510,6 +510,17 @@ and never converted into silent corruption.
 - retried operations are idempotent or protected by an idempotency key
 - logs retain a correlation identifier without recording sensitive data
 
+For each user journey selected for this audit, where applicable:
+- Exercise normal use, one representative failure, and recovery after
+  the failure clears.
+- Activate the actual recovery control and verify the intended result;
+  rendering a retry button does not establish that retry works.
+- Reuse relevant evidence. Identify source-only, simulated, and executed
+  checks, including environment/version limits. Missing execution
+  evidence remains explicit.
+- Stay within the agreed scope. Do not enumerate every failure
+  combination or build new infrastructure merely for completeness.
+
 **Output:**
 
 - failure trigger, blast radius, recovery behavior, and observable evidence