@bastani/atomic 0.9.39 → 0.9.40-alpha.2

package/dist/builtin/workflows/skills/impeccable/reference/new-work.md

@@ -38,7 +38,7 @@ Keep the visual system fixed. Derive five to seven materially different structur
 
 `.pi/skills/impeccable/scripts/impeccable concept-seed --scope surface --mode <mode>`
 
-The script deals three of your structures; the dice pick which three reach the user, breaking the ranking rut while the user keeps a real choice. Present them on the decision page as full cards of equal salience, the dealt lead under kicker THE ROLL, with steer and re-roll; the user locks one. No canon card and no pick card at surface scope: the world is settled, so every card visualizes composition, not identity. With image generation and a comp-led build path (the path the PRESENTATION block printed for this surface; the build-path paragraph below), each card declares a `comp` under `.impeccable/mocks/decision/`, generated after serving, in reading order, under [visualize.md](visualize.md)'s comp discipline and the MODE RULES block concept-seed printed for this surface. Anchor each comp on the established identity: pass a screenshot of a representative existing page as a reference image (the harness image tool's input image, or `impeccable generate-image --ref`) with a short prompt in visualize.md's shape; prose paraphrases of a design system drift, pixel references do not. Without image generation, or on a code-led round, each card carries an HTML sketch of the first viewport, declared as its `html`, which the page draws as a skeleton; the PRESENTATION block names its shape, and a card without one falls back to a `wireframe` schematic (`impeccable serve-question --schema`). Locking a card is the approval and sets the build path: a locked comp builds comp-led with that comp as the approved comp, discharging [visualize.md](visualize.md)'s three-option round with no second approval point; a locked sketch or wireframe builds code-led, its ambition carried by the direction contract, and a locked sketch is the composition the build matches. Never run the script for a local extension or a precisely specified narrow request; shape those directly.
+The script deals three of your structures; the dice pick which three reach the user, breaking the ranking rut while the user keeps a real choice. Present them on the decision page as full cards of equal salience, the dealt lead under kicker THE ROLL, with steer and re-roll; the user locks one. Each card declares `kind`: `assigned` on the dealt lead, `dealt` on the other dealt structures, and `challenger` with its `catalogId` (the SOURCE ID) on a challenger that won its place. No canon card and no pick card at surface scope: the world is settled, so every card visualizes composition, not identity. With image generation and a comp-led build path (the path the PRESENTATION block printed for this surface; the build-path paragraph below), each card declares a `comp` under `.impeccable/mocks/decision/`, generated after serving, in reading order, under [visualize.md](visualize.md)'s comp discipline and the MODE RULES block concept-seed printed for this surface. Anchor each comp on the established identity: pass a screenshot of a representative existing page as a reference image (the harness image tool's input image, or `impeccable generate-image --ref`) with a short prompt in visualize.md's shape; prose paraphrases of a design system drift, pixel references do not. Without image generation, or on a code-led round, each card carries an HTML sketch of the first viewport, declared as its `html`, which the page draws as a skeleton; the PRESENTATION block names its shape, and a card without one falls back to a `wireframe` schematic (`impeccable serve-question --schema`). Locking a card is the approval and sets the build path: a locked comp builds comp-led with that comp as the approved comp, discharging [visualize.md](visualize.md)'s three-option round with no second approval point; a locked sketch or wireframe builds code-led, its ambition carried by the direction contract, and a locked sketch is the composition the build matches. Never run the script for a local extension or a precisely specified narrow request; shape those directly.
 
 ### Create or replace the visual world
 
@@ -48,7 +48,7 @@ The script deals three of your structures; the dice pick which three reach the u
 4. Run `.pi/skills/impeccable/scripts/impeccable concept-seed --scope direction --mode <mode>` and follow what it prints. No substitute, no skip: on a new or replacement world, writing artifact code before this script has run and its assignment is acknowledged is a contract violation, whatever the harness, the model, or the time pressure; the roll is what keeps every run from converging on the category default. The script assigns the direction to build and deals catalog challengers. Fuse each challenger before judging it: the challenger supplies the form and its system grammar, the product supplies every fact, clarity wins conflicts. Weigh fused challengers against the assigned direction on exactly two axes, audience identification and product clarity. Losing to strong grounded material is a valid outcome; beating a thin or tool-monoculture list is the point. Close with a verdict per challenger, decided before any borrowing: wins (beats the assigned direction on both axes; becomes the build candidate), competitive (holds one axis; stays a full alternate), or declined (loses both). A declined challenger is not spent: name the one discipline of its system the assigned direction lacks, and raise the assigned direction to match before presenting it. A donation transfers ambition and system discipline (a palette's total commitment, a grid's density courage, a form's structural honesty), never the challenger's clothes. A component treatment, such as a button's shadow or a display face, is clothes, not discipline; a lifted motif is a costume note, not a raise, and one world owns the page. Write each raise into the presented direction as its own line, named for its donor; a raise nobody can read did not happen.
 5. Present one direction, fully committed and already raised by the hand it beat, raises visible as named lines: world, first viewport, visitor path, signature interaction, cross-surface reach, honest risk. Route each challenger by verdict: winning and competitive challengers are full alternates with their QUALITY BAR cards and one-line case; declined challengers render demoted, compact and quiet, each carrying its verdict and what the direction kept from it, never full-size, never silently dropped, still adoptable on request. The verdict informs the user's choice, never pre-empts it; the demoted row is the hand's proof of judgment. A hand holds at most three full-card challengers: when the roll deals more, the three strongest join and the rest wait in the re-roll pool, noted in one line; dropping a challenger from the hand itself takes a named product-truth failure, disclosed. Add one card for your own top-ranked grounded candidate when it is not the assigned direction, kicker IMPECCABLE’S PICK, same anatomy as every card, with an honest risk line naming its familiarity when true: the strongest grounded direction is often where most runs in this category land, and the user deciding that trade is the point of showing it. Familiar and effective is a legitimate destination, not a failure of nerve; the pick card and the standing exit serve it at two depths. One pick card, never two, never a ranked list: a lineup of your candidates hands selection back to a taste function and invites the safest card. The pick never takes the lead position; when the dice assign your top candidate there is no pick card, and the assigned card notes it topped your list. Add re-roll with an optional one-line steer, in three registers: plain (a fresh hand, same spread), safer (your remaining conventional grounded candidates plus the canon against named competitors), bolder (foreign forms only, at full commitment). The register is the user's steering on the familiar-to-bold axis, never yours to pre-select; when the answer carries one, re-run the seed with `--register <value>` and the next `--reroll` round, and follow what it prints. A user saying "bolder" or "safer" while a direction round is open means these registers, never the bolder or harden commands. The two channels share this structure and differ only in richness: cards and boards on the decision page, names and one-liners through the structured tool, whose option list carries the assigned direction, the pick, the winning and competitive challengers, and the standing exit last; declined challengers fold into the assigned option's description as their kept lines, so the raise survives the text channel.
 
-The standing exit: every direction round offers one quiet, permanent alternative, the category standard, played straight. It is the user's door, never yours: never recommend it, never weigh it against the roll, never let it soften the dealt directions; the counterweights bind the unchosen default, not the chosen one. When the user takes it (the canon action, a safer-steer, or plain words asking for the familiar or competitor-like path), convention becomes the commitment: ask once for two or three products this should sit alongside, make their craft level the bar, and execute the canon at full fidelity, without irony or smuggled quirk. Record a standing preference as a brand commitment in PRODUCT.md. Re-roll eliminates every direction already shown, grounded and challenger alike; after two consecutive re-rolls, ask what quality is missing. Re-roll on your own only on named factual grounds, when the assigned direction cannot carry the product's truth or task; taste is never grounds. The user may re-roll freely, and a user- or brief-pinned direction beats the roll, always. Resolve collisions field by field: preserve every user- or brief-pinned constraint. In dimensions the brief leaves open, the assignment still binds through its topology, controls, state vocabulary, and ritual; when only its materials conflict with a pinned visual direction or PRODUCT.md brand commitment, translate that material expression and name the translation in the presented direction. A look mismatch is not grounds to re-roll. Present the decision visually: write an options payload with the assigned direction leading, its raised lines included; the pick card when one exists; the dealt challengers as alternates with their QUALITY BAR cards, verdicts, and kept lines; re-roll with its safer and bolder registers; steer; canon enabled; and `buildPath` carrying the recorded default with `toggle: true` whenever image generation exists (details in the build-path paragraph below). A degraded roll with no challengers still uses the page, as a single text-only card with re-roll. Give every card the same anatomy: thesis, palette, materials, first viewport, honest risk, and the challengers' case lines (`--schema` prints the exact shape); the page renders identity from these fields, demotes declined challengers to their row on its own, and a challenger's catalog image rides as labeled inspiration, never the promise of the build. Author `canonCard` too: the category standard as one honest card, same anatomy; the page keeps it subordinate, and the counterweights still bind you. Run `.pi/skills/impeccable/scripts/impeccable serve-question --start --payload <file>` (`--schema` first for the payload shape). It daemonizes, prints the page URL and a key, and exits; open that URL for the user, in-app browser first, then the system opener, then showing the URL. Collect the choice with `--wait --key <key>`, repeating while it exits 3; the ANSWER prints as JSON. An ANSWER of `{"optionId":"reroll"}` keeps the server alive and the page open on a loading hand: rerun concept-seed with the same `--scope` and `--mode` plus `--from <seed-key> --reroll <n>` (1 on the first re-roll, counting up), build the next payload, deliver it with `--update --key <same key> --payload <file>`, then return to `--wait` on that key. Never `--start` a second server or fall back to chat here: either strands the open tab on a hand that never arrives. Exit 4 means the page closed unanswered: re-present once through the structured question tool, and with no answer there either, proceed unattended with the assigned direction and state the assumptions. A harness that can leave a shell blocked in the background may run the script without `--start` and let it auto-open and block. A harness that cannot hold a blocking `--wait` (it detaches long-running commands without ever returning their output, or reaps a backgrounded child) takes the structured tool without starting the page and discloses the substitution in the first reply, so the tab is never left unanswered. A shell that hands back a still-running command as a session you can poll holds the wait: poll that session until it exits, and rerun `--wait` only after it exits without an answer. Never predict any other fallback: run the script, and only exit code 2 from starting it, or that wait check before starting, routes the decision to the structured tool; those are the fallback, never an error to retry. concept-seed closes every roll with this procedure, condensed, as a PRESENTATION block that names the recorded build path.
+The standing exit: every direction round offers one quiet, permanent alternative, the category standard, played straight. It is the user's door, never yours: never recommend it, never weigh it against the roll, never let it soften the dealt directions; the counterweights bind the unchosen default, not the chosen one. When the user takes it (the canon action, a safer-steer, or plain words asking for the familiar or competitor-like path), convention becomes the commitment: ask once for two or three products this should sit alongside, make their craft level the bar, and execute the canon at full fidelity, without irony or smuggled quirk. Record a standing preference as a brand commitment in PRODUCT.md. Re-roll eliminates every direction already shown, grounded and challenger alike; after two consecutive re-rolls, ask what quality is missing. Re-roll on your own only on named factual grounds, when the assigned direction cannot carry the product's truth or task; taste is never grounds. The user may re-roll freely, and a user- or brief-pinned direction beats the roll, always. Resolve collisions field by field: preserve every user- or brief-pinned constraint. In dimensions the brief leaves open, the assignment still binds through its topology, controls, state vocabulary, and ritual; when only its materials conflict with a pinned visual direction or PRODUCT.md brand commitment, translate that material expression and name the translation in the presented direction. A look mismatch is not grounds to re-roll. Present the decision visually: write an options payload with the assigned direction leading, its raised lines included; the pick card when one exists; the dealt challengers as alternates with their QUALITY BAR cards, verdicts, and kept lines; re-roll with its safer and bolder registers; steer; canon enabled; and `buildPath` carrying the recorded default with `toggle: true` whenever image generation exists (details in the build-path paragraph below). A degraded roll with no challengers still uses the page, as a single text-only card with re-roll. Every option declares its identity: `kind` is `assigned`, `pick`, `challenger`, or `grounded` (another of your own grounded directions, such as each card of a safer hand's lineup, any number of them), and each challenger carries `catalogId`, the SOURCE ID concept-seed printed for its world, never the card's own id; `--start` and `--update` refuse a direction or surface payload without them, and the page reports the choice from them. Give every card the same anatomy: thesis, palette, materials, first viewport, honest risk, and the challengers' case lines (`--schema` prints the exact shape); the page renders identity from these fields, demotes declined challengers to their row on its own, and a challenger's catalog image rides as labeled inspiration, never the promise of the build. Author `canonCard` too: the category standard as one honest card, same anatomy; the page keeps it subordinate, and the counterweights still bind you. Run `.pi/skills/impeccable/scripts/impeccable serve-question --start --payload <file>` (`--schema` first for the payload shape). It daemonizes, prints the page URL and a key, and exits; open that URL for the user, in-app browser first, then the system opener, then showing the URL. Collect the choice with `--wait --key <key>`, repeating while it exits 3; the ANSWER prints as JSON. An ANSWER of `{"optionId":"reroll"}` keeps the server alive and the page open on a loading hand: rerun concept-seed with the same `--scope` and `--mode` plus `--from <seed-key> --reroll <n>` (1 on the first re-roll, counting up), build the next payload, deliver it with `--update --key <same key> --payload <file>`, then return to `--wait` on that key. Never `--start` a second server or fall back to chat here: either strands the open tab on a hand that never arrives. Exit 4 means the page closed unanswered: re-present once through the structured question tool, and with no answer there either, proceed unattended with the assigned direction and state the assumptions. A harness that can leave a shell blocked in the background may run the script without `--start` and let it auto-open and block. A harness that cannot hold a blocking `--wait` (it detaches long-running commands without ever returning their output, or reaps a backgrounded child) takes the structured tool without starting the page and discloses the substitution in the first reply, so the tab is never left unanswered. A shell that hands back a still-running command as a session you can poll holds the wait: poll that session until it exits, and rerun `--wait` only after it exits without an answer. Never predict any other fallback: run the script, and only exit code 2 from starting it, or that wait check before starting, routes the decision to the structured tool; those are the fallback, never an error to retry. concept-seed closes every roll with this procedure, condensed, as a PRESENTATION block that names the recorded build path.
 
 When image generation exists, every card also declares a `comp` path under `.impeccable/mocks/decision/`, the canon card included. Where the harness sandboxes its shell, start the page through the least-sandboxed command path it offers: a sandboxed shell cannot bind the board's port, and the first-attempt failure costs a retry every session. Serve the page first, then produce the comps; the page shimmer-waits per slot and the user may answer before they land. Load [visualize.md](visualize.md) before writing the first decision comp prompt, not at the comp round: each card's image is that direction's north-star comp at full fidelity under its comp discipline and the MODE RULES block concept-seed printed, and a prompt written before reading them misses every rule there: the requested surface as the real page, its first viewport and the start of the section below it, held like every comp to visualize.md's rule that a template skeleton stays the template whatever world paints it (your own pick included: a safe layout under a world skin is the template), a short prompt in visualize.md's shape, real product name and real content, no invented commercial claims, in that card's own palette, type character, and material world, committed all the way. Once a round declares comps it has not generated yet, `impeccable serve-question --start` (and `--update`, and a flip to comp) prints a `NEXT read <path>/visualize.md` line; read that file then, before the first prompt. `--wait` prints `COMP SIDECAR MISSING` for any landed decision comp with no prompt sidecar (the image's full file name plus `.json`: `a.png` gets `a.png.json`); write the missing sidecar before you continue. `COMP STALE` names a file an earlier round left at one of this hand's slots; regenerate it there. Generation takes the same time at any fidelity, so an unfinished draft pays comp cost for draft quality; fairness between cards is equal fidelity in each card's own grammar, one surface, one aspect, never shared unfinishedness. The frame's aspect is the surface's own: portrait at device viewport for a native app or mobile-first surface, landscape for desktop web; the decision page adapts to either, and a phone screen comped landscape is a broken frame, not a neutral default. Produce in reading order, the assigned card, then the pick, then the full-card hand, then canon, each file written with its prompt sidecar the moment it is done, so a re-roll's spend front-loads onto the cards read first; declined challengers get no comp, their catalog thumb is their face. With parallel subagents, fan out one agent per card: each spawn is the shipped asset producer with a single-comp packet, that card's fields, its world's card images when the NEXT line names them, PRODUCT.md, the shared frame, the path to visualize.md for its comp discipline, the COMPS section of the MODE RULES block copied verbatim (the subagent never sees the roll's output), and the card's declared path, up to four in flight. Regenerate inline any slot still empty when its agent returns; drop without ceremony any slot still empty when the user answers. No other supervision is owed. Without parallel subagents, generate in the main thread after serving, same order, and let the harness's own generation display carry the progress; the wait for the answer follows the last file. The chosen card's comp is not spent by the choice: comp-led, it enters the comp round as compositional option one; code-led, it returns at the finish review as the critique reference, what the image dared that the build did not. Unchosen comps stay in `.impeccable/mocks/decision/` as the round's spent hand; they carry no approval and imply none. With no image generation, cards carry their identity in palette chips and facts, and that page is complete, not a lesser version; the page then also demotes every challenger's catalog art to a labeled thumbnail on its own, because salience must encode the verdict, never the accident of which cards have images.
 
@@ -70,7 +70,7 @@ Calibration: AI-generated interfaces cluster around a few looks regardless of su
 
 ## 5. Record the decision
 
-Before code, record the chosen direction as a development-only contract under `## Direction contract` in the relevant surface brief. A direction contract is durable route or artifact strategy, so create or update the brief even when no other surface strategy needs persistence. Use six short blocks, roughly 150 words; do not spend tool calls counting words. THESIS: the one idea this surface owns and the category-default arrangement it refuses. OWN-WORLD: the palette and component language, specific enough to be recognizable with all content removed. STORY: what the visitor understands, believes, and does. FIRST VIEWPORT: the exact composition, what is where and at what scale, and where the primary action sits. FORM: the chosen form, its position on your ordered list, and the seed key the script printed. Close with one more line, FINISH: the run's exit condition, verbatim "unreviewed and undocumented is unfinished; this build ends with the finish review, the verdict, DESIGN.md, and every shipping raster carrying its provenance". The surface brief is the reminder later agents reload across edits and sessions: a page that looks complete with the FINISH line undischarged is not done, it is abandoned at the finish line. If a block reads like a mood, the direction is not decided yet; the finishing review audits the render against this contract.
+Before code, record the chosen direction as a development-only contract under `## Direction contract` in the relevant surface brief. A direction contract is durable route or artifact strategy, so create or update the brief even when no other surface strategy needs persistence. Use six short blocks, roughly 150 words; do not spend tool calls counting words. THESIS: the one idea this surface owns and the category-default arrangement it refuses. OWN-WORLD: the palette and component language, specific enough to be recognizable with all content removed. STORY: what the visitor understands, believes, and does. FIRST VIEWPORT: the exact composition, what is where and at what scale, and where the primary action sits. FORM: the chosen form, its position on your ordered list, and the SEED REFERENCE concept-seed printed (`seed:` and 16 hex), never the raw seed key: the brief is committed, and on this machine the reference stands in for the key wherever a command takes one. When the roll printed SEED REFERENCE unavailable, write `seed: none (unavailable)` instead, and nothing else. Close with one more line, FINISH: the run's exit condition, verbatim "unreviewed and undocumented is unfinished; this build ends with the finish review, the verdict, DESIGN.md, and every shipping raster carrying its provenance". The surface brief is the reminder later agents reload across edits and sessions: a page that looks complete with the FINISH line undischarged is not done, it is abandoned at the finish line. If a block reads like a mood, the direction is not decided yet; the finishing review audits the render against this contract.
 
 Never copy the direction contract into implementation source or any browser-delivered artifact. This includes HTML or framework comments, hidden DOM, `<template>` elements, `data-*` attributes, rendered JSX or TSX output, serialized props or state, React Server Component payloads, client bundles, metadata or JSON-LD, accessibility-only text, and files served beside the artifact. A compiler or optimizer removing development metadata is not a safety boundary. Reviewers and documenters receive the contract from the surface brief.
 
@@ -82,7 +82,7 @@ Read the existing surface brief before updating it:
 
 `.pi/skills/impeccable/scripts/impeccable surface-brief write <primary-target> <body-file> [related-target ...]`
 
-After writing, read the brief once more and verify that all six contract blocks and the seed key are present before building.
+After writing, read the brief once more and verify that all six contract blocks and the seed reference (or `seed: none (unavailable)` when the roll printed that) are present before building.
 
 Keep the brief small: scope and visitor mode; audience, job, action/task, proof/content, and constraints; chosen direction and memorable moment; unresolved decisions. Do not copy global product truth or DESIGN.md tokens into it.
 
@@ -98,7 +98,7 @@ Build the assigned direction, not a safer interpretation of it. The form supplie
 
 When an approved comp exists, it is a spatial contract, not a mood board: only the user can downgrade its authority, in explicit words. Models systematically believe their HTML, CSS, and SVG recreation of an image succeeded when it did not, so the build runs as a state machine on disk whose gates measure the screen against the comp instead of asking you to remember it. Start it once, and let it tell you what is next:
 
-`.pi/skills/impeccable/scripts/impeccable build-phase start --direction <seed key> --artifact <entry file>` right after the direction choice, adding `--decision-comp <path>` when the chosen card has a decision comp (the path CHOSEN COMP names) so the comps gate counts it as option one, or `start --comp <approved comp> --artifact <entry file>` when a surface round already locked one. Start is not the choice ping: that is the `concept-seed --kind` rerun the roll's TELEMETRY line names, sent once when the roll printed one.
+`.pi/skills/impeccable/scripts/impeccable build-phase start --direction <seed reference, or none when it was unavailable> --artifact <entry file>` right after the direction choice, adding `--decision-comp <path>` when the chosen card has a decision comp (the path CHOSEN COMP names) so the comps gate counts it as option one, or `start --comp <approved comp> --artifact <entry file>` when a surface round already locked one. Start is not the choice ping: that is the `concept-seed --kind` rerun the roll's TELEMETRY line names, sent once when the roll printed one.
 
 Then, in order, each closed by `.pi/skills/impeccable/scripts/impeccable build-phase advance` (every verb below runs as `.pi/skills/impeccable/scripts/impeccable <verb>`; exit 2 means the gate failed and printed why; fix that and advance again; write nothing for a later phase while an earlier gate is open):
 
@@ -133,7 +133,7 @@ Preserve semantics, accessibility, performance, responsiveness, project conventi
 
 ## 7. Inspect and finish
 
-Inspect the surface's target sizes in one batched screenshot round: desktop and mobile on the web; on a native platform (`ios` / `android` / `adaptive`), the shipped device classes per OS, captured from the simulator or emulator the way the platform reference's Verifying the build section describes. When the harness reports the user's actual viewport (an in-app browser's size, a named resolution), add that width to the set: the width that breaks is the one the user sees first. Critique the render against the user's request and the direction contract, fix material gaps, and confirm with one final round; two rounds is the ceiling, and fixes batch between them rather than earning per-tweak screenshots. The ceiling bounds inspection and never closes an open build-phase gate: a gate stays open until it passes or the route it names is taken. On a comp-led build, run `.pi/skills/impeccable/scripts/impeccable comp-diff --comp <approved comp> --build .impeccable/review/desktop.png --spec .impeccable/build/spec.json --out-dir .impeccable/review/diff/final` and read its region rows and paired crops as the critique: the side-by-side is the view the build thread never has on its own, and a region it scores missing or contradicted is a fix whatever the page looks like from memory. Never judge fidelity from one full-page thumbnail; it hides exactly the failures that matter. On a Persuade surface, verify the mode did its job: a first-time visitor should know what this is, why it matters, and what to do within seconds, in the form's own vocabulary.
+Inspect the surface's target sizes in one batched screenshot round: desktop and mobile on the web; on a native platform (`ios` / `android` / `adaptive`), the shipped device classes per OS, captured from the simulator or emulator the way the platform reference's Verifying the build section describes. When the harness reports the user's actual viewport (an in-app browser's size, a named resolution), add that width to the set: the width that breaks is the one the user sees first. On anything interactive, the round drives every interaction and reachable state (open, closed, hover, focus, error, empty, overlong content) and checks each for overlap and clipping, not only the resting screen. Critique the render against the user's request and the direction contract, fix material gaps, and confirm with one final round; two rounds is the ceiling, and fixes batch between them rather than earning per-tweak screenshots. The ceiling bounds inspection and never closes an open build-phase gate: a gate stays open until it passes or the route it names is taken. On a comp-led build, run `.pi/skills/impeccable/scripts/impeccable comp-diff --comp <approved comp> --build .impeccable/review/desktop.png --spec .impeccable/build/spec.json --out-dir .impeccable/review/diff/final` and read its region rows and paired crops as the critique: the side-by-side is the view the build thread never has on its own, and a region it scores missing or contradicted is a fix whatever the page looks like from memory. Never judge fidelity from one full-page thumbnail; it hides exactly the failures that matter. On a Persuade surface, verify the mode did its job: a first-time visitor should know what this is, why it matters, and what to do within seconds, in the form's own vocabulary.
 
 A capture is evidence only when it is valid, and you validate before you send. Settle or disable entrance motion first: an element hidden by animation timing reads as a missing element and gets fixed into a regression. Capture full-page shots from the document top. Capture the comp comparison at the comp's own pixel dimensions. Then open every file once and confirm it shows what its name claims: no black or blank regions, no wrong section behind a right filename, no half-loaded state. A malformed capture sent onward costs the whole round; the reviewer answers it with `disposition: recapture` and nothing it reviewed binds.
 

package/dist/builtin/workflows/skills/impeccable/reference/onboard.md

@@ -23,7 +23,7 @@ Understand what users need to learn and why:
    - What's the key action we want them to take? (First project? First invite?)
    - How do we know onboarding worked? (Completion rate? Time to value?)
 
-**CRITICAL**: Onboarding should get users to value as quickly as possible, not teach everything possible.
+Onboarding should get users to value as quickly as possible, not teach everything possible.
 
 ## Onboarding Principles
 
@@ -208,9 +208,9 @@ localStorage.setItem('onboarding-completed', 'true');
 localStorage.setItem('feature-tooltip-seen-reports', 'true');
 ```
 
-**IMPORTANT**: Don't show same onboarding twice (annoying). Track completion and respect dismissals.
+Show onboarding once: track completion and respect dismissals.
 
-**NEVER**:
+**Avoid**:
 - Force users through long onboarding before they can use product
 - Patronize users with obvious explanations
 - Show same tooltip repeatedly (respect dismissals)

package/dist/builtin/workflows/skills/impeccable/reference/optimize.md

@@ -17,7 +17,7 @@ Understand current performance and identify problems:
    - How bad is it? (Perceivable? Annoying? Blocking?)
    - Who's affected? (All users? Mobile only? Slow connections?)
 
-**CRITICAL**: Measure before and after. Premature optimization wastes time. Optimize what actually matters.
+Measure before and after. Optimizing without a measurement spends effort on things that do not matter.
 
 ## Optimization Strategy
 
@@ -233,9 +233,9 @@ const observer = new IntersectionObserver((entries) => {
 - Bundle size
 - Request count
 
-**IMPORTANT**: Measure on real devices with real network conditions. Desktop Chrome with fast connection isn't representative.
+Measure on real devices with real network conditions. Desktop Chrome on a fast connection isn't representative.
 
-**NEVER**:
+**Avoid**:
 - Optimize without measuring (premature optimization)
 - Sacrifice accessibility for performance
 - Break functionality while optimizing

package/dist/builtin/workflows/skills/impeccable/reference/overdrive.md

@@ -7,7 +7,7 @@ Start your response with:
 
 Push an interface past conventional limits. This isn't just about visual effects. It's about using the full power of the browser to make any part of an interface feel extraordinary: a table that handles a million rows, a dialog that morphs from its trigger, a form that validates in real-time with streaming feedback, a page transition that feels cinematic.
 
-**EXTRA IMPORTANT FOR THIS COMMAND**: Context determines what "extraordinary" means. A particle system on a creative portfolio is impressive. The same particle system on a settings page is embarrassing. But a settings page with instant optimistic saves and animated state transitions? That's extraordinary too. Understand the project's personality and goals before deciding what's appropriate.
+Context decides what "extraordinary" means. A particle system on a creative portfolio is impressive. The same particle system on a settings page is embarrassing. But a settings page with instant optimistic saves and animated state transitions? That's extraordinary too. Understand the project's personality and goals before deciding what's appropriate.
 
 ### Propose Before Building
 
@@ -19,9 +19,9 @@ This command has the highest potential to misfire. Do NOT jump straight into imp
 
 Skipping this step risks building something embarrassing that needs to be thrown away.
 
-### Iterate with Browser Automation
+### Verify in the Browser
 
-Technically ambitious effects almost never work on the first try. You MUST actively use browser automation tools to preview your work, visually verify the result, and iterate. Do not assume the effect looks right, check it. Expect multiple rounds of refinement. The gap between "technically works" and "looks extraordinary" is closed through visual iteration, not code alone.
+Ambitious effects rarely work on the first try, so verify them in the browser rather than from code: an effect that technically runs can still stutter, ease wrong, or land on the wrong frame. Aim the checks at timing, easing, and smoothness, batch the fixes between looks, and keep refining until the effect is extraordinary.
 
 ---
 

package/dist/builtin/workflows/skills/impeccable/reference/quieter.md

@@ -30,7 +30,7 @@ Analyze what makes the design feel too intense:
 
 If any of these are unclear from the codebase, do not guess. Ask the user directly to clarify what you cannot infer.
 
-**CRITICAL**: "Quieter" doesn't mean boring or generic. It means refined and easier on the eyes. Think luxury, not laziness.
+"Quieter" means refined and easier on the eyes, not generic. Generic quiet looks like gray text on white, one sans at a uniform weight, and a grid of identical cards; restraint still needs a point of view.
 
 ## Plan Refinement
 
@@ -41,7 +41,7 @@ Create a strategy to reduce intensity while maintaining impact:
 - **Simplification approach**: What can be removed entirely?
 - **Sophistication approach**: How can we signal quality through restraint?
 
-**IMPORTANT**: Subtlety requires precision. Quiet without intent collapses to generic.
+Subtlety requires precision. Quiet without intent collapses to generic.
 
 ## Refine the Design
 
@@ -80,7 +80,7 @@ Systematically reduce intensity across these dimensions:
 - **Align to grid**: Bring rogue elements back into systematic alignment
 - **Even out spacing**: Replace extreme spacing variations with consistent rhythm
 
-**NEVER**:
+**Avoid**:
 - Make everything the same size/weight (hierarchy still matters)
 - Remove all color (quiet ≠ grayscale)
 - Eliminate all personality (maintain character through refinement)

package/dist/builtin/workflows/skills/impeccable/reference/typeset.md

@@ -56,6 +56,16 @@ Use the fewest roles and families that make the hierarchy unmistakable. Combine
 
 Do not make type decorative at the expense of comprehension, or introduce a second family without a clear role it alone can perform.
 
+## Line breaks
+
+After Matthew Butterick's *Practical Typography*, paraphrased; where his numbers differ from these, these stand.
+
+- Set `text-wrap: balance` on headings and short centered blocks, and `text-wrap: pretty` on body copy. Both are progressive: a browser that ignores them keeps its default wrap.
+- `pretty` pulls a word down beside a lone last word. It does not fill the last line, and a two-word tail is fine.
+- In a column too narrow for either to help, edit the copy or widen the column.
+- Break a heading by hand only between phrases, and check the break at every width the heading renders at. A hard break that lands mid-line on a phone is worse than the default wrap.
+- An uneven break can carry meaning: a headline that lands on one word for weight, a poster line, a pull quote. Make it deliberate with a hard break or a wrap set on that element, and keep it rare. The detector's `straggler` and `unbalanced-heading` findings are advisory for this reason; say which breaks are intended.
+
 ## Verify
 
 - Primary, secondary, body, and metadata roles are recognizable without reading the copy.

package/dist/builtin/workflows/skills/impeccable/reference/visualize.md

@@ -6,7 +6,7 @@ A probe tests composition, narrative, hierarchy, density, focal moment, signatur
 
 ## Generate three compositional options
 
-The comp round runs inside the build's phase state: `impeccable build-phase start --direction <seed key>` has already run (with `--decision-comp <path>` when the chosen card has a decision comp) and its `comps` phase is open before the first comp is generated; a comp rendered before that sits outside the state, and a session resumed from that point has no phases to follow. `impeccable generate-image` refuses to write under `.impeccable/mocks/` until start has run; a harness-native image tool is bound by the same order.
+The comp round runs inside the build's phase state: `impeccable build-phase start --direction <seed reference>` has already run (with `--decision-comp <path>` when the chosen card has a decision comp) and its `comps` phase is open before the first comp is generated; a comp rendered before that sits outside the state, and a session resumed from that point has no phases to follow. `impeccable generate-image` refuses to write under `.impeccable/mocks/` until start has run; a harness-native image tool is bound by the same order.
 
 Render three distinct high-fidelity north-star comps of the requested surface, saved under `.impeccable/mocks/` so they survive the session. When the chosen card has a decision comp, it is option one: it stays at its path under `.impeccable/mocks/decision/`, where the gate counts it through `--decision-comp`, and is never regenerated; render the other two. Comp at the surface's own viewport: portrait at device size for a native app or mobile-first surface, desktop landscape otherwise; a phone screen comped landscape misstates the composition before anything is built against it. Comps are the build thread's own work, never delegated: the thread that writes the prompts holds the direction's full context and has seen every comp when the build starts. Open every image by its workspace-relative path; sandboxed viewers reject absolute paths, and everything under the project root has a relative one. Base the comps on real content and the surface concepts already developed with the user. On an established world, anchor every comp on the real identity: capture a screenshot of a representative existing page and pass it as a reference image (the harness image tool's input image, or `impeccable generate-image --ref`); the prompt leads with the new surface's structure while the reference carries palette, type, and component character, because DESIGN.md words alone drift where a pixel reference does not. Name what the reference contributes and what it must not: chrome, palette, type, and component character carry over; the reference page's own content does not, and a banner, hero, or card lifted verbatim is the reference leaking, not fidelity. Three is the number: one comp invites rubber-stamping; the spread between three surfaces the composition worth building. The chosen card's decision comp is the first of the three: it already renders this direction at full fidelity under this discipline, so generate two more that vary what the first held fixed, from the direction in words rather than with the first comp as an input image (a reference image anchors the layout, and three comps collapse into one composition). How comps two and three vary from the first is the mode's call, in its COMPS rules. A variant that simplifies the first into a tidier version of itself adds no choice to the round. Send all three to the approval point together. Only a round arriving with no decision comp (a degraded roll, an identity-mode page, a direction pinned without the decision round) renders all three here.
 

package/dist/builtin/workflows/skills/impeccable/scripts/VERSION

@@ -1 +1 @@
-0.1.14
+0.1.16

package/dist/builtin/workflows/skills/impeccable/scripts/impeccable

@@ -130,6 +130,12 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
   [ "$os" = windows ] && asset="$asset.exe"
   url="$base/engine-v$version/$asset"
   tmp="$cache_root/bin/$version/.impeccable.part.$$"
+  # An interrupted download (Ctrl-C, a hook timeout) would otherwise leave the
+  # PID-named staging file behind for good. The handlers must exit explicitly.
+  cleanup() { rm -f "$tmp" "$tmp.sha256" 2>/dev/null || :; }
+  trap 'cleanup; exit 129' HUP
+  trap 'cleanup; exit 130' INT
+  trap 'cleanup; exit 143' TERM
   if ! mkdir -p "$cache_root/bin/$version" 2>/dev/null; then
     echo "impeccable: engine $version is not installed; cannot create cache directory: $cache_root/bin/$version" >&2
     setup_help

package/dist/builtin/workflows/skills/impeccable/scripts/impeccable.cmd

@@ -78,20 +78,37 @@ if exist "%IMPECCABLE_HOME%\bin\%version%\" goto cache_ready
 mkdir "%IMPECCABLE_HOME%\bin\%version%" >nul 2>nul
 if errorlevel 1 goto cache_directory_failed
 :cache_ready
-rem Check the staging file too: an existing directory may be read-only.
+rem Stage the download in a directory only this run owns, as the sh launcher
+rem does with .impeccable.part.$$: concurrent first runs (parallel hooks, two
+rem agents) must never write, hash or move each other's files. mkdir fails
+rem when the name exists, so it claims the name atomically. RANDOM alone is
+rem not enough because cmd seeds it from the clock in whole seconds; the
+rem timestamp and the retry on collision keep same-second runs apart. A cache
+rem directory that refuses every mkdir is reported as unwritable.
+set "attempt=0"
+:claim_staging
+set /a attempt+=1
+if %attempt% GTR 20 goto cache_write_failed
+set "stamp=%TIME: =0%"
+set "stamp=%stamp::=%"
+set "stamp=%stamp:.=%"
+set "stamp=%stamp:,=%"
+set "staging=%IMPECCABLE_HOME%\bin\%version%\.impeccable.part.%stamp%-%RANDOM%%RANDOM%"
+mkdir "%staging%" >nul 2>nul
+if errorlevel 1 goto claim_staging
+set "part=%staging%\impeccable.exe"
+set "sidecar=%staging%\impeccable.sha256"
 rem Redirection failures do not reliably update ERRORLEVEL in cmd.exe;
-rem branch on the command's failure directly. Never treat a directory as a
-rem staging file (later del cleanup would prompt to delete its contents).
-if exist "%cached%.part\" goto cache_write_failed
-(type nul >"%cached%.part") 2>nul || goto cache_write_failed
+rem branch on the command's failure directly.
+(type nul >"%part%") 2>nul || goto staging_write_failed
 set "asset=impeccable-windows-%arch%.exe"
 set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
-curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
 if not errorlevel 1 goto verify
 if not "%arch%"=="arm64" goto download_failed
 set "asset=impeccable-windows-x64.exe"
 set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
-curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
+curl.exe -fsSL -o "%part%" "%url%" >nul 2>nul
 if errorlevel 1 goto download_failed
 
 :verify
@@ -101,61 +118,67 @@ rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
 rem runs only after verifying against its .sha256 sidecar. A sidecar that
 rem cannot be fetched, or an empty certutil result, refuses the download
 rem instead of running an unverified binary.
-curl.exe -fsSL -o "%cached%.sha256" "%url%.sha256" >nul 2>nul
+curl.exe -fsSL -o "%sidecar%" "%url%.sha256" >nul 2>nul
 if errorlevel 1 goto verify_refuse
 set "expected="
-set /p expected=<"%cached%.sha256"
+set /p expected=<"%sidecar%"
 for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
 call :check_download
 if errorlevel 1 exit /b 127
 set "actual="
 rem Reuse the sidecar staging file after reading expected. Check certutil's
 rem status before parsing: its error text on stdout is not a digest.
-certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
+certutil -hashfile "%part%" SHA256 >"%sidecar%" 2>nul
 if errorlevel 1 goto verify_refuse
 call :check_download
 if errorlevel 1 exit /b 127
-for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
-del "%cached%.sha256" >nul 2>nul
+for /f "usebackq skip=1 delims=" %%h in ("%sidecar%") do if not defined actual set "actual=%%h"
+del "%sidecar%" >nul 2>nul
 if not defined expected goto verify_refuse
 if not defined actual goto verify_refuse
 set "actual=%actual: =%"
 if /I "%actual%"=="%expected%" goto place
-del "%cached%.part" >nul 2>nul
+call :discard_staging
 echo impeccable: checksum mismatch downloading %url% 1>&2
 exit /b 127
 
 :verify_refuse
 call :check_download
 if errorlevel 1 exit /b 127
-del "%cached%.part" >nul 2>nul
-del "%cached%.sha256" >nul 2>nul
+call :discard_staging
 echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
 exit /b 127
 
 :check_download
 set "download_file=%~1"
-if not defined download_file set "download_file=%cached%.part"
+if not defined download_file set "download_file=%part%"
 if not exist "%download_file%" goto download_missing
 for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
 exit /b 0
 
 :download_missing
-del "%cached%.sha256" >nul 2>nul
+call :discard_staging
 echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
 exit /b 127
 
 :download_empty
 del "%download_file%" >nul 2>nul
-del "%cached%.sha256" >nul 2>nul
+call :discard_staging
 echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
 exit /b 127
 
+:discard_staging
+rem Removes this run's staging directory and whatever is left in it. Never
+rem touches another run's staging directory or the cached binary.
+if defined staging rd /s /q "%staging%" >nul 2>nul
+exit /b 0
+
 :place
 call :check_download
 if errorlevel 1 exit /b 127
-move /y "%cached%.part" "%cached%" >nul 2>nul
+move /y "%part%" "%cached%" >nul 2>nul
 if errorlevel 1 goto place_failed
+call :discard_staging
 call :check_download "%cached%"
 if errorlevel 1 exit /b 127
 set "run=%cached%"
@@ -164,7 +187,7 @@ goto run
 :place_failed
 call :check_download
 if errorlevel 1 exit /b 127
-del "%cached%.part" >nul 2>nul
+call :discard_staging
 echo impeccable: could not cache the verified download: %url% 1>&2
 exit /b 127
 
@@ -193,6 +216,9 @@ exit /b 0
 echo impeccable: engine %version% is not installed; cannot create cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
 goto setup_failed
 
+:staging_write_failed
+call :discard_staging
+
 :cache_write_failed
 echo impeccable: engine %version% is not installed; cannot write to cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
 goto setup_failed
@@ -202,7 +228,7 @@ echo impeccable: cannot download engine %version%; curl.exe is unavailable. 1>&2
 goto setup_failed
 
 :download_failed
-del "%cached%.part" >nul 2>nul
+call :discard_staging
 echo impeccable: could not download engine %version% from %url%; check network access and the release URL. 1>&2
 
 :setup_failed
@@ -212,7 +238,6 @@ echo Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCA
 exit /b 127
 
 :fail
-del "%cached%.part" >nul 2>nul
 echo impeccable: no engine binary found (looked in %bin%, %cached%, PATH). 1>&2
 echo Download impeccable-windows-%arch%.exe from https://github.com/pbakaus/impeccable/releases (tag engine-v%version%) and save it as %cached%, or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style 1>&2
 exit /b 127

package/dist/builtin/workflows/skills/impeccable/scripts/live-browser-dom.js

@@ -85,7 +85,10 @@
     }
 
     function id8() {
-      if (crypto?.randomUUID) return crypto.randomUUID().replace(/-/g, '').slice(0, 8);
+      // randomUUID is secure-context only (issue #1055); getRandomValues is not.
+      try {
+        if (typeof crypto?.randomUUID === 'function') return crypto.randomUUID().replace(/-/g, '').slice(0, 8);
+      } catch { /* fall through */ }
       // Insecure-context fallback (plain-http LAN preview): still draw from the
       // CSPRNG. Math.random here was flagged by CodeQL (js/insecure-randomness)
       // because these ids name live-edit sessions.
@@ -200,6 +203,35 @@
       return el;
     }
 
+    // Copy text through a selected textarea and execCommand, for origins where
+    // navigator.clipboard is missing or refused (plain HTTP, issue #1055).
+    // The textarea mounts like any page-level chrome, so while a modal
+    // <dialog> is open it sits in that dialog's top-layer host: on <body> it
+    // would be inert, and inert text cannot be selected or copied.
+    function copyTextViaSelection(text) {
+      let ta = null;
+      const previous = activeElementDeep();
+      try {
+        ta = doc.createElement('textarea');
+        ta.id = prefix + '-clipboard';
+        ta.value = text;
+        ta.setAttribute('readonly', '');
+        ta.setAttribute('aria-hidden', 'true');
+        ta.tabIndex = -1;
+        ta.style.cssText = 'position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none;';
+        uiAppendToPage(ta);
+        ta.select();
+        return doc.execCommand('copy');
+      } catch {
+        return false;
+      } finally {
+        ta?.remove();
+        if (previous && previous !== activeElementDeep() && typeof previous.focus === 'function') {
+          try { previous.focus({ preventScroll: true }); } catch { /* best effort */ }
+        }
+      }
+    }
+
     function uiAppend(el) {
       const uiRoot = liveUiRoot();
       if (uiRoot === doc.body) return uiAppendToPage(el);
@@ -267,6 +299,7 @@
       liveUiRoot,
       uiAppend,
       uiAppendToPage,
+      copyTextViaSelection,
       topLayerHost,
       watchModalDialogs,
       cloneWithoutChrome,

package/dist/builtin/workflows/skills/impeccable/scripts/live-browser-session.js

@@ -8,6 +8,30 @@
 (function (root) {
   'use strict';
 
+  // crypto.randomUUID() exists only in secure contexts (HTTPS, localhost), so a
+  // dev site on a LAN IP, a Tailscale address, or a custom hostname over plain
+  // HTTP has no randomUUID at all (issue #1055). getRandomValues() is available
+  // in every context, so the fallback still draws from the CSPRNG: the upstream
+  // Math.random last resort is the insecure-randomness class CodeQL flagged in
+  // the id8 helper, and these ids name live-edit sessions.
+  function randomUUID(cryptoImpl) {
+    const c = cryptoImpl === undefined ? root.crypto : cryptoImpl;
+    try {
+      if (c && typeof c.randomUUID === 'function') return c.randomUUID();
+    } catch { /* fall through to getRandomValues */ }
+    const bytes = new Uint8Array(16);
+    (c || crypto).getRandomValues(bytes);
+    bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
+    bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC 4122 variant
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    return hex.slice(0, 8) + '-' + hex.slice(8, 12) + '-' + hex.slice(12, 16)
+      + '-' + hex.slice(16, 20) + '-' + hex.slice(20);
+  }
+
+  function randomId8(cryptoImpl) {
+    return randomUUID(cryptoImpl).replace(/-/g, '').slice(0, 8);
+  }
+
   function createLiveBrowserSessionState({ prefix, storage, idFactory }) {
     if (!prefix) throw new Error('prefix required');
     const store = storage || root.localStorage;
@@ -150,5 +174,5 @@
     };
   }
 
-  root.__IMPECCABLE_LIVE_SESSION__ = { createLiveBrowserSessionState };
+  root.__IMPECCABLE_LIVE_SESSION__ = { createLiveBrowserSessionState, randomUUID, randomId8 };
 })(typeof window !== 'undefined' ? window : globalThis);

package/dist/builtin/workflows/skills/impeccable/scripts/live-browser.js

@@ -61,11 +61,19 @@
   const IMPECCABLE_COMMAND = (window.__IMPECCABLE_COMMAND_PREFIX__ || '/') + 'impeccable';
   const PICK_CURSOR_STYLE_ID = PREFIX + '-pick-cursor-style';
   const MANUAL_APPLY_STATE_TTL_MS = 15 * 60 * 1000;
-  const sessionState = window.__IMPECCABLE_LIVE_SESSION__?.createLiveBrowserSessionState({
-    prefix: PREFIX,
-    storage: localStorage,
-    idFactory: () => crypto.randomUUID().replace(/-/g, '').slice(0, 8),
-  });
+  // No idFactory: the session helper's default works on plain-HTTP origins,
+  // where the secure-context-only randomUUID does not exist (issue #1055).
+  let sessionState = null;
+  try {
+    sessionState = window.__IMPECCABLE_LIVE_SESSION__?.createLiveBrowserSessionState({
+      prefix: PREFIX,
+      storage: localStorage,
+    });
+  } catch (err) {
+    console.error('[impeccable] Live mode could not create its session state.', err);
+    window.__IMPECCABLE_LIVE_INIT__ = false; // let a later injection retry
+    return;
+  }
   if (!sessionState) {
     console.error('[impeccable] live-browser-session.js was not loaded. Live mode cannot start safely.');
     window.__IMPECCABLE_LIVE_INIT__ = false;
@@ -293,6 +301,7 @@
     liveUiRoot,
     uiAppend,
     uiAppendToPage,
+    copyTextViaSelection,
     topLayerHost,
     watchModalDialogs,
     cloneWithoutChrome,
@@ -7120,6 +7129,10 @@
   //
 
   function startScrollTracking() {
+    // Idempotent: callers overlap (showBar starts tracking, then the agent
+    // pick path starts it again), and a second loop would never be cancelled
+    // because scrollRaf only remembers the latest one (#1002).
+    stopScrollTracking();
     function tick() {
       if (state === 'CONFIGURING' || state === 'GENERATING' || state === 'CYCLING') {
         if (isInsertGeneratingSession()) ensureInsertPlaceholder();
@@ -13461,12 +13474,24 @@ void main() {
       .replace(/'/g, ''');
   }
 
+  // navigator.clipboard exists only in secure contexts, and writeText can
+  // reject even where it exists (no focus, permission). Fall back
+  // to the DOM helpers' selection copy (execCommand), which plain-HTTP origins
+  // still allow and which stays usable under an open modal dialog.
   function copyToClipboard(text) {
     if (!text) return;
+    const report = (ok) => showToast(ok ? 'Copied: ' + text : 'Could not copy: ' + text);
+    let pending = null;
     try {
-      navigator.clipboard.writeText(text);
-      showToast('Copied: ' + text);
-    } catch { /* ignore */ }
+      if (navigator.clipboard && typeof navigator.clipboard.writeText === 'function') {
+        pending = navigator.clipboard.writeText(text);
+      }
+    } catch { pending = null; }
+    if (pending && typeof pending.then === 'function') {
+      pending.then(() => report(true), () => report(copyTextViaSelection(text)));
+      return;
+    }
+    report(copyTextViaSelection(text));
   }
 
   //

package/dist/builtin/workflows/src/durable/journal/resolution.d.ts

@@ -7,13 +7,13 @@ export interface RunJournalSettings {
     };
     storage?: StorageSettingsSelection;
 }
-export declare function selectRunJournal(options?: {
+export interface RunJournalResolutionOptions {
     journal?: RunJournalOption;
     settings?: RunJournalSettings;
-}): StorageSelection | RunJournal;
-export declare function resolveRunJournal(options?: {
-    journal?: RunJournalOption;
-    settings?: RunJournalSettings;
-}): Promise<RunJournal>;
-export declare function openSelectedRunJournal(selection: StorageSelection | RunJournal): Promise<RunJournal>;
+    /** The agent directory the owning session resolved its storage against; defaults to `getAgentDir()`. */
+    agentDir?: string;
+}
+export declare function selectRunJournal(options?: RunJournalResolutionOptions): StorageSelection | RunJournal;
+export declare function resolveRunJournal(options?: RunJournalResolutionOptions): Promise<RunJournal>;
+export declare function openSelectedRunJournal(selection: StorageSelection | RunJournal, agentDir?: string): Promise<RunJournal>;
 export declare function withRunJournalConfigSource<T>(selection: StorageSelection | RunJournal, open: () => Promise<T>): Promise<T>;