@bongos/core 1.19.461 → 1.19.462

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.461",
-  "core_contract": "1.19.461",
-  "source_commit": "c90f2d3b84966cebe03459eff83dddb8f458c871",
+  "core_version": "1.19.462",
+  "core_contract": "1.19.462",
+  "source_commit": "5a6c95f3a72c1ce7545fae6790a64a9350e51421",
   "source_ref": "HEAD",
-  "built_at": "2026-09-01T23:39:44.285Z",
+  "built_at": "2026-09-02T00:41:58.939Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 380,
+    "docs_redacted": 400,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 1816,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2220,
-  "tree_sha256": "4c595d2e8e84883925a96367ebdcb500c59ca83987e4b0ef21fc52bfcf20ef08",
+  "file_count": 2240,
+  "tree_sha256": "5374e542955404a28c6fca59d1b6a97bb38c97bf041d54ee23d33fc042b2c1d8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -127,7 +127,7 @@
     {
       "path": ".claude/skills/design/SKILL.md",
       "mode": "0000644",
-      "sha256": "ced60ba6ce3e6b8295e3fa9986234f6bb9be8cd4a941ce801af47591928cb270"
+      "sha256": "c1ed5d4eaffffde255ac3308490d86f0235b9ab66a9349684652bb3eae82ae57"
     },
     {
       "path": ".claude/skills/dev/SKILL.md",
@@ -1609,10 +1609,15 @@
       "mode": "0000644",
       "sha256": "8e121001f8ff3f854c5efe461aabb17dc4f81e49ca262b2cadf4717c49b11bb0"
     },
+    {
+      "path": "docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md",
+      "mode": "0000644",
+      "sha256": "aed01aaa88a3deb1fbf15a1183f07954db0c7867272e7c6bd9dd0b74327c6c34"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "441c2773abced552c433f5c54a52fd4924e674c304360c9c3c6d962fedb33fc3"
+      "sha256": "f27631d3aa68cf8855420f62c4de01dd0c817d3b014e738fa1579bf92bfa16a3"
     },
     {
       "path": "docs/api-reference.md",
@@ -2092,7 +2097,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "2164f82effe472df69ccf7c05787060ea6d108c4dfa3e74064a6f23623eb018b"
+      "sha256": "dfa54c74d708e6e1375c57eb28cbe638ac5396cbbb42aad438801a47e886f72a"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2102,7 +2107,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0ebc5de06d0b5454d8509fbd60ad81f7107414610a1afb8cc363c3cf7a0473be"
+      "sha256": "6dcd4c63eea2f0929fb8523047a2c91ef718040f5df303e2f9fe80adae51b400"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6342,7 +6347,7 @@
     {
       "path": "modules/ui-design/module.json",
       "mode": "0000644",
-      "sha256": "31e80de5f689a2bdaf5eb0ebbb31cc96de99b2e1fe31b0eba9d7f9515d07f0a5"
+      "sha256": "1b7e099867d2ecb1f752652a8e765fd421f87786847d0fe39527f2aa320b5167"
     },
     {
       "path": "modules/ui-design/scripts/design-sync.js",
@@ -6367,7 +6372,7 @@
     {
       "path": "modules/ui-design/skills/README.md",
       "mode": "0000644",
-      "sha256": "018332aa1b1dae06abfecdd96b64cdd0f99132be1c925b2a77484e69865c83f3"
+      "sha256": "29d570739f8b22fa030631ae623a78c2676d4dcd8f94bbf40674617b8414a7da"
     },
     {
       "path": "modules/ui-design/skills/design-taste-frontend-v1/SKILL.md",
@@ -6384,6 +6389,101 @@
       "mode": "0000644",
       "sha256": "eeb33e0a2d0a227d23b67c5e6d32c5757d8d5d7249a1a6d0fe3c67d8bd95fc91"
     },
+    {
+      "path": "modules/ui-design/skills/impeccable/SKILL.md",
+      "mode": "0000644",
+      "sha256": "b82bde6df7fd759d57c11e072a427bf5e88f9558deb8ce746b89fa031d06d051"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/adapt.md",
+      "mode": "0000644",
+      "sha256": "2721796c15d32d123d8585ec544614455d7992a9d62055edc90742cf14c75c29"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/animate.md",
+      "mode": "0000644",
+      "sha256": "b4763d82dfa55abf84258f7d1e466e3e7cfed23f1062a85fbc2235dc58bd9e59"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/audit.md",
+      "mode": "0000644",
+      "sha256": "724b4e9f9763d835695a5b1249ba8cc38c4f906d8d3f8b3fc8c267549c4c6edc"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/bolder.md",
+      "mode": "0000644",
+      "sha256": "5637eb523c23e81bf609c0247c9d389c07636a8b00dc3435eca57660d5c30102"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/clarify.md",
+      "mode": "0000644",
+      "sha256": "f1e4803f60fb657e4a1113cdc2f2ca14b1d9154ef9e88d6615af81eb422a50ec"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/colorize.md",
+      "mode": "0000644",
+      "sha256": "8aebf2e3b5a03bec6a6db623a227b917679c5a497741337cdb91737766f04f35"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/critique.md",
+      "mode": "0000644",
+      "sha256": "8aa3abc015bf692e9292f31ae769faef2cc60d0f248d3d60ee829cbb41ecb596"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/distill.md",
+      "mode": "0000644",
+      "sha256": "2a9f490ead7f971537f362dc5fcd0a44886d342e90325a001525231d245c5358"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/document.md",
+      "mode": "0000644",
+      "sha256": "7d39eaefe7f3338928bd7b877ddc6408e079ccc5ba50a6ea025e81d04b195613"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/extract.md",
+      "mode": "0000644",
+      "sha256": "3792d4af2140ad75c5b97fa2cbe60efa21dd97ed13034c5ed8d648ee477bf45a"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/harden.md",
+      "mode": "0000644",
+      "sha256": "e3eb2b4fc6e1c978f6766270f14cc306d1d72364f848991b94132dae7bab1239"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/layout.md",
+      "mode": "0000644",
+      "sha256": "e8ba930c3afc9ca508b39d62c0fe2503cc7151214a3e38485172d650339eb559"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/onboard.md",
+      "mode": "0000644",
+      "sha256": "66ba79216413c9b84c08a1c78235ba8a2e4b46b99335c4b223a904682f8d98e6"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/optimize.md",
+      "mode": "0000644",
+      "sha256": "896d171ff0426ae61098c2113888af70e0530ae2851b7d26b8122afc0cbe3fff"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/polish.md",
+      "mode": "0000644",
+      "sha256": "1a2e89db89cfc6a30dcd6f7e6afa6b26cfb8237813052a60d823c55aa080457a"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/quieter.md",
+      "mode": "0000644",
+      "sha256": "7da009c09724463a2040b4cc705723ac68b00fea8699cd39a92d1aa55ef06995"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/shape.md",
+      "mode": "0000644",
+      "sha256": "e9ca1b4be020c83b1ba5721bf51104d21e82ffda21aa7979ba295e77575b8cdc"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/typeset.md",
+      "mode": "0000644",
+      "sha256": "d960ee789a1b5d44c06bab53d2a661800457960cb121cf1496ba928792fa9307"
+    },
     {
       "path": "modules/ui-design/skills/policy.json",
       "mode": "0000644",
@@ -6462,12 +6562,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3ca799f0609f1ad2e4bfea78e7bba57f976b6df4df4cefad5e0229e3f5e2a8ab"
+      "sha256": "cc48f9622b76910048e8eddee004dd0fa872e622a03e72c6e578c3aa9d3f3a01"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8ea4badf28d81545fe9d546df94c49da9980c78650f8a7fdc13a8b907168787c"
+      "sha256": "dd5a515d9dffdd6839d708e4d16aae0b441ddb99358a21cd665d586dc7d22552"
     },
     {
       "path": "public-docs/index.html",
@@ -8117,7 +8217,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2f2268d16d20bc3ae5c531c9bab8faae7a323a0517c4b9692dc7d10fd3fd5d26"
+      "sha256": "f2fccddc6dcaed3d8e767e6937db4c9f3aa6a3f3d6114bd1a89bbc2094bffdce"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11032,7 +11132,7 @@
     {
       "path": "tests/ui_design_skills.mjs",
       "mode": "0000644",
-      "sha256": "73a4c7e6b29f2703b866f3241a459fd0c4a57b7b606f0058905306b624134b1b"
+      "sha256": "391f6e8c5ff83e4c3c1e2148aed74c3346200efabc59657ac99820cfcfdac1ac"
     },
     {
       "path": "tests/ui_design_styles.mjs",

package/.claude/skills/design/SKILL.md

@@ -61,12 +61,13 @@ Third-party design skills reach a builder only through the module's vendoring po
 
 - *None vendored (2026-08-28).* Both origins scanned for the scoped set — `pbakaus/impeccable`, and the eleven `Leonxlnx/taste-skill` skills (`minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`, and the four below) — reduced to `dangerous` at the scanner's deterministic floor and landed as rebuild specs (GDS tasks). The roster, the verdicts and the way to land one are in the README; vendoring one anyway is an owner override recorded in an ADR, not a session's call.
 
-**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/<redacted>.md), task 1003325): first-party skills at `modules/ui-design/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
+**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/<redacted>.md), task 1003325; [ADR 0221](../../../docs/adr/<redacted>.md), task 1003326): first-party skills at `modules/ui-design/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
 
 - **design-taste-frontend** — the default taste skill for a landing page, a portfolio or a marketing surface: the brief read in one line, three dials from presets, one world locked for the page, hero and layout discipline, rationed decoration, a pre-flight the kit measures. Declines dashboards, tables, wizards and editors.
 - **design-taste-frontend-v1** — the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the named vocabulary of premium patterns and the tile-grid archetypes.
 - **high-end-visual-design** — the agency-build polish pass: one texture archetype (the library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, the spatial rhythm, choreography and scroll entry inside the Kill Switch.
 - **redesign-existing-projects** — the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks, `probe.js` green before and after.
+- **impeccable** — the design-craft method as one skill with sub-commands: `impeccable <sub-command> <target>` loads exactly one of eighteen playbooks (shape, critique, audit, polish, harden, onboard, animate, colorize, typeset, layout, adapt, distill, clarify, optimize, document, extract, bolder, quieter); no argument prints a menu from live project signals and never auto-runs; a bare description is routed to the closest playbook; carries the craft floor (loaded right before UI is edited, never recited) and the bounded finish (build, one kit round, one batch of fixes, at most one confirming round, stop; a read-only reviewer that answers with one of four words). No hooks, no bypass agent, no telemetry, no live server: the live loop is the playwright plugin below and the headless loop is the kit; the detector is task 1003329; native mobile declines to this loop.
 
 **Prerequisite, not vendored:** the **playwright plugin** (`claude plugin install playwright@claude-plugins-official`) is the LIVE browser-driving loop, where the kit in Step 2 is the headless one. Install it on the machine that runs a design session; the module never installs anything.
 

package/docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md

@@ -0,0 +1,36 @@
+# ADR 0221 — The impeccable method is one skill with sub-command playbooks: one preamble, one playbook per request, the three homes are the instance's own files, and the origin's mechanisms are dropped rather than disabled
+
+- **Status:** Accepted (2026-09-01)
+- **Task:** [task 1003326](https://cloudbongos.com/builders#/task/1003326) (goal 1000083 — the ui-design module as a platform capability; the second rebuild-spec task after [ADR 0220](<redacted>.md))
+- **Owner intent (2026-08-28):** every builder, on every instance, can produce good-looking, functional UIs in line with that instance's world. The impeccable skill was the operating skill the hub round ran under; the scan said it could not be copied, so its method is rebuilt.
+
+## Context
+
+`/scan-before-install` reduced `pbakaus/impeccable` @ `<redacted>` to `dangerous` at the default tier: three critical findings at the deterministic floor, and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route with the parent environment forwarded, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry ([ADR 0198](<redacted>.md); the roster in `modules/ui-design/skills/README.md`). The REBUILD-SPEC in the task body lists a hundred and forty requirements derived from the origin's documentation only, across twelve areas: entry, world, commands, craft floor, detector, live, finish, native, hooks, assets, docs.
+
+ADR 0220 fixed where a rebuild lives and what it carries. It did not say how a method that is a *family of sub-commands* lands (the taste core was four independent skills), what the origin's three persisted homes (product truth, the visual system, per-surface briefs) become on a platform whose world is already the instance's files, or what to do with the six areas of the spec whose whole substance is the mechanism the panel condemned.
+
+## Decision
+
+1. **One skill, one playbook per request.** The method is `modules/ui-design/skills/impeccable/SKILL.md` (the frontmatter, the preamble, the `## Rebuilt from` section, invocation, the menu, the session setup, the three homes, the routing table, the craft floor, the finish, and what is not here) plus `reference/<sub-command>.md`, one file per playbook, eighteen in all: the sixteen the task body names (`shape`, `audit`, `critique`, `polish`, `harden`, `animate`, `typeset`, `colorize`, `layout`, `adapt`, `distill`, `clarify`, `onboard`, `optimize`, `document`, `extract`) and the two directions the spec lists beside them (`bolder`, `quieter`). A request loads exactly one playbook, which is the spec's own entry rule and the reason the playbooks are not inlined: a single file would load every playbook on every request. The preamble is pinned **once**, in `SKILL.md`, and governs every playbook; a playbook that carried a copy would be a second pin. The materialiser's own-dir branch already copies the tree recursively, so `reference/` ships with the skill and nothing in `claude-materialize.js` changes.
+2. **The three homes are the instance's files, and the skill creates none of them.** Product truth is `docs/project-context.template.md` and the branding pack's identity strings; the visual system is the root `DESIGN.md` (and a look's `DESIGN.md` under `modules/ui-design/styles/`); the per-surface brief is the claimed task's body and its ship notes, in a fixed brief block (scope, mode, audience, primary action, proof, constraints, direction, memorable moment, open decisions). The spec's read-and-write brief helper, its versioned product-doc schema and its sidecar file become that block and the existing files. `shape` proposes edits to product truth as a diff for the owner; `document` drafts the visual system on the claim's branch, never overwrites an existing one without the explicit refresh / overwrite / merge choice, and never runs in the same pass as `shape`. The module reads the world and never owns it (ADR 0197); a skill that wrote `DESIGN.md` on its own authority would be the inversion the module exists to prevent.
+3. **Dropped, not disabled, and each drop has a named destination.** Hooks: none, in any harness config; the platform's ship gate is the sweep and the pre-flight is the kit. The bypass agent: none; the finish's separate reviewer is an ordinary subagent through the harness's own Agent tool with its ordinary permissions and no build context. Telemetry, the remote bundle, the live-server credential: none. The live loop (a helper server, an injected control bar, a session journal, CSP patching, in-page text editing, accept / discard / normalise): the playwright plugin as a documented prerequisite driving the kit's stub, with variants as states in the states file, accept as a commit and discard as a checkout, and nothing to sweep because nothing was injected. The detector: task 1003329, as rules in `kit/check-mock.js` and `kit/lib.js`; until then `check-mock.js`, `render.js`'s floors and `contrast.js` are the deterministic floor, run once per review round and treated as a floor, never as proof. The asset producer: the owner's hero-plates-only rule and task 1003328. The native playbooks: not rebuilt; every surface here is a served web page, so a native target declines to `/design` with one line. `init`, `doctor`, `pin`, `unpin` and the installer existed to write and repair the origin's own config and harness entries; the materialiser is the install and there is no stored artifact of the skill's own to drift.
+4. **The finish is the kit in bounded rounds, and the reviewer speaks four words.** Build fully; one batched inspection (`render.js` every state at 1440 / 390 / 320 in the modes the states file names, `probe.js` for the contract); fix everything in one batch; at most one confirming round; stop, with shots, checks, micro-edits and rebuilds all counted against the same budget. The reviewer takes an explicit packet, runs an evidence check first (`recapture` on missing, blank, mismatched or implausibly sized captures), inventories the approved mock itself, treats an uncited deviation as a defect, and returns one of `clean`, `recapture`, `defects`, `contradicted`, reported unchanged and at its true scope; a second pass scores each fix resolved / partial / unresolved from new captures only. The platform's ship-time grader is the second independent reviewer and reads the real diff.
+5. **The craft floor is mechanics, loaded late, never recited.** It sits in `SKILL.md` after direction is settled and before UI is edited, is skipped by the read-only playbooks, and is translated for a world that may be hairlines by rule: where the world has shadows they carry offset and blur, where it has none the absence is the floor; a kicker above a heading is refused where the world bans one; the pack's faces are the display voice. With every check green the remaining effort goes to the committed world.
+6. **The pins** (`tests/ui_design_skills.mjs`): `impeccable` exists and is declared; each of the sixteen named sub-commands has a playbook and each playbook on disk is routed from `SKILL.md` (no orphan); no playbook carries the preamble marker; every playbook is longer than a stub; nothing in the tree directs a permission bypass, a hook written into a harness config, a settings-file edit, telemetry, a remote download, a live-server credential or an instruction override (naming a ban is fine, directing it is not, the same shape as ADR 0220's image-mandate pin); `SKILL.md` names the playwright plugin, `kit/render.js` and task 1003329. The ADR 0220 own-skill pins apply unchanged.
+
+## Consequences
+
+- **Five in-house skills ship with the module.** The roster in `/design`, the README, the module `CLAUDE.md` and `docs/file-map.md` names all five. The core checkout still does not see them (task 1003330).
+- **A builder with the upstream `impeccable` under `~/.claude/skills`** has a collision by design, the ADR 0220 shape: the module's copy is the one an instance ships, and none of the upstream files were opened by this task.
+- **The DONE WHEN's "one page rendered through the kit after each of three sub-commands"** is met with the three review playbooks (`audit`, `critique`, `harden` as a review of the states) against the front door, rendered ALL CLEAN after each; the playbooks that edit are proven by the pins and by the kit they point at, not by a change to a shipped surface inside a skill-authoring task.
+- **A future harness that supports skill sub-commands natively** changes only the routing paragraph; the playbooks are already one file each.
+
+## Rejected
+
+- **Eighteen skills, one per sub-command.** Eighteen preamble copies, eighteen descriptions competing for the harness's routing, and the spec's own entry rule (one name, an optional sub-command) contradicted.
+- **One `SKILL.md` carrying every playbook inline.** Loads the whole method on every request; the spec's "load exactly one playbook" exists to prevent exactly that.
+- **A hooks-lite variant** (a documented opt-in hook the builder writes themselves). A hook written into a harness config is the finding, with or without consent; the pre-flight is the kit and the ship gate is the sweep.
+- **A reviewer with elevated permissions** to "match the origin's autonomy". The reviewer is read-only by definition; it needs nothing the Agent tool does not give it.
+- **A `doctor`** to repair drift between the skill's artifacts and its version. The skill has no artifacts of its own; the kit's report is regenerated every run.
+- **Rebuilding the native playbooks** for a platform that serves web surfaces. Scope with no customer; the one principle worth keeping is stated in one line in the skill.

package/docs/adr/README.md

@@ -307,5 +307,6 @@ This keeps the decision history honest and traceable.
 | 0218 | [**The apex-root web surface: a module may own the front door, and says so with a flag, not an empty prefix** ([task 1003322](https://cloudbongos.com/builders#/task/1003322) · goal 1000080 — the last of the five tasks scoped with the owner on 2026-08-28). Carves the repo-root `public-landing/` into `modules/public-landing/`, the THIRD web-surface module after status-UI (BV1.R84) and hall-UI (BV1.R85) and the first that is not a subdomain. The obstacle: `moduleWebSurfaces()`'s whole routing vocabulary was a Host-header PREFIX, and the apex root is not a prefix of anything — it is whatever is left once the subdomains are taken. So a surface now names where it answers in exactly one of two ways, `{ host: "status.", dir }` or `{ apexRoot: true, dir }`, never both and never neither. **`host: ""` is rejected on purpose:** the routers match with `host.startsWith(s.host)` and every string starts with `""`, so an empty prefix would answer on `builders.`/`status.` too AND make `isModuleSurfaceHost()` true for every request — the predicate eleven `/builders` guards use to step aside — silently un-serving the hall. A boolean cannot be mistaken for a prefix. The landing keeps its DEDICATED serving block (the hall precedent): the apex-only strip, the branding stamp, the `?v=` content stamp and the six routes are untouched; only `LANDING_DIR` changes, from a hardcoded path to a lookup through the loader, resolved by the `apexRoot` PREDICATE so neither `platform-server.js` nor `serve-internal.js` names a module key (ADR 0083 §Decision #4). Disabling the module removes the front door outright and the apex answers the game-less 404 tail — the module contract's "disable without breaking anything" in its most literal form. At most one apex-root surface: the first discovered wins and a second is logged. Also: the BV1.R76 host-identity gate learned that an **apex-only region is exempt** — the server deletes it on every non-hub instance, so it cannot make a child render the hub's brand, which is the failure that gate names. Evidence: the five apex pages hashed as served, before and after, differ by exactly the same 22 bytes — `"public-landing":true,`, the module's own `window.__MODULES__` entry — and are otherwise identical; the 106 moved files hash identically on disk.](<redacted>.md) |
 | 0219 | [**A look is a branding pack: the style library ships looks as `theme.ui` overlays, never as sheets** ([task 1003323](https://cloudbongos.com/builders#/task/1003323) · goal 1000083). The owner scoped "varying ui styles" for the ui-design module; the shape was decided by three facts: every served sheet already reads only the contract and is measured by a suite that resolves its own expressions under the pack (ADR 0196), the pack is one-mode (light values; dark is each sheet's black tier), and the world round's candidate token layers were sheets, not packs. Decisions: **D1** a look is `modules/ui-design/styles/<name>/` = `pack.json` (the `theme.ui` overlay, exactly the thirteen colours + the two font stacks and their links) + `DESIGN.md` (the derived recipes in the root DESIGN.md's frontmatter shape, thirteen in lockstep with the pack) + `mock.html` (a specimen with no `:root`, served through the stub with the pack spliced in), never a fork of a sheet; a sixteenth token is a contract change. **D2** `chrome-world` is canonical and pinned byte-for-byte to the neutral pack; its DESIGN.md points at the root one. **D3** the alternates `expedition` (natgeo-editorial) and `grove` (organic-cards) are ported by retuning the thirteen against the three sheets' own pair lists in both modes until every pair clears AA (the grove's sage lifted and its inks deepened for the hub's status vocabulary and the hall's chips); dark under both is the sheets' black. **D4** the picker rides `GDS_BRANDING_FILE`, the fixed knob `src/branding.js` already has: `STYLE=<name>` on the stub, `--style` on render/probe, `--pack <name>` on contrast/check-mock; no core change. **D5** the three token suites take `UI_DESIGN_PACK` and their drift tests keep measuring against the neutral pack; `tests/ui_design_styles.mjs` runs them once per alternate and proves the knob live with a pack that must fail. **D6** an instance adopts a look by copying `theme` into `config/branding.json`; what stays the platform's whichever look is on: the dark ground, the hall's verification vocabulary, every sheet's derived tier, the floors. Rejected: sheets per look beside world.css; a dark tier in the contract; a picker that writes the host boundary.](<redacted>.md) | ui-design / branding contract |
 | 0220 | [**An in-house rebuilt skill is a first-party skill: it lands at `skills/<name>/`, opens with the same preamble, carries a "Rebuilt from" section instead of a sidecar, and is counted** ([task 1003325](https://cloudbongos.com/builders#/task/1003325) · goal 1000083). ADR 0198 landed both scanned origins as rebuild specs and left the roster empty; this is the first rebuild — the taste core: `design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `redesign-existing-projects` — and the policy had not said where a rebuild lives, what replaces `PROVENANCE.md`, whether a preamble written for vendored copies still fits, or whether five byte-identical copies of it trip the doc-entropy ratchet (they would have: baseline 6). Decisions: **D1** a rebuild is `modules/ui-design/skills/<name>/SKILL.md`, declared in `module.json`, materialised by step 1b's own-dir branch (no sidecar gate), first-party and counted by every ratchet — no `rebuilt/` exemption like `vendor/`, because these are our lines. **D2** one preamble worded for both origins ("vendored from a scanned origin, or rebuilt in-house from a spec"), still byte-identical everywhere; a rebuild's provenance is its `## Rebuilt from` section first after the block: the origin the SPEC was derived from (documentation only), the verdict, the spec task, "no upstream bytes consulted or copied", this ADR, and what changed in translation; no `PROVENANCE.md`, no `LICENSE`. **D3** the translation rules for every rebuilt taste skill: the palette is the pack and variants come from the style library (ADR 0219); the design system is the instance's `DESIGN.md`; imagery is hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides, and where the world calls for what an audit would flag, the world is the answer key. **D4** `docs-entropy.js` skips a paragraph opening with the preamble marker beside its generated-block skip, calibrated against a plain duplicate that is still flagged. **D5** v1 is a distinct skill differing in content (the fixed triple, the stack conventions, the pattern vocabulary, the tile-grid archetypes), not a version stamp. **D6** the pins in `tests/ui_design_skills.mjs`: frontmatter name = dir, preamble first and once, the section's task link + ADR 0198 + "no upstream bytes", the style library and "hero plates" named, no image mandate, no sidecar, every door lists the four. Rejected: a sidecar with the spec's commit; a second preamble; a `rebuilt/` segment; vendoring anyway (an owner override, not taken); folding v1 into v2; raising the doc baseline.](<redacted>.md) | ui-design / skills |
+| 0221 | [**The impeccable method is one skill with sub-command playbooks: one preamble, one playbook per request, the three homes are the instance's own files, and the origin's mechanisms are dropped rather than disabled** ([task 1003326](https://cloudbongos.com/builders#/task/1003326) · goal 1000083). `pbakaus/impeccable` scanned `dangerous` (ADR 0198: hooks written into five harness configs, a child agent with permissions bypassed, an instruction override, a live-server credential in page source, an unverified remote bundle, default-on telemetry), so its method is rebuilt from the spec. ADR 0220 fixed where a rebuild lives; it had not said how a family of sub-commands lands, what the origin's three persisted homes become, or what to do with the six spec areas whose substance is the condemned mechanism. Decisions: **D1** one skill at `skills/impeccable/`: `SKILL.md` (invocation, the menu from live signals, session setup, the three homes, the routing table, the craft floor, the bounded finish, what is not here) plus `reference/<sub-command>.md`, eighteen playbooks, exactly one loaded per request (the spec's own entry rule); the preamble pinned once in `SKILL.md` and governing every playbook; the materialiser's tree copy ships `reference/` unchanged. **D2** the three homes are the instance's files (product truth = `docs/project-context.template.md` + the pack's identity; the visual system = the root `DESIGN.md` and a look's; the brief = the task's body + a fixed brief block in the ship notes); the skill creates none, `shape` proposes diffs, `document` drafts on the claim's branch with the refresh / overwrite / merge choice. **D3** dropped, not disabled, each with a destination: hooks → none (the ship gate is the sweep, the pre-flight is the kit); the bypass agent → an ordinary read-only subagent via the Agent tool; telemetry, the remote bundle, the credential → none; the live loop → the playwright plugin driving the kit's stub, variants as states, accept = commit, discard = checkout, nothing injected; the detector → task 1003329; the asset producer → the hero-plates rule and task 1003328; native → declines to `/design`; `init`/`doctor`/`pin`/installer → the materialiser is the install. **D4** the finish is the kit in bounded rounds (build, one batched inspection, one batch of fixes, at most one confirming round, stop, one budget) and the reviewer answers with one of `clean` / `recapture` / `defects` / `contradicted` after an evidence check and its own mock inventory. **D5** the craft floor is mechanics loaded late and never recited, translated for a world that may be hairlines by rule. **D6** the pins: sixteen routed playbooks, no orphan, no preamble copy in a playbook, and nothing in the tree directing a bypass, a hook write, a settings edit, telemetry, a remote download, a credential or an override. Rejected: eighteen skills; one inline file; a hooks-lite opt-in; an elevated reviewer; a `doctor`; the native playbooks.](<redacted>.md) | ui-design / skills |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/file-map.md

@@ -130,7 +130,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Three ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages) and `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend.
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove; STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove; STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -1359,5 +1359,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.459 with no explicit bump. run 33571137958. (task 1002620)
   1.19.461 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.460 with no explicit bump. run 33571982271. (task 1002620)
+  1.19.462 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.461 with no explicit bump. run 33576366095. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ui-design/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects"] },
+  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable"] },
   "provides": [],
   "consumes": []
 }

package/modules/ui-design/skills/README.md

@@ -20,14 +20,14 @@ Two origins were scanned for the set scoped with the owner (impeccable; the elev
 
 | Skill (in-house name) | Upstream | Licence | Verdict | Landing |
 |---|---|---|---|---|
-| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → GDS task |
+| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → [task 1003326](https://cloudbongos.com/builders#/task/1003326) → rebuilt in-house as `impeccable/` ([ADR 0221](../../../docs/adr/<redacted>.md)) |
 | `design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `minimalist-ui`, `industrial-brutalist-ui`, `redesign-existing-projects`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | MIT | **dangerous** — floor: 1 critical (an injection-phrase hit at `skills/taste-skill/SKILL.md:892`, which the panel identifies as a filename placeholder; the floor is untouchable by design); panel: caution (1 medium: the only documented install path runs an unpinned third-party `npx` CLI; 21 low: mandated invocation of any available image-generation tool, unbounded image counts, remote assets and scripts in generated pages, an auto-loaded cross-agent instruction file) | rebuild spec → GDS task |
 
 The eleven taste skills are single-file prose; the floor's one critical is a false positive in the human sense and a true positive in the scanner's — and the rule that makes the scanner worth having is that a session does not get to tell the difference. Vendoring any of them anyway is an **owner override recorded in an ADR**, not a judgement a task makes.
 
 ## The in-house rebuilds (2026-09-01)
 
-A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/<redacted>.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it.
+A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/<redacted>.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/<redacted>.md)).
 
 | Skill | Rebuilt from (spec) | Task | What it is |
 |---|---|---|---|
@@ -35,8 +35,9 @@ A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` seg
 | `design-taste-frontend-v1` | `Leonxlnx/taste-skill` `taste-skill-v1` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the pattern vocabulary, the tile-grid archetypes |
 | `high-end-visual-design` | `Leonxlnx/taste-skill` `soft-skill` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the agency-build polish pass: one texture archetype (the style library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, rhythm, choreography and scroll entry inside the Kill Switch |
 | `redesign-existing-projects` | `Leonxlnx/taste-skill` `redesign-skill` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks |
+| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | [task 1003326](https://cloudbongos.com/builders#/task/1003326) | the design-craft method as one skill with sub-commands, one playbook loaded per request from `impeccable/reference/`: shape, critique, audit, polish, harden, onboard, animate, colorize, typeset, layout, adapt, distill, clarify, optimize, document, extract, bolder, quieter; the craft floor and the bounded finish live in its `SKILL.md`; the three persisted homes are the instance's own files; no hooks, no bypass agent, no telemetry, no live server (the playwright plugin and the kit are the loops) |
 
-What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. Still specs, not skills: the impeccable method (task 1003326), the image family (1003328), the detector (1003329), the four looks (1003327).
+What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. Still specs, not skills: the image family (task 1003328), the detector (1003329), the four looks (1003327).
 
 **The playwright plugin** (`claude-plugins-official`, an MCP plugin) is the LIVE browser-driving loop, where the kit is the headless one. It is a prerequisite, documented — `claude plugin install playwright@claude-plugins-official` — never vendored.
 

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -0,0 +1,143 @@
+---
+name: impeccable
+description: The design-craft method for ANY surface on ANY Cloud Bongos instance, invoked as one skill plus an optional sub-command and an optional target ("impeccable audit /projects", "impeccable polish the hall's ranks page", "impeccable harden the wizard"). Sixteen sub-command playbooks (shape, audit, critique, polish, harden, animate, typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract) plus the two directions (bolder, quieter), exactly one loaded per request; a bare description with no sub-command is ordinary design work routed to the closest playbook; no argument prints a menu built from live project signals and never auto-runs anything. Carries the craft floor (loaded right before UI is edited, never recited to the user) and the bounded finish (build fully, one render round through the kit, one batch of fixes, at most one confirming round, stop). Triggers on "impeccable", "critique this page", "audit the UI", "polish the whole path", "make it survive long text", "animate this", "tighten the copy", "document the design system", "extract the repeated pattern". Rebuilt in-house from the impeccable rebuild spec (task 1003326, ADR 0198) with no hooks, no bypass agent, no telemetry and no live server; the live loop is the playwright plugin and the headless loop is the module's kit. Web surfaces only; a native mobile target declines to /design.
+---
+
+<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+>
+> 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
+> 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.
+> 3. **A style skill produces variants INSIDE that world, never a second world.** The look this skill carries (its palette, faces, materials, mood boards) is a reference for composition and craft; the instance's tokens and faces replace it. Changing the world is the owner's decision and an ADR, not a session's taste.
+> 4. **Images are for hero plates and hero objects only.** UI is built from templates and the instance's world, not painted; any image-generation step below applies to text-free plates and hero objects, never to controls, cards, text, or a screenshot of a screen.
+> 5. **The instance's taste bans apply and win.** Read them from its `DESIGN.md`. Cloud Bongos's own (no em dash or en dash in visible copy, no emoji, no gradient text, no three-equal-card row, no fake screenshot built from divs) are that instance's, not the module's; where this skill's rules conflict with an instance's bans, the instance wins.
+> 6. **The platform floors hold on every instance** and a `DESIGN.md` may tighten them, never loosen them: every control clears 24px on both sides (primary pills 46–48px); AA in both modes (4.5:1 body text, 3:1 large text and non-text) measured from the real stylesheet; and the Kill Switch, `@media (prefers-reduced-motion: reduce)` at the foot of the token layer killing every animation and transition, no motion authored in JavaScript, and a rest frame that is a complete composition on its own.
+> 7. **Look before you ship.** Render the real surface through the module's kit before and after (`/design` Step 2 and `docs/recipes/ui-look-before-you-ship.md`: every state at 1440 / 390 / 320 in dark and light, audited against the floors); a page with no states file gets one first, and new interactive code ships with a pin in the page's own test file.
+>
+> The rules below are the skill's own. A vendored copy carries a `PROVENANCE.md` beside this file naming the origin, the pinned commit, the licence and the scan verdict it was vendored under; an in-house rebuild names its rebuild spec and its ADR in the section right after this block.
+<!-- END PLATFORM PREAMBLE -->
+
+## Rebuilt from
+
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `pbakaus/impeccable` @ `<redacted>` (Apache-2.0; skill v4.1.x), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28: three critical findings at the deterministic floor and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry. Under [ADR 0198](../../../../docs/adr/<redacted>.md) that verdict lands a REBUILD-SPEC, never a copy. The spec is the body of [task 1003326](https://cloudbongos.com/builders#/task/1003326), derived from the origin's documentation only; this file and the playbooks under `reference/` implement its requirements from scratch, **no upstream bytes consulted or copied**. The landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/<redacted>.md); the sub-command shape (one skill, one playbook per sub-command, what was kept and what was dropped) is [ADR 0221](../../../../docs/adr/<redacted>.md).
+
+What changed in translation, on purpose. The method's **three persisted homes** (product truth, the visual system, per-surface briefs) are the instance's own files here: product truth is `docs/project-context.template.md` and the identity block of the branding pack, the visual system is the root `DESIGN.md` (and a look's `DESIGN.md` under `modules/ui-design/styles/`), and a surface's brief is the claimed task's body and ship notes. This skill creates none of them and writes the root `DESIGN.md` only through the `document` playbook, as a draft on the claim's branch the owner reviews. Everything the panel flagged is **gone, not disabled**: no hook is written anywhere, no child agent runs with permissions bypassed (a reviewer is an ordinary subagent through the harness's own Agent tool), nothing is reported home, nothing is downloaded, and there is no live helper server. The **live loop** is the playwright plugin (a documented prerequisite) driving the module's stub; the **headless loop** is `kit/render.js` and `kit/probe.js`. The **anti-pattern detector** is not shipped here: task 1003329 lands it as rules in `kit/check-mock.js` and `kit/lib.js`, and until then the floor is what the kit already measures. The **native playbooks** (the two mobile platforms) are not rebuilt: every surface on this platform is a served web page, so a native target declines to `/design` with one line. The `init`, `doctor`, `pin`, `unpin` and installer operations, which existed to write and repair the origin's own config and harness entries, have no counterpart: the materialiser is the install. Imagery follows the owner's rule (hero plates only, task 1003328 for the image family); the palette is the pack and a variant is a look from the style library; every motion rule lives inside the Kill Switch.
+
+## Invocation: one name, one sub-command, one target
+
+`impeccable [<sub-command>] [<target>]` where the target is a page path (`/projects`), a surface (`hall-ui`), a file, or a plain description.
+
+- **A sub-command names a playbook.** Load exactly one: `reference/<sub-command>.md` beside this file. Do not load two, do not load the whole set.
+- **No sub-command, but a description** ("the pricing band feels loud") is ordinary design work: pick the playbook whose "when" line fits, say which you picked in one line, and run it. A new surface or a replacement look is not this skill's playbook; it is `design-taste-frontend` for a marketing surface or the plain `/design` loop for a working one, and a new *world* is the owner's decision and an ADR.
+- **Two playbooks plausibly fit** ("clean this up" could be `distill` or `polish`): ask once, with the two names and one line each. Never guess, never run both.
+- **No argument at all**: print the menu below. Never auto-run a command from the menu.
+- **A native mobile target** (an app for either mobile platform, or cross-platform): decline in one line and route to `/design`. The platform serves web surfaces and the native playbooks were not rebuilt.
+
+## The menu (no argument)
+
+Read four live signals, then print two or three recommended next commands with a one-line reason each, followed by the full list grouped by category. Signals, all read locally and none written:
+
+1. **The world files**: does `DESIGN.md` exist at the repo root; is `config/branding.json` present over the neutral pack; is `docs/project-context.template.md` filled or still the scaffold. A scaffold with no answers recommends `shape` first; a missing `DESIGN.md` alone does not make the project greenfield (the neutral pack is the world).
+2. **The last kit report** for the target, if any: `report.json` under `%TMP%/ui-design-kit/<surface>/<page>/` (or the `--out` dir the last run named). Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
+3. **Dirty files in version control**: `git status --porcelain` over the surfaces (`modules/*/public/`, `src/ui/`, `public*/`). Dirty UI files recommend `polish` on that path before anything new.
+4. **A stub already listening**: `kit/serve.js` prints its port when it starts; a page already served means the live loop (the playwright plugin) is available without a second server. Never start a duplicate on an occupied port.
+
+The full list, grouped:
+
+| Category | Sub-commands |
+|---|---|
+| Discover | `shape`, `critique`, `audit` |
+| Build | `polish`, `harden`, `onboard`, `animate`, `colorize`, `typeset`, `layout`, `adapt`, `distill`, `clarify`, `optimize` |
+| Direction | `bolder`, `quieter` |
+| Record | `document`, `extract` |
+
+## Session setup, once
+
+The setup step is the preamble's world load, done **once per session** and not repeated: the pack, the tokens, the root `DESIGN.md`, and `docs/project-context.template.md` for product truth. The directives that come back are the world's own named rules and its Do's and Don'ts; quote them from the files, never from memory. Then, before editing anything, inspect the target **and at least one source of existing visual truth** for it: the sheet the page loads, a sibling component, the page's states file, or a plate under the instance's assets. A surface is edited only after both have been read.
+
+This skill lives at `modules/ui-design/skills/impeccable/` in the core and at `.claude/skills/impeccable/` once materialised into an instance; the playbooks are always `reference/<name>.md` relative to this file. If a harness has put the file somewhere else, resolve the playbooks relative to wherever this file was read from, and fall back to the module path.
+
+## The three homes, and what they are here
+
+| The method's home | On this platform | Written by |
+|---|---|---|
+| Durable product truth (platform, users, purpose, positioning, constraints, brand commitments, principles, accessibility) | `docs/project-context.template.md` plus the branding pack's identity strings | the owner; `shape` records answers in the task, and only proposes edits to the file |
+| The durable visual system | the root `DESIGN.md`; a look's `DESIGN.md` under `modules/ui-design/styles/<name>/` | the owner; `document` drafts one where none exists, from shipped code, on the claim's branch |
+| The per-surface strategy brief | the claimed task's body and its ship notes (the brief block below) | the session, under the claim |
+
+Never merge them into one file, never create a second copy of any of them. **Product truth is required before new visual work begins**: a scaffold with no answers stops the build and starts `shape`. **An existing look is evidence of what the thing is, never authority over what it becomes**; a page's current sheet tells you the world it was built in, and the world file tells you the rules.
+
+**Refinement or redesign, never a blend.** Refinement keeps identity, content, behaviour and everything out of scope; redesign keeps product truth and function and replaces the look. Name which one the request is in the brief block; refusing to split the difference is the rule. The four starting cases branch every playbook: **full redesign** (product truth stays, the look goes, and a new look is a look from the style library or an owner decision), **inherit an established world** (the instance has a `DESIGN.md`: every decision is a lookup), **extend a partial brand** (a pack but no `DESIGN.md`: the pack's fifteen and the platform floors are the rulebook, and the gaps are named, not filled), **no visual authority at all** (the neutral pack is the world; say so). Scale invention to scope: an extension inherits everything, a new surface in a settled world explores structure only, and a new or replacement world is not a session's call. A local addition (a section, a component, a state) inherits the surface it sits in and is never escalated into an identity exercise.
+
+**The brief block**, written into the ship notes before the first edit and kept current:
+
+```
+Brief: <surface> · <refine|redesign> · case <1-4>
+Mode: <persuade|operate|read|experience> (from the surface, not the product)
+Audience / primary action / proof:
+Constraints (the world's named rules that bind here):
+Direction chosen / memorable moment:
+Open decisions:
+```
+
+The visitor mode is picked per surface (a ledger operates, a landing persuades, a policy page reads), persists only in that surface's brief, and changes what every playbook optimises. A brief that already names an era, a material, a face or a palette **overrides this skill's own saturated-pattern warnings**; steering a clear brief toward the agent's taste is the failure, not the pattern.
+
+## The playbooks
+
+| Sub-command | Playbook | When | Returns |
+|---|---|---|---|
+| `shape` | `reference/shape.md` | before any new work, or when the brief has holes | a confirmed written brief; no code, no persistence |
+| `critique` | `reference/critique.md` | "is this good?" | heuristics on a table, personas walked, a cognitive-load pass, three to five prioritised issues with fixes |
+| `audit` | `reference/audit.md` | "is this correct?" | five dimensions scored, every issue with a file and line, nothing fixed |
+| `polish` | `reference/polish.md` | a whole path before ship | every drift classified and fixed at the narrowest correct level |
+| `harden` | `reference/harden.md` | real data is coming | the surface survives long, empty, foreign, failing and huge |
+| `onboard` | `reference/onboard.md` | first run, empty states, a short tour | the fastest path to first value, skippable, never repeated |
+| `animate` | `reference/animate.md` | motion, delight, an ambitious effect | a motion thesis, one focal moment, a reduced-motion path for everything |
+| `colorize` | `reference/colorize.md` | colour feels off | colour by role inside the fifteen, ratios verified from computed values |
+| `typeset` | `reference/typeset.md` | type feels off | the role scale on the pack's faces, measure and tracking verified |
+| `layout` | `reference/layout.md` | order, grouping, rhythm, density | the page restructured, not rescaled |
+| `adapt` | `reference/adapt.md` | another width or context | restructured per context; native declines |
+| `distill` | `reference/distill.md` | too much | elements, options, copy and code removed; function kept through disclosure |
+| `clarify` | `reference/clarify.md` | copy is unclear | interface copy rewritten by its function, flagged to `copy-desk` |
+| `optimize` | `reference/optimize.md` | it feels slow | the measured bottleneck fixed, not the suspected one |
+| `document` | `reference/document.md` | after the build | the design-system doc drafted from shipped code |
+| `extract` | `reference/extract.md` | a pattern repeats | repeated patterns consolidated into the system, call sites migrated |
+| `bolder` | `reference/bolder.md` | one section falls short of its neighbours | one section raised, nothing else touched |
+| `quieter` | `reference/quieter.md` | too loud | saturation, weight, decoration and motion reduced; hierarchy kept |
+
+Every playbook opens by naming which of the four cases it is running in and which visitor mode the brief holds, ends by handing the result to the finish below, and obeys the preamble: the world first, the fifteen as the only colours, hero plates as the only imagery, the switch as the only motion, the kit as the proof.
+
+## The craft floor
+
+Load this **after direction is settled and immediately before editing UI**; skip it for planning-only work (`shape`, `critique`, `audit`, `document` read it, they do not edit); **never recite it to the user**. It is mechanics, not direction: the floor is what every surface clears, the world is what it becomes.
+
+- **Contrast, on the built result**: body and placeholder text at 4.5:1, large text at 3:1, in both modes, measured (`kit/contrast.js` for the pairs, `render.js` for the page). Secondary text on a coloured surface is tinted from that hue (`color-mix()` of the surface and the ink), never a grey dropped on top.
+- **Depth, in the world's language**: where the world has shadows they carry an offset and a soft blur; a zero-offset coloured halo is decoration, not elevation. Where the world is hairlines by rule (the chrome world), the absence of a shadow is the floor, and a hard zero-blur offset shadow belongs only to a world that chose that language.
+- **Spacing rhythm, from computed values**: tight within a group, generous between groups, more air above a heading than below it, every step on the world's scale.
+- **Type**: prose measure 65 to 75 characters; a display ceiling; a tracking floor at display sizes; balanced headings (`text-wrap: balance`) and pretty prose; no overflow with real copy at 1440, 390 and 320.
+- **Motion**: one authored moment, not scattered effects and not the same entrance on every section; easing out from an already-visible default; everything inside the switch; the rest frame complete.
+- **States**: hover, disabled, loading, error and empty, each named in the page's states file; real content, working controls, responsive composition, a visible keyboard focus ring.
+- **The browser surfaces nobody draws**: `::selection`, `caret-color`, the scrollbar, the focus ring, `text-underline-offset`, `font-variant-numeric: tabular-nums` on data.
+- **Refuse**: identical icon-plus-heading-plus-text card grids as page structure; a card nested in a card; the hero-metric template; decorative section numbering; a kicker or eyebrow above a heading where the world bans one (the chrome world does, above the h1); gradient text; decorative glass and blur; a coloured side stripe above a hairline on a card or callout; emoji or unicode glyphs standing in for a drawn icon set; a system display face as the world's display voice (the pack's faces are the voice); a geometric mask faking an organic cutout.
+- **Then commit.** With every check green, the remaining effort goes to the committed world; when torn between refined and committed, commit.
+
+## The finish
+
+Verification is **bounded passes, never an open loop**, and the budget covers the whole cycle: shots, checks, micro-edits and rebuilds all count against it.
+
+1. **Build fully.** Nothing is inspected half-built.
+2. **Inspect once, batched.** `node modules/ui-design/kit/render.js --page <path>` renders every state at 1440 / 390 / 320 in the modes the states file names and audits each against the floors; `node modules/ui-design/kit/probe.js --page <path>` runs the interaction contract. Desktop and mobile arrive in the same round. Validate the captures before believing them: entrance motion settled (the kit's reduced-motion pass is the rest frame), captured from the document top, at the intended dimensions, and each file opened to confirm it shows what its name claims.
+3. **Fix everything it showed in one batch.** Not one finding at a time.
+4. **Confirm with at most one more round.** Then stop.
+
+**The separate reviewer.** Hand the review to a read-only subagent that did not see the build conversation (the harness's Agent tool, the top-tier model, its ordinary permissions), with an explicit packet: the request, the user's answers, the artifact paths, the shots directory, the brief block, the kit's findings, and the approved mock where one exists. The reviewer runs an **evidence check first** and returns `recapture` when any required capture is missing, blank, mismatched or implausibly sized, rather than scoring on broken evidence. It builds its **own inventory** of the approved mock and classifies each salient element as *match*, *acceptable adaptation*, *missing*, *contradicted* or *added without approval*; a deviation is intentional only when it cites a user answer, the brief, an accessibility need or product truth, and an uncited deviation is a defect. Its disposition is **one of four words, derived from its checks**: `clean`, `recapture`, `defects`, `contradicted`; report that word unchanged and at its true scope (a page, not the site). A **second verdict pass** scores each prior fix *resolved*, *partial* or *unresolved* strictly from new captures, opens no new checks, and treats the builder's narration as non-evidence. When the user supplies evidence that contradicts a verdict, **reopen a fresh review** rather than defending the last one.
+
+**Close.** A source diff pass removes accidental churn, orphaned rules, duplicate values and temporary artifacts; then `document` records the design system from what was built. The platform's own ship-time grader is a second independent reviewer and reads the real committed diff, so the ship notes carry the brief block, the shots looked at and in which modes, and the reviewer's word.
+
+## Not here, and where it went
+
+- **The anti-pattern detector**: task 1003329 lands it as rules in `kit/check-mock.js` and `kit/lib.js`; today `check-mock.js` (the platform rules and the instance's `DESIGN.md` bans over a mock), `render.js`'s floors and `contrast.js` are the deterministic floor. Run it once per review round, treat a clean scan as a floor and never as proof, verify every finding in context and name false positives out loud.
+- **The live loop**: `claude plugin install playwright@claude-plugins-official`, a prerequisite the module never installs, driving `kit/serve.js`'s stub (`SURFACE=<dir or module key>`, `STYLE=<look>`). Variants are states in the states file, rendered by the kit; accepting one is a commit and discarding one is a checkout; there is no in-page overlay, no injected script, no journal, and no leftover to sweep because nothing was injected.
+- **Hooks, the bypass agent, telemetry, the remote bundle, the installer, `doctor`, `pin`, `unpin`**: gone. The ship gate is the sweep; the materialiser is the install; a reviewer runs with ordinary permissions.
+- **The asset producer**: images are hero plates and hero objects by token (task 1003328 for the image family); nothing here generates, crops or cleans an image.
+- **Native mobile**: `/design`, with the one principle that survives the drop stated for the record: the platform governs structure, navigation and interaction, and brand expresses through tint, type, motion and content.

package/modules/ui-design/skills/impeccable/reference/adapt.md

@@ -0,0 +1,25 @@
+# `impeccable adapt` — restructure per context, never scale pixels
+
+**When:** a surface built at one width must work at another, or in another context: a phone, a narrow pane, a print sheet, a large-text setting, a kiosk. Edits: yes, on the sheet's context rules and the states file.
+
+**Runs in:** every case. The platform's contexts are the three the kit renders (1440 / 390 / 320), the two modes, the reduced-motion pass and the large-text setting; the world names one breakpoint and the collapse it wants.
+
+## Native declines
+
+An adaptation to a native mobile app, on either platform or cross-platform, is not this playbook: the surfaces here are served web pages and the native playbooks were not rebuilt. Say so in one line and route to `/design`. What survives of the principle is that porting translates idioms and never transplants them, and that a screenshot from a browser is not evidence for a native surface.
+
+## Diagnose per context
+
+For each context, read the shot and answer three questions: what does the visitor do here that they do not do elsewhere (a phone is one-handed and interrupted; a print sheet is read once, without a hover); what breaks (the bar wraps, the headline hits three lines, a table scrolls sideways, a hover-only affordance vanishes); what must survive (the primary action above the fold, the 24px floor, the measure).
+
+## Restructure
+
+- The collapse the world names comes first (the chrome world: a 60px single-row bar under 900, the hero as a static centred column, the ledger one column per row, the basics stacked). Below it, invent nothing that the wider layout does not already contain.
+- A table becomes rows with labelled cells, not a sideways scroll; a menu becomes a disclosure; a hover affordance gains a visible twin.
+- Large text: every container is `min-height` or content-sized, nothing `height`; the bar still holds one row at 200 percent.
+- Print: a `@media print` block that hides the chrome and keeps the content, in ink on the pack's light ground.
+- Nothing scales: the type roles keep their sizes, the controls keep their floor, the composition changes.
+
+## The return
+
+Every context the page serves named as a state or a size the kit renders, ALL CLEAN; `probe.js` PASS at 390; the ship notes list which contexts were adapted and which the page does not serve.

package/modules/ui-design/skills/impeccable/reference/animate.md

@@ -0,0 +1,27 @@
+# `impeccable animate` — motion with a thesis
+
+**When:** motion is asked for, a page feels dead, delight is wanted, or an ambitious effect is proposed. Edits: yes, in CSS only.
+
+**Runs in:** every case; the world's motion grammar (the chrome world: the breath and the drift, a 20s floor on ambient loops, one authored arrival) caps everything below.
+
+## Write the thesis before any keyframe
+
+Three sentences in a comment at the top of the motion rules: **the one focal moment** (what arrives, once, and why the visitor should notice), **the feedback motion** (what answers a press, a hover, a change of state, on the state curve at 200 to 400ms), and **the continuity motion** (what keeps a change from being a cut: a band opening, a row entering). A page has one focal moment; a second is a `quieter` finding.
+
+Choose every property by what it communicates: `opacity` for presence, `transform` for place and scale, `filter` on a plate for atmosphere where the world paints one. Nothing else animates, and never a layout property. Ease out from an already-visible default: the rest frame is the design, and motion is how it is reached, so a page that fails to animate is still the page.
+
+## Delight, earned once
+
+A personality moment is allowed when it is **tied to the product's own mechanism** (a ledger's figure ticking to its new value; a project's orb settling into its shelf), never a generic flourish. One per surface. If the sentence that justifies it is "it looks nice", it goes.
+
+## Ambitious effects
+
+For a technically extraordinary effect, **propose two or three directions first**, each one paragraph with what it costs at 390 and under the switch, and get the person's pick before writing any code. A direction that needs script to move (a spring, a magnetic hover, a pointer-tracked border, a shared-element transition) is named **not available** on this platform and a CSS neighbour is proposed instead; a scroll-driven one goes through `animation-timeline` behind `@supports` with a static fallback.
+
+## The reduced-motion path, for everything
+
+The Kill Switch at the foot of the token layer kills every animation and transition; the rest frame you designed first is what remains. A stagger comes from an `--i` custom property in the markup. A loop moves only plates and respects the world's period floor. Every rule carries a one-sentence comment naming what it communicates.
+
+## The return
+
+The thesis comment; the rules; the kit's reduced-motion pass green (`render.js` fails a page where anything still runs); the ship notes name the focal moment and the shots where it was seen at rest and in flight. Contrast holds at every phase where a ground moves.

package/modules/ui-design/skills/impeccable/reference/audit.md

@@ -0,0 +1,19 @@
+# `impeccable audit` — the technical review
+
+**When:** "is this correct?" The engineering half of a review: what the page does under the platform floors and the world's named rules, documented with locations and **fixed by nothing here**. `polish` fixes; `audit` lists.
+
+**Runs in:** every case. In cases 3 and 4 the world's rules are the pack's fifteen and the platform floors, and an audit row that would need a `DESIGN.md` rule to judge is marked *no rule*, not failed.
+
+## The five dimensions, each scored
+
+Score each 0 to 3 from evidence the kit produced, never from reading the sheet alone: `render.js` for the floors at every state, size and mode, `probe.js` for the interaction contract, `contrast.js` for the pack pairs, `check-mock.js` for a mock. Then read the source for the location of every problem the shots showed.
+
+1. **Accessibility.** Contrast in both modes; a visible focus ring on every control; one `<main>`, one `<header>`, one `<h1>`, a skip link that targets `<main>`; every control at the 24px floor; every image with `alt` or `aria-hidden`; a disclosure pattern on every menu; nothing that reads only by colour.
+2. **Performance.** The largest contentful element is a plate or the headline, never a node a script built; fonts sized-fallback and `font-display: swap`; nothing animates a layout property; no continuous script (`requestAnimationFrame`, timers that touch layout); live DOM is `createElement` and `textContent`.
+3. **Theming.** No literal colour outside black or white with alpha; no page `:root`; every dark rule written twice and byte-identical; no pack colour pinned as a literal; the accent spent only where the world allows.
+4. **Responsive behaviour.** Nothing scrolls sideways at 1440, 390 or 320; the bar holds one row; the headline holds the world's line count at every width; touch targets keep the floor when the layout collapses.
+5. **Implementation integrity.** One sheet, no inline styles, a named `z-index` scale on `body`, no dead selectors, no duplicate values that should be one token, no `innerHTML`, every state in the states file reachable, every probe green.
+
+## The return
+
+A table of issues: **dimension, file and line, what the shot shows, the floor or named rule it breaks, the playbook that fixes it**. Scores per dimension and the total. A row the instance's `DESIGN.md` calls for by name (the chrome world's pure-black dark, its flat bands) is not a defect and is listed under *world-sanctioned* so the next reader does not re-flag it. Save nothing except the ship notes; the kit's `report.json` is the artifact and it is regenerated each run.

package/modules/ui-design/skills/impeccable/reference/bolder.md

@@ -0,0 +1,17 @@
+# `impeccable bolder` — raise one section to its neighbours' conviction
+
+**When:** one named section falls short of the page around it: a band that whispers between two that speak, a call to action that recedes, a headline that apologises. Edits: yes, **inside the named target only**; everything outside it stays byte-identical.
+
+**Runs in:** cases 2 and 3; there is no bolder without a world that already sets the register.
+
+## Only the vocabulary the system already owns
+
+Bolder is not louder. The section is raised to the conviction its neighbours already reach, using only what the world already has: its display size ceiling, its heavier term weight, its one accent (on the pressable and the live only), its full-bleed band, its plate where the composition allows one, its scale of air. Nothing is introduced: no new colour, no new face, no gradient, no glow, no motion the thesis does not already name.
+
+- Read the neighbours first and write down what gives them conviction (a two-line headline at the ceiling, a single door, a plate behind them, a band of air). Then give the target the same devices at the same intensity, not more.
+- One device usually does it. Try the largest lever (size and air) before the smallest (weight), and stop at the first one that brings the section level.
+- If the section cannot reach its neighbours without a device the world lacks, that is a `shape` finding about the section's purpose, not a reason to invent one.
+
+## The return
+
+The diff confined to the target's rules and markup, with one line in the ship notes naming the device used; the page rendered ALL CLEAN at all three widths in both modes; the rest of the page's shots pixel-identical to the before run.

package/modules/ui-design/skills/impeccable/reference/clarify.md

@@ -0,0 +1,25 @@
+# `impeccable clarify` — interface copy by its function
+
+**When:** the words on the surface are unclear: a button that does not say what happens, an error that blames, a label that needs the help text to make sense. Edits: proposed, and applied only where the string is structural (a label, an action); the product's voice belongs to `copy-desk`, so voice changes are flagged to them with the proposed text.
+
+**Runs in:** every case; copy is not world, but the instance's copy bans are (no long dash in visible copy where banned, no emoji, no exclamation in success copy).
+
+## Rewrite by function, not by feel
+
+Every string on the surface has one of seven jobs; classify it first, then apply that job's rule.
+
+| Function | The rule |
+|---|---|
+| **Action** (buttons, links that do) | a verb and its object, in the visitor's words: "Save changes", never "Submit" or "OK"; destructive actions name the loss |
+| **Form** (labels, placeholders, hints) | the label says what to enter, the placeholder shows the shape and is never the label, the hint says the constraint before the mistake |
+| **Error** | what happened, what to do next, in that order, addressed to the situation and never to the visitor's fault; the field it belongs to is named |
+| **Loading** | what is being fetched and, if it is slow, how long; never a spinner with no sentence |
+| **Empty** | what this will hold and the one action that fills it (`onboard` designs the state; this rule writes its line) |
+| **Success** | what is now true, plainly, without an exclamation mark |
+| **Help** | the one fact the visitor cannot infer from the control, and nothing the label already said |
+
+Then the hygiene: sentence case; no long dash where the instance bans it; a number is a number, not "a few"; no placeholder names or invented brands; every string that appears twice appears in one place in the source.
+
+## The return
+
+A table of strings: **location, function, before, after, who owns it** (structural strings changed here; voice strings flagged). The page rendered with the new strings at 390 and 320 so no label wraps into a second row in the bar; the ship notes carry the flag list for `copy-desk`.

package/modules/ui-design/skills/impeccable/reference/colorize.md

@@ -0,0 +1,22 @@
+# `impeccable colorize` — colour by role, inside the fifteen
+
+**When:** colour feels off: too many, too few, an accent spent on the wrong thing, a pairing that fails in one mode. Edits: yes, on the token layer and the rules that read it, never on the pack.
+
+**Runs in:** cases 2 and 3 with the pack as the palette; in case 1 (a redesign) the new palette is a look from `modules/ui-design/styles/` compared with `--style <name>` on the kit and adopted by the owner, never chosen here.
+
+## Assign roles, then map roles to tokens
+
+Write the role list for the surface before touching a value: **ground, surface, ink, ink-muted, rule, accent (pressable and live only), a second voice where the world has one, the status vocabulary the platform owns (green, amber, red on the hall), focus, selection.** Every element on the page takes exactly one role. A role with no token is a `color-mix()` of two that exist (`color-mix(in srgb, var(--ink) 55%, var(--bg))` for a muted ink), declared once on `body`, never a literal.
+
+- The accent lights what is pressable or live; a mark that is neither is ink, rule or nothing.
+- No dark block pins an accent-family token to a literal; dark derives.
+- A coloured surface tints its secondary text from its own hue, so a muted label on the accent is `color-mix()` of the accent and the ink, not a grey.
+- The purple-blue generated gradient, gradient text and a coloured glow are refused on every pack unless the instance's `DESIGN.md` names them.
+
+## Verify from computed values
+
+Ratios are measured, never judged by eye: `node modules/ui-design/kit/contrast.js` for the pack's pairs (`--pack <look>` to measure a look), `render.js` for the page in both modes at every state. Body and placeholder text 4.5:1, large text and non-text 3:1, and where a ground moves under the text, at every phase of the loop. A pairing that fails in one mode is fixed in the role map, not by a mode-specific override that splits the twins.
+
+## The return
+
+The role list as a comment at the head of the token block; every colour on the page a `var()` or a `color-mix()`; the twins byte-identical; the contrast run clean in both modes; the ship notes name any role the world lacks as a gap for the owner, never as a private token this page added.

package/modules/ui-design/skills/impeccable/reference/critique.md

@@ -0,0 +1,15 @@
+# `impeccable critique` — the design review
+
+**When:** "is this good?" A judgement of the surface as a person meets it. Read-only: it returns issues and fixes and edits nothing.
+
+**Runs in:** every case; the visitor mode from the brief sets what "good" means (a persuading page is judged on conviction and the fold, an operating page on error cost and speed, a reading page on measure and rhythm, an experiencing page on the one moment).
+
+## The three passes, in order
+
+1. **The heuristics, scored on a table.** Render the page first (`node modules/ui-design/kit/render.js --page <path>`) and judge the shots, not the source. One row per heuristic, a score from 0 to 2 and one line of evidence: visibility of state, match to the world's vocabulary, control and undo, consistency with the instance's other surfaces, error prevention, recognition over recall, efficiency for the returning visitor, aesthetic restraint, error recovery, help where it is needed. A row with no evidence line is not scored.
+2. **The personas, walked.** Three archetypes and one path each, written as what they see and do at 1440 and at 390: the first-time visitor who has thirty seconds; the returning operator who does this daily and hates every extra click; the visitor with a screen reader, a keyboard, a large text setting or reduced motion. Each walk ends in the moment they would leave, or the moment they were done.
+3. **The cognitive-load checklist.** Count, do not feel: distinct type sizes in view; distinct colours in use; competing calls to action in the first viewport; choices offered before the first meaningful one; things that move; things that need reading before the primary action is understood. Anything above the world's own ceilings (the chrome world: two lines of headline, one accent, one authored motion) is a finding.
+
+## The return
+
+**Three to five issues, prioritised** by cost to the visitor times how often it is met, each with the heuristic or persona that surfaced it, the shot that shows it, and the fix named as the playbook that does it (`clarify` for a copy problem, `layout` for a grouping problem, `distill` for too much, `harden` for a state that breaks). Fewer than three means the page is good and the review says so; more than five means the top five and a line that the rest exist. Where the world calls for something the checklist would count against it, say the world is the answer key and drop the row.

package/modules/ui-design/skills/impeccable/reference/distill.md

@@ -0,0 +1,26 @@
+# `impeccable distill` — remove what does not earn its place
+
+**When:** too much: too many elements, options, words, states, rules. Edits: yes, and they are mostly deletions.
+
+**Runs in:** every case. Distilling toward the world means the surviving elements are the world's components and nothing else.
+
+## The four inventories
+
+Count before cutting. For each inventory, write the list, then mark each entry *earns its place* (the visitor's task needs it, in this mode) or *does not*.
+
+1. **Elements.** Every band, panel, badge, dot, cue, stripe, divider. A decorative status dot, a scroll cue, a version badge, an enumerated section label and a trust strip are the usual first cuts and are banned outright in the chrome world.
+2. **Options.** Every control the visitor can operate: filters, toggles, sorts, secondary actions. An option used by fewer than one visitor in ten goes behind a disclosure; an option nobody would miss goes.
+3. **Copy.** Every sentence: a headline that explains the subhead, a subhead that repeats the headline, a caption under a self-evident control, help text for a labelled field. Tighten to the word; the voice stays `copy-desk`'s and the cuts are flagged to them.
+4. **Code.** Every rule that no selector matches, every token no rule reads, every state no probe reaches, every script that only decorates. Delete, do not comment out.
+
+## Where the function must survive
+
+- **Progressive disclosure**: the rarely-used behind a disclosure control that follows the world's pattern (a button with `aria-expanded` and `aria-controls`), the disclosed content still in the DOM and still a state the kit renders.
+- **Consolidation**: three similar panels become one with a switch; two bands saying one thing become one band.
+- **Defaults**: a choice with an obvious answer becomes the answer, with the choice moved out of the way.
+
+Never remove a state the visitor can reach (error, empty, loading); never remove the skip link, the focus ring or a control's floor; never remove a rule the world names.
+
+## The return
+
+The four inventories with each entry's verdict; the diff mostly red; the page rendered ALL CLEAN with fewer distinct type sizes, colours and gaps than before (state the counts); `probe.js` PASS with the same probes, because function survived.

package/modules/ui-design/skills/impeccable/reference/document.md

@@ -0,0 +1,25 @@
+# `impeccable document` — the design-system doc from shipped code
+
+**When:** after a build, when an instance has no `DESIGN.md`, or when the one it has no longer describes what is served. Writes: a draft, on the claim's branch, that the owner reviews in the PR. **The root `DESIGN.md` is the instance's world; this playbook records it and never invents it.**
+
+**Runs in:** cases 3 and 4 as a seed; case 2 as a refresh. It never runs in the same pass as `shape` (product truth and the visual system are written by different hands at different times).
+
+## Ground truth is what shipped
+
+Scan in this order and record only what repeats (a value used once is not a token): the custom properties on `body` and in the pack; the branding pack's `theme.ui`; `config/design-tokens.json`; the served sheets; the components the surfaces share; last, computed styles sampled from a page through the stub. Group colour into role families; map type onto the fixed hierarchy (display, headline, title, body, label, caption, data); catalogue elevation, or record flatness explicitly where the world is hairlines; keep the project's own colour format.
+
+**Refuse to canonise a defect.** A value the craft floor forbids (a literal hex, a page `:root`, a `100vh` band, a script animation) is reported as *carried* in the draft's notes, never written into the system as a rule. **Refuse to ban a device the world natively uses**: if the chrome world's dark is pure black by decision, the draft does not call pure black a defect.
+
+## The creative layer, asked not derived
+
+Two short rounds of at most three questions each, and only for what the code cannot say: the named metaphor (the world's one sentence), the mood, descriptive names for the colours, the elevation philosophy, and one phrase for how components feel. Answers go into the draft's overview as the owner's words.
+
+## The shape of the draft
+
+The root `DESIGN.md`'s own shape, so the kit's `check-mock.js` can read its bans: frontmatter with the machine-readable tokens (colour, type, radius, spacing, components), then the fixed sections by heading: Overview, Colors (with Modes, The derived tiers, Named Rules), Typography (Hierarchy, Named Rules), Layout, Elevation and Depth, Motion, Shapes, Components, Do's and Don'ts, Accessibility Floors. Sections with nothing real are omitted, never padded. A look's `DESIGN.md` under `modules/ui-design/styles/<name>/` takes the same shape with its thirteen in lockstep with its pack.
+
+**An existing doc is never overwritten silently.** Show it and its drift first, and offer the explicit choice: *refresh* (only the sections that drifted), *overwrite* (the whole draft, the old one in the diff), or *merge* (the draft's new rules appended under the existing headings). A project before its first build gets a *seed* with placeholders marked as such and no derived tiers.
+
+## The return
+
+The draft in the diff under the claim; the drift list in the ship notes; the *carried* defects listed with the playbook that would fix each; nothing written outside the branch.

package/modules/ui-design/skills/impeccable/reference/extract.md

@@ -0,0 +1,20 @@
+# `impeccable extract` — consolidate the repeated pattern into the system
+
+**When:** a pattern repeats across pages or components, or hard-coded values recur where a token should be. Edits: yes, across every call site, with parity proven before the old code is deleted.
+
+**Runs in:** cases 2 and 3; in case 4 there is no system to extract into, and the extraction is a proposal for the owner.
+
+## The threshold
+
+**Three or more** repeats, or a hard-coded value that appears in more than one file. Below that, leave it: one-off extractions, uselessly generic components, a token per value, and merging things that only look alike are the four ways an extraction makes a codebase worse, and each is refused by name in the ship notes when the person asks for it.
+
+## The four steps
+
+1. **Inventory** every occurrence: file, line, the values that differ between them. Differences that are content (a label, a count) become the component's inputs; differences that are drift (a 2px taller bar) become the bug the extraction fixes; a difference that is a real design decision means these are two patterns, not one.
+2. **Consolidate** into the existing system: a token on `body` for a value, a shared rule for a component, a fixture shape for a feed. Into the world's vocabulary (the chrome world's pill, ledger row, poster card), never a new family beside it. A markup pattern the platform's pages share becomes a documented snippet with expanded utilities, inlined marks and namespaced classes, so a page can copy it without a build step.
+3. **Migrate every call site** and **verify parity**: `render.js` for each page before and after with the same states file, shots compared; `probe.js` PASS on each; `contrast.js` unchanged. A call site that cannot reach parity is either the drift being fixed (say which) or a second pattern (stop and split).
+4. **Delete the superseded code** and update the catalogue: the component's line in the root `DESIGN.md` (via `document`, as a draft) and in the surface's nested `CLAUDE.md`.
+
+## The return
+
+The inventory; the one place the pattern now lives; the diff red where the copies were; parity shots named per page; the ship notes carry any refusal (below threshold, two patterns, a decision not a drift) in one line each.

package/modules/ui-design/skills/impeccable/reference/harden.md

@@ -0,0 +1,21 @@
+# `impeccable harden` — make the surface survive
+
+**When:** real data is about to arrive, or a surface was built against the neutral fixtures only. Edits: yes, on the sheet and on the states file, never on the copy's meaning.
+
+**Runs in:** every case; hardening is floors, not world.
+
+## The seven pressures, each a state
+
+Add a state to the page's states file for every pressure below that the page can meet, so the kit renders it forever after instead of a session remembering to look once. The fixtures under `modules/ui-design/kit/fixtures/` are the neutral shapes; a hardening state supplies the hostile ones through the stub's `FAIL=` and `LIVE=` switches or a fixture variant.
+
+1. **Long text**: a name at the field's limit, a title that wraps three times, a URL with no break opportunities. `overflow-wrap: anywhere` on user text, `text-overflow` only where truncation is a decision the brief made, a measure that holds.
+2. **Empty text**: a missing name, an empty list, a zero. Every empty state is designed (`onboard` owns the first-run one; the rest are here), and a zero is a number, not a blank.
+3. **Foreign scripts**: emoji in user text (allowed there; banned in the world's own copy), right-to-left runs inside left-to-right lines (`unicode-bidi: plaintext` on user text), CJK with no spaces, combining marks that grow the line box.
+4. **Translation expansion**: every label survives a 40 percent longer string without clipping or a second row in the bar; no control's width is a magic number.
+5. **Failure**: the feed 5xx, the feed slow, the feed a different shape; a state each, and the page still a complete composition with the failure said in the instance's voice (a string flagged to `copy-desk`, not invented).
+6. **Permission**: signed out, signed in below the rank the surface expects, signed in and disabled; the stub's `AUTH=1` and the fixtures' builder are the two ends.
+7. **Scale**: a list of a thousand rows, a plate that never loads, a table wider than 320. Pagination or a window, never a scroll of the whole document sideways.
+
+## The return
+
+The new states named in the states file and rendered ALL CLEAN in both modes at all three widths; `probe.js` still PASS; the ship notes list which pressures the page could not meet and why (a surface with no user text has no long-text state, and says so). Nothing was made prettier; that is `polish`.

package/modules/ui-design/skills/impeccable/reference/layout.md

@@ -0,0 +1,20 @@
+# `impeccable layout` — reading order, grouping, rhythm, density
+
+**When:** a page reads in the wrong order, groups the wrong things, has no rhythm, or is too dense or too thin for its mode. Edits: yes, on structure and spacing; never a rescale.
+
+**Runs in:** every case. The world supplies the container, the breakpoint, the rhythm scale and the archetypes (the chrome world: full-width bands under a hairline, a 1180px wrap, one breakpoint at 900); this playbook arranges inside them.
+
+## Diagnose four things, from the shots
+
+1. **Reading order.** Read the 1440 shot top-left to bottom-right and write down the order the eye takes; then read the DOM order. Where they differ, the DOM is wrong (a screen reader gets the DOM) or the composition is (the eye gets the composition); fix the one that is wrong, never with `order` alone.
+2. **Grouping.** Things that belong together sit closer to each other than to anything else; a group has one heading, one purpose, one boundary (a hairline, air, never a card where the world bans one). A group with two purposes is two groups.
+3. **Rhythm.** Every vertical gap is a step on the world's scale, tight inside a group and generous between groups, with more above a heading than below it. Measure the computed gaps; a page with eleven distinct gap values has no rhythm.
+4. **Density.** The visitor mode sets it: an operating surface holds more per band than a persuading one. Density is facts per band, not padding; the 24px floor and the measure never give.
+
+## Restructure, do not rescale
+
+The fix is a different arrangement at the same size, never a smaller font or a tighter container to make things fit. Adjacent bands never share a layout family (split, full-bleed, ledger, tile grid, single measure each appear once before any repeats); a grid has exactly as many cells as items; a bento with a filler tile is a list.
+
+## The return
+
+The new structure rendered at all three widths in both modes, ALL CLEAN; `probe.js` still PASS; the ship notes carry the before-and-after reading order as two numbered lists and the gap values as one line.

package/modules/ui-design/skills/impeccable/reference/onboard.md

@@ -0,0 +1,22 @@
+# `impeccable onboard` — first run, empty states, hints and a short tour
+
+**When:** a surface has a first time: an empty ledger, an unconfigured project, a page the visitor has never seen. Edits: yes, but only on the empty and first-run states and whatever carries a hint.
+
+**Runs in:** every case; onboarding is content and sequence, and the world supplies the form.
+
+## The one rule
+
+**The fastest path to first value.** Not the fullest introduction: the shortest sequence from arriving to having done the one thing the surface exists for. Count the steps before the first meaningful result and remove every one that a default could take.
+
+## The four devices, in order of preference
+
+1. **The designed empty state.** The page with nothing in it is a composition, not a blank: what this will hold, the one action that fills it, and nothing else. It uses the world's components (the chrome world's door pill, its hairline bands); it never carries an illustration invented for the occasion, because imagery is hero plates only.
+2. **A contextual hint**, placed where the thing it explains is, shown once, dismissable in one press, and **never shown again after dismissal** (a flag in `localStorage` keyed by the hint, read at render, never a server call). A hint that explains a control the world already makes obvious is removed.
+3. **A short tour**: at most three stops, each one sentence, each pointing at a real element on the page, skippable from the first stop with a control that clears the whole tour. A tour that needs a fourth stop is a `distill` finding on the page.
+4. **Progressive defaults**: a form prefilled with the sensible value so the first submit works, the advanced choices behind a disclosure.
+
+Everything is **always skippable and never repeated after dismissal**. Nothing blocks the page; nothing moves under the visitor's hands; the tour respects the switch like everything else.
+
+## The return
+
+The first-run and empty states named in the states file and rendered; the hints' dismissal proven by a probe (open, dismiss, reload, absent); every string flagged to `copy-desk` in the ship notes because voice is theirs. A one-line note of how many steps the first value now takes, against how many before.

package/modules/ui-design/skills/impeccable/reference/optimize.md

@@ -0,0 +1,22 @@
+# `impeccable optimize` — fix the measured bottleneck
+
+**When:** the surface feels slow, or a review suspects it is. Edits: yes, on whatever the measurement names, and nothing else.
+
+**Runs in:** every case; performance is floors, and the platform's surfaces are static markup, one sheet and script only for live data, so the usual suspects are few.
+
+## Measure first, on the real thing
+
+Suspicion is not a finding. Serve the page through the stub (`kit/serve.js`, the instance's real transforms) and measure with the playwright plugin or the browser's own tooling: the largest contentful paint and which element it was; layout shift and which element moved; the long tasks and which script ran; the bytes and which asset carried them; the render count under a live refresh. Write the numbers down before changing anything. **Fix the one thing the numbers name**, re-measure, and stop when the number is under the floor, not when the code looks fast.
+
+## The floors and their usual causes
+
+- **The largest paint is a plate or the headline**, never a node a script built. Cause: markup built from a fetch; fix: real values baked into the markup and refreshed live.
+- **Nothing shifts.** Cause: an unsized image, a web face without a sized fallback, a band that appears late; fix: `width`/`height` or `aspect-ratio` on every plate, `size-adjust` on the fallback face, the band in the markup from the start.
+- **No layout property animates.** Cause: a transition on `height`, `top`, `margin`; fix: `transform` and `opacity` only, and a `grid-template-rows: 0fr → 1fr` for an opening band.
+- **No continuous script.** Cause: a `requestAnimationFrame` loop, a timer that touches layout; fix: delete it, the switch forbids it anyway.
+- **Bytes**: one sheet, plates as a black JPEG plate plus a WebP alpha cutout at production size, fonts subset to the scripts the copy uses, no library for something CSS does.
+- **Live data** is `createElement` and `textContent` into existing nodes, batched per refresh, never `innerHTML` and never a rebuild of the list.
+
+## The return
+
+The numbers before and after on one line each; the one change and why the measurement named it; `render.js` still ALL CLEAN and `probe.js` still PASS; a note of what was **not** changed because the measurement did not name it.

package/modules/ui-design/skills/impeccable/reference/polish.md

@@ -0,0 +1,22 @@
+# `impeccable polish` — the final pass over a whole path
+
+**When:** a whole user path (sign in, pick a project, open the wizard, finish) before it ships, or after `audit` has listed what is wrong. Edits: yes, and every edit is classified first.
+
+**Runs in:** cases 2 and 3 mostly; a polish in case 4 is limited to the platform floors because there is no world to polish toward.
+
+## Classify every drift before touching it
+
+Walk the path in the kit's shots, every state, both modes, three widths. Each thing that is off goes in one of four buckets, and the bucket decides where the fix lives:
+
+| Bucket | What it looks like | Fix at |
+|---|---|---|
+| **Missing token** | a value the world names but the sheet spells out (a literal radius, a hand-typed grey, a duration) | the token layer on `body`: use the existing token, or name the gap in the ship notes if the world has none |
+| **One-off implementation** | the world's component rebuilt slightly differently on this page (a second pill, a bar that is 2px taller) | the shared rule: reuse the world's component, delete the copy |
+| **Conceptual mismatch** | the page speaks a different mode than its brief (a ledger that persuades, a landing that operates) | the brief, then `layout` or `distill`; not a polish edit |
+| **Local defect** | a typo in a selector, a missing state, a wrong breakpoint, an orphaned rule | the line |
+
+**Fix the cause at the narrowest correct level.** A missing token fixed on one page will drift again on the next; a local defect fixed in the token layer changes every page. Never fix a conceptual mismatch in a polish pass: name it and stop that thread.
+
+## Order and proof
+
+Fix all the local defects in one batch, then the one-offs, then the tokens, rendering once after each batch and never after each edit. A path is polished when `render.js` is ALL CLEAN for every page on it, `probe.js` is PASS, and the ship notes list every drift by bucket with the line that fixed it. The mismatches go to the notes as open decisions with the playbook that owns them.

package/modules/ui-design/skills/impeccable/reference/quieter.md

@@ -0,0 +1,17 @@
+# `impeccable quieter` — reduce without losing the point of view
+
+**When:** the surface is too loud: saturated where it should rest, heavy where it should breathe, decorated where it should be plain, moving where it should be still. Edits: yes, across the surface, each a reduction.
+
+**Runs in:** cases 2 and 3; in case 4 quieter means the neutral pack and the floors, and nothing more.
+
+## Quiet is precision, not grayscale
+
+Reduce four things, in this order, and stop at the first level where the page rests: **saturation** (the accent only on the pressable and the live; a second voice back to the world's second token; every other coloured thing to ink or rule), **weight** (the term weight only where a term is; headlines at the world's display weight; no bold as emphasis in prose), **decoration** (no dots, stripes, glows, badges, numbering, cues; a hairline where a box was; air where a divider was), **motion** (the one focal moment kept, everything else at rest; ambient loops slower or gone).
+
+What must survive, and is checked after each level: **hierarchy** (the eye still lands on the headline, then the action, then the proof), **personality** (the world's display voice, its one warm thing, its plate if it had one), and **the point of view** (a quieter page still argues the same thing; if it now says nothing, the reduction went one level too far and the last step is reverted).
+
+Never quieten by desaturating everything to grey, by lowering contrast below the floor, by hiding a state, or by removing the one plate the composition was built around.
+
+## The return
+
+The four levels applied, named in the ship notes with the level at which the page rested; the page rendered ALL CLEAN in both modes; the contrast run unchanged or better; the counts of distinct colours, weights and moving things before and after on one line.

package/modules/ui-design/skills/impeccable/reference/shape.md

@@ -0,0 +1,23 @@
+# `impeccable shape` — the bounded discovery interview
+
+**When:** before any new visual work, or when the brief block in the ship notes has holes (no audience, no primary action, no mode). Planning only: **no code, no contract, no persistence** beyond the brief block itself.
+
+**Runs in:** any of the four cases. In case 4 (no visual authority) it is also where the session says out loud that the neutral pack is the world.
+
+## The interview
+
+One round by default, **two or three questions per round**, each about outcomes and product behaviour rather than implementation (the owner may not be an engineer). Prefer the harness's structured question widget where one exists; otherwise three numbered questions in one message. A second round only when the first left a fork open, and never a third.
+
+Pick the questions from what the homes do not already answer. Read `docs/project-context.template.md` and the task body first; ask nothing they settle.
+
+- **Who is this for and what do they come to do?** The visitor mode falls out of the answer: persuade, operate, read, or experience. Pick it from the surface, not the product.
+- **What is the one action, and what proof makes them take it?** A ledger's proof is the data itself; a landing's is a plate and a sentence; a settings page's is that nothing is hidden.
+- **What must not change?** The named rules of the world bind by default; the question is which existing content, behaviour or identity is out of scope for this pass.
+- **Refine or redesign?** Say what each means in one line (refinement keeps the look; redesign keeps the truth and replaces the look) and make them pick. No blend.
+- **Mockup first or straight to code?** Asked once, as its own question, and recorded in the brief; a surface with a settled world usually goes straight to code and proves itself in the kit.
+
+Where the product-truth file is still the scaffold, the round covers its sections too (platform, users, purpose, positioning, constraints, brand commitments, accessibility), **at least one real answer** before anything is treated as known; an inferred fact is labelled *inferred* in the brief and disclosed up front. Invented social proof, pricing and figures are banned; an undecided fact is recorded as *undecided*, never padded.
+
+## The return
+
+A confirmed written brief in the brief block's shape, read back to the person in full and confirmed with one word before it is written into the ship notes. Proposed edits to `docs/project-context.template.md` are listed as a diff for the owner, not applied by this playbook. Then hand off: a new marketing surface goes to `design-taste-frontend`, a working surface to the `/design` loop, and a change to an existing one to the playbook the brief names.

package/modules/ui-design/skills/impeccable/reference/typeset.md

@@ -0,0 +1,24 @@
+# `impeccable typeset` — type on a role scale, on the pack's faces
+
+**When:** type feels off: sizes that do not relate, a headline that wraps to three lines, prose that runs wide, numbers that jitter. Edits: yes, on the type tokens and the rules that read them.
+
+**Runs in:** every case. The faces are the pack's two stacks in every case; a brief that names another typeface gets the nearest face the pack carries and a line in the notes.
+
+## The role scale
+
+Name the roles the surface uses before setting a size: **display, headline, title, body, label, caption, data**. Each maps to one token on `body` (size, line-height, weight, tracking, and the face it takes from the two stacks). A size that belongs to no role is deleted. The world's hierarchy caps the count; the chrome world's display voice is light, tight-tracked and lowercase, its headline holds two lines, its labels are a mono face and are the only place it shouts.
+
+- **Measure**: prose 65 to 75 characters (`max-width` in `ch`), and the measure is spent on the reading text, not on a container.
+- **The display ceiling**: a `clamp()` whose upper bound is the world's, and a tracking floor at display sizes so a big face does not fall apart.
+- **Balance**: `text-wrap: balance` on headings, `pretty` on prose, and no orphaned last word on a headline at 1440 or 390.
+- **Data**: `font-variant-numeric: tabular-nums` on anything a ledger produced, so a live refresh does not reflow the row.
+- **Loading**: `font-display: swap` with a fallback sized to the web face (`size-adjust`, `ascent-override`) so nothing shifts when it arrives.
+- **Case**: sentence case for headlines and prose, the world's lowercase for its display voice and controls, uppercase only in a label face the world names.
+
+## Verify from computed values
+
+The kit's shots at 1440 / 390 / 320 with real copy from the fixtures: no overflow, the headline within the world's line count, the measure within range, the bar on one row. Measure the rendered line length, do not estimate it.
+
+## The return
+
+The role tokens declared once; every text rule reading a role; the shots clean at all three widths in both modes; the ship notes list any role the world's `DESIGN.md` does not name, as a gap for the owner rather than a size this page invented.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.461",
+  "version": "1.19.462",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.461",
+      "version": "1.19.462",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.461",
+  "version": "1.19.462",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.461'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.462'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ui_design_skills.mjs

@@ -107,6 +107,47 @@ test('the taste core of task 1003325 exists as four in-house skills and every on
   }
 });
 
+// ── the impeccable method (task 1003326, ADR 0221): one skill, one playbook per sub-command ──
+const IMPECCABLE = path.join(SKILLS, 'impeccable');
+const IMPECCABLE_SUBCOMMANDS = ['shape', 'audit', 'critique', 'polish', 'harden', 'animate', 'typeset', 'colorize', 'layout', 'adapt', 'distill', 'clarify', 'onboard', 'optimize', 'document', 'extract'];
+
+test('impeccable is one in-house skill whose sixteen sub-commands each own exactly one playbook under reference/', () => {
+  assert.ok(ownDirs.includes('impeccable'), 'skills/impeccable/SKILL.md exists');
+  assert.ok(manifest.contributes.skills.includes('impeccable'), 'declared in contributes.skills');
+  const skill = read(path.join(IMPECCABLE, 'SKILL.md'));
+  const refDir = path.join(IMPECCABLE, 'reference');
+  const onDisk = fs.readdirSync(refDir).filter((f) => f.endsWith('.md')).map((f) => f.replace(/\.md$/, '')).sort();
+  for (const sub of IMPECCABLE_SUBCOMMANDS) {
+    assert.ok(onDisk.includes(sub), `reference/${sub}.md exists (the task body names it)`);
+    assert.ok(skill.includes(`reference/${sub}.md`), `SKILL.md routes \`${sub}\` to its playbook`);
+  }
+  for (const ref of onDisk) assert.ok(skill.includes(`reference/${ref}.md`), `reference/${ref}.md is routed from SKILL.md (no orphan playbook)`);
+  for (const ref of onDisk) {
+    const text = read(path.join(refDir, `${ref}.md`));
+    assert.ok(!text.includes(policy.preamble.begin), `reference/${ref}.md carries no preamble copy (the block is pinned once, in SKILL.md, and governs every playbook)`);
+    assert.ok(text.trim().length > 400, `reference/${ref}.md is a playbook, not a stub`);
+  }
+});
+
+test('impeccable carries none of the behaviour that made its origin dangerous: no hooks, no bypass agent, no telemetry, no remote bundle, no live-server token', () => {
+  const files = [path.join(IMPECCABLE, 'SKILL.md'), ...fs.readdirSync(path.join(IMPECCABLE, 'reference')).map((f) => path.join(IMPECCABLE, 'reference', f))];
+  for (const f of files) {
+    const text = read(f);
+    const rel = path.relative(ROOT, f).split(path.sep).join('/');
+    assert.doesNotMatch(text, /bypassPermissions|--dangerously-skip-permissions/, `${rel}: no permission bypass`);
+    assert.doesNotMatch(text, /\b(write|add|install|register)\b[^.\n]{0,60}\b(PostToolUse|PreToolUse|Stop)\b[^.\n]{0,40}\bhooks?\b/i, `${rel}: no step writes a hook into a harness config`);
+    assert.doesNotMatch(text, /\b(write|edit|patch)\b[^.\n]{0,40}\bsettings(\.local)?\.json\b/i, `${rel}: no step edits settings.json`);
+    assert.doesNotMatch(text, /\b(enable|send|collect|report|emit)s?\b[^.\n]{0,40}\btelemetry\b|\btelemetry\b[^.\n]{0,40}\b(is|are|stays|defaults?)\s+(on|enabled|sent)\b/i, `${rel}: no step turns on or sends telemetry (naming the ban is fine; directing it is not)`);
+    assert.doesNotMatch(text, /\b(curl|wget|fetch|download)\b[^.\n]{0,60}\bhttps?:\/\//i, `${rel}: no remote bundle download`);
+    assert.doesNotMatch(text, /\b(auth|access|bearer|helper)\s+token\b/i, `${rel}: no live-server token`);
+    assert.doesNotMatch(text, /(disregard|ignore)\b[^.\n]{0,40}\b(system prompt|harness)/i, `${rel}: no instruction-override directive`);
+  }
+  const skill = read(path.join(IMPECCABLE, 'SKILL.md'));
+  assert.match(skill, /playwright/i, 'the live loop is the playwright plugin, named as a prerequisite');
+  assert.match(skill, /kit\/render\.js/, 'the headless loop is the kit');
+  assert.match(skill, /1003329/, 'the detector is named as its own task, not shipped here');
+});
+
 test('every in-house SKILL.md opens with the PLATFORM PREAMBLE, byte-identical to PREAMBLE.md, exactly once, right after its frontmatter', () => {
   const pre = read(path.join(SKILLS, 'PREAMBLE.md')).trimEnd();
   for (const name of ownDirs) {