@ericrisco/rsc 0.1.47 → 0.1.49

package/skills/django/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: django
-description: "Use when building, reviewing, securing, testing or shipping a Django web app — models, migrations, QuerySets, managers, FBV/CBV views, forms, the admin, settings split, and Django REST Framework (serializers, ModelViewSet, routers, permissions, throttling). Triggers: 'add a filter and fix the N+1 in this ListView', 'build a DRF ModelViewSet with owner-only permission', 'this template loops over books and queries book.author each iteration' (N+1 without the word Django), 'why does manage.py check --deploy warn about SECURE_HSTS_SECONDS', 'revisa este modelo y añade un UniqueConstraint en (tenant, slug)', 'el queryset hace N+1', any file with manage.py, settings.py, models.py, serializers.py or a 0001_initial migration. NOT async-first FastAPI services (that is fastapi)."
+description: "Use when building, reviewing, securing, testing or shipping a Django app — models, migrations, QuerySets/managers, FBV/CBV views, forms, the admin, settings split, and Django REST Framework (serializers, ModelViewSet, permissions). NOT async FastAPI/Pydantic services (that is `fastapi`), NOT Postgres schema/index work (that is `postgresdb`)."
 tags: [python, django, orm, drf, backend, web]
 recommends: [postgresdb, secure-coding, deployment, testing-py, api-design]
 origin: risco
@@ -31,10 +31,7 @@ add a dependency.
 
 **Version rule:** default to 5.2 LTS. Pick 6.0 only for a concrete Tasks/CSP need, and say so.
 
-## When to use vs route elsewhere
-
-The test: if the project has `manage.py` and `INSTALLED_APPS`, it is Django. If it imports
-`fastapi` + `pydantic`, it is not.
+## Route elsewhere
 
 | Situation | Route to |
 |---|---|
@@ -45,8 +42,6 @@ The test: if the project has `manage.py` and `INSTALLED_APPS`, it is Django. If
 | REST contract design (cursor vs offset, status codes, versioning) | `api-design` |
 | ruff/uv/general type hints, packaging | `python` |
 
-Everything else Django-shaped — models, QuerySets, migrations, views, DRF, settings — is here.
-
 ## Project shape
 
 Split settings by environment; never ship one `settings.py` toggled by `DEBUG`.

package/skills/docker/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: docker
-description: "Use when authoring or auditing a Dockerfile/Containerfile, shrinking a bloated image, hardening a container that runs as root, choosing a base image, or wiring a Compose dev loop with hot reload. Triggers: 'dockerize this app', 'my node image is 1.2GB make it smaller', 'the build cache keeps busting', 'harden this Dockerfile, trivy flags it', 'docker compose watch for local dev', 'distroless vs alpine vs slim', 'la imagen pesa demasiado', 'el build de docker tarda siglos'. NOT the CI/CD pipeline or deploy-to-host (that is deployment), NOT k8s autoscaling/HPA (that is scaling), NOT app-level SQL injection or secrets-in-code (that is secure-coding)."
+description: "Use when authoring or auditing a Dockerfile, shrinking a bloated image, hardening a container that runs as root, picking a base image, or wiring a Compose dev loop with hot reload. NOT CI builds or deploy-to-host (that is `deployment`), NOT k8s autoscaling (that is `scaling`), NOT app-level injection or secrets-in-code (that is `secure-coding`)."
 tags: [docker, containers, dockerfile, compose, image-security]
 recommends: [deployment, secure-coding, scaling, github-actions]
 origin: risco
@@ -20,17 +20,8 @@ source  →  Dockerfile (multi-stage, cache mounts)  →  small + scanned image
 ```
 
 The hand-off is sharp: **the moment you have a green, scanned image and a working
-`compose.yaml`, you are done.** Pushing to a registry, building in CI, deploying to a host,
-rollback — that is `../deployment/SKILL.md`. It already references Dockerfiles; you are the
-image-internals specialist it leans on.
-
-## When to use
-
-- Authoring or auditing a `Dockerfile` for any stack (Node, Python, Go, Rust, JVM, static SPA).
-- An image is too big (800 MB+ Node image), builds too slowly, or fails `trivy`/`hadolint`.
-- A container runs as root and you need least privilege.
-- Standing up local dev with `compose.yaml` + `docker compose watch` (sync / rebuild / sync+restart).
-- Choosing a base image and getting multi-stage + BuildKit cache mounts right.
+`compose.yaml`, you are done.** Everything downstream is `../deployment/SKILL.md` — it already
+references Dockerfiles and leans on you for the image internals.
 
 ## When NOT to use — and who owns it instead
 
@@ -42,24 +33,6 @@ image-internals specialist it leans on.
 | Install/operate a self-hosted PaaS | `../coolify/SKILL.md` | Host operation, not the image |
 | Containerless PaaS deploy mechanics | `../railway/SKILL.md`, `../fly-io/SKILL.md` | Platform deploy, not the Dockerfile |
 
-## The five rules
-
-1. **Multi-stage, always.** Build deps (compilers, dev packages, the full SDK) must never reach
-   the runtime image. Multiple `FROM` stages; copy only the built artifact into a minimal final
-   stage. *Why: a Go binary needs ~10 MB, not a 900 MB toolchain — and every extra package is CVE
-   surface.*
-2. **Choose the base deliberately and pin it — never `:latest`.** Pin a tag (ideally a digest)
-   so a rebuild is reproducible. *Why: `:latest` silently changes under you, breaking builds and
-   busting the scan you just passed.*
-3. **Install deps before copying source.** Order layers so the lockfile install is cached and use
-   BuildKit cache mounts. *Why: copying everything first invalidates the dependency layer on every
-   one-character source edit.*
-4. **Run as a non-root `USER`.** Default PID 1 is root (UID 0); a container escape from root is a
-   host compromise. *Why: least privilege is the cheapest blast-radius reduction you can ship.*
-5. **One concern per container; EXEC-form `CMD`; add a `HEALTHCHECK`.** *Why: shell-form `CMD foo`
-   wraps your process in `/bin/sh -c`, which swallows `SIGTERM` so the container ignores graceful
-   shutdown; a healthcheck lets Compose/orchestrators gate on readiness.*
-
 ## Pick a base image (2026 reality)
 
 | Base | Size | CVE / patch velocity | Debuggable? | Wins when |
@@ -72,7 +45,8 @@ image-internals specialist it leans on.
 
 Rule of thumb: glibc app with native deps → `*-slim` or Wolfi. Static Go binary → `scratch` or
 `distroless/static`. Security mandate → Chainguard. Reach for `alpine` only when you've confirmed
-your wheels/native libs build against musl. Per-language tag maps live in
+your wheels/native libs build against musl. Per-language tag maps, multi-stage templates for the
+stacks not shown below (Rust, JVM `jlink`, static SPA → nginx) and multi-arch buildx live in
 [references/base-images-and-stages.md](references/base-images-and-stages.md).
 
 ## Multi-stage skeletons
@@ -204,8 +178,9 @@ docker build --secret id=npm_token,env=NPM_TOKEN .
 ## Compose for dev
 
 Canonical filename is `compose.yaml`; **omit the obsolete `version:` key**; use `docker compose`
-(v2 subcommand), never the standalone `docker-compose` v1. `develop.watch` is GA since Compose
-2.22.0 and gives you a tight dev loop.
+(v2 subcommand), never the standalone `docker-compose` v1. One concern per container — the app, the
+database and the seed job are separate services. `develop.watch` is GA since Compose 2.22.0 and
+gives you a tight dev loop.
 
 ```yaml
 services:
@@ -264,20 +239,13 @@ These are exactly what `scripts/verify.sh` automates (it skips a tool gracefully
 
 | Bad | Good | Why |
 |---|---|---|
-| `FROM node:latest` | `FROM node:24-bookworm-slim` (pin/digest) | `:latest` drifts; builds + scans become non-reproducible |
-| runs as root (no `USER`) | `USER nonroot` / `USER 10001` | root escape == host compromise |
+| `FROM node:latest` | `FROM node:24-bookworm-slim`, or pin a digest | `:latest` drifts under you; builds + scans become non-reproducible |
+| runs as root (no `USER`) | `USER nonroot` / `USER 10001` | PID 1 defaults to root (UID 0), so a container escape == host compromise |
 | `ARG TOKEN` / `ENV SECRET=` | `RUN --mount=type=secret,...` | ARG/ENV persist in image history & layers |
 | `COPY . .` then `RUN npm ci` | copy lockfile → install → copy source | source edits bust the dep cache layer every build |
 | single `FROM`, ship the SDK | multi-stage, copy only the artifact | runtime carries compilers & dev CVE surface |
 | `apt-get install x` | `apt-get install --no-install-recommends x && rm -rf /var/lib/apt/lists/*` | recommends + apt lists bloat the layer |
 | no `.dockerignore` | mirror `.gitignore` + build outputs | whole context ships; `.env`/`.git` can leak |
 | `version: "3.8"` / `docker-compose` v1 | omit `version:`; `docker compose` v2 | the key is obsolete; v1 is EOL |
-| `CMD npm start` (shell form) | `CMD ["node", "server.js"]` (exec) | shell form swallows `SIGTERM`; no graceful shutdown |
-
-## References & siblings
-
-- [references/base-images-and-stages.md](references/base-images-and-stages.md) — per-language
-  multi-stage templates (Rust, JVM jlink, static SPA → nginx), tag maps, multi-arch buildx.
-- [references/compose-recipes.md](references/compose-recipes.md) — fuller Compose patterns.
-- Once the image is green and scanned: `../deployment/SKILL.md`. Image/container hardening pairs
-  with `../secure-coding/SKILL.md`. Self-hosted host ops: `../coolify/SKILL.md`.
+| `CMD npm start` (shell form) | `CMD ["node", "server.js"]` (exec) | shell form wraps the process in `/bin/sh -c`, which swallows `SIGTERM` — no graceful shutdown |
+| no `HEALTHCHECK` | `HEALTHCHECK CMD [...]` | nothing for Compose/orchestrators to gate readiness on (`condition: service_healthy`) |

package/skills/document-processing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: document-processing
-description: "Use when you need to get content out of a document or build a document out of data — extracting text/tables from PDFs, filling interactive PDF forms (AcroForm), generating PDF/DOCX from templates, or OCR'ing scanned/image-only files into Markdown/JSON. Triggers: 'extract the line items from this invoice PDF', 'fill this PDF form and flatten it', 'generate a contract DOCX from this template', 'this scan has no text layer', 'the PDF copies out as garbage symbols', 'merge/split/rotate these PDFs', 'OCR 300 scanned pages', 'rellena este formulario PDF y fusiónalos', 'extreu les taules d'aquesta factura escanejada'. NOT pulling schema-typed fields out of text (that is structured-extraction), NOT sending it for signature (that is e-signature), NOT reading spreadsheet cells/formulas (that is spreadsheet-ops)."
+description: "Use when the deliverable is a document's bytes or its literal content — text/tables out of PDFs, AcroForm fill and flatten, page merge/split, PDF/DOCX from templates, OCR of image-only scans. NOT schema-typed fields pulled from text (that is structured-extraction), NOT signature routing (e-signature) or spreadsheet cells/formulas (spreadsheet-ops)."
 tags: [pdf, ocr, docx, forms, extraction, document-ai]
 recommends: [structured-extraction, e-signature, spreadsheet-ops, rag, data-scraper]
 origin: risco
@@ -15,7 +15,7 @@ The boundary test, apply it first:
 - Deliverable is **raw text / Markdown / table cells / a generated file** → you are in the right place.
 - Deliverable is **a typed object matching a schema** (`{parties: [...], total: 1234.50}`) → that is `structured-extraction`. This skill stops at "clean Markdown out of the file"; the schema-constrained extraction runs on that Markdown.
 
-Everything else routes too: signing → `e-signature`, spreadsheet grids/formulas → `spreadsheet-ops`, indexing for Q&A → `rag`, downloading the files off a site → `data-scraper`.
+Everything else routes too: signing with an audit trail → `e-signature`, spreadsheet grids/formulas/XLSX-as-data → `spreadsheet-ops`, indexing for cross-document Q&A → `rag` (this skill *produces* the text `rag` ingests, it does not index it), downloading the files off a site → `data-scraper`.
 
 ## Step 0 — does the PDF have a text layer?
 
@@ -42,7 +42,7 @@ If `extract_text()` returns empty (or near-empty) across the first few pages, it
 | Goal | Use | Why |
 |---|---|---|
 | Extract text + tables with layout | **pdfplumber** | Layout-aware; `extract_tables()` returns rows/cols as Python lists → pandas/CSV. |
-| Raw text, merge, split, rotate, page ops | **pypdf** (6.12.2) | Pure-Python, no C deps, runs in Lambda/containers; the maintained core. |
+| Raw text, merge, split, rotate, page ops | **pypdf** (6.12.2) | Pure-Python, no C deps, runs in Lambda/containers; the maintained core — import `pypdf`, never the dead `PyPDF2`, which was merged back into it. |
 | Fill an interactive PDF form | **pypdf** | `update_page_form_field_values` writes AcroForm fields; can flatten. |
 | Generate a Word/DOCX from a template | **docxtpl** (0.20.x) | A real `.docx` becomes a Jinja2 template; author in Word, tag, render. |
 | Generate a PDF from scratch | **ReportLab** | Canvas / Platypus flowables for laid-out PDFs. |
@@ -50,8 +50,6 @@ If `extract_text()` returns empty (or near-empty) across the first few pages, it
 | OCR messy scans / handwriting / hard tables, API ok | **Mistral OCR** | `mistral-ocr-2512` (OCR 3), ~$2 / 1,000 pages, tuned for forms + handwriting. |
 | Fastest extract / easiest page→PNG raster | **PyMuPDF** ⚠️ **AGPL** | Fast, but AGPL: shipping it imposes an open-source obligation or needs a paid license. Flag this before recommending. |
 
-Rule: use the maintained **`pypdf`** import, never the dead `PyPDF2` — `PyPDF2` is unmaintained and was merged back into `pypdf`. Importing it is a signal of stale code.
-
 ## Extraction recipes
 
 Text + tables with `pdfplumber`, straight to CSV:
@@ -128,7 +126,7 @@ with open("filled.pdf", "wb") as f:
     writer.write(f)
 ```
 
-Why `auto_regenerate=False`: it defaults to `True` for legacy reasons, which marks the AcroForm dirty and triggers a "you have unsaved changes" prompt when the user opens the PDF. You almost never want that. Checkbox/radio values are the field's `/V` on-state (often `/Yes`), not `True` — read the field to find it.
+`auto_regenerate` defaults to `True` for legacy reasons, and you almost never want it. Checkbox/radio values are the field's `/V` on-state (often `/Yes`), not `True` — read the field to find it.
 
 ## Generation
 
@@ -191,16 +189,10 @@ markdown = "\n\n".join(p.markdown for p in resp.pages)
 
 **Never trust OCR output blind.** OCR confuses `0/O`, `1/l/I`, and drops or shifts decimal points — a `1.234,50` can come back as `1234,50` or `1,234.50`. Always spot-check totals, dates, and ID numbers against the rendered page before you hand the text downstream. For clean scans with no budget, plain `pytesseract` is the zero-cost baseline, but it is weak on layout/tables versus the pipelines above.
 
-## Scale and handoff
+## Scale
 
 Batch jobs: parallelize per-file, cap concurrency on the hosted API (rate limits + cost), and use Mistral's Batch API for the 50% discount on large runs. Engine install matrix, exact version pins, the full licensing table, the Docling-vs-Marker-vs-Mistral feature/cost comparison, and troubleshooting (encrypted PDFs, mangled AcroForm field names, multi-column reading order, CJK/handwriting) live in `references/engines.md` — read it before a non-trivial install.
 
-Handoffs:
-- Need typed fields (`{total, due_date, parties}`) out of the Markdown you produced → `structured-extraction`.
-- Need to route the finished PDF for signature with an audit trail → `e-signature`.
-- The grid is really a spreadsheet (cells, formulas, XLSX as data) → `spreadsheet-ops`.
-- Need to index the extracted text for cross-document Q&A → `rag`. This skill *produces* the text `rag` ingests; it does not index it.
-
 ## Anti-patterns
 
 | Anti-pattern | Why it is wrong | Do instead |

package/skills/domains-dns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: domains-dns
-description: "Use when pointing a custom domain at a host, fixing broken HTTPS, choosing apex vs www, or publishing DNS rows — registering/delegating a name, writing A/AAAA/CNAME/ALIAS/MX/TXT/CAA/SRV records, standing up auto-renewing TLS, or cutting nameservers over without downtime. Triggers: 'point example.com at Vercel', 'set up DNS for the domain', 'NET::ERR_CERT_AUTHORITY_INVALID', 'CNAME flattening / ALIAS at the apex', 'dig +trace still shows the old IP', 'need a CAA record for Let's Encrypt', 'publish the SPF/DKIM/DMARC/MX rows', 'apuntar el dominio', 'el certificado caducó y no renueva', 'configurar els registres DNS'. NOT inbox placement / warmup / spam-rate tuning (that is email-deliverability), NOT what runs behind the name (that is deployment)."
+description: "Use when pointing a domain at a host or fixing broken HTTPS — delegating nameservers, writing A/AAAA/CNAME/ALIAS/MX/TXT/CAA rows, apex vs www, standing up auto-renewing TLS, and cutting nameservers over without downtime. NOT inbox placement or warmup (that is `email-deliverability`), NOT what runs behind the name (that is `deployment`)."
 tags: [dns, tls, ssl, domains, https, acme, certbot, dig, caa, nameservers]
 recommends: [email-deliverability, deployment, monitoring, cloudflare, vercel]
 origin: risco
@@ -104,13 +104,7 @@ curl -vI https://example.com 2>&1 | grep -Ei 'HTTP/|location|SSL certificate'  #
 
 Propagation is governed by **TTL, not a fixed 48 hours** (RFC 2181). To make a change land fast, lower the record's TTL (e.g. to 300s) *before* you change it, so resolvers re-query sooner. NS/registrar delegation changes can still lag because of registry/TLD TTLs.
 
-Verification checklist before you call it done:
-
-- [ ] `dig +short` returns the intended IP/host from a public resolver (`@1.1.1.1`).
-- [ ] Apex resolves via A/AAAA or ALIAS, **never** a CNAME.
-- [ ] `dig CAA` lists the CA that issued (or is empty — open policy).
-- [ ] `openssl s_client` shows the right subject, a complete chain, and `notAfter` comfortably ahead.
-- [ ] `curl -vI` returns 2xx/3xx with no cert warning; www and apex land on the one canonical host.
+`scripts/verify.sh <domain>` runs the whole done-check read-only: apex-CNAME check, CAA sanity, chain completeness + expiry, HTTPS reachability, www↔apex canonical. The full dig/openssl/curl playbook and an error → cause → fix table are in `references/verify-and-debug.md`.
 
 ## Nameserver cutover (no downtime)
 
@@ -135,12 +129,3 @@ Order matters; each step has a reason.
 | Splitting one zone across two providers | Resolvers answer from whichever NS won; records vanish intermittently | One authoritative provider per zone |
 | TTL left at 86400 during migration | Old answer cached for a day after you flip | Drop to 300s a day ahead |
 | Testing certs against ACME production | Burns the 50-cert/7-day limit; week-long lockout | Use the staging endpoint first |
-
-## References & siblings
-
-- `references/record-cookbook.md` — every record type with edge cases (TXT chunking, MX priority, SPF lookup limit, SRV, DNSSEC).
-- `references/tls-and-acme.md` — certbot/acme.sh, HTTP-01 vs DNS-01, wildcards, platform cert quirks, 2026 lifetimes + ARI.
-- `references/verify-and-debug.md` — full dig/openssl/curl playbook and error → cause → fix.
-- `scripts/verify.sh <domain>` — read-only audit: apex-CNAME check, CAA sanity, chain completeness + expiry, HTTPS reachability, www↔apex canonical.
-
-Route out when the ask isn't the records: inbox placement → ../email-deliverability/SKILL.md; what runs behind the name and how it's released → ../deployment/SKILL.md; platform-specific edge/build config → ../cloudflare/SKILL.md or ../vercel/SKILL.md.

package/skills/drizzle-orm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: drizzle-orm
-description: "Use when modeling data or querying with Drizzle ORM in TypeScript — schema declared in `.ts`, type-safe `select`/`insert`/relational queries, and `drizzle-kit` migrations, or when choosing Drizzle over Prisma for an edge/serverless runtime. Triggers: 'set up Drizzle ORM', 'drizzle-kit generate', 'write a pgTable schema', '$inferSelect type', 'drizzle push vs generate for production', 'my db.query.posts.findMany returns no author relation', 'drizzle-kit conflicting migration', 'switch off Prisma to something lighter for edge', 'definir l esquema amb Drizzle i tipus type-safe', 'migrar de Prisma a Drizzle para algo más ligero', 'migració amb drizzle-kit'. NOT Prisma Client or schema.prisma (that is prisma-orm), NOT a generic zero-downtime migration strategy (that is db-migrations), NOT Postgres engine/indexing/EXPLAIN (that is postgresdb)."
+description: "Use when modeling data or querying with Drizzle ORM in TypeScript — `pgTable` schema in `.ts`, type-safe select/insert/relational queries, `drizzle-kit` migrations. NOT Prisma Client or `schema.prisma` (that is `prisma-orm`), NOT ORM-agnostic migration strategy (that is `db-migrations`), NOT Postgres engine tuning or EXPLAIN (that is `postgresdb`)."
 tags: [drizzle, drizzle-orm, typescript-orm, drizzle-kit, sql, migrations, database, schema]
 recommends: [prisma-orm, postgresdb, db-migrations, neon, sqlite-turso, planetscale, supabase, typescript, sql]
 origin: risco
@@ -229,6 +229,3 @@ It checks a `drizzle()` call exists, the table helper matches the configured `di
 carries `dialect`/`schema`/`out`, that any `db.query` usage has `{ schema }`/`{ relations }` passed
 to `drizzle()`, and bans Prisma-isms (`schema.prisma`, `PrismaClient`, `prisma generate`) that mean
 the wrong ORM leaked in.
-
-For the full driver matrix and the v1↔v2 relations migration, see
-`references/relations-and-drivers.md`.

package/skills/duckdb/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: duckdb
-description: "Use when you need fast analytical SQL over local files (Parquet/CSV/JSON/Arrow) with no server to run, when embedding OLAP in an app or notebook, when a pandas groupby/merge on multi-GB data is too slow, or when reading data straight from S3/HTTP/a lakehouse. Triggers: 'query a folder of parquet files in place', 'aggregate a 5GB CSV on my laptop', 'replace this slow pandas groupby', 'run SQL over a dataframe in Jupyter', 'read these parquet files from S3 without downloading', 'out-of-core aggregate', 'analizar un CSV enorme sin montar un servidor', 'consultar parquet en local sense base de dades'. NOT a multi-user production analytics server (that is clickhouse-analytics), NOT your app's transactional CRUD database (that is postgresdb)."
+description: "Use when analytical SQL must run in-process with no server: Parquet/CSV/JSON/Arrow queried in place, OLAP embedded in an app or notebook, a slow pandas groupby on multi-GB data, or S3/lakehouse data read without downloading. NOT a multi-user analytics server (that is clickhouse-analytics), NOT an app's transactional CRUD store (that is postgresdb)."
 tags: [duckdb, olap, analytics, parquet, embedded-database, sql, columnar]
 recommends: [clickhouse-analytics, postgresdb, sql, sqlite-turso, data-cleaning, business-intelligence]
 origin: risco
@@ -34,8 +34,7 @@ for greenfield exploration.
 The two you will confuse most: DuckDB vs ClickHouse is **embedded-single-node vs server-distributed** —
 under ~10GB on one box DuckDB usually wins; pick ClickHouse when many people query concurrently. DuckDB vs
 SQLite is **same niche, opposite workload** — both embedded single-file, but SQLite is row-store OLTP and
-DuckDB is column-store OLAP. Don't run your app's writes through DuckDB. (Some recommended siblings above
-may not be built in this collection yet; the routing decision still holds.)
+DuckDB is column-store OLAP. Don't run your app's writes through DuckDB.
 
 ## Install & version
 
@@ -175,22 +174,17 @@ escape hatch, not the default.
 
 ## Anti-patterns
 
-| Rationalization | Reality → STOP |
+| Anti-pattern | Do instead |
 | --- | --- |
-| "Load the file into pandas, then query it" | You just paged the whole file through RAM. `FROM 'file.parquet' SELECT ...` scans only needed columns. |
-| "DuckDB can be our app's database" | One writer, single process — concurrent CRUD writers corrupt the workflow. App OLTP is `postgresdb`. |
-| "Spin up DuckDB behind our dashboard API for 200 users" | It's embedded, not a server; concurrent users serialize on the writer. That's `clickhouse-analytics`. |
-| "Just use the latest version in prod" | Pin the **LTS** (1.4.x; v1.4.4 shipped 2026-01-26) so a future upgrade doesn't break the on-disk format / extension ABI. |
-| "Download the S3 files, then read them" | `INSTALL httpfs` + `CREATE SECRET` reads `s3://...` in place with row-group pushdown. No download. |
-| "`SELECT *` over this 200-column Parquet" | Columnar engine — list the columns you need so it skips the rest. `SELECT *` reads everything. |
-| "GROUP BY a, b, c (restate every column)" | Drift bait. `GROUP BY ALL` tracks the SELECT automatically. |
-| "It's embedded so I don't need to think about RAM" | Set `memory_limit` / `threads`; without a cap a runaway aggregate can thrash before it spills. |
-| "Use DuckDB as our embeddings/vector store" | VSS exists but vector search is `vector-db`'s workflow, not DuckDB's home turf. |
-
-## References
-
-- [references/python-and-interop.md](references/python-and-interop.md) — full Python client: connect/cursor, `?`/`$name` parameters, relational operators, register/unregister frames, pandas/Polars/Arrow/NumPy round-trips, transactions, threading caveat.
-- [references/remote-and-lakehouse.md](references/remote-and-lakehouse.md) — httpfs, `CREATE SECRET` for S3/GCS/Azure, hive globs, Iceberg/Delta/DuckLake reads, partitioned writes, MotherDuck `ATTACH 'md:'`.
+| Loading a file into pandas, then querying the frame | Pages the whole file through RAM. `FROM 'file.parquet' SELECT ...` scans only needed columns. |
+| Making DuckDB the app's database | One writer, single process — concurrent CRUD writers corrupt the workflow. App OLTP is `postgresdb`. |
+| Serving a dashboard API for 200 users from DuckDB | It's embedded, not a server; concurrent users serialize on the writer. That's `clickhouse-analytics`. |
+| Running the latest version in prod | Pin the **LTS** (1.4.x; v1.4.4 shipped 2026-01-26) so a future upgrade doesn't break the on-disk format / extension ABI. |
+| Downloading the S3 files, then reading them | `INSTALL httpfs` + `CREATE SECRET` reads `s3://...` in place with row-group pushdown. No download. |
+| `SELECT *` over a 200-column Parquet | Columnar engine — list the columns you need so it skips the rest. `SELECT *` reads everything. |
+| `GROUP BY a, b, c` — restating every column | Drift bait. `GROUP BY ALL` tracks the SELECT automatically. |
+| Treating "embedded" as "no need to think about RAM" | Set `memory_limit` / `threads`; without a cap a runaway aggregate can thrash before it spills. |
+| Using DuckDB as the embeddings/vector store | VSS exists but vector search is `vector-db`'s workflow, not DuckDB's home turf. |
 
 ## Verify
 

package/skills/dynamodb/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: dynamodb
-description: "Use when designing or operating an Amazon DynamoDB table - modeling entities and relationships without joins, choosing partition/sort keys, deciding single-table vs table-per-entity, adding a GSI/LSI, picking on-demand vs provisioned capacity, or diagnosing throttling. Triggers: 'design a DynamoDB table', 'model one-to-many / many-to-many without joins', 'single-table design worth it?', 'query the same data by two different keys' (inverted GSI), 'writes throttled even though I'm under my provisioned capacity' (hot partition), 'on-demand or provisioned?', 'why does my Query only return some rows?' (1 MB page), 'diseña la tabla DynamoDB para estos patrones de acceso', 'modela aquesta relació amb clau composta a DynamoDB'. NOT relational schema / SQL / EXPLAIN / B-tree indexing (that is postgresdb), and NOT document modeling with aggregation pipelines (that is mongodb)."
+description: "Use when modeling or operating a DynamoDB table: deriving partition/sort keys from access patterns, single-table vs table-per-entity, adding a GSI/LSI, on-demand vs provisioned capacity, or diagnosing hot-partition throttling. NOT relational schema/SQL/EXPLAIN (that is `postgresdb`), NOT aggregation-pipeline document modeling (that is `mongodb`)."
 tags: [dynamodb, nosql, single-table-design, aws, data-modeling]
 recommends: [postgresdb, mongodb, redis, vector-db, aws-essentials, deployment, secure-coding]
 origin: risco
@@ -29,24 +29,16 @@ You **refuse** to: click through the AWS console, wire the IaC/CI provisioning p
 `../deployment/SKILL.md`), or model the data as normalized tables you then "join" in application code.
 You emit DDL, IaC snippets, and example SDK calls — you do not provision the infrastructure.
 
-## The non-negotiable order
-
-Do these in sequence. Reordering them is the single most common DynamoDB mistake.
-
-1. **Access patterns first.** You cannot query what your keys do not express, and there is no `WHERE`
-   over arbitrary columns. List the patterns before you name a single attribute.
-2. **Keys second.** Co-locate items that are read together so one `Query` returns them.
-3. **Indexes last.** A GSI is a cost and a consistency compromise; reach for it only when the base
-   table cannot answer a pattern.
-4. **Capacity last.** Capacity mode is a billing decision, not a modeling one — it changes nothing about
-   the keys. Pick it after the model is stable.
-
-Why the order matters: changing a table's key schema after launch means a full migration (new table +
-backfill + dual-write). Get the keys wrong and you pay for it forever.
+The steps below run in sequence — access patterns, then keys, then indexes, then capacity. Reordering
+them is the single most common DynamoDB mistake.
 
 ## Step 1 — Enumerate access patterns
 
-Produce this table before touching keys. It is also exactly what `scripts/verify.sh` checks.
+You cannot query what your keys do not express, and there is no `WHERE` over arbitrary columns, so
+produce this table before you name a single attribute. It is also exactly what `scripts/verify.sh`
+checks: run `scripts/verify.sh <path-to-key-design.{md,json}>` and every row must carry a key target
+(`pk`/`sk` or a named `gsi`) and a `query_type`. It FAILS on any pattern served by `Scan`, WARNS on
+`FilterExpression`, and asserts ≤20 GSIs / ≤5 LSIs. Read-only; exits 0 on an empty or clean target.
 
 | pattern | entity | key condition | read/write | est. freq | served by |
 |---|---|---|---|---|---|
@@ -65,8 +57,12 @@ modeling smell — redesign the key, do not patch it with a filter.
 
 ## Step 2 — Key design + single-table decision
 
+Get this wrong and you pay for it forever: changing a table's key schema after launch means a full
+migration (new table + backfill + dual-write).
+
 **Composite-key encoding.** Use prefixed, sortable strings so one partition holds an entity and its
-children, and so a sort-key range query slices them:
+children — items read together are co-located, so one `Query` returns them — and so a sort-key range
+query slices them:
 
 ```text
 PK = USER#123
@@ -84,8 +80,10 @@ One `Query` with `PK = USER#123 AND SK begins_with("ORDER#")` returns all of tha
 already sorted. That is a **one-to-many** relationship with no join.
 
 **Many-to-many** uses an adjacency list: store the edge twice (or use an inverted GSI, see Step 3) so
-you can traverse it from either side. Full worked example in
-[references/access-patterns.md](references/access-patterns.md).
+you can traverse it from either side. Worked end-to-end in
+[references/access-patterns.md](references/access-patterns.md) — a multi-tenant SaaS / e-commerce model
+(pattern table → PK/SK map → GSI map → AWS SDK v3 `@aws-sdk/lib-dynamodb` calls), adjacency-list
+many-to-many, time-series and leaderboard patterns.
 
 **Single-table vs table-per-entity** — decide honestly, do not cargo-cult:
 
@@ -130,7 +128,8 @@ under one partition key). GSI-only tables have no such cap — a real reason to
 
 ## Step 4 — Capacity & cost
 
-Pick the mode after the model is stable. Decision table:
+Capacity mode is a billing decision, not a modeling one — it changes nothing about the keys, so pick it
+after the model is stable. Decision table:
 
 | traffic shape | recommendation | why |
 |---|---|---|
@@ -156,7 +155,8 @@ PK = METRIC#daily_total
 PK = METRIC#daily_total#<0..9>
 ```
 
-Capacity math, full pricing detail, and the sharding recipe live in
+Capacity math, full pricing detail (including the Nov-2024 cut), warm throughput, the full quota table,
+and hot-partition diagnosis + the sharding recipe live in
 [references/capacity-and-limits.md](references/capacity-and-limits.md).
 
 ## Step 5 — Operational guardrails
@@ -195,23 +195,10 @@ aws dynamodb query --table-name App \
 | Storing > 400 KB inline (images, docs, logs) | Hits the 400 KB item cap; bloats every read | Put the blob in S3, store the pointer in the item |
 | Picking capacity mode before the model is done | Mode is billing, not modeling — premature and often wrong | Stabilize keys/GSIs first, then choose on-demand vs provisioned |
 
-## References & siblings
-
-- [references/access-patterns.md](references/access-patterns.md) — full multi-tenant SaaS / e-commerce
-  model end-to-end: pattern table → PK/SK map → GSI map → example AWS SDK v3 (`@aws-sdk/lib-dynamodb`)
-  calls; adjacency-list many-to-many; time-series and leaderboard patterns.
-- [references/capacity-and-limits.md](references/capacity-and-limits.md) — capacity-mode detail, current
-  pricing + the Nov-2024 cut, warm throughput, the full quota table, hot-partition diagnosis + sharding.
-
-Route elsewhere when the engine is different: relational schema / SQL / EXPLAIN / indexing →
-`../postgresdb/SKILL.md`; MySQL-engine schema → `mysql`; document modeling + aggregation pipeline →
-`mongodb`; cache / queue / rate-limiter → `redis`; vector store / semantic search → `vector-db`; AWS
-account / IAM / VPC setup → `aws-essentials`; provisioning the table in CI/CD → `../deployment/SKILL.md`;
-API-layer auth/secrets in front of the table → `../secure-coding/SKILL.md`.
-
-## verify.sh
+## Route elsewhere when the engine is different
 
-`scripts/verify.sh <path-to-key-design.{md,json}>` checks the access-pattern artifact: every row has a
-key target (`pk`/`sk` or a named `gsi`) and a `query_type`; it FAILS on any pattern served by `Scan`,
-WARNS on `FilterExpression`, and asserts ≤20 GSIs / ≤5 LSIs. Read-only; exits 0 on an empty or clean
-target.
+Relational schema / SQL / EXPLAIN / indexing → `../postgresdb/SKILL.md`; MySQL-engine schema → `mysql`;
+document modeling + aggregation pipeline → `mongodb`; cache / queue / rate-limiter → `redis`; vector
+store / semantic search → `vector-db`; AWS account / IAM / VPC setup → `aws-essentials`; provisioning the
+table in CI/CD → `../deployment/SKILL.md`; API-layer auth/secrets in front of the table →
+`../secure-coding/SKILL.md`.

package/skills/e-signature/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: e-signature
-description: "Use when adding legally-valid electronic-signature flows to documents — sending a PDF or template for signature, embedding signing in your own app, tracking status, verifying signing webhooks, and retrieving the signed PDF plus its audit trail via DocuSign or Dropbox Sign. Triggers: 'send this contract for signature', 'create a DocuSign envelope', 'signature_request/send', 'embed signing in our app', 'notify us when it's signed', 'set up DocuSign JWT auth', 'is a typed-name signature legally binding?', 'do we need QES for EU customers?', 'enviar a firmar', 'firma electrònica amb validesa legal'. NOT drafting the contract text itself (that is contracts) and NOT OCR/parsing/extracting fields from documents (that is document-processing)."
+description: "Use when wiring an e-signature flow with DocuSign or Dropbox Sign — picking the SES/AES/QES legal tier, sending a PDF or template for signature, embedded signing, verifying signing webhooks, retrieving the signed PDF plus audit trail. NOT drafting contract text (that is `contracts`), NOT extracting fields from PDFs (that is `document-processing`)."
 tags: [e-signature, docusign, dropbox-sign, esignature-api, webhooks, eidas, esign-act, audit-trail]
 recommends: [contracts, document-processing, webhooks, api-connector-builder, gdpr-privacy, automation-flows]
 origin: risco
@@ -10,17 +10,13 @@ origin: risco
 
 You are wiring a third-party signing API (DocuSign eSignature or Dropbox Sign, ex-HelloSign) into someone's app or backend. You take a PDF or template, define signers and fields, send it for signature, track status, react to completion via a verified webhook, and retrieve the signed PDF plus its audit trail.
 
-You are NOT writing the contract language — clauses, indemnity, liability go to `../contracts/SKILL.md`. You are NOT doing OCR, field extraction, or PDF splitting with no signing involved — that is `../document-processing/SKILL.md`. You only build the signing flow.
-
-## Three rules
-
-1. **Pick the legal tier deliberately, before you write code.** A typed name (SES) is binding for most B2B in the US and EU, but a high-stakes EU document may need AES or QES. Choosing the tier decides which provider features you enable (ID Verification, SMS/access code, qualified signature). Get this wrong and the signature is hard to defend in court.
-2. **Sandbox / `test_mode` before prod, always.** A live send is billable and emails a real human. DocuSign demo env is `https://demo.docusign.net`; Dropbox Sign uses `test_mode: 1`. Only non-test sends count against quota and reach signers.
-3. **The deliverable is the signed PDF + audit trail, retrieved and stored.** A send is not done when status is `sent` — it is done when the signer completes and you have pulled the signed document AND its evidence (DocuSign Certificate of Completion, Dropbox Sign audit-trail PDF). Fire-and-forget is the most common bug here.
+Contract language — clauses, indemnity, liability — goes to `../contracts/SKILL.md`; OCR, field extraction, or PDF splitting with no signing involved is `../document-processing/SKILL.md`.
 
 ## Decision: which legal tier do you need?
 
-US law (ESIGN Act + UETA) has **no tiers** — e-signatures equal wet ink. The EU (eIDAS, and eIDAS 2.0 / Reg (EU) 2024/1183 in force since May 2024) defines three. Map the document's stakes to a tier, then to a provider feature.
+Pick the tier deliberately, **before you write code**: it decides which provider features you enable (ID Verification, SMS/access code, qualified signature), and getting it wrong leaves a signature that is hard to defend in court.
+
+US law (ESIGN Act + UETA) has **no tiers** — e-signatures equal wet ink. The EU (eIDAS, and eIDAS 2.0 / Reg (EU) 2024/1183 in force since May 2024) defines three. A typed name (SES) is binding for most B2B in the US and EU, but a high-stakes EU document may need AES or QES. Map the document's stakes to a tier, then to a provider feature.
 
 | Tier | What it is | When you need it | Provider feature to enable |
 |------|-----------|------------------|----------------------------|
@@ -47,6 +43,8 @@ Either is fine. Pick one and stay on it so you keep **one** consistent audit tra
 
 Never commit keys. Read everything from env; the RSA private key lives in a secret store or a file path, never inline in source.
 
+Point at the sandbox before prod, always — a live send is billable and emails a real human. DocuSign demo env is `https://demo.docusign.net`; Dropbox Sign uses `test_mode: 1`. Only non-test sends count against quota and reach signers.
+
 | Env var | Provider | Holds |
 |---------|----------|-------|
 | `DOCUSIGN_INTEGRATION_KEY` | DocuSign | client/integration key (GUID) |
@@ -135,6 +133,8 @@ const res = await api.signatureRequestSend({
 
 ## Webhooks / completion
 
+A send is not done when status is `sent` — it is done when the signer completes and you have pulled the signed document AND its evidence (DocuSign Certificate of Completion, Dropbox Sign audit-trail PDF), retrieved and stored. Fire-and-forget is the most common bug here.
+
 **Verify the signature before you trust anything in the payload.** The body is attacker-controllable until you have verified it.
 
 - **DocuSign Connect**: HMAC-signed; verify the `X-DocuSign-Signature-1` header against the raw request body using your Connect HMAC key.

package/skills/e2e-testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: e2e-testing
-description: "Use when writing or stabilizing browser end-to-end tests with Playwright — driving real navigation, forms, logins, and multi-step user journeys through an actual browser, picking durable locators, or killing tests that pass locally but flake in CI. Covers getByRole/getByTestId locator choice, web-first assertions, storageState auth via setup projects, retries/trace config, sharding, and the 2026 flakiness playbook. Triggers: 'write a Playwright test', 'my e2e tests flake in CI but pass locally', 'set up storageState so I don't log in every test', 'getByRole vs CSS selector', 'shard Playwright across machines', 'trace on retry', 'strict mode resolved to 2 elements', 'els tests d'extrem a extrem fallen aleatòriament al pipeline', 'los tests e2e fallan a veces'. NOT in-process component/unit web tests (that is testing-web), NOT pytest suites (that is testing-py), NOT a11y audits as the goal (that is accessibility), NOT building the CI pipeline itself (that is github-actions)."
+description: "Use when writing or stabilizing Playwright tests that drive a real browser through multi-step journeys — durable locators, web-first assertions, storageState auth, trace/retries, and flakes that only bite in CI. NOT in-process component tests (that is testing-web), NOT WCAG auditing (that is accessibility), NOT the pre-merge gate (that is verify)."
 tags: [playwright, e2e, browser-testing, flakiness, ci]
 recommends: [testing-web, accessibility, performance, github-actions, debug]
 origin: risco
@@ -18,17 +18,6 @@ line is **Playwright v1.60.x** (v1.60.0 shipped 2026-05-11). The `_react` / `_vu
 and the `:light` Shadow-DOM suffix were **removed in v1.58.0** — at any version you should be pinning
 they are long gone, so do not reach for them.
 
-## What good looks like
-
-- **User-facing locators.** Tests find elements the way a user does — by role and accessible name —
-  not by `div.card > button:nth-child(2)`. The test survives a refactor that the user never sees.
-- **Web-first assertions.** Every assertion auto-retries until the DOM settles. You never read a
-  value once and compare it.
-- **Deterministic by design.** No `waitForTimeout`. No test that depends on another test's leftovers.
-  Flakiness is a design defect you prevent, not a rerun you tolerate.
-- **Traces on retry.** CI captures a full trace the first time a test retries, so a CI-only failure
-  is debuggable from the artifact without a local repro.
-
 ## Is this even an e2e test?
 
 E2e is the most expensive layer. Spend it only on journeys that cross pages or services. Route the rest out.
@@ -40,6 +29,7 @@ E2e is the most expensive layer. Spend it only on journeys that cross pages or s
 | "Is this page accessible?" — WCAG/ARIA as the deliverable | `../accessibility/SKILL.md` | E2e may *call* axe inside a test, but auditing a11y is its own skill. |
 | "Is this page fast?" — LCP/CWV budgets | `../performance/SKILL.md` | Perf budgets are a different signal than journey correctness. |
 | The runner matrix, caching, the pipeline itself | `../github-actions/SKILL.md` | E2e contributes a *job*; owning the pipeline is theirs. |
+| "Is the change done?" — run the gate, collect evidence, then merge | `../verify/SKILL.md` | Running an existing suite as a pre-merge gate is not authoring or stabilizing one. |
 
 Rule: if you can prove it without launching a browser, you should. Push logic down to `testing-web`.
 

package/skills/electron/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: electron
-description: "Use when building, hardening, or shipping a cross-platform desktop app with Electron — wiring the main/renderer/preload process model, exposing OS capabilities to a web UI over typed IPC, locking down an insecure shell, or packaging with code signing and auto-update. Triggers: 'build a desktop app for Mac/Windows/Linux from my web app', 'let my renderer read a file safely', 'audit my Electron security (nodeIntegration, sandbox, CSP)', 'my preload exposes ipcRenderer and the renderer can require(\"fs\")', 'Squirrel.Mac won\\'t auto-update my app', 'migrate off @electron/remote and BrowserView', 'empaquetar mi app de escritorio para Windows y Mac con firma de código y auto-actualización', 'empaquetar app d\\'escriptori amb auto-actualització'. NOT a smaller Rust-backed shell on the OS native webview (that is tauri)."
+description: "Use when building, hardening, or shipping a cross-platform Electron desktop app — main/renderer/preload process model, typed contextBridge IPC, locking down nodeIntegration/contextIsolation/sandbox/CSP, or packaging with signing and auto-update. NOT a Rust-backed shell on the native webview (that is tauri), nor the web UI inside it (that is react)."
 tags: [electron, desktop, ipc, security, packaging, auto-update, code-signing]
 recommends: [tauri, react, nodejs, github-actions, secure-coding]
 origin: risco
@@ -8,13 +8,9 @@ origin: risco
 
 # Electron — desktop shell, typed IPC, hardening, signing
 
-> Build, harden, and ship cross-platform desktop apps. Treat the renderer as hostile
-> territory and the IPC channel as an attack surface — that is the dominant failure mode
-> in real Electron apps, so the whole skill is organized around it.
-
 This skill owns the **desktop shell**: process model, IPC, security, packaging, signing,
-auto-update. It does **not** own the web UI inside the window (`../react/SKILL.md` if it
-existed), the Node backend logic, or the CI runner matrix.
+auto-update. It does **not** own the web UI inside the window (`../react/SKILL.md`), the
+Node backend logic, or the CI runner matrix.
 
 ## The mental model — three processes, one rule
 
@@ -28,7 +24,8 @@ wrong one is the root cause of most security holes.
 | preload  | isolated world, runs before page JS | semi-trusted | window | the **only** bridge: `contextBridge` exposes a tiny API |
 
 **The governing rule: the renderer is untrusted, the main process holds all privilege, and
-the preload is the only sanctioned bridge between them.** Everything below is a corollary.
+the preload is the only sanctioned bridge between them.** Renderer-to-OS escalation is the
+dominant failure mode in real Electron apps, so everything below is a corollary.
 
 ## Start right
 
@@ -55,7 +52,7 @@ src/
   ipc/types.ts  # IPC contract shared by main + preload
 ```
 
-## The security baseline — non-negotiable
+## The security baseline
 
 Modern Electron defaults are already secure (`nodeIntegration:false`,
 `contextIsolation:true`, `sandbox:true` since Electron 20). **Assert them explicitly anyway**
@@ -185,32 +182,23 @@ Authenticode, and `electron-updater` + GitHub Releases wiring: `references/packa
 The CI matrix that *runs* these builds across three OSes is `github-actions`' job; this skill
 defines *what* to build and sign.
 
-## Migration smells — and the fix
-
-| Smell in the code                          | Why it's dangerous                          | Fix                                              |
-|--------------------------------------------|---------------------------------------------|--------------------------------------------------|
-| `nodeIntegration: true`                    | Page JS gets `require('fs')`, full Node     | Set `false`; move the capability behind IPC      |
-| `contextIsolation: false`                  | Page can rewrite the preload's globals      | Set `true` (default)                             |
-| `@electron/remote` import                  | Sync main-object access = renderer→main RCE | Replace with explicit `ipcMain.handle` channels  |
-| `new BrowserView(...)`                     | Deprecated since 30, will be removed        | `new WebContentsView(...)`                        |
-| `exposeInMainWorld('api', ipcRenderer)`    | Universal IPC weapon (empty object now)     | One function per channel                          |
-
-## Anti-patterns
+## Anti-patterns and migration smells
 
 | Anti-pattern                                          | Why it's wrong                                              | Do instead                                            |
 |-------------------------------------------------------|------------------------------------------------------------|-------------------------------------------------------|
-| `nodeIntegration: true`                               | Any XSS in the renderer becomes OS-level RCE               | `false` + IPC for every privileged op                 |
-| `contextIsolation: false`                             | Renderer can tamper with preload internals                 | `true` (the default)                                  |
+| `nodeIntegration: true`                               | Page JS gets `require('fs')`; any XSS becomes OS-level RCE | `false`; move the capability behind IPC               |
+| `contextIsolation: false`                             | Page can rewrite the preload's globals                     | `true` (the default)                                  |
 | `sandbox: false` without a reason                     | Drops the OS sandbox around the renderer                   | `true`; only relax for a measured, isolated need      |
-| Exposing `ipcRenderer`/its methods over the bridge    | Page can call any channel with any payload                 | One typed function per channel                        |
+| `exposeInMainWorld('api', ipcRenderer)` or its methods | Universal IPC weapon — any channel, any payload (and an empty object now) | One typed function per channel        |
 | No arg validation in `ipcMain.handle`                 | Renderer is an untrusted client; you trust its input       | Type-check + bound every arg before acting            |
 | `webSecurity: false` to "fix CORS"                    | Disables same-origin policy app-wide                       | Keep `true`; proxy/handle CORS in main                |
 | CSP only in a `<meta>` tag                            | Doesn't cover the initial document; bypassable             | Set CSP in `onHeadersReceived`                         |
 | Loading a remote URL into a Node-enabled window       | Remote site runs with your app's privilege                 | Bundle UI locally; sandbox + nav lockdown for remote  |
+| `@electron/remote` import                             | Sync main-object access = renderer→main RCE                | Replace with explicit `ipcMain.handle` channels       |
+| `new BrowserView(...)`                                | Deprecated since Electron 30, will be removed              | `new WebContentsView(...)`                            |
 | Auto-update with an unsigned/un-notarized build       | Squirrel.Mac silently refuses; no updates ship             | Sign + notarize (mac), Authenticode (win) first       |
 | Shipping on an EOL Electron major                     | Unpatched Chromium CVEs in your users' hands               | Stay within the latest 3 majors                       |
 | Heavy CPU work in the main process                    | Blocks the event loop → the whole UI freezes               | `utilityProcess`/worker, or do it in the renderer     |
-| Keeping `@electron/remote`                             | A known renderer→main escalation path                      | Migrate to explicit IPC                               |
 
 ## Verify