@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/audit-accessibility/SKILL.md

@@ -0,0 +1,441 @@
+---
+name: audit-accessibility
+description: >
+  WCAG 2.2 audit via playwright-cli: crawl every page, inject axe-core, test
+  keyboard nav, contrast, ARIA labels, heading order. Use when "audit
+  accessibility", "check a11y", "WCAG audit", "check keyboard nav", or "test
+  screen reader".
+license: MIT
+effort: high
+---
+
+# Accessibility Audit
+
+**Degree of freedom: MIXED** — Phases 0–1, 5 `[HIGH freedom]`; Phases 2–3
+playwright/axe/Tab sequences `[LOW freedom — run exactly]`. Read
+`protocol-browser-anti-stall` before any browser step.
+
+## How to reason
+
+1. **Observe** — quote axe rule+selector, heading list, or Tab snapshot
+2. **Interpret** — can a keyboard or AT user complete the task?
+3. **Classify** — WCAG fail / axe-false-positive / manual-only / correct-as-is
+4. **Severity** — Level A = P0; Level AA = P1; best-practice = P2
+
+## Worked example
+
+> **Observe:** axe `label` on `/signup`; `<input name="email">` has no `id`/`aria-label`.
+> **Interpret:** AT users cannot tell what to type (1.3.1 / 4.1.2).
+> **Classify:** WCAG fail (not an axe false positive).
+> **Severity:** P0 — Level A, blocks signup.
+> **Finding:** `/signup` | 1.3.1+4.1.2 | P0 | unlabeled email | `<label for>`.
+
+## Self-critique before reporting  [LOW freedom — do not skip]
+
+1. **WCAG SC + numbers** — not "contrast is bad"; quote ratio or selector
+2. **Keyboard, not axe-only** — 2.1.1 fails even if axe is clean
+3. **Every reachable page** — obscure routes still count
+4. **Severity justified** — Level A = P0
+5. **Axe is ~30–40%** — heading/focus/link-text/reading-order always manual
+
+---
+
+## Phase 0: Auto-Detect Pages and Components
+
+### 0a. Discover Route Structure
+
+```
+Glob("**/app/**/page.{tsx,jsx,ts,js}")
+Glob("**/pages/**/*.{tsx,jsx,ts,js}")
+Glob("**/src/routes/**/*.{tsx,jsx,svelte,vue}")
+```
+
+### 0b. Find the App URL
+
+```
+Grep(pattern: "NEXT_PUBLIC_APP_URL|NEXT_PUBLIC_BASE_URL|VITE_APP_URL|APP_URL|localhost", glob: ".env*")
+```
+
+If no production URL, default to `http://localhost:3000` (or detected dev server port).
+
+### 0c. Detect CSS Framework and Component Library
+
+```
+Grep(pattern: "tailwindcss|@chakra-ui|@mui|@radix-ui|shadcn|bootstrap|bulma", glob: "package.json")
+```
+
+### 0d. Detect Existing a11y Tooling
+
+```
+Grep(pattern: "axe-core|@axe-core|eslint-plugin-jsx-a11y|pa11y|lighthouse|@testing-library", glob: "package.json")
+Grep(pattern: "aria-|role=|tabIndex|sr-only|visually-hidden", glob: "*.{tsx,jsx,vue,svelte}", output_mode: "count")
+```
+
+Record: `APP_URL`, `PAGES`, `CSS_FRAMEWORK`, `COMPONENT_LIB`, `EXISTING_A11Y_TOOLS`, `ARIA_USAGE_COUNT`.
+
+---
+
+## Phase 1: Research Current WCAG Guidelines
+
+### 1a. Firecrawl Research
+
+```json
+firecrawl:firecrawl_search
+{
+ "query": "WCAG 2.2 success criteria checklist web accessibility [current year]",
+ "limit": 5
+}
+```
+
+```json
+firecrawl:firecrawl_search
+{
+ "query": "axe-core automated accessibility testing best practices common false positives",
+ "limit": 5
+}
+```
+
+```json
+firecrawl:firecrawl_search
+{
+ "query": "<CSS_FRAMEWORK> <COMPONENT_LIB> accessibility best practices common issues",
+ "limit": 5
+}
+```
+
+Scrape 2–3 authoritative results:
+
+```json
+firecrawl:firecrawl_scrape
+{
+ "url": "<BEST_RESULT_URL>",
+ "formats": ["markdown"],
+ "onlyMainContent": true
+}
+```
+
+### 1b. Framework-Specific a11y Docs (Context7)
+
+```json
+context7:resolve-library-id
+{
+ "libraryName": "<COMPONENT_LIB e.g. radix-ui or chakra-ui>"
+}
+```
+
+```json
+context7:query-docs
+{
+ "libraryId": "<RESOLVED_ID>",
+ "query": "accessibility ARIA keyboard navigation focus management"
+}
+```
+
+---
+
+## Phase 2: Automated Scanning (axe-core via Playwright)
+
+### 2a. Navigate to Each Page
+
+For each page discovered in Phase 0a:
+
+```bash
+PW="npx --yes @playwright/cli@latest"
+$PW -s=a11y open --headed "<APP_URL><ROUTE>"    # first page; use `goto` for subsequent ones
+```
+
+Apply the `protocol-browser-anti-stall` protocol: wait 2s, snapshot, verify page loaded.
+
+### 2b. Inject and Run axe-core
+
+Use `run-code` to inject axe-core from CDN and run a full scan. The URL pins
+a version so results are reproducible; if the CDN returns 404, look up the
+current axe-core 4.x on cdnjs and substitute it — do not skip the scan:
+
+```bash
+$PW -s=a11y run-code 'async (page) => { await page.addScriptTag({ url: "https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.10.2/axe.min.js" }); return await page.evaluate(async () => { const r = await axe.run(); return { violations: r.violations.map(v => ({ id: v.id, impact: v.impact, description: v.description, help: v.help, helpUrl: v.helpUrl, nodes: v.nodes.length, targets: v.nodes.slice(0, 3).map(n => n.target[0]) })), passes: r.passes.length, incomplete: r.incomplete.length, inapplicable: r.inapplicable.length }; }); }'
+```
+
+For each violation returned, record:
+- **Rule ID** (e.g., `color-contrast`, `image-alt`, `label`)
+- **Impact** (critical, serious, moderate, minor)
+- **WCAG criteria** mapped from the rule
+- **Affected elements** (CSS selectors)
+- **Count** of affected nodes
+
+### 2c. Check Specific WCAG Categories Manually
+
+**Heading Hierarchy (WCAG 1.3.1):**
+
+```bash
+$PW -s=a11y eval '() => Array.from(document.querySelectorAll("h1,h2,h3,h4,h5,h6")).map(h => ({ tag: h.tagName, text: h.textContent.trim().substring(0, 50) }))'
+```
+
+Verify: only one `h1`, headings don't skip levels (h1 -> h3 without h2).
+
+**Image Alt Text (WCAG 1.1.1):**
+
+```bash
+$PW -s=a11y eval '() => Array.from(document.querySelectorAll("img")).map(img => ({ src: img.src.split("/").pop(), alt: img.alt, hasAlt: img.hasAttribute("alt"), decorative: img.getAttribute("role") === "presentation" || img.alt === "" }))'
+```
+
+Verify: all informative images have descriptive alt text, decorative images have `alt=""` or `role="presentation"`.
+
+**Link Text (WCAG 2.4.4):**
+
+```bash
+$PW -s=a11y eval '() => Array.from(document.querySelectorAll("a")).filter(a => ["click here", "here", "read more", "learn more", "", "link"].includes((a.textContent || "").trim().toLowerCase())).map(a => ({ href: a.href, text: (a.textContent || "").trim(), ariaLabel: a.getAttribute("aria-label") }))'
+```
+
+Flag generic link text ("click here", "read more", empty links without aria-label).
+
+**Form Labels (WCAG 1.3.1, 4.1.2):**
+
+```bash
+$PW -s=a11y eval '() => Array.from(document.querySelectorAll("input,select,textarea")).map(el => ({ type: el.type, name: el.name, id: el.id, hasLabel: !!el.id && !!document.querySelector(`label[for="${el.id}"]`), ariaLabel: el.getAttribute("aria-label"), ariaLabelledBy: el.getAttribute("aria-labelledby"), placeholder: el.placeholder }))'
+```
+
+Verify: every form control has an associated `<label>`, `aria-label`, or `aria-labelledby`.
+
+**Language Attribute (WCAG 3.1.1):**
+
+```bash
+$PW -s=a11y eval '() => ({ htmlLang: document.documentElement.lang, htmlDir: document.documentElement.dir })'
+```
+
+Verify: `<html>` has a valid `lang` attribute.
+
+### 2d. Take Evidence Screenshots
+
+For each page, capture a screenshot as visual evidence:
+
+```bash
+$PW -s=a11y screenshot --filename ".playwright-mcp/a11y-<route>.png"
+```
+
+---
+
+## Phase 3: Keyboard Navigation Testing
+
+### 3a. Tab Order Test
+
+For each page, test that all interactive elements are reachable via Tab key:
+
+```bash
+PW="npx --yes @playwright/cli@latest"
+$PW -s=a11y open --headed "<APP_URL><ROUTE>"    # first page; use `goto` for subsequent ones
+```
+
+Press Tab repeatedly and snapshot after each press to track focus movement:
+
+```bash
+$PW -s=a11y press Tab
+$PW -s=a11y snapshot
+```
+
+After each Tab, check:
+- [ ] Focus is visible (there is a focus indicator on the active element)
+- [ ] Focus order is logical (follows visual reading order)
+- [ ] No focus trap (Tab eventually cycles back to the beginning or reaches the end)
+- [ ] Skip links exist (if there is a large navigation area)
+
+Keep pressing Tab until focus has visited every interactive element on the page or cycled back to the first one; stop early only when a focus trap is found, and record it.
+
+### 3b. Interactive Element Testing
+
+For each interactive component (dropdowns, modals, tabs, accordions):
+
+**Enter/Space activation (WCAG 2.1.1):**
+- Tab to the element
+- Press Enter or Space
+- Verify the action fires (snapshot to confirm state change)
+
+**Escape to close (WCAG 2.1.1 for modals/dialogs):**
+
+```bash
+$PW -s=a11y press Escape
+```
+
+Verify: modals/dropdowns close, focus returns to the trigger element.
+
+**Arrow key navigation (for tab panels, menus, listboxes):**
+
+```bash
+$PW -s=a11y press ArrowDown
+```
+
+### 3c. Focus Management After State Changes
+
+Test that focus is managed correctly after dynamic updates:
+- After opening a modal: focus should move into the modal
+- After closing a modal: focus should return to the trigger
+- After deleting an item from a list: focus should move to the next item or a logical location
+- After form submission: focus should move to a success/error message
+
+---
+
+## Phase 4: Cross-Check with Sentry
+
+### 4a. Search for Assistive Technology Errors
+
+```json
+sentry:search_issues
+{
+ "organizationSlug": "<ORG_SLUG>",
+ "projectSlugOrId": "<PROJECT_SLUG>",
+ "query": "is:unresolved aria OR screenreader OR voiceover OR talkback OR nvda OR jaws OR focus OR tabindex OR keyboard"
+}
+```
+
+### 4b. Check for JavaScript Errors on Keyboard Interaction
+
+```json
+sentry:search_issues
+{
+ "organizationSlug": "<ORG_SLUG>",
+ "projectSlugOrId": "<PROJECT_SLUG>",
+ "query": "is:unresolved keydown OR keyup OR keypress OR focusin OR focusout"
+}
+```
+
+### 4c. Browser/Device Breakdown
+
+If errors cluster on AT-favored browsers, pull the browser distribution for the issue. `get_issue_tag_values` is a catalog tool, not a direct one, so call it through `execute_sentry_tool`. If the call is rejected, run `search_sentry_tools` with `"issue tag values"` to get the current name and schema.
+
+```json
+sentry:execute_sentry_tool
+{
+ "name": "get_issue_tag_values",
+ "arguments": {
+  "organizationSlug": "<ORG_SLUG>",
+  "issueId": "<ISSUE_ID>",
+  "tagKey": "browser"
+ }
+}
+```
+
+---
+
+## Phase 5: Static Code Analysis
+
+### 5a. Missing ARIA Attributes
+
+```
+Grep(pattern: "onClick(?!.*role=)(?!.*tabIndex)", glob: "*.{tsx,jsx}")
+```
+
+Flag `div` or `span` elements with click handlers but no `role` or `tabIndex` — these are invisible to keyboard and screen reader users.
+
+### 5b. Inaccessible Custom Components
+
+```
+SemanticSearch(query: "Where are custom interactive components defined (dropdowns, modals, tabs, accordions) that don't use a component library?", target_directories: [])
+```
+
+Check each custom interactive for:
+- Proper ARIA roles (`role="dialog"`, `role="tabpanel"`, etc.)
+- Keyboard event handlers (`onKeyDown`)
+- Focus management (`useRef` + `.focus()`)
+- ARIA states (`aria-expanded`, `aria-selected`, `aria-hidden`)
+
+### 5c. Color Contrast in CSS/Tailwind
+
+```
+Grep(pattern: "text-gray-[345]|text-slate-[345]|text-zinc-[345]|text-neutral-[345]|color:\\s*#[789abc]", glob: "*.{tsx,jsx,css,scss}")
+```
+
+Light gray text on white background is the most common contrast failure. Flag files using light gray text colors for manual contrast checking.
+
+---
+
+## Phase 6: Report
+
+```
+═══════════════════════════════════════════════════════
+ WCAG 2.2 ACCESSIBILITY AUDIT REPORT
+ Project: <PROJECT_NAME>
+ Date: <DATE>
+ Standard: WCAG 2.2 Level AA
+ Pages Tested: <COUNT>
+═══════════════════════════════════════════════════════
+
+## 1. EXECUTIVE SUMMARY
+
+| Metric | Result |
+|---------------------------|-----------------|
+| Pages tested | X |
+| Total violations | N |
+| Critical violations | N |
+| Serious violations | N |
+| Level A criteria failed / checked | N / M |
+| Level AA criteria failed / checked | N / M |
+| axe-core rules passed | N |
+| Keyboard navigable pages | X/Y |
+
+## 2. AXE-CORE SCAN RESULTS (per page)
+
+| Page | Critical | Serious | Moderate | Minor | Pass | Worst level failed (A / AA / none) |
+|------|----------|---------|----------|-------|------|------|
+| / | ... | ... | ... | ... | ... | A / AA / none |
+| /about | ... | ... | ... | ... | ... | A / AA / none |
+
+## 3. VIOLATIONS BY WCAG CRITERION
+
+| WCAG SC | Name | Level | Pages Affected | Elements | Impact | Status |
+|---------|------|-------|----------------|----------|--------|--------|
+| 1.1.1 | Non-text Content | A | ... | ... | ... | PASS/FAIL |
+| 1.3.1 | Info and Relationships | A | ... | ... | ... | PASS/FAIL |
+| 1.4.3 | Contrast (Minimum) | AA | ... | ... | ... | PASS/FAIL |
+| 2.1.1 | Keyboard | A | ... | ... | ... | PASS/FAIL |
+| 2.4.3 | Focus Order | A | ... | ... | ... | PASS/FAIL |
+| 2.4.4 | Link Purpose | A | ... | ... | ... | PASS/FAIL |
+| 2.4.7 | Focus Visible | AA | ... | ... | ... | PASS/FAIL |
+| 3.1.1 | Language of Page | A | ... | ... | ... | PASS/FAIL |
+| 4.1.2 | Name, Role, Value | A | ... | ... | ... | PASS/FAIL |
+
+## 4. KEYBOARD NAVIGATION
+
+| Page | Tab Order Logical | Focus Visible | No Focus Trap | Skip Link | Worst level failed |
+|------|-------------------|---------------|---------------|-----------|-------|
+| / | ... | ... | ... | ... | A / AA / none |
+
+## 5. INTERACTIVE COMPONENTS
+
+| Component | Location | ARIA Roles | Keyboard Operable | Focus Managed | Worst level failed |
+|-----------|----------|------------|-------------------|---------------|-------|
+| Modal | ... | ... | ... | ... | A / AA / none |
+| Dropdown | ... | ... | ... | ... | A / AA / none |
+
+## 6. SENTRY ASSISTIVE TECHNOLOGY ERRORS
+
+| Issue | Error Type | Events | Browser/AT | Fix Needed |
+|-------|------------|--------|------------|------------|
+| ... | ... | ... | ... | ... |
+
+## 7. STATIC CODE FINDINGS
+
+| Pattern | Files | Count | Risk |
+|---------|-------|-------|------|
+| onClick without role/tabIndex | ... | N | High |
+| Custom interactive without ARIA | ... | N | High |
+| Low-contrast text classes | ... | N | Medium |
+
+## 8. CRITICAL FINDINGS (Action Required)
+
+P0 — Level A violations (legal risk):
+1. [finding with WCAG SC, element, page, evidence]
+
+P1 — Level AA violations (compliance gap):
+1. [finding with WCAG SC, element, page, evidence]
+
+P2 — Best practice improvements:
+1. [finding with rationale]
+
+## 9. RECOMMENDATIONS
+
+| # | WCAG SC | Current | Recommended | Effort | Files to Change |
+|---|---------|---------|-------------|--------|-----------------|
+| 1 | ... | ... | ... | S/M/L | ... |
+
+═══════════════════════════════════════════════════════
+```

package/skills/audit-agent-speed/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: audit-agent-speed
+description: >
+  Measure and fix a slow coding-agent setup: status line, hooks, instruction
+  bloat, effort, worktree pile-up, antivirus and indexer scans. Use when
+  "Claude is slow" or "CPU is pinned". App speed → audit-performance.
+license: MIT
+effort: high
+---
+
+# audit-agent-speed — Make the agent setup fast again
+
+**Degree of freedom: MIXED** — measurement commands `[LOW freedom — run
+exactly]`; which fixes to recommend `[HIGH freedom]`.
+
+> **Audit-and-fix exception.** Report first, then fix. Apply local, reversible
+> fixes right away. Ask before anything that needs admin rights, touches
+> committed config, deletes data, or changes a user preference (effort, model).
+
+Most of an agent's turn is model time on the provider's servers, and no local
+tuning changes that. This skill wins back the **local** part: hooks, tools,
+builds, git, terminal rendering, and a CPU that other processes keep pinned.
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **audit-agent-speed** (this) | The agent host: Claude Code/Cursor config, hooks, status line, worktrees, OS scanners |
+| `audit-performance` | The product's runtime speed (Core Web Vitals, bundles, queries) |
+| `workflow-environment-ready` | Proving tools and verify commands work before a long run |
+| `iterate-agent-harness` | Turning an agent failure into a guard with a regression test |
+
+## How to reason
+
+1. **Observe**: measure CPU per process before blaming anything. Quote the numbers.
+2. **Interpret**: per-call cost × call rate × concurrent sessions. A 100 ms hook
+   on every tool call across 3 agents matters; a 2 s Stop hook that runs once doesn't.
+3. **Classify**: fix now (local, reversible) / ask (admin, committed, preference) / leave.
+4. **Verify**: re-measure after each fix and report each change's effect separately.
+
+## Worked example
+
+> **Observe:** total CPU 100% with 3 sessions. Per-process sampling: `ccusage`
+> ×5 at 49%, `wmiprvse` 8%, `MsMpEng` 3%.
+> **Interpret:** the status line runs `ccusage statusline` every 10 s per
+> session; each run re-reads ~10 GB of transcripts, and slow runs pile up.
+> **Classify:** fix now. Remove the widget (back up the config first).
+> **Verify:** no `ccusage` spawned in 2 min; total 53–72% → later ~30% as agent
+> jobs finished (report the workload change separately from the fix).
+
+---
+
+## Phase 0 — Measure (run exactly)
+
+Windows (includes protected processes such as Defender):
+
+```powershell
+$c = Get-Counter '\Process(*)\% Processor Time' -SampleInterval 5 -MaxSamples 1 -ErrorAction SilentlyContinue
+$cores = (Get-CimInstance Win32_ComputerSystem).NumberOfLogicalProcessors
+$c.CounterSamples | Where-Object { $_.InstanceName -notin '_total','idle' -and $_.Status -eq 0 } |
+  Group-Object { $_.InstanceName -replace '#\d+$','' } |
+  ForEach-Object { [pscustomobject]@{ Name=$_.Name; Count=$_.Count; Cpu=[math]::Round((($_.Group | Measure-Object CookedValue -Sum).Sum)/$cores,1) } } |
+  Sort-Object Cpu -Descending | Select-Object -First 15
+```
+
+macOS / Linux: `ps -eo pcpu,comm --sort=-pcpu | head -20` (macOS: `ps -Ao pcpu,comm -r | head -20`).
+
+Take 3–4 samples over ~30 s. Avoid heavy `Get-CimInstance Win32_Process`
+loops while measuring; they inflate `wmiprvse` themselves.
+
+## Phase 1 — Status line
+
+- A status line runs on every assistant message (debounced at 300 ms).
+  `statusLine.refreshInterval` **adds** timed runs on top; leave it unset
+  unless a widget needs a clock.
+- Widgets that re-read transcripts on every render (`ccusage statusline`,
+  transcript-parsing HUDs) scale with transcript volume × sessions. Prefer
+  widgets that only read the JSON Claude Code passes on stdin (cost,
+  context window, rate limits). Keep `ccusage` as an on-demand CLI.
+- Cache slow git calls (ccstatusline: `gitCacheTtlSeconds` ≥ 30).
+- Source: https://code.claude.com/docs/en/statusline
+
+## Phase 2 — Hooks
+
+Inventory every hook in `~/.claude/settings.json` and each repo's
+`.claude/settings.json`, then time each one (`echo '{}' | <command>`).
+
+- **Per-tool-call hooks** (`PreToolUse` with matcher `*`, `PostToolUse` on
+  `Edit|Write`) spawn a process per call. Narrow with `matcher` or the `if`
+  field (permission-rule syntax) so non-matching calls never spawn.
+- **Per-edit lint/format** that blocks for seconds duplicates `lint-staged` at
+  commit and rewrites files under the agent (forcing re-reads). Remove it when
+  pre-commit already runs `eslint --fix`.
+- **Synchronous Stop typecheck is invisible cost.** For most events, including
+  Stop, plain stdout goes to the debug log only, so the agent never sees the
+  errors while every turn waits. Replace it with
+  [scripts/stop-typecheck.mjs](scripts/stop-typecheck.mjs) registered with
+  `asyncRewake: true`: background, skip-if-unchanged, wakes the agent only on a
+  new error set. Copy it to `<repo>/.claude/hooks/` and pass the repo's
+  typecheck script name.
+- Source: https://code.claude.com/docs/en/hooks (Exit code 0, `async`, `asyncRewake`, `if`)
+
+## Phase 3 — Instruction files and search scope
+
+- **AGENTS.md is skipped when any CLAUDE.md exists in the working directory or
+  above it**, which includes a parent folder holding all your repos. Load both
+  with user settings
+  `"pluginConfigs": { "agents-md@builtin": { "options": { "instructionFiles": "claude-md-and-agents-md" } } }`
+  (ignored in project settings). Source: https://code.claude.com/docs/en/memory
+- Keep each CLAUDE.md under ~200 lines; `@imports` load at launch and don't
+  save context. Run `/doctor prompt-audit` to find bloat.
+- **Worktree folders inside the repo that are not gitignored** (`.worktrees/`)
+  make every Grep/Glob walk each copy and return duplicate hits. Add them to
+  `.git/info/exclude` (local, no commit) or `.gitignore`. Check:
+  `git check-ignore -v .worktrees/x` and compare `rg --files | wc -l` before and after.
+
+## Phase 4 — Effort and models
+
+- Lower effort is faster and cheaper; Opus 5.5 defaults to `medium`. A global
+  `xhigh` slows every routine turn. Suggest `high` (or the default) with
+  `/effort xhigh` for hard tasks. On Opus 5.5, changing effort keeps the prompt cache.
+- The built-in Explore agent inherits the main model. A user agent named
+  `Explore` with `model: haiku` overrides it for fast, cheap searches.
+- Fast mode (`/fast`): up to 2.5× faster output at a higher per-token price,
+  billed from usage credits on subscriptions; enable at session start.
+- These are preferences: recommend, then ask. Sources:
+  https://code.claude.com/docs/en/model-config, https://code.claude.com/docs/en/sub-agents, https://code.claude.com/docs/en/fast-mode
+
+## Phase 5 — Worktree pile-up
+
+Agents create worktrees faster than anyone removes them. Inventory with
+`git worktree list --porcelain` per repo and classify:
+
+- **KEEP**: uncommitted changes, locked, path in a running process's command
+  line, or activity in the last 24 h. Measure activity from `HEAD` and
+  `logs/HEAD` mtimes in the worktree's git dir, **not** `index`: `git status`
+  rewrites the index and makes every worktree look fresh.
+- **SAFE**: clean, idle, and either merged into the default branch or its PR
+  branch is `[gone]` on the remote (squash merges).
+- **REVIEW**: clean, but holds commits not on the default branch.
+
+Report the counts and list; remove SAFE ones only on approval, with
+`git worktree remove` (never `--force`).
+
+## Phase 6 — Operating system (Windows examples)
+
+- **Antivirus:** prefer a Dev Drive with Defender performance mode over
+  exclusions. Process exclusions (`node.exe`, `git.exe`) skip scanning of
+  everything those processes write, so flag them as risk, not as a speed fix.
+  Source: https://learn.microsoft.com/en-us/windows/dev-drive/
+- **Search indexer:** exclude the repos folder via Settings → Privacy &
+  security → Searching Windows → Add an excluded folder. The
+  `PreventIndexingCertainPaths` policy key was observed to be ignored on
+  Windows 11 Home; verify any exclusion with a probe file.
+- **Vendor utilities that query WMI on every process start** (observed:
+  Alienware Command Center's `AWCC.SCSubAgent`, ~8% CPU) scale with agent
+  process churn. Attribute `wmiprvse` load by enabling the
+  `Microsoft-Windows-WMI-Activity/Trace` channel for ~20 s (admin) and
+  grouping `ClientProcessId`. Killing the sub-agent doesn't stick if a
+  service respawns it; the fix is uninstalling the utility, which is the owner's call.
+- Power plan on AC and Best performance; background terminals are throttled
+  harder on battery.
+
+## Self-critique
+
+Before reporting, fail the run if any of these are true:
+
+- A cause was named without a per-process measurement behind it
+- A fix was credited with a drop that a workload change explains
+- A hook or setting was changed without timing it before and after
+- A worktree, exclusion, or user preference was changed without approval
+- An exclusion or policy was reported as working without a probe that proves it
+
+## Report
+
+```
+| # | Finding | Measured | Fix | Status (fixed / ask / leave) |
+```
+
+Then a before/after CPU table, the list of changed files with backups, and
+what's left for the owner (admin prompts, committed config, preferences).