@tinkcarlos/skillora 0.2.0

package/.claude/skills/code-review/references/database-review.md

@@ -0,0 +1,298 @@
+# Database Review Guide
+
+> Comprehensive guide for reviewing database-related code, SQL, migrations, and data layer.
+
+## Table of Contents
+
+- [SQL File Review](#sql-file-review)
+- [Migration Review](#migration-review)
+- [ORM & Query Review](#orm--query-review)
+- [Schema Design Review](#schema-design-review)
+- [Performance Patterns](#performance-patterns)
+- [Security Checklist](#security-checklist)
+- [Database File Review](#database-file-review)
+
+---
+
+## SQL File Review
+
+### What to Check in SQL Files
+
+| Category | Check | Why |
+|----------|-------|-----|
+| **Syntax** | Valid SQL for target database | MySQL != PostgreSQL != SQLite |
+| **Indexes** | Indexes on WHERE, JOIN, ORDER BY columns | Performance critical |
+| **Transactions** | BEGIN/COMMIT/ROLLBACK boundaries | Data consistency |
+| **Error Handling** | What happens on failure | Partial updates are dangerous |
+| **Idempotency** | Safe to run multiple times | Deployments may retry |
+
+### Common SQL Bugs
+
+```sql
+-- 🔴 BUG: Missing index on frequently queried column
+SELECT * FROM orders WHERE customer_id = ?;
+-- Fix: CREATE INDEX idx_orders_customer ON orders(customer_id);
+
+-- 🔴 BUG: SELECT * in production code
+SELECT * FROM users WHERE id = ?;
+-- Fix: SELECT id, name, email FROM users WHERE id = ?;
+
+-- 🔴 BUG: Missing NULL handling
+SELECT * FROM users WHERE deleted_at = NULL;
+-- Fix: SELECT * FROM users WHERE deleted_at IS NULL;
+
+-- 🔴 BUG: Implicit type conversion
+SELECT * FROM users WHERE id = '123';  -- id is INT
+-- Fix: SELECT * FROM users WHERE id = 123;
+
+-- 🔴 BUG: LIKE without index hint
+SELECT * FROM products WHERE name LIKE '%phone%';
+-- Note: Leading wildcard prevents index usage
+
+-- 🔴 BUG: Missing LIMIT on large tables
+SELECT * FROM logs WHERE level = 'ERROR';
+-- Fix: SELECT * FROM logs WHERE level = 'ERROR' LIMIT 1000;
+```
+
+### Transaction Patterns
+
+```sql
+-- ✅ GOOD: Explicit transaction with error handling
+BEGIN;
+  UPDATE accounts SET balance = balance - 100 WHERE id = 1;
+  UPDATE accounts SET balance = balance + 100 WHERE id = 2;
+COMMIT;
+
+-- 🔴 BAD: No transaction for multi-statement operation
+UPDATE accounts SET balance = balance - 100 WHERE id = 1;
+-- If crash here, money is lost
+UPDATE accounts SET balance = balance + 100 WHERE id = 2;
+```
+
+---
+
+## Migration Review
+
+### Pre-Deployment Checklist
+
+| Check | Question | Risk |
+|-------|----------|------|
+| **Reversibility** | Can this be rolled back? | Stuck with broken schema |
+| **Data Loss** | Does this delete data? | Irreversible damage |
+| **Downtime** | Does this lock tables? | Service unavailable |
+| **Dependencies** | Is code deployed first or DB? | 500 errors during deploy |
+| **Large Tables** | Will this take hours? | Deployment timeout |
+
+### Dangerous Migration Patterns
+
+```sql
+-- 🔴 DANGEROUS: Dropping column without checking usage
+ALTER TABLE users DROP COLUMN legacy_field;
+-- Check: Is any code still using this column?
+
+-- 🔴 DANGEROUS: Renaming column (breaks running code)
+ALTER TABLE users RENAME COLUMN name TO full_name;
+-- Fix: Add new column, migrate data, then drop old in next release
+
+-- 🔴 DANGEROUS: Adding NOT NULL without default
+ALTER TABLE users ADD COLUMN role VARCHAR(50) NOT NULL;
+-- Fix: ADD COLUMN role VARCHAR(50) NOT NULL DEFAULT 'user';
+
+-- 🔴 DANGEROUS: Changing column type with data loss
+ALTER TABLE users ALTER COLUMN age TYPE SMALLINT;
+-- Check: Any values > 32767?
+
+-- 🔴 DANGEROUS: Index on large table without CONCURRENTLY
+CREATE INDEX idx_orders_date ON orders(created_at);
+-- Fix (PostgreSQL): CREATE INDEX CONCURRENTLY idx_orders_date ON orders(created_at);
+```
+
+### Migration Best Practices
+
+1. **Backward Compatible**: New code should work with old schema
+2. **Forward Compatible**: Old code should work with new schema
+3. **Separate Deploy**: Schema change and code change in different deploys
+4. **Test Rollback**: Actually run the down migration
+
+---
+
+## ORM & Query Review
+
+### N+1 Query Detection
+
+```python
+# 🔴 BUG: N+1 queries (1 + N database calls)
+users = User.query.all()  # 1 query
+for user in users:
+    print(user.orders)    # N queries (1 per user)
+
+# ✅ FIX: Eager loading
+users = User.query.options(joinedload(User.orders)).all()  # 1-2 queries
+```
+
+```typescript
+// 🔴 BUG: N+1 in JavaScript
+const users = await User.findAll();
+for (const user of users) {
+    const orders = await Order.findAll({ where: { userId: user.id } });
+}
+
+// ✅ FIX: Include in query
+const users = await User.findAll({ include: [Order] });
+```
+
+### Raw Query Injection
+
+```python
+# 🔴 BUG: SQL Injection
+user_id = request.args.get('id')
+query = f"SELECT * FROM users WHERE id = {user_id}"
+db.execute(query)
+
+# ✅ FIX: Parameterized query
+query = "SELECT * FROM users WHERE id = :id"
+db.execute(query, {"id": user_id})
+```
+
+### Connection Management
+
+```python
+# 🔴 BUG: Connection leak
+conn = pool.acquire()
+result = conn.execute(query)  # If exception here
+pool.release(conn)            # Never executed
+
+# ✅ FIX: Context manager
+with pool.acquire() as conn:
+    result = conn.execute(query)
+```
+
+---
+
+## Schema Design Review
+
+### Data Type Issues
+
+| Issue | Problem | Fix |
+|-------|---------|-----|
+| VARCHAR(255) for everything | Wasted space, no validation | Use appropriate sizes |
+| TEXT for short strings | Index limitations | Use VARCHAR with limit |
+| FLOAT for money | Precision loss | Use DECIMAL(19,4) |
+| INT for timestamp | Y2K38 problem | Use DATETIME/TIMESTAMP |
+| No ENUM validation | Invalid data allowed | Use ENUM or CHECK constraint |
+
+### Constraint Checklist
+
+```sql
+-- Required constraints to verify:
+-- 1. Primary Key
+-- 2. Foreign Keys with ON DELETE behavior
+-- 3. NOT NULL for required fields
+-- 4. UNIQUE for unique fields
+-- 5. CHECK constraints for valid ranges
+-- 6. DEFAULT values for optional fields
+
+-- Example: Complete table definition
+CREATE TABLE orders (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    status VARCHAR(20) NOT NULL DEFAULT 'pending' 
+        CHECK (status IN ('pending', 'paid', 'shipped', 'delivered')),
+    total DECIMAL(19, 4) NOT NULL CHECK (total >= 0),
+    created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMP NOT NULL DEFAULT NOW()
+);
+```
+
+---
+
+## Performance Patterns
+
+### Index Review
+
+```sql
+-- Find missing indexes (PostgreSQL)
+SELECT schemaname, tablename, indexname, indexdef
+FROM pg_indexes
+WHERE tablename = 'your_table';
+
+-- Check for unused indexes
+SELECT indexrelname, idx_scan, idx_tup_read
+FROM pg_stat_user_indexes
+WHERE idx_scan = 0;
+```
+
+### Query Optimization
+
+| Pattern | Bad | Good |
+|---------|-----|------|
+| Select fields | `SELECT *` | `SELECT id, name, email` |
+| Pagination | `OFFSET 10000` | Cursor-based pagination |
+| Counting | `SELECT COUNT(*)` | Cached count or estimate |
+| Existence | `SELECT COUNT(*) > 0` | `SELECT EXISTS(...)` |
+| Batch insert | Loop with single INSERT | Bulk INSERT |
+
+---
+
+## Security Checklist
+
+### SQL Injection Prevention
+
+- [ ] All user input parameterized
+- [ ] No string concatenation in queries
+- [ ] ORM queries don't use raw()
+- [ ] Stored procedures use parameters
+
+### Data Protection
+
+- [ ] Sensitive data encrypted at rest
+- [ ] PII masked in logs
+- [ ] Backups encrypted
+- [ ] Connection uses TLS
+
+### Access Control
+
+- [ ] Principle of least privilege
+- [ ] No root/admin credentials in code
+- [ ] Database users have limited permissions
+- [ ] Connection strings use environment variables
+
+---
+
+## Database File Review
+
+### SQLite/Embedded Database Files
+
+When reviewing `.db`, `.sqlite`, `.sqlite3` files:
+
+| Check | What to Look For | Risk |
+|-------|------------------|------|
+| **PII Exposure** | User data, emails, phones | Privacy violation |
+| **Secrets** | API keys, tokens, passwords | Security breach |
+| **Test Data** | Fake data in production | Confusion |
+| **Size** | Unexpectedly large files | Performance issue |
+| **Location** | In version control? | Data leak |
+
+### Detection Commands
+
+```bash
+# Check if DB files are in git
+git ls-files | grep -E "\.db$|\.sqlite"
+
+# List tables in SQLite
+sqlite3 database.db ".tables"
+
+# Check for sensitive columns
+sqlite3 database.db ".schema" | grep -i "password\|secret\|token\|key"
+
+# Sample data (first 5 rows)
+sqlite3 database.db "SELECT * FROM users LIMIT 5;"
+```
+
+### Best Practices
+
+1. **Never commit database files** — Add to `.gitignore`
+2. **Use migrations** — Don't ship pre-populated DBs
+3. **Separate test data** — Use fixtures/seeds, not DB files
+4. **Encrypt sensitive DBs** — SQLCipher for SQLite
+

package/.claude/skills/code-review/references/dependency-and-integrity-protocol.md

@@ -0,0 +1,313 @@
+# Dependency Management & Code Integrity Protocol
+
+> **核心原则**: 新增依赖必须安装 → 依赖文件必须更新 → 完成后必须验证 → 验证包括兼容性和文件完整性
+
+---
+
+## 🔴 依赖管理门禁 (Dependency Management Gate)
+
+### 触发条件
+
+当代码中出现以下情况时，**必须执行依赖管理流程**：
+
+| 触发条件 | 示例 |
+|----------|------|
+| 新增 import/require 语句 | `import { Collapsible } from "@radix-ui/react-collapsible"` |
+| 安装新的组件库/UI 框架 | shadcn/ui, Ant Design, Material UI |
+| 引入新的工具函数库 | lodash, date-fns, zod |
+| 使用新的后端框架/库 | FastAPI, LangChain, Pydantic |
+| 调用新的第三方 API SDK | Stripe, OpenAI, AWS SDK |
+
+---
+
+## 依赖检测规则 (通用)
+
+### Step 1: 识别依赖类型
+
+| 项目类型 | 依赖文件 | 安装命令 |
+|----------|---------|----------|
+| Node.js/前端 | `package.json` | `npm install <pkg>` / `yarn add <pkg>` / `pnpm add <pkg>` |
+| Python | `requirements.txt` / `pyproject.toml` | `pip install <pkg>` / `uv add <pkg>` |
+| Go | `go.mod` | `go get <pkg>` |
+| Rust | `Cargo.toml` | `cargo add <pkg>` |
+| Java/Kotlin | `pom.xml` / `build.gradle` | Maven/Gradle 手动添加 |
+
+### Step 2: 检查依赖是否已存在
+
+```bash
+# Node.js - 检查 package.json
+grep "<package-name>" package.json
+
+# Python - 检查 requirements.txt
+grep "<package-name>" requirements.txt
+
+# 通用 - 检查 node_modules / venv
+ls node_modules/<package-name> 2>/dev/null || echo "Not installed"
+```
+
+### Step 3: 安装缺失依赖
+
+**🔴 必须在代码修改前或立即之后安装依赖！**
+
+```bash
+# Node.js
+npm install <package-name>
+# 或指定版本
+npm install <package-name>@<version>
+```
+
+#### 🔴 Python 虚拟环境强制要求 (NON-NEGOTIABLE)
+
+**Python 项目的所有依赖操作必须在虚拟环境中进行！**
+
+```bash
+# Step 1: 检查虚拟环境是否存在
+ls venv/ 2>/dev/null || ls .venv/ 2>/dev/null || echo "虚拟环境不存在"
+
+# Step 2: 如果不存在，创建虚拟环境
+python -m venv venv
+
+# Step 3: 激活虚拟环境 (必须!)
+# Windows CMD
+venv\Scripts\activate
+# Windows PowerShell
+.\venv\Scripts\Activate.ps1
+# Linux/Mac
+source venv/bin/activate
+
+# Step 4: 在虚拟环境中安装依赖
+pip install <package-name>
+# 或指定版本
+pip install <package-name>==<version>
+
+# Step 5: 更新 requirements.txt
+pip freeze > requirements.txt
+```
+
+**❌ 禁止事项**:
+- 禁止在全局 Python 环境中安装项目依赖
+- 禁止不激活虚拟环境就执行 `pip install`
+- 禁止使用系统 Python 运行项目脚本
+
+**✅ 验证虚拟环境激活**:
+```bash
+# 检查 which/where python 指向虚拟环境
+which python  # Linux/Mac: 应显示 .../venv/bin/python
+where python  # Windows: 应显示 ...\venv\Scripts\python.exe
+```
+
+### Step 4: 更新依赖文件
+
+**🔴 安装后必须验证依赖文件已更新！**
+
+| 项目类型 | 验证方式 |
+|----------|---------|
+| Node.js | 检查 `package.json` 和 `package-lock.json` 是否包含新依赖 |
+| Python | 执行 `pip freeze > requirements.txt` 或手动添加到 requirements.txt |
+
+---
+
+## 🔴 代码文件完整性检查 (File Integrity Check)
+
+### 触发条件
+
+当新增功能涉及以下情况时，**必须执行文件完整性检查**：
+
+| 场景 | 检查内容 |
+|------|----------|
+| 使用 UI 组件库 | 组件文件是否存在于 `components/ui/` |
+| 引用工具函数 | 工具函数文件是否存在于 `lib/` 或 `utils/` |
+| 导入类型定义 | 类型文件是否存在于 `types/` |
+| 调用 API 服务 | 服务文件是否存在于 `services/` 或 `api/` |
+
+### 检查流程
+
+```
+代码中有新 import
+       ↓
+┌──────────────────────────────────────────────────────┐
+│ Step 1: 解析 import 路径                              │
+│ ─────────────────────────────────────────────────────│
+│ 相对路径? → 检查文件是否存在                          │
+│ 别名路径 (@/)? → 解析别名后检查文件是否存在           │
+│ 包路径? → 检查 node_modules 或 site-packages         │
+└──────────────────────────────────────────────────────┘
+       ↓
+┌──────────────────────────────────────────────────────┐
+│ Step 2: 文件不存在时的处理                            │
+│ ─────────────────────────────────────────────────────│
+│ UI 组件? → 创建组件文件 (shadcn/ui 风格)              │
+│ 工具函数? → 创建工具函数文件                          │
+│ 第三方包? → 安装依赖                                  │
+└──────────────────────────────────────────────────────┘
+```
+
+### 常见缺失文件场景
+
+| 场景 | 缺失类型 | 解决方案 |
+|------|---------|----------|
+| shadcn/ui 组件 | `components/ui/xxx.tsx` | 使用 `npx shadcn@latest add xxx` 或手动创建 |
+| Radix UI 原语 | npm 包未安装 | `npm install @radix-ui/react-xxx` |
+| 自定义 Hook | `hooks/useXxx.ts` | 创建 Hook 文件 |
+| API 服务 | `services/xxxService.ts` | 创建服务文件 |
+
+---
+
+## 🔴 兼容性检查 (Compatibility Check)
+
+### 版本兼容性矩阵
+
+| 检查项 | 方法 | 风险等级 |
+|--------|------|----------|
+| **Peer Dependencies** | 检查 npm 警告信息 | 🔴 高 |
+| **Node.js 版本** | 对比 `engines` 字段 | 🔴 高 |
+| **TypeScript 版本** | 检查类型定义兼容性 | 🟡 中 |
+| **React 版本** | 检查 Hooks/API 可用性 | 🔴 高 |
+| **Python 版本** | 对比 `python_requires` | 🔴 高 |
+| 🔴 **原生模块 (Native Module)** | 检查是否需要编译 | 🔴 高 |
+
+### 🔴 原生模块检查 (Electron/React Native 必须)
+
+**原生模块 = 使用 C/C++/Rust 编写的 Node.js 模块 = Electron 启动失败的头号杀手**
+
+| 检查命令 | 判断标准 |
+|----------|----------|
+| `ls node_modules/<pkg>/*.node` | 有 .node 文件 = 原生模块 |
+| `grep "binding.gyp" node_modules/<pkg>/` | 有 binding.gyp = 原生模块 |
+| `npm info <pkg> | grep -i "native\|gyp\|c++"` | 搜索结果有匹配 = 原生模块 |
+
+**常见原生模块及纯 JS 替代方案：**
+
+| 原生模块 | 纯 JS 替代 | 说明 |
+|----------|-----------|------|
+| `better-sqlite3` / `sqlite3` | `sql.js` | SQLite |
+| `sharp` | `jimp` | 图片处理 |
+| `bcrypt` | `bcryptjs` | 密码哈希 |
+| `node-sass` | `sass` | SCSS 编译 |
+
+→ 完整列表: `references/platform-specific-review.md`
+
+### 兼容性检查命令
+
+```bash
+# Node.js - 检查 peer dependency 警告
+npm ls 2>&1 | grep -i "peer dep"
+
+# Node.js - 审计安全问题
+npm audit
+
+# Python - 检查依赖冲突
+pip check
+
+# Python - 查看依赖树
+pip show <package-name>
+```
+
+### 常见兼容性问题处理
+
+| 问题 | 症状 | 解决方案 |
+|------|------|----------|
+| Peer dependency 不满足 | npm 警告 | 安装兼容版本或使用 `--legacy-peer-deps` |
+| TypeScript 类型错误 | 编译失败 | 安装 `@types/xxx` 或升级 TS 版本 |
+| React 版本不匹配 | 运行时错误 | 检查组件库的 React 版本要求 |
+| Python 版本不兼容 | ImportError | 检查库的 Python 版本要求 |
+
+---
+
+## 任务完成验证清单 (Post-Task Verification)
+
+**🔴 每个开发任务结束前，必须完成以下检查：**
+
+### 依赖验证
+
+- [ ] **依赖安装完成**: 所有新增依赖已安装到项目中
+- [ ] **依赖文件更新**: `package.json` / `requirements.txt` 已包含新依赖
+- [ ] **Lock 文件同步**: `package-lock.json` / `poetry.lock` 已更新
+- [ ] **无兼容性警告**: `npm ls` / `pip check` 无报错
+
+### 文件完整性验证
+
+- [ ] **所有 import 可解析**: 无 "Cannot find module" / "ModuleNotFoundError"
+- [ ] **组件文件存在**: UI 组件文件均存在于正确路径
+- [ ] **类型定义完整**: 无 TypeScript 类型错误
+
+### 运行时验证
+
+- [ ] **开发服务器启动**: `npm run dev` / `python run.py` 无报错
+- [ ] **无控制台错误**: 浏览器/终端无红色错误
+- [ ] **核心功能正常**: 主要功能可正常使用
+
+---
+
+## 验证命令速查
+
+```bash
+# ===== Node.js 项目 =====
+# 检查依赖安装
+npm ls --depth=0
+
+# 检查 peer dependency
+npm ls 2>&1 | grep -i "peer\|missing\|invalid"
+
+# 启动开发服务器验证
+npm run dev
+
+# ===== Python 项目 (🔴 必须在虚拟环境中!) =====
+# Step 0: 检查虚拟环境是否存在
+ls venv/ 2>/dev/null || ls .venv/ 2>/dev/null || echo "需要创建虚拟环境"
+
+# Step 1: 创建虚拟环境 (如果不存在)
+python -m venv venv
+
+# Step 2: 激活虚拟环境 (🔴 必须!)
+# Windows CMD
+venv\Scripts\activate
+# Windows PowerShell  
+.\venv\Scripts\Activate.ps1
+# Linux/Mac
+source venv/bin/activate
+
+# Step 3: 验证虚拟环境已激活
+which python  # 应指向 venv/bin/python 或 venv\Scripts\python.exe
+
+# Step 4: 安装依赖
+pip install -r requirements.txt
+
+# Step 5: 检查依赖安装
+pip list | grep <package-name>
+
+# Step 6: 检查依赖冲突
+pip check
+
+# Step 7: 导出依赖 (安装新包后)
+pip freeze > requirements.txt
+
+# Step 8: 运行项目 (使用虚拟环境 Python)
+python run.py  # 或 venv/bin/python run.py
+```
+
+---
+
+## 输出契约 (Dependency Gate Report)
+
+**任务完成时，在 Output Contract 中添加：**
+
+```markdown
+## 依赖管理报告
+
+### 新增依赖
+| 包名 | 版本 | 用途 | 安装状态 |
+|------|------|------|----------|
+| @radix-ui/react-collapsible | ^1.0.0 | Collapsible 组件 | ✅ 已安装 |
+
+### 文件完整性
+| 文件 | 类型 | 状态 |
+|------|------|------|
+| components/ui/collapsible.tsx | UI 组件 | ✅ 已创建 |
+
+### 验证结果
+- [x] 依赖安装完成
+- [x] 依赖文件更新
+- [x] 无兼容性警告
+- [x] 开发服务器启动正常
+```

package/.claude/skills/code-review/references/external-standards.md

@@ -0,0 +1,51 @@
+# External Standards & Authoritative Sources (for Code Review)
+
+Retrieved: 2025-12-23
+
+Use this document as a source-of-truth index for what “good” looks like across common review dimensions. Prefer these references when you need a neutral standard to justify a review finding or to design a minimal verification plan.
+
+## 1) General Code Review Process
+
+- Google Engineering Practices – Code Review Developer Guide: https://google.github.io/eng-practices/review/
+  - Review what matters: design, functionality, complexity, tests, naming, comments, style, documentation.
+  - Use code review as a quality and knowledge-sharing mechanism.
+- GitHub Docs – About pull request reviews: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews
+  - Standard review outcomes: comment, approve, request changes.
+  - Use CODEOWNERS and required reviews to enforce quality gates.
+
+## 2) Secure Code Review
+
+- OWASP Code Review Guide (project page + downloadable PDF): https://owasp.org/www-project-code-review-guide/
+  - Manual security review remains important even with automated scanners.
+  - Organize review around vulnerability classes and “red flags”, not language-specific “do it my way” patterns.
+- OWASP Application Security Verification Standard (ASVS): https://owasp.org/www-project-application-security-verification-standard/
+  - Security requirements checklist usable for design review, implementation review, and verification planning.
+  - Requirements are versioned and identifiable; reference the ASVS version when citing requirements.
+
+## 3) Testing & Verification Strategy
+
+- Martin Fowler – Test Pyramid: https://martinfowler.com/bliki/TestPyramid.html
+  - Prefer many fast, reliable unit tests; use fewer, more expensive end-to-end/UI tests.
+  - High-level tests are valuable but can be slow/brittle; balance matters.
+- Microsoft Learn – Unit testing best practices for .NET: https://learn.microsoft.com/en-us/dotnet/core/testing/unit-testing-best-practices
+  - Good unit tests are fast, isolated, repeatable, self-checking, and readable.
+  - Coverage is a signal, not a goal; avoid chasing coverage without value.
+
+## 4) Database Schema/DDL Change Risk
+
+- PostgreSQL Documentation – ALTER TABLE: https://www.postgresql.org/docs/current/sql-altertable.html
+  - Many DDL variants require strong locks (often ACCESS EXCLUSIVE) unless stated otherwise.
+  - Multiple subcommands acquire the strictest lock required by any subcommand.
+- MySQL 8.0 Reference Manual – InnoDB and Online DDL: https://dev.mysql.com/doc/refman/8.0/en/innodb-online-ddl.html
+  - Online DDL supports INSTANT/INPLACE operations with concurrent DML in many cases.
+  - Use `ALGORITHM`/`LOCK` clauses as explicit safety rails; fail fast if the desired concurrency is unavailable.
+
+## 5) Frontend Accessibility & Real-User Performance
+
+- W3C Recommendation – WCAG 2.2: https://www.w3.org/TR/WCAG22/
+  - Accessibility guidance is structured as principles → guidelines → testable success criteria (A/AA/AAA).
+  - WCAG is technology-agnostic; use it as a baseline for UX/a11y review discussions.
+- GoogleChrome – web-vitals (Core Web Vitals metrics): https://github.com/GoogleChrome/web-vitals
+  - Core Web Vitals include CLS, INP, and LCP; additional metrics like FCP and TTFB support diagnosis.
+  - Measuring “real users” requires careful instrumentation; don’t double-register observers/listeners.
+