crewforth 3.1.0-rc.1 → 3.1.0-rc.2

package/CHANGELOG.md

@@ -80,8 +80,16 @@ versioning follows [SemVer](https://semver.org/).
   rules of its architecture guide, the rebuild cost model, layout by window size and never by device type, isolates,
   platform channels, generated localisations, the mix of unit, widget, integration and golden tests, measuring in
   profile mode on a real device, and a release without a secret in it. Its done-definition is `dart format
-  --set-exit-if-changed .`, `flutter analyze`, `flutter test` and the accessibility guideline test. Every rule was
-  checked against Flutter's and Dart's own documentation; the sources are in the skill's `references/`. 40 skills now.
+  --set-exit-if-changed .`, `flutter analyze`, `flutter test` and the accessibility guideline test. It also holds
+  what a real app taught it: panes that split at a foldable's hinge, a list and a detail whose selection and typed
+  input survive a change of window class, a widget test at one width of each window class, figures of one width for
+  amounts, case changed by the language's rules, no inline text (one central file is enough for one language), a
+  domain layer with no `package:flutter` import, goldens made in one pinned container, and a store build that
+  refuses the flag of a closed feature. For an app that holds sensitive data: an encrypted database, its key in the
+  platform's secure store, both kept out of backup and device transfer, every network call through a transport bound to its own allowed hosts,
+  and no ad in a window that shows a sensitive screen. The rules were checked against Flutter's, Dart's and the
+  named packages' and platforms' own pages; the sources, and what was not checked, are in the skill's `references/`.
+  40 skills now.
 - **In `auto` and `dontAsk`, your own message approves a commit or a push.** Those modes answer a permission prompt
   with software, so the commit gate fails closed there and the only way through was to switch mode for every commit.
   Now a message that is nothing but `approve: commit`, `approve: push` or `approve: commit+push` (`onay:` works too)

package/kit/eval/smoke-test.sh

@@ -9171,6 +9171,35 @@ if [ -n "$SGR" ] && [ -f "$SGR/.gitattributes" ] && [ -d "$SGR/packaging" ] && [
       [ "$(printf 'README.md\r\n' | bash "$CDO")" = docs ] || _cv="$_cv crlf"
       [ -z "$_cv" ] && pass "ci-docs-only.sh: documentation reads docs; a hook, evals/run.sh, kit/README.md, ci.yml or an empty diff reads code" \
                     || fail "ci-docs-only.sh gave the wrong verdict for:$_cv"
+      # The third answer, `text`: a pull request that changes only the text of skills, agents or commands skips the
+      # macOS and Windows jobs as a documentation one does, and still runs the Linux verify job. That list is pinned
+      # the same way, and every pattern must be a .md under one of the six text directories: `kit/*`, a script or
+      # kit/CLAUDE.md in it would let a gate change skip the platforms where it can break.
+      cdo_tpats(){ awk '/# TEXT-PATTERNS-START/{f=1;next} /# TEXT-PATTERNS-END/{f=0} f && /\) *return 0/ {sub(/^[[:space:]]*/,""); sub(/\).*/,""); print}' "$1"; }
+      cdo_tunsafe(){ while IFS= read -r _p; do case "$_p" in kit/skills/\*.md|kit/agents/\*.md|kit/commands/\*.md|plugin/skills/\*.md|plugin/agents/\*.md|plugin/commands/\*.md) ;; *) printf '%s\n' "$_p" ;; esac; done; }
+      _tp="$(cdo_tpats "$CDO" | tr '\n' ' ' | sed 's/ $//')"
+      _twant='kit/skills/*.md kit/agents/*.md kit/commands/*.md plugin/skills/*.md plugin/agents/*.md plugin/commands/*.md'
+      _ttu="$(printf '%s\n' 'kit/*' 'kit/hooks/*.md' 'kit/skills/*' 'kit/skills/*.md' | cdo_tunsafe | grep -c .)"
+      if [ "$_tp" != "$_twant" ]; then fail "the text-only list changed — it reads '$_tp', pinned '$_twant'. Widening it lets a change skip macOS and Windows; update this pin deliberately"
+      elif [ -n "$(cdo_tpats "$CDO" | cdo_tunsafe)" ]; then fail "a text-only pattern is not a .md under skills, agents or commands: $(cdo_tpats "$CDO" | cdo_tunsafe | tr '\n' ' ')"
+      elif [ "$_ttu" != 3 ]; then fail "the text-pattern check caught $_ttu of 3 planted patterns (kit/*, kit/hooks/*.md, kit/skills/*) — it reads nothing"
+      else pass "the text-only list is exactly the .md files of skills, agents and commands in kit/ and plugin/; 3 planted wider patterns are caught"; fi
+      _cv=""
+      [ "$(cdo kit/skills/x/SKILL.md plugin/skills/x/references/y.md)" = text ] || _cv="$_cv text-set"
+      [ "$(cdo kit/agents/a.md CHANGELOG.md README.md)" = text ]               || _cv="$_cv text+docs"
+      [ "$(cdo kit/skills/x/SKILL.md kit/hooks/guard-bash.sh)" = code ]        || _cv="$_cv text+hook"
+      [ "$(cdo kit/skills/x/scripts/run.sh)" = code ]                          || _cv="$_cv skill-script"
+      [ "$(cdo kit/skills/x/SKILL.md kit/CLAUDE.md)" = code ]                  || _cv="$_cv text+rulebook"
+      [ "$(cdo kit/skills/x/SKILL.md kit/hooks/trace-blocklist.txt)" = code ]  || _cv="$_cv text+blocklist"
+      [ "$(cdo README.md)" = docs ]                                            || _cv="$_cv docs-stays-docs"
+      [ -z "$_cv" ] && pass "ci-docs-only.sh: skill, agent and command text reads text, with documentation too; with a hook, a skill's script, kit/CLAUDE.md or a blocklist it reads code" \
+                    || fail "ci-docs-only.sh gave the wrong text verdict for:$_cv"
+      # The Linux verify job is gated on nothing: it holds the checks a text change can break.
+      _cyv="$(awk '/^  verify:$/{f=1;next} f && /^  [a-z-]+:$/{f=0} f' "$SGR/.github/workflows/ci.yml" | grep -cE '^    (if|needs):')"
+      _cyn="$(awk '/^  verify:$/{f=1;next} f && /^  [a-z-]+:$/{f=0} f' "$SGR/.github/workflows/ci.yml" | grep -c 'bash packaging/verify.sh')"
+      [ "$_cyv" = 0 ] && [ "$_cyn" -ge 1 ] \
+        && pass "ci.yml runs the Linux verify job on every pull request, a text-only one included (no if:, no needs:)" \
+        || fail "ci.yml's verify job is conditional ($_cyv if:/needs: line(s)) or was not found ($_cyn verify.sh call(s)): a text-only pull request would skip the budget, pointer, routing and plugin checks"
       # ...and ci.yml really uses it: both cross-platform jobs are gated on its answer, nothing else is.
       _cy="$SGR/.github/workflows/ci.yml"
       _gated="$(grep -c "if: needs.changes.outputs.scope == 'code'" "$_cy")"

package/kit/skills/frontend-flutter/SKILL.md

@@ -13,8 +13,8 @@ Otherwise do not use this skill: `frontend` and the project's own stack apply (s
 Trigger phrases: "riverpod", "go_router", "pubspec", "widget test", "analysis_options", "flutter_test", "golden test", "platform channel", "dart isolate", "gen-l10n"
 
 For generic frontend discipline, applies the `frontend` skill; this file only covers what Flutter adds. Every rule
-below was checked against Flutter's own documentation (docs.flutter.dev, dart.dev); the depth and the sources are in
-`references/`. Not used in a project on another stack (delete it if needed).
+below was checked against Flutter's own documentation (docs.flutter.dev, dart.dev) or the page of the package or
+platform it names; the depth and the sources are in `references/`, which also say what was not checked. Not used in a project on another stack (delete it if needed).
 
 ## The project decides, not this file
 - **Read before you write:** `pubspec.yaml` (the packages already chosen), `analysis_options.yaml` (the lint set and
@@ -31,7 +31,8 @@ below was checked against Flutter's own documentation (docs.flutter.dev, dart.de
   an abstract class, so tests can use a fake. **No logic in widgets** — a widget renders state and forwards events.
 - **Unidirectional data flow** and **immutable models**; a model that crosses a layer is not mutated in place.
 - **Dependencies are injected** into view models and repositories, not looked up from inside them. A domain layer
-  only when the logic needs one (the guide marks it conditional).
+  only when the logic needs one (the guide marks it conditional). **Where there is one it is plain Dart: no file in
+  it imports `package:flutter`**, and an architecture test reads its files and fails on such an import.
 - Feature folders (`features/<name>/`) with view, view model and tests together, as `frontend` says.
 
 ## Widgets and rebuilds — the cost model
@@ -48,6 +49,11 @@ below was checked against Flutter's own documentation (docs.flutter.dev, dart.de
   and desktop). Measure with **`MediaQuery.sizeOf`** (the whole window; cheaper than `MediaQuery.of`) or
   **`LayoutBuilder`** (the space this widget is given). Breakpoints come from the project's design system; the
   Material window classes are compact < 600 · medium 600–839 · expanded 840–1199 · large 1200–1599 · ≥ 1600 dp.
+- **List and detail:** two panes side by side in an expanded window, a push to the detail in a compact one. **What
+  the user selected and what they typed survive a change of window class** (a fold, a rotation, a resized window):
+  that state lives above the two layouts, not inside either.
+- **A foldable:** when `MediaQuery.displayFeatures` holds a hinge that separates the window, the panes split at the
+  hinge and no content is laid out on it.
 - **Do not lock orientation** — it is an accessibility problem. Keep scroll position across a layout change
   (`PageStorageKey`), and support mouse, trackpad and keyboard where the app runs on desktop or a large screen.
 - Accessibility: tap targets 48×48 (Android) / 44×44 (iOS), every tappable labelled, text contrast checked, the UI
@@ -66,23 +72,45 @@ below was checked against Flutter's own documentation (docs.flutter.dev, dart.de
 ## Navigation, text, data
 - Navigation: the project's router. Named routes are not recommended by Flutter (no custom deep-link handling, no
   browser forward button); a page-backed route is deep-linkable, a pageless one is not.
-- User-facing text goes through `gen-l10n` (ARB files, `AppLocalizations.of(context)`), plurals and placeholders in
-  ICU form — never concatenated. The `i18n-integrity` skill checks the files.
+- **No user-facing text is written inline in a widget, in any app.** An app in more than one language uses
+  `gen-l10n` (ARB files, `AppLocalizations.of(context)`), plurals and placeholders in ICU form — never concatenated;
+  the `i18n-integrity` skill checks the files. An app in one language may keep every text in one central file instead.
+- **Changing case follows the language.** Dart's `toUpperCase()` / `toLowerCase()` use the language-independent
+  mapping (Turkish `i` becomes `I`, not `İ`), so text is cased through one helper that takes the locale.
 - Money is never a `double`; dates carry their time zone or are date-only on purpose (the `frontend` rules apply).
+  **Amounts and other numbers that line up are drawn with `FontFeature.tabularFigures()`**, so digits keep one width.
 
 ## Tests (the `testing` skill owns the strategy)
 - Many **unit** and **widget** tests (`flutter_test`), and enough **integration** tests (`integration_test/`, the
   binding initialised) for the important flows. Tests use fakes of the repositories and services (the guide's
   recommendation), which is why those sit behind abstract classes.
-- **Golden tests** (`matchesGoldenFile`) only where pixels are the contract; generated and compared on the same
-  platform with fonts loaded first (`flutter test --update-goldens` refreshes them).
-- Every new screen gets a widget test at the narrowest and widest window the app supports, and the a11y guideline test.
+- **Golden tests** (`matchesGoldenFile`) only where pixels are the contract, fonts loaded first. **They are generated
+  and compared in one place, a pinned container in CI**; `flutter test --update-goldens` is not run on a developer's
+  machine, whose rendering differs.
+- **Every new screen reached from the app's navigation gets a widget test at one width of each window class** the
+  app supports (for example 320, 360, 700 and 1280 dp), **and a test that crosses a class boundary and finds the
+  selection and the typed input still there.** Plus the a11y guideline test.
+
+## If the app holds sensitive data (apply only then)
+Financial, health or identity data, or anything the user would not want read off a lost phone or a backup:
+- **The local database is encrypted**, and its **key lives in the platform's secure store** (Keychain, Keystore),
+  never in the database's own directory, in preferences or in the code.
+- **The database and the key's files are kept out of the operating system's backup and device transfer**, on both
+  platforms.
+- **Every network call goes through a transport bound to its own allowed host or hosts.** A call that leaves that
+  list is refused: it throws before anything is sent, and a test makes such a call and expects the throw. One
+  transport for the whole app or one per service are both this rule; a call made outside any transport is not.
+- **In an app that shows ads, no ad is drawn in a window where a sensitive screen is visible** — in a two-pane
+  layout that is the whole window, not the pane.
+How, and what was checked: **`references/sensitive-data.md`**.
 
 ## Performance and release
 - **Measure in profile mode on a real device** (`flutter run --profile`); debug mode is not indicative and profile
   mode does not run on an emulator or simulator. Frame budget: about 16 ms at 60 Hz, 8 ms at 120 Hz.
 - Release: `--obfuscate --split-debug-info=<dir>` where the target supports it, the symbols kept for `flutter
   symbolize`. Obfuscation is not encryption: **no secret ships in the app**. An app commits its `pubspec.lock`.
+- **A feature closed by a build flag stays closed in the store build:** the store build fails when it is handed
+  that flag, on Android and on iOS. Detail: **`references/platform-async-release.md`**.
 - Logging: `debugPrint` prints in release mode too unless it sits behind a debug check or an assert; log through the
   project's logger (the `observability` skill).
 
@@ -90,5 +118,7 @@ below was checked against Flutter's own documentation (docs.flutter.dev, dart.de
 - `dart format --set-exit-if-changed .` exits 0 · `flutter analyze` clean (0 issues, the project's lint set) ·
   `flutter test` green — one run after the last edit, reported with its exit code and counts.
 - No widget holds business logic; no device-type or orientation check decides a layout.
-- The a11y guideline test passes on every new screen; the narrowest and widest window are tested.
+- The a11y guideline test passes on every new screen; each window class the app supports is tested at one width,
+  and state survives a change of class.
+- No user-facing text inline; the domain layer (if any) imports no `package:flutter`.
 - Works across the project's target platform matrix (Android / iOS / web / desktop as declared).

package/kit/skills/frontend-flutter/references/adaptive-and-accessible.md

@@ -4,7 +4,8 @@ Checked against https://docs.flutter.dev/ui/adaptive-responsive/general,
 https://docs.flutter.dev/ui/adaptive-responsive/best-practices,
 https://docs.flutter.dev/ui/accessibility-and-internationalization/accessibility,
 https://docs.flutter.dev/ui/accessibility/accessibility-testing and the Material window size classes as Android's
-documentation states them (2026-10-02).
+documentation states them (2026-10-02); the foldable part against
+https://api.flutter.dev/flutter/widgets/MediaQueryData/displayFeatures.html (2026-10-07).
 
 ## The three steps
 1. **Abstract** the widgets that change with the space, and the data they share.
@@ -32,6 +33,23 @@ documentation states them (2026-10-02).
 - A list that keeps its layout across a rotation keeps its scroll position: `PageStorageKey`.
 - Mouse, trackpad and keyboard shortcuts work where the app runs on desktop or a large screen.
 
+## List and detail
+- Expanded and wider: the list and the detail are two panes of one screen. Compact: the list is the screen and the
+  detail is pushed over it. Medium is the design system's call.
+- **The selection and any typed input are kept across a change of window class.** Hold them above the two layouts
+  (the view model, or state owned by the widget that chooses the layout), so that going from two panes to one shows
+  the detail that was selected, with the form as it was, and going back does not clear it. A `GlobalKey` or a
+  `PageStorageKey` keeps a subtree's state only while its place in the tree allows it; state that must survive is
+  not left to that.
+
+## A foldable
+- `MediaQuery.displayFeatures` (and `MediaQueryData.displayFeatures`) lists the areas of the display that hardware
+  obstructs. The documentation says it is populated on Android only. A **hinge** and a **cutout** obstruct the
+  display; a **fold** is a crease and does not. A hinge and a fold carry a state that tells the device's posture.
+- When a hinge separates the window into two areas, **the panes split at the hinge**: one pane on each side, and
+  nothing — no text, no control, no divider the user must touch — laid out on the hinge's bounds.
+- A window with no such feature, or with a fold that obstructs nothing, is laid out by its width alone.
+
 ## Accessibility, tested
 Rules (the `a11y` skill holds them for every stack): tap targets at least 48×48 on Android and 44×44 on iOS; a
 label on every tappable; text contrast at least 4.5:1 (3:1 for large text, 18 pt and above); the UI legible and
@@ -51,5 +69,13 @@ testWidgets('meets the accessibility guidelines', (tester) async {
 });
 ```
 
-Run it for every new screen, and run the screen's widget test at the narrowest and widest window the app supports
-(`tester.view.physicalSize` and `devicePixelRatio`, reset afterwards).
+Run it for every new screen.
+
+## Widths, tested
+- Every new screen reached from the app's navigation has a widget test at **one width of each window class the app
+  supports**, for example 320 and 360 dp (compact, a small and a common phone), 700 dp (medium) and 1280 dp (large).
+  Set the size with `tester.view.physicalSize` and `devicePixelRatio`, and reset both afterwards.
+- One test **crosses a class boundary**: select an item and type into a form at one width, change the width to
+  another class, and expect the same selection and the same input.
+- The narrowest and the widest window alone are not enough: a layout can be right at both ends and wrong in a class
+  between them.

package/kit/skills/frontend-flutter/references/platform-async-release.md

@@ -33,6 +33,15 @@ https://dart.dev/tools/dart-format and https://dart.dev/tools/pub/private-files
   the browser's forward button does not work with them.
 
 ## Text and locales
+- No user-facing text is written inline. An app in more than one language uses `gen-l10n` (below). An app in one
+  language may keep every text in one central file of constants instead: one place to read, review and later move
+  to ARB files.
+- `String.toUpperCase()` "uses the language independent Unicode mapping and thus only works in some languages"
+  (api.dart.dev, 2026-10-07), and `toLowerCase()` likewise: under them Turkish `i` gives `I` and `I` gives `i`,
+  where the language has `İ` and `ı`. Text is cased by one helper of the project that takes the locale and handles
+  the letters its languages need; nothing calls the two methods on user-facing text directly.
+- `FontFeature.tabularFigures()` (`TextStyle.fontFeatures`) asks the font for figures of one width, so amounts in a
+  column line up and a changing number does not shift the text beside it. It does nothing in a font without them.
 - `flutter_localizations` and `intl` in `pubspec.yaml`, `generate: true` under `flutter:`, an `l10n.yaml` with
   `arb-dir`, `template-arb-file`, `output-localization-file`. `flutter gen-l10n` (or `flutter pub get` / `run`)
   generates `AppLocalizations`.
@@ -47,6 +56,9 @@ https://dart.dev/tools/dart-format and https://dart.dev/tools/pub/private-files
 - Golden files: `matchesGoldenFile('goldens/x.png')`, refreshed with `flutter test --update-goldens`. The default
   test font (Ahem) draws boxes; custom fonts render differently across platforms and Flutter versions, so goldens are
   produced and compared on one platform, with fonts loaded first (`flutter_test_config.dart`).
+- One place, in practice: a container image pinned by digest, with the Flutter version pinned, in CI. A golden that
+  changed is regenerated there (a CI job that uploads the new files, or the same image run by hand) and reviewed as
+  an image diff. `--update-goldens` on a developer's own machine produces files CI then fails.
 
 ## Release
 - `flutter build <target> --obfuscate --split-debug-info=<dir>` on the targets that support it (Android, iOS, macOS,
@@ -57,3 +69,32 @@ https://dart.dev/tools/dart-format and https://dart.dev/tools/pub/private-files
 - An application commits `pubspec.lock` (a library package does not): transitive upgrades become visible changes.
 - `dart format` rewrites files by default; in CI and in the DoD use `dart format --set-exit-if-changed .` (exit 1
   when anything would change). The line width is the project's `formatter` setting in `analysis_options.yaml`.
+
+## A feature closed by a build flag
+A feature that must not reach the store yet (it waits for a review, a consent text, a legal check) is closed in code
+by a compile-time flag: `const bool.fromEnvironment('NAME')`, set with `--dart-define=NAME=true`. The compiler drops
+the closed branch. That keeps it out of an ordinary build; it does not keep it out of a store build that someone
+runs with the flag. **The store build itself refuses the flag**, in the build system of each platform, before
+anything is compiled:
+
+- **Android (Gradle):** a task the release bundle depends on reads the project properties the Flutter Gradle plugin
+  is handed — `dart-defines` and `extra-front-end-options` — and fails the build when a closed flag is among them.
+- **iOS (Xcode):** a Run Script build phase, placed first in the app target, reads the build settings `DART_DEFINES`
+  and `EXTRA_FRONT_END_OPTIONS` and fails a release archive the same way (a line that starts with `error:` shows
+  among Xcode's build errors).
+
+The ways round a check that only looks for `NAME=true`, each of which the check closes:
+- **The defines are encoded.** They arrive as one value: entries separated by commas, each the base64 of
+  `NAME=value`. The check decodes every entry; an entry it cannot decode fails the build.
+- **Any value sets it.** The flag's name fails the build whatever follows the `=`, and so does the name anywhere
+  inside another entry.
+- **The front end's own options.** A define can be passed to the Dart front end directly (`-DNAME=…`), and other
+  options replace what is compiled. A store build is given no front-end options at all; one that is, fails.
+- **Only the store artifact is checked** — the release app bundle and the release archive. A debug or profile
+  build, and a release build for one's own device, may carry the flag.
+- A test in the project pins the check: it runs it with the flag, with the flag encoded, with a front-end option,
+  and with none, and expects three failures and one pass.
+
+Not from Flutter's documentation: the property and setting names above are what the Flutter tool hands to Gradle
+and Xcode, read from a project that does this. They are not a documented contract, so the project's test also fails
+when a Flutter upgrade renames them, instead of the check passing because it reads nothing.

package/kit/skills/frontend-flutter/references/sensitive-data.md

@@ -0,0 +1,54 @@
+# An app that holds sensitive data (Flutter)
+
+Apply only when the app stores data its user would not want read off a lost phone, a backup or the network:
+financial, health, identity. Checked against https://pub.dev/packages/sqlite3 and its hook documentation,
+https://pub.dev/packages/sqlcipher_flutter_libs and https://developer.android.com/identity/data/autobackup
+(2026-10-07). The iOS part is from Apple's API names and was **not checked against a fetched page**.
+
+## The database is encrypted
+- The project's database package decides how; the rule is that the file on disk is ciphertext.
+- With `package:sqlite3` 3.x the SQLite build is chosen by a build hook, in the `pubspec.yaml` at the workspace root:
+
+  ```yaml
+  hooks:
+    user_defines:
+      sqlite3:
+        source: sqlcipher   # or sqlite3mc; the default is sqlite3, which does not encrypt
+  ```
+
+- `sqlcipher_flutter_libs` belongs to version 2.x of `package:sqlite3`; its own page says "Not used anymore, update
+  to version 3.x of package:sqlite3 instead". Do not add it to a project on 3.x.
+- A test opens the database file without the key and expects the open to fail: an encryption that was configured
+  and silently not applied looks the same from the app.
+
+## The key is in the platform's secure store
+- Generated on the device, kept in the Keychain (iOS) or behind the Keystore (Android) through the project's
+  secure-storage package. Not in the database's directory, not in shared preferences, not in the code or its assets.
+- A key that is lost makes the data unreadable. Decide and write down what the app does then (an `adr`).
+
+## Out of backup and device transfer
+The database and the secure store's own files are excluded on both platforms; a restored copy without its key is
+unreadable at best, and a copy with its key is the data on another device.
+
+- **Android.** `android:allowBackup="false"` on `<application>`. For an app that targets Android 12 (API 31) or
+  higher that turns off cloud backup but, in the documentation's words, "doesn't disable device-to-device transfers"
+  on some manufacturers' devices. So also `android:dataExtractionRules` pointing at an XML file whose
+  `<cloud-backup>` and `<device-transfer>` sections each exclude the database and the secure-storage files. Devices
+  on Android 11 or lower read `android:fullBackupContent` instead.
+- **iOS.** The files carry the resource value `isExcludedFromBackup` (`NSURLIsExcludedFromBackupKey`), set from
+  native code or a plugin after the file exists. Set it again when the file is created anew.
+- A test (or a check in CI) reads the manifest and the rules file and fails when either attribute is missing.
+
+## Every network call through a transport bound to its allowed hosts
+- A transport is the one object a service's requests leave through. Each holds the host or hosts **it** may talk
+  to and **refuses any other**: it throws before the request is sent. An app with one backend has one transport;
+  an app that talks to several services gives each its own, with its own list, so a transport for one service
+  cannot reach another's host.
+- A test asks each transport for a host that is not on its list and expects the throw. An architecture test fails
+  on a network call made outside a transport (a client constructed or a socket opened anywhere else). In a debug
+  run the throw is a crash someone sees; it is never swallowed.
+
+## Ads
+In an app that shows ads, **no ad is drawn in a window where a sensitive screen is visible.** In a two-pane layout
+the detail pane may be the sensitive one while the list is not: the rule is about the window, so the list's ad goes
+too. A widget test at an expanded width expects no ad widget while the sensitive detail is shown.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewforth",
-  "version": "3.1.0-rc.1",
+  "version": "3.1.0-rc.2",
   "description": "Crewforth — your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"