lazycodex-ai 5.1.61 → 5.1.63

package/packages/shared-skills/skills/lsp-setup/references/python/README.md

@@ -21,13 +21,13 @@ command -v basedpyright-langserver
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "basedpyright": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 
@@ -36,27 +36,28 @@ or `[tool.basedpyright]` in `pyproject.toml`, not the LSP config.
 
 ## Choosing a server
 
-All four are builtin. Type checkers and the linter serve different roles — run a
-type server, and optionally `ruff` ALONGSIDE it (not instead).
+All four are builtin. The engine starts ONE server per extension: the first
+installed candidate after ordering by config source (project > user > builtin)
+and then `priority`. So `ruff` cannot run alongside a type server for `.py` —
+choosing it replaces type checking with lint/format diagnostics.
 
 | id            | command                       | install                | role                                    |
 | ------------- | ----------------------------- | ---------------------- | --------------------------------------- |
 | `basedpyright`| `basedpyright-langserver --stdio` | `pip install basedpyright` | strictest types, **default**       |
 | `pyright`     | `pyright-langserver --stdio`  | `pip install pyright`  | upstream Microsoft type checker         |
 | `ty`          | `ty server`                   | `pip install ty`       | Astral, very fast, pre-1.0/experimental |
-| `ruff`        | `ruff server`                 | `pip install ruff`     | lint + format only, complements a type server |
+| `ruff`        | `ruff server`                 | `pip install ruff`     | lint + format only, no type checking    |
 
-Recommended priority: **basedpyright** (default) > pyright > ty (experimental).
-`ruff` complements via priority — it does not type-check, so keep a type server
-enabled.
+Recommended: **basedpyright** (default) > pyright > ty (experimental). Keep a
+type server as the `.py` server; run `ruff` from the shell or a pre-commit hook
+for lint/format.
 
-Enable ruff alongside basedpyright, disabling pyright:
+Switch this project to pyright:
 
 ```json
 { "lsp": {
-  "basedpyright": { "priority": 100 },
-  "ruff": { "priority": 90 },
-  "pyright": { "disabled": true }
+  "pyright": { "priority": 100 },
+  "basedpyright": { "disabled": true }
 } }
 ```
 

package/packages/shared-skills/skills/lsp-setup/references/ruby/README.md

@@ -22,13 +22,13 @@ command -v rubocop
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "ruby-lsp": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/rust/README.md

@@ -22,13 +22,13 @@ command -v rust-analyzer
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "rust": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/swift/README.md

@@ -1,7 +1,7 @@
 # Swift — LSP setup
 
 - **Builtin server:** `sourcekit-lsp` — `sourcekit-lsp`
-- **Extensions:** `.swift .objc .objcpp`
+- **Extensions:** `.swift .m .mm`
 - **Install hint:** `Included with Xcode or the Swift toolchain`
 
 ## Install
@@ -20,13 +20,13 @@ command -v sourcekit-lsp
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "sourcekit-lsp": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 
@@ -41,7 +41,7 @@ None commonly required. For best results the project needs a **SwiftPM `Package.
 - **PATH:** `sourcekit-lsp` on PATH; reopen shell after install (or after `xcode-select -s`).
 - **Wrong toolchain (macOS):** point `xcode-select` at the right Xcode/toolchain; mismatches cause stale or missing results.
 - **No `Package.swift` / compile db:** add a SwiftPM manifest or generate `compile_commands.json` for accurate indexing.
-- **Objective-C (`.objc`/`.objcpp`):** needs a compilation database to resolve headers and frameworks.
+- **Objective-C (`.m`/`.mm`):** needs a compilation database to resolve headers and frameworks.
 - **First build slow:** the server builds the module graph on first open; wait for it.
 
 ## Verify

package/packages/shared-skills/skills/lsp-setup/references/terraform/README.md

@@ -23,13 +23,13 @@ command -v terraform
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "terraform": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/typescript/README.md

@@ -22,13 +22,13 @@ command -v typescript-language-server
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "typescript": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 
@@ -67,7 +67,7 @@ Pick Deno or Biome over the default:
 (Swap `"deno"` for `"biome"` to use Biome instead.)
 
 ## Troubleshooting
-- **PATH:** `typescript-language-server` must be on PATH; reopen shell after `npm i -g`. Check your global bin with `npm bin -g`.
+- **PATH:** `typescript-language-server` must be on PATH; reopen shell after `npm i -g`. Your global bin is `$(npm prefix -g)/bin` (Windows: `npm prefix -g`); make sure it is on PATH.
 - **Missing tsserver:** errors like "Could not find tsserver" mean the `typescript` package is absent — install it globally or in the project.
 
 ## Verify

package/packages/shared-skills/skills/lsp-setup/references/yaml/README.md

@@ -18,13 +18,13 @@ command -v yaml-language-server
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "yaml-ls": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/references/zig/README.md

@@ -21,13 +21,13 @@ command -v zls
 
 ## Configure
 
-Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in `.codex/lsp-client.json` (Codex) AND `.opencode/lsp.json` (OpenCode/omo):
+Builtin — usually NO config needed (auto-resolved by extension). Configure only to set priority, init options, override extensions, or disable. Same JSON shape in every harness's project config (per-harness paths: the Configure step in `SKILL.md`):
 
 ```json
 { "lsp": { "zls": { "priority": 100 } } }
 ```
 
-For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled`/`env`. A fully custom (non-builtin) server with its own `command` must go in the USER config (`~/.codex/lsp-client.json`).
+For builtin ids in a PROJECT config, `command` is supplied automatically — only set `priority`/`initialization`/`extensions`/`disabled` (a project entry drops `env`). `env`, and a fully custom (non-builtin) server with its own `command`, must go in your harness's USER config (see the Configure step in `SKILL.md`).
 
 ### Initialization options (only if commonly needed)
 

package/packages/shared-skills/skills/lsp-setup/scripts/detect-lsp.ts

@@ -182,7 +182,7 @@ function renderReport(root: string, results: readonly DetectionResult[], configS
 		missing.length === 0
 			? `All ${results.length} detected server(s) installed.`
 			: `${missing.length}/${results.length} server(s) NOT installed: ${missing.map((m) => m.server.language).join(", ")}`,
-		"Next: read references/<language>/README.md, then configure .codex/lsp-client.json AND .opencode/lsp.json.",
+		"Next: read references/<language>/README.md, then configure your harness's project config (SKILL.md, Configure step).",
 	)
 	return lines.join("\n")
 }

package/packages/shared-skills/skills/lsp-setup/scripts/lsp-server-table.ts

@@ -58,7 +58,7 @@ export const LANGUAGES: readonly LanguageServer[] = [
 	{
 		language: "kotlin",
 		serverId: "kotlin-ls",
-		command: ["kotlin-lsp"],
+		command: ["kotlin-lsp", "--stdio"],
 		extensions: [".kt", ".kts"],
 		installHint: "https://github.com/Kotlin/kotlin-lsp",
 	},
@@ -80,7 +80,7 @@ export const LANGUAGES: readonly LanguageServer[] = [
 		language: "swift",
 		serverId: "sourcekit-lsp",
 		command: ["sourcekit-lsp"],
-		extensions: [".swift", ".objc", ".objcpp"],
+		extensions: [".swift", ".m", ".mm"],
 		installHint: "Included with Xcode (xcode-select --install) or the Swift toolchain",
 	},
 	{
@@ -174,4 +174,5 @@ export const PROJECT_CONFIG_FILES: readonly string[] = [
 	".opencode/lsp.json",
 	".omo/lsp.json",
 	".omo/lsp-client.json",
+	".pi/lsp-client.json",
 ] as const

package/packages/shared-skills/skills/programming/SKILL.md

@@ -78,7 +78,7 @@ Apply unless the per-language reference overrides with something stricter.
 | Exhaustive variant matching | `match` + `assert_never` | `match` (compiler-enforced) | `switch` + `assertNever` | sealed interface + type switch + **`exhaustive` linter** (the compiler will not help) |
 | No untyped escape hatches | no `Any` in public sigs, no `cast`, no `# type: ignore` | no `unwrap`/`expect` outside tests (invariant `expect` only behind `#[expect(clippy::expect_used, reason)]`), no numeric `as`, no `#[allow]` (silence with `#[expect(lint, reason)]`) | no `any`, no `as` (except `as const`, `satisfies`), no `!`, no `@ts-ignore`, no `@ts-expect-error` | no `interface{}` / bare `any` in domain sigs; no `_ = err`; no `//nolint` without reason |
 | No bare error strings | typed exception dataclass with `__str__` | `thiserror` enum (lib) or `anyhow` with `.context(...)` (app) | `Error` subclass with typed fields | sentinel `errors.New` + typed `*XError` struct; wrap with `%w`; check via `errors.Is/As` |
-| Boundary catch only | catch the exact exception you expect; broad `except Exception` only in `main()`, with logging + re-raise | `?` everywhere; never `panic!` in library code | `catch` must narrow with `instanceof` and re-throw or convert; no empty catch | every `(T, error)` checked; `panic` only in `main`/tests; one `httperr.Write` funnel in handlers |
+| Boundary catch only | catch the exact exception you expect; broad `except Exception` only at a top-level boundary (`main()`/CLI entry, HTTP handler), with logging + re-raise | `?` everywhere; never `panic!` in library code | `catch` must narrow with `instanceof` and re-throw or convert; no empty catch | every `(T, error)` checked; `panic` only in `main`/tests; one `httperr.Write` funnel in handlers |
 | Resources via RAII | `with` (sync) / `async with` (async) | `Drop` impl or RAII guard | `using`/`await using` (TC39 explicit resource management) | `defer x.Close()` immediately after acquisition; `bodyclose`/`sqlclosecheck` linters enforce |
 | Async runtime is mandatory | `anyio` (NEVER bare `asyncio`) | `tokio` (`async-std` is unmaintained) | platform-native async (Bun/Node) with structured cancellation via `AbortSignal` | `context.Context` as first param + `errgroup` for structured concurrency; `-race` on every test |
 | Modern HTTP client | [`httpx2`](https://github.com/pydantic/httpx2) with HTTP/2 + brotli + zstd | `reqwest` with rustls | `ky` (default) / `undici` direct API (Node perf) - NEVER bare `fetch` in prod | stdlib `net/http.Client` with tuned `Transport` + `go-retryablehttp` for retry/backoff |
@@ -140,13 +140,13 @@ Full rationale, measurement methods, workaround detection, and split examples: *
 
 A source file past 250 non-blank, non-comment lines has outgrown a single reviewer's working memory. The module is almost certainly doing more than one thing. Measure: `awk '!/^[[:space:]]*$/ && !/^[[:space:]]*(\/\/|#|--)/' <file> | wc -l`.
 
-**When detected:** Name what the file owns in one short noun phrase. If the answer needs "and", the file needs splitting. Load `/refactor` and split by responsibility. If the file genuinely cannot be split (generated parser, indivisible state machine), mark with `// allow: SIZE_OK — <reason>`.
+**When detected:** Name what the file owns in one short noun phrase. If the answer needs "and", the file needs splitting. Load `/refactor` and split by responsibility. If the file genuinely cannot be split (generated parser, indivisible state machine), mark it in the first 10 lines with `# noqa: SIZE_OK — <reason>` in Python (the form `scripts/python/check-no-excuse-rules.py` reads) or `// allow: SIZE_OK — <reason>` in `//`-comment languages.
 
 ### Smell 2 — Function with more than 3 parameters
 
 More than 3 arguments signals the function is doing too much, or that related parameters belong in a typed struct. **Workarounds count as the same smell** — passing `dict`/`Record<string, unknown>`/`map[string]any`/`**kwargs`/`...args` to smuggle parameters through one argument, or a throwaway "config" object with 6+ fields that exists solely to wrap what would otherwise be positional args (genuine reusable domain types like `HttpClientConfig` are fine).
 
-**When detected:** Group related parameters into a typed value object with a domain name. If 4+ independent inputs are genuinely required, the justification must be SPECIFIC. See [`references/code-smells.md` Smell 2](references/code-smells.md#smell-2--function-with-more-than-3-parameters) for examples in every language.
+**When detected:** Group related parameters into a typed value object with a domain name. If 4+ independent inputs are genuinely required, the justification must be SPECIFIC. See [`references/code-smells.md` Smell 2](references/code-smells.md#smell-2--function-with-more-than-3-parameters) for Python, TypeScript, and Go examples.
 
 ### Smell 3 — Redundant verification after a destructive action
 
@@ -242,9 +242,9 @@ These two skills are not optional cosmetics. They are the recovery path for the
 
 | Trigger | Skill to load | Why |
 |---|---|---|
-| Any [code smell](#code-smells--automatic-review-triggers) fires (250+ LOC, >3 params, redundant verification), OR the post-write loop surfaces 2+ issues, OR the user says "reshape this", "extract this", "clean this up" | `refactor` | Safe codemap-driven multi-step refactor with LSP + tests after each step. Never improvise a structural change. |
+| Any [code smell](#code-smells--automatic-review-triggers) fires (250+ LOC, >3 params, redundant verification, negative naming), OR the post-write loop surfaces more than two issues, OR the user says "reshape this", "extract this", "clean this up" | `refactor` | Safe codemap-driven multi-step refactor with LSP + tests after each step. Never improvise a structural change. |
 | Recent branch contains AI-authored patterns (broad except, dead helpers, vague comments, oversized files, redundant post-action verification, junk tests), OR the user says "remove slop", "clean AI code", "deslop" | `remove-ai-slops` | Behavior locked by gate-passing tests FIRST, then categorized parallel cleanup (junk tests included, each cut proven by a mutation), then quality gates. Behavior-preserving. |
-| Rust code touches `unsafe`, `*mut`, `*const`, `MaybeUninit`, FFI, `unsafe impl Send/Sync`, or a custom lock-free primitive | `references/rust-ub/` | Full UB taxonomy + Miri strictness escalation. Every `unsafe` block must survive Miri Level 3 (strict provenance + symbolic alignment + preemption) before it ships. |
+| Rust code touches `unsafe`, `*mut`, `*const`, `MaybeUninit`, FFI, `unsafe impl Send/Sync`, or a custom lock-free primitive | `references/rust-ub/` | Full UB taxonomy + Miri strictness escalation. Every `unsafe` block must survive Miri Level 3 (strict provenance + symbolic alignment + preemption) and the Level 4 Tree Borrows pass before it ships. |
 
 ---
 

package/packages/shared-skills/skills/programming/references/code-smells.md

@@ -48,10 +48,10 @@ cloc --by-file <file>   # the "code" column is the number
 
 A file may legitimately exceed 250 pure LOC if **and only if** it is:
 
-- A truly indivisible single-responsibility unit (e.g., a generated parser table, a state machine whose states share a single closure). Mark with `// allow: SIZE_OK — <reason>`.
+- A truly indivisible single-responsibility unit (e.g., a generated parser table, a state machine whose states share a single closure). Mark it in the first 10 lines with `# noqa: SIZE_OK — <reason>` in Python (the form `scripts/python/check-no-excuse-rules.py` reads) or `// allow: SIZE_OK — <reason>` in `//`-comment languages.
 - A pure data table (translation strings, error code lookup, brand color palette).
 
-`// allow: SIZE_OK` without a justifying comment is itself slop.
+A SIZE_OK marker without a justifying comment is itself slop.
 
 ### Concrete split examples
 

package/packages/shared-skills/skills/programming/references/go/README.md

@@ -66,9 +66,9 @@ Read these per-file references for the canonical patterns:
 - **HTTP backend** → `backend-stack.md` — `gin` server skeleton, middleware ordering, SSE/streaming with `http.Flusher`, structured slog logging, graceful shutdown — distilled from the CLIProxyAPI codebase (a real proxy serving OpenAI/Gemini/Claude APIs).
 - **RPC** → `grpc-connect.md` — when to pick Connect vs grpc-go, codegen pipeline, protovalidate, streaming.
 - **DB** → `sqlc-pgx.md` — compile-time-safe SQL via sqlc + pgx connection pool + migrations via goose + testcontainers in CI.
-- **CLI** → `cobra-stack.md` — cobra layout, slog integration, graceful shutdown on signals, fang-style colored help.
+- **CLI** → `cobra-stack.md` — cobra layout, slog integration, graceful shutdown on signals, shell completions, `huh` prompts styled with `lipgloss`.
 - **TUI** → `bubbletea-v2.md` — v2 model, `SetVirtualCursor(false)` + `tea.View{Cursor}` for CJK IME, why v1 was broken for Korean/Japanese/Chinese input.
-- **Testing** → `testing.md` — table-driven tests, `require` vs `assert`, `autogold` snapshots, `gopter` property tests, `testcontainers` for integration, `goleak` for goroutine leaks.
+- **Testing** → `testing.md` — table-driven tests, `require` vs `assert`, `autogold` snapshots, `rapid` property tests, `testcontainers` for integration, `goleak` for goroutine leaks.
 - **Bootstrap** → `bootstrap.md` — `scripts/go/new-project.ts` invocation, project layout (`cmd/`, `internal/`, `pkg/`), Taskfile, CI.
 - **Strict config** → `golangci-strict.md` — the canonical `.golangci.yml` with the full linter whitelist and per-linter rationale.
 - **One-liners** → `one-liners.md` — `go run` scripts with `//go:build ignore`, `gorun`-style invocation.
@@ -81,7 +81,7 @@ The `cmd/server/main.go` is the most common violator. Refactor it: `main.go` onl
 
 ## Existing codebases — non-strict project
 
-When editing an existing `.go` file that doesn't follow these rules: **write new code in strict style, don't refactor existing code in the same change.** Use the `remove-ai-slops` skill for branch-scope cleanup.
+When editing an existing `.go` file that doesn't follow these rules: **write new code in strict style, don't refactor existing code in the same change.** The one exception is the 250 pure-LOC ceiling: if your edit adds lines to a file already over it, split the unit you are touching into its own file first (see [`../code-smells.md`](../code-smells.md) Smell 1); everything else waits for a separate change. Use the `remove-ai-slops` skill for branch-scope cleanup.
 
 ## Activation
 

package/packages/shared-skills/skills/programming/references/python/README.md

@@ -41,7 +41,7 @@ These are deliberate project choices. Violations are always wrong, not "style pr
 11. **No Any, no object** — both are banned as type annotations. `object` erases all structural information (zero callable attributes, zero narrowing). Use `Protocol` (structural typing), `TypeVar` (generic pass-through), explicit union (known variants), or `TypedDict` (dict shapes).
 12. **No cast** — `cast()` is banned. Redesign the types.
 13. **No type: ignore** — fix the type error. The checker is right; you are wrong.
-14. **No broad except** — `except Exception` and `except BaseException` are banned. Catch the **specific** exception you expect. A broad catch swallows bugs you need to see — `KeyError`, `AttributeError`, `TypeError` all vanish silently. If you genuinely need a catch-all at a top-level boundary (CLI entry, HTTP handler), use `# noqa: BROAD_EXCEPT_OK` and log + re-raise.
+14. **No broad except** — `except Exception` and `except BaseException` are banned. Catch the **specific** exception you expect. A broad catch swallows bugs you need to see — `KeyError`, `AttributeError`, `TypeError` all vanish silently. If you genuinely need a catch-all at a top-level boundary (CLI entry, HTTP handler), put `# noqa: BROAD_EXCEPT_OK` on the `except` line and log + re-raise.
 
 ### Typing and safety
 
@@ -147,19 +147,19 @@ except Exception:
 # GOOD — catch what you expect
 try:
     result = api.fetch(url)
-except httpx.HTTPStatusError as e:
+except httpx2.HTTPStatusError as e:
     logger.error("API %d: %s", e.response.status_code, e.request.url)
     return None
-except httpx.ConnectError:
+except httpx2.ConnectError:
     raise ServiceUnavailableError(service="api") from None
 
-# GOOD — top-level boundary (only place broad catch is acceptable)
-def main() -> int:  # noqa: BROAD_EXCEPT_OK
+# GOOD — top-level boundary (CLI entry or HTTP handler: the only places a broad catch is acceptable)
+def main() -> int:
     try:
         return run()
-    except Exception:
+    except Exception:  # noqa: BROAD_EXCEPT_OK
         logger.exception("unhandled error")
-        return 1
+        raise
 ```
 
 ### Async
@@ -307,7 +307,7 @@ Tests still follow the iron list — frozen dataclasses, typed errors, exhaustiv
 
 ## Existing codebases
 
-When editing an existing file that doesn't follow these rules: **write new code in strict style, don't refactor existing code in the same change.** Mixing feature work with style migration makes reviews harder and bugs likelier.
+When editing an existing file that doesn't follow these rules: **write new code in strict style, don't refactor existing code in the same change.** The one exception is the 250 pure-LOC ceiling: if your edit adds lines to a file already over it, split the unit you are touching into its own file first (see [`../code-smells.md`](../code-smells.md) Smell 1); everything else waits for a separate change. Mixing feature work with style migration makes reviews harder and bugs likelier.
 
 ## Activation
 

package/packages/shared-skills/skills/programming/references/python/data-processing.md

@@ -10,16 +10,16 @@ NEVER pandas. Polars (with numpy) plus DuckDB. Pandas is 10-50x slower, has weak
 |---|---|---|
 | `.csv` / `.parquet` / `.json` direct query | DuckDB | Zero memory load, SQL ergonomics |
 | `.duckdb` file | DuckDB | Native format |
-| Filter (any size) | Polars | 128x faster than DuckDB for filtering |
-| Sort | Polars | 12x faster |
-| Multi-table join | DuckDB | 3x faster, more join types |
-| Heavy GROUP BY aggregation | DuckDB | 4x faster on large datasets |
-| Window function | Polars | 3-5x faster |
-| Pivot / melt / string ops | Polars | 2x faster |
+| Filter (any size) | Polars | row-wise filtering, low setup cost |
+| Sort | Polars | in-memory sorting |
+| Multi-table join | DuckDB | more join types, out-of-core joins |
+| Heavy GROUP BY aggregation | DuckDB | large grouped aggregation |
+| Window function | Polars | window expressions |
+| Pivot / melt / string ops | Polars | reshape and string expressions |
 | Larger than RAM | Polars streaming or DuckDB out-of-core | Both handle OOM |
 | Mixed pipeline | Hybrid (zero-copy via Arrow) | Use each tool's strengths |
 
-For the deep version (per-operation benchmarks, OOM strategies, full execution templates), load the **`data-scientist`** skill - it lives in this same skill set and is the source of truth for performance numbers.
+For the deep version (engine choice, placement, OOM strategies, execution templates), load the **`data-scientist`** skill - it lives in this same skill set; when the engine choice matters, measure on the actual data, as that skill says.
 
 ## Standard imports
 
@@ -69,7 +69,7 @@ result = (
         pl.len().alias("count"),
         pl.sum("amount").alias("total"),
     ])
-    .collect(streaming=True)
+    .collect(engine="streaming")
 )
 ```
 
@@ -84,7 +84,7 @@ joined = duckdb.sql("""
     JOIN 'products.parquet'  p ON o.product_id  = p.id
 """).pl()
 
-# Phase 2: Polars for filtering and transformation (128x + 2x faster)
+# Phase 2: Polars for filtering and transformation
 processed = (
     joined
     .filter(pl.col("amount") > 100)

package/packages/shared-skills/skills/programming/references/python/libraries.md

@@ -52,7 +52,7 @@ Next-generation HTTP client under Pydantic stewardship. Sync and async in one li
 
 **Install**: `httpx2[http2,brotli,zstd]` — always include all three extras, no exceptions.
 
-**A bare `httpx2.AsyncClient()` / `httpx2.Client()` is a bug.** Always use the factory pattern from `references/httpx2-optimization.md` with ALL optimizations enabled by default:
+**A bare `httpx2.AsyncClient()` / `httpx2.Client()` is a bug.** Always use the factory pattern from `references/python/httpx2-optimization.md` with ALL optimizations enabled by default:
 
 ```python
 import socket
@@ -78,7 +78,7 @@ with httpx2.Client(transport=transport, timeout=_TIMEOUT, follow_redirects=True)
     users = response.json()
 ```
 
-See `references/httpx2-optimization.md` for the full factory functions (`create_client()` / `create_async_client()`), event hooks, and the rationale behind every setting. **Load that reference whenever you write ANY network code.**
+See `references/python/httpx2-optimization.md` for the full factory functions (`create_client()` / `create_async_client()`), event hooks, and the rationale behind every setting. **Load that reference whenever you write ANY network code.**
 
 ## JSON — stdlib `json` (default) or `orjson` (hot paths)
 
@@ -98,7 +98,7 @@ raw: bytes = orjson.dumps(
 
 For FastAPI: `app = FastAPI(default_response_class=ORJSONResponse)`. Pydantic-typed responses bypass it (and that's correct — Pydantic's path is faster). Raw `dict`/`list` returns go through orjson.
 
-See `references/orjson-stack.md` for the full decision tree, option flag reference, FastAPI integration, Redis/queue/logging patterns, and the `model_dump_json()` vs orjson benchmark.
+See `references/python/orjson-stack.md` for the full decision tree, option flag reference, FastAPI integration, Redis/queue/logging patterns, and the `model_dump_json()` vs orjson benchmark.
 
 ## Validation — pydantic v2
 

package/packages/shared-skills/skills/programming/references/python/one-liners.md

@@ -258,7 +258,7 @@ if __name__ == "__main__":
 | `python -m venv .venv && ...` | `uv run --script` handles it |
 | Script without usage comment | Always include the "How to run" block |
 | `import asyncio; asyncio.run(main())` | `import anyio; anyio.run(main)` |
-| Bare `httpx2.AsyncClient()` | Full production defaults (see `references/httpx2-optimization.md`) |
+| Bare `httpx2.AsyncClient()` | Full production defaults (see `references/python/httpx2-optimization.md`) |
 
 ## Sources
 

package/packages/shared-skills/skills/programming/references/python/pyproject-strict.md

@@ -209,7 +209,7 @@ A single `make ci` target combining the four works fine.
 
 ## Enforcement summary
 
-The config above, combined with `scripts/check-no-excuse-rules.py`, enforces:
+The config above, combined with `scripts/python/check-no-excuse-rules.py`, enforces:
 
 | What | How |
 |---|---|

package/packages/shared-skills/skills/programming/references/rust/libraries.md

@@ -321,7 +321,7 @@ let player: WorldPoint  = Point2D::new(3.5, 1.2);
 // let mistake = cursor + player; // compile error: different coordinate spaces
 ```
 
-Generalize the pattern to your own domains (see `references/type-state.md`).
+Generalize the pattern to your own domains (see `references/rust/type-state.md`).
 
 ## Property tests — `proptest`
 
@@ -380,7 +380,7 @@ Run with `cargo bench`. HTML reports under `target/criterion/`. Pair with `cargo
 
 ## Concurrency model — `loom`
 
-For lock-free or atomic-heavy code (channels, refcounts, hazard pointers). See `references/concurrency.md` for the full pattern.
+For lock-free or atomic-heavy code (channels, refcounts, hazard pointers). See `references/rust/concurrency.md` for the full pattern.
 
 ## Arena allocator — `bumpalo`
 

package/packages/shared-skills/skills/programming/references/rust-ub/README.md

@@ -98,7 +98,7 @@ MIRIFLAGS="\
 **Interpret results:**
 - Fails at Level 1 → Definite UB. Fix immediately.
 - Passes Level 1, fails Level 2 → Provenance or alignment UB. Fix.
-- Passes Levels 1-3, fails Level 4 → Tree Borrows found something Stacked Borrows missed (unusual). Investigate — may be a Tree Borrows false positive, but usually indicates fragile aliasing.
+- Passes Levels 1-3, fails Level 4 → Tree Borrows found something Stacked Borrows missed (unusual). Investigate — may be a Tree Borrows false positive, but usually indicates fragile aliasing. It does not ship until the aliasing is fixed or the false positive is proven and recorded with the Miri output.
 - Passes all 4 → Miri-clean. Proceed to supplementary tools.
 
 ### Phase 3: Supplementary Scans
@@ -159,11 +159,11 @@ Is there unsafe code in the changeset?
   │       NO  → Run Miri Level 2 (strict provenance).
   │             Miri fails?
   │               YES → Stop. Classify. Fix. Prove. Then continue.
-  │               NO  → Proceed with the original task.
+  │               NO  → Proceed with the original task; run Levels 3 and 4 before it ships.
   NO → Proceed normally.
 ```
 
-This is not optional. **Every `unsafe` block gets Miri'd before it ships.**
+This is not optional. **Every `unsafe` block passes Miri Levels 3 and 4 before it ships.**
 
 ## SAFETY Comment Standard
 

package/packages/shared-skills/skills/programming/references/typescript/README.md

@@ -16,7 +16,7 @@ These are deliberate project choices. Violations are always wrong, not "style pr
 | Category | Use | Never |
 |---|---|---|
 | Runtime | Bun (native TS, single binary) | ts-node, tsx |
-| Package manager | `pnpm` | npm, yarn (unless workspace requires it) |
+| Package manager | Bun (`bun install`); `pnpm` only when Node is forced | npm, yarn (unless workspace requires it) |
 | Linter + formatter | **oxlint + oxfmt**, with both local copy rules | New ESLint, Prettier, or Biome setups; retain them only in repositories already using them |
 | Type checker | `tsc --noEmit` with strict config | skip type checking |
 | Web framework | Hono | Express |
@@ -39,7 +39,7 @@ These are deliberate project choices. Violations are always wrong, not "style pr
 11. **as const for constants** — module-level constant objects and arrays use `as const`.
 12. **import type** — type-only imports use `import type`. Enforced by `verbatimModuleSyntax`.
 13. **Named exports only** — no `export default`. Exception: framework requirement (Next.js pages, etc.).
-14. **No empty catch, no catch-and-swallow** — every `catch` block must either (a) narrow the error with `instanceof` and handle each case, or (b) re-throw. Empty catch blocks and `catch (e) { console.error(e) }` without narrowing or re-throw are banned — they hide bugs. At top-level boundaries (CLI entry, HTTP handler), opt out with `// no-excuse-ok: catch`.
+14. **No empty catch, no catch-and-swallow** — every `catch` block must either (a) narrow the error with `instanceof` and handle each case, or (b) re-throw. Empty catch blocks and `catch (e) { console.error(e) }` without narrowing or re-throw are banned — they hide bugs. At top-level boundaries (CLI entry, HTTP handler), opt out with `// no-excuse-ok: catch` on the `catch` line.
 
 ### Data modeling — which construct, when
 
@@ -91,10 +91,10 @@ try {
 }
 
 // GOOD — top-level boundary (only place catch-all is acceptable)
-async function main(): Promise<void> {  // no-excuse-ok: catch
+async function main(): Promise<void> {
   try {
     await run()
-  } catch (e) {
+  } catch (e) {  // no-excuse-ok: catch
     console.error("unhandled:", e)
     process.exit(1)
   }
@@ -190,7 +190,7 @@ Tests still follow the iron list — branded types, typed errors, exhaustive swi
 
 ## Existing codebases
 
-When editing an existing file that doesn't follow these rules: **write new code in strict style, don't refactor existing code in the same change.**
+When editing an existing file that doesn't follow these rules: **write new code in strict style, don't refactor existing code in the same change.** The one exception is the 250 pure-LOC ceiling: if your edit adds lines to a file already over it, split the unit you are touching into its own file first (see [`../code-smells.md`](../code-smells.md) Smell 1); everything else waits for a separate change.
 
 ## Activation
 

package/packages/shared-skills/skills/programming/scripts/typescript/new-project.ts

@@ -77,7 +77,7 @@ const pkg = {
   },
   dependencies: {
     hono: "^4.12.5",
-    zod: "^3.24.0",
+    zod: "^4.0.0",
   },
   devDependencies: {
     "@types/bun": "latest",