mustflow 2.103.22 → 2.103.32

package/templates/default/locales/en/.mustflow/skills/hono-code-change/SKILL.md

@@ -2,11 +2,11 @@
 mustflow_doc: skill.hono-code-change
 locale: en
 canonical: true
-revision: 1
+revision: 2
 lifecycle: mustflow-owned
 authority: procedure
 name: hono-code-change
-description: Apply this skill when Hono apps, routes, middleware, validators, RPC clients, bindings, context variables, auth boundaries, or runtime adapters are created or changed.
+description: Apply this skill when Hono apps, route chains, middleware order, validators, RPC or typed clients, OpenAPI schema generation, runtime bindings, context variables, auth, CORS, cookie, header, streaming, WebSocket, cache, static asset, or Cloudflare, Bun, Node, Deno, edge, or serverless adapter boundaries are created or changed.
 metadata:
   mustflow_schema: "1"
   mustflow_kind: procedure
@@ -28,26 +28,29 @@ metadata:
 <!-- mustflow-section: purpose -->
 ## Purpose
 
-Preserve Hono runtime, middleware, validation, context binding, auth, typed route, and response contract boundaries.
+Preserve Hono route registration, runtime adapter, middleware ordering, validation, context binding, auth, typed client, OpenAPI, streaming, cache, static asset, and response contract boundaries.
 
 <!-- mustflow-section: use-when -->
 ## Use When
 
-- `new Hono`, `app.get`, `app.post`, `app.use`, `c.env`, `c.get`, `c.set`, validators, RPC clients, middleware, adapters, or Hono route tests change.
-- The task touches Cloudflare Workers, Bun, Node, edge-compatible routes, bindings, variables, auth middleware, or response schemas.
+- `new Hono`, `app.route`, `basePath`, `app.get`, `app.post`, `app.use`, wildcard routes, fallback routes, `c.env`, `c.get`, `c.set`, `c.req.valid`, validators, RPC clients, middleware, adapters, or Hono route tests change.
+- The task touches Cloudflare Workers, Bun, Node, Deno, edge-compatible, serverless, SSR, static file, WebSocket, SSE, streaming, cache, cookie, CORS, CSRF, JWT, JWK, header, body-limit, binding, variable, auth middleware, OpenAPI, or response schema behavior.
+- The task exports or consumes `typeof app`, `typeof routes`, `AppType`, `hc`, `InferRequestType`, `InferResponseType`, `ApplyGlobalResponse`, OpenAPI clients, or generated SDKs from Hono routes.
 
 <!-- mustflow-section: do-not-use-when -->
 ## Do Not Use When
 
 - The task only touches framework-agnostic service code behind a Hono handler; use the relevant language or architecture skill.
 - Another HTTP framework is used instead of Hono.
+- The task only updates external framework version prose; use `source-freshness-check` unless the Hono procedure itself changes.
 
 <!-- mustflow-section: required-inputs -->
 ## Required Inputs
 
-- Package metadata, TypeScript config, runtime adapter config, worker or server entrypoint, routes, middleware, env/binding types, schemas, client types, and tests.
-- Target runtime matrix: Cloudflare, Bun, Node, edge-compatible, or single runtime.
-- Existing response envelope and error contract.
+- Package metadata, TypeScript config, runtime adapter config, worker or server entrypoint, route modules, middleware registration, env and binding types, context variables, schemas, validators, client type exports, OpenAPI generation, generated SDKs, and tests.
+- Target runtime matrix: Cloudflare Workers or Pages, Bun, Node with `@hono/node-server`, Deno, Lambda or other serverless adapter, edge-compatible, or single runtime.
+- Existing response envelope, status-code contract, error contract, CORS, cookie, header, cache, streaming, WebSocket, static file, body-size, and upload behavior.
+- Official or repository-local source evidence before preserving exact latest-version, patch-note, or adapter-behavior claims.
 
 <!-- mustflow-section: preconditions -->
 ## Preconditions
@@ -55,6 +58,7 @@ Preserve Hono runtime, middleware, validation, context binding, auth, typed rout
 - Confirm runtime before using platform APIs.
 - Identify `Bindings` for runtime-provided values and `Variables` for request-local middleware values.
 - Identify auth, validation, and error response boundaries before adding routes.
+- Refresh official package or vendor sources before preserving exact "latest", release-date, or security-patch claims; otherwise keep those facts out of the skill or mark them as snapshot-only in the report.
 
 <!-- mustflow-section: allowed-edits -->
 ## Allowed Edits
@@ -63,26 +67,33 @@ Preserve Hono runtime, middleware, validation, context binding, auth, typed rout
 - Register middleware in an order that preserves logging, CORS, security headers, body limits, auth, validation, and handler behavior.
 - Trust only validated request data in handlers.
 - Keep success and failure envelopes consistent.
+- Keep route type exports, RPC clients, OpenAPI documents, generated SDKs, tests, and docs synchronized when public API behavior changes.
 
 <!-- mustflow-section: procedure -->
 ## Procedure
 
-1. Read app entrypoint, runtime adapter, route modules, middleware, schemas, client type exports, and tests.
-2. Map the route boundary: method, path, runtime, auth, params, query, headers, cookies, body, variables, bindings, response statuses, and content types.
-3. Do not put Node-only, Bun-only, or Cloudflare-only APIs in shared routes.
-4. Keep auth middleware above protected routes and wildcard or fallback routes after specific routes.
-5. Separate `Bindings` from `Variables`; do not store request-local state in globals.
-6. Use validator output rather than rereading unvalidated request bodies.
-7. Preserve typed route or RPC inference by keeping handler responses in the framework's typed response path.
-8. Choose configured verification intents that cover type checks, route tests, auth failure, validation failure, and runtime env mocks when available.
+1. Read app entrypoint, runtime adapter, route modules, middleware, schemas, validator helpers, OpenAPI setup, client type exports, generated clients, and tests.
+2. Map the route boundary: method, path, registration order, runtime, auth, params, query, headers, cookies, body, variables, bindings, response statuses, content types, cache headers, streaming mode, and public client surface.
+3. Treat Hono route order as behavior. Keep specific routes before wildcard or fallback routes; check `route()`, `basePath()`, `mount`, optional params, regexp params, static routes, and fallback registration for shadowing or doubled prefixes.
+4. Keep auth, CORS, CSRF, secure headers, body limit, cookie, JWT, JWK, cache, ETag, compression, and logging middleware in an order that matches the security and observability boundary.
+5. For CORS with credentials, require an explicit origin allowlist or exact origin callback; do not rely on wildcard origin behavior or loose suffix checks.
+6. Separate `Bindings` from `Variables`; do not store request-local auth, user, session, tenant, or trace state in globals, module singletons, or runtime-wide mutable objects.
+7. Use `createMiddleware<{ Variables }>()` or route-local generics for context values that depend on middleware execution. Avoid `ContextVariableMap` unless the value is truly available for every request path.
+8. Use `c.req.valid(...)` output rather than rereading unvalidated request bodies. Remember that request bodies are one-shot, query and params are strings, header validator keys are lowercase, and `json` or `form` validators need the matching `Content-Type`.
+9. For multipart uploads, large JSON, webhooks, raw-body signatures, and file routes, check parser shape, body limits, runtime limits, storage limits, repeated-field behavior, and raw request cloning before changing handlers.
+10. Preserve typed route, RPC, and SDK inference by exporting the route chain actually used by `hc<AppType>()`, keeping handler responses on typed `c.json(payload, status)` paths, and avoiding broad `Context` handler extraction that drops path, validator, or response types.
+11. Keep runtime validation schema, OpenAPI schema, response schema, generated SDKs, and Hono RPC types from becoming separate truths. Choose one canonical contract and verify drift with tests or snapshots when available.
+12. Do not put Node-only, Bun-only, Cloudflare-only, Deno-only, Lambda-only, static-serving, connection-info, WebSocket, or filesystem APIs in shared route modules. Keep runtime entry files thin and pass plain config or adapter functions into shared app code.
+13. For streaming, SSE, WebSocket, cache, ETag, static file, and SSR or JSX routes, check cancellation, abort handling, backpressure, already-started-response errors, header retention, path traversal, cache key and `Vary`, repeated `Set-Cookie`, and adapter header normalization.
+14. Choose configured verification intents that cover type checks, route tests, auth failure, validation failure, CORS/cookie/header behavior, streaming or WebSocket behavior, OpenAPI or SDK generation, and runtime env mocks when available.
 
 <!-- mustflow-section: postconditions -->
 ## Postconditions
 
 - Runtime-specific APIs are isolated.
-- Middleware order and auth boundary are clear.
-- Request validation and response envelope are preserved.
-- Typed route or RPC contract impact is reported.
+- Middleware order, route order, and auth boundary are clear.
+- Request validation, body parsing, header/cookie/CORS/cache, and response envelope behavior are preserved.
+- Typed route, RPC, OpenAPI, generated SDK, and runtime adapter contract impact is reported.
 
 <!-- mustflow-section: verification -->
 ## Verification
@@ -96,21 +107,24 @@ Use configured oneshot command intents when available:
 - `docs_validate_fast`
 - `mustflow_check`
 
-Report missing multi-runtime or route-level verification intents when relevant.
+Report missing multi-runtime, route-level, streaming, WebSocket, OpenAPI, SDK, or adapter verification intents when relevant.
 
 <!-- mustflow-section: failure-handling -->
 ## Failure Handling
 
 - If runtime target is unclear, inspect adapter and deployment config before editing.
 - If a route needs a broader permission, binding, or auth change, switch to the relevant security or contract skill.
-- If typed route inference breaks, repair schema and response shape before adding more routes.
+- If typed route inference breaks, repair the route chain, validator, schema, and response shape before adding more routes.
+- If official source freshness cannot be checked for a version, release, or security-patch claim, omit the claim from durable skill text and report it as unverified snapshot context.
+- If streaming, WebSocket, cache, static, or adapter-specific behavior cannot be tested by configured intents, report the missing runtime smoke coverage.
 
 <!-- mustflow-section: output-format -->
 ## Output Format
 
 - Boundary checked
-- Runtime and middleware notes
-- Validation and response contract notes
+- Runtime, adapter, route-order, and middleware notes
+- Validation, RPC, OpenAPI, SDK, and response contract notes
+- CORS, cookie, header, cache, streaming, WebSocket, static, or SSR notes when touched
 - Files changed
 - Command intents run
 - Skipped checks and reasons

package/templates/default/locales/en/.mustflow/skills/routes.toml

@@ -528,6 +528,18 @@ route_type = "primary"
 priority = 85
 applies_to_reasons = ["code_change", "public_api_change", "test_change"]
 
+[routes."axum-code-change"]
+category = "general_code"
+route_type = "primary"
+priority = 85
+applies_to_reasons = ["code_change", "behavior_change", "public_api_change", "test_change", "docs_change", "performance_change", "security_change", "privacy_change", "data_change", "package_metadata_change", "release_risk"]
+
+[routes."godot-code-change"]
+category = "general_code"
+route_type = "primary"
+priority = 85
+applies_to_reasons = ["code_change", "behavior_change", "public_api_change", "test_change", "docs_change", "performance_change", "security_change", "privacy_change", "data_change", "ui_change", "package_metadata_change", "release_risk"]
+
 [routes."dart-code-change"]
 category = "general_code"
 route_type = "primary"
@@ -538,13 +550,13 @@ applies_to_reasons = ["code_change", "public_api_change", "test_change"]
 category = "general_code"
 route_type = "primary"
 priority = 85
-applies_to_reasons = ["code_change", "public_api_change", "security_change"]
+applies_to_reasons = ["code_change", "behavior_change", "public_api_change", "test_change", "docs_change", "performance_change", "security_change", "privacy_change", "package_metadata_change", "release_risk"]
 
 [routes."elysia-code-change"]
 category = "general_code"
 route_type = "primary"
 priority = 85
-applies_to_reasons = ["code_change", "public_api_change", "security_change"]
+applies_to_reasons = ["code_change", "behavior_change", "public_api_change", "test_change", "docs_change", "performance_change", "security_change", "privacy_change", "package_metadata_change", "release_risk"]
 
 [routes."source-anchor-authoring"]
 category = "general_code"
@@ -988,7 +1000,13 @@ applies_to_reasons = ["ui_change", "code_change", "public_api_change"]
 category = "ui_assets"
 route_type = "primary"
 priority = 85
-applies_to_reasons = ["ui_change", "docs_change", "code_change", "behavior_change", "migration_change", "package_metadata_change"]
+applies_to_reasons = ["ui_change", "docs_change", "code_change", "behavior_change", "public_api_change", "data_change", "security_change", "privacy_change", "performance_change", "test_change", "migration_change", "package_metadata_change", "release_risk"]
+
+[routes."babylon-code-change"]
+category = "ui_assets"
+route_type = "primary"
+priority = 85
+applies_to_reasons = ["ui_change", "code_change", "behavior_change", "public_api_change", "data_change", "security_change", "privacy_change", "performance_change", "test_change", "docs_change", "migration_change", "package_metadata_change", "release_risk"]
 
 [routes."react-code-change"]
 category = "ui_assets"
@@ -996,11 +1014,17 @@ route_type = "primary"
 priority = 85
 applies_to_reasons = ["ui_change", "code_change", "behavior_change", "public_api_change", "data_change", "security_change", "privacy_change", "performance_change", "test_change", "package_metadata_change", "release_risk"]
 
+[routes."vue-code-change"]
+category = "ui_assets"
+route_type = "primary"
+priority = 85
+applies_to_reasons = ["ui_change", "code_change", "behavior_change", "public_api_change", "data_change", "security_change", "privacy_change", "performance_change", "test_change", "package_metadata_change", "release_risk"]
+
 [routes."svelte-code-change"]
 category = "ui_assets"
 route_type = "primary"
 priority = 85
-applies_to_reasons = ["ui_change", "code_change", "behavior_change", "public_api_change", "data_change", "security_change", "privacy_change", "test_change", "package_metadata_change"]
+applies_to_reasons = ["ui_change", "code_change", "behavior_change", "public_api_change", "data_change", "security_change", "privacy_change", "performance_change", "test_change", "docs_change", "migration_change", "package_metadata_change", "release_risk"]
 
 [routes."pattern-scout"]
 category = "architecture_patterns"

package/templates/default/locales/en/.mustflow/skills/svelte-code-change/SKILL.md

@@ -2,11 +2,11 @@
 mustflow_doc: skill.svelte-code-change
 locale: en
 canonical: true
-revision: 2
+revision: 3
 lifecycle: mustflow-owned
 authority: procedure
 name: svelte-code-change
-description: Apply this skill when Svelte or SvelteKit components, routes, load functions, server actions, endpoints, stores, context, runes, SSR boundaries, server-only imports, accessibility warnings, or tests are created or changed.
+description: Apply this skill when Svelte or SvelteKit components, routes, universal or server load functions, form actions, endpoints, hooks, stores, context, runes, props, snippets, bindings, SSR, hydration, streaming, preload, invalidation, server-only imports, env boundaries, adapters, Vite, TypeScript, packaging, accessibility warnings, or tests are created or changed.
 metadata:
   mustflow_schema: "1"
   mustflow_kind: procedure
@@ -28,64 +28,78 @@ metadata:
 <!-- mustflow-section: purpose -->
 ## Purpose
 
-Preserve Svelte component reactivity, SvelteKit SSR/server/client boundaries, data secrecy, load/action/endpoint contracts, request-scoped state ownership, accessibility, and generated route behavior. Choose files by data boundary first, not by filename habit.
+Preserve Svelte component reactivity, SvelteKit SSR/server/client execution modes, data secrecy, load/action/endpoint contracts, request-scoped state ownership, hydration, streaming, invalidation, adapter output, accessibility, and generated route behavior. Choose files by data boundary and execution mode first, not by filename habit.
 
 <!-- mustflow-section: use-when -->
 ## Use When
 
-- `.svelte`, `+page`, `+layout`, `+page.server`, `+layout.server`, `+server`, load functions, form actions, endpoints, stores, context, runes, `$app` imports, `$lib/server`, hooks, route params, or Svelte tests change.
-- The task touches state management, SSR errors, browser APIs, forms, routing, progressive enhancement, request-local data, server-only imports, private/public environment variables, or Svelte 5 runes.
+- `.svelte`, `.svelte.ts`, `.svelte.js`, `+page`, `+layout`, `+page.server`, `+layout.server`, `+server`, load functions, form actions, endpoints, stores, context, snippets, bindings, runes, `$app` imports, `$lib/server`, hooks, route params, route matchers, or Svelte tests change.
+- The task touches state management, SSR errors, hydration warnings, browser APIs, forms, routing, progressive enhancement, preload, invalidation, request-local data, server-only imports, private/public environment variables, adapters, Vite, TypeScript, package exports, or Svelte 5 runes.
+- The task upgrades, reviews, or writes docs about Svelte, SvelteKit, Vite, `@sveltejs/vite-plugin-svelte`, `svelte-check`, an adapter, `@sveltejs/package`, or generated Svelte library output.
 
 <!-- mustflow-section: do-not-use-when -->
 ## Do Not Use When
 
 - The change is plain CSS or HTML with no Svelte or SvelteKit behavior; use the relevant UI foundation skill.
 - The service code is framework-free and no Svelte boundary changes.
+- The task only updates external framework version prose; use `source-freshness-check` unless the Svelte procedure itself changes.
 
 <!-- mustflow-section: required-inputs -->
 ## Required Inputs
 
-- Package metadata, Svelte config, Vite config, TypeScript config, route segment files, hooks, app types, stores/runes/context, form schema, and tests.
-- Svelte version, route data source, secrecy, request scope, mutation type, serialization requirement, SSR/client boundary, browser dependency, and state owner.
-- Imports from `$lib/server`, `*.server.*`, `$env/static/private`, `$env/dynamic/private`, DB/filesystem/server SDK modules, cookies, auth headers, and `event.locals`.
+- Package metadata, Svelte config, Vite config, TypeScript config, route segment files, hooks, app types, stores/runes/context, form schema, adapter config, package export metadata, and tests.
+- Svelte and SvelteKit version tracks, route data source, secrecy, request scope, mutation type, serialization requirement, SSR/client boundary, browser dependency, state owner, and adapter target.
+- Imports from `$lib/server`, `*.server.*`, `$env/static/private`, `$env/dynamic/private`, DB/filesystem/server SDK modules, cookies, auth headers, `event.locals`, `$app/state`, `$app/navigation`, `$app/forms`, and browser-only libraries.
+- Official or repository-local source evidence before preserving exact latest-version, release-date, Node/Vite requirement, adapter behavior, or compiler behavior claims.
 - Configured verification intents.
 
 <!-- mustflow-section: preconditions -->
 ## Preconditions
 
-- For route work, read the sibling `+layout`, `+page`, `+page.server`, and `+server` files as one boundary.
-- Classify every data access by origin, secrecy, request scope, mutation, browser dependency, and serialization before choosing a SvelteKit file.
-- Treat all route files as potentially server-executed until proven otherwise.
+- For route work, read sibling and parent `+layout`, `+layout.server`, `+page`, `+page.server`, `+server`, hooks, app types, and route matcher files as one boundary.
+- Classify every data access by origin, secrecy, request scope, mutation, browser dependency, serialization, invalidation dependency, and adapter support before choosing a SvelteKit file.
+- Treat universal route files as server-executed and browser-executed until proven otherwise.
+- Refresh official package or vendor sources before preserving exact "latest", Node/Vite minimum, adapter, or release-note claims; otherwise keep those facts out of durable skill text or mark them as snapshot-only in the report.
 
 <!-- mustflow-section: allowed-edits -->
 ## Allowed Edits
 
-- Keep secrets, private environment, database clients, and cookie-authenticated data in server-only files.
-- Use browser APIs only behind client-safe lifecycle or environment guards.
+- Keep secrets, private environment, database clients, server SDKs, cookie-authenticated data, and request identity in server-only files.
+- Use browser APIs only behind client-safe lifecycle, dynamic import, event, action, or environment boundaries.
 - Keep state local unless shared ownership is justified.
-- Preserve form actions and progressive enhancement instead of replacing all forms with client-only fetch.
+- Preserve form actions and progressive enhancement instead of replacing page forms with client-only fetch.
 - Use context for request-scoped component-tree sharing instead of module singletons.
-- Use `$derived` for computed display values and `$effect` only for browser-side effects and cleanup.
+- Use `$derived` for computed display values and `$effect` only for browser-side effects, subscriptions, DOM, timers, observers, third-party browser libraries, and cleanup.
+- Keep SvelteKit, Vite, TypeScript, adapter, `svelte-check`, and package export surfaces synchronized when toolchain behavior changes.
 
 <!-- mustflow-section: procedure -->
 ## Procedure
 
-1. Read route segment files, parent layouts, stores/runes/context, hooks, app types, and tests.
-2. Identify Svelte version and whether the code uses runes or legacy reactivity.
-3. Before choosing a file, classify every data access with: origin, secrecy, request scope, mutation, browser dependency, and serialization.
-4. If data requires DB, filesystem, private env, cookies, auth headers, `event.locals`, server SDKs, or request-local identity, keep it in server-only code: `+page.server`, `+layout.server`, `+server`, `hooks.server`, or `$lib/server`.
-5. If data is public and can be safely fetched by the browser without secrets, universal load is allowed.
-6. If the operation is a page form mutation, prefer `+page.server` actions over a custom JSON endpoint.
-7. If the operation is a public HTTP API, webhook, mobile API, stream, file response, or non-page endpoint, use `+server`.
-8. If the value is UI-only state such as modal open, selected tab, draft input, accordion state, hover state, or local editing state, keep it in component `$state` or local context.
-9. If a value is computed from reactive inputs, use `$derived`. Do not use `$effect` to copy or synchronize derived state.
-10. Use `$effect`, lifecycle hooks, event handlers, actions, or dynamic imports for browser-only APIs and browser-only libraries. Do not touch `window`, `document`, `localStorage`, `matchMedia`, canvas, or browser-only imports in SSR top-level code.
-11. Keep request-specific user/session/auth state out of module-level mutable variables, global stores, exported `$state`, and load/action side effects.
-12. Do not write to stores from load functions.
-13. Keep server load return values intentionally serializable and minimal. Do not pass secrets, raw sessions, tokens, hidden DB fields, or whole service responses to the browser.
-14. Prefer `$app/state` over legacy `$app/stores` in SvelteKit projects that use the newer SvelteKit state API.
-15. Do not hide SSR errors by disabling SSR unless the user explicitly accepts that product and architecture change.
-16. Treat accessibility compiler warnings as real findings unless a local false-positive reason is documented.
+1. Read route segment files, parent layouts, route matchers, stores/runes/context, hooks, app types, Svelte/Vite/TypeScript config, adapter config, package metadata, and tests.
+2. Identify Svelte and SvelteKit version tracks and whether the code uses runes, legacy reactivity, or mixed migration mode.
+3. Before choosing a file, classify every data access with: origin, secrecy, request scope, mutation, browser dependency, serialization, dependency tracking, invalidation trigger, and adapter support.
+4. Keep DB, filesystem, private env, cookies, auth headers, `event.locals`, server SDKs, and request-local identity in server-only code: `+page.server`, `+layout.server`, `+server`, `hooks.server`, `$lib/server`, or `*.server.*`.
+5. Treat `+page.ts` and `+layout.ts` as universal. They may run during SSR and later in the browser; do not import browser-only packages, private env, DB clients, or server modules there.
+6. If `+page.server` and universal `+page` or `+layout` coexist, check that server-load data is intentionally passed through the universal `load` return value when the page component needs it.
+7. Keep `load` side-effect-free. Do not increment counters, mark reads, mutate stores, write analytics, or change module state from `load`; preload and navigation can run it before the user commits.
+8. Avoid `await parent()` waterfalls. Start independent fetches before awaiting parent data, and keep auth checks in `hooks.server` or route-specific server load when child data must not execute first.
+9. Use SvelteKit-provided `fetch` inside load when dependency tracking, SSR response inlining, and hydration reuse matter. For custom clients, register `depends(...)` keys and invalidate the exact URL or dependency key.
+10. Use page form actions for page-owned mutations. Preserve `fail(...)`, `redirect(303, ...)`, `use:enhance`, `update()`, `applyAction()`, focus reset, and invalidation behavior when enhancing forms.
+11. Use `+server` for public HTTP APIs, webhooks, mobile APIs, streams, file responses, and custom response contracts. Do not create a JSON endpoint for a normal page form unless there is a non-page consumer.
+12. For streaming load data, finish auth, redirects, and headers before streaming starts. Handle promise rejections, check adapter and proxy buffering, and stream only data whose late failure does not change page policy.
+13. Preserve hydration markers and valid HTML structure. Do not use HTML minifiers, CDN rewrites, or edge transforms that remove Svelte hydration comments without verifying hydration.
+14. If navigation reuses page or layout components, make route-dependent values `$derived` from `data`, `$app/state`, or URL state; use `{#key ...}` only when a real remount boundary is intended.
+15. Put SSR-affecting filters, search, pagination, sorting, and shareable state in URL search params. Keep temporary UI state local or snapshot-like.
+16. Use `$state` only for state that should update UI, `$derived`, or `$effect`. Keep large immutable payloads, table rows, CMS payloads, parser outputs, and third-party data as plain values or `$state.raw` with reassignment.
+17. Do not destructure `$state` or proxy objects when live reactivity is required. Read fields at the use site or derive a narrow value.
+18. Use `SvelteMap`, `SvelteSet`, `SvelteDate`, `SvelteURL`, or reassignment patterns when reactive special objects are required; do not expect ordinary `Map`, `Set`, `Date`, `URL`, or class internals to be deeply tracked.
+19. Use `$derived` or `$derived.by` for filtering, sorting, totals, validation results, labels, and view models. Do not use `$effect` to copy or synchronize derived state.
+20. Keep `$effect` dependencies narrow and synchronous. Read dependencies before `await`, `setTimeout`, or callbacks; use `untrack` for incidental logging, snapshots, or non-dependency reads.
+21. Return cleanup from effects that create subscriptions, intervals, observers, sockets, editors, charts, canvas loops, or external library instances.
+22. Treat props as parent-owned. Use callback props for changes and `$bindable` only for narrow form-control-like two-way APIs. Preserve wrapper binding chains or convert them to explicit callbacks.
+23. In Svelte 5, treat DOM event handlers as props. When spreading rest props through wrappers, intentionally compose external handlers with internal policy instead of relying on spread order.
+24. Treat snippets as typed render callbacks. Require optional snippet guards, pass row or slot-like data as parameters, and avoid hidden parent-state capture in reusable library components.
+25. Check SvelteKit, Vite, TypeScript, adapter, and package output as one toolchain boundary. Do not edit generated `.svelte-kit/tsconfig.json`; fix `svelte.config`, `kit.alias`, package exports, `types`, `svelte` conditions, `files`, and CSS side effects at their source.
 
 <!-- mustflow-section: data-boundary-policy -->
 ## Data Boundary Policy
@@ -94,6 +108,7 @@ Preserve Svelte component reactivity, SvelteKit SSR/server/client boundaries, da
 - Public external APIs and public CMS data may live in universal load only when the browser may call them directly without secrets.
 - DB, filesystem, private env, server SDKs, cookies, auth headers, sessions, and `event.locals` belong in server-only files.
 - User-specific data must be read server-side and narrowed before being serialized into `data`.
+- Server load return values must be intentionally serializable and minimal.
 - Page forms should use form actions by default.
 - External clients, webhooks, mobile apps, streaming responses, and custom HTTP responses belong in `+server`.
 - Browser-only values belong in component effects, event handlers, dynamic imports, or browser actions.
@@ -105,18 +120,22 @@ Preserve Svelte component reactivity, SvelteKit SSR/server/client boundaries, da
 - `+page.server.ts` and `+layout.server.ts` are for server-only page data.
 - `+page.server.ts` actions are for page-owned form mutations.
 - `+server.ts` is for HTTP endpoints, webhooks, non-page APIs, streams, files, and custom responses.
+- Route matchers, optional params, rest params, and route groups are public URL and layout/auth behavior, not only folder naming.
 - Do not create a JSON endpoint for a normal page form unless there is a non-page consumer.
 - Do not wrap server-only imports in browser guards. Fix the import graph.
 
 <!-- mustflow-section: runes-state-policy -->
 ## Runes And State Policy
 
-- Use `$state` for local interactive UI state.
-- Use `$derived` for calculations from props, route data, page state, or local state.
-- Use `$effect` only for browser-side effects, subscriptions, DOM, canvas, analytics, third-party browser libraries, and cleanup.
+- Use `$state` for owned interactive UI state.
+- Use `$state.raw` only when reassignment, not internal mutation, is the update model.
+- Use `$state.snapshot` before sending proxy state to serializers, workers, chart libraries, equality tools, or external APIs that should see plain data.
+- Use `$derived` for calculations from props, route data, page state, URL state, or local state.
+- Use `$effect` only for browser-side effects, subscriptions, DOM, canvas, analytics, timers, third-party browser libraries, and cleanup.
 - Use stores for external streams or manual subscribe/unsubscribe interop, not ordinary component state.
 - Use context for parent-owned values shared down the component tree, especially request-scoped layout data.
 - Do not reassign reactive context objects after placing them in context; update their properties or pass getter functions when needed.
+- Use stable keys for changing lists. Do not use array indexes as keys when rows can reorder, insert, delete, transition, or own child state.
 
 <!-- mustflow-section: ssr-debug-policy -->
 ## SSR Debug Policy
@@ -127,7 +146,7 @@ When SSR breaks, inspect in this order:
 2. `$lib/server`, `*.server.*`, DB, filesystem, admin SDK, or server-only import chains.
 3. Request-local state stored in module singletons, stores, or exported `$state`.
 4. Browser API access at module top-level or during SSR render.
-5. Hydration mismatch from time, randomness, locale, timezone, localStorage, or browser-only initial state.
+5. Hydration mismatch from invalid HTML, removed comments, time, randomness, locale, timezone, localStorage, or browser-only initial state.
 6. Route-level SSR disabling only after the product accepts an SPA-like shell.
 
 <!-- mustflow-section: hard-bans -->
@@ -137,18 +156,21 @@ When SSR breaks, inspect in this order:
 - Do not move required first-render page data into lifecycle hooks or `$effect`.
 - Do not import `$lib/server`, `*.server.*`, private env modules, DB clients, filesystem, or admin SDKs from universal/client route files or shared client utilities.
 - Do not mutate module-scope variables, global stores, or exported `$state` with user/session/request data during SSR, load, or actions.
-- Do not use `$effect` to compute derived values.
+- Do not use `$effect` to compute derived values or synchronize state mirrors.
 - Do not put browser-only library imports at top level when the package touches browser globals during import.
 - Do not serialize secrets, raw sessions, access tokens, hidden DB fields, or whole service responses through load data.
+- Do not edit generated `.svelte-kit` files as source.
 
 <!-- mustflow-section: postconditions -->
 ## Postconditions
 
 - Server/client and SSR boundaries are explicit.
-- State owner and derived/effect behavior are clear.
+- Route, load, action, endpoint, invalidation, and streaming behavior are clear.
+- State owner, derived/effect behavior, props ownership, snippets, and binding behavior are clear.
 - Forms remain progressive unless intentionally changed.
 - Private data stays server-only and serialized data is intentionally minimal.
 - Request-scoped sharing uses load data, props, or context instead of module singletons.
+- Adapter, Vite, TypeScript, and package output impacts are reported when touched.
 - Accessibility warnings are resolved or justified.
 
 <!-- mustflow-section: verification -->
@@ -163,7 +185,7 @@ Use configured oneshot command intents when available:
 - `docs_validate_fast`
 - `mustflow_check`
 
-Report missing Svelte check, SSR render, form action, or browser verification intents when relevant.
+Report missing Svelte check, SSR render, hydration, form action, browser, adapter, package, or preview-mode verification intents when relevant.
 
 <!-- mustflow-section: failure-handling -->
 ## Failure Handling
@@ -173,13 +195,16 @@ Report missing Svelte check, SSR render, form action, or browser verification in
 - If accessibility warnings require an ignore, include the specific reason in the code or report.
 - If server-only imports leak into universal/client files, move the boundary instead of adding runtime guards.
 - If request-local data is stored globally, move it to server load, actions, context, or persistent storage with user scoping.
+- If exact framework, adapter, Vite, Node, or release claims cannot be refreshed from official sources, omit them from durable skill text and report them as unverified snapshot context.
+- If streaming, hydration, adapter output, package exports, or preview-mode behavior cannot be verified by configured intents, report the missing runtime smoke coverage.
 
 <!-- mustflow-section: output-format -->
 ## Output Format
 
 - Boundary checked
-- SSR/server/client and state notes
-- Form/action/accessibility impact
+- SSR/server/client, route, load, action, invalidation, and streaming notes
+- Runes, state, props, snippet, binding, and accessibility notes
+- Adapter, Vite, TypeScript, and package-output notes when touched
 - Files changed
 - Command intents run
 - Skipped checks and reasons