mustflow 2.115.11 → 2.115.14

package/README.md

@@ -302,7 +302,7 @@ mf run mustflow_update_apply
 | `mf script-pack list` | List bundled script packs, script refs, routing hints, side-effect flags, input/output labels, and JSON schema files. |
 | `mf script-pack suggest --changed --json` | Rank optional read-only helpers for current changed files without running those helpers or granting command authority. |
 | `mf script-pack suggest --path <path> --phase before_change` | Rank helpers for an explicit path and workflow phase before deciding which script to run. |
-| `mf script-pack run code/outline scan <path...> --json` | Scan supported source files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
+| `mf script-pack run code/outline scan <path...> --json` | Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
 | `mf script-pack run code/dependency-graph scan <path...> --json` | Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files. |
 | `mf script-pack run code/module-boundary check <path...> --json` | Check configured module-boundary import rules, import cycles, public entrypoints, feature imports, and shared budgets. |
 | `mf script-pack run code/change-impact analyze --base HEAD --json` | Analyze changed files and return bounded impact candidates, script-pack hints, and verification intent hints. |
@@ -482,7 +482,7 @@ mf run release_npm_publish
 mf run release_npm_published_verify
 ```
 
-The Bun scripts remain available for human maintainers and release packaging. `test_fast` runs the fast CLI regression baseline, `test_related` selects tests from changed files and falls back to the fast baseline, and both use 8 Node test workers by default. Set `MUSTFLOW_TEST_CONCURRENCY=1`, `2`, or another positive integer to tune those workers on local machines. `test_release` keeps package metadata and packaging checks out of routine local edits. `test_coverage` runs the fast CLI baseline through Node's built-in coverage report with no enforced threshold; set `MUSTFLOW_TEST_COVERAGE_CONCURRENCY=1`, `2`, or another positive integer to adjust its worker count. `lint` and test-audit are configured as narrow repository-local gates. `docs_validate_fast` checks documentation navigation and localized content links without building the entire static site; `docs_validate` performs the full static documentation build, search index, and sitemap gate for release-sensitive changes.
+The Bun scripts remain available for human maintainers and release packaging. `test_fast` runs the fast CLI regression baseline, `test_related` selects tests from changed files and falls back to the fast baseline, and both use 8 Node test workers by default. Skill-body changes select only their owning authoring shard plus the lightweight install-surface contract, and `test_skill_contracts` exposes that seconds-scale contract path directly. Set `MUSTFLOW_TEST_CONCURRENCY=1`, `2`, or another positive integer to tune those workers on local machines. `test_release` keeps package metadata and packaging checks out of routine local edits. `test_coverage` runs the fast CLI baseline through Node's built-in coverage report with no enforced threshold; set `MUSTFLOW_TEST_COVERAGE_CONCURRENCY=1`, `2`, or another positive integer to adjust its worker count. `lint` and test-audit are configured as narrow repository-local gates. `docs_validate_fast` checks documentation navigation and localized content links without building the entire static site; `docs_validate` performs the full static documentation build, search index, and sitemap gate for release-sensitive changes.
 
 `dist/` is a generated build output and is not committed. `npm pack` and `npm publish` run `npm run build` via `prepack`, so the npm package contains the built CLI.
 

package/dist/cli/i18n/en.js

@@ -797,7 +797,7 @@ Read these files before working:
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ Read these files before working:
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ Read these files before working:
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/es.js

@@ -797,7 +797,7 @@ Lee estos archivos antes de trabajar:
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ Lee estos archivos antes de trabajar:
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ Lee estos archivos antes de trabajar:
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/fr.js

@@ -797,7 +797,7 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ Lisez ces fichiers avant de travailler :
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/hi.js

@@ -797,7 +797,7 @@ export const hiMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ export const hiMessages = {
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ export const hiMessages = {
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/ko.js

@@ -797,7 +797,7 @@ export const koMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "TypeScript와 JavaScript 파일에서 symbol header와 라인 범위를 스캔합니다",
+    "scriptPack.script.codeOutline.summary": "TypeScript, JavaScript, Astro, Svelte, Go, Rust, Python 파일에서 symbol header와 라인 범위를 스캔합니다",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ export const koMessages = {
     "scriptPack.error.unknownScript": "알 수 없는 script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "추천 입력을 하나 이상 제공하세요: --path <path>, --changed, --phase <phase>, 또는 --skill <skill>",
     "scriptPack.error.unknownPhase": "알 수 없는 script-pack phase: {phase}",
-    "codeOutline.help.summary": "TypeScript와 JavaScript 소스 파일에서 declaration header, 라인 범위, export flag, content hash를 스캔합니다.",
+    "codeOutline.help.summary": "TypeScript, JavaScript, Astro, Svelte, Go, Rust, Python 소스 파일에서 declaration header, 라인 범위, export flag, content hash를 스캔합니다.",
     "codeOutline.help.option.maxFiles": "스캔할 최대 소스 파일 수입니다. 기본값: 200",
     "codeOutline.help.option.maxFileBytes": "각 소스 파일에서 읽을 최대 바이트입니다. 기본값: 1048576",
     "codeOutline.help.exit.ok": "code outline을 finding 없이 스캔했습니다",
@@ -842,7 +842,7 @@ export const koMessages = {
     "codeOutline.error.missingPath": "스캔할 소스 파일이나 디렉터리를 하나 이상 제공하세요",
     "codeOutline.error.invalidPositiveInteger": "{option}은 양의 safe integer여야 합니다: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option}은 0 이상의 safe integer여야 합니다: {value}",
-    "codeSymbolRead.help.summary": "source anchor, symbol 라인, 또는 명시 라인 범위에서 제한된 TypeScript 또는 JavaScript source snippet을 읽습니다.",
+    "codeSymbolRead.help.summary": "source anchor, symbol 라인, 또는 명시 라인 범위에서 지원되는 소스의 제한된 snippet을 읽습니다.",
     "codeSymbolRead.help.option.anchor": "target symbol로 해석할 source anchor id입니다",
     "codeSymbolRead.help.option.startLine": "symbol 또는 범위로 해석할 1-based source line입니다",
     "codeSymbolRead.help.option.endLine": "선택적 1-based end line입니다. 생략하면 포함하는 outline symbol을 읽습니다",

package/dist/cli/i18n/zh.js

@@ -797,7 +797,7 @@ export const zhMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ export const zhMessages = {
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ export const zhMessages = {
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.115.11",
+  "version": "2.115.14",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",
@@ -32,6 +32,7 @@
     "test:related": "node scripts/run-cli-tests.mjs --build=auto related",
     "test:related:cached": "node scripts/run-cli-tests.mjs related-cached",
     "test:related:profile": "node scripts/run-cli-tests.mjs --build related-profile",
+    "test:skill-contracts": "node scripts/run-cli-tests.mjs skill-contracts",
     "test:cli": "node scripts/run-cli-tests.mjs --build cli",
     "test:coverage": "node scripts/run-cli-tests.mjs --build coverage",
     "test:audit": "node scripts/audit-tests.mjs --json",

package/templates/default/common/.mustflow/config/mustflow.toml

@@ -321,9 +321,7 @@ on_limit = "stop_and_report"
 required_for = [
   "git_commit",
   "git_push",
-  "dependency_install",
   "dependency_upgrade",
-  "network_access",
   "database_migration",
   "destructive_command",
   "secret_access",

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 239
+revision = 242
 translations = {}
 
 [documents."skill.ada-code-change"]
@@ -889,7 +889,7 @@ translations = {}
 [documents."skill.svelte-code-change"]
 source = "locales/en/.mustflow/skills/svelte-code-change/SKILL.md"
 source_locale = "en"
-revision = 4
+revision = 5
 translations = {}
 
 [documents."skill.tailwind-code-change"]
@@ -910,6 +910,18 @@ source_locale = "en"
 revision = 2
 translations = {}
 
+[documents."skill.webview2-code-change"]
+source = "locales/en/.mustflow/skills/webview2-code-change/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
+[documents."skill.hetzner-cloud-change"]
+source = "locales/en/.mustflow/skills/hetzner-cloud-change/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
 [documents."skill.typescript-code-change"]
 source = "locales/en/.mustflow/skills/typescript-code-change/SKILL.md"
 source_locale = "en"
@@ -1146,7 +1158,7 @@ translations = {}
 [documents."skill.state-machine-pattern"]
 source = "locales/en/.mustflow/skills/state-machine-pattern/SKILL.md"
 source_locale = "en"
-revision = 4
+revision = 5
 translations = {}
 
 [documents."skill.strategy-pattern"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 239
+revision: 242
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -685,6 +685,8 @@ routes. Event routes stay inactive until their event occurs.
 | Third-party SDK or external API integration, review, debugging, upgrade, webhook handling, auth scope change, sandbox or production setup, provider SDK version change, API version migration, rate-limit handling, retry policy, idempotency key usage, pagination, provider error mapping, request id logging, changelog review, deprecation response, or provider operational-readiness test needs production integration review | `.mustflow/skills/third-party-api-integration-review/SKILL.md` | Provider and SDK/API ledger, source-of-truth docs, auth and scope ledger, operation and side-effect ledger, webhook ledger, error and observability ledger, changelog or migration evidence, existing fakes or sandbox tests, and configured command intents | Provider adapters, wrappers, typed request and response models, error mappers, timeout and retry policies, rate-limit handling, idempotency key handling, pagination handling, webhook signature verification and dedupe, redacted observability, sandbox tests, fixtures, runbooks, migration notes, and directly synchronized docs or templates | demo-only integration, stale provider docs, SDK/API drift, sandbox-production mixup, hardcoded secret, overbroad scope, token refresh gap, missing timeout, infinite retry, retrying permanent errors, mutating retry without idempotency, per-attempt idempotency key, 429 retry storm, ignored Retry-After, offset pagination assumption, raw provider error leak, string-only provider error, missing request id, trusted webhook payload, JSON-parsed signature breakage, duplicate webhook side effect, event-order assumption, success redirect as proof, unhandled unknown provider outcome, dashboard-only setting, untested SDK upgrade, or happy-path-only sandbox test | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Third-party integration reviewed, provider source-of-truth and SDK/API version evidence, auth/environment/scope decisions, timeout/retry/rate-limit/idempotency/pagination decisions, webhook delivery and dedupe checks, error and observability mapping, tests or missing evidence, verification, and remaining provider operational risk |
 | Tauri frontend invokes, Rust commands, capabilities, permissions, scopes, plugins, filesystem, dialog, shell, opener, updater, sidecar, mobile native permissions, Tauri bundling targets, release package formats, or native desktop CI build matrices are created or changed | `.mustflow/skills/tauri-code-change/SKILL.md` | Frontend call sites, Tauri config, Rust commands, capability and permission files, plugin config, bundle targets, release matrix evidence, changed files, and command contract entries | Tauri frontend, Rust commands, capabilities, permissions, scopes, plugins, bundle target narrowing, package target notes, tests, and docs | broad native permission, untrusted IPC input, filesystem escape, shell or updater risk, WebView/native boundary drift, all-target bundling surprise, cold Cargo cache cost, duplicated macOS packaging jobs, or long-retention CI artifacts posing as release assets | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | IPC, permission, scope, filesystem, shell, updater, native boundary, bundle target, release matrix, artifact retention, verification, and remaining Tauri risk |
 | Wails v3 applications, Go services, generated bindings, TypeScript runtime calls, windows, menus, system tray, dialogs, events, frontend bridge payloads, WebView platform behavior, Taskfile or build config, signing, packaging, platform targets, native desktop CI build matrices, custom protocols, file associations, server builds, or Wails-related tests are created, changed, reviewed, or upgraded | `.mustflow/skills/wails-code-change/SKILL.md` | Wails version track, Go module and frontend package metadata, generated bindings, app entry point, service/window/event/menu/tray/dialog/build/package evidence, platform target and release matrix evidence, changed files, and command contract entries | Wails app assembly, Go services, frontend bridge calls, generated bindings, windows, events, menus, tray, dialogs, WebView platform behavior, platform packaging, target narrowing, tests, and docs | Electron or Wails v2 migration drift, accidental exported RPC, binding or runtime version drift, shared-service race, unsafe frontend input, oversized bridge payload, event leak or broadcast, WebView platform mismatch, packaging/signing drift, all-platform PR packaging, duplicated macOS packaging jobs, or long-retention CI artifacts posing as release assets | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Wails version/app/service/bridge/binding/window/event/menu/tray/dialog/platform packaging, release matrix, artifact retention notes, verification, and remaining Wails risk |
+| Microsoft Edge WebView2 SDK or Runtime selection, `CoreWebView2Environment`, custom initialization, UDFs, profiles, web messages, host objects, document or frame trust, navigation, popups, downloads, permissions, process failures, memory, performance, Evergreen or Fixed Version deployment, WPF, WinForms, WinUI, or Win32 behavior is created, changed, reviewed, debugged, or upgraded | `.mustflow/skills/webview2-code-change/SKILL.md` | Host/Runtime, environment/UDF/profile, trust/bridge/navigation, lifecycle, failure, and performance ledgers; official source evidence; changed files; and command contract entries | Initialization, environment registry, UDF/profile policy, bridge handlers, navigation/frame policy, popup/download/permission lifecycle, process recovery, memory/performance diagnostics, Runtime update, packaging, tests, and docs | implicit `Source` initialization, UDF deletion retry, SDK/Runtime confusion, untrusted native RPC, prefix origin check, broad host object, stale navigation result, leaked event/deferral/child/download, recovery loop, process-count theater, timing misdiagnosis, Evergreen update not adopted, or unowned Fixed Runtime patching | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Host/SDK/Runtime/distribution decision, environment/UDF/profile/process/document ownership, bridge/navigation/lifecycle/security/memory/performance findings, verification, and remaining WebView2 risk |
+| Hetzner Cloud or Dedicated infrastructure, hcloud or API integrations, Terraform provider resources, servers, networks, load balancers, firewalls, IPs, placement groups, volumes, backups, Object Storage, Storage Box, cloud-init, Docker or Coolify hosting, Kubernetes CCM or CSI integration, monitoring, recovery, capacity, cost, or Hetzner-related deployment tests are created, changed, reviewed, debugged, migrated, or upgraded | `.mustflow/skills/hetzner-cloud-change/SKILL.md` | Target repository and environment, Hetzner project or account boundary, infrastructure source and state owner, resource and credential ledger, failure domains, traffic and storage model, container data paths, guest network owner, CCM/CSI compatibility, RPO/RTO, workload and capacity evidence, current official provider facts, changed files, and command contract entries | Hetzner IaC, provider integrations, bootstrap config, images, guest networking, container mounts, orchestration drivers, application resilience code, health checks, monitoring, tests, fixtures, runbooks, architecture docs, cost guardrails, and directly synchronized templates | Placement Group treated as an availability zone, Firewall allowlists treated as overrides, outbound or existing-session semantics ignored, label selection treated as applied state, private Network treated as encrypted or filtered, L3 Network treated as VLAN, competing DHCP owners, load balancer or Floating IP treated as automatic location failover, DDoS filtering treated as WAF or origin authentication, Docker named volume treated as Hetzner Volume, missing mount creating fresh state, Object Storage treated as POSIX, unpinned CCM/CSI compatibility, replicated storage or server Backup treated as independent backup, provider-only monitoring or recovery control, unfenced IP move, untested private-only recovery, irreversible rescale, architecture mismatch, arbitrary performance thresholds, destructive raw-device benchmark, powered-off resource assumed free, stale price or limit, autonomous cleanup, or local validation claimed as live provider state | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Hetzner boundary and resource ledger, refreshed provider facts and integration versions, failure-domain/network/firewall/credential/storage/mount/backup/restore decisions, compute/performance/capacity/cost evidence, state layers verified, files changed, command intents run, manual provider checks, and remaining Hetzner risk |
 | File path handling, cross-platform path behavior, path helpers, safe filesystem wrappers, clone or checkout destinations, scaffold roots, temp or cache paths, atomic writes, locks, archive extraction, uploads, downloads, scanners, CLI/API/schema path contracts, snapshots, generated outputs, or package artifact paths are created, changed, reviewed, or reported | `.mustflow/skills/file-path-cross-platform-change/SKILL.md` | Path ledger, trust classes, accepted path representation, base root, path helpers, safe filesystem wrappers, clone/checkout/scaffold/install/extract outputs, staging and promotion policy, temp/cache helpers, lock policy, archive policy, upload/download policy, scanner policy, CLI/API/schema/snapshot/generated/package surfaces, platform expectations, failure taxonomy, and command contract entries | Path validators, helpers, wrappers, schemas, CLI/API parsing, snapshots, fixtures, docs, tests, generated-output paths, package artifact paths, clone or scaffold destinations, archive extraction, scanner bounds, temp/cache handling, locks, and cleanup code | path traversal, base containment bypass, drive-relative path bug, reserved-name bug, case-collision bug, Unicode-collision bug, Git checkout path-length failure misreported as network or auth, unsafe archive extraction, non-atomic write claim, stale lock, scanner loop, partial-output cleanup data loss, user-selected destination deletion, path contract drift, or package artifact path drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Path contract, path ledger, trust classes, root policy, preflight/staging/promotion decisions, Windows/macOS/Linux/archive/upload/download/scanner/lock/temp/cache/atomic/cleanup decisions, failure taxonomy, synchronized contract surfaces, verification, and remaining path risk |
 | File paths, directories, symlinks, real paths, traversal, NTFS alternate data streams, Windows 8.3 short names, Windows namespace prefixes, atomic writes, file copies, generated outputs, temporary files, clone or checkout materialization, cleanup, or Windows/POSIX filesystem behavior are created, changed, reviewed, or reported | `.mustflow/skills/cross-platform-filesystem-safety/SKILL.md` | Path inputs, base directory, trust boundary, symlink policy, write or cleanup strategy, clone/checkout/scaffold/install/extract path budget, app-owned staging boundary, platform expectations, ADS and short-name behavior, failure taxonomy, and command contract entries | Path validation, file helpers, copy/update/delete code, clone/scaffold/archive cleanup code, scan bounds, dev-server or file-serving deny checks, fixtures, tests, docs, and templates | path traversal, symlink escape, unsafe overwrite, Windows ADS bypass, 8.3 short-name bypass, namespace-prefix bypass, platform-only behavior, stale output, path-length or filename-length misclassification, watcher/resource misclassification, or cleanup data loss | `changes_status`, `changes_diff_summary`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Path trust classes, root boundary, symlink/write/delete/scan decisions, ADS and short-name handling, preflight and staging boundaries, clone/scaffold/extract classification, platform assumptions, verification, and remaining filesystem risk |
 | Child processes, shell or argv execution, built-in command reruns, Git/package-manager/scaffolder failures, timeouts, process trees, output limits, streaming, environment policy, command eligibility, failure classification, command-line length limits, or execution receipts are created, changed, reviewed, or reported | `.mustflow/skills/process-execution-safety/SKILL.md` | Execution path, timeout, output limit, stdin, argv and shell command-length budget, environment, cwd, process tree behavior, failure taxonomy, receipt and write-tracking expectations, and command contract entries | Process execution code, process-tree helpers, output buffers, environment creation, eligibility checks, failure classifiers, receipts, tests, and docs | runaway process, unbounded output, leaked environment, argv-too-long failure, shell-command-too-long failure, inconsistent JSON/text execution, false cleanup claim, Git checkout path failure misreported as network or auth, blind retry, diagnostic loss, or unreliable receipt | `changes_status`, `changes_diff_summary`, `test_related`, `test_release`, `mustflow_check` | Execution surface, timeout/output/environment/process-tree boundaries, argv and shell length handling, failure classification, diagnostic preservation, receipt consistency, tests, verification, and remaining process risk |
@@ -778,7 +780,6 @@ routes. Event routes stay inactive until their event occurs.
 | Skill procedures or routes are created or maintained, or their conditional, exception-bearing, authority-sensitive, universal, completion, or cross-repository verification claims need logical review | `.mustflow/skills/skill-authoring/SKILL.md` | Repeated task evidence, selected repository boundary, explicit parent dependencies, nearby rules, positive cases, boundary cases, and counterexamples | `.mustflow/skills/**` | overlap, command drift, cross-root verification inheritance, converse inference, unbounded quantifier, contradictory branch, flat authority ranking, unreachable stop state, or unobservable postcondition | `mustflow_check`, `docs_validate` | Skill route and procedure changes, logical consistency and repository-boundary result, counterexamples checked, and claims narrowed |
 | Agent A designs and Agent B implements from a versioned handoff, private `.agent` planning files, local-only ignored design state, manifest/plan/state ledgers, startup gates, allowed-path gates, blocker/deviation ledgers, or completion gates | `.mustflow/skills/design-implementation-handoff/SKILL.md` | Target repository, Agent A and Agent B surfaces, privacy mode, public behavior source, private handoff paths, ownership, allowed and forbidden paths, task dependencies, verification expectations, and remote-agent transfer boundary | `AGENTS.md`, public spec files, private `.agent` handoff files, ignore or exclude guidance, handoff templates, instruction artifacts, tests, docs, and directly synchronized workflow surfaces | hidden-only product contract, private-file leak, remote agent missing local context, plan/state version drift, Agent B editing Agent A-owned files, overly broad allowed paths, unbacked ignored files, or false completion evidence | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `mustflow_check` | Handoff mode, public versus private file split, Agent A/B ownership, startup and task gates, ignore or exclude decision, remote-agent limitation, verification gates, and remaining privacy or handoff risk |
 | Work instructions for coding agents, Codex tasks, work orders, issues, PR requests, automations, implementation briefs, reviews, proofs, cleanup tasks, or operational-readiness tasks are drafted, reviewed, or improved | `.mustflow/skills/task-instruction-authoring/SKILL.md` | Target agent surface, task family, goal, scope, constraints, durable rules, risk class, verification expectations, and required output | Instruction artifacts, work-order bodies, issue bodies, templates, docs, skills, checklists, and directly synchronized workflow surfaces | vague goal, delegated product decision, missing acceptance evidence, unsafe raw command, proof theater, review blade drift, overlong one-off policy, or operational-readiness gap | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `mustflow_check` | Instruction family, missing decisions, final instruction or rubric, durable guidance decision, verification expectations, and remaining ambiguity or operational risk |
-
 When introducing a new skill, link it here and define the specific trigger and route fields.
 Avoid including raw shell commands in skill documents; instead, reference the command intent
 names as defined in `.mustflow/config/commands.toml`.

package/templates/default/locales/en/.mustflow/skills/hetzner-cloud-change/SKILL.md

@@ -0,0 +1,316 @@
+---
+mustflow_doc: skill.hetzner-cloud-change
+locale: en
+canonical: true
+revision: 2
+lifecycle: mustflow-owned
+authority: procedure
+name: hetzner-cloud-change
+description: Apply this skill when Hetzner Cloud or Dedicated infrastructure, hcloud or API integrations, Terraform provider resources, servers, networks, load balancers, firewalls, IPs, placement groups, volumes, backups, Object Storage, Storage Box, cloud-init, Docker or Coolify hosting, Kubernetes CCM or CSI integration, monitoring, recovery, capacity, cost, or Hetzner-related deployment tests are created, changed, reviewed, debugged, migrated, or upgraded.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.hetzner-cloud-change
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - lint
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - test_release
+    - mustflow_check
+---
+
+# Hetzner Cloud Change
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Change or review Hetzner infrastructure without confusing one resilience mechanism with a complete
+availability, backup, recovery, security, performance, or cost design.
+
+Treat Hetzner as a provider with distinct compute, network, storage, control-plane, account, and
+location failure domains. Prove the current provider contract from official documentation instead
+of carrying old prices, limits, product availability, or console behavior into a durable design.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- A task changes Hetzner Cloud, Dedicated, Robot, hcloud, API, Terraform, Pulumi, Ansible, cloud-init,
+  image, server, server type, architecture, location, network zone, private Network, Load Balancer,
+  Firewall, Primary IP, Floating IP, Placement Group, Volume, Backup, Snapshot, Object Storage,
+  Storage Box, DNS failover, monitoring, capacity, restore, or disaster-recovery behavior.
+- A review claims that a Hetzner design is highly available, private, encrypted, backed up,
+  recoverable, scalable, cost-effective, or production-ready.
+- A Hetzner incident or performance investigation may lead to infrastructure, application,
+  runbook, test, monitoring, or capacity changes.
+- Docker, Coolify, Kubernetes, a cloud-controller manager, CSI driver, CNI, ingress, egress gateway,
+  container registry, or orchestration platform depends on Hetzner networking, storage, metadata,
+  load-balancer, image, architecture, or API behavior.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task is provider-neutral cost review only; use `cloud-cost-guardrail-review`.
+- The task is provider-neutral rollout, canary, drain, probe, or rollback review only; use
+  `deployment-rollout-safety-review`.
+- The task only changes Docker build or runtime behavior without a Hetzner boundary; use
+  `docker-code-change` or `docker-runtime-triage`.
+- The task only diagnoses application code, database queries, Linux performance, or networking
+  after evidence has excluded Hetzner resources and provider behavior.
+- The user asks for a live production mutation, deletion, failover, restore, rescale, or provider
+  purchase that no configured command intent authorizes.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Target repository, environment, Hetzner project or account boundary, infrastructure source of
+  truth, state owner, changed files, and configured command intents.
+- Resource ledger: Cloud or Dedicated servers, architecture and server types, images, locations,
+  network zones, Placement Groups, Networks, routes, Load Balancers, Firewalls, Primary and Floating
+  IPs, Volumes, Backups, Snapshots, buckets, Storage Boxes, DNS, certificates, metadata endpoints,
+  guest network-config owners, container data paths, orchestration drivers, monitoring, and tokens.
+- Failure-domain and recovery model: host, rack or unknown facility boundary, location, network zone,
+  provider control plane, DNS, account, credential, operator error, data corruption, and dependency
+  failure; required RPO, RTO, restore evidence, and traffic or data failover path.
+- Runtime and traffic model: ingress, egress, east-west traffic, health checks, TLS termination,
+  connection draining, long-lived connections, retries, idempotency, queue leases, replication,
+  storage consistency, and peak connection or throughput demand.
+- Capacity and cost model: actual workload measurements, architecture compatibility, quota, current
+  SKU and location availability, current provider prices, retention, egress, IP, storage, backup,
+  and idle-resource costs.
+- Current official Hetzner documentation for every date-sensitive price, limit, availability,
+  billing, networking, backup, restore, or product-capability claim used in the decision.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- Read the actual IaC, config, code, tests, runbooks, state boundaries, and current official Hetzner
+  documentation before recommending or changing provider behavior.
+- Separate declared configuration, provider-accepted configuration, and observed runtime state.
+  One layer does not prove the next.
+- Treat attached reports, old docs, console screenshots, blogs, and AI summaries as leads to verify,
+  not as current provider authority.
+- Keep provider credentials, state files, private addresses, customer data, and recovery secrets out
+  of repository output and test fixtures.
+- Provider CLI, API, console, apply, import, state mutation, purchase, deletion, failover, and restore
+  actions remain manual-only unless a configured oneshot command intent explicitly permits them.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Update Hetzner IaC, provider integrations, bootstrap configuration, images, application resilience
+  code, health checks, monitoring, tests, fixtures, runbooks, architecture docs, cost guardrails, and
+  directly synchronized templates within the user-requested scope.
+- Add validation for immutable-image or reproducible bootstrap paths, multi-architecture artifacts,
+  resource labels, deletion protection, bounded scaling, restore evidence, and declared-versus-applied
+  state when the repository owns those surfaces.
+- Do not add live credentials, broad provider command wrappers, autonomous cleanup, production
+  failover, unbounded autoscaling, or destructive recovery automation outside the command contract.
+- Do not rewrite provider-neutral deployment, cost, database, security, or performance policy inside
+  this skill when the matching adjunct skill already owns it.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Classify the provider boundary.
+   Record Cloud versus Dedicated, project or account, environment, location, network zone,
+   architecture, OS, image, ownership, IaC state, and whether the task changes desired state,
+   provider state, guest state, application behavior, or only documentation.
+
+2. Build the resource and credential ledger.
+   Map each server, IP, Network, route, Load Balancer, target, Firewall, Placement Group, Volume,
+   Backup, Snapshot, bucket, Storage Box, DNS record, certificate, token, monitoring path, and state
+   store to its owner, lifecycle, protection, cost, and dependent resources. Use projects and token
+   scope as blast-radius boundaries; keep read-only monitoring credentials separate from mutation
+   credentials and keep break-glass material outside the affected provider boundary.
+
+3. Model failures by mechanism instead of by product label.
+   For host, location, network-zone, provider-control-plane, DNS, account, credential, operator,
+   corruption, and dependency failures, record detection, surviving components, fencing, traffic or
+   data transition, and recovery evidence. A spread Placement Group reduces same-host concentration;
+   it does not prove location isolation. A Load Balancer, replicated Volume, server Backup, Snapshot,
+   and off-provider backup each cover different failures.
+
+4. Verify current provider facts.
+   Refresh exact prices, quotas, server types, architectures, locations, limits, billing rules,
+   supported protocols, IP behavior, MTU, firewall scope, backup contents, restore compatibility,
+   Object Lock behavior, metadata endpoints, guest auto-configuration ownership, CCM and CSI
+   compatibility, and product availability from official Hetzner sources and maintained provider
+   repositories. Record the access date, component version, or digest. Keep time-sensitive values in
+   config or evidence, not as timeless prose; never treat a mutable `latest` tag as compatibility proof.
+
+5. Review network and recovery reachability together.
+   Map ingress, egress, east-west traffic, DNS, TLS, routes, MTU and overlay overhead, allowlists,
+   private-address behavior, Firewall coverage, bastion or console access, package and API egress,
+   and rescue or rebuild paths. Private does not prove encrypted or filtered. Before removing a
+   public path, prove a tested replacement for administration, egress, recovery, and credential
+   rotation under the same failure being handled. Treat Cloud Firewall, host firewall, container
+   firewall, service identity, and application authorization as separate layers. Verify these
+   provider-Firewall semantics from current docs and applied state:
+   - assigned allowlists combine; attaching another Firewall does not override an existing broad allow;
+   - no outbound rules means allow-all, while adding outbound rules creates an implicit-deny remainder;
+   - rule changes do not terminate connections that were already established;
+   - label selection is desired scope, not proof that every intended resource was actually attached;
+   - private Network traffic and Load Balancer interfaces require their own controls when provider
+     Firewall coverage is absent.
+   Model the Network as routed L3, not a VLAN or security zone. Verify source-address and route
+   constraints for VPN, NAT, custom-router, alias-IP, and failover designs. Give each private NIC one
+   configuration owner: provider image automation or explicit guest config, not competing DHCP
+   clients. Validate routes, DNS, MTU, large transfers, and recovery after a cold boot.
+
+6. Review Load Balancer and IP transitions.
+   Separate liveness from readiness; keep readiness bounded to dependencies required to accept new
+   work. Verify TLS termination, target protocol, Proxy Protocol compatibility, health-check timing,
+   connection and bandwidth budget, drain order, long-lived connection recovery, and independent
+   DNS entry points when location-level failover is required. Treat Floating IP movement as an
+   explicit fenced transition: isolate the old writer before reassignment and prove the guest-side
+   address and routing state. Do not call it automatic failover. Inspect actual public IPv4, public
+   IPv6, and private interface state rather than inferring exposure from DNS. Keep DDoS filtering,
+   WAF behavior, application abuse control, and origin authentication distinct; hiding a DNS record
+   does not prove that an old or direct origin address is unreachable.
+
+7. Select compute from workload evidence.
+   Compare Cloud and Dedicated ownership burden, shared and dedicated CPU behavior, x86 and Arm
+   compatibility, memory duplication, local-disk dependence, replacement speed, and tail latency.
+   Correlate application throughput, error rate, queue age, p95 or p99 latency, run queue, CPU PSI,
+   steal, `MemAvailable`, swap I/O, memory PSI, storage latency, queue depth, I/O PSI, and fsync
+   latency. Do not promote an arbitrary utilization or PSI percentage to a universal threshold.
+   Reproduce candidates with identical workload, location, image, and application version when safe.
+
+8. Preserve replacement and scaling options.
+   Check architecture and image compatibility, root-disk resize irreversibility, local-state loss,
+   SKU and location scarcity, quotas, drain behavior, maximum scale, and fallback types before
+   rescale or autoscaling changes. Keep state out of disposable compute where practical. Define
+   bounded fallback behavior when a preferred type or location cannot be allocated.
+
+9. Classify storage by durability and access pattern.
+   Distinguish replaceable local storage, block Volume state, object storage, backup archives, and
+   Storage Box data. Verify current performance and durability claims rather than copying fixed IOPS
+   or throughput values. Replication is availability, not history. Test storage with disposable files
+   and realistic I/O shapes; never benchmark a production raw block device destructively.
+   Trace the actual byte path from application or container to filesystem, mount, block device, or
+   object key. A Docker named volume is not a Hetzner Volume. For required block storage, make mount
+   identity and readiness a startup precondition, order consumers after the mount, and fail closed on
+   a missing or wrong mount so an empty local directory cannot become a second database. Treat Volume
+   attachment, location, growth, and filesystem expansion as explicit operations, not automatic HA.
+   Treat Object Storage as an object API, not POSIX, shared block storage, or a database filesystem;
+   review overwrite, rename, locking, append, small-object, request, connection, bucket, and source-IP
+   limits, including NAT aggregation. For Kubernetes, verify the pinned CCM and CSI versions or
+   digests, topology, access modes, attachment behavior, immutable provider fields, and current
+   snapshot or migration support before accepting a StatefulSet or LoadBalancer design.
+
+10. Build the backup and restore chain.
+    Start from application-consistent backup and point-in-time requirements. Record whether root disk,
+    attached Volumes, databases, objects, secrets, DNS, certificates, queues, cron, and external state
+    are included. Keep an encrypted independently administered copy outside the failure and account
+    boundary being protected. Decide Object Lock at bucket creation when required, separate write from
+    retention or deletion authority, and test restoration into an isolated target including login,
+    reads, writes, workers, schedules, policies, and cutover. Measure achieved data-loss window and
+    service restoration time; do not infer RPO or RTO from backup-job success. Design versioning,
+    retention lock, lifecycle deletion, encryption, and credential scope as separate controls; prove
+    that lifecycle rules cannot delete an application backup chain earlier than the restore contract.
+
+11. Keep monitoring and recovery control independent.
+    Use guest, application, database, storage, network, backup-age, and synthetic-user signals in
+    addition to provider graphs. Place at least one detection and coordination path outside the
+    provider failure domain when that failure is in scope. Preserve timestamps, request or job IDs,
+    path evidence, provider inventory drift, access and audit events, and bidirectional network
+    evidence before replacement or restart hides the fault. Send security-relevant logs to a sink
+    whose ingestion identity cannot rewrite or delete retained evidence.
+
+12. Prepare rebuild-first incident recovery.
+    Separate prevention from containment: a provider Firewall change can block new connections while
+    old sessions, application tokens, database sessions, and compromised processes remain active.
+    Define clean administrator access, account and token containment, exposure removal, session
+    termination, evidence preservation, isolated analysis, clean-image rebuild, validated data
+    restoration, and rotation of every secret the compromised workload could read. Do not return a
+    patched compromised server or attached forensic disk to the production trust boundary.
+
+13. Treat bootstrap as reproducible initialization.
+    Keep cloud-init or user data small, versioned, secret-safe, observable, and limited to bootstrap.
+    Move substantial configuration into an idempotent, rerunnable, pinned, and testable mechanism.
+    Prove failure reporting and rebuild from a clean server; do not rely on a one-shot script whose
+    partial completion cannot be distinguished from success. Verify the current metadata API contract,
+    deprecated paths, image-specific network auto-configuration owner, and first-boot identity reset.
+
+14. Build a live cost and lifecycle ledger.
+    Refresh billing rules and prices, then account for active and powered-off compute, IPs, Load
+    Balancers, Volumes, Backups, Snapshots, buckets, retained versions, Storage Boxes, egress, and
+    Dedicated commitments. Label owner, environment, purpose, protection, and expiry. Cleanup must
+    inventory dependencies and protections first and use a configured intent; never turn a cost
+    observation into an automatic delete.
+
+15. Verify the complete change matrix.
+    Cover declared config, parser or schema, plan or diff, focused tests, architecture compatibility,
+    bootstrap, health checks, failover fencing, restore, monitoring, cost, docs, and rollback or
+    replacement. Run only configured intents. Report provider-side checks that remain manual rather
+    than claiming production state from local validation.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- Hetzner resources, owners, failure domains, credentials, network paths, storage classes, recovery
+  chain, current provider assumptions, capacity evidence, and cost lifecycle are explicit.
+- Availability, replication, backup, restore, and off-provider recovery claims are kept distinct.
+- Declared, provider-applied, guest-observed, and externally observed states are not conflated.
+- Every changed operational claim has named evidence or is reported as an unverified manual check.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `changes_status`
+- `changes_diff_summary`
+- `lint`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `test_release`
+- `mustflow_check`
+
+Prefer narrower configured IaC validation, provider-mock, network, architecture, bootstrap, restore,
+performance, cost, and runbook checks. Local success does not prove live Hetzner state.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If current official documentation disagrees with an attachment, old runbook, test fixture, or
+  remembered provider behavior, use the current contract and report the compatibility impact.
+- If provider state cannot be inspected safely, stop at declared-state verification and name the
+  missing provider and runtime checks.
+- If a change removes public reachability, enlarges a root disk, crosses architecture, moves a
+  Floating IP, deletes a resource, changes retention, or alters backup custody without a proven
+  recovery path, do not proceed with the mutation.
+- If failover lacks fencing, idempotency, bounded retry, quorum, or independent coordination, report
+  the split-brain or duplicate-work risk before adding automation.
+- If an isolation change relies only on a new Cloud Firewall while old sessions remain active,
+  require a separate connection, process, credential, and evidence-containment plan.
+- If required state storage is missing, mounted at the wrong path, attached in the wrong location, or
+  replaced by an empty local directory, fail startup instead of creating fresh state.
+- If an application requires POSIX locks, atomic rename, append, mmap, or low-latency random I/O,
+  reject Object Storage as a transparent mounted filesystem.
+- If a provider integration relies on a mutable image tag, removed API field, undocumented metadata
+  path, or unverified CSI or CCM feature, pin a compatible version or stop with the compatibility gap.
+- If a cost optimization removes recovery, observability, capacity, architecture compatibility, or
+  failure isolation, reject the optimization or add the missing guardrail first.
+- If the needed provider command intent is absent, report it instead of embedding a raw hcloud,
+  Terraform, API, SSH, benchmark, delete, rescale, restore, or failover command.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- Hetzner boundary and resource ledger
+- Current official provider facts refreshed and access date
+- Failure-domain, network, credential, storage, backup, restore, and control-plane decisions
+- Compute, architecture, performance, capacity, cost, and lifecycle evidence
+- Declared, provider, guest, and external state verified
+- Files changed
+- Command intents run
+- Manual or skipped provider checks and reasons
+- Remaining Hetzner availability, recovery, security, performance, and cost risk

package/templates/default/locales/en/.mustflow/skills/routes.toml

@@ -918,6 +918,18 @@ route_type = "primary"
 priority = 90
 applies_to_reasons = ["code_change", "behavior_change", "ui_change", "security_change", "privacy_change", "data_change", "public_api_change", "package_metadata_change", "release_risk"]
 
+[routes."webview2-code-change"]
+category = "data_external"
+route_type = "primary"
+priority = 90
+applies_to_reasons = ["code_change", "behavior_change", "ui_change", "security_change", "privacy_change", "data_change", "public_api_change", "package_metadata_change", "performance_change", "release_risk"]
+
+[routes."hetzner-cloud-change"]
+category = "data_external"
+route_type = "primary"
+priority = 90
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "security_change", "privacy_change", "data_change", "migration_change", "docs_change", "workflow_change", "package_metadata_change", "performance_change", "release_risk"]
+
 [routes."process-execution-safety"]
 category = "data_external"
 route_type = "primary"

package/templates/default/locales/en/.mustflow/skills/state-machine-pattern/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.state-machine-pattern
 locale: en
 canonical: true
-revision: 4
+revision: 5
 lifecycle: mustflow-owned
 authority: procedure
 name: state-machine-pattern
@@ -66,6 +66,7 @@ Two states can still require this skill when the lifecycle is meaningful, such a
 ## Required Inputs
 
 - The entity and state field under change.
+- The intended initial state, the user-visible entry state, and the first event or command that should leave it.
 - Complete state list and which states are terminal.
 - Complete event list and the facts each event carries.
 - Current places that change state, validate actions, check state, or render available actions.
@@ -118,6 +119,8 @@ Two states can still require this skill when the lifecycle is meaningful, such a
 5. Write the transition table first.
    - Include every source state, allowed event, guard name, target state, and effect description.
    - Include terminal states explicitly with no outgoing transitions when they are truly terminal.
+   - Declare the initial state explicitly and verify it matches the real entry experience. Do not initialize directly into an active state such as `PLAYING`, `RUNNING`, or `PROCESSING` when the user must first see a menu, confirmation, setup, or start action.
+   - Model the first user or system action as a real transition. Test that the expected entry action leaves the initial state and that missing runtime prerequisites produce a visible failure or unavailable action instead of a silent no-op.
    - Do not hide transition rules inside handler branches, repository filters, database queries, adapter code, or UI code.
    - Do not let direct `deleted_at` assignment bypass allowed archive, soft-delete, restore, purge, anonymize, or redirect transitions when deletion is a meaningful lifecycle.
 6. Keep guards pure.
@@ -167,6 +170,7 @@ Two states can still require this skill when the lifecycle is meaningful, such a
     - For important domains, document state list, event list, transition table, terminal states, guards, effects, concurrency method, duplicate-event handling, and any cross-machine invariants.
     - Diagrams are secondary. The code transition table is the source of truth.
 17. Test from the transition table.
+    - Test the declared initial state and the first permitted transition before testing later lifecycle branches.
     - Test every valid transition.
     - Test representative invalid transitions, especially terminal states and dangerous skipped states.
     - Test guard success and guard failure separately.

package/templates/default/locales/en/.mustflow/skills/svelte-code-change/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.svelte-code-change
 locale: en
 canonical: true
-revision: 4
+revision: 5
 lifecycle: mustflow-owned
 authority: procedure
 name: svelte-code-change
@@ -98,6 +98,10 @@ Preserve Svelte component reactivity, SvelteKit SSR/server/client execution mode
 20. Keep `$effect` dependencies narrow and synchronous. Read dependencies before `await`, `setTimeout`, or callbacks; use `untrack` for incidental logging, snapshots, or non-dependency reads.
 21. Return cleanup from effects that create subscriptions, intervals, observers, sockets, editors, charts, canvas loops, or external library instances.
 22. Treat props as parent-owned. Use callback props for changes and `$bindable` only for narrow form-control-like two-way APIs. Preserve wrapper binding chains or convert them to explicit callbacks.
+    - In Svelte 5 runes mode, do not expose local `$state` through an `export { local as prop }` alias and expect a parent `bind:` directive to update. Declare a bindable prop through `$props()` and `$bindable()` when two-way binding is the intended public contract.
+    - Do not remove a child component merely to hide a broken DOM-reference handoff. Prefer keeping canvas, editor, chart, media, or other imperative resource creation and cleanup in the component that owns the DOM node. When a parent must coordinate initialization, expose an explicit ready callback carrying the node or initialized handle after the child has mounted.
+    - Treat `bind:this` values as unavailable before mount and possibly unavailable again after conditional unmount. Do not assume a parent `onMount` runs after a child-provided reference has propagated through an invalid or indirect binding chain.
+    - Do not silently return from required imperative initialization when the DOM node is unexpectedly absent. Distinguish an expected conditional absence from a broken ownership or binding contract, expose the failure during development, and provide a bounded reinitialization path when the node can appear later.
 23. In Svelte 5, treat DOM event handlers as props. When spreading rest props through wrappers, intentionally compose external handlers with internal policy instead of relying on spread order.
 24. Treat snippets as typed render callbacks. Require optional snippet guards, pass row or slot-like data as parameters, and avoid hidden parent-state capture in reusable library components.
 25. In the official-source snapshot checked on 2026-07-11, SvelteKit remote functions were
@@ -141,6 +145,7 @@ Preserve Svelte component reactivity, SvelteKit SSR/server/client execution mode
 - Use `$state.snapshot` before sending proxy state to serializers, workers, chart libraries, equality tools, or external APIs that should see plain data.
 - Use `$derived` for calculations from props, route data, page state, URL state, or local state.
 - Use `$effect` only for browser-side effects, subscriptions, DOM, canvas, analytics, timers, third-party browser libraries, and cleanup.
+- Keep imperative DOM resources in the component that owns the bound node when practical. If ownership must cross a component boundary, use an explicit `$bindable` prop or ready callback and test the handoff instead of exporting local rune state by alias.
 - Use stores for external streams or manual subscribe/unsubscribe interop, not ordinary component state.
 - Use context for parent-owned values shared down the component tree, especially request-scoped layout data.
 - Do not reassign reactive context objects after placing them in context; update their properties or pass getter functions when needed.

package/templates/default/locales/en/.mustflow/skills/webview2-code-change/SKILL.md

@@ -0,0 +1,335 @@
+---
+mustflow_doc: skill.webview2-code-change
+locale: en
+canonical: true
+revision: 2
+lifecycle: mustflow-owned
+authority: procedure
+name: webview2-code-change
+description: Apply this skill when Microsoft Edge WebView2 code, SDK or Runtime selection, CoreWebView2Environment initialization, user data folders, profiles, web messages, host objects, document or frame trust, navigation, popups, downloads, permissions, process failures, memory or performance behavior, Evergreen or Fixed Version deployment, WPF, WinForms, WinUI, or Win32 WebView2 tests are created, changed, reviewed, debugged, or upgraded.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.webview2-code-change
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - lint
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - mustflow_check
+---
+
+# WebView2 Code Change
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Preserve WebView2's runtime, process, storage, initialization, native-bridge, navigation, threading,
+lifecycle, security, performance, update, and deployment boundaries across WPF, WinForms, WinUI,
+and Win32 hosts.
+
+Treat WebView2 as a Chromium process group, a persistent browser profile, and a native RPC boundary,
+not as a browser-shaped UI control whose lifetime ends when a window disappears.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- `Microsoft.Web.WebView2`, `CoreWebView2*`, `ICoreWebView2*`, `EnsureCoreWebView2Async`,
+  `CreationProperties`, `WebMessageReceived`, `PostWebMessageAsJson`, host objects, virtual host
+  mappings, document or frame origins, navigation events, popups, downloads, permissions, process
+  events, profiles, or user data folders change.
+- A WPF, WinForms, WinUI, or Win32 application creates, disposes, recycles, packages, diagnoses, or
+  tests WebView2 controls or environments.
+- The task chooses or changes Evergreen versus Fixed Version Runtime distribution, feature
+  detection, prerelease SDK usage, runtime update adoption, or enterprise update policy.
+- The task investigates initialization failures, incompatible environment options, UDF locks,
+  bridge authorization, stale document responses, Runtime update adoption, process-failure
+  classification, memory retention, process growth, shutdown delay, rendering stalls, GPU behavior,
+  popup or download bugs, or packaged Runtime availability.
+- Durable guidance makes exact claims about current WebView2 SDKs, Runtimes, preview channels,
+  release cadence, API stability, platform support, or distribution requirements.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task is ordinary frontend code with no WebView2 host, native bridge, profile, runtime, or
+  packaged behavior; use the matching frontend skill.
+- The task changes a Tauri or Wails application without direct WebView2 APIs or Windows-specific
+  runtime behavior; use `tauri-code-change` or `wails-code-change`.
+- The task is only generic desktop memory analysis with no WebView2-specific lifecycle or process
+  boundary; use `desktop-memory-footprint-review`.
+- The task only refreshes an external version statement and does not change WebView2 procedure;
+  use `source-freshness-check` or `version-freshness-check`.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Host stack and target: WPF, WinForms, WinUI, or Win32; packaged or unpackaged; architecture;
+  minimum Windows version; installed SDK package; Runtime distribution mode; and target channels.
+- Environment ledger: Runtime executable folder, normalized user data folder, environment options,
+  profile name, InPrivate choice, owner, sharing boundary, initialization call sites, and first
+  navigation trigger.
+- Trust ledger: top-level origins, frame origins, virtual host mappings, remote content, injected
+  scripts, web-message commands, host objects, native capabilities, navigation and redirect policy,
+  popups, downloads, permissions, external schemes, and document-generation rules.
+- Ownership ledger: control, controller, environment, profile, process group, document generation,
+  frame, navigation, child window, download, deferral, event subscription, pending bridge request,
+  disposal, update, and restart owners.
+- Failure evidence: exception or HRESULT, effective environment options, actual UDF path, Runtime
+  and SDK versions, process kind, source origin, crash reason, packaged or unpackaged state, and
+  reproduction sequence.
+- Performance evidence: browser, renderer, GPU, or helper process identity; WebView and window
+  count; navigation id; page and host timestamps; bridge request ids; memory metric; DevTools or OS
+  trace; hidden or suspended state; and before-open, steady-state, after-close, and repeated-cycle
+  observations.
+- Current official Microsoft documentation before preserving exact version, release-date,
+  stable-versus-prerelease, API phase, runtime cadence, or deployment claims.
+- Configured verification intents for host builds, focused tests, packaged startup, runtime
+  detection, initialization, UDF/profile behavior, bridge security, navigation, lifecycle, memory,
+  performance, update adoption, and docs.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- Identify the host framework and actual WebView2 SDK and Runtime evidence before changing API
+  calls. Do not infer Runtime capability from the NuGet version alone.
+- Distinguish stable APIs, prerelease or experimental APIs, Runtime-only fixes, and future plans.
+  Feature-detect recent APIs where deployed Evergreen clients may lag or enterprise policy may
+  block updates.
+- Refresh official release notes and concept documentation before writing date-sensitive claims.
+  If freshness cannot be checked, keep the procedure version-agnostic and report the gap.
+- Treat web content, messages, frames, paths, URLs, file objects, permission requests, and host
+  object arguments as untrusted even when the HTML is bundled with the app.
+- Keep command execution within the selected repository's configured intents.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Update WebView2 host initialization, environment registries, profile and UDF policy, bridge DTOs
+  and handlers, document trust and navigation policy, popup/download/permission handlers, lifecycle
+  owners, update adoption, process-failure diagnostics, performance instrumentation, packaging,
+  tests, and directly synchronized docs or templates.
+- Add narrow state machines, registries, typed message envelopes, origin policies, resource
+  filters, cleanup paths, or feature-detection adapters when the existing ownership is implicit.
+- Keep framework-specific UI integration in the established WPF, WinForms, WinUI, or Win32 layer.
+- Do not delete or reset a UDF as a generic initialization retry, weaken origin or permission
+  checks to make navigation work, or adopt prerelease APIs as production requirements without an
+  explicit compatibility decision.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Read package metadata, target framework files, app startup, control creation, environment
+   construction, first navigation, event registration, bridge code, window shutdown, packaging,
+   tests, and diagnostic hooks. Record the host framework and Runtime distribution mode.
+2. Build one ownership map for four distinct lifetimes:
+   - native control and controller;
+   - `CoreWebView2Environment`, UDF, profile, and Chromium process group;
+   - top-level document, frames, scripts, and bridge requests;
+   - host window, application session, restart, update, and uninstall policy.
+   Do not use window visibility or field nulling as proof that the other lifetimes ended.
+3. Centralize environment creation. Key a shared initialization task by the effective Runtime path,
+   normalized UDF path, environment options, language, browser arguments, and access policy. Reject
+   incompatible options for an already-active UDF instead of racing a second environment into it.
+4. Make initialization an explicit state machine such as `Created -> Initializing -> Ready ->
+   Closing -> Closed` with one shared task and a generation or cancellation token. Apply creation
+   properties or the explicit environment before `EnsureCoreWebView2Async`; register handlers and
+   document-created scripts after successful initialization; navigate last. Do not let XAML or
+   constructor `Source` start an implicit default initialization first.
+5. Treat UDF and profile design as storage architecture:
+   - use a writable, user-local UDF path and avoid network drives;
+   - use multiple profiles inside one UDF for account separation within one trust boundary;
+   - use different UDFs only for process, trust, regulatory, or independent-lifecycle isolation;
+   - use stable opaque profile identifiers rather than email addresses or display names;
+   - distinguish logout, browsing-data clearing, profile deletion, factory reset, and uninstall;
+   - wait for all owning WebViews and browser processes to exit before moving or deleting a UDF.
+6. Choose Runtime distribution deliberately. Prefer Evergreen unless exact binary reproducibility
+   or a constrained certification contract justifies Fixed Version. For Fixed Version, require an
+   owned patch SLA, retained signed artifacts and hashes, architecture-specific packaging, update
+   and rollback tests, disk-budget evidence, and required filesystem permissions. For Evergreen,
+   handle continuous-running apps by coordinating release of all environments or a state-saving
+   restart after `NewBrowserVersionAvailable`.
+7. Bind bridge availability to the current trusted document generation. Issue a new document id or
+   generation at navigation start, complete a native-to-web handshake only after an allowed origin
+   is ready, reject requests from older generations, and cancel pending work when the document,
+   renderer, or control is replaced.
+8. Treat every native bridge as a privileged RPC surface:
+   - parse and compare exact normalized scheme, host, and effective port; never use prefix matching;
+   - keep top-level and frame origin policies separate;
+   - use a finite command allowlist with typed request and response schemas, size and depth limits,
+     request ids, timeouts, cancellation, idempotency for side effects, and bounded concurrency;
+   - bind pending requests to the current document generation and cancel them on navigation,
+     renderer loss, or disposal;
+   - send data through JSON message APIs instead of interpolating values into script source;
+   - expose small capability objects only when messages cannot meet the requirement, and recheck
+     native authorization on every host-object call.
+9. Separate trusted app content from external content when native capabilities differ. Prefer a
+   dedicated WebView for external pages. Configure scripts, web messages, host objects, and virtual
+   host mappings before first navigation. Map only the resource directory, deny unnecessary
+   cross-origin access, and keep sensitive files physically outside mapped trees and reparse-point
+   escape paths.
+10. Build navigation state around WebView instance, top-level versus frame scope, and
+    `NavigationId`:
+    - re-evaluate every redirect rather than trusting the first URL;
+    - keep same-document source or history changes separate from a new document generation;
+    - reject stale completion events after a newer navigation has started;
+    - use `IsSuccess`, `WebErrorStatus`, and HTTP status only for transport evidence, not business
+      success;
+    - keep request-header inspection separate from mutation and restrict injected headers to the
+      exact resource context and origin.
+11. Route every escape from the current document through one native policy engine:
+    - top-level and frame navigation;
+    - `NewWindowRequested` and opener behavior;
+    - `LaunchingExternalUriScheme`;
+    - downloads and final save paths;
+    - script dialogs and permission requests.
+    Treat `IsUserInitiated` as a gesture signal, not authorization. Check the initiating frame and
+    destination, default-deny unknown schemes and origins, and keep permission decisions keyed by
+    origin and permission kind.
+12. Treat popups and downloads as owned asynchronous state:
+    - initialize a child WebView under a deferral before assigning `NewWindow`;
+    - dispose half-created children when initialization or the parent lifetime fails;
+    - distinguish `DownloadStarting.Handled` from `Cancel`;
+    - validate the final absolute save path against an allowed directory and safe filename policy;
+    - track `CoreWebView2DownloadOperation.State`, including unknown total length, until terminal
+      completion or interruption;
+    - unregister per-child and per-download handlers at their terminal state.
+13. Preserve the STA threading contract. Create, initialize, and access WebView2 on the UI STA
+    thread with a message pump. Keep one asynchronous initialization owner and do not block its
+    callbacks with `.Wait()` or `.Result`. When an event requires asynchronous policy work, acquire
+    its deferral, enter `try`, and complete exactly once in `finally`; track outstanding deferrals so
+    closing can cancel work and still terminate.
+14. Make shutdown idempotent and ordered: mark closing, reject new navigation, popup, bridge, and
+    download work, cancel pending operations, complete deferrals, close children, unregister events
+    from long-lived publishers, remove host objects, close or dispose the controller or control,
+    clear references, and wait for browser exit only when a Runtime or UDF operation requires it.
+    Hidden controls remain alive; choose hide, suspend, low-memory mode, and permanent disposal as
+    distinct policies.
+15. Coordinate Runtime update adoption and UDF maintenance at the environment-sharing boundary.
+    Stop bridge traffic, dispose every WebView using the UDF, release environment references, wait
+    for the owning browser process to exit when deletion or replacement requires it, and then create
+    the new environment. Recreating one window while another shares the UDF does not adopt a new
+    Runtime or release the profile lock.
+16. Classify `ProcessFailed` by process kind and reason before recovery. Distinguish normal exit,
+    abnormal exit, integrity failure, renderer unresponsiveness, launch failure, and whole browser
+    process exit when the deployed API exposes them. Use nullable crash details as diagnostics, not
+    as a required recovery input. Do not recreate for auto-recoverable GPU or utility exits. Coordinate
+    browser-process recovery with `BrowserProcessExited`, deduplicate events across controls, and
+    bound recovery by environment generation, retry count, backoff, and one concurrent recovery.
+17. Diagnose memory by ownership, not the total of every `msedgewebview2.exe` process. Separate
+    JavaScript heap and detached DOM, renderer memory, shared browser or helper processes, native
+    window/ViewModel retention, environment event cycles, host-object graphs, pending deferrals,
+    hidden controls, and expected caches. Pair process ids with UDF, kind, associated frames, active
+    controls, and repeated open-close evidence before calling growth a leak.
+18. Diagnose performance across page and host boundaries. Correlate page performance marks,
+    WebView2 event timestamps, navigation ids, process ids, bridge ids, DevTools/CDP traces, and host
+    or WPR/WPA traces. Check broad `WebResourceRequested` interception, synchronous UI-thread work,
+    bridge chatter, large payloads, slow or network UDF storage, security software, GPU fallback,
+    hidden controls, suspension, and low-memory targets before rewriting frontend code.
+19. Verify the smallest relevant matrix: supported Windows and host framework, installed Runtime
+    floor, Evergreen current and preview channel when compatibility matters, Fixed artifact when
+    used, packaged and unpackaged startup, first and repeated initialization, navigation and frame
+    denial, redirect denial, bridge negative cases, popup and download cancellation, deferral
+    completion, permission and external-scheme denial, process-failure recovery, repeated open-close
+    memory, planned restart, and UDF cleanup or retention policy.
+
+<!-- mustflow-section: hard-bans -->
+## Hard Bans
+
+- Do not treat the NuGet SDK version as proof of the installed Runtime version or API availability.
+- Do not set `Source` before custom environment initialization and then attempt to replace the
+  environment.
+- Do not delete a UDF because initialization threw an unclassified exception.
+- Do not authorize native work from `Source.StartsWith`, `IsUserInitiated`, a frontend role flag,
+  an arbitrary reflected method name, or a path supplied by JavaScript.
+- Do not expose a service container, application object, shell execution, unrestricted filesystem,
+  secrets, tokens, or broad host object to web content.
+- Do not leave event subscriptions, host objects, pending bridge requests, document generations,
+  environment references, deferrals, child windows, downloads, or profile locks without an explicit
+  owner and cleanup path.
+- Do not treat `IsUserInitiated`, `NavigationCompleted`, `DownloadStarting`, process count, or a
+  lower working set as proof of a safe destination, business success, completed download, memory
+  leak, or reduced live memory.
+- Do not ship prerelease or experimental API assumptions as a stable production contract without
+  feature detection, compatibility bounds, and fallback behavior.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- Host, SDK, Runtime, channel, distribution mode, environment, UDF, profile, document, and process
+  ownership are explicit.
+- Initialization, navigation, bridge, popup, download, permission, deferral, process failure,
+  update adoption, and UDF cleanup paths have bounded states and terminal cleanup.
+- Origin, frame, message schema, native authorization, permission, filesystem, and external-launch
+  boundaries are enforced on the native side.
+- Memory and performance claims name the process, metric, scenario, timestamps, and after-close or
+  recovery evidence.
+- Missing packaged, Runtime-channel, initialization, security-negative, lifecycle, memory, or
+  process diagnostic coverage is reported rather than hidden behind a generic frontend test.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `changes_status`
+- `changes_diff_summary`
+- `lint`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `mustflow_check`
+
+Report missing WebView2-specific intents when relevant: packaged startup smoke, installed Runtime
+detection, SDK/Runtime compatibility, custom-environment initialization, UDF/profile isolation,
+origin and frame denial, malformed or oversized bridge messages, host-object reachability,
+document-generation invalidation, redirect denial, popup initialization, download cancellation and
+path safety, deferral completion, permission and external-scheme denial, process-failure recovery,
+repeated open-close memory, Evergreen restart adoption, Fixed Version packaging, GPU fallback, and
+preview-channel regression.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If initialization fails, classify environment option mismatch, UDF path or permission, Runtime
+  discovery, window handle, UI thread, disposed control, policy override, and browser-process exit
+  before retrying or touching stored data.
+- If a blank view appears only after packaging, inspect built assets, virtual host mappings, CSP,
+  navigation denial, Runtime availability, architecture loaders, and packaged path permissions
+  before changing application state.
+- If bridge responses are stale or duplicated, add document generations, request correlation,
+  cancellation, idempotency, and bounded queues before adding retries.
+- If a UDF remains locked, inspect shared environments, other app instances, active WebViews,
+  environment references, and browser-process exit before deleting, moving, or recreating it.
+- If a popup, download, dialog, permission, or external launch hangs, inspect deferral completion,
+  parent lifetime, initiating frame, terminal operation state, and event cleanup before adding a
+  retry or bypass.
+- If memory or processes remain after close, inspect shared UDF ownership, environment event cycles,
+  host objects, child windows, downloads, deferrals, hidden controls, renderer heap, and expected
+  caches before forcing termination or trimming working sets.
+- If a performance trace disagrees with page timing, preserve both observations and correlate the
+  page, WebView event, process, bridge, and OS timelines before assigning the bottleneck.
+- If exact current release claims cannot be refreshed from official sources, remove the precise
+  claim from durable guidance and report the unverified boundary.
+- If repository intents cannot exercise a Windows or packaged path, report the missing platform
+  evidence and keep the completion claim limited to the checks actually run.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- WebView2 boundary checked
+- Host, SDK, Runtime, channel, and distribution mode
+- Environment, UDF, profile, process, document, frame, and lifecycle ownership notes
+- Initialization, UDF/profile, document/frame trust, bridge, and native authorization findings
+- Navigation, redirect, popup, download, permission, external-launch, and deferral findings
+- Runtime distribution, lifecycle, update adoption, process-failure, memory, performance, and
+  packaging findings
+- Files changed
+- Command intents run
+- Skipped checks and reasons
+- Remaining WebView2 risk

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.115.11"
+version = "2.115.14"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"
@@ -132,6 +132,8 @@ creates = [
   ".mustflow/skills/tailwind-code-change/SKILL.md",
   ".mustflow/skills/tauri-code-change/SKILL.md",
   ".mustflow/skills/wails-code-change/SKILL.md",
+  ".mustflow/skills/webview2-code-change/SKILL.md",
+  ".mustflow/skills/hetzner-cloud-change/SKILL.md",
   ".mustflow/skills/typescript-code-change/SKILL.md",
   ".mustflow/skills/unocss-code-change/SKILL.md",
   ".mustflow/skills/cli-option-contract-review/SKILL.md",
@@ -373,6 +375,8 @@ minimal = [
   "tailwind-code-change",
   "tauri-code-change",
   "wails-code-change",
+  "webview2-code-change",
+  "hetzner-cloud-change",
   "typescript-code-change",
   "unocss-code-change",
   "command-contract-authoring",
@@ -550,6 +554,8 @@ patterns = [
   "tailwind-code-change",
   "tauri-code-change",
   "wails-code-change",
+  "webview2-code-change",
+  "hetzner-cloud-change",
   "typescript-code-change",
   "unocss-code-change",
   "command-contract-authoring",
@@ -738,6 +744,8 @@ oss = [
   "tailwind-code-change",
   "tauri-code-change",
   "wails-code-change",
+  "webview2-code-change",
+  "hetzner-cloud-change",
   "typescript-code-change",
   "unocss-code-change",
   "cli-option-contract-review",
@@ -945,6 +953,8 @@ team = [
   "tailwind-code-change",
   "tauri-code-change",
   "wails-code-change",
+  "webview2-code-change",
+  "hetzner-cloud-change",
   "typescript-code-change",
   "unocss-code-change",
   "command-contract-authoring",
@@ -1136,6 +1146,8 @@ product = [
   "tailwind-code-change",
   "tauri-code-change",
   "wails-code-change",
+  "webview2-code-change",
+  "hetzner-cloud-change",
   "typescript-code-change",
   "unocss-code-change",
   "command-contract-authoring",
@@ -1333,6 +1345,8 @@ library = [
   "tailwind-code-change",
   "tauri-code-change",
   "wails-code-change",
+  "webview2-code-change",
+  "hetzner-cloud-change",
   "typescript-code-change",
   "unocss-code-change",
   "cli-option-contract-review",