mustflow 2.115.9 → 2.115.13

package/README.md

@@ -302,7 +302,7 @@ mf run mustflow_update_apply
 | `mf script-pack list` | List bundled script packs, script refs, routing hints, side-effect flags, input/output labels, and JSON schema files. |
 | `mf script-pack suggest --changed --json` | Rank optional read-only helpers for current changed files without running those helpers or granting command authority. |
 | `mf script-pack suggest --path <path> --phase before_change` | Rank helpers for an explicit path and workflow phase before deciding which script to run. |
-| `mf script-pack run code/outline scan <path...> --json` | Scan supported source files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
+| `mf script-pack run code/outline scan <path...> --json` | Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
 | `mf script-pack run code/dependency-graph scan <path...> --json` | Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files. |
 | `mf script-pack run code/module-boundary check <path...> --json` | Check configured module-boundary import rules, import cycles, public entrypoints, feature imports, and shared budgets. |
 | `mf script-pack run code/change-impact analyze --base HEAD --json` | Analyze changed files and return bounded impact candidates, script-pack hints, and verification intent hints. |

package/dist/cli/i18n/en.js

@@ -797,7 +797,7 @@ Read these files before working:
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ Read these files before working:
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ Read these files before working:
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/es.js

@@ -797,7 +797,7 @@ Lee estos archivos antes de trabajar:
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ Lee estos archivos antes de trabajar:
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ Lee estos archivos antes de trabajar:
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/fr.js

@@ -797,7 +797,7 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ Lisez ces fichiers avant de travailler :
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/hi.js

@@ -797,7 +797,7 @@ export const hiMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ export const hiMessages = {
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ export const hiMessages = {
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/dist/cli/i18n/ko.js

@@ -797,7 +797,7 @@ export const koMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "TypeScript와 JavaScript 파일에서 symbol header와 라인 범위를 스캔합니다",
+    "scriptPack.script.codeOutline.summary": "TypeScript, JavaScript, Astro, Svelte, Go, Rust, Python 파일에서 symbol header와 라인 범위를 스캔합니다",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ export const koMessages = {
     "scriptPack.error.unknownScript": "알 수 없는 script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "추천 입력을 하나 이상 제공하세요: --path <path>, --changed, --phase <phase>, 또는 --skill <skill>",
     "scriptPack.error.unknownPhase": "알 수 없는 script-pack phase: {phase}",
-    "codeOutline.help.summary": "TypeScript와 JavaScript 소스 파일에서 declaration header, 라인 범위, export flag, content hash를 스캔합니다.",
+    "codeOutline.help.summary": "TypeScript, JavaScript, Astro, Svelte, Go, Rust, Python 소스 파일에서 declaration header, 라인 범위, export flag, content hash를 스캔합니다.",
     "codeOutline.help.option.maxFiles": "스캔할 최대 소스 파일 수입니다. 기본값: 200",
     "codeOutline.help.option.maxFileBytes": "각 소스 파일에서 읽을 최대 바이트입니다. 기본값: 1048576",
     "codeOutline.help.exit.ok": "code outline을 finding 없이 스캔했습니다",
@@ -842,7 +842,7 @@ export const koMessages = {
     "codeOutline.error.missingPath": "스캔할 소스 파일이나 디렉터리를 하나 이상 제공하세요",
     "codeOutline.error.invalidPositiveInteger": "{option}은 양의 safe integer여야 합니다: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option}은 0 이상의 safe integer여야 합니다: {value}",
-    "codeSymbolRead.help.summary": "source anchor, symbol 라인, 또는 명시 라인 범위에서 제한된 TypeScript 또는 JavaScript source snippet을 읽습니다.",
+    "codeSymbolRead.help.summary": "source anchor, symbol 라인, 또는 명시 라인 범위에서 지원되는 소스의 제한된 snippet을 읽습니다.",
     "codeSymbolRead.help.option.anchor": "target symbol로 해석할 source anchor id입니다",
     "codeSymbolRead.help.option.startLine": "symbol 또는 범위로 해석할 1-based source line입니다",
     "codeSymbolRead.help.option.endLine": "선택적 1-based end line입니다. 생략하면 포함하는 outline symbol을 읽습니다",

package/dist/cli/i18n/zh.js

@@ -797,7 +797,7 @@ export const zhMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
-    "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeOutline.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python files for symbol headers and line ranges",
     "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
     "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
     "scriptPack.script.codeModuleBoundary.summary": "Check configured module boundary import rules and shared budgets",
@@ -825,7 +825,7 @@ export const zhMessages = {
     "scriptPack.error.unknownScript": "Unknown script-pack script: {script}",
     "scriptPack.error.missingSuggestInput": "Provide at least one suggestion input: --path <path>, --changed, --phase <phase>, or --skill <skill>",
     "scriptPack.error.unknownPhase": "Unknown script-pack phase: {phase}",
-    "codeOutline.help.summary": "Scan TypeScript and JavaScript source files for declaration headers, line ranges, export flags, and content hashes.",
+    "codeOutline.help.summary": "Scan TypeScript, JavaScript, Astro, Svelte, Go, Rust, and Python source files for declaration headers, line ranges, export flags, and content hashes.",
     "codeOutline.help.option.maxFiles": "Maximum number of source files to scan. Default: 200",
     "codeOutline.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 1048576",
     "codeOutline.help.exit.ok": "The code outline was scanned without findings",
@@ -842,7 +842,7 @@ export const zhMessages = {
     "codeOutline.error.missingPath": "Provide at least one source file or directory to scan",
     "codeOutline.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "codeOutline.error.invalidNonNegativeInteger": "{option} must be a non-negative safe integer: {value}",
-    "codeSymbolRead.help.summary": "Read a bounded TypeScript or JavaScript source snippet from a source anchor, symbol line, or explicit line range.",
+    "codeSymbolRead.help.summary": "Read a bounded supported-source snippet from a source anchor, symbol line, or explicit line range.",
     "codeSymbolRead.help.option.anchor": "Source anchor id to resolve to its target symbol",
     "codeSymbolRead.help.option.startLine": "1-based source line to resolve to a symbol or range",
     "codeSymbolRead.help.option.endLine": "Optional explicit 1-based end line; when omitted, the containing outline symbol is read",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.115.9",
+  "version": "2.115.13",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/templates/default/common/.mustflow/config/mustflow.toml

@@ -321,9 +321,7 @@ on_limit = "stop_and_report"
 required_for = [
   "git_commit",
   "git_push",
-  "dependency_install",
   "dependency_upgrade",
-  "network_access",
   "database_migration",
   "destructive_command",
   "secret_access",

package/templates/default/i18n.toml

@@ -62,7 +62,7 @@ translations = {}
 [documents."skills.index"]
 source = "locales/en/.mustflow/skills/INDEX.md"
 source_locale = "en"
-revision = 237
+revision = 239
 translations = {}
 
 [documents."skill.ada-code-change"]
@@ -889,7 +889,7 @@ translations = {}
 [documents."skill.svelte-code-change"]
 source = "locales/en/.mustflow/skills/svelte-code-change/SKILL.md"
 source_locale = "en"
-revision = 4
+revision = 5
 translations = {}
 
 [documents."skill.tailwind-code-change"]
@@ -1095,6 +1095,12 @@ source_locale = "en"
 revision = 24
 translations = {}
 
+[documents."skill.performance-measurement-integrity-review"]
+source = "locales/en/.mustflow/skills/performance-measurement-integrity-review/SKILL.md"
+source_locale = "en"
+revision = 2
+translations = {}
+
 [documents."skill.pattern-scout"]
 source = "locales/en/.mustflow/skills/pattern-scout/SKILL.md"
 source_locale = "en"
@@ -1140,7 +1146,7 @@ translations = {}
 [documents."skill.state-machine-pattern"]
 source = "locales/en/.mustflow/skills/state-machine-pattern/SKILL.md"
 source_locale = "en"
-revision = 4
+revision = 5
 translations = {}
 
 [documents."skill.strategy-pattern"]

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 237
+revision: 239
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -614,6 +614,7 @@ routes. Event routes stay inactive until their event occurs.
 | Source anchors are added, revised, reviewed, or used to mark a module boundary | `.mustflow/skills/source-anchor-authoring/SKILL.md` | Target files, anchor reason, nearby anchors, source-anchor policy, and validation surface | Source anchors and directly related workflow docs or comments | comment bloat, authority drift, false verification claims, or hidden module pressure | `mustflow_check`, `docs_validate_fast` | Anchor placement decision, field choices, module-boundary handoff, and verification |
 | Changed files need risk classification and verification selection | `.mustflow/skills/diff-risk-review/SKILL.md` | Changed-file list, diff summary, and task goal | Changed surfaces and verification report | under- or over-verification | `changes_status`, `changes_diff_summary`, `test`, `test_related`, `test_audit`, `lint`, `build`, `docs_validate`, `mustflow_check` | Risk level, verification choice, rollback notes |
 | Runtime performance, hot paths, user-perceived latency, p95/p99 tail latency, throughput, infrastructure cost, memory, GC pressure, CPU cache locality, allocation churn, bundle size, payload size, HTTP delivery, compression, streaming latency, media loading, build time, filesystem scanning, process spawning, IPC/RPC/DB/API fan-out, N+1 work, repeated filtering/sorting/parsing/serialization, caching, pagination, queues, virtualization, backpressure, or performance claims are planned, edited, reviewed, or reported | `.mustflow/skills/performance-budget-check/SKILL.md` | Performance surface, hot-path shape, input scale, measurement method, baseline and result when available, correctness boundaries, isolation surface, and command contract entries | Data access, lookup indexes, grouping, projection, batching, scheduling, rendering, cache boundaries, queues, concurrency limits, cancellation, measurements, docs, tests, and directly synchronized templates | invented budgets, stale measurements, hidden O(n²), misleading Big-O or data-structure claims, N+1 queries or RPC, unbounded materialization, repeated serialization, object churn, GC pressure, broad rerender, false compression win, buffered stream latency, cache stampede, key explosion, queue backlog, pool exhaustion, stale async result, or speed-over-correctness tradeoff | `changes_status`, `changes_diff_summary`, `build`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Hot path, ROI priority, cost multiplier, measurement or complexity evidence, semantic preservation, optimization applied, verification, and remaining performance risk |
+| Performance counters, timers, histograms, cache ratios, CPU PMU evidence, batch or queue throughput, communication IPC outcomes, cross-process latency, cancellation cost, benchmark results, profiler artifacts, regression gates, or performance logs need review for semantic correctness, concurrency safety, comparable evidence, coordinated-omission resistance, and sensitive-data containment | `.mustflow/skills/performance-measurement-integrity-review/SKILL.md` | Measurement question and decision, event lifecycle, unit and denominator ledger, time and clock-domain model, concurrency and snapshot model, workload and comparison evidence, CPU event and scheduling evidence, cross-layer phase evidence, artifact and telemetry boundary, tests or schemas, and configured command intents | Event definitions, lifecycle counters, units, histograms, operation context, snapshot and reset logic, batch and queue stage metrics, cancellation resource ledgers, CPU counter normalization, PMU grouping checks, communication outcome conservation, cross-layer phase closure, benchmark schemas, comparison rules, budgets, artifact sanitization, canary scans, focused tests, and directly synchronized templates | logical command and attempt collapse, submit counted as start, inconsistent atomic snapshot, thread-local async timer, cross-process monotonic subtraction, wall/CPU/wait collapse, coordinated omission, instrumentation contention, exporter-biased tail, ratio averaging, CPU IPC and communication IPC ambiguity, multiplexed PMU ratio, cache-hit-rate theater, hybrid-core or NUMA drift, request/key/byte cache-rate collapse, batch/item weighting drift, useful/attempted throughput collapse, start/finish cohort mismatch, partial-success collapse, duplicate terminal metric, client/server outcome overwrite, layer-p99 addition, invented presentation boundary, cancellation boolean theater, rerun-until-pass, incomparable benchmark, raw path or remote leakage, unsafe profile artifact, or unverified regression gate | `changes_status`, `changes_diff_summary`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Performance measurement boundary reviewed, event/lifecycle/unit/clock/snapshot/CPU-counter/cache/communication-IPC/cross-layer/batch/queue/cancellation/benchmark/privacy findings, evidence level, verification, and remaining measurement-integrity risk |
 | Installed app startup needs launch-path review for Android, iOS, React Native, Flutter, Tauri mobile, Electron, desktop app shells, cold start, warm start, hot start, splash, first frame, fully usable state, TTID, TTFD, `reportFullyDrawn()`, Android Vitals, Xcode Organizer, Instruments, Application or AppDelegate work, ContentProvider auto-init, AndroidX App Startup, dependency injection graph creation, SDK initialization, static initializers, main-thread disk or network work, cached startup snapshots, auth or config gates, launch migrations, first-screen layout or assets, custom fonts, Baseline Profile, Startup Profile, Macrobenchmark, Perfetto, Hermes, import graphs, deferred components, shader warmup, on-demand modules, and post-first-frame work queues | `.mustflow/skills/app-startup-performance-review/SKILL.md` | Startup scope ledger, measurement ledger, launch critical-path ledger, main-thread blocking ledger, first usable state ledger, first-screen render ledger, deferred work ledger, platform optimization ledger, existing tests, package surfaces, synchronized docs or templates, and configured command intents | Application or AppDelegate cleanup, auto-init control, lazy or scoped DI and SDK setup, static initializer cleanup, main-thread I/O removal, cache snapshot startup, auth or config gate deferral, maintenance-work scheduling, first-screen simplification, asset and font reductions, Android startup profiles, iOS launch tooling, hybrid import or preload cleanup, deferred queue ownership, startup tests, and directly synchronized docs or templates | splash masking, early `reportFullyDrawn()` metric gaming, debug-only measurement, simulator-only or flagship-only startup claims, app delegate warehouse, ContentProvider surprise init, eager DI graph construction, SDK auto-init, static initializer cost, main-thread disk or network, network-first startup dependency, launch migration or cleanup stall, heavy first screen, oversized launch asset, custom font bloat, React Native top-level import bloat, Flutter shader surprise, unowned deferred work, or missing release/device/profiler evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | App startup boundary reviewed, first frame and fully usable state, measurement evidence, critical path findings, lazy-init and defer decisions, platform tooling, verification, and remaining app-startup performance risk |
 | Desktop background process stability needs recovery review for Windows services, SCM failure actions, preshutdown handlers, service SIDs, Session 0 boundaries, scheduled tasks, macOS LaunchDaemons or LaunchAgents, launchd daemon or agent placement, launchd-managed helpers, Linux systemd user or system units, restart policy, start-rate limits, Electron main or utility processes, WebView helpers, tray apps, sync workers, local daemons, auto-start helpers, updaters, crash recovery, durable checkpoints, single-instance locks, data-directory locks, stale locks, OS supervisor configuration, restart backoff, PID-only health checks, progress heartbeats, job leases, idempotent jobs, atomic file writes, shutdown-only persistence, exit-code semantics, UI and worker lifecycle separation, sleep or resume, monotonic time, local IPC authorization, environment and working-directory determinism, least privilege, early logs, crash reporting, update drain, lifecycle tests, or safe mode | `.mustflow/skills/desktop-background-process-stability-review/SKILL.md` | Process ledger, recovery ledger, instance ledger, supervisor ledger, health ledger, lifecycle ledger, security ledger, existing tests, telemetry or crash evidence, package surfaces, synchronized docs or templates, and configured command intents | Durable checkpoints, startup recovery, stale-lock cleanup, data-directory locks, early single-instance lock acquisition, lease states, idempotency keys, atomic write-temp/flush/fsync/rename paths, progress health checks, heartbeats with job and offset fields, supervisor restart backoff and start-rate limits, user-stop versus crash-restart state, UI/worker process split, launchd daemon/agent placement, Session 0 IPC separation, sleep/resume revalidation, monotonic timers, IPC ACLs and schema versions, explicit environment, least-privilege service configuration, early crash/log setup, update drain, safe mode, lifecycle tests, and directly synchronized docs or templates | immortal-process fantasy, memory-only progress, restart that re-enters corruption, late single-instance lock, process lock mistaken for resource lock, one processing boolean, duplicate side effect after lease recovery, half-written local JSON, shutdown-hook-only persistence, hand-rolled mini supervisor, unbounded crash loop, user stop ignored by scheduled restart, PID-as-health, `last_seen_at` heartbeat theater, UI and worker lifecycle tangle, service UI from Session 0, daemon/agent mismatch, daemonizing under launchd, boot-order network assumption, wall-clock lease timer, trusted localhost IPC, inherited PATH or working directory, overprivileged helper, missing early startup logs, crash reporter started too late, one-shot migration, update deletes rollback path too early, untested sleep/resume, or no safe mode | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Desktop background process stability boundary reviewed, process/recovery/instance/supervisor/health/heartbeat/lease/atomic-write/shutdown/platform/power/time/IPC/environment/privilege/logging/crash/update/lifecycle/safe-mode findings, verification, and remaining desktop background stability risk |
 | Desktop automatic update safety needs review for Electron autoUpdater, electron-builder feeds, Squirrel.Windows first-run locks, Sparkle appcasts, Tauri updater, macOS signed or notarized updates, Windows installers, Linux desktop packages, update endpoints, immutable artifacts, `.sig`, `.blockmap`, `latest.yml`, `latest.json`, `appcast.xml`, metadata pointer order, CDN cache policy, staged rollout, deterministic canary buckets, alpha/beta/stable channels, update kill switches, remote disable policy, signatures, hash verification, signing-key custody, key rotation, certificate expiry, notarization gates, single-flight update checks, quit-and-install timing, skipped-version upgrade paths, same-version republish recovery, updater telemetry, crash gates, or installed-app update smoke tests | `.mustflow/skills/desktop-auto-update-safety-review/SKILL.md` | Updater stack ledger, state-machine ledger, artifact ledger, trust ledger, rollout ledger, installed-client ledger, observability ledger, current updater code or release metadata, package surfaces, synchronized docs or templates, and configured command intents | Check/download/verify/stage/apply/relaunch state machines, immutable artifact names, artifact-before-metadata publishing order, latest pointer cache rules, signature and hash verification, signing-key custody, key rotation practice, certificate and notarization gates, physical channel separation, deterministic staged rollout, jitter and backoff, server-side no-update kill switch, single-flight update checks, Squirrel first-run delay, quit-and-install safety, installed old-version upgrade matrix, idempotent local migrations, old artifact retention, update telemetry, crash-free rollout gates, and directly synchronized docs or templates | remote code execution treated as convenience, mutable published artifact, metadata-before-artifact 404 wave, stale CDN latest pointer, hash or signature mismatch, release-server private key, unpracticed key rotation, certificate expiry surprise, stable client reading beta feed, random per-request canary, no kill switch, broken updater requires updater update, duplicate `checkForUpdates()` downloads, first-run installer lock, forced restart data loss, dev-mode updater test, skipped-version migration break, same-version hotfix fantasy, deleted old delta, download-complete-as-success, or missing installed-app smoke evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Desktop auto-update boundary reviewed, updater stack/state/artifact/trust/rollout/installed-client/migration/telemetry/kill-switch findings, verification, skipped updater diagnostics, and remaining desktop auto-update risk |

package/templates/default/locales/en/.mustflow/skills/performance-measurement-integrity-review/SKILL.md

@@ -0,0 +1,324 @@
+---
+mustflow_doc: skill.performance-measurement-integrity-review
+locale: en
+canonical: true
+revision: 2
+lifecycle: mustflow-owned
+authority: procedure
+name: performance-measurement-integrity-review
+description: Apply this skill when performance counters, timers, histograms, cache ratios, batch or queue throughput, cancellation cost, benchmark results, profiler artifacts, regression gates, or performance logs need review for semantic correctness, concurrency safety, comparable evidence, and sensitive-data containment.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.performance-measurement-integrity-review
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - build
+    - test_related
+    - test
+    - docs_validate_fast
+    - test_release
+    - mustflow_check
+---
+
+# Performance Measurement Integrity Review
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Make performance evidence mean what its name claims. Separate event semantics, units, clocks,
+concurrency guarantees, workload conditions, and privacy boundaries before using a number for an
+optimization claim, alert, budget, or release gate.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- Code adds or changes counters, gauges, timers, histograms, cache statistics, queue or batch
+  measurements, cancellation measurements, benchmark result files, performance budgets, profiler
+  artifacts, regression comparison, or automated performance gates.
+- A review must decide whether multithreaded, asynchronous, retried, deduplicated, hedged, batched,
+  queued, cancelled, or partially committed work is counted and timed correctly.
+- Performance logs or artifacts can expose paths, repository remotes, URLs, process arguments,
+  environment values, source text, heap contents, credentials, personal data, or internal topology.
+- A report claims a benchmark or telemetry series proves a regression, improvement, capacity,
+  cache efficiency, throughput, latency, or cancellation cost.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task only chooses or implements an optimization and the measurement contract is unchanged;
+  use `performance-budget-check`.
+- The task primarily asks whether operators can narrow an incident from general logs, metrics,
+  traces, dashboards, or alerts; use `observability-debuggability-review`.
+- The task primarily designs a load generator or test-suite runtime; use the matching load,
+  benchmark, or test-performance skill first and this skill only for measurement integrity.
+- A number is a local fixture with no performance meaning, comparison, or public contract.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- Measurement question and decision: what event, duration, resource, ratio, or regression is being
+  measured and what action the result may trigger.
+- Event lifecycle: logical command, attempt, accepted, started, completed, committed, acknowledged,
+  deduplicated, retried, rejected, dropped, cancelled, rolled back, and terminal boundaries.
+- Unit ledger: request, lookup, key, item, batch, chunk, byte, operation, worker-second, CPU-second,
+  wall-second, and any weighting or denominator.
+- Time model: monotonic versus wall clock, process boundary, scheduled arrival, queue wait, service
+  time, commit time, end-to-end time, CPU time, nested work, and unfinished work.
+- Concurrency model: update primitive, snapshot guarantee, context propagation, aggregation window,
+  reset behavior, sampling, contention, and instrumentation overhead.
+- Workload and comparison evidence: baseline, candidate, environment identity, scenario, input size,
+  concurrency, cache state, warmup, repetitions, raw samples, and statistical decision rule.
+- Hardware-counter evidence when used: CPU model and core type, event definitions, counter grouping,
+  multiplexing or running percentage, affinity, NUMA placement, working-set size, and normalization
+  by attempted or completed logical operation.
+- Cross-layer latency evidence when used: trace identity, phase sequence, clock domain, payload size,
+  ingress and handoff boundaries, executor or event-loop queueing, presentation boundary, sampling
+  decision, and dropped-event count.
+- Artifact and telemetry boundary: schema version, retention, exporter or collector path, redaction,
+  artifact formats, access policy, and recursive secret or path scanning.
+- Relevant tests, benchmark fixtures, profiler outputs, schemas, budgets, and configured command intents.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- The task matches the Use When conditions and does not match the exclusions.
+- Existing metric, benchmark, profiler, telemetry, redaction, and result-schema conventions have
+  been searched before introducing a new shape.
+- Missing workload, snapshot, privacy, or comparison evidence can be reported without inventing it.
+- Apply `security-privacy-review` when sensitive data or trust-boundary policy changes, and apply
+  `performance-budget-check` when the task also changes the optimized implementation or budget.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Add or tighten event definitions, metric names, units, lifecycle counters, histograms, context
+  propagation, snapshot logic, reset handling, benchmark schemas, comparison rules, budgets,
+  artifact sanitization, canary scans, and focused tests tied to the measurement contract.
+- Replace ambiguous averages or ratios with source counters and mergeable distributions whose
+  denominator and weighting are explicit.
+- Replace raw paths, remotes, URLs, arguments, environment values, and identifiers with bounded
+  logical names, route templates, classifications, or keyed pseudonyms where policy permits.
+- Do not add a telemetry vendor, profiler service, load generator, background process, network call,
+  or raw command outside the configured command contract.
+- Do not weaken correctness, privacy, or reproducibility merely to reduce instrumentation overhead.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Define each measured event before naming a counter.
+   - Separate one logical command from attempts, accepted work, started work, terminal outcomes,
+     durable commits, deduplication, retries, hedges, drops, and rollbacks.
+   - Place increments at the transition they claim to count. Pool size, queue size, or submit calls
+     are not substitutes for started or committed work.
+2. Define the unit and denominator.
+   - Keep request, lookup, key, item, batch, chunk, byte, and resource-time units separate.
+   - For cache evidence, distinguish request, key, and byte hit rates plus lookup outcome, load
+     outcome, coalesced wait, refresh, negative or stale hit, and served source where relevant.
+   - Aggregate source counts before deriving a ratio; do not average per-worker or per-instance ratios.
+3. Review counter concurrency and snapshot semantics.
+   - An atomic increment prevents lost updates; it does not make several independently read totals
+     one consistent snapshot.
+   - If numerator, denominator, count, and duration must describe one observation window, use a
+     joint observation, mergeable histogram, epoch handoff, or explicit synchronization whose cost
+     and guarantee are documented.
+   - Check overflow, process restart, counter reset, scrape gaps, aggregation-window length, and
+     sawtooth batch completion before deriving rates.
+4. Review timer ownership and clocks.
+   - Attach timing state to the operation or trace context, not an assumed worker thread.
+   - Use a monotonic clock for elapsed time within one clock domain. Do not subtract monotonic values
+     from different processes. Use event timestamps and trace context for distributed timelines and
+     state the clock-error boundary.
+   - Split wall, CPU, lock wait, I/O wait, queue wait, batch-fill wait, service, commit, ack, and
+     end-to-end time when those phases can drive different decisions.
+5. Preserve parallel and unfinished work semantics.
+   - Distinguish elapsed time from cumulative worker time and exclusive time; parent and child timers
+     may intentionally overlap and must not be summed as one elapsed duration.
+   - Record terminal outcome and duration for failures, timeouts, and observed cancellations. Track
+     in-flight age, oldest queued age, and abandoned age so non-completing work is not deleted from
+     latency evidence.
+   - For offered-load tests, preserve scheduled arrival or another open-loop reference when a
+     closed-loop client would hide coordinated omission.
+6. Bound instrumentation distortion.
+   - Check shared-counter contention, false sharing, allocation, label cardinality, clock-read cost,
+     event volume, profiler overhead, and sampling bias.
+   - Per-thread or striped accumulation trades short-window snapshot precision for lower contention;
+     document that trade instead of calling both properties exact.
+   - Measure disabled, minimally recorded, and fully recorded modes under the same workload when
+     instrumentation can change code layout, inlining, vectorization, allocation, lock hold time,
+     exporter backpressure, or tail latency. A no-op sink does not remove event construction cost.
+   - Apply sampling before expensive field construction where possible. Tail sampling can reduce
+     retained or exported data after recording; it does not refund span creation and attribute work.
+   - Observe exporter capacity, queue age or utilization, enqueue failure, and dropped signals. A
+     pipeline that drops more telemetry during slow periods can make the measured tail look better.
+   - Measure the empty timing or recording path to establish resolution and overhead. For work near
+     that floor, batch repeated operations and report the resulting precision limit.
+7. Model batch, queue, and throughput stages.
+   - Record batch, chunk, item, input-byte, and output-byte counts plus batch-size distribution.
+   - Separate offered, admitted, started, computed, committed, rejected, expired, dropped, duplicate,
+     retried, discarded, and rolled-back work. Report useful throughput and attempted throughput.
+   - Split batch-fill wait, admission wait, queue wait, time to first result, processing span, commit,
+     acknowledgement, and end-to-end latency. Keep item-weighted and batch-weighted distributions distinct.
+   - Condition latency on bounded batch-size or cost classes and inspect stragglers, shard skew,
+     head-of-line blocking, busy worker time, CPU time, and active concurrency.
+8. Treat cancellation as a lifecycle and a resource ledger.
+   - Separate requested, accepted, observed by worker, side effects stopped, and terminal cancelled.
+   - Measure reaction time, drain time, work completed before observation, work attempted after
+     observation, post-cancel CPU or worker time, cleanup, rollback, orphaned side effects, restart
+     rework, and backlog recovery when applicable.
+   - A cancellation API returning success does not prove execution or side effects stopped.
+9. Make benchmark evidence comparable.
+   - Use a versioned result schema containing scenario and environment identity, commit or build
+     identity, raw samples, units, warmup, repetitions, input size, concurrency, cache state, and
+     measurement-tool version.
+   - Compare base and candidate under the same controlled environment, preferably interleaved on
+     the same machine. Gate on a predeclared practical effect threshold and uncertainty rule, not
+     one noisy average or a favorable rerun.
+   - Combine relative and absolute budgets and cover representative size, concurrency, cache, and
+     scaling scenarios. Keep bounded retry policy; never rerun until a desired result appears.
+   - Use a fast representative pull-request subset and broader scheduled or merge-queue evidence
+     when cost requires tiers. Profile or bisect after a regression is confirmed, not as a substitute
+     for a reproducible comparator.
+10. Validate hardware-counter and cache claims.
+    - Disambiguate CPU IPC, meaning retired instructions per CPU cycle, from inter-process
+      communication. Spell out the term when both concepts appear in the same scope.
+    - Normalize instructions, cycles, misses, and transferred bytes by the same attempted or
+      successfully completed logical operation used by the outcome model. Preserve both denominators
+      when failures differ between candidates.
+    - Treat hit rate as explanatory evidence, not the final optimization result. Review references
+      per operation, misses per operation, misses per instruction, cycles per operation, latency,
+      throughput, errors, and tail latency together.
+    - Confirm each performance-monitoring event's meaning for the actual CPU. Generic cache events,
+      speculative accesses, prefetches, and cache levels are not portable semantic contracts.
+    - Check whether ratio inputs ran simultaneously. If limited hardware counters were multiplexed,
+      preserve running percentages and group dependent events or reject ratios whose overlap is too
+      weak for the workload phase length.
+    - Keep different hybrid core types separate. Control CPU affinity and memory or NUMA placement
+      for the comparison, then repeat under representative scheduler interference.
+    - Sweep working sets across relevant cache boundaries and concurrency across one to saturation.
+      Compare cold, warmup, steady-state, single-thread, contended, and near-saturation scenarios
+      separately. Inspect memory-bound classification, miss latency or source, cache-line ownership,
+      and false sharing before attributing an improvement to cache behavior.
+    - Do not infer cause from CPU IPC alone. A branch, vectorization, compiler, overlap, or algorithm
+      change can alter it; require end-result improvement plus a consistent causal evidence chain.
+11. Preserve communication outcome and conservation semantics.
+    - Keep a logical operation distinct from transport attempts, child work, retries, hedges, and
+      units within a partial result. Report logical success, attempt success, attempt amplification,
+      full or partial operation outcome, and unit outcome with explicit denominators.
+    - Make terminal outcomes mutually exclusive and finalize one logical operation once. Timeout,
+      cancellation, transport failure, application failure, rejection, process loss, partial success,
+      and full success must not double-decrement in-flight work or double-record duration.
+    - Do not divide starts and finishes from the same wall-time window as if they were one cohort.
+      For closed reports, group by start cohort through terminal or deadline. For live views, show
+      terminal ratios beside in-flight count, oldest age, and the started-versus-finished gap.
+    - Separate client outcome, server execution outcome, and delivery outcome. A caller deadline can
+      coexist with a later durable server commit; expose late completion and post-cancel work rather
+      than overwriting one fact with another.
+    - Record all terminal outcomes in one bounded-label duration family, then view outcome-specific
+      distributions. Treat cancelled observations as cancellation timing or censored completion
+      evidence, not successful completion latency.
+    - Define conservation checks such as admitted equals terminal plus in-flight, and requested units
+      equal terminal unit outcomes plus remaining units within the stated snapshot tolerance. Use a
+      monotonic terminal transition and idempotent unit identity to detect missing or duplicate events.
+12. Decompose cross-process and user-visible latency.
+    - Build one trace-scoped phase sequence from actual input occurrence through frontend queueing,
+      preparation, encoding, bridge ingress, decode, executor queue, active execution and waits,
+      response encoding and handoff, native receipt, event-loop continuation, framework commit, and
+      presentation when those boundaries are observable.
+    - Mark every timestamp with its clock domain. Do not directly subtract browser, process, or host
+      monotonic clocks. Use bounded ping-pong offset and drift estimation or retain per-domain spans
+      with an explicit uncertainty interval.
+    - Distinguish async object or future creation, spawn, first poll, active poll time, wait time, and
+      completion. Do not hold thread-affine span state across suspension points.
+    - Use empty or no-op round trips plus payload-size sweeps to separate bridge fixed cost from
+      serialization, copying, and queue noise. Do not halve round-trip time and call it one-way delay
+      when the two directions are asymmetric.
+    - Treat handler entry as post-routing or post-decode unless an earlier ingress boundary is
+      actually instrumented. Likewise, a promise continuation is not native receipt and a state
+      assignment or animation-frame callback is not proof of pixels presented.
+    - Keep an inseparable interval composite instead of inventing internal timestamps. For each trace,
+      compare end-to-end latency with the union of non-overlapping critical-path phases and residual;
+      frequent negative or large residuals indicate clock, overlap, or missing-boundary errors.
+    - Calculate end-to-end percentiles from complete per-trace paths. Never add layer p99 values,
+      because each layer's slowest sample can belong to a different operation.
+13. Protect performance telemetry and artifacts.
+    - Normalize paths before classification and replace them with logical roots; partial substring
+      masking is not a path policy. Separate repository identity from remote URL.
+    - Parse URLs structurally. Remove user info and fragments, strip or allowlist query values, and
+      prefer route templates or endpoint classes over full URLs.
+    - Do not dump argument vectors, environments, configs, headers, baggage, or trace state. Emit a
+      versioned allowlisted schema and redact at the source plus collector boundary where one exists.
+    - Treat raw CPU, heap, allocation, JFR, pprof, trace, benchmark, and compressed artifacts as
+      sensitive. Scan final binaries and recursively inspect supported archives and profile formats
+      for canary secrets, source paths, remotes, URLs, and credentials before distribution.
+    - Use keyed pseudonyms rather than raw hashes for low-entropy sensitive identifiers when stable
+      correlation is permitted, and rotate or scope keys according to policy.
+14. Connect evidence to the decision.
+    - State which source counters and distributions produce every ratio, percentile, budget, or alert.
+    - Classify the conclusion as configured-test evidence, controlled benchmark evidence, profiler
+      evidence, telemetry evidence, static review, manual-only, missing, or not applicable.
+    - Reject a gate or claim when its semantics, comparator, privacy boundary, or reproducibility is
+      materially unknown.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- Measured events, lifecycle stages, units, denominators, clocks, snapshot guarantees, reset behavior,
+  workload conditions, comparison rules, and privacy boundaries are explicit or reported missing.
+- Retry, dedupe, hedge, batch, queue, cache, cancellation, unfinished-work, and parallel-work semantics
+  are not collapsed into misleading totals when they affect the decision.
+- Hardware-counter ratios have defined events, compatible clock and scheduling windows, normalized
+  operation denominators, and sufficient simultaneous-running evidence, or are rejected.
+- Communication outcomes obey a stated terminal and unit conservation model, and cross-process
+  latency phases preserve clock-domain uncertainty and critical-path semantics.
+- Performance claims and gates are backed by evidence whose scope is no broader than the actual
+  scenario, environment, samples, and verification performed.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `changes_status`
+- `changes_diff_summary`
+- `build`
+- `test_related`
+- `test`
+- `docs_validate_fast`
+- `test_release`
+- `mustflow_check`
+
+Prefer focused metric-schema, concurrency, reset, histogram, redaction, artifact-scan, benchmark-parser,
+and regression-gate tests. Treat live production telemetry, dedicated benchmark hardware, and external
+profilers as manual-only unless a configured intent explicitly owns them.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If event meaning or denominator is ambiguous, preserve the raw source counts and stop the derived
+  ratio or gate until the contract is named.
+- If a low-contention accumulator cannot provide the required snapshot guarantee, either weaken the
+  claim explicitly or choose a bounded synchronization or epoch design and measure its overhead.
+- If base and candidate conditions differ materially, report two observations instead of a regression.
+- If an artifact cannot be inspected or redacted safely, keep it undistributed and report the missing
+  verification rather than claiming it is sanitized.
+- If instrumentation changes the hot path materially, reduce or relocate it with a documented loss of
+  precision; do not silently keep a distorted benchmark.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- Performance measurement boundary reviewed
+- Event, lifecycle, unit, denominator, clock, snapshot, reset, and instrumentation-overhead findings
+- Batch, queue, cache, cancellation, unfinished-work, and parallel-work findings
+- CPU counter, cache hierarchy, PMU scheduling, affinity, NUMA, working-set, and saturation findings
+- Communication outcome, cohort, partial-success, finalize-once, conservation, and late-completion findings
+- Cross-process clock alignment, phase closure, critical-path, residual, and presentation findings
+- Benchmark schema, comparator, scenario, budget, statistical rule, profiling, and bisect findings
+- Telemetry and artifact privacy findings
+- Fixes made or recommended
+- Evidence level and command intents run
+- Skipped verification and reasons
+- Remaining performance-measurement integrity risk

package/templates/default/locales/en/.mustflow/skills/routes.toml

@@ -942,6 +942,12 @@ route_type = "adjunct"
 priority = 70
 applies_to_reasons = ["performance_change", "code_change", "data_change", "ui_change", "behavior_change"]
 
+[routes."performance-measurement-integrity-review"]
+category = "general_code"
+route_type = "adjunct"
+priority = 79
+applies_to_reasons = ["unknown_change", "code_change", "behavior_change", "test_change", "performance_change", "security_change", "privacy_change", "data_change", "docs_change", "package_metadata_change", "release_risk"]
+
 [routes."vertical-slice-tdd"]
 category = "tests"
 route_type = "primary"

package/templates/default/locales/en/.mustflow/skills/state-machine-pattern/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.state-machine-pattern
 locale: en
 canonical: true
-revision: 4
+revision: 5
 lifecycle: mustflow-owned
 authority: procedure
 name: state-machine-pattern
@@ -66,6 +66,7 @@ Two states can still require this skill when the lifecycle is meaningful, such a
 ## Required Inputs
 
 - The entity and state field under change.
+- The intended initial state, the user-visible entry state, and the first event or command that should leave it.
 - Complete state list and which states are terminal.
 - Complete event list and the facts each event carries.
 - Current places that change state, validate actions, check state, or render available actions.
@@ -118,6 +119,8 @@ Two states can still require this skill when the lifecycle is meaningful, such a
 5. Write the transition table first.
    - Include every source state, allowed event, guard name, target state, and effect description.
    - Include terminal states explicitly with no outgoing transitions when they are truly terminal.
+   - Declare the initial state explicitly and verify it matches the real entry experience. Do not initialize directly into an active state such as `PLAYING`, `RUNNING`, or `PROCESSING` when the user must first see a menu, confirmation, setup, or start action.
+   - Model the first user or system action as a real transition. Test that the expected entry action leaves the initial state and that missing runtime prerequisites produce a visible failure or unavailable action instead of a silent no-op.
    - Do not hide transition rules inside handler branches, repository filters, database queries, adapter code, or UI code.
    - Do not let direct `deleted_at` assignment bypass allowed archive, soft-delete, restore, purge, anonymize, or redirect transitions when deletion is a meaningful lifecycle.
 6. Keep guards pure.
@@ -167,6 +170,7 @@ Two states can still require this skill when the lifecycle is meaningful, such a
     - For important domains, document state list, event list, transition table, terminal states, guards, effects, concurrency method, duplicate-event handling, and any cross-machine invariants.
     - Diagrams are secondary. The code transition table is the source of truth.
 17. Test from the transition table.
+    - Test the declared initial state and the first permitted transition before testing later lifecycle branches.
     - Test every valid transition.
     - Test representative invalid transitions, especially terminal states and dangerous skipped states.
     - Test guard success and guard failure separately.

package/templates/default/locales/en/.mustflow/skills/svelte-code-change/SKILL.md

@@ -2,7 +2,7 @@
 mustflow_doc: skill.svelte-code-change
 locale: en
 canonical: true
-revision: 4
+revision: 5
 lifecycle: mustflow-owned
 authority: procedure
 name: svelte-code-change
@@ -98,6 +98,10 @@ Preserve Svelte component reactivity, SvelteKit SSR/server/client execution mode
 20. Keep `$effect` dependencies narrow and synchronous. Read dependencies before `await`, `setTimeout`, or callbacks; use `untrack` for incidental logging, snapshots, or non-dependency reads.
 21. Return cleanup from effects that create subscriptions, intervals, observers, sockets, editors, charts, canvas loops, or external library instances.
 22. Treat props as parent-owned. Use callback props for changes and `$bindable` only for narrow form-control-like two-way APIs. Preserve wrapper binding chains or convert them to explicit callbacks.
+    - In Svelte 5 runes mode, do not expose local `$state` through an `export { local as prop }` alias and expect a parent `bind:` directive to update. Declare a bindable prop through `$props()` and `$bindable()` when two-way binding is the intended public contract.
+    - Do not remove a child component merely to hide a broken DOM-reference handoff. Prefer keeping canvas, editor, chart, media, or other imperative resource creation and cleanup in the component that owns the DOM node. When a parent must coordinate initialization, expose an explicit ready callback carrying the node or initialized handle after the child has mounted.
+    - Treat `bind:this` values as unavailable before mount and possibly unavailable again after conditional unmount. Do not assume a parent `onMount` runs after a child-provided reference has propagated through an invalid or indirect binding chain.
+    - Do not silently return from required imperative initialization when the DOM node is unexpectedly absent. Distinguish an expected conditional absence from a broken ownership or binding contract, expose the failure during development, and provide a bounded reinitialization path when the node can appear later.
 23. In Svelte 5, treat DOM event handlers as props. When spreading rest props through wrappers, intentionally compose external handlers with internal policy instead of relying on spread order.
 24. Treat snippets as typed render callbacks. Require optional snippet guards, pass row or slot-like data as parameters, and avoid hidden parent-state capture in reusable library components.
 25. In the official-source snapshot checked on 2026-07-11, SvelteKit remote functions were
@@ -141,6 +145,7 @@ Preserve Svelte component reactivity, SvelteKit SSR/server/client execution mode
 - Use `$state.snapshot` before sending proxy state to serializers, workers, chart libraries, equality tools, or external APIs that should see plain data.
 - Use `$derived` for calculations from props, route data, page state, URL state, or local state.
 - Use `$effect` only for browser-side effects, subscriptions, DOM, canvas, analytics, timers, third-party browser libraries, and cleanup.
+- Keep imperative DOM resources in the component that owns the bound node when practical. If ownership must cross a component boundary, use an explicit `$bindable` prop or ready callback and test the handoff instead of exporting local rune state by alias.
 - Use stores for external streams or manual subscribe/unsubscribe interop, not ordinary component state.
 - Use context for parent-owned values shared down the component tree, especially request-scoped layout data.
 - Do not reassign reactive context objects after placing them in context; update their properties or pass getter functions when needed.

package/templates/default/manifest.toml

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.115.9"
+version = "2.115.13"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"
@@ -195,6 +195,7 @@ creates = [
   ".mustflow/skills/multi-agent-work-coordination/SKILL.md",
   ".mustflow/skills/null-object-pattern/SKILL.md",
   ".mustflow/skills/performance-budget-check/SKILL.md",
+  ".mustflow/skills/performance-measurement-integrity-review/SKILL.md",
   ".mustflow/skills/pattern-scout/SKILL.md",
   ".mustflow/skills/process-execution-safety/SKILL.md",
   ".mustflow/skills/public-json-contract-change/SKILL.md",
@@ -319,6 +320,7 @@ minimal = [
   "failure-integrity-review",
   "backend-log-evidence-review",
   "observability-debuggability-review",
+  "performance-measurement-integrity-review",
   "incident-triage-review",
   "deployment-rollout-safety-review",
   "cloud-cost-guardrail-review",
@@ -495,6 +497,7 @@ patterns = [
   "failure-integrity-review",
   "backend-log-evidence-review",
   "observability-debuggability-review",
+  "performance-measurement-integrity-review",
   "incident-triage-review",
   "deployment-rollout-safety-review",
   "cloud-cost-guardrail-review",
@@ -682,6 +685,7 @@ oss = [
   "failure-integrity-review",
   "backend-log-evidence-review",
   "observability-debuggability-review",
+  "performance-measurement-integrity-review",
   "incident-triage-review",
   "deployment-rollout-safety-review",
   "cloud-cost-guardrail-review",
@@ -888,6 +892,7 @@ team = [
   "failure-integrity-review",
   "backend-log-evidence-review",
   "observability-debuggability-review",
+  "performance-measurement-integrity-review",
   "incident-triage-review",
   "deployment-rollout-safety-review",
   "cloud-cost-guardrail-review",
@@ -1078,6 +1083,7 @@ product = [
   "failure-integrity-review",
   "backend-log-evidence-review",
   "observability-debuggability-review",
+  "performance-measurement-integrity-review",
   "incident-triage-review",
   "deployment-rollout-safety-review",
   "cloud-cost-guardrail-review",
@@ -1274,6 +1280,7 @@ library = [
   "failure-integrity-review",
   "backend-log-evidence-review",
   "observability-debuggability-review",
+  "performance-measurement-integrity-review",
   "incident-triage-review",
   "deployment-rollout-safety-review",
   "cloud-cost-guardrail-review",