skillpacks 0.1.0 → 0.1.2

package/packs/code-debug/claude/investigate/archive/v0.1/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: investigate
+description: Validate user claims against codebase and git history, trace to root cause, and propose a fix
+type: debugging
+version: v0.1
+argument-hint: <error, bug description, user observations, or issue URL> [--ui] [--data] [--plan]
+---
+
+# Investigate
+
+Given a bug report, error message, unexpected behavior, or user observations about what they think is wrong, validate claims against the codebase and git history, trace to root cause, and propose a fix.
+
+## Process
+
+1. **Parse the input** from `$ARGUMENTS`:
+   - Error message or stack trace → extract file paths, line numbers, error types
+   - Bug description → identify the expected vs. actual behavior
+   - User claims/observations → extract each specific claim to validate (e.g., "I think the auth middleware is stripping the header," "this worked before the last deploy," "the database query is returning stale data")
+   - Issue URL → fetch the issue details via `gh`
+   - Check for `--plan` flag → if present, force plan output mode (write fix steps to `tasks/todo.md` instead of applying inline)
+   - Check for `--ui` or `--data` flag → if present, skip auto-detection and use that investigation strategy (see step 1b)
+   - If no arguments provided, ask the user what to investigate.
+
+1b. **Select investigation strategy:**
+
+   If `--ui` or `--data` flag is set, use that strategy directly. Otherwise, auto-detect from the input:
+
+   - **UI strategy** (`--ui`): Use when the problem is visual — layout, spacing, animation, transitions, skeleton/loading states, theming, colors, popovers, positioning, truncation, responsive behavior, CSS.
+     - Signal words: skeleton, animation, spacing, popover, transition, theme, truncated, glitch, dead space, detached, pop-in, flickering, layout, positioning, z-index, overflow.
+   - **Data strategy** (`--data`): Use when the problem is wrong values, stale state, sync mismatches, timers, counters, missing data, or data pipeline issues.
+     - Signal words: countdown, percentage, usage, sync, stale, timer, refresh, reset, missing data, wrong number, out of sync, not updating, mismatch.
+   - **General strategy** (default): Use for errors/crashes (stack traces, console errors, server errors), behavioral bugs (wrong flow, missing options, incorrect form behavior), and anything ambiguous.
+
+   If the input contains signals from multiple strategies (e.g., "the countdown shows wrong AND the animation glitches"), start with the data strategy — wrong data is more commonly the root cause that manifests as a visual symptom.
+
+2. **Gather context** (varies by strategy):
+
+   All strategies:
+   - Read `CLAUDE.md` for project conventions.
+   - Check `git log --oneline -20` for recent changes that may have introduced the issue.
+   - If the user references specific files, commits, or timeframes, read those directly.
+
+   **UI strategy** — start from the component tree:
+   - Identify the component(s) rendering the affected area.
+   - Read the component file(s) and their styles (CSS modules, Tailwind classes, styled-components).
+   - Trace the render path: parent → child → conditional renders → animation/transition logic.
+   - Check for CSS specificity conflicts, z-index stacking, overflow rules, and layout model issues (flex/grid).
+   - If the component uses loading/skeleton states, trace the state transition that swaps skeleton → content.
+
+   **Data strategy** — start from the data pipeline:
+   - Identify the data source (API, store, local state, timer, computed value).
+   - Trace the data flow: source → transformations → state management → component prop.
+   - Check for stale caches, missing refresh triggers, incorrect timer intervals, timezone/epoch issues.
+   - Compare the expected value computation against the actual one — read the business logic, not just the display.
+   - If multiple components show the same data differently, find where they diverge in the pipeline.
+
+   **General strategy** — start from the symptom:
+   - If a stack trace is available, start from the crash site and read those files.
+   - If behavioral, identify the relevant feature area and read entry points.
+
+3. **Validate user claims** (when the user provides observations or hypotheses):
+   - Extract each distinct claim the user has made.
+   - For each claim, verify it against the codebase and git history:
+     - Read the files the user references — does the code behave as they describe?
+     - Check `git log`, `git diff`, and `git blame` on relevant files — does the history support their timeline?
+     - If the user says "this used to work" or "this changed recently," use `git log --all -- <file>` and `git diff <commit range>` to verify.
+   - Classify each claim as: **confirmed**, **partially correct** (right intuition, wrong detail), or **not supported by evidence**.
+   - Report findings before proceeding to trace — the user's mental model may be off, and correcting it early saves time.
+
+4. **Trace the issue:**
+   - Follow the execution path from the symptom to the source.
+   - Read only the files in the chain — do not explore the full codebase.
+   - **UI strategy**: trace component tree → styles → layout → animation/transition → render lifecycle. Check for CSS conflicts, missing keys, layout thrashing, and transition timing.
+   - **Data strategy**: trace data source → transform → store → subscription → render. Check for stale closures, missing dependency arrays, incorrect comparisons, cache invalidation, and timer drift.
+   - **General strategy**: check for null/undefined, wrong types, missing env vars, stale imports, race conditions, schema mismatches, config drift.
+   - If the initial strategy hits a dead end, pivot to the other strategy — a "UI bug" may have a data root cause, and vice versa.
+   - If the issue was introduced by a recent commit, identify which one with `git log` or `git bisect` logic.
+   - If user claims were partially correct or unsupported, trace from the actual evidence rather than the user's hypothesis.
+
+5. **Verify the hypothesis:**
+   - Look for test coverage of the affected code path.
+   - Check if the bug is reproducible from the code alone (no need to run the app unless necessary).
+   - If there are related tests, run them to confirm the current state.
+
+6. **Apply or plan the fix:**
+   - **Determine fix mode:**
+     - If `--plan` flag is set → **plan mode** (always write to `tasks/todo.md`)
+     - If fix requires 3+ discrete steps across multiple files → **plan mode**
+     - Otherwise → **inline mode** (apply fix directly)
+   - **Inline mode** (default for single contained fixes):
+     - Write the minimal code change that fixes the root cause.
+     - If tests exist, update them. If not, write a test that would have caught this.
+     - Run the relevant tests to confirm the fix works and no regressions.
+   - **Plan mode** (multi-step fixes or `--plan` flag):
+     - Do NOT apply code changes. Proceed to step 7.
+
+7. **Write fix steps to `tasks/todo.md`** (plan mode only):
+   - Read existing `tasks/todo.md` if present — do NOT overwrite existing content.
+   - Append a new section:
+     ```
+     ## Investigation Fix: [concise title of the issue]
+
+     - [ ] Step description — `file/path.ext` — why this change is needed
+     - [ ] Step description — `file/path.ext` — why this change is needed
+     ...
+     - [ ] Verify: run [specific test command or acceptance criterion]
+     ```
+   - Each item must specify: what to change, which file, and why.
+   - Final item must be an acceptance criterion (run tests, verify behavior).
+   - Order steps by dependency — changes that other steps depend on come first.
+
+## Output
+
+### Strategy Used
+- **Mode**: UI / Data / General (and whether auto-detected or flag-forced)
+- **Pivoted**: Yes/No — if the initial strategy didn't find the root cause and a different layer was the actual source
+
+### User Claims Validated
+For each claim the user made:
+- **Claim**: What the user said
+- **Verdict**: Confirmed / Partially correct / Not supported
+- **Evidence**: What the code or git history actually shows
+
+_(Skip this section if the input was a plain error message or stack trace with no user hypotheses.)_
+
+### Root Cause
+- **Location**: `file:line`
+- **What's wrong**: One-sentence explanation
+- **Introduced by**: commit hash or "pre-existing" if not recent
+- **Relationship to user's theory**: How this connects to (or diverges from) what the user suspected
+
+### Fix Applied
+_(Shown in inline mode)_
+- Files modified and what changed
+- Test results
+
+### Fix Steps Written
+_(Shown in plan mode — replaces "Fix Applied")_
+- Written to `tasks/todo.md` under `## Investigation Fix: [title]`
+- Number of steps and summary
+- Run `/exec` to execute the fix steps sequentially
+
+### Prevention
+- What test or check would have caught this earlier
+
+## Constraints
+- Do not refactor unrelated code while fixing the bug.
+- Do not guess — if you can't trace the root cause, say so and list what you've ruled out.
+- Always validate user claims before assuming they're correct — the user's observations are a starting point, not ground truth.
+- Always run tests after applying the fix (inline mode).
+- If the fix requires changes outside the current project (infra, env vars, external service), document what's needed instead of attempting it.
+- Do not write to `docs/debug-changelog.md` — that is `/debug`'s domain.
+- Do not write to `tasks/todo.md` for single-step fixes unless `--plan` is explicitly set.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-debug/codex/debug/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## v0.3 - 2026-06-13
+
+- Removed direct execution-loop command handoffs from non-exec routing; route through approved YAML, task, or roadmap artifacts instead.
+
+
+## v0.2 - 2026-06-12
+
+- Added explicit next-step routing for unresolved bugs, dirty fix handoff, systemic follow-up execution, and no-follow-up completion.
+
 ## v0.0
 
 - Archived previous skill contract.

package/packs/code-debug/codex/debug/SKILL.md

@@ -2,7 +2,7 @@
 name: debug
 description: Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.
 type: debugging
-version: v0.1
+version: v0.3
 ---
 
 # Debug
@@ -32,6 +32,15 @@ Investigate a reported problem, maintain a persistent debug changelog (`docs/deb
 - **Changelog Updated**: entry added, any cross-references
 - **Prevention**: what check would have caught this earlier; systemic follow-up if applicable
 
+## Next-Step Routing
+
+After reporting the debug outcome:
+
+- If the root cause remains unresolved or verification still fails, use **Recommended next command:** `$debug <specific failing symptom>` with the failing command and evidence, or `$investigate <claim>` when the remaining work is broader repo validation.
+- If the fix created or modified tracked files, check `.agents/project.json` for `exec-loop`; recommend `$ship` when enabled, or `npx skillpacks install exec-loop` from the project shell when it is not enabled.
+- If a systemic follow-up was added to `tasks/todo.md`, check `.agents/project.json` for `exec-loop`; state that the approved task artifact is ready for an execution-loop runner; if runner tooling is missing, recommend installing `exec-loop` with the project package manager.
+- If verification passed, no tracked files are dirty, and no systemic follow-up remains, state that no follow-up command is recommended.
+
 ## Constraints
 
 - Always read the full debug changelog before proposing a fix.

package/packs/code-debug/codex/debug/archive/v0.1/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: debug
+description: Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.
+type: debugging
+version: v0.1
+---
+
+# Debug
+
+Invoke as `$debug`.
+
+Investigate a reported problem, maintain a persistent debug changelog (`docs/debug-changelog.md`), and propose a fix that avoids repeating past solutions.
+
+## Process
+
+1. Parse the error message, stack trace, or bug description.
+2. Capture environment context: current branch, recent commits, uncommitted changes.
+3. Ensure `docs/debug-changelog.md` exists (create `docs/` directory and file if missing).
+4. Read the full debug changelog and search for prior entries matching the current symptom.
+5. If a match is found, report what was tried before and whether the recurrence is systemic.
+6. Trace the execution path from the symptom to the root cause, reading only files in the chain.
+7. Check recent git history for changes that may have introduced the issue.
+8. Propose a minimal fix, cross-checking the changelog to avoid repeating a previously failed approach.
+9. Apply the fix, write or update tests, and run them to verify.
+10. Prepend a structured entry to `docs/debug-changelog.md` with: date, symptom, category, severity, root cause, fix, test results, related entries, and systemic flag.
+
+## Output
+
+- **Problem**: Symptom, new or recurring
+- **Root Cause**: file:line, what's wrong, when introduced
+- **Fix Applied**: approach, files modified, test results
+- **Changelog Updated**: entry added, any cross-references
+- **Prevention**: what check would have caught this earlier; systemic follow-up if applicable
+
+## Constraints
+
+- Always read the full debug changelog before proposing a fix.
+- Do not refactor unrelated code.
+- Never duplicate a previously failed fix without justification.
+- If the root cause can't be determined, report what was ruled out.
+- Always run tests after applying the fix.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-debug/codex/debug/archive/v0.2/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: debug
+description: Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.
+type: debugging
+version: v0.2
+---
+
+# Debug
+
+Invoke as `$debug`.
+
+Investigate a reported problem, maintain a persistent debug changelog (`docs/debug-changelog.md`), and propose a fix that avoids repeating past solutions.
+
+## Process
+
+1. Parse the error message, stack trace, or bug description.
+2. Capture environment context: current branch, recent commits, uncommitted changes.
+3. Ensure `docs/debug-changelog.md` exists (create `docs/` directory and file if missing).
+4. Read the full debug changelog and search for prior entries matching the current symptom.
+5. If a match is found, report what was tried before and whether the recurrence is systemic.
+6. Trace the execution path from the symptom to the root cause, reading only files in the chain.
+7. Check recent git history for changes that may have introduced the issue.
+8. Propose a minimal fix, cross-checking the changelog to avoid repeating a previously failed approach.
+9. Apply the fix, write or update tests, and run them to verify.
+10. Prepend a structured entry to `docs/debug-changelog.md` with: date, symptom, category, severity, root cause, fix, test results, related entries, and systemic flag.
+
+## Output
+
+- **Problem**: Symptom, new or recurring
+- **Root Cause**: file:line, what's wrong, when introduced
+- **Fix Applied**: approach, files modified, test results
+- **Changelog Updated**: entry added, any cross-references
+- **Prevention**: what check would have caught this earlier; systemic follow-up if applicable
+
+## Next-Step Routing
+
+After reporting the debug outcome:
+
+- If the root cause remains unresolved or verification still fails, use **Recommended next command:** `$debug <specific failing symptom>` with the failing command and evidence, or `$investigate <claim>` when the remaining work is broader repo validation.
+- If the fix created or modified tracked files, check `.agents/project.json` for `exec-loop`; recommend `$ship` when enabled, or `npx skillpacks install exec-loop` from the project shell when it is not enabled.
+- If a systemic follow-up was added to `tasks/todo.md`, check `.agents/project.json` for `exec-loop`; recommend `$exec` when enabled, or `npx skillpacks install exec-loop` from the project shell when it is not enabled.
+- If verification passed, no tracked files are dirty, and no systemic follow-up remains, state that no follow-up command is recommended.
+
+## Constraints
+
+- Always read the full debug changelog before proposing a fix.
+- Do not refactor unrelated code.
+- Never duplicate a previously failed fix without justification.
+- If the root cause can't be determined, report what was ruled out.
+- Always run tests after applying the fix.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-debug/codex/investigate/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v0.2 - 2026-06-13
+
+- Kept the Codex mirror aligned with the alignment-YAML routing remediation and approved-artifact execution boundary.
+
+
 ## v0.0
 
 - Archived previous skill contract.

package/packs/code-debug/codex/investigate/SKILL.md

@@ -2,7 +2,7 @@
 name: investigate
 description: Validate user claims against codebase and git history, trace to root cause, and propose a fix
 type: debugging
-version: v0.1
+version: v0.2
 ---
 
 # Investigate

package/packs/code-debug/codex/investigate/archive/v0.1/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: investigate
+description: Validate user claims against codebase and git history, trace to root cause, and propose a fix
+type: debugging
+version: v0.1
+---
+
+# Investigate
+
+Invoke as `$investigate`.
+
+Use this skill when the user reports a bug, error, unexpected behavior, or provides observations/hypotheses about what they think is wrong. Validates claims against the codebase and git history before tracing to root cause.
+
+## Process
+
+1. Parse the error message, stack trace, bug description, or user observations/claims.
+2. **Select investigation strategy** from flags or auto-detection:
+   - `--ui`: Visual/layout bugs — start from component tree, styles, animations, transitions, spacing, theming, skeleton/loading states, positioning. Signal words: skeleton, animation, spacing, popover, transition, theme, truncated, glitch, dead space, detached, pop-in, flickering, layout, z-index, overflow.
+   - `--data`: Data/state bugs — start from data pipeline, state management, timers, counters, sync logic. Signal words: countdown, percentage, usage, sync, stale, timer, refresh, reset, missing data, wrong number, out of sync, not updating, mismatch.
+   - General (default): Errors, crashes, behavioral bugs, and anything ambiguous — start from symptom/stack trace.
+   - If input has signals from both UI and data, prefer data strategy — wrong data commonly manifests as a visual symptom.
+3. If the user provides claims or hypotheses, validate each one against the codebase and git history (`git log`, `git diff`, `git blame`). Classify each as confirmed, partially correct, or not supported by evidence. Report findings before proceeding.
+4. Trace using the selected strategy:
+   - **UI**: component tree → styles → layout → animation/transition → render lifecycle. Check CSS conflicts, missing keys, layout thrashing, transition timing.
+   - **Data**: data source → transform → store → subscription → render. Check stale closures, missing dependency arrays, incorrect comparisons, cache invalidation, timer drift.
+   - **General**: execution path from symptom to source — null/undefined, wrong types, missing env vars, stale imports, race conditions, schema mismatches.
+   - If the initial strategy hits a dead end, pivot to the other — a UI bug may have a data root cause, and vice versa.
+5. Check recent git history for changes that may have introduced the issue.
+6. Identify the root cause with file and line reference.
+7. Apply a minimal fix and write or update tests.
+8. Run tests to verify the fix and check for regressions.
+
+## Output
+
+- **Strategy Used**: UI / Data / General (auto-detected or flag-forced), whether a pivot occurred
+- **User Claims Validated**: For each claim — verdict (confirmed/partially correct/not supported) and evidence. Skip if input was a plain error message.
+- **Root Cause**: file:line, what's wrong, when introduced, relationship to user's theory
+- **Fix Applied**: files modified, test results
+- **Prevention**: what check would have caught this earlier
+
+## Constraints
+
+- Do not refactor unrelated code.
+- Validate user claims before assuming they're correct — observations are a starting point, not ground truth.
+- If the root cause can't be determined, report what was ruled out.
+- Always run tests after applying the fix.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-maintenance/claude/migrate/ALIGNMENT-PAGE.md

@@ -9,7 +9,7 @@ When this skill produces durable deliverables (research, specs, plans, reports,
 
 The tier is set per skill via `visual_tier` in SKILL.md frontmatter (or detected by the upgrade script). The bundled ALIGNMENT-PAGE.md receives tier-appropriate rendering guidance from the generator.
 
-**Alignment lifecycle.** Alignment pages have three lifecycle states. `review` is the draft/pre-approval page: it contains the complete deliverable preview, evidence, required inline gate questions, section feedback controls, feedback-only YAML, and final compile controls. `confirmed` is the post-approval page after the agent has consumed final compiled YAML, made any approved user-requested edits, and written or updated the approved canonical artifacts. A confirmed page is finished and current for the completed alignment cycle, but it remains amendable when later research changes or extends the conclusions. `amended` is a future revision of a confirmed page: archive the previous confirmed page first, mark what changed, preserve the prior approval record, and highlight the new evidence, decisions, or scope that changed the earlier conclusion.
+**Alignment lifecycle.** Alignment pages have three lifecycle states. `review` is the draft/pre-approval page: it contains the complete deliverable preview, evidence, required inline gate questions, section feedback controls, local section-feedback YAML only after a section feedback choice is selected, and one bottom `Compile Responses` control. `confirmed` is the post-approval page after the agent has consumed final compiled response YAML, made any approved user-requested edits, and written or updated the approved canonical artifacts. A confirmed page is finished and current for the completed alignment cycle, but it remains amendable when later research changes or extends the conclusions. `amended` is a future revision of a confirmed page: archive the previous confirmed page first, mark what changed, preserve the prior approval record, and highlight the new evidence, decisions, or scope that changed the earlier conclusion.
 
 **Central alignment index.** When a research-producing skill writes or updates an HTML alignment page, also maintain the repository's central alignment index. Look for `alignment/index.html` at the repository root; if the target repo documents a different central alignment-index path, use that path and report it. If the index does not exist, create it as a self-contained HTML page that works from `file://`, links to every active `alignment/*.html` page except itself, and includes the newly written page. Every index entry must include the page's alignment date in a muted meta span after the link, formatted `YYYY-MM-DD`, for example `<a href="page.html">Title</a> <span class="meta">2026-06-09</span>`. The alignment date is the review or confirmed date written inside the page itself; new pages use today's date. If the index exists, update it instead of blindly appending: preserve valid existing entries, metadata, and entry dates; remove duplicate entries for the same page path; keep links repo-relative; and include the new or updated page. When updating an existing index, add a date only to entries that are missing one, deriving it from the page's internal alignment date, or from file history when the page has no internal date. If a `new` marker is used, combine it with the date as `<span class="meta">new · YYYY-MM-DD</span>`, and remove stale `new` markers from entries that are no longer the latest addition.
 
@@ -29,7 +29,7 @@ The tier is set per skill via `visual_tier` in SKILL.md frontmatter (or detected
 
 **Category and product-path grouping.** In product-line or product-path repositories, identify product from `research/.progress.yaml` `product_paths[]`, active `research/{slug}/` or `specs/{slug}/` scopes, page metadata, page title, or the alignment page path. Group index entries by category first, then by product/product path within each category, with the repo's existing secondary sort preserved when clear. In flat repositories, group by category, then preserve the existing index organization within each category or use a clear newest-first or title order when creating a new index.
 
-**Research quality contract.** For research-producing outputs, do not synthesize research findings, recommendations, candidate rankings, or working packets until the user approves the research scope from the `review` alignment page's final compiled YAML. Before scope approval, do only minimal discovery needed to propose the research scope, source plan, assumptions, output paths, and approval questions; label any observed files or source availability as scope evidence, not findings. After scope approval, perform the synthesized research and separate and label `claims` (what the report concludes), `evidence` (source, repo artifact or file path, quote or observation, date, and confidence), `inference` (why that evidence supports the claim), `assumptions` (what remains unproven), and `decision impact` (what the user should approve, reject, or correct). Do not collapse evidence and inference into unsupported summary prose.
+**Research quality contract.** For research-producing outputs, do not synthesize research findings, recommendations, candidate rankings, or working packets until the user approves the research scope from the `review` alignment page's final compiled response YAML. Before scope approval, do only minimal discovery needed to propose the research scope, source plan, assumptions, output paths, and approval questions; label any observed files or source availability as scope evidence, not findings. After scope approval, perform the synthesized research and separate and label `claims` (what the report concludes), `evidence` (source, repo artifact or file path, quote or observation, date, and confidence), `inference` (why that evidence supports the claim), `assumptions` (what remains unproven), and `decision impact` (what the user should approve, reject, or correct). Do not collapse evidence and inference into unsupported summary prose.
 
 **Embed prohibition.** Do not use `<object>`, `<iframe>`, `<embed>`, or "open working packet" / "view full document" links as the primary rendering of any proposed deliverable, evidence matrix, interview log, or manifest entry. The alignment page HTML must contain the rendered content directly. Embedded or linked external documents are permitted only as supplemental references alongside the fully rendered content already present in the page. **Exception:** Self-contained inline `<canvas>` and `<svg>` elements are permitted for charts and diagrams within the same HTML file.
 
@@ -57,28 +57,30 @@ The tier is set per skill via `visual_tier` in SKILL.md frontmatter (or detected
 
 **Report-only research gates.** For report-only or pre-approval research skills, the first `review` alignment page must explicitly contain proposed research scope, source plan, assumptions/confidence, recommended output path, proposed file changes, and approval gates before synthesized research begins and before any working packet, canonical research, spec, or task file is created or updated.
 
-**Staged research workflow.** Heavy report-first research uses a scope-first three-stage approval workflow. Stage 1 is minimal scope discovery only: inspect enough repository, user, and source context to propose research scope, source plan, assumptions, output paths, and approval questions. Build the `review` alignment page before synthesized research. The page must render the proposed scope, available source categories, known context, assumptions/confidence, proposed working-packet and canonical output paths, and research-scope approval gates. Stop for final compiled YAML approval of the research scope. Do not synthesize findings, rank candidates, recommend a path, or create working packets, canonical research, spec, or task files in Stage 1. Stage 2 starts only after final compiled YAML approves the research scope with no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Perform the synthesized research, run required source/code checks, and write only a non-canonical working packet. Flat mode uses `research/_working/preliminary-migrate-research.md`; product-path mode uses `research/{slug}/_working/preliminary-migrate-research.md`. Existing raw evidence or search-log outputs may remain as supporting evidence when the skill contract already requires them, but synthesized deliverables stay in the working packet. Update the same `review` alignment page so it renders the full preliminary packet, evidence matrix, assumptions/confidence register, source coverage gaps, proposed canonical file changes, and artifact approval gates. Feedback-only YAML revises the working packet and review page, then remains in Stage 2. Stage 3 consumes final compiled YAML for artifact approval only when it has no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Apply approved edits first, archive the working packet to `docs/history/archive/YYYY-MM-DD/HHMMSS/<original-working-path>`, remove the active working packet, write the approved canonical artifacts to the unchanged output paths, and convert the page to `confirmed` with the approval record preserved.
+**Staged research workflow.** Heavy report-first research uses a scope-first three-stage approval workflow. Stage 1 is minimal scope discovery only: inspect enough repository, user, and source context to propose research scope, source plan, assumptions, output paths, and approval questions. Build the `review` alignment page before synthesized research. The page must render the proposed scope, available source categories, known context, assumptions/confidence, proposed working-packet and canonical output paths, research-scope approval gates, and a `Stage 2 Preview / Expected Review Format` section that shows the future Stage 2 review shape before research starts. Stop for final compiled response YAML approval of the research scope. Do not synthesize findings, rank candidates, recommend a path, or create working packets, canonical research, spec, or task files in Stage 1. Stage 2 starts only after final compiled response YAML approves the research scope with no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Perform the synthesized research, run required source/code checks, and write only a non-canonical working packet. Flat mode uses `research/_working/preliminary-migrate-research.md`; product-path mode uses `research/{slug}/_working/preliminary-migrate-research.md`. Existing raw evidence or search-log outputs may remain as supporting evidence when the skill contract already requires them, but synthesized deliverables stay in the working packet. Update the same `review` alignment page so it renders the complete working-packet substance as structured HTML review UI: purpose-built sections, tables, matrices, gates, cards, and tier-appropriate charts or diagrams that preserve every packet section, finding, caveat, and decision detail without summary loss. Raw Markdown packet text may appear only as a supplemental source view after the rendered review UI; do not make a `Full Preliminary Packet` or `Full Working Packet` raw Markdown dump, giant `<pre><code>` block, link-only view, or source-only view the primary review surface. Include the evidence matrix, assumptions/confidence register, source coverage gaps, proposed canonical file changes, and artifact approval gates. Partial compiled responses revise the working packet and review page, then remain in Stage 2. Stage 3 consumes final compiled response YAML for artifact approval only when it has `approval_status: ready-for-agent-review` and no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Apply approved edits first, archive the working packet to `docs/history/archive/YYYY-MM-DD/HHMMSS/<original-working-path>`, remove the active working packet, write the approved canonical artifacts to the unchanged output paths, and convert the page to `confirmed` with the approval record preserved.
+
+**Stage 2 review-page template.** Stage 1 scope-review pages must include a `Stage 2 Preview / Expected Review Format` section that previews the exact section sequence, table shapes, evidence treatment, visual density, and approval gates the user will see after research; make it specific enough for the user to flag preferred content formats, grouping, labels, visuals, and evidence density before the agent does heavy research. After scope approval and research, the Stage 2 review page must include these sections as structured HTML, not as raw Markdown dumps: `Research Scope Approved` status block with approved scope, source plan, output paths, and unresolved caveats; `Executive Findings` or a skill-specific top-findings section with confidence labels; `Evidence Matrix` mapping claim, evidence/source/path, inference, confidence, assumptions, and decision impact; `Working Packet Review` with the complete working-packet substance rendered as purpose-built HTML sections, lists, tables, matrices, cards, and tier-appropriate charts or diagrams; `Alternatives / Rejected or Lower-Confidence Findings`; `Source Coverage & Gaps`; `Assumptions / Confidence Register`; `Proposed Canonical Artifacts & File Changes`; a required `User Format Preferences` gate asking whether the layout, tables, grouping, visuals, labels, and evidence density match expectations; and a required `Final Artifact Approval` gate for Stage 3 readiness. Raw Markdown packet text, search logs, or source notes may appear only as supplemental source views after the rendered review UI and never replace the Stage 2 review sections.
 
 **Required inline questions.** In `review` pages, each gate must contain at least one required inline question placed directly under the content it governs, inside a visually distinct question block. Each question must use radio-button inputs and include two standing options after the skill-generated choices: "Other / None of the above" backed by a multi-line text box for free-form input, and "Need clarification" backed by an optional notes box where the user can explain what is unclear. When any radio option other than "Other" or "Need clarification" is selected, show an optional "Additional notes" text box beneath it so the user can qualify their choice. Generate questions based on what genuinely needs user input -- do not add filler questions. Do not create a separate bottom "Decisions & Clarifications" section. Confirmed pages must not keep these as required input controls; render the answered decisions as read-only records.
 
-**Section feedback controls.** Every major section of the page (each deliverable section, evidence matrix, confidence register, gate, and any anchor-linked top-level heading) carries a lightweight section-feedback control near its heading: three mutually exclusive choices -- "emphasize" (add more weight to this section or to the point named in the notes), thumbs down (reject or flag a concern), and "clarification needed". Selecting any one reveals a multi-line section-feedback textarea placed directly under or beside that section's emphasize/down/clarify controls; deselecting hides the textarea and any local feedback YAML output for that section. This textarea is separate from required gate-question text inputs: even when the same section has gate questions with their own text boxes, selecting emphasize/down/clarify must still reveal the section-feedback textarea near the feedback controls. Use `--green` for active "emphasize", `--red` for the active thumbs-down, and `--orange` for active "clarification needed", with muted/inactive states otherwise. These controls are optional for final approval and do not replace required gate questions. They also power the separate feedback-only YAML path so the user can send emphasis requests, concerns, or clarification requests before answering every required gate question. When a section contains nested subsections (h3 or deeper), duplicate the section-feedback control at the bottom of the section, just before the closing `</section>` tag. The bottom copy mirrors the top copy — same `data-section`, same id with a `-bottom` suffix, same button set. Sections without nested subsections keep only the top control. Pair top and bottom controls by matching `data-section` attribute. When a feedback button is clicked on one copy, mirror the active state, `has-feedback` class, and `dataset.feedback` value to the paired copy. Textarea content should sync on compile — whichever textarea has content takes precedence (prefer the one the user last typed in). Both copies' local compile/copy buttons produce the same YAML. Use the top copy's `id` (without `-bottom`) as the canonical feedback id for YAML output.
+**Section feedback controls.** Every major section of the page (each deliverable section, evidence matrix, confidence register, gate, and any anchor-linked top-level heading) carries a lightweight section-feedback control near its heading: three mutually exclusive choices -- "emphasize" (add more weight to this section or to the point named in the notes), thumbs down (reject or flag a concern), and "clarification needed". The section feedback textarea, local compile/copy controls, and local read-only YAML output are hidden by default. Selecting any one feedback choice reveals a multi-line section-feedback textarea plus local "Compile Feedback YAML", "Copy YAML", and read-only YAML controls placed directly under or beside that section's emphasize/down/clarify controls; deselecting the active choice hides the textarea, local compile/copy controls, and local read-only YAML output again and omits that section from compiled responses. This textarea is separate from required gate-question text inputs: even when the same section has gate questions with their own text boxes, selecting emphasize/down/clarify must still reveal the section-feedback textarea near the feedback controls. Use `--green` for active "emphasize", `--red` for the active thumbs-down, and `--orange` for active "clarification needed", with muted/inactive states otherwise. These controls are optional for final approval and do not replace required gate questions. They also contribute `section_feedback` entries to the unified response payload so the user can send emphasis requests, concerns, or clarification requests before answering every required gate question. When a section contains nested subsections (h3 or deeper), duplicate the section-feedback control at the bottom of the section, just before the closing `</section>` tag. The bottom copy mirrors the top copy — same `data-section`, same id with a `-bottom` suffix, same button set. Sections without nested subsections keep only the top control. Pair top and bottom controls by matching `data-section` attribute. When a feedback button is clicked on one copy, mirror the active state, `has-feedback` class, and `dataset.feedback` value to the paired copy. Textarea content should sync on compile — whichever textarea has content takes precedence (prefer the one the user last typed in). Both copies' local compile/copy buttons produce the same YAML. Use the top copy's `id` (without `-bottom`) as the canonical feedback id for YAML output.
 
-**Feedback-only YAML contract.** Provide feedback-only YAML in two places: locally under each selected section-feedback textarea, and globally in the bottom compile section. When a section-feedback control is selected, show local "Compile Feedback YAML" and "Copy YAML" controls plus a read-only YAML textarea directly under that section's feedback textarea. The local feedback compile generates YAML with `alignment_page: alignment/migrate-{topic}.html`, `feedback_status: revision-request`, `approval_status: not-approved`, `unanswered_required_questions`, and a `section_feedback` list containing the single selected section-feedback entry for that local control. The bottom "Compile Feedback YAML" control generates the same YAML shape but aggregates every selected section-feedback entry on the page. Enable both local and bottom feedback compile controls as soon as at least one section-feedback control is set, even if required inline gate questions are unanswered. Populate `alignment_page` from the known repo-relative output path used to write the HTML page, not from the page title, browser URL, window location, or any display label. Each feedback entry uses the shape `section`, `feedback` (`emphasize`, `down`, or `needs-clarification`), optional `notes` from that section's feedback textarea, and `requested_agent_action` (`add-weight-to-section`, `investigate-and-revise`, or `clarify-before-approval`). For `emphasize` feedback, the YAML must make clear that the agent should add more weight, prominence, evidence, detail, or recommendation emphasis to that section or to the specific point named in the notes; this is a revision request, not approval of the section as-is. For `down` and `needs-clarification` feedback, the YAML must make clear that the agent should evaluate the feedback, investigate further when needed, and contextually amend the HTML alignment page before asking again for final approval answers. Automatically attempt to copy feedback YAML to the clipboard, display local or bottom copy status, display it in the matching read-only textarea, and provide a "Copy YAML" button with the same retry and fallback behavior as final gate YAML. Do not render the bottom feedback compile controls as a sticky or fixed banner.
+**Section feedback YAML contract.** Provide local section-feedback YAML only under each selected section-feedback textarea. When a section-feedback control is selected, show local "Compile Feedback YAML" and "Copy YAML" controls plus a read-only YAML textarea directly under that section's feedback textarea; when the control is deselected, hide those local controls and output again. The local feedback compile generates YAML with `alignment_page: alignment/migrate-{topic}.html`, `feedback_status: revision-request`, `approval_status: not-approved`, `unanswered_required_questions`, and a `section_feedback` list containing the single selected section-feedback entry for that local control. Enable local feedback compile controls as soon as that section-feedback control is set, even if required inline gate questions are unanswered. Populate `alignment_page` from the known repo-relative output path used to write the HTML page, not from the page title, browser URL, window location, or any display label. Each feedback entry uses the shape `section`, `feedback` (`emphasize`, `down`, or `needs-clarification`), optional `notes` from that section's feedback textarea, and `requested_agent_action` (`add-weight-to-section`, `investigate-and-revise`, or `clarify-before-approval`). For `emphasize` feedback, the YAML must make clear that the agent should add more weight, prominence, evidence, detail, or recommendation emphasis to that section or to the specific point named in the notes; this is a revision request, not approval of the section as-is. For `down` and `needs-clarification` feedback, the YAML must make clear that the agent should evaluate the feedback, investigate further when needed, and contextually amend the HTML alignment page before asking again for final approval responses. Automatically attempt to copy local feedback YAML to the clipboard, display local copy status, display it in the matching read-only textarea, and provide a "Copy YAML" button with the same retry and fallback behavior as response YAML.
 
-**Gate YAML contract.** In `review` pages, at the bottom of the page, include an ordinary in-flow compile section with a "Compile Feedback YAML" button for selected section feedback and a separate "Compile Answers" button for final approval answers. The bottom compile section must not be sticky, fixed, floating, or styled as a persistent banner. The "Compile Answers" button aggregates answers from all inline gate questions throughout the page, including free-text notes. The final approval button remains disabled until every required question has a selection, shows a count of remaining unanswered questions, and scrolls to the first unanswered question if clicked early. When every question is answered, generate a structured YAML block with `alignment_page: alignment/migrate-{topic}.html`, `approval_status: ready-for-agent-review`, one item per gate answer using this stable shape: `section`, `gate_type`, `status` (`answered`, `other`, or `needs-clarification`), `answer`, optional `notes`, and optional `target_artifact` or `target_path` when the gate controls file output. Populate `alignment_page` from the known repo-relative output path used to write the HTML page, not from the page title, browser URL, window location, or any display label. The same final compiled output also includes any section-feedback controls that the user set, using the `section_feedback` shape from the feedback-only YAML contract. After successful compilation, automatically attempt to copy the YAML to the clipboard with the Clipboard API, display copy status, and display the YAML in a read-only textarea with an explicit "Copy YAML" button. The copy button must retry clipboard copy when supported and fall back to selecting the textarea contents when clipboard access is unavailable or blocked.
+**Response YAML contract.** In `review` pages, at the bottom of the page, include an ordinary in-flow compile section with a single "Compile Responses" button. The bottom compile section must not be sticky, fixed, floating, or styled as a persistent banner. "Compile Responses" aggregates all answered inline gate questions throughout the page, including free-text notes, plus every selected section-feedback entry. Enable it as soon as at least one gate question has an answer or at least one section-feedback control is selected; do not require every required gate question to be answered before compiling partial responses. If clicked with no answered gates and no selected section feedback, show a response status that asks the user to answer a gate question or select section feedback. The compiled YAML is a mixed response payload with `alignment_page: alignment/migrate-{topic}.html`, `response_status` (`partial` or `complete`), `approval_status` (`not-approved` or `ready-for-agent-review`), `required_gate_status` (`incomplete` or `complete`), and `unanswered_required_questions`. It may include a `gate_answers` list where each answered gate item preserves the stable gate-answer shape: `section`, `gate_type`, `status` (`answered`, `other`, or `needs-clarification`), `answer`, optional `notes`, and optional `target_artifact` or `target_path` when the gate controls file output. It may also include a `section_feedback` list using the section-feedback shape from the section feedback YAML contract. Set `approval_status: ready-for-agent-review` only when every required gate is answered and there are no unresolved `down`, unresolved `needs-clarification`, or other unresolved negative feedback items; otherwise set `approval_status: not-approved` and keep the response in review. Populate `alignment_page` from the known repo-relative output path used to write the HTML page, not from the page title, browser URL, window location, or any display label. After successful compilation, automatically attempt to copy the YAML to the clipboard with the Clipboard API, display copy status, and display the YAML in a read-only textarea with an explicit "Copy YAML" button. The copy button must retry clipboard copy when supported and fall back to selecting the textarea contents when clipboard access is unavailable or blocked.
 
-**Confirmed page contract.** After final approval has been applied, convert the active alignment page from `review` to `confirmed`. Include a visible status block with `alignment_status: confirmed`, confirmation date, confirmed artifact paths, approval source summary, and explicit finished but amendable language: the page is current for the completed alignment cycle, and later research can amend it only by archiving the prior confirmed page and highlighting the amendment. Remove required gate-question controls, the final "Compile Answers" button, unanswered-question counters, disabled approval buttons, and approval-blocking language. Preserve the full research and approval record: answered decisions, user requests, evidence matrix, assumptions/confidence register, source gaps, proposed file changes, final compiled YAML or faithful approval summary, and what changed during confirmation. Keep research caveats visible; `confirmed` means approved/current, not immutable or permanently true.
+**Confirmed page contract.** After final approval has been applied, convert the active alignment page from `review` to `confirmed`. Include a visible status block with `alignment_status: confirmed`, confirmation date, confirmed artifact paths, approval source summary, and explicit finished but amendable language: the page is current for the completed alignment cycle, and later research can amend it only by archiving the prior confirmed page and highlighting the amendment. Remove required gate-question controls, section feedback input controls, local compile/copy controls, local read-only YAML outputs, the final "Compile Responses" button, response counters, disabled approval buttons, and approval-blocking language. Preserve the full research and approval record: answered decisions, user requests, evidence matrix, assumptions/confidence register, source gaps, proposed file changes, final compiled response YAML or faithful approval summary, and what changed during confirmation. Keep research caveats visible; `confirmed` means approved/current, not immutable or permanently true.
 
-**Pre-approval stop.** While an alignment page is in `review`, the next action is review of the HTML alignment page, not downstream routing. Ask the user to review the page and provide either local or bottom feedback-only YAML for emphasis requests, concerns, or clarification, or final compiled YAML answers when ready. Do not require the user to answer every gate before sending emphasis requests, negative feedback, or clarification needs. When feedback-only YAML is provided, treat it as a revision request: evaluate the feedback, investigate further when needed, archive and amend the HTML page contextually, highlight the changes, and ask again for review. Do not include `Recommended next skill`, `Recommended next command`, or downstream routing language until after final compiled YAML has been provided and the approved artifacts have been written or updated.
+**Pre-approval stop.** While an alignment page is in `review`, the next action is review of the HTML alignment page, not downstream routing. Ask the user to review the page and provide either local section-feedback YAML for one section or bottom compiled response YAML for gate answers and/or selected section feedback. Do not require the user to answer every gate before sending emphasis requests, negative feedback, clarification needs, or other partial responses. When compiled response YAML is partial or has `approval_status: not-approved`, treat it as a revision request: evaluate the feedback, investigate further when needed, archive and amend the HTML page contextually, highlight the changes, and ask again for review. Do not include `Recommended next skill`, `Recommended next command`, or downstream routing language until after final compiled response YAML with `approval_status: ready-for-agent-review` has been provided and the approved artifacts have been written or updated.
 
-**After approval handling.** When final compiled YAML is provided, inspect it before confirming the page. If it contains approvals plus user-requested edits, first update the page, research, and proposed canonical artifacts to satisfy the request; then write or update the approved canonical artifacts and confirm the page. If it contains `needs-clarification`, unresolved `down` feedback, or any unresolved negative feedback, revise the page and return it to `review` instead of marking it `confirmed`. Before replacing any existing alignment page, archive it to `docs/history/archive/YYYY-MM-DD/HHMMSS/alignment/migrate-{topic}.html`. Future amendments to confirmed pages follow the same archive-first rule and must show what changed from the prior confirmed record.
+**After approval handling.** When final compiled response YAML with `approval_status: ready-for-agent-review` is provided, inspect it before confirming the page. If it contains approvals plus user-requested edits, first update the page, research, and proposed canonical artifacts to satisfy the request; then write or update the approved canonical artifacts and confirm the page. If it contains `needs-clarification`, unresolved `down` feedback, or any unresolved negative feedback, revise the page and return it to `review` instead of marking it `confirmed`. Before replacing any existing alignment page, archive it to `docs/history/archive/YYYY-MM-DD/HHMMSS/alignment/migrate-{topic}.html`. Future amendments to confirmed pages follow the same archive-first rule and must show what changed from the prior confirmed record.
 
 **Diff highlighting on updates.** When the agent updates an existing alignment page after receiving feedback, compiled answers, confirmation edits, or later amendment evidence, the rendered HTML must visibly indicate what changed since the previous version. Highlight changed sections or blocks in-place with a `Changed`/`Updated` badge, distinct border or background, `<ins>`/`<del>` markup, or a side-by-side before/after comparison when that is clearer. A top-level change summary is useful but not sufficient by itself unless the changed content is also visibly marked where the reader reviews it. Remove or refresh stale change markers on later updates so the highlights describe the current revision only.
 
 **Archiving.** Before replacing an existing alignment page, archive it to `docs/history/archive/YYYY-MM-DD/HHMMSS/alignment/migrate-{topic}.html`.
 
-**Brief Me (text-to-speech).** Every alignment page must include a `<script src="../scripts/alignment-tts-kokoro.js"></script>` tag before `</body>`. The script adds a "Brief Me" button that reads the page aloud section-by-section using Kokoro TTS (an 82M-parameter model running client-side via WebGPU/WASM from `kokoro-js`). The transport bar includes play/pause/stop/skip controls, a voice selector (persisted in localStorage), and speed selection. On first click the voice model downloads (~92MB quantized on WASM; ~326MB fp32 on WebGPU). Weights persist between visits via Cache API origin storage, and this works on `file://` origins in Chrome — including `file://wsl.localhost` UNC paths (verified 2026-06-09 with an instrumented probe in Windows Chrome: `caches` is available, entries survive reloads and browser restarts, and Chrome shares a single `file://` origin across all local pages, so one download serves every alignment page). Repeat visits pay model initialization only, not re-download. If `caches` is undefined (non-Chromium or locked-down browsers), the model re-downloads each visit; serving pages from a local HTTP origin (e.g. `node scripts/serve-alignment.mjs` in the repo root, then `http://localhost:8907/alignment/<page>.html`) guarantees caching there — note `http://localhost` is a separate origin from `file://`, so the first localhost visit downloads once even when the `file://` cache is already warm. After the first successful load on a machine, the script preloads the model during browser idle time on later page loads (gated by a `tts-kokoro-used` localStorage flag, so users who never click pay nothing). Text is prepared for speech before synthesis: block boundaries (headings, paragraphs, list items, table cells) get sentence punctuation so the model does not read them as run-ons, and speech-hostile symbols are normalized (`~92MB` reads as "approximately 92MB", `v0.3` as "version 0.3", em-dashes as comma pauses, `e.g.`/`i.e.`/`vs.` expanded). Synthesis is pipelined with small chunks: the first audio chunk is kept short (~250 chars) for fast time-to-first-audio, later chunks stay small (~300 chars, cut at sentence or clause boundaries) with up to two chunks synthesizing ahead during playback, and the next section's opening chunk is prefetched while the current section's last chunk plays, so chunk and section boundaries are gapless. If Kokoro fails to load (old browser, network error), it falls back to the Web Speech API automatically. It skips gate controls, compile UI, feedback textareas, and stat grids. Charts and tables use narrative summaries instead of raw data: containers with a `data-tts-narrative` attribute have the narrative read aloud; containers without the attribute are silently skipped. To inject TTS into existing pages, run `node scripts/inject-tts.mjs` (idempotent). Use `--force` to replace the existing TTS block with an updated version. Do not inline the TTS script; always use the `src` tag. Do not use `type="module"` — module scripts are blocked by CORS on `file://` URLs.
+**Brief Me (text-to-speech).** Every alignment page must include a `<script src="../scripts/alignment-tts-kokoro.js"></script>` tag before `</body>`. The script adds a "Brief Me" button that reads the page aloud section-by-section using Kokoro TTS (an 82M-parameter model running client-side via WebGPU/WASM from `kokoro-js`). The transport bar includes play/pause/stop/skip controls, a voice selector (persisted in localStorage), and speed selection. On first click the voice model downloads (~92MB quantized on WASM; ~326MB fp32 on WebGPU). Weights persist between visits via Cache API origin storage, and this works on `file://` origins in Chrome — including `file://wsl.localhost` UNC paths (verified 2026-06-09 with an instrumented probe in Windows Chrome: `caches` is available, entries survive reloads and browser restarts, and Chrome shares a single `file://` origin across all local pages, so one download serves every alignment page). Repeat visits pay model initialization only, not re-download. If `caches` is undefined (non-Chromium or locked-down browsers), the model re-downloads each visit; serving pages from a local HTTP origin (e.g. `node scripts/serve-alignment.mjs` in the repo root, then `http://localhost:8907/alignment/<page>.html`) guarantees caching there — note `http://localhost` is a separate origin from `file://`, so the first localhost visit downloads once even when the `file://` cache is already warm. After the first successful load on a machine, the script preloads the model during browser idle time on later page loads (gated by a `tts-kokoro-used` localStorage flag, so users who never click pay nothing). Text is prepared for speech before synthesis: block boundaries (headings, paragraphs, list items, table cells) get sentence punctuation so the model does not read them as run-ons, and speech-hostile symbols are normalized (`~92MB` reads as "approximately 92MB", `v0.3` as "version 0.3", em-dashes as comma pauses, `e.g.`/`i.e.`/`vs.` expanded). Synthesis is pipelined with small chunks: the first audio chunk is kept short (~250 chars) for fast time-to-first-audio, later chunks stay small (~300 chars, cut at sentence or clause boundaries) with up to two chunks synthesizing ahead during playback, and the next section's opening chunk is prefetched while the current section's last chunk plays, so chunk and section boundaries are gapless. If Kokoro fails to load (old browser, network error), it falls back to the Web Speech API automatically. It skips gate controls, compile UI, feedback textareas, and stat grids. Charts and tables use narrative summaries instead of raw data: containers with a `data-tts-narrative` attribute have the narrative read aloud; containers without the attribute are silently skipped. To inject TTS into existing pages, run `node scripts/inject-tts.mjs` (idempotent). Use `--force` to replace the existing TTS block with an updated version. Do not inline the TTS script; always use the `src` tag. Do not use `type="module"` — module scripts are blocked by CORS on `file://` URLs. Narration follows along visually: the blocks currently being read (paragraphs, list items, table rows, headings, chart narratives) receive a `.tts-active-chunk` highlight at ~1–2-sentence chunk granularity, and the page auto-scrolls to keep them centered (instantly rather than smoothly under `prefers-reduced-motion: reduce`), while the active section keeps a lightened outline frame. The Web Speech fallback stays section-level — outline plus section-start scroll, no per-chunk highlight.
 
 **TTS narrative contract.** Every `.chart-container` and `.table-wrap` element should carry a `data-tts-narrative` attribute with a 1-3 sentence human-readable summary of what the chart or table shows. Chart functions in `scripts/alignment-chart-snippets.js` auto-generate a baseline narrative from their data; author-provided `data-tts-narrative` attributes take precedence. When authoring alignment pages manually, add `data-tts-narrative` to chart containers and table wrappers so that Brief Me reads a meaningful summary instead of skipping the element.
 
-**Browser open.** After writing the resulting HTML page, run `node scripts/open-html-page.mjs alignment/migrate-{topic}.html --browser auto` from the repository root, replacing the path with the actual page path when needed. Report the script status (`focused`, `opened`, `fallback-opened`, `blocked`, or `failed`) in the handoff. Continue when opening is `blocked` if the files were written and verified correctly; a blocked browser-open attempt does not make the skill fail.
+**Browser open.** After writing the resulting HTML page, attempt to open it from the repository root with this ordered fallback, replacing `alignment/migrate-{topic}.html` with the actual page path when needed. First, if `scripts/open-html-page.mjs` exists, run `node scripts/open-html-page.mjs alignment/migrate-{topic}.html --browser auto`. If the helper is missing or cannot open the page and the environment is WSL (`grep -qi microsoft /proc/version`) with `/mnt/c/WINDOWS/System32/WindowsPowerShell/v1.0/powershell.exe` available, open a browser-friendly file URI through PowerShell: build `file://wsl.localhost/${WSL_DISTRO_NAME:-Ubuntu}/<absolute-linux-path>` from the HTML page's absolute path and run PowerShell `Start-Process '<file-uri>'`. Try `xdg-open <absolute-linux-path>` only after the helper path and WSL PowerShell bridge are unavailable or blocked. Report the final status (`focused`, `opened`, `fallback-opened`, `blocked`, or `failed`) in the handoff, and include the absolute path when the status is `blocked` or `failed`. Continue when opening is `blocked` if the files were written and verified correctly; a blocked browser-open attempt does not make the skill fail.

package/packs/code-maintenance/claude/update-packages/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## v0.1 - 2026-06-13
+
+- Stop recommending unsupported npm project `.npmrc` age-gate keys.
+- Require retained publish-time proof for npm-only projects and persisted pnpm `minimumReleaseAge: 11520` config where supported.
+
+## v0.0 - 2026-05-17
+
+- Initial dependency update workflow with 8-day package publish-age selection and package-manager migration guidance.

package/packs/code-maintenance/claude/update-packages/SKILL.md

@@ -2,7 +2,7 @@
 name: update-packages
 description: Update project dependencies to the latest version that is more than 8 days old, preferring pnpm over npm and enforcing installer age gates
 type: execution
-version: v0.0
+version: v0.1
 argument-hint: "[package names, workspace scope, or --all]"
 ---
 
@@ -30,13 +30,12 @@ Use this skill when a project needs dependency updates but should avoid newly pu
    - If npm must remain, record the reason and continue with npm commands without inventing a pnpm migration.
    - In monorepo parallel-agent contexts, do not run commands that mutate shared lockfiles. Stop and route dependency changes to a single serial session.
 
-3. **Add the installer age gate.**
-   - Create or update the project-root `.npmrc` before dependency updates, preserving existing registry/auth settings.
-   - Add npm's relative age gate: `min-release-age=8`.
-   - Add pnpm's 8-day equivalent in minutes for pnpm versions/configurations that read `.npmrc`: `minimum-release-age=11520`.
-   - If the active pnpm version uses `pnpm-workspace.yaml` or `pnpm config` for non-auth settings, also add or update `minimumReleaseAge: 11520` in the project `pnpm-workspace.yaml` or documented pnpm project config. Do this in addition to `.npmrc`, not instead of it, so npm and pnpm installs are both covered.
-   - When documenting the settings, keep their ownership clear: `min-release-age=8` is the npm relative-age guard, while `minimum-release-age=11520` and `minimumReleaseAge: 11520` are pnpm coverage for the same 8-day policy where supported.
-   - Avoid overwriting private registry tokens, scoped registry lines, or unrelated project config.
+3. **Add or verify the age gate.**
+   - Do not add unsupported age-gate keys to project `.npmrc`; modern npm warns on unknown project config such as `min-release-age` and `minimum-release-age`.
+   - For npm-only projects that cannot migrate to pnpm, enforce the 8-day policy by selecting versions from retained registry publish-time evidence before mutation, and document that npm does not provide a supported persisted project age gate.
+   - For pnpm projects, add or update pnpm project config with `minimumReleaseAge: 11520` in `pnpm-workspace.yaml` or the documented pnpm project config location supported by the active pnpm version.
+   - When documenting the settings, keep ownership clear: npm coverage is explicit registry age verification during the run; `minimumReleaseAge: 11520` is pnpm's persisted 8-day installer age gate where supported.
+   - Avoid overwriting private registry tokens, scoped registry lines, or unrelated package-manager config.
    - If an existing config deliberately excludes packages from the age gate, keep only exclusions that are documented and necessary; otherwise remove or narrow exclusions before updating.
 
 4. **Discover eligible versions.**
@@ -58,15 +57,15 @@ Use this skill when a project needs dependency updates but should avoid newly pu
    - For non-trivial or plan-first dependency updates, write a batch execution checklist before mutating files. Each batch must include:
      - exact mutation command(s) or file edits for that batch;
      - exact verification command(s) to run before moving on;
-     - expected proof or artifact, such as `packageManager`, `.npmrc`, lockfile creation, selected package version, or smoke-test output;
+     - expected proof or artifact, such as `packageManager`, retained publish-time evidence, pnpm age-gate config, lockfile creation, selected package version, or smoke-test output;
      - a "do not proceed on red" gate and a stop condition that routes broad compatibility work to `/migrate <package or framework>`.
    - For npm-to-pnpm migrations, make the package-manager migration Batch 0, then put low-risk minors/patches before framework, runtime, test-runner, or build-tool majors unless peer constraints require a different order.
    - For Vitest and other test-runner migrations, prefer the project script (`pnpm test`, `pnpm run test`, or the discovered package-manager equivalent) plus a discovered single-file or config smoke check. Do not recommend Jest-only or version-uncertain flags unless you have verified that the selected runner version supports them.
    - Do not edit lockfiles by hand.
 
 6. **Verify after updates.**
-   - Confirm `.npmrc` contains `min-release-age=8` and, for pnpm coverage, `minimum-release-age=11520` unless the project has a documented reason to store pnpm settings only in `pnpm-workspace.yaml` or pnpm config.
-   - For pnpm projects, confirm `minimumReleaseAge: 11520` is present in `pnpm-workspace.yaml` or equivalent project pnpm config when required by the active pnpm version.
+   - Confirm npm-only projects retain publish-time evidence proving selected versions are older than 8 full days.
+   - For pnpm projects, confirm `minimumReleaseAge: 11520` is present in `pnpm-workspace.yaml` or equivalent project pnpm config supported by the active pnpm version.
    - Run the repo's install/update command, typecheck, tests, lint, build, and any focused smoke checks implied by changed packages.
    - For major/framework/build-tool updates, run or document package-specific compatibility checks and smoke tests before calling the update complete.
    - If verification fails, diagnose the root cause. Apply the smallest durable fix when it is clearly inside the dependency update scope.
@@ -82,7 +81,7 @@ Use this skill when a project needs dependency updates but should avoid newly pu
 ## Output
 
 - **Package manager:** before and after, including any npm-to-pnpm migration result.
-- **Age gate:** `.npmrc` and pnpm config files changed, including `min-release-age=8` and `minimum-release-age`/`minimumReleaseAge` values.
+- **Age gate:** npm publish-time proof and pnpm config files changed, including `minimumReleaseAge: 11520` where supported.
 - **Updated packages:** package, old version, new version, selected publish date, and batch.
 - **Skipped packages:** package and reason.
 - **Major-upgrade risk handling:** affected packages, batch order, compatibility checks, focused smoke checks, and any stop route to `/migrate <target>`.
@@ -93,7 +92,7 @@ Use this skill when a project needs dependency updates but should avoid newly pu
 ## Constraints
 
 - Never select a package version published within the last 8 days unless the user explicitly overrides the safety gate.
-- Do not finish a mutation run without adding or verifying the package-manager age gate, unless the user explicitly declines it or the package manager cannot support it; document either exception.
+- Do not finish a mutation run without adding or verifying the package-manager age gate: retained publish-time proof for npm-only projects and persisted `minimumReleaseAge: 11520` for pnpm projects where supported. If the user explicitly declines it or the package manager cannot support persisted enforcement, document the exception.
 - Do not run package-manager commands that mutate a shared lockfile while acting as one of multiple parallel agents.
 - Do not hand-edit generated lockfiles.
 - Do not remove npm support when scripts, deployment docs, CI, or hosting constraints explicitly require npm.