v1.24.1

frontend-production-engineer v1.24.1

Patch release. The skill is installed on its own by engineers who never install another skill from the same author. It named two of those skills by name at fifty-six sites, and each name was a dangling reference for those engineers. Every site now states the same rule in self-contained words. No domain is added, and the router, the domain roster, and the frontmatter description are unchanged.

What changed

• Fifty-five sites in SKILL.md, AGENTS.md, and twenty-four reference files handed a server-side subject to a named backend security skill. Each now hands it to "the backend's security review". The subject each site hands over is unchanged: the DRF permission class, the server-side CSRF rule, the rate limit, the cookie attributes, the upload scan, the stored file's name, the secret storage, the password hash, the server-side injection sink, and the never-log guarantee on a response body.
• references/openapi-schema-and-codegen.md handed the reconciliation of two OpenAPI documents to a named FastAPI skill. It now hands that reconciliation to the backend, which owns one error shape, one authentication scheme, and one schema dialect across both surfaces. The frontend keeps what it generates from each document.

Verification

Both repository workflows pass on the finished tree: 73 reference files, every link resolving, no orphan, balanced code fences, SKILL.md at 211,632 of the 215,040 bytes allowed, and the frontmatter description at 1013 characters. A grep for either skill name over the repository returns nothing.

v1.24.0

frontend-production-engineer v1.24.0

One handoff. references/openapi-schema-and-codegen.md owns the OpenAPI schema
as the one source of the frontend types, and its "What the backend publishes"
table enumerates DRF with drf-spectacular, DRF with drf-yasg, django-ninja, a
schema a person wrote, and no schema at all. Every row assumes one backend
runtime. A Django system that runs a FastAPI service beside it publishes two
documents, and the file had no route for that case. No domain is added, and the
router, the domain roster, and the frontmatter description are unchanged.

Why it matters

The two documents are not in the same dialect, and the difference reaches the
generated types.

• FastAPI 0.141.1 emits "openapi": "3.1.0" and renders an optional string as
  {"anyOf": [{"type": "string"}, {"type": "null"}]}.
• drf-spectacular 0.30.0 emits "openapi": "3.0.3" and renders the same field
  as {"type": "string", "nullable": true}.

A client generated from the DRF document carries nothing for the FastAPI
surface. The nullable-field guidance in
references/boundary-validation-and-api-types.md is written against the 3.0
spelling throughout, so the 3.1 form of that same field arrives in a shape
those rules do not describe.

What changed

references/openapi-schema-and-codegen.md gains one entry in its ## Handoffs
list. A second backend runtime beside Django, and the two OpenAPI documents
that reach one client, now route to fastapi-alongside-django. That skill
reconciles the two dialects. This file keeps what the frontend generates from
each document.

Verification

Both repository workflows pass on the finished tree: 73 reference files, every
link resolving, no orphan, balanced code fences, SKILL.md at 211,569 of the
215,040 bytes allowed, and the frontmatter description at 1013 characters.

v1.23.4

frontend-production-engineer v1.23.4

A reconcile release. The build is complete: all twenty-four domains are
integrated, and the router carries every one of them. No domain is added. Five
repairs, against five items of the battery, in README.md and in the three
files that carry the same content to the other agents.

Repaired

• 2 — README.md: the roster marked every domain as integrated and named
  no file that carries it. A reader who wanted the depth behind a domain had
  the router table as the only route to it, and the router is keyed by concern
  rather than by domain. Each of the twenty-four rows now names its files.
  The seventy-three files partition across the roster, each one under exactly
  one domain.
• 4 — README.md: the layout tree listed every other top-level entry,
  including the dot-directories and .gitignore, and omitted the two
  workflow files. The sentence under the tree states what the repository does
  not hold, so the tree reads as complete. The two files are in it now, with
  what each one gates.
• 8 — AGENTS.md, GEMINI.md, and the Cursor rule: none of the three
  stated the order in which a feature task resolves the domains. Two of them
  named the tiers, which is a taxonomy and not an order, and the third named
  nothing. An agent that reads one of these files alone had no rule that puts
  the backend contract before the code that calls it. All three now state the
  order.
• 10 — AGENTS.md, GEMINI.md, and the Cursor rule: none of the three
  named the seven domains that hold a veto over completion. A reader of one of
  these files could run the four commands, pass all four, and never learn that
  a keyboard trap or an injection sink is a failed task. All three now name
  the seven, with the first failure condition of each, and each one points at
  the full list.
• 11 — GEMINI.md: it stated the standing rules and the conflict rule, and
  it stated no check at all. It deferred the definition of done to the
  canonical file, so the one agent that reads only a context file had nothing
  to run before it reported the work complete. It states the six conditions
  now.

Domains affected

• None. This run changed no reference file, so no domain moved. The four
  cascade files changed, and SKILL.md changed for the version string alone.
• The three cascade files now name the seven blocking domains:
  01 nextjs-app-router-architecture, 02 typescript-type-system-discipline,
  05 django-drf-api-contract, 07 authentication-and-authorization,
  10 accessibility-wcag, 17 frontend-security, and
  20 testing-and-quality.
• README.md now maps all twenty-four domains onto the seventy-three files
  that carry them.

The version moves from 1.23.3 to 1.23.4. This run adds no domain, so the router
still carries twenty-four and the minor number stays at 23. This run changed
five files, none of them under references/, so the patch number moves by one.
The frontmatter description is unchanged at 1013 characters.

Limits

• Thirty-six items ran. Thirty-one passed on the first read, five failed, and
  each of the five was re-tested after its repair. The re-test is the same
  command that found the failure.
• The blocking lines in the three cascade files carry the first failure
  condition of each gate, and not the whole gate block. Reproducing seven gate
  blocks would make these files copies rather than pointers, which is what the
  head of AGENTS.md states they are not. Each file names the canonical file
  as the holder of the full list.
• The denylist search returns zero hits across the full tree, and it returned
  zero before this run as well. No seam lost a name in this pass, so no seam
  needed its boundary restated.
• One term for one thing holds across the tree. Two deviations sit inside code
  and stay: a British spelling in one thrown error string, and an American
  spelling in one code comment. Both are exempt under the language standard.
• The six https:// tokens in README.md are the clone address of this
  repository, which every install instruction needs. Two http:// tokens
  remain in an Nginx proxy_pass line, where the scheme is required and the
  value names an upstream block rather than a host.
• Thirty-four tags and thirty-four published releases match one for one. None
  is a draft and none is a prerelease.

v1.23.3

frontend-production-engineer v1.23.3

An adversarial release. No domain is added, and the router still carries
twenty-four. Sixteen repairs, against five items of the battery, in the
foundations and the backend contract, and in the shared type and lint rules.

Repaired

• 6 — session-and-token-lifecycle, route-protection-and-permissions, and
  server-state-and-query-cache: three verification steps passed -E to
  ripgrep. The flag is --encoding, so each command aborted with
  unknown encoding. The stated pass condition of the first is that it prints
  nothing, so a repository holding the exact Wrong sample of the same file
  passed the step. The default engine already reads the pattern.
• 6 — server-and-client-components: the search for a "use client"
  directive on a layout or a page used -g 'app/**/layout.tsx'. A ripgrep glob
  that holds a slash anchors to the search root, and this material mandates
  src/app/, so the command matched nothing and exited 1. The globs carry the
  **/ prefix now.
• 7 — typescript-config-and-enforcement: the recommended tsconfig.json
  set noPropertyAccessFromIndexSignature. ProcessEnv is an index signature,
  so the flag makes every process.env.NAME read a TS4111 error, and this
  material holds thirty-two of them across fourteen files. The domain 02 gate
  never asked for the flag, and the parse at the boundary is the stronger rule,
  so the flag and its table row go.
• 7 — session-and-token-lifecycle: the logout wrote
  import { queryClient } from "@/lib/query/client". That module exports
  makeQueryClient and getQueryClient, and a module-scope queryClient is
  its own Wrong sample, whose failure is that one user receives the rows of
  another. The import and the call take getQueryClient.
• 7 — type-modeling-and-narrowing: the sample said that satisfies keeps
  the literal. The contextual type of Metadata['title'] carries no literal
  member, so "Home" widens to string. The sample takes
  as const satisfies Metadata, which is the ordering rule the next paragraph
  already states.
• 9 — lint-format-and-scripts: the Correct disable wrapped its reason onto
  a second // line, so eslint-disable-next-line targeted that comment rather
  than the import below it. The rule still fired, and the unused directive
  failed --max-warnings=0. The directive is one physical line.
• 9 — cross-origin-and-bff-proxy: the Correct proxy forwarded
  Content-Type and cookie alone. The upstream enforces CSRF on every unsafe
  method, so each POST returned the 403 that this same file documents forty
  lines above, and the domain 05 gate fails a write with no X-CSRFToken. The
  header is forwarded, and the closing rule names it.
• 9 — suspense-and-actions: the retry control called resetErrorBoundary
  on a promise that a Server Component created. The boundary re-rendered the
  same rejected promise and the error returned in the same commit, so the
  control was a permanent dead end — which the sentence below the sample
  forbids. The boundary takes an onReset that reaches the server.
• 9 — live-events-and-cache-merge: the Wrong and Correct pair swapped two
  calls that name different cache entries. A write to the detail key cannot
  clear the stale mark on the list prefix, so both orderings behave alike and
  the stated failure never happens. Both calls name one entry, so the mechanism
  is visible.
• 6 — app-router-structure: a session gate in app/dashboard/layout.tsx
  was labelled Correct, and the checklist accepted a layout. Domain 07 labels
  the same shape Wrong, because a layout does not re-render on a client
  navigation, and the blocking gate fails a gate that sits in a layout. The
  sample moves to the page, and the checklist states why a layout is not enough.
• 5 — component-composition: the Correct sample took asChild, which
  belongs to Radix Primitives. The pinned stack is shadcn/ui on Base UI, and the
  table two rows above already says that Base UI takes a render prop. The
  sample takes render, and the Radix form stays beside it.
• 6 — api-client-and-request-safety, server-state-and-query-cache, and
  push-transport-and-connection: three declarations used interface where no
  module merges into them. The house rule takes type, and the verification
  step of the file that owns the rule greps for exactly this.
• 6 — lint-format-and-scripts: the lint:fix script omitted
  --max-warnings=0 in the canonical script list, while the same file states
  that every invocation carries it and its checklist asks for it.
• 6 — component-composition: the checklist asked for a file under 200
  lines and a component under five useState calls. The rule and the
  verification step both read "more than", so a file at exactly 200 lines passed
  the rule and failed the checklist.
• 6 — openapi-schema-and-codegen: the case-convention step said that one of
  two commands must print nothing. A conversion at the client boundary is a
  configuration the same file permits, and under it both commands print hits.
  The step names the three configurations and what each pair of results means.
• 8 — push-transport-and-connection: the visibility handler closed the
  socket and left the pending reconnect timer running. A return before the timer
  fired opened one socket, and the timer then opened a second. The handler
  clears the timer, drops the reference, and reopens only where none is held.

Domains affected

• 01 nextjs-app-router-architecture — app-router-structure and
  server-and-client-components.
• 02 typescript-type-system-discipline — type-modeling-and-narrowing and
  typescript-config-and-enforcement.
• 03 react-component-architecture — component-composition and
  suspense-and-actions.
• 04 project-structure-and-tooling — lint-format-and-scripts.
• 05 django-drf-api-contract — api-client-and-request-safety,
  cross-origin-and-bff-proxy, and openapi-schema-and-codegen.
• 06 data-fetching-and-state — server-state-and-query-cache.
• 07 authentication-and-authorization — route-protection-and-permissions and
  session-and-token-lifecycle.
• 08 realtime-and-streaming — live-events-and-cache-merge and
  push-transport-and-connection.

The version moves from 1.23.2 to 1.23.3. This run adds no domain, so the router
still carries twenty-four and the minor number stays at 23. This run changed
twelve reference files and four files outside references/, so the patch number
moves by one. The frontmatter description is unchanged at 1013 characters.

Limits

• These sixteen came from the one attack lane whose verification did not finish
  in the previous release. Each one was checked by hand for this release. The
  four ripgrep defects and the two glob forms were run against a fixture, and
  each behaves as the repaired text states.
• No TypeScript compiler and no Node runtime for this stack are installed on the
  machine that ran this pass. The compile claims were read against the pinned
  versions, against the exports that the cited module declares, and against the
  contextual type that the operator receives. None was compiled here.
• Removing noPropertyAccessFromIndexSignature is the one repair that changes a
  recommendation rather than a defect in a sample. The alternative was to
  rewrite thirty-two sample sites across fourteen files to bracket access, which
  is a larger change than the finding.
• Two http:// tokens remain, in an Nginx proxy_pass line. Nginx requires the
  scheme, and the value names an upstream block rather than a host.

v1.23.2

frontend-production-engineer v1.23.2

An adversarial release. No domain is added, and the router still carries
twenty-four. Nine repairs, against six items of the battery, in nine of the
twenty-four integrated domains and in the public boundary.

Repaired

• 7 — data-table-and-server-driven-state: the sortable header of the
  Correct sample read aria-sort={sort === "reference" ? "ascending" : "none"},
  and the control set one value. The header could never announce a descending
  sort, so a screen reader heard ascending on a table that the request had
  ordered the other way. The sample takes the - prefix that the same file
  states for the DRF ordering parameter, and the checklist asks whether the
  value matches the direction of the request.
• 7 — data-table-and-server-driven-state: the virtualised row read
  rows[virtualRow.index].id. noUncheckedIndexedAccess is mandatory in this
  material, so the expression is Row | undefined and tsc --noEmit stops on
  it. Verification step 9 of the same file runs that command, so the file asked
  for code that its own gate rejects. The row is hoisted and guarded.
• 7 — file-upload-and-transport: the progress helper installed onload
  and onerror alone. abort() fires neither, so a cancel left the promise
  open for the life of the page, the row kept its last percentage, and the
  pending state never cleared. The helper rejects on abort with an
  AbortError, and a warning states why the two handlers are not enough.
• 7 — served-content-and-downloads: the picker sample called
  window.showSaveFilePicker behind an in guard. lib.dom.d.ts carries no
  such method on TypeScript 5.9, so the guard narrows the value to unknown and
  the call fails the typecheck. The sample declares the optional method first.
• 5 — component-styles-and-variants: verification step 4 searched for the
  Tailwind v3 important prefix. Version 4 writes the modifier as a suffix, so
  bg-destructive! passed the step, the checklist item, and the symptom row
  together. The pattern reads the suffix, and the comment states the change.
• 6 — wcag-conformance-and-verification: the route-listing line of
  verification step 5 read rg -c 'page.tsx' -g 'page.tsx' src/app/. -c
  counts matching lines inside files, so the line printed nothing and exited 1
  on every project, and the AxeBuilder list beside it had nothing to compare
  against. The line reads rg --files.
• 6 — version-proof-and-unconfirmed-code: the row for the second proxy.ts
  bypass gave the symptom as a version below the patched minor, and neither the
  symptom nor the migration named that minor. Two other files state 16.2.11 and
  15.5.21, and the row states them now.
• 16 — untrusted-markup-and-injection: the sink row and the checklist asked
  only that a postMessage payload is parsed. A parse proves the shape and
  never the sender, so a shape-valid message from any framing page drove the
  handler. Both ask for an event.origin test against an allowlist first.
• 13 — SKILL.md and event-taxonomy-and-tracking-plan: the seam row for
  the release domain and the analytics domain repeated the second half of the
  routing row word for word, so it never stated what the release domain owns for
  the vendor path. The reference then sent the reader to the reverse-proxy file,
  which holds no vendor rewrite at all. The seam states the ownership, and the
  rule states that one layer alone answers the path.
• 29 — five reference files cited a dossier, and five cited a research
  corpus, as the provenance of a library table or of a stated range. Neither
  exists for a reader who installed this skill, and the reader is never the
  author. Ten sentences state what this skill read, or what the table itself
  holds.
• 25 — README.md: the Codex install section named a bundled pointer skill
  twice. The repository holds no such file, git log -S shows the phrase has
  been unbacked since the scaffold, and instruction-files-and-skill-discovery
  states that Codex reads a cloned SKILL.md directly. A reader who followed
  the section went looking for a file that is not there.
• 25 — README.md: the Gemini section told the reader to copy GEMINI.md
  into a repository root, and it was the only install section with no step that
  obtains the file. It carries the clone.
• 6 — README.md: the blocking paragraph named the last two of seven
  domains as the absolute pair, which reads as security and testing. The
  absolute pair is accessibility and security, and the next sentence of the same
  paragraph already said so.

Domains affected

• 04 project-structure-and-tooling — instruction-files-and-skill-discovery.
• 09 design-system-and-styling — component-styles-and-variants.
• 10 accessibility-wcag — wcag-conformance-and-verification.
• 11 forms-and-validation — form-schema-and-field-binding.
• 12 data-tables-and-visualization — data-table-and-server-driven-state.
• 13 media-and-file-handling — file-upload-and-transport and
  served-content-and-downloads.
• 17 frontend-security — untrusted-markup-and-injection.
• 20 testing-and-quality — end-to-end-journeys-and-flake-control,
  merge-gates-and-quality-signals, network-mocks-and-contract-tests, and
  test-strategy-and-component-tests.
• 23 analytics-privacy-and-consent — consent-gate-and-cookie-inventory and
  event-taxonomy-and-tracking-plan.
• 24 agent-operating-doctrine — version-proof-and-unconfirmed-code.

The version moves from 1.23.1 to 1.23.2. This run adds no domain, so the router
still carries twenty-four and the minor number stays at 23. This run changed
twelve reference files and four files outside references/, so the patch number
moves by one. The frontmatter description is unchanged at 1013 characters.

Limits

• Thirty-five candidate findings met an adversarial verifier that was told to
  refute each one. Nine survived, and this note holds them. Twenty-six fell,
  and the reason was almost always the same: a neighbouring sentence, a
  Not here clause, a seam row, or a Handoffs block already answered the
  objection. Those twenty-six are not repaired, because there was nothing to
  repair.
• Twenty-four task sentences ran against the description and the router alone.
  Twelve fired and twelve stayed silent, and eight of the twelve silences came
  from a deliberate route-out to the backend rather than from luck.
• Four routing candidates fell to the same verifier. The command palette resolves
  through the combobox, the listbox, the modal, and the focus trap that the row
  already names. A browser push task reaches the transport file, which bounds
  itself to an open tab in its first two paragraphs. A stale list after a write
  is settled at the symptom by server-state-and-query-cache. Scroll on
  navigation belongs to domain 01 by three seam rows, and the material for it
  is not in this repository.
• No TypeScript compiler and no Node runtime for this stack are installed on the
  machine that ran this pass. The four sample repairs were read against the
  pinned versions and against lib.dom.d.ts of the installed TypeScript, and
  none was compiled here. The two rg patterns were run against a fixture, and
  both behave as the repaired text states.
• The gate blocks for the seven blocking domains were walked with a failing task
  each. All seven blocked. The security and developer-convenience conflict
  resolved to security, and the exception clause for 'unsafe-inline' matches
  the reference that owns it in both directions.
• Two http:// tokens remain, in an Nginx proxy_pass line. Nginx requires the
  scheme, and the value names an upstream block rather than a host.

v1.23.1

frontend-production-engineer v1.23.1

A checkpoint release. No domain is added, and the router still carries
twenty-four. Twelve repairs, against ten items of the battery, in the operating
doctrine and in twenty of the twenty-four integrated domains.

Repaired

• 37 — fifty-one reference files, SKILL.md, README.md, AGENTS.md, and
  the Cursor rule: every one of them routed the reader to a repository that a
  public reader cannot install. The reader of this skill is never its author, so
  such a handoff names an owner nobody can reach, and the frontend rule then
  reads as incomplete. Three hundred references go, and every seam keeps its
  boundary: server-side work that the frontend must not perform now routes to
  the backend, which is an owner a public reader can act on.
• 38 — task-plan-and-scope-control: the table of the changes that stop a
  frontend task carried six such repositories in its owner column, and the
  checklist and the closing summary repeated two of them. The table keeps every
  row, because the classes of change are what a reader needs, and the column
  states the owner.
• 39 — twenty-four router clauses and thirty-one handoff lines: each one
  kept its subject and lost the name. Four clauses named two owners for one
  subject and now name one, because both resolved to the same place.
• 43 — README.md, AGENTS.md, and SKILL.md: three sentences addressed
  the owner of this repository rather than the person who installed it. The
  backend is out of scope, and the roster holds all twenty-four domains.
• 44 — SKILL.md, README.md, and the Cursor rule: five statements said
  that the router grows by one entry per release, that the invocation order
  applies as it grows, that six further domains follow the same pipeline, and
  that two folders arrive with a later domain. All twenty-four domains are
  integrated, so the four files state that.
• 44 — wcag-conformance-and-verification: one sentence said that the
  testing domain is not integrated yet. It landed four releases earlier, so the
  sentence sent the reader to nothing.
• 19 — wcag-conformance-and-verification and lint-format-and-scripts:
  both named the testing domain by number and slug with no loadable path. The
  runner, the fixtures, and the harness resolve to
  test-strategy-and-component-tests for the component lane and to
  end-to-end-journeys-and-flake-control for the browser lane, and the test
  layout to the first of those.
• 48 — README.md: the opening paragraph stated that the Django backend
  belongs to a set of skills that the reader has no way to install.
• 8 — instruction-files-and-skill-discovery carried no // Wrong: marker
  at all. It, task-plan-and-scope-control,
  version-proof-and-unconfirmed-code, and merge-gates-and-quality-signals
  opened a text fence with a bare
  Wrong:, Correct:, or Failure:. directory-and-module-boundaries already
  writes the comment form inside a text fence, and thirty-one marker lines
  take it.
• 30 — app-router-structure, bidirectional-layout-and-scripts,
  exposed-endpoints-and-destinations, keyboard-focus-and-live-regions,
  merge-gates-and-quality-signals, secret-boundary-and-supply-chain, and
  test-strategy-and-component-tests: seven descriptive sentences ran past
  twenty-five words. Each is two sentences now, and the break falls where a
  colon or a coordinator already split the thought.
• 30 — task-plan-and-scope-control,
  instruction-files-and-skill-discovery, security-headers-and-csp, and
  degradation-and-health-checks: six -ing forms stood as a noun or as a
  verb. The plan template read "each one naming the file it touches", and one
  file kept depth out of an instruction file "by moving" it.
• 31 — locale-formatting-and-calendars and SKILL.md wrote recognises
  against three uses of recognizes. performance-budgets-and-measurement
  introduced "the backend owner" where nine other uses say "the backend team".

Domains affected

• 01 nextjs-app-router-architecture — app-router-structure,
  caching-and-revalidation, and data-access-and-mutations.
• 02 typescript-type-system-discipline — boundary-validation-and-api-types.
• 04 project-structure-and-tooling — dependencies-and-git-workflow,
  directory-and-module-boundaries, and lint-format-and-scripts.
• 05 django-drf-api-contract — api-client-and-request-safety,
  cross-origin-and-bff-proxy, and openapi-schema-and-codegen.
• 06 data-fetching-and-state — server-state-and-query-cache.
• 07 authentication-and-authorization — route-protection-and-permissions and
  session-and-token-lifecycle.
• 08 realtime-and-streaming — live-events-and-cache-merge and
  push-transport-and-connection.
• 10 accessibility-wcag — keyboard-focus-and-live-regions and
  wcag-conformance-and-verification.
• 11 forms-and-validation — form-submission-and-server-errors.
• 12 data-tables-and-visualization — cell-formatting-and-export,
  charts-and-visual-encoding, and data-table-and-server-driven-state.
• 13 media-and-file-handling — file-upload-and-transport,
  image-and-video-delivery, and served-content-and-downloads.
• 15 ux-writing-and-content-design — error-and-empty-state-copy.
• 16 performance-and-web-vitals — paint-and-interaction-cost and
  performance-budgets-and-measurement.
• 17 frontend-security — exposed-endpoints-and-destinations,
  secret-boundary-and-supply-chain, security-headers-and-csp, and
  untrusted-markup-and-injection.
• 18 seo-and-metadata — crawl-and-index-control,
  route-metadata-and-social-cards, and structured-data-and-rich-results.
• 19 internationalization-and-rtl — bidirectional-layout-and-scripts,
  locale-formatting-and-calendars, and locale-routing-and-catalogs.
• 20 testing-and-quality — end-to-end-journeys-and-flake-control,
  merge-gates-and-quality-signals, network-mocks-and-contract-tests, and
  test-strategy-and-component-tests.
• 21 observability-and-resilience — correlation-and-telemetry,
  degradation-and-health-checks, and error-capture-and-reporting.
• 22 build-deploy-and-runtime-ops — build-output-and-container-image,
  release-pipeline-and-rollback, and runtime-process-and-reverse-proxy.
• 23 analytics-privacy-and-consent — consent-gate-and-cookie-inventory,
  data-rights-and-privacy-surfaces, and event-taxonomy-and-tracking-plan.
• 24 agent-operating-doctrine — instruction-files-and-skill-discovery,
  task-plan-and-scope-control, and version-proof-and-unconfirmed-code.

The version moves from 1.23.0 to 1.23.1. This run adds no domain, so the router
still carries twenty-four and the minor number stays at 23. This run changed
fifty-three reference files and five files outside references/, so the patch
number moves by one. The frontmatter description is unchanged at 1013
characters.

Limits

• The router rows, the trigger groups of the Cursor rule, and the frontmatter
  description are enumerations of Technical Names. The sentence-length rule
  does not shape them, and this run applied it to none of them.
• The standard holds an instruction to twenty words and a descriptive sentence
  to twenty-five. These files are descriptive rules rather than a procedure, and
  four earlier checkpoints read them that way, so this run enforced the
  twenty-five. Forty-five rule statements run from twenty-one to twenty-five
  words on that reading, and none moved.
• Nine reference files had never met this battery, because domains 22, 23, and
  24 landed after the 1.20.1 checkpoint. Each was read in full. Six of the
  twelve repairs reach into them, and three sit there alone.
• Sixty-four reference files met the battery at an earlier checkpoint. This run
  tested them with the mechanical sweep: the router resolution, the orphan
  search, the hyperlink and marker searches, the Next 15 idioms, the pair and
  checklist polarity, the rg --files-without-match convention, the seam
  resolution, the invisible-character scan, the dialect count, the noun-cluster
  scan, the warning placement, and the sentence-length rule. Six of them carried
  a repair.
• No TypeScript compiler and no Node runtime for this stack are installed on the
  machine that ran this checkpoint. Every code sample was read against the
  pinned versions, and none was compiled.
• This run added no material, so it opened no forward seam. Every seam that it
  changed points at a file that exists today, or at an owner outside this
  repository that the text names in its own right.
• One // TODO: remains, inside a Correct sample that teaches how to record a
  schema gap against a ticket. It is the rule that the sample states, and not an
  unfinished note.
• Two http:// tokens remain, in an Nginx proxy_pass line. Nginx requires the
  scheme, and the value names an upstream block rather than a host.

v1.23.0

frontend-production-engineer v1.23.0

The domain added is 24 agent-operating-doctrine — Tier 0 operating
discipline, and it is always in effect. It is the twenty-fourth and the last.

What landed

Three reference files. The split is the moment at which an agent reaches for
the material, and not the sections of the research. Planning a change, proving
that the code can run, and editing the files that instruct an agent are three
moments. This domain is always in effect, so one file would put the AGENTS.md
precedence rules and the skill metadata budget in front of every typecheck
failure.

• references/task-plan-and-scope-control.md — the work that surrounds a diff.
  The plan is four parts under fifteen lines, because it is a contract rather
  than a document, and a goal that names a file rather than a behavior is a
  step. A question is asked only where the answer changes the route tree, the
  data model, or a contract that a user can observe. Everything a neighbouring
  file already answers becomes a stated assumption instead, because asking
  spends a turn that the repository had already spent. The rest is the diff
  that carries only the request, the abstraction that waits for a second caller
  who never arrives, the orphan that this change created against the one that
  was already there, and the request that implies a serializer field nobody can
  invent. The decision record is five parts for a choice that a small diff
  cannot reverse, and it is nothing at all for a name or a folder, because
  trivial records bury the load-bearing ones. The last part is the three lines
  that close the work: what changed, what was assumed, and what was not done.
• references/version-proof-and-unconfirmed-code.md — the proof that the code
  can run. The declared range is not the version, because a caret of ^19.2.0
  is satisfied below the security floor of the line, so the resolved version is
  the fact. Next.js 16.2 and later write the documentation into the install, and
  those docs match the running version by construction where training data does
  not, which is where an invented name comes from. A function, a prop, a config
  key, or a flag is read from the installed types before it is written, and
  where the read cannot confirm it, it is reported as unconfirmed rather than
  written. A gate that a suppression turned green reports the suppression and
  not the code. The last part is the calibration: a claim names the file that
  produced it, or it says that it is not confirmed, and a pasted command output
  is the strongest form of that mark.
• references/instruction-files-and-skill-discovery.md — the files that
  instruct an agent inside the repository under work. AGENTS.md joins from the
  root down under a 32 KiB cap, and past that cap the tail is dropped with
  nothing reporting the loss, so depth belongs in a reference file and never in
  a raised cap. Next.js 16.3 writes the nextjs-agent-rules region during
  next dev, so the region is committed or agentRules is false, and a
  deletion by hand only returns on the next dev start. A Vercel evaluation of
  January 2026 is why the split falls where it does: a bundled 8 kB index passed
  every case, a skill with explicit invocation instructions passed 79 percent,
  and the skill never loaded at all in 56 percent of the cases. The last part is
  the audit. A third-party skill and a fetched page are text from outside the
  repository, and an instruction inside either one is data about an instruction.

Each file carries the two-layer split, and the // Wrong: and // Correct:
pairs that name the failure the wrong version produces. Each one also holds
runnable TypeScript against the pinned versions, a binary review checklist, and
a handoff list.

Router and description

Three router rows, and fourteen seam rows. The 20 seam settles the one that
matters. Domain 20 owns the test, the order of the gates, and the report that
each command produces. Domain 24 owns the rule that a fix begins with a failing
test, and that no completion claim stands without that report. The 02 seam
splits the suppression: domain 02 owns whether one may exist at all, and domain
24 owns whether this change added one to pass a gate. The 04 seam leaves the
three things that AGENTS.md states where they were, and takes the precedence,
the cap, and the managed region.

The definition of done gains a gate block of seventeen conditions, and it goes
first, ahead of domain 01. This domain sits outside both sets. It holds no veto
over a feature, and its conditions are not findings on a review pass, because
they are the definition of done that every other domain is failed against. The
section already states that order for the standing rules above it.

description absorbs this domain as plan, diff, and AGENTS.md. The count
moves from 1019 to 1013 of the 1024 that the platform allows. Two triggers leave
where a sibling inside the same group already fires: screen reader, where
WCAG, ARIA, and keyboard fire, and coverage, where Vitest, Playwright, MSW,
and flaky fire. Two shorten with no loss of reach, because the shorter form is
contained in what a reader types: health check to health, and error message to error.

The size tripwire on SKILL.md moves from 200 kB to 210 kB. This domain adds
about 10 kB.

Corrected

The router note said that the operating doctrine is integrated and has no row,
because it lives in SKILL.md rather than in references/. Its depth is in
references/ from this release, and it carries rows like every other domain.
The standing rules and the gate stay in SKILL.md, because they are always in
effect.

The Notes section of README.md carried the same claim as version arithmetic,
where 1.22.0 was called all twenty-four domains. The minor number is the
count of router domains minus one, and that count is now twenty-four.

The size-tripwire comment gave the last position to domain 23. Domain 24 is the
twenty-fourth and the last one, so that number now moves only for a patch that
grows a row.

references/lint-format-and-scripts.md keeps the three things that AGENTS.md
states, and it now names the file that owns the cap, the precedence, and the
managed region. It stated that file with none of them.

Two version facts from the research did not land, because the repository
carries later ones. The research puts the React security floor at 19.2.4, and
references/state-and-effects.md already records the January 2026 advisory that
moved it to 19.2.6, so the higher floor holds everywhere. The research could not
confirm CVE-2026-64642 against a primary advisory, and four landed files already
carry that identifier with a date, so the repository's identifier holds.

Limits

• The research asks a reference file past about a hundred lines to open with a
  table of contents. Seventy files answer the same partial-read problem with a
  subject list in the opening paragraph and a fixed section order, so the rule
  landed in the form that the repository already implements. A table of contents
  in three files and in none of the other seventy would be a rule the
  repository breaks on every page.
• The research reports a conflict on the SKILL.md name length, at 64
  characters in the vendor documentation against 50 in a community mirror. No
  rule in these files stands on that number, so neither figure landed. The
  1,024-character cap on description did land, because the workflow in this
  repository checks it.
• The research reports a default skill-listing budget of about 1 percent of the
  context for one agent, and it names a secondary source for the figure and for
  the environment variable that overrides it. Neither landed. The rule stands on
  the 2 percent and 8,000-character budget that the vendor source confirms, and
  on the two startup strings that report a truncation.
• The research reports a recommendation to keep AGENTS.md under about three
  hundred lines, from secondary sources only. The file states the 32 KiB
  project_doc_max_bytes cap instead, which is the hard limit that a command
  can measure.
• The research reports that one agent SDK ignores the allowed-tools field in
  SKILL.md, from a weak source. The file states the rule that the field is a
  pre-approval and never a restriction, which holds whether or not that report
  is right, and it routes a real limit to a deny rule in the configuration of
  the agent.
• .codex/skills/ carries the third mark of this repository: it is alive only
  in legacy code. The research resolved the path toward the vendor
  documentation, and it notes that the discovery set of the installed version is
  the thing to read.
• The prerequisites of this domain are none. It is the root of the invocation
  order. No forward seam remains anywhere in the repository: every seam that any
  file writes resolves to a file that exists.

v1.22.0

frontend-production-engineer v1.22.0

The domain added is 23 analytics-privacy-and-consent — Tier 4
non-functional, and it is not blocking. It is the last of the twenty-four.

What landed

Three reference files. The split is the moment at which an agent reaches for
the material, and not the sections of the research. Adding a tracking call,
building a cookie banner, and shipping an export or a deletion screen are three
moments. One file would have made a task that adds one event load the consent
categories, the Sec-GPC header, the cookie inventory, and the data subject
flows as well.

• references/event-taxonomy-and-tracking-plan.md — the measurement that a
  product takes of itself. One module holds the vendor, so a vendor change
  edits one file and a component test emits nothing. A discriminated union is
  the tracking plan, so an event outside it fails the typecheck rather than
  splitting one funnel into two charts that disagree. The identity is the
  stable backend id and never an email, and the logout resets it, because a
  shared device otherwise joins the next reader to the previous account. One
  navigation produces one page view, which means the automatic capture of the
  vendor goes off; the alternative is a funnel that reports half the real
  conversion rate with no code change to explain it. The scrub over a path and
  a query string sits inside the module, because a rule that each caller must
  remember is a rule that one caller forgets. The last part is the three
  failures that a measurement tool must not cause: a revenue event that a
  blocked browser can drop, a Server Action that waits on a collector, and a
  handler that reads a global which an ad blocker removed.
• references/consent-gate-and-cookie-inventory.md — the permission that comes
  before the storage. The gate is the render and not the send, because Article
  5(3) of the ePrivacy Directive covers the access to the device rather than
  what the script transmits afterward, so a flag around track() arrives after
  the cookie is already written. The server reads the record, or the banner
  appears for a moment on every visit and moves the content under it. The
  record carries a policy version, a time, and a category map, and it lives in
  a first-party cookie because localStorage is invisible to the server. A
  Sec-GPC of 1 sets every non-essential category to false as a default.
  The tool choice decides the size of the question, and a cookieless
  self-hosted counter removes the banner, the vendor origin, and the transfer
  question together. The last part is the inventory: one file that the policy
  page renders, and an audit of document.cookie in both states that proves
  it.
• references/data-rights-and-privacy-surfaces.md — the parts of the interface
  that the law makes the product show. An export is a job with a state rather
  than a request that a control awaits, because an account with many rows
  outlives the proxy timeout and the reader then presses the control again. A
  deletion names its scope in counted nouns, takes a typed confirmation, and
  clears the query cache and the analytics identity in the same step. The
  retention window is a sentence beside the data rather than a line in a policy
  page. The policy page renders the inventory and states the version that the
  consent record names, so a purpose change moves one constant and the question
  returns.

Each file carries the two-layer split, and the // Wrong: and // Correct:
pairs that name the failure the wrong version produces. Each one also holds
runnable TypeScript against the pinned versions, a binary review checklist, and
a handoff list.

Router and description

Three router rows, and fourteen seam rows. The 17 seam settles the one that
matters. Domain 17 owns the script-src and connect-src entries, the review
over a tag manager, and the integrity attribute, and it holds the veto.
Domain 23 owns the consent that must arrive before the tag renders at all. The
21 seam splits the two scrubs: an error report and an analytics event take
separate paths, and each path needs its own gate. The 16 seam keeps the cost
and the moment of a script where they already were, and takes only the
condition in front of it.

The definition of done gains a report block of twenty-five conditions. Domain
23 holds no veto, so each condition is a finding on a review pass, and one of
them fails a task only where a blocking domain fails with it. The research
offered a consent-banner focus rule and a contrast rule, and neither landed,
because the accessibility-wcag gate already carries both and it holds the
veto.

description absorbs this domain as analytics, consent, and GDPR. The count
moves from 1021 to 1019 of the 1024 that the platform allows. The 1.21.0
release recorded that no structural move remained, so the room comes from five
triggers that a sibling in the same group already fires: cast, where any
and Zod fire; CVE, where XSS and CSP fire; axe, where WCAG and ARIA fire;
robots.txt, where sitemap and metadata fire; and the size of bundle size, where LCP and INP fire. tsconfig.json loses its extension, and it is
the only trigger that shortened rather than left.

The size tripwire on SKILL.md moves from 192 kB to 200 kB. This domain adds
about 11 kB. It is the last of the twenty-four, so the number now moves only
for a patch that grows a row.

Corrected

Four landed files carried a seam that named domain 23 by number and stated that
it was not integrated. Each one now names the file that owns the subject.
references/client-bundle-and-third-party-scripts.md resolves to two files,
because the condition in front of a tag and the event that the tag sends are
separate owners. references/security-headers-and-csp.md,
references/interface-copy-and-voice.md, and
references/secret-boundary-and-supply-chain.md each resolve to the consent
file. The four Not here clauses in the SKILL.md router did the same.

references/error-capture-and-reporting.md gains a seam that it never had. It
configures the session replay mask, and nothing in it stated that a replay
needs the analytics category before it starts at all.

The research contradicted nothing that already landed, and it superseded
nothing. It carries no version delta, so the pinned baseline is unchanged.

facade keeps one meaning across the seam. The repository already uses it for
the click-to-load placeholder in front of an embed, so the analytics wrapper is
"the analytics module" rather than a second sense of the same word.

Limits

• The research names each analytics vendor and each consent platform, and it
  compares them on privacy posture, cookie requirement, self-hosting, bundle
  weight, data ownership, and legal exposure. It states no version, no release
  date, and no advisory record for any of them. Those three columns hold Not stated, and each file tells the reader to check the registry entry before an
  install.
• The research reports that a content blocker removes between about 20 and 40
  percent of client-side events, and it names no source for that range. The
  file states the range as the research reports it, and no rule rests on the
  number. The instruction is to compare the browser count of one event against
  the server count of the same event.
• LGPD, PIPEDA, PIPL, the EU Data Act, and the AI Act appear in the research as
  regimes that exist. It states nothing operational about any of them. They are
  router triggers, and no rule stands on them.
• IAB TCF is named as a large surface for a product that carries advertising.
  No implementation material landed, and the file states that the legal owner
  belongs in that review.
• The research names the GDPR articles as the range 12 to 22, and it maps no
  single right onto a single article. The file cites the range, and it does not
  invent the per-article mapping.
• Heatmap, survey, and in-app message tools appear as one cost row, because
  references/client-bundle-and-third-party-scripts.md owns the budget over a
  third-party script.
• The prerequisites of this domain are 15, 16, 17, and 21, and all four are
  integrated. No forward seam remains anywhere in the repository: every seam
  that any file writes now resolves to a file that exists.

v1.21.0

frontend-production-engineer v1.21.0

The domain added is 22 build-deploy-and-runtime-ops — Tier 4
non-functional, and it is not blocking.

What landed

Three reference files. The split is the moment at which an agent reaches for
the material, and not the sections of the research. Producing the artifact,
keeping a process alive behind a proxy, and moving a release onto a host and
back off it are three moments. One file would have made a task that writes a
Dockerfile load the WebSocket proxy block, the pipeline hardening rules, and
the rollback procedure as well.

• references/build-output-and-container-image.md — the artifact that a
  release ships. output: 'standalone' traces the modules that the server
  loads, and it does not copy public or .next/static, which is the failure
  a first standalone image produces: every page renders with no stylesheet and
  the health check still passes. The build runs on the pipeline machine,
  because V8 gives the old generation about 4 GB and a small host answers with
  the out-of-memory killer. The image is three stages, the runner holds no
  toolchain, USER node follows the copies, and the runner creates .next
  first so the cache is writable. The base is the Node slim image, because a
  native module ships a glibc binary more often than a musl one. The last part
  is sharp, which the trace does not always carry, and the exec form of
  CMD, which is what puts the server at PID 1 to receive SIGTERM.
• references/runtime-process-and-reverse-proxy.md — the process that serves
  the application, and the layer in front of it. A supervisor owns the
  lifetime, states a restart policy, and states a memory limit, because a host
  with none lets the kernel choose which process dies. The environment reaches
  the process from a file with mode 600, and the start fails where a required
  value is absent. One server block routes / to Node and /api/ to Django,
  serves _next/static immutable, forwards the four proxy headers, carries the
  upgrade map for a WebSocket, and turns buffering off wherever the application
  streams. One layer emits the security header set, and the default for this
  stack is the application, because proxy.ts is the only source of a
  per-request nonce. The proxy sets x-middleware-subrequest to an empty
  value, as a second layer under the 16.2.11 floor and never as the first one.
• references/release-pipeline-and-rollback.md — the path from a merged commit
  to a serving process, and the path back. The pipeline is a production system:
  every third-party action is pinned to a commit, every workflow states a
  permissions block, no workflow runs fork code under pull_request_target,
  and a short-lived credential replaces a stored registry key. One artifact
  reaches every environment, so a value that differs between two of them is
  read at request time under await connection() rather than baked by a
  NEXT_PUBLIC_ read. The replacement starts first, answers a probe, takes a
  smoke run, and only then takes the traffic; the rollback is the same switch
  in the other direction, and it has been run against production once. The last
  part is the second instance, which needs a shared cacheHandler with
  cacheMaxMemorySize at 0, and the expand-and-contract order that keeps a
  frontend deploy and a backend deploy independent.

Each file carries the two-layer split, and the // Wrong: and // Correct:
pairs that name the failure the wrong version produces. Each one also holds
runnable configuration against the pinned versions, a binary review checklist,
and a handoff list.

Router and description

Three router rows, and twelve seam rows. The 17 seam settles the one that
matters. Domain 17 owns what each security header must contain, and it holds
the veto. Domain 22 owns the one layer that emits it, and the forged header
that the proxy strips. The 21 seam does the same work for a release: domain 21
owns the health route, the two skew keys, and what each one repairs for an open
tab, and this domain owns the deploy that calls that route and the pipeline
that supplies one value to every instance. The research offered a health-route
pattern and a skew-key pattern that references/degradation-and-health-checks.md
already carries, so neither landed a second time.

The definition of done gains a report block of twenty-three conditions. Domain
22 holds no veto, so each condition is a finding on a review pass, and one of
them fails a task only where a blocking domain fails with it. Three conditions
the research offered are absent, because the frontend-security gate already
carries each one: a duplicated security header, a public cache directive on a
per-user response, and an installed Next.js under the current security release.

description absorbs this domain as deploy, Docker, Nginx, and CI. The count
moves from 1006 to 1021 of the 1024 that the platform allows. The 1.20.0
release recorded that no structural move remained and that the only lever left
was a low-value trigger from a group of four or five. The room comes from two
of the five it ranked: nonce, where security and CSP already fire, and
Intl, where i18n and locale already fire. Every other trigger that was there
is still there, and 2 characters remain.

The size tripwire on SKILL.md moves from 184 kB to 192 kB. This domain adds
about 11 kB, which is above the usual 8 kB because fifteen router clauses grew
from a bare domain number into a file path.

Corrected

references/app-router-structure.md stated that a single Docker image which
must read a public variable at run time needs next-runtime-env. The
self-hosting guide reads a server value at request time under
await connection(), which promotes one image across environments with no
third-party package. That sentence now states the framework mechanism and hands
the promotion to references/release-pipeline-and-rollback.md.

references/security-headers-and-csp.md told the reader to emit the header set
from the application "until it lands". The layer decision has landed, and the
same paragraph now names the file that owns it and states the default and its
reason.

Twenty-eight seams across twenty-one reference files resolved from a bare
domain 22 to the file that owns the subject. Fifteen router Not here clauses
did the same. Seven of the reference seams resolve to two or three files,
because the artifact, the running process, and the pipeline are separate
owners. Four of them also narrowed: a seam that promised the storage bucket,
the content network, or the infrastructure behind the optimizer now names only
what this domain holds.

smoke run is one term across the seam. references/merge-gates-and-quality-signals.md
had used it since 1.19.0, and the incoming files took it rather than introduce
a second name for the same request.

Limits

• The research states that the exact memory at which the out-of-memory killer
  fires, when Next.js, Gunicorn, Postgres, and Redis share a 1 GB host, is
  workload-dependent and unmeasured. The files state the rule that every
  service carries a limit, and they supply no number for it.
• The research carries no primary source for the round-trip cost from Iran to a
  German host, and it resolves the question by measurement. No latency figure
  landed, and no content-network recommendation rests on one.
• The blue-green pattern over Docker Compose is community-documented rather
  than official. The file states the shape that is certain — start first,
  probe, smoke run, switch, stop the previous one — and it states no vendor
  recipe.
• The research resolves two conflicts, and both landed as the resolution rather
  than as the conflict. sharp is installed explicitly and proved inside the
  built image, because the repository issues outweigh the zero-configuration
  claim for a standalone build in a container. The base image is Node slim,
  because that is the default of the official example.
• The research names feature flags and maintenance mode nowhere, and neither
  landed. A deploy that needs either one has no material here.
• The prerequisites of this domain are 01, 04, 17, and 20, and all four are
  integrated. The domain feeds 21, which is integrated. No forward seam
  remains: every seam that this domain writes resolves to a file that exists.

v1.20.1

frontend-production-engineer v1.20.1

A checkpoint release. No domain is added, and the router still carries
twenty-one. Twelve repairs, against seven items of the battery, in the operating
doctrine and in five of the twenty-one integrated domains.

Repaired

• 11 — degradation-and-health-checks: the next.config.ts sample read
  process.env.GIT_SHA! for generateBuildId. The domain 02 gate fails a
  non-null ! on a value that can be absent, and an unset variable is exactly
  that. One buildId constant now feeds deploymentId and generateBuildId,
  which is also what the checklist of the file asks for.
• 11 — route-protection-and-permissions: the safeNext guard read
  process.env.APP_ORIGIN! before it parsed the redirect target. It reads the
  variable and returns / where no origin is configured, which is the same
  refusal the two string tests above it perform. type-modeling-and-narrowing
  states the rule as "NEVER reach for !", and two Correct samples held one.
• 8 — error-capture-and-reporting: the Wrong pair for an event handler
  said that a rejected promise sends no report. Four sections later the same
  file states that Sentry.init installs an unhandledrejection handler, which
  sends one. The Failure now names the failure that the sample does produce: no
  boundary renders, nothing on the screen states that the export failed, and the
  event that reaches the tracker names no control.
• 12 — locale-routing-and-catalogs: the Wrong sample for a cookie-only
  locale read cookies() with no await. That is the Next 15 form, and it was
  the only synchronous read of a dynamic API left in references/. The pair
  teaches the cookie, and it carried a second unstated defect that domain 01
  blocks on.
• 31 — network-mocks-and-contract-tests: the mock-socket test asserted on
  an unknownFrameCounter after a frame whose type is known and whose payload
  fails the parse. Domain 08 owns that counter and calls it the dropped frame,
  in live-events-and-cache-merge and in the 08 to 21 row of SKILL.md. The
  identifier and the fix cell of the symptom table take that term.
• 31 — end-to-end-journeys-and-flake-control: one sentence used "image"
  for a screenshot and for a container image. The checklist of the same file
  already writes "container image", so the sentence takes both terms apart.
• 9 — network-mocks-and-contract-tests and
  view-transitions-and-animation-libraries: two checklist items opened with
  "Does any". A reviewer with no real backend, and a reviewer with no
  <ViewTransition> call, cannot tick either box, so a pass reads as a failure.
  Both ask about every one, which is the form that every other item in both
  files uses.
• 30 — bidirectional-layout-and-scripts: one row of the mirror table wrote
  "Neither one" over a list of three elements. It states "None of them".
• 32 — bidirectional-layout-and-scripts, locale-formatting-and-calendars,
  and locale-routing-and-catalogs: the first verification step read
  cat package.json | rg '...'. Every other file writes rg -n '...' package.json or a node -p read. The three files of domain 19 were the only
  ones with the pipe.
• 30 — SKILL.md: one condition of the definition of done ran to twenty-six
  words, in the report block of domain 19. ASD-STE100 holds a descriptive
  sentence to twenty-five. The locale route that the build reports as dynamic is
  its own condition, which is the same split that 1.17.1 made for domain 14.
• 32 — README.md, AGENTS.md, and GEMINI.md: 1.20.0 inserted the domain
  21 paragraph above the domain 20 paragraph and relabelled the older one "the
  next part". Nothing follows the newest part, and domain 20 landed one release
  before domain 21. The two paragraphs swap back, and the sentence that closes
  the section moves with them.
• 30 — README.md, AGENTS.md, and GEMINI.md: the sentence that closed
  the domain 21 paragraph ran to twenty-seven words. It is two sentences.

The router table carries the same sixty-four rows and the same trigger
vocabulary. Every row resolves to a file on disk, and no file in references/
is an orphan. The frontmatter description is unchanged, and it holds its 1006
characters of the 1024 that the platform allows. The definition of done names
the failure condition of all seven landed blocking domains, and the conflict
rule and the invocation order are unchanged.

SKILL.md is 180232 bytes after this release, against the 188416 that
docs-integrity allows.

Domains affected

• 24 agent-operating-doctrine — the gate conditions of SKILL.md, the README,
  AGENTS.md, and GEMINI.md.
• 07 authentication-and-authorization — route-protection-and-permissions.
• 14 motion-and-interaction — view-transitions-and-animation-libraries.
• 19 internationalization-and-rtl — locale-routing-and-catalogs,
  locale-formatting-and-calendars, and bidirectional-layout-and-scripts.
• 20 testing-and-quality — network-mocks-and-contract-tests and
  end-to-end-journeys-and-flake-control.
• 21 observability-and-resilience — error-capture-and-reporting and
  degradation-and-health-checks.

The version moves from 1.20.0 to 1.20.1. This run adds no domain, so the router
still carries twenty-one and the minor number stays at 20. This run changed nine
reference files and four files outside references/, so the patch number moves
by one.

Limits

• The ASD-STE100 approved-vocabulary list is not in this repository, and this
  run did no web research. The language pass therefore tested the rules that the
  repository can decide by itself: sentence length, one instruction in one
  sentence, voice, tense, the -ing form as a noun, noun clusters, articles,
  paragraph length, and warning placement. Vocabulary approval is untested, and
  phrasal-verb approval with it.
• The router rows, the trigger groups of the Cursor rule, and the frontmatter
  description are enumerations of Technical Names. The sentence-length rule
  does not shape them, and this run applied it to none of them.
• The repository holds two spellings for two different things, and this run kept
  both. The verb is optimise, and the Next.js image optimizer keeps its z.
  Prose says sanitiser, and an API name says sanitize. standardised
  describes a team, and drf-standardized-errors names a package.
• No TypeScript compiler and no Node runtime for this stack are installed on the
  machine that ran this checkpoint. Every code sample was read against the
  pinned versions, and none was compiled. The two ! repairs rest on the rule
  that an unset environment variable is undefined, and the await cookies()
  repair on the Next 16 rule that every dynamic API returns a promise.
• Ten reference files had never met this battery, because domains 19, 20, and 21
  landed after the 1.17.1 checkpoint. Seven of the twelve repairs sit entirely
  in those ten files, and one more reaches into them.
• Fifty-four reference files met the battery at an earlier checkpoint, and two
  of them carry a repair here. This run tested the rest with the mechanical
  sweep alone: the router
  resolution, the orphan search, the hyperlink and marker searches, the Next 15
  idioms, the pair and checklist polarity, the rg --files-without-match
  convention, the seam resolution, the invisible-character scan, the dialect
  count, and every language rule above.
• This run added no material, so it opened no forward seam. Every seam that it
  changed points at a file that exists today. The seams to domain 22
  build-deploy-and-runtime-ops and domain 23 analytics-privacy-and-consent
  are written as named domains in prose, and neither is integrated.
• No sibling material moved, and no statement about secure-code-auditor,
  django-api-contract, django-async-jobs, django-performance-optimizer,
  django-migration-safety, django-test-auditor, or django-release-readiness
  changed.