Changelog

Every skill in skills-lock.json was compared with its upstream source, file by file. Most were already current. The rest were read diff by diff before they came in, and each commit names the upstream commit it took.

• Updated from upstream. Seven of Matt Pocock's skills, seven pstack skills (interrogate now keeps only findings an adversary proves with a run; poteto-mode's autopilot-stack never merges), Emil Kowalski's two animation skills (Motion shorthands are hardware-accelerated from 14.2), neon-postgres (branching and egress references), serve-sim (the hardened server), and three Expo skills. (4685247, 4232f77, 8411619, 456f0c8, 8ccf7e3)
• Stageshow 1.1.1. The fix steadies the skill's playground when scroll bars are always on. The kit is unchanged, so the landing's vendored copy and the landing itself are untouched. (4af377b)
• Expo's renamed skills. expo-deployment is now eas-app-stores and expo-cicd-workflows is eas-workflows. The old building-native-ui and native-data-fetching copies are gone, because expo-native-ui, expo-router and expo-data-fetching replace them. expo-tailwind-setup (NativeWind) is gone too: upstream deleted it and the mobile app does not use it. The design map points at expo-native-ui. Expo's new feedback instruction, which has the agent report the user's task to Expo on its own, was left out. (bf34bb9)
• Held back. Taste Skill 2.5 is a different product: a 39 MB static-site kit with scripts that download icons, photos and fonts. Landing work stays on Taste v2 with redesign-existing-projects, which upstream folded into 2.5. The evlog skills now tell the agent to run npx evlog, which fetches an unpinned @evlog/cli. Both wait until that CLI is pinned. Five Expo skills whose only upstream change is the new feedback instruction stay where they were.

Projects built from the template now share one rule for the language of their code, stated in AGENTS.md and on Conventions: identifiers, file and route names, database tables, env vars, comments, test names, developer logs, error codes, commits, branches, pull requests and developer docs are English, whatever language the domain, the team or the conversation with an agent uses. User-facing text is the only exception and goes through the i18n catalogs. A domain word from another language gets one English name in CONTEXT.md.

scripts/code-language.test.mjs runs in pnpm test and fails when a short list of Portuguese and German words appears in identifiers, comments or test titles under apps/*/src, packages/*/src and the scripts folders. String literals, JSX text and the locale catalogs are not read. The rest of the rule (other languages, commits, docs) is checked in review; see Enforcement.

Six changes from the x.com rebuild research, each measured against main on the slow profile (Slow 4G, 4x CPU, the built Worker, median of 5). Method and every number: docs/measurements/2026-11-06-web-quick-wins.md.

• The cookie banner is in the server HTML. It used to mount after hydration and was the largest paint of a first visit to /login, /dashboard and /todos. The choice now lives in a cookie_consent cookie the server reads, so the banner paints with the page: largest paint 2.52 → 0.50 s on /login, 3.54 → 1.00 s on /dashboard, 4.02 → 0.99 s on /todos. Choices stored in the browser before this release are moved to the cookie without the banner flashing. Categories, defaults and the analytics gate are unchanged. (0406d2f)
• Hashed assets are cached for a year. /assets/* answers public, max-age=31536000, immutable (apps/web/public/_headers; the build fails if an unhashed file lands there). A repeat visit takes scripts from the cache without a request: the landing hydrates at 0.92 s instead of 1.41 s, /dashboard paints at 0.20 s instead of 0.40 s and hydrates at 0.50 s instead of 1.01 s. Favicons, figures and other public files keep revalidating. (ee97233)
• The landing figure is sent once. The request machine was inlined in the HTML and shipped again as 130 KB of JSON in the landing script. The server now inlines the generated SVG and hydration keeps it; the landing chunk drops from 57 to 33 KB gzip and a first visit hydrates 0.28 s sooner. The drawing and its animation are pixel-identical. (dd62551)
• No hydration error on the dashboard. Relative times ("5 minutes ago") were computed from the clock at the server render and again at hydration, seconds later, and React threw #418 whenever the rounding changed in between. useFormatTimeAgo counts from the moment the server rendered until hydration; the activity timeline's day headings now use the visitor's time zone as well (W16). (772bef0)
• Web Vitals from real visits. Visitors who allow analytics in the banner report LCP, INP, CLS, FCP and TTFB with the route pattern (never the URL), language, navigation type and connection class to POST /api/events/web-vitals, which writes one web_vital line to Workers Logs. Nothing is observed or sent without that consent, and nothing loads before the first paint. See Observability. (bcfbd84)
• The Workers Logs sampling rate is explicit. observability.logs.head_sampling_rate is set to 1 in wrangler.jsonc, with what lowering it saves and loses (sampling drops whole requests, errors included) and the cost table in Observability. (67588c2)