chore: track two regression tests, bump natively-api, ignore root dispute docs

Sweeps up what was left untracked in the working directory, with one deliberate
exclusion.

gitignore — the reason this is not a routine chore:
  KAUSHAL_12_DISPUTE_HANDOVER.md sits at the repo ROOT, a byte-identical stray
  copy of the file already held in the correctly-ignored
  dispute-evidence-kaushal-shivaprakashan/. The existing rules are all
  directory-scoped (/dispute-evidence-*), so the root copy was fully
  committable and the next `git add -A` would have published it. This repo is
  PUBLIC and that document carries a named customer's email address, phone
  number and home address. Adds /*_DISPUTE_HANDOVER.md and /*_DISPUTE_*.md so
  the root copies can never be staged. README.md and other root docs stay
  committable — the rule is scoped, not a blanket.

Tests (new, previously untracked alongside 279 tracked siblings):
  V3SkillInjection2026_08_05 — PR Natively-AI-assistant#429 Bug 003, skill injection silently
  dropped when Context Intelligence V3 is active (default ON since 2026-07-30),
  covering both drop sites independently.
  ManualScreenshotScreenContext2026_08_05 — manual screenshot screen context.

natively-api: cecbfdf → bedc55e, which is merged to that repo's main via PR Natively-AI-assistant#7
and is the deployed revision (Railway reports Online, /health 200).

transitions/: 27 CSS transition reference docs. Scanned for credentials and
customer data before publishing — the single hit is the word "password" inside
a prose description of form-validation UX. These are tooling reference material
rather than application source; say the word and they come back out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SiDsWPD5XtBYgXWt7ZPizu

Author: Hardening v2.7

.gitignore

@@ -418,6 +418,12 @@ user log/
 /dispute_evidence/
 scripts/*evidence*.py
 scripts/combine_*_single_file.py
+# The dispute handover docs are ALSO written to the repo root, outside every
+# directory rule above — byte-identical strays that a `git add -A` would sweep
+# in. This repo is PUBLIC and those files carry a named customer's email, phone
+# number and home address, so the root copies need their own rule.
+/*_DISPUTE_HANDOVER.md
+/*_DISPUTE_*.md
 # Autopilot campaign prompts — internal docs, not source
 /HANDOFF*.md
 /NATIVELY_CONTEXT_SYSTEM_SIMPLIFICATION_PROMPT.md

electron/services/__tests__/ManualScreenshotScreenContext2026_08_05.test.mjs

@@ -0,0 +1,45 @@
+// Regression test for PR #429 Bug 002: "screenshot attached but code not
+// generated" — a manually-attached screenshot never set hasScreenContext, so
+// the V3 turn classifier never added SCREEN_SPECIFIC / SCREEN_FACT and the
+// screen was not treated as authoritative evidence.
+//
+// Two drop sites, one per surface:
+//
+//  1. WTA overlay (IntelligenceEngine.ts, buildV3Prompt input):
+//     `hasScreenContext: Boolean(options?.screenContext)` — options.screenContext
+//     is the periodic-capture OCR object; a manually-attached screenshot rides
+//     in `imagePaths` with screenContext null, so the flag was always false.
+//
+//  2. Manual chat (ipcHandlers.ts, gemini-chat-stream buildV3Prompt call):
+//     hasScreenContext was omitted entirely, defaulting to undefined/false
+//     even when the user attached screenshots.
+
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '../../..');
+const read = (rel) => fs.readFileSync(path.join(root, rel), 'utf8');
+
+describe('Bug 002: manually attached screenshots set hasScreenContext', () => {
+  test('WTA surface: hasScreenContext covers the imagePaths channel, not just periodic OCR', () => {
+    const source = read('electron/IntelligenceEngine.ts');
+    assert.doesNotMatch(source, /hasScreenContext: Boolean\(options\?\.screenContext\),/,
+      'the OCR-only guard must be widened to cover imagePaths');
+    assert.match(source, /hasScreenContext: Boolean\(options\?\.screenContext\) \|\| \(imagePaths\?\.length \?\? 0\) > 0,/,
+      'hasScreenContext must be true when manual screenshots ride in imagePaths');
+  });
+
+  test('manual-chat surface: the gemini-chat-stream buildV3Prompt call passes hasScreenContext from imagePaths', () => {
+    const source = read('electron/ipcHandlers.ts');
+    // Scope the assertion to the manual-chat V3 composition block.
+    const start = source.indexOf("surface: 'manual-chat'");
+    assert.ok(start !== -1, 'manual-chat V3 composition must exist');
+    const block = source.slice(start, start + 4000);
+    assert.match(block, /hasScreenContext: \(imagePaths\?\.length \?\? 0\) > 0,/,
+      'the manual-chat buildV3Prompt call must derive hasScreenContext from attached imagePaths');
+  });
+});

electron/services/__tests__/V3SkillInjection2026_08_05.test.mjs

@@ -0,0 +1,97 @@
+// Regression test for PR #429 Bug 003: skill injection silently ignored when
+// Context Intelligence V3 is active (default ON since 2026-07-30).
+//
+// Two independent drop sites, one per surface:
+//
+//  1. WTA overlay (WhatToAnswerLLM.ts): the system prompt was composed as
+//     `_v3p?.system ?? finalPromptOverride`. With V3 active `_v3p` is always
+//     defined, so `finalPromptOverride` — the only carrier of the
+//     `## ACTIVE SKILL` block — was silently discarded.
+//
+//  2. Manual chat (ipcHandlers.ts): the V3 short-circuit owns the turn end to
+//     end and consumed only the raw `message`, but the /skill-name prefix
+//     parsing lived ~500 lines later on the legacy path. Under V3 the prefix
+//     leaked to the model as literal text and the skill instructions were
+//     never injected anywhere.
+
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { composeWtaSystemPrompt } from '../../../dist-electron/electron/llm/index.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '../../..');
+const read = (rel) => fs.readFileSync(path.join(root, rel), 'utf8');
+
+// ---------------------------------------------------------------------------
+// 1. WTA surface — behavioral contract of the system-prompt composition
+// ---------------------------------------------------------------------------
+describe('composeWtaSystemPrompt (WTA surface)', () => {
+  const skill = { id: 'humanize-ai-text', name: 'Humanize AI Text', promptBlock: '<active_skill>rewrite naturally</active_skill>' };
+
+  test('V3 system + active skill → skill block is appended, V3 system preserved', () => {
+    const out = composeWtaSystemPrompt('V3 SYSTEM PROMPT', 'LEGACY OVERRIDE', skill);
+    assert.ok(out.startsWith('V3 SYSTEM PROMPT'), 'V3 system prompt must lead');
+    assert.ok(out.includes(skill.promptBlock), 'skill promptBlock must be present');
+  });
+
+  test('V3 system + no skill → exactly the V3 system prompt (no behavior change)', () => {
+    assert.equal(composeWtaSystemPrompt('V3 SYSTEM PROMPT', 'LEGACY OVERRIDE', undefined), 'V3 SYSTEM PROMPT');
+    assert.equal(composeWtaSystemPrompt('V3 SYSTEM PROMPT', 'LEGACY OVERRIDE', null), 'V3 SYSTEM PROMPT');
+  });
+
+  test('no V3 prompt → legacy override verbatim, with or without skill', () => {
+    assert.equal(composeWtaSystemPrompt(undefined, 'LEGACY OVERRIDE', skill), 'LEGACY OVERRIDE');
+    assert.equal(composeWtaSystemPrompt(null, 'LEGACY OVERRIDE', undefined), 'LEGACY OVERRIDE');
+  });
+
+  test('WhatToAnswerLLM wires the composition helper at the _wtaSystemPrompt site', () => {
+    const source = read('electron/llm/WhatToAnswerLLM.ts');
+    assert.match(source, /_wtaSystemPrompt = composeWtaSystemPrompt\(/,
+      '_wtaSystemPrompt must be built via composeWtaSystemPrompt so activeSkill survives V3');
+    assert.doesNotMatch(source, /_wtaSystemPrompt = _v3p\?\.system \?\? finalPromptOverride/,
+      'the raw ??-discard pattern must be gone');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 2. Manual-chat surface — skill parse must precede the V3 short-circuit and
+//    the composed V3 system prompt must carry the skill block
+// ---------------------------------------------------------------------------
+describe('manual-chat V3 short-circuit honors /skill prefixes', () => {
+  test('skill prefix parsing occurs BEFORE the V3 short-circuit', () => {
+    const source = read('electron/ipcHandlers.ts');
+    const skillParseIdx = source.indexOf('skillPrefixMatch');
+    const v3EntryIdx = source.indexOf('isContextIntelligenceV3Enabled()');
+    assert.ok(skillParseIdx !== -1 && v3EntryIdx !== -1, 'both sites must exist');
+    assert.ok(skillParseIdx < v3EntryIdx,
+      'skill prefix must be parsed before the V3 branch so V3 sees the stripped query and the skill block');
+  });
+
+  test('V3 stream sends a system prompt that includes skillPromptBlock when set', () => {
+    const source = read('electron/ipcHandlers.ts');
+    assert.match(source, /skillPromptBlock\s*\?\s*`\$\{composed\.system\}[\s\S]{0,40}\$\{skillPromptBlock\}`/,
+      'the V3 system prompt must append skillPromptBlock when a skill is active');
+  });
+
+  test('legacy context injection site still exists (non-V3 path unchanged)', () => {
+    const source = read('electron/ipcHandlers.ts');
+    assert.match(source, /context = context \? `\$\{skillPromptBlock\}\\n\\n\$\{context\}` : skillPromptBlock/,
+      'legacy skill-into-context injection must remain for the non-V3 path');
+  });
+
+  // Code-review follow-up (2026-08-05): hoisting the parse above V3 means the
+  // legacy identity-probe now sees the STRIPPED message. Pre-hoist, the probe
+  // ran on the raw "/humanize who are you", which its fully-anchored regexes
+  // (manualIdentityRouting.ts ^...$) could never match — skill turns were
+  // structurally immune to probe hijacking. The probe must therefore be
+  // skipped whenever a skill is active, or "/humanize who are you" on the
+  // legacy path answers with the canned identity reply and drops the skill.
+  test('legacy identity probe is skipped when a skill is active', () => {
+    const source = read('electron/ipcHandlers.ts');
+    assert.match(source, /if \(!skillPromptBlock && !imagePaths\?\.length && typeof message === 'string'\) \{/,
+      'the identity-probe gate must include !skillPromptBlock so skill turns bypass the probe');
+  });
+});

natively-api

@@ -1 +1 @@
-Subproject commit cecbfdf531208fbcf373cd5b09455a57dd4f0473
+Subproject commit bedc55e26a5528258bfd760f6005fdb88a95f699

transitions/accordion.md

@@ -0,0 +1,124 @@
+# Accordion expand
+
+## When to use
+
+A disclosure / accordion / collapsible section whose panel grows and shrinks in height when toggled, with the header chevron flipping between a downward "v" and an upward "^". Use for settings groups, FAQs, filter sections, "show more" details — any header + collapsible body.
+
+Height animates via `grid-template-rows: 0fr ↔ 1fr`, so there's **no JS height measuring** and content of any size animates cleanly. The chevron flips vertically (`scaleY`) from a "v" to a "^", passing through a flat line at the midpoint.
+
+## HTML usage
+
+```html
+<div class="t-acc" data-open="false">
+  <button class="t-acc-head" aria-expanded="false">
+    Title
+    <span class="t-acc-chevron">
+      <svg viewBox="0 0 16 16"><path d="M4 6.5L8 10.5L12 6.5"/></svg>
+    </span>
+  </button>
+  <div class="t-acc-panel"><div class="t-acc-panel-inner"> … </div></div>
+</div>
+```
+
+Toggle `data-open` on the item. The panel animates via
+grid-template-rows 0fr ↔ 1fr (no JS height measuring) and
+the chevron flips vertically (scaleY) from a "v" to a "^".
+
+## Tunable variables
+
+| Variable | Default | Notes |
+| --- | --- | --- |
+| `--acc-expand` | `250ms` | sourced from `--p21-expand-dur` |
+| `--acc-collapse` | `250ms` | sourced from `--p21-collapse-dur` |
+| `--acc-chevron` | `250ms` | sourced from `--p21-chevron-dur` |
+| `--acc-ease` | `cubic-bezier(0.22, 1, 0.36, 1)` | sourced from `--p21-ease` |
+
+The `:root` defaults below match the live tuning on [transitions.dev](https://transitions.dev). Drop them into your global stylesheet once — every transition in this skill reads from semantic names like these, so multiple transitions can share a single `:root` block.
+
+```css
+:root {
+  --acc-expand: 250ms;
+  --acc-collapse: 250ms;
+  --acc-chevron: 250ms;
+  --acc-ease: cubic-bezier(0.22, 1, 0.36, 1);
+}
+```
+
+## CSS
+
+```css
+/* grid-template-rows 0fr → 1fr gives a clean height animation
+   with no JS measurement; the inner element clips overflow. */
+.t-acc-panel {
+  display: grid;
+  grid-template-rows: 0fr;
+  transition: grid-template-rows var(--acc-collapse) var(--acc-ease);
+}
+.t-acc[data-open="true"] .t-acc-panel {
+  grid-template-rows: 1fr;
+  transition: grid-template-rows var(--acc-expand) var(--acc-ease);
+}
+.t-acc-panel-inner {
+  overflow: hidden;
+  opacity: 0;
+  filter: blur(2px);
+  transition:
+    opacity var(--acc-collapse) var(--acc-ease),
+    filter var(--acc-collapse) var(--acc-ease);
+}
+.t-acc[data-open="true"] .t-acc-panel-inner {
+  opacity: 1;
+  filter: blur(0);
+  transition:
+    opacity var(--acc-expand) var(--acc-ease),
+    filter var(--acc-expand) var(--acc-ease);
+}
+/* Flip the chevron vertically to turn the "v" into a "^".
+   scaleY(-1) about the centre passes through a flat line at
+   the midpoint (same look as a `d:` path morph) but animates
+   in every browser, unlike CSS `d:` morphing (Chromium only).
+   The chevron path is symmetric about the 16x16 viewBox
+   centre, so the flip lands exactly on the "^"; non-scaling
+   -stroke keeps the stroke width constant through the flip. */
+.t-acc-chevron {
+  display: inline-flex;
+  transform: scaleY(1);
+  transform-origin: center;
+  transition: transform var(--acc-chevron) var(--acc-ease);
+}
+.t-acc-chevron path { vector-effect: non-scaling-stroke; }
+.t-acc[data-open="true"] .t-acc-chevron {
+  transform: scaleY(-1);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .t-acc-panel, .t-acc-panel-inner, .t-acc-chevron {
+    transition: none !important;
+  }
+}
+```
+
+The `@media (prefers-reduced-motion: reduce)` guard at the bottom of the snippet is required — keep it. It zeroes the transition for users who have asked for less motion at the OS level.
+
+## JavaScript orchestration
+
+```js
+// Toggle data-open on the item; CSS owns the height + chevron morph.
+const acc = document.querySelector(".t-acc");
+const head = acc.querySelector(".t-acc-head");
+
+head.addEventListener("click", () => {
+  const open = acc.getAttribute("data-open") === "true";
+  acc.setAttribute("data-open", String(!open));
+  head.setAttribute("aria-expanded", String(!open));
+});
+```
+
+### Two-element panel + padding placement
+
+The panel needs the two-element structure (`.t-acc-panel` grid track + `.t-acc-panel-inner` with `overflow: hidden`). The `0fr → 1fr` track can only collapse a child that clips its own overflow. Keep padding on `.t-acc-panel-inner`, never on `.t-acc-panel` — padding on the `0fr` track leaves a residual height strip so the panel never fully closes.
+
+### Why the chevron flips instead of morphing its path
+
+The natural way to turn the "v" into a "^" is to morph the chevron's SVG `d` between two vertex sets — but CSS `d:` path interpolation is **Chromium-only**, so on mobile Safari and Firefox it snaps (or doesn't move at all). A vertical flip (`transform: scaleY(-1)`) reproduces the same motion — it passes through a flat horizontal line at the midpoint, exactly like the path morph — and animates in every browser. Two requirements make it land cleanly: the chevron path must be **symmetric about the centre of its viewBox** (so the flip maps the "v" onto the "^"), and the path needs `vector-effect: non-scaling-stroke` so the stroke width stays constant while the box is squashed mid-flip.
+