@@ -32,11 +32,21 @@ release.
    Open `CHANGES.md` and extract every bullet under `## Development`.
 
 4. **Cross-reference.**
-   For each commit that represents a user-visible change (type `feat`, `fix`,
-   `refactor`, or `perf`), check whether a corresponding bullet exists in the
-   Development section. A bullet does not need to quote the commit message
-   verbatim -- it only needs to describe the same change at a short summary
-   level.
+   `CHANGES.md` opens with a comment block stating what qualifies for an entry.
+   Read it first; it is authoritative and the rules below restate only what
+   this check needs.
+
+   A commit needs a bullet when it adds something a user can use, changes
+   behaviour they would be surprised by, removes something, or fixes a bug
+   that was BROKEN IN A RELEASED VERSION. A bullet does not need to quote the
+   commit message -- it only needs to describe the same change.
+
+   A commit does NOT need one when it is refactoring, a test, CI, an internal
+   rename, or a dependency bump with no user-visible effect. Nor when it fixes
+   a bug that never shipped: if the last released version did not have the
+   defect, the changelog has nothing to say about it. That case is common on a
+   long branch and is the one most often reported as a false gap -- check the
+   bug's origin before flagging a missing entry, not just the commit's type.
 
 5. **Check each bullet against the length rule.**
    Per the "Changelog Entries" section of CONTRIBUTING.md, a bullet is at most
@@ -45,15 +55,23 @@ release.
    ones that exceed it, with their count. Do not measure released `## Version`
    sections -- a section is frozen once cut and is never rewritten.
 
-6. **Report findings.**
+6. **Check the section against the entry-count limits.**
+   `CHANGES.md`'s comment block sets a soft limit of **10** bullets per version
+   section and a hard limit of **50**, counting every bullet across its
+   subsections. Report the count. Over the soft limit, name the entries that
+   look mergeable or cuttable. Over the hard limit, say plainly that the
+   release must not ship until they are merged or cut.
+
+7. **Report findings.**
    - List commits with NO changelog entry (missing entries -- these must be
      added).
    - List changelog bullets that appear to describe nothing in the commit
      history (stale or speculative entries -- flag for author review).
    - List bullets over the 25-word limit, each with its count, and propose a
      shorter wording.
+   - Report the section's bullet count against the soft and hard limits.
    - If everything matches, report "CHANGES.md is current."
 
-7. **Do not edit CHANGES.md automatically.**
+8. **Do not edit CHANGES.md automatically.**
    Propose the missing bullets in your report and let the developer apply them.
    The developer owns the changelog wording.
@@ -45,8 +45,12 @@ Verify that all project documentation is accurate and up to date.
    (e.g., `1.0.0`) must match the version in root `package.json`.
 
 6. **Check CHANGES.md structure.**
-   Confirm the file starts with a `## Development` section and that previous
-   release sections follow the `## Version X.Y.Z` heading format (no date).
+   Confirm the file carries its rules comment block, that `## Development` is
+   the first heading after it, and that previous release sections follow the
+   `## Version X.Y.Z` heading format (no date). The block sits above
+   `## Development` on purpose: `release-notes.mjs` extracts only from a
+   `## Version` heading to the next `## `, so anything above the first one
+   never reaches a GitHub release.
 
 7. **Report.**
    List every issue found (missing files, broken nav links, stale commands,
 
@@ -24,7 +24,7 @@ its own README explains what each fixture drives.
 
 ## Isolation
 
-The suite never touches the developer's machine state. `e2e/src/cli.ts` is the
+The suite never touches the developer's machine state. `e2e/cli/src/cli.ts` is the
 only way a spec can invoke the CLI, and it always sets **both**:
 
 - `XDG_CONFIG_HOME`, which relocates `state.json` and `config.yaml`
@@ -42,13 +42,13 @@ the machine -- which is why the harness owns them rather than each spec.
 ### 1. Run the suite
 
 ```bash
-pnpm test:e2e
+pnpm test:e2e:cli
 ```
 
 That is the whole check. The script behind it
 (`scripts/e2e-prepare.mjs`) initializes the fixture submodule, force-pulls it to
 the tip of its branch, and builds `target/debug/skillkeeper`; Jest then runs the
-specs in `e2e/tests/`.
+specs in `e2e/cli/tests/`.
 
 Set `SKILLKEEPER_E2E_PIN_FIXTURE=1` to run against the fixture commit this
 repository pins instead of pulling. CI does that for reproducibility; locally
@@ -61,11 +61,13 @@ to look:
 
 | spec | covers | a failure means |
 |---|---|---|
-| `e2e/tests/fixture.spec.ts` | the submodule is checked out, ASCII-only, and still has the manifests and file modes the rest of the suite assumes | the **fixture** drifted |
-| `e2e/tests/skills.spec.ts` | resolution schemes, `.skid.yml` identity, nested body paths, selective `+x`, guidance precedence, hook merge and consent, the delimited-text region, and both silent-failure modes of the resolver | the **product** changed |
-| `e2e/tests/mcp.spec.ts` | preset discovery including the group-scoped file, parameter substitution, both ledger files, the `.gitignore` guard for the secrets file, rules rendering, instance-name allocation, the Codex stdio-only skip, and removal | the **product** changed |
-| `e2e/tests/repair.spec.ts` | `verify` -> `repair` -> `verify`, directory pruning, the bounds that keep repair inside the repaired skill, and uninstall reversing hooks and guidance | the **product** changed |
-| `e2e/tests/requires.spec.ts` | skill dependencies: every `repo lint` code the `requires` group triggers, the single-document `--json` form, both target-misuse exits, the transitive install closure, and the uninstall breakage report | the **product** changed |
+| `e2e/cli/tests/fixture.spec.ts` | the submodule is checked out, ASCII-only, and still has the manifests and file modes the rest of the suite assumes | the **fixture** drifted |
+| `e2e/cli/tests/skills.spec.ts` | resolution schemes, `.skid.yml` identity, nested body paths, selective `+x`, guidance precedence, hook merge and consent, the delimited-text region, and both silent-failure modes of the resolver | the **product** changed |
+| `e2e/cli/tests/mcp.spec.ts` | preset discovery including the group-scoped file, parameter substitution, both ledger files, the `.gitignore` guard for the secrets file, rules rendering, instance-name allocation, the Codex stdio-only skip, and removal | the **product** changed |
+| `e2e/cli/tests/mcp-oauth.spec.ts` | the oauth preset's exact per-agent native shape, the copilot skip, that no agent's config ever carries a client secret, and `repo lint` on the deliberately invalid oauth preset | the **product** changed |
+| `e2e/cli/tests/mcp-parameters.spec.ts` | link rendering, description truncation, option-value validation on install, and every mcp lint warning a description or parameter can trigger | the **product** changed |
+| `e2e/cli/tests/repair.spec.ts` | `verify` -> `repair` -> `verify`, directory pruning, the bounds that keep repair inside the repaired skill, and uninstall reversing hooks and guidance | the **product** changed |
+| `e2e/cli/tests/requires.spec.ts` | skill dependencies: every `repo lint` code the `requires` group triggers, the single-document `--json` form, both target-misuse exits, the transitive install closure, and the uninstall breakage report | the **product** changed |
 
 If `fixture.spec.ts` fails, fix or re-pin the fixture. If it passes and another
 spec fails, the CLI's behaviour moved and the fixture is telling you so.
@@ -90,7 +92,7 @@ git -C examples/test-repo status --porcelain  # expect clean
 ```
 
 Every spec runs the CLI with throwaway `HOME` and `XDG_CONFIG_HOME`
-(`e2e/src/cli.ts`), so a dirty tree here means a test wrote somewhere it should
+(`e2e/cli/src/cli.ts`), so a dirty tree here means a test wrote somewhere it should
 not have -- a blocker, and a harness defect rather than a product one.
 
 Note that a force-pull may legitimately leave the submodule pointer moved; that
@@ -103,7 +105,7 @@ commit the bump on its own.
 Jest already reports per-test results, so summarize rather than restate:
 
 ```
-pnpm test:e2e:            PASS / FAIL (N passed, N failed of 51)
+pnpm test:e2e:cli:        PASS / FAIL (N passed, N failed of 67)
 failing spec(s):          <file> -> <test name>
 attributed to:            fixture drift / product change / harness defect
 working tree clean after: yes / no
 
@@ -21,7 +21,7 @@ jobs:
   open-backmerge-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
 
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # Fetch LFS blobs (png/ttf/woff2): the icon generator and the font
           # assets read real bytes, not the LFS pointer text.
@@ -82,6 +82,9 @@ jobs:
       - name: Type-check
         run: pnpm typecheck
 
+      - name: Check formatting
+        run: pnpm format:check
+
       - name: Test with coverage (90% gate)
         # vitest run --coverage enforces the thresholds defined in vitest.config.ts.
         # The build fails if lines or branches fall below 90%.
@@ -97,7 +100,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # Fetch LFS blobs (png/ttf/woff2): the icon generator and the font
           # assets read real bytes, not the LFS pointer text.
@@ -228,7 +231,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # Nothing this job reads is LFS-tracked today, but fetch the blobs
           # anyway: if a fixture or an asset the CLI touches ever becomes
@@ -262,10 +265,74 @@ jobs:
 
       # The suite drives only the CLI crate, which does not link the webview, so
       # the Tauri system libraries the `rust` job installs are not needed here.
+      # Explicitly the CLI half, not `pnpm test:e2e`: this job has no
+      # Playwright browser install, so the desktop half would fail with
+      # "browserType.launch: Executable doesn't exist" here. The desktop half
+      # runs in its own `desktop-e2e` job below, which does install Chromium.
       - name: Run the end-to-end suite
         # Pin the fixture to the commit this repository records: a CI run must be
         # reproducible and fail for reasons in the diff, not because the fixture
         # moved. Locally the same script force-pulls instead.
         env:
           SKILLKEEPER_E2E_PIN_FIXTURE: '1'
-        run: pnpm test:e2e
+        run: pnpm test:e2e:cli
+
+  desktop-e2e:
+    name: Desktop UI (Playwright)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          lfs: false
+          submodules: false
+
+      - name: Enable pnpm via corepack
+        run: corepack enable
+
+      - name: Set up Node.js with pnpm cache
+        uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+          cache: pnpm
+
+      - name: Install dependencies (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate localization catalogs
+        run: pnpm run i18n
+
+      # Keyed on the whole lockfile, not just the Playwright package version:
+      # a browser build is ~150MB, so caching it is worth doing, but the key
+      # deliberately errs coarse. Keying on a parsed-out Playwright version
+      # instead would risk a bump the parsing misses reusing a stale,
+      # mismatched browser binary; hashing the full lockfile instead means an
+      # occasional needless re-download on an unrelated dependency bump,
+      # which is the safe direction to be wrong in.
+      - name: Cache the Playwright browser
+        id: playwright-cache
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
+      # No separate "build the renderer" step here: playwright.config.ts
+      # chains `frontend:build` into the webServer command so every run
+      # boots a fresh bundle, and a build failure surfaces as the webServer
+      # failing to come up. A second, earlier build step would only repeat
+      # that work.
+      - name: Run the desktop UI suite
+        run: pnpm test:e2e:desktop
+
+      - name: Upload the report on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: playwright-report/
+          retention-days: 7
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # No LFS and no submodules on purpose. CodeQL reads source, not
           # binary assets, and examples/test-repo is a fixture whose contents
@@ -106,7 +106,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           lfs: false
           submodules: false
 
@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # mike needs full history plus the gh-pages branch it maintains.
           fetch-depth: 0
@@ -54,7 +54,7 @@ jobs:
           lfs: true
 
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Configure git identity for mike
         run: |
 
@@ -49,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # check-tag-branch.mjs asks whether the tag is reachable from main or
           # develop, which needs the full history and those branch refs -- a
@@ -143,7 +143,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           # The desktop build needs real binary assets (LFS-tracked fonts and
           # icon source PNGs), not LFS pointer files.
@@ -266,7 +266,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Build the app (Tauri)
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
         env:
           # macOS signing is injected via $GITHUB_ENV by "Configure Apple code
           # signing" above, and only when a certificate secret is set. The
@@ -454,7 +454,7 @@ jobs:
       # dir (linux/windows) and the cross-target dir (macOS --target).
       # -----------------------------------------------------------------------
       - name: Upload artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: skillkeeper-${{ github.ref_name }}-${{ matrix.target }}
           path: |
@@ -488,7 +488,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Node.js 22
         uses: actions/setup-node@v5
@@ -503,7 +503,7 @@ jobs:
         run: node scripts/release-notes.mjs
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           path: dist-all
 
 
@@ -31,6 +31,17 @@ Thumbs.db
 # Storybook
 apps/desktop/storybook-static/
 
+# Playwright: `outputDir`'s default walks up from the config file's directory
+# (e2e/desktop/) to the nearest package.json and appends test-results/ to
+# THAT directory -- today that lands at the repository root (e2e/desktop/ has
+# no package.json of its own), but that is one `e2e/desktop/package.json` away
+# from moving to e2e/desktop/test-results/ (see e2e/cli/package.json for a
+# sibling suite that already has one). No leading slash, so these match
+# wherever it actually lands rather than assuming which.
+test-results/
+playwright-report/
+blob-report/
+
 # Documentation site (mkdocs + uv): uv caches the tools globally, but keep any
 # local Python virtualenv and the rendered static site out of git.
 .venv/