diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09b6694..dec8175 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+- Upgraded `codebase-memory-mcp` pin to v0.11.0 with SHA-256 verified portable tarball download, and added automatic `--format json` argument propagation in `lib/cbm.py` for reliable JSON extraction across project listing and status commands.
+- Bumped `shadcn` CLI MCP pin to `4.21.0` across `vendor/mcp-wanted.json`, `vendor/mcp-policy.json`, `lib/install.py`, `rules/00-routing.md`, and doctor tests.
+- Refreshed `impeccable` craft floor mechanics in `skills/impeccable/reference/craft-floor.md` from upstream `skill-v4.3.1` / main (tracking caps at -0.04em, single elevation declarations via border or shadow, banning amateur sketch imitation in SVG while preserving geometric linework, subject-world textures, and truth-grounded claims).
+- Created `skills/impeccable/reference/email.md` synthesizing email design intelligence and bulletproof rendering (CosmoBlk, email-pro-max, email-skills, agent-skills): 6 committed archetypes (Editorial, Bold-mono, Minimal-lux, Founder letter, Punk/Character, Lookbook), strict presentation tables (or React Email/MJML framework components), inline CSS, 6-digit hex colors, bulletproof table-cell CTA buttons, preheader anti-spill ZWNJ padding, dark mode resilience, and <100KB deliverability constraints.
+- Wired email design routing into `skills/impeccable/SKILL.md`, `skills/impeccable/reference/routing.md`, and `skills/impeccable/reference/ui-hub.md` to guarantee web component libraries are never mistakenly installed into email templates.
+- Consolidated Emil Kowalski motion doctrines into `skills/emil-design-eng/references/`: created `motion.md` (decision framework, compositor-only properties, production recipes, exit choreography), `apple-principles.md` (WWDC 2018 fluid interfaces, physics-based springs, velocity handoff, momentum projection, materials, SF Pro optical sizing), and `native-motion.md` (eliminating mobile web browser tells, 100dvh, safe area insets, touch-action, overscroll containment, and Expo / React Native Reanimated 3 worklets). Maintained zero new skill names, preserving catalog freeze at 62.
+- Refreshed upstream pins in `vendor/sources.json` for `pbakaus/impeccable` (tag `skill-v4.3.1` `cd12f8660e2d` / verified main `e0881d2de397`), `emilkowalski/skills` (`85e8e2363b71`), `microsoft/markitdown` (v0.1.8 `b8f79c57`, PIN_ONLY), and `kunchenguid/axi` (`85a8723276ca`, PIN_ONLY).
+- Updated `docs/source-wave.md`, `docs/mcp.md`, `README.md`, and `THIRD_PARTY_NOTICES.md` with complete attribution and license notices for merged doctrines.
+- Recorded `CODEBASE_MEMORY_BINARY_CHECKSUM_FAILED` in `docs/troubleshooting.md` (delete download cache and `components/codebase-memory`, then reinstall; v0.11 index rebuilds once). Vendored `vendor/licenses/IMPECCABLE-APACHE2.txt` and `vendor/licenses/EMILKOWALSKI-MIT.txt` so `licenseFile` pins are not empty pointers. `scroll-world` and `browser-act` stay **UPDATE** (not body-refreshed in this wave). markitdown `uvx` invocation stays unpinned (`PIN_ONLY` follow-up).
+
 ## 0.1.3 — 2026-09-23
 
 - Codified the 20-member closed intent classification set in `rules/00-routing.md`, `docs/routing.md`, and `templates/AGENTS.md` (`repo_understand | bug | security | perf | ui_direction | ui_implement | motion | scroll_2d | scroll_3d | img3d | docs | ingest_md | prose | academic | browser_qa | architecture | warehouse | ops_data | video_html | demo_id`).
diff --git a/README.md b/README.md
index cf6df02..36ddf6e 100644
--- a/README.md
+++ b/README.md
@@ -154,7 +154,7 @@ Native OpenCode 2 shape (`mcp.servers`, every entry has `type`, `disabled` not V
       },
       "shadcn": {
         "type": "local",
-        "command": ["npx", "-y", "shadcn@4.18.0", "mcp"],
+        "command": ["npx", "-y", "shadcn@4.21.0", "mcp"],
         "disabled": false
       }
     }
@@ -166,7 +166,7 @@ Core (installed):
 
 - `codebase-memory-mcp` — downloaded, SHA-256 verified, Linux x86_64. If the binary will not run, doctor reports `DEGRADED`, never fake `CONNECTED`.
 - `context7` — `https://mcp.context7.com/mcp` (no secret stored)
-- `shadcn` — `npx -y shadcn@4.18.0 mcp`
+- `shadcn` — `npx -y shadcn@4.21.0 mcp`
 
 Optional:
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 3fef3be..73771df 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -27,6 +27,8 @@ Machine-readable copy: `vendor/license-audit.json`.
 | `academic` | Original first-party text. Conceptual pipeline (research→write→review→revise) independently implemented. No source copied from Imbad0202/academic-research-skills (CC-BY-NC-4.0). | MIT © 2026 OpenCodeHighEnd contributors | follow MIT |
 | `hyperframes` | [heygen-com/hyperframes](https://github.com/heygen-com/hyperframes); skill `NOTICE.md` | Apache-2.0 | follow Apache-2.0 |
 | `diagram-design` | [cathrynlavery/diagram-design](https://github.com/cathrynlavery/diagram-design); skill `NOTICE.md` | MIT © 2024-2026 Cathryn Lavery contributors | follow MIT |
+| Email design doctrine | Merged from [CosmoBlk/email-design](https://github.com/CosmoBlk/email-design) (MIT © 2026 CosmoBlk), [jayesh-bansal/email-pro-max](https://github.com/jayesh-bansal/email-pro-max) (MIT © 2026 Jayesh Bansal), [chunkydotdev/email-skills](https://github.com/chunkydotdev/email-skills) (MIT © 2026 chunkydotdev), and [Olshansk/agent-skills](https://github.com/Olshansk/agent-skills) (MIT © 2026 Olshansk) into `skills/impeccable/reference/email.md` | MIT | follow MIT |
+| Emil Kowalski motion doctrines | Merged from [emilkowalski/skills](https://github.com/emilkowalski/skills) (`85e8e2363b71`) into `skills/emil-design-eng/references/` (`motion.md`, `apple-principles.md`, `native-motion.md`, `interface-feel.md`). Text: `vendor/licenses/EMILKOWALSKI-MIT.txt` | MIT © 2026 Emil Kowalski | follow MIT |
 | Warehouse Batch 2a (`agent-architecture-audit`, `cost-aware-llm-pipeline`, `eval-harness`, `prompt-optimizer`, `skill-stocktake`) | Adapted from [affaan-m/ECC](https://github.com/affaan-m/ECC); respective skill `NOTICE.md` files | MIT © 2024-2026 affaan-m and ECC contributors | follow MIT |
 | Warehouse Batch 3a (`api-design`, `automation-audit-ops`, `click-path-audit`, `code-tour`, `contract-first`) | Adapted from [affaan-m/ECC](https://github.com/affaan-m/ECC); respective skill `NOTICE.md` files | MIT © 2024-2026 affaan-m and ECC contributors | follow MIT |
 | Design bank media | User-provided public bootstrap artifact or existing local bank | **not cleared** | not in git; normal install does not download it |
diff --git a/docs/mcp.md b/docs/mcp.md
index 5476822..4bcd9e9 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -6,9 +6,9 @@ Owned:
 
 | Name | Type | Pin |
 | --- | --- | --- |
-| codebase-memory-mcp | local stdio | 0.9.0 SHA-256 verified |
+| codebase-memory-mcp | local stdio | 0.11.0 SHA-256 verified |
 | context7 | remote HTTP | https://mcp.context7.com/mcp |
-| shadcn | local stdio | `npx -y shadcn@4.18.0 mcp` |
+| shadcn | local stdio | `npx -y shadcn@4.21.0 mcp` |
 
 Optional:
 
diff --git a/docs/source-wave.md b/docs/source-wave.md
index 860eb4c..d286b25 100644
--- a/docs/source-wave.md
+++ b/docs/source-wave.md
@@ -7,13 +7,13 @@ Recorded per Phase 0 contract.
 |---|---|---|:---:|---|---|
 | [miqdadbadjuber/anti-slop](https://github.com/miqdadbadjuber/anti-slop) | `743735248fbaefd76bb56619615687dfa8b3bc1e` (v3.2.9) | UI/copy filter (38 rules R-01–R-38), 3 tiers (Hard Gate, Purpose-Gate, Quality Locks), Delivery Gate checklist, Liveliness dials, during/after usage modes. MIT. | **MERGE** | `skills/impeccable` (taste-guard + direction), `skills/humanizer`, `rules/03-prose-discipline.md` | Filter, not a style guide. Do not vendor as 65th skill (`antislop` or `antislop-ui`). Distinct from Oxlint. |
 | [dmmulroy/anti-slop](https://github.com/dmmulroy/anti-slop) | `e8c4880471b23ab7f216fba7b27d173a6ef07d4c` (v0.1.2) | TypeScript/JavaScript Oxlint static linter ruleset. MIT. | **DONE** | `skills/install-anti-slop` | Already vendored and pinned. Strictly for static code linting on opt-in TS/JS projects. |
-| [microsoft/markitdown](https://github.com/microsoft/markitdown) | `945314a45ddbe02935f2fd287b797dc0ba4a01e4` (v0.1.7 tag `63714e4`) | File to Markdown converter (Office/PDF/HTML/CSV/XLSX/PPTX/EPUB/ZIP). MIT. | **UPDATE** | `skills/markitdown` | Update pin and CLI invocation surface. Output is data-only. SmartDoc keeps contract/QA/render. MCP remains FOREIGN_ON_DEMAND. |
+| [microsoft/markitdown](https://github.com/microsoft/markitdown) | `b8f79c57ebc0044be41323d89b2a45d3fda8460e` (v0.1.8) | File to Markdown converter (Office/PDF/HTML/CSV/XLSX/PPTX/EPUB/ZIP). MIT. | **PIN_ONLY** | `skills/markitdown` | Pinned to v0.1.8 (commit `b8f79c57`). CLI invocation unchanged; output remains data-only. SmartDoc keeps contract/QA/render. MCP remains FOREIGN_ON_DEMAND. |
 | [affaan-m/ECC](https://github.com/affaan-m/ECC) | `dd6ee538aee0f548d4a6b520118f875431fd749e` | External agent control plane (68 agents, 292 skills, hooks, learning runtime). | **REJECT** | None (`FOREIGN_ON_DEMAND`) | Do not vendor harness control plane or 292 skills. No installer mutator. Doctor does not fail when absent. Individual warehouse ports remain first-party MIT. |
 | [Leonxlnx/taste-skill](https://github.com/Leonxlnx/taste-skill) | `e79ca9ec7e071eb3a3b623c4fb752e853fc3ed58` (`ccbc156` base) | Design taste dials (VARIANCE, MOTION, DENSITY), quality rules, GSAP/Tailwind references. MIT. | **MERGE** | `skills/impeccable/reference/taste/direction.md`, `taste-guard.md` | Dials already integrated into Impeccable surface brief. Fenced after Design Bank or DESIGN.md direction exists. Never a frontend-design twin. |
 | [ashemag/human-atlas](https://github.com/ashemag/human-atlas) | `1c38bf35c254a891200d3cedecfd57abebe83d8d` | 3D human anatomy application (Three.js/R3F + BodyParts3D dataset). CC BY-SA 4.0 / CC BY 4.0 data. | **REJECT** | None (catalog reject) | Standalone 3D application, not an agent writing or coding skill. Do not vendor heavy anatomy meshes or CC BY-4.0 data into OCBF overlay. |
 | [oso95/scroll-world](https://github.com/oso95/scroll-world) | `71cc36d3bb150248ae36a2c552f9cbf88802a79c` | Continuous camera fly-through landing, vanilla-JS scrub engine, seam QA. MIT. | **UPDATE** | `skills/scroll-world` | Update camera style choices and composition seam QA. Retain boundary: scroll-craft = 2D timeline; scroll-world = 3D camera flight. Do not vendor paid video backends (degrade to NOT_CONFIGURED). |
 | [VoltAgent/awesome-design-md](https://github.com/VoltAgent/awesome-design-md) | `8147538b4226ae41e2487a9179e3bcc1f68e8554` | Curated repository of brand DESIGN.md files and design token guidelines. | **REJECT** (vendor) / **FOREIGN** (reference) | Mention in `skills/found-this-design` | Human-chosen reference corpus only. Do not clone brand files into overlay. Direction stays Design Bank + project DESIGN.md. |
-| [kunchenguid/axi](https://github.com/kunchenguid/axi) | `fb752160dea2eb421b082dee77fc1d5bc152639c` | Agent eXperience Interface (AXI) — 10 CLI principles; official `gh-axi`, `chrome-devtools-axi`. MIT. | **UPDATE** | `skills/gh-axi`, `skills/chrome-devtools-axi` | Refresh command surfaces and principles from upstream. Do not introduce a generic "axi" skill. Maintain 4-door browser hierarchy. |
+| [kunchenguid/axi](https://github.com/kunchenguid/axi) | `85a8723276ca` | Agent eXperience Interface (AXI) — 10 CLI principles; official `gh-axi`, `chrome-devtools-axi`. MIT. | **PIN_ONLY** | `skills/gh-axi`, `skills/chrome-devtools-axi` | Pinned commit `85a8723276ca`. Command surfaces and 4-door browser hierarchy unchanged. Do not introduce a generic "axi" skill. |
 | [browser-act/skills](https://github.com/browser-act/skills) | `11c057b03f92101642cadc9f840564574120d184` | BrowserAct CLI agent skills (2.0.2 stub, multi-account, stealth, session isolation). MIT. | **UPDATE** | `skills/browser-act` | Document three modes: `chrome` (profile reuse), `stealth-fresh`, `stealth-fixed`. Ban `chrome-direct`. Playwright-qa remains primary default QA adapter. |
 | [cursor/plugins](https://github.com/cursor/plugins) | `e31650eea443aaea1e84cc15d88c13f40080b275` (`60c641e` base) | Cursor ecosystem: pstack, SaaS connectors (Gmail, HubSpot, Salesforce), continual-learning, ralph-loop, orchestrate. | **DONE** (pstack) / **REJECT** (SaaS & autopilot) | Existing specialists | pstack principles already absorbed in routing and engineering principles. Reject foreign SaaS connectors and autopilot loops (`ralph-loop`, `orchestrate`, `continual-learning`). |
 | [jakubkrehel/make-interfaces-feel-better](https://ui-skills.com) | ui-skills upstream | Interface tactile feel: typography stability, hit targets, concentric border radii, layered shadows. MIT. | **MERGE** | `skills/emil-design-eng/references/interface-feel.md` | Concrete checklists for tactile feel merged directly into `emil-design-eng`. Zero catalog bloat; no new skill folder. |
@@ -28,9 +28,17 @@ Recorded per Phase 0 contract.
 | [PaulRBerg/agent-skills](https://github.com/PaulRBerg/agent-skills) | upstream ref | Agent coding skills and engineering conventions. | **CHERRY-PICK** | `rules/00-routing.md`, `skills/codebase-design/` | Cherry-pick module interface and seam principles. Do not vendor catalog; `frontend-design` must not become a skill. |
 | [confident-ai/deepteam](https://github.com/confident-ai/deepteam) | `latest` / Apache-2.0 | LLM red-teaming and OWASP LLM Top 10 evaluation framework. | **OPTIONAL_POINTER** | `skills/full-audit-keamanan/SKILL.md`, `skills/eval-harness/SKILL.md` | Documented as external maintainer-side red-team framework pointer. Zero overlay dependencies, non-vendored. |
 | [Panniantong/Agent-Reach](https://github.com/Panniantong/Agent-Reach) | upstream ref | Headless browser reaching and web crawling agent tool. | **REJECT** / **FOREIGN** | None (`docs/mcp.md`) | Reject as core MCP or skill. Not exploratory QA eyes; carries ToS/cookie risk; Exa is already designated FOREIGN_ON_DEMAND. |
-| [emilkowalski/emil-design-eng](https://github.com/emilkowalski) | animations.dev | Design engineering, interaction feel, and spring physics. | **UPDATE** | `skills/emil-design-eng/` | Update references and interaction doctrines. |
+| [emilkowalski/emil-design-eng](https://github.com/emilkowalski) | animations.dev | Design engineering, interaction feel, and spring physics. | **MERGE** | `skills/emil-design-eng/references/` | Body landed (`motion.md`, `apple-principles.md`, `native-motion.md`, `interface-feel.md`). Not an open UPDATE. Zero new skill names. |
 | [emilkowalski/apple-design](https://github.com/emilkowalski) + [wshobson/interaction-design](https://github.com/wshobson/interaction-design) | upstream refs | Apple-grade tactile motion, velocity inheritance, interruptible springs. | **MERGE** | `skills/emil-design-eng/references/interface-feel.md` | Merge interruptible springs, velocity inheritance, and tactile press feedback. Never an Apple-clone skill. |
 | [mengto/beautiful-shadows](https://github.com/mengto) + [pbakaus/adapt](https://github.com/pbakaus) + [superfuture/design-review](https://github.com/superfuture) | upstream refs | Multi-layer ambient shadows, adaptive container queries, and design review checklists. | **MERGE** | `skills/emil-design-eng/references/interface-feel.md`, `skills/impeccable/reference/audit.md` | Merged bounded checklist items (≤15 bullets total). No new skill. |
-| [shadcn-ui/shadcn](https://github.com/shadcn-ui/ui) | upstream ref | Shadcn component registry and CLI MCP. | **SKIP** | `mcp.servers.shadcn` | Core MCP already owned and pinned (`shadcn@4.18.0`). Skip raw skill text to prevent duplicate routing. |
+| [shadcn-ui/shadcn](https://github.com/shadcn-ui/ui) | upstream ref | Shadcn component registry and CLI MCP. | **SKIP** | `mcp.servers.shadcn` | Core MCP already owned and pinned (`shadcn@4.21.0`). Skip raw skill text to prevent duplicate routing. |
 | [anthropics/frontend-design](https://github.com/anthropics) | upstream ref | Frontend design principles and anti-generic aesthetic filters. | **MERGE** | `skills/impeccable/reference/taste-guard.md` | Merged anti-generic rules (≤25 bullets: no cream #F4F1EA kit, no terracotta cards, token system before markup). NEVER add as skill; NEVER implement product UI from it when Design Bank misses. |
 | [ui-skills.com](https://www.ui-skills.com) | remote MCP | Curated design-skill reference server. | **FOREIGN_ON_DEMAND** | `docs/mcp.md` | Lookup-only remote MCP (`list_skills`, `get_skill`). Product UI remains Design Bank + Impeccable + Design V2 atoms + shadcn; BANK_MISS never generates from ui-skills document. |
+| [pbakaus/impeccable](https://github.com/pbakaus/impeccable) | tag `skill-v4.3.1` (`cd12f8660e2d`), main `e0881d2de397` | Impeccable design skill suite. Apache-2.0. | **UPDATE** | `skills/impeccable` | Refreshed craft floor mechanics (`reference/craft-floor.md`) from upstream tag/main; merged anti-slop email reference (`reference/email.md`). Preserved Design Bank overlay gates. |
+| [CosmoBlk/email-design](https://github.com/CosmoBlk/email-design) + [jayesh-bansal/email-pro-max](https://github.com/jayesh-bansal/email-pro-max) + [chunkydotdev/email-skills](https://github.com/chunkydotdev/email-skills) + [Olshansk/agent-skills](https://github.com/Olshansk/agent-skills) | upstream refs (`c56bfe0`, `6a28b31`, `dca18fc`, `d43745c`) | Anti-slop email design, 6 archetypes, and bulletproof multi-client HTML email rendering. MIT. | **MERGE** | `skills/impeccable/reference/email.md` | Merged into single reference under Impeccable; strict tables, inline CSS, 6-digit hex, bulletproof CTA, preheader anti-spill padding, framework exemption for React Email/MJML. No new skill. |
+| [emilkowalski/skills](https://github.com/emilkowalski/skills) | `85e8e2363b71` | Animation recipes, WWDC fluid interface design, mobile web polish, and Expo motion. MIT. | **MERGE** | `skills/emil-design-eng/references/` | Merged `motion.md`, `apple-principles.md`, and `native-motion.md` into references. Zero new skill names, exact catalog freeze maintained. |
+| [DeusData/codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp) | `v0.11.0` | Codebase indexing and symbol memory MCP server. | **UPDATE** | `vendor/sources.json`, `lib/install.py`, `lib/cbm.py` | Bumped binary pin to 0.11.0 with SHA-256 verified portable tarball and inner binary, plus `--format json` for `list_projects` / `index_status`. |
+| [heygen-com/hyperframes](https://github.com/heygen-com/hyperframes) | `ed75203cb6aa` (v0.8.64) | Deterministic HTML/CSS video composition. Apache-2.0. | **PIN_ONLY** | `skills/hyperframes` | Pinned commit `ed75203cb6aa` in `vendor/sources.json`. Skill body unchanged. |
+| [cathrynlavery/diagram-design](https://github.com/cathrynlavery/diagram-design) | `dc1ace47b99a` (v2.6.33) | Editorial HTML/SVG diagram design. MIT. | **PIN_ONLY** | `skills/diagram-design` | Pinned commit `dc1ace47b99a` in `vendor/sources.json`. Skill body unchanged. |
+| [blader/humanizer](https://github.com/blader/humanizer) | `3.0.0` | AI prose humanizing and slop removal. MIT. | **PIN_ONLY** | `skills/humanizer` | Pinned v3.0.0 in `vendor/sources.json`. Skill body unchanged. |
+| [semgrep / gitleaks / osv-scanner](https://github.com) | `semgrep` 1.177.0, `gitleaks` 8.30.1, `osv-scanner` 2.6.0 | Host security scanners. | **PIN_ONLY** | `skills/full-audit-keamanan` | Host scanner version pins recorded in `vendor/sources.json`. |
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 4d4d06e..57572e5 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -6,7 +6,9 @@
 
 `V1_PLUGIN_LEFTOVER` / `failed to load plugin` — OpenCode 2 rejects legacy V1 plugins (such as `impeccable-live-poll.ts` from OCBF) in `~/.config/opencode/plugins/`. Re-run `./install.sh` to quarantine known legacy plugins to `~/.local/share/opencode-highend/quarantine/plugins/`, or move them manually.
 
-`CODEBASE_MEMORY_CHECKSUM_FAILED` — delete `~/.local/share/opencode-highend/cache/downloads/` and retry. Do not ignore a mismatch.
+`CODEBASE_MEMORY_CHECKSUM_FAILED` — archive hash mismatch. Delete `~/.local/share/opencode-highend/cache/downloads/` and retry. Do not ignore a mismatch.
+
+`CODEBASE_MEMORY_BINARY_CHECKSUM_FAILED` — archive hash matched, extracted `codebase-memory-mcp` did not. Delete `~/.local/share/opencode-highend/cache/downloads/` and `~/.local/share/opencode-highend/components/codebase-memory`, then re-run `./install.sh`. A 0.9.0 → 0.11.0 upgrade rebuilds the index once. Do not ignore a mismatch.
 
 `DESIGN_BANK_INVALID` — bootstrap requires parseable 21st, Aura, Refero, and Motionsites catalogs (the 4 foundational bootstrap catalogs; `found-this-design` indexes up to 12 banks once present). Fix the configured target or choose a new empty `--target`.
 
diff --git a/lib/cbm.py b/lib/cbm.py
index 7ec017c..88a9e03 100644
--- a/lib/cbm.py
+++ b/lib/cbm.py
@@ -54,7 +54,10 @@ def cbm_cli(args: list[str]) -> tuple[int, object | None, str]:
     bin_path = cbm_bin()
     if not bin_path:
         return 2, None, "missing"
-    r = run([str(bin_path), "cli", *args])
+    cli_args = list(args)
+    if cli_args and cli_args[0] in {"list_projects", "index_status"} and "--format" not in cli_args:
+        cli_args.extend(["--format", "json"])
+    r = run([str(bin_path), "cli", *cli_args])
     text = (r.stdout or "") + (r.stderr or "")
     if r.returncode != 0:
         try:
diff --git a/lib/install.py b/lib/install.py
index b8a4917..44bef43 100644
--- a/lib/install.py
+++ b/lib/install.py
@@ -243,6 +243,7 @@ def download_codebase_memory(offline: bool = False) -> Path:
     sources = load_json(repo_root() / "vendor" / "sources.json")["sources"]["codebase-memory"]
     url = sources["artifactUrl"]
     expected = sources["artifactSha256"]
+    expected_bin = sources.get("innerBinarySha256")
     version = sources["version"]
     target_dir = share_dir() / "components" / "codebase-memory" / "bin"
     target = target_dir / "codebase-memory-mcp"
@@ -287,6 +288,10 @@ def download_codebase_memory(offline: bool = False) -> Path:
             if not found:
                 die("codebase-memory binary missing from archive")
             bin_path = found[0]
+        if expected_bin:
+            got_bin = sha256_file(bin_path)
+            if got_bin != expected_bin:
+                die(f"CODEBASE_MEMORY_BINARY_CHECKSUM_FAILED expected={expected_bin} got={got_bin}")
         bin_path.chmod(bin_path.stat().st_mode | stat.S_IXUSR)
         ver = run([str(bin_path), "--version"])
         if ver.returncode != 0 or version not in (ver.stdout + ver.stderr):
@@ -313,7 +318,7 @@ def owned_mcp_spec(cbm_bin: Path) -> dict:
         },
         "shadcn": {
             "type": "local",
-            "command": ["npx", "-y", "shadcn@4.18.0", "mcp"],
+            "command": ["npx", "-y", "shadcn@4.21.0", "mcp"],
             "disabled": False,
         },
     }
@@ -1085,7 +1090,9 @@ def cmd_install(
             bank = (None, "not-requested", "DEGRADED_DESIGN_BANK")
         cbm = Path(os.environ.get("OPENCODE_HE_TEST_CBM") or "/nonexistent/codebase-memory-mcp")
         mcp_plan = merge_opencode_config(cbm, dry_run=True)
-        print(plan_text(meta, mcp_plan, bank, "download-or-reuse 0.9.0"))
+        sources = load_json(repo_root() / "vendor" / "sources.json")
+        cbm_ver = sources.get("sources", {}).get("codebase-memory", {}).get("version", "0.11.0")
+        print(plan_text(meta, mcp_plan, bank, f"download-or-reuse {cbm_ver}"))
         if with_design_bank:
             print("DESIGN_BOOTSTRAP would run after core install")
         print("DRY_RUN_NO_MUTATION")
diff --git a/rules/00-routing.md b/rules/00-routing.md
index 48b97c1..083cde2 100644
--- a/rules/00-routing.md
+++ b/rules/00-routing.md
@@ -86,7 +86,7 @@ Never list unused tools or uncalled MCP methods as used.
 - Repository structure and impact: MCP `codebase-memory-mcp` first. If Codebase Memory has no project for cwd, skip it and use repo files. Do not retry.
 - Exact cross-file symbol work: MCP `serena` only if already registered and only after Codebase Memory and simpler repo evidence are not enough. Do not run Serena and Codebase Memory as the main brain at the same time. If Serena is absent, say so; do not `opencode mcp add serena` from a session unless the user asked. Helper: `opencode-he serena enable`.
 - Current library or framework docs: MCP `context7` only when repo evidence is insufficient.
-- Installable React/shadcn registry items: MCP `shadcn` (pinned CLI `shadcn@4.18.0`). Search, inspect, then install. Context7 stays documentation.
+- Installable React/shadcn registry items: MCP `shadcn` (pinned CLI `shadcn@4.21.0`). Search, inspect, then install. Context7 stays documentation.
 - Broader web research: built-in `WebSearch` and `WebFetch`. MCP `exa` is foreign/pre-existing and ON_DEMAND. Use it only if already connected and research needs it. Never add or remove `exa`.
 - Hard, high-impact, divergent decisions, fuzzy debugging, API or schema alternatives, trap detection: `/adhd` on demand only. Skip ADHD for typos, ordinary CRUD, or bugs with a known cause.
 - Official library, spec, or first-party API facts: `/research` (Context7 when repo evidence is not enough). Why *this repo* chose an approach: suggest `/why` (manual). Do not mix the two.
diff --git a/skills/emil-design-eng/SKILL.md b/skills/emil-design-eng/SKILL.md
index ab1a534..bcf741a 100644
--- a/skills/emil-design-eng/SKILL.md
+++ b/skills/emil-design-eng/SKILL.md
@@ -675,12 +675,10 @@ When reviewing UI code, check for:
 | Same enter/exit transition speed           | Make exit faster than enter (e.g., enter 2s, exit 200ms)         |
 | Elements all appear at once                | Add stagger delay (30-80ms between items)                        |
 
-## Interface Feel & Tactile Polish
+## Reference Modules
 
-Beyond animation curves, great interfaces feel responsive and stable through tactile details:
-- **Typography**: Apply `tabular-nums` to numbers/metrics to eliminate layout jitter. Use `text-wrap: balance` on headlines and `text-wrap: pretty` on copy.
-- **Hit targets**: Maintain >=44×44px hit targets (using negative pseudo-element insets if visual element is smaller). Set `user-select: none` on clickable badges/controls.
-- **Surfaces**: Enforce concentric nested radius (`inner = max(0, outer - padding)`). Use layered diffuse shadows and 1px semi-transparent borders.
-- **Optical alignment**: Nudge icons in text containers up 0.5–1px for baseline harmony.
-
-See detailed checklist in [references/interface-feel.md](references/interface-feel.md).
+For deeper doctrine and production code recipes, consult the specialized references:
+- **[references/motion.md](references/motion.md)**: Web animation construction, decision gates, compositor-only rules, and ready-to-use component recipes.
+- **[references/apple-principles.md](references/apple-principles.md)**: WWDC 2018 fluid interface principles, spring physics, velocity handoff, and momentum projection.
+- **[references/native-motion.md](references/native-motion.md)**: Eradicating mobile browser tells (100dvh, safe-area-inset, tap-highlight, overscroll) and React Native / Expo Reanimated 3 motion.
+- **[references/interface-feel.md](references/interface-feel.md)**: Tactile polish checklist (tabular-nums, concentric radius, multi-layer shadows, hit target ergonomics).
diff --git a/skills/emil-design-eng/references/apple-principles.md b/skills/emil-design-eng/references/apple-principles.md
new file mode 100644
index 0000000..8b0a594
--- /dev/null
+++ b/skills/emil-design-eng/references/apple-principles.md
@@ -0,0 +1,100 @@
+# Fluid Interfaces & Apple Design Principles
+
+Synthesized from Apple's design engineering foundations and WWDC *Designing Fluid Interfaces* (WWDC 2018), translated for modern web and native application engineering.
+
+---
+
+## 1. The Core Law of Fluidity
+
+> An interface feels alive when motion begins from the current on-screen position, inherits the user's velocity, projects momentum forward, and remains interruptible at any sub-millisecond instant.
+
+When software treats animations as fire-and-forget fixed-duration movies, it feels stiff and mechanical. When software treats motion as physical objects governed by mass, stiffness, and damping, it feels like an extension of the user's body.
+
+---
+
+## 2. The Nine Fluid Interaction Principles
+
+### Principle 1: Zero Latency Response
+Immediate visual confirmation on pointerdown. When a user touches or clicks a surface, visual acknowledgment must occur within 16ms (the very first frame).
+- Never wait for a click or pointerup event before providing visual feedback.
+- Buttons scale to `0.97` or illuminate immediately on pointerdown.
+
+### Principle 2: 1:1 Direct Manipulation
+While a pointer or finger is moving across the screen, the dragged element must track 1:1 with pointer coordinates.
+- No lagging behind or rubber-banding while within active bounds.
+- The anchor point under the user's cursor remains locked.
+
+### Principle 3: Absolute Interruptibility
+**This is the single most critical principle in modern interaction design.**
+- If an element is animating in and the user taps close, it must immediately reverse from its current position and velocity.
+- Never block gestures with boolean flags like `isAnimating = true`.
+- Never queue transitions sequentially when the user rapidly toggles state; blend them dynamically.
+
+### Principle 4: Springs Over Bezier Timers
+Fixed-duration bezier curves (`transition: transform 300ms ease`) cannot handle interruptibility smoothly because resetting time `t = 0` causes velocity jumps or hitching.
+Springs do not have fixed durations—they calculate instantaneous acceleration based on distance and velocity:
+
+$$\text{Force} = -k \cdot x - c \cdot v$$
+
+Recommended spring configurations:
+- **Snappy UI (Buttons, toggles, menus)**: Stiffness: 400, Damping: 30, Mass: 1 (rapid settle, zero overshoot).
+- **Smooth Sheets / Drawers**: Stiffness: 300, Damping: 32, Mass: 1 (clean glide, gentle settle).
+- **Bouncy Accents (Badges, likes, celebrations)**: Stiffness: 350, Damping: 18, Mass: 1 (controlled 1-2 oscillation overshoot).
+
+### Principle 5: Velocity Handoff
+When the user releases a drag or swipe gesture, the physics simulation must inherit the pointer's release velocity vector ($v_x, v_y$):
+- If the user flicks a sheet downward fast, the closing spring must start with that downward speed.
+- If the user slowly drags and lets go, initial velocity is ~0.
+- A fast flick must never abruptly decelerate to a preset slow transition speed.
+
+### Principle 6: Momentum Projection
+Project the user's trajectory to decide target state:
+$$\text{Projected Position} = \text{Current Position} + \frac{\text{Velocity}}{\text{Deceleration Rate}}$$
+If the projected position crosses 50% of the threshold or velocity exceeds flick threshold (e.g. 500px/s), commit to the open/close state even if the release point was only 20% along the path.
+
+### Principle 7: Spatial Symmetry & Anchor Points
+- Elements must exit along the path they entered. A drawer that slides in from the bottom must slide out to the bottom.
+- Popovers, context menus, and tooltips must anchor their `transform-origin` to the exact bounding box of the trigger control, not screen center.
+
+### Principle 8: Rubber-Banding at Soft Boundaries
+When dragging beyond valid scroll or drag limits, apply logarithmic resistance rather than a hard stop:
+$$dx_{\text{clamped}} = dx_{\text{boundary}} + (dx - dx_{\text{boundary}}) \times \left(1 - \frac{1}{\frac{|dx - dx_{\text{boundary}}|}{\text{dimension}} \times c + 1}\right)$$
+This communicates boundary elasticity and hints that the action has reached its extent.
+
+### Principle 9: Reduced Motion & Accessibility
+When `prefers-reduced-motion: reduce` is active:
+- Disable spatial translations (`translateX`, `translateY`, `scale`).
+- Preserve instantaneous or subtle cross-fade opacity transitions (`150ms ease-out`).
+- Never strip functional state changes; ensure focus outlines and selection badges remain visible.
+
+---
+
+## 3. Materials, Depth & Translucency
+
+In Apple design, depth is functional hierarchy, not decoration:
+1. **Translucent Frosted Materials**:
+   - Navigation bars, toolbars, and sheets use backdrop blur with semi-transparent backgrounds to maintain environmental context:
+     ```css
+     backdrop-filter: blur(20px) saturate(180%);
+     background-color: rgba(255, 255, 255, 0.75); /* Light */
+     /* Dark mode */
+     background-color: rgba(18, 18, 18, 0.75);
+     ```
+2. **Specular Hairlines & Bevels**:
+   - Glass surfaces feature an inner 1px white highlight at top (`inset 0 1px 0 rgba(255, 255, 255, 0.15)`) to ground illumination.
+3. **Concentric Radii**:
+   - Outer and inner rounded rectangles must share a center:
+     $$\text{Radius}_{\text{inner}} = \max(0, \text{Radius}_{\text{outer}} - \text{Padding})$$
+
+---
+
+## 4. Typography Discipline (Optical Sizing & SF Pro Harmony)
+
+- **Tracking (Letter Spacing)**:
+  - Large display type (≥32px): tight negative tracking (`-0.02em` to `-0.03em`).
+  - Standard body text (14–17px): default tracking (`0em`).
+  - Small captions / badges (10–12px): slightly positive tracking (`+0.01em` to `+0.03em`).
+- **Tabular Figures**:
+  - Always enforce `tabular-nums` on timers, counters, stock tickers, and tabular data to avoid vibrating characters.
+- **Dynamic Type Balance**:
+  - Use `text-wrap: balance` for titles up to 3 lines.
diff --git a/skills/emil-design-eng/references/motion.md b/skills/emil-design-eng/references/motion.md
new file mode 100644
index 0000000..b59e9bc
--- /dev/null
+++ b/skills/emil-design-eng/references/motion.md
@@ -0,0 +1,205 @@
+# Motion Engineering & Animation Recipes
+
+Knowledge synthesized from Emil Kowalski's animation engineering doctrines. Use this reference when building, refining, or reviewing interface animations.
+
+---
+
+## 1. The Animation Decision Framework
+
+Before writing animation code, run these three gates in order:
+
+### Gate 1: Should this animate at all?
+Base the decision on usage frequency:
+
+| Frequency | Action | Example |
+| --- | --- | --- |
+| **100+ times/day** | **Zero animation. Ever.** | Command palettes, keyboard shortcuts, tabs, editor hotkeys |
+| **Tens of times/day** | **Minimal or instantaneous** | Hover states, list item selection, dropdown menus |
+| **Occasional (a few times/session)** | **Standard polished motion** | Modals, drawers, toasts, accordions |
+| **Rare / First-run** | **Can add expressive delight** | Onboarding milestones, celebrations, success states |
+
+**Never animate keyboard-initiated actions.** Users type at 60–100 WPM; animation introduces perceived lag and breaks muscle memory.
+
+### Gate 2: What is the purpose?
+Valid purposes:
+- **Spatial consistency**: Dialog originates from the button that triggered it; drawer slides back to the edge it came from.
+- **State confirmation**: Button depresses on click to prove input was acknowledged.
+- **Preventing jarring cuts**: Smoothly transitioning layout when items are added or removed.
+- **Orientation**: Directing attention to what just changed (e.g. toast notification).
+
+If the answer is merely "it looks fancy" on a high-frequency control, cut the animation.
+
+### Gate 3: What easing curve?
+- **Entering the screen**: Strong `ease-out` (starts instantly, decelerates smoothly).
+- **Moving across screen**: Strong `ease-in-out` (smooth acceleration and deceleration).
+- **Leaving the screen**: Fast `ease-in` or accelerated `ease-out` (exits must never linger).
+- **Standard CSS curves (`ease`, `linear`) are too weak.** Use custom high-tension curves:
+
+```css
+:root {
+  /* Strong ease-out for entering UI elements and popovers */
+  --ease-out: cubic-bezier(0.23, 1, 0.32, 1);
+
+  /* Strong ease-in-out for morphing or cross-screen repositioning */
+  --ease-in-out: cubic-bezier(0.77, 0, 0.175, 1);
+
+  /* Deep iOS-style drawer curve */
+  --ease-drawer: cubic-bezier(0.32, 0.72, 0, 1);
+
+  /* Fast exit curve */
+  --ease-exit: cubic-bezier(0.4, 0, 1, 1);
+}
+```
+
+---
+
+## 2. Properties to Animate
+
+Stick to compositor-only properties to guarantee steady 60/120fps without layout thrash:
+- **Fast / GPU-accelerated**: `transform` (`translate`, `scale`, `rotate`), `opacity`, `filter` (`blur`), `clip-path`.
+- **Forbidden in high-frequency animations**: `width`, `height`, `top`, `left`, `margin`, `padding`, `border-width`. These trigger costly layout reflows on the main thread.
+
+For expanding accordion height, use CSS Grid 0fr → 1fr rather than animating max-height:
+```css
+.accordion-content {
+  display: grid;
+  grid-template-rows: 0fr;
+  transition: grid-template-rows 250ms var(--ease-out);
+}
+.accordion-content[data-expanded="true"] {
+  grid-template-rows: 1fr;
+}
+.accordion-inner {
+  overflow: hidden;
+}
+```
+
+---
+
+## 3. Production Animation Recipes
+
+### Recipe A: Button Press
+Immediate feedback that the interface received the user's action:
+
+```css
+.button {
+  transition: transform 140ms var(--ease-out);
+}
+
+.button:active {
+  transform: scale(0.97);
+}
+```
+
+### Recipe B: Popover, Dropdown, Menu, Select
+Originates from its trigger element using dynamic `transform-origin`:
+
+```css
+.popover {
+  transform-origin: var(--transform-origin, center top);
+  transition:
+    opacity 180ms var(--ease-out),
+    transform 180ms var(--ease-out);
+}
+
+.popover[data-state="closed"] {
+  opacity: 0;
+  transform: scale(0.95);
+  pointer-events: none;
+}
+
+.popover[data-state="open"] {
+  opacity: 1;
+  transform: scale(1);
+}
+```
+
+### Recipe C: Tooltip with Group Instant Warmup
+Tooltips delay on first hover to prevent nuisance flashing, but open instantly once a toolbar session is active:
+
+```css
+.tooltip {
+  transform-origin: var(--transform-origin, center bottom);
+  transition:
+    transform 120ms var(--ease-out),
+    opacity 120ms var(--ease-out);
+}
+
+.tooltip[data-state="closed"] {
+  opacity: 0;
+  transform: scale(0.96);
+}
+
+/* When another tooltip in the group was recently open, skip delay & duration */
+.tooltip-group[data-instant] .tooltip {
+  transition-duration: 0ms !important;
+}
+```
+
+### Recipe D: Centered Modal Dialog
+Modals stay centered. Scale subtly from 0.95 → 1.0 (never 0 → 1.0; elements in reality do not emerge from a microscopic dot):
+
+```css
+.modal-overlay {
+  transition: opacity 220ms var(--ease-out);
+}
+.modal-overlay[data-state="closed"] {
+  opacity: 0;
+}
+
+.modal-content {
+  transform-origin: center center;
+  transition:
+    opacity 220ms var(--ease-out),
+    transform 220ms var(--ease-out);
+}
+.modal-content[data-state="closed"] {
+  opacity: 0;
+  transform: scale(0.95);
+}
+.modal-content[data-state="open"] {
+  opacity: 1;
+  transform: scale(1);
+}
+```
+
+### Recipe E: Bottom Sheet / Drawer
+Slides cleanly from viewport edge with iOS-like deceleration:
+
+```css
+.drawer {
+  transition: transform 320ms var(--ease-drawer);
+  transform: translateY(0);
+}
+
+.drawer[data-state="closed"] {
+  transform: translateY(100%);
+}
+```
+
+### Recipe F: List Item Exit / Deletion Choreography
+Collapsing deleted items smoothly without jarring jumps:
+1. Fade and slide out item horizontally (`opacity: 0; transform: translateX(20px);`).
+2. Collapse item height and margin to 0 over 200ms using CSS grid or height animation on wrapper.
+3. Cleanly remove node from DOM.
+
+---
+
+## 4. Exit Choreography Rules
+
+1. **Exits must be faster than entries.** If entering takes 250ms, exiting should take 160–180ms. The user has already finished interacting and wants the obstacle out of the way.
+2. **Never stagger exits.** Entering items can stagger by 20–30ms to reveal structure. Exiting items should vanish simultaneously or near-instantly.
+3. **No exit spring oscillations.** Springs that overshoot on exit look sloppy; use clean critical damping or straight ease-out.
+
+---
+
+## 5. Review Format Checklist
+
+When reviewing animation code, format output in a Markdown comparison table:
+
+| Before | After | Why |
+| --- | --- | --- |
+| `transition: all 300ms ease;` | `transition: transform 180ms var(--ease-out);` | Never animate `all`; specify properties and use high-tension ease-out. |
+| `transform: scale(0);` | `transform: scale(0.95); opacity: 0;` | Elements should scale from ~95%, not thin air. |
+| `ease-in` on dropdown menu | `ease-out` | `ease-in` starts slowly and feels sluggish to human touch. |
+| Missing active state | `transform: scale(0.97)` on `:active` | Touch/click lacks tactile confirmation without active scale. |
diff --git a/skills/emil-design-eng/references/native-motion.md b/skills/emil-design-eng/references/native-motion.md
new file mode 100644
index 0000000..c1aae18
--- /dev/null
+++ b/skills/emil-design-eng/references/native-motion.md
@@ -0,0 +1,170 @@
+# Mobile Native & Touch Interaction Engineering
+
+Engineering guidelines for mobile web polish and native mobile motion (React Native / Expo / iOS / Android). Synthesized from Emil Kowalski's mobile-native and animate-expo doctrines.
+
+---
+
+## 1. Web on Mobile: Eradicating Browser Tells
+
+When running a web app on a mobile device, eliminating "website tells" transforms the perceived quality from an ordinary web page to an installed application:
+
+### A. Viewport & 100dvh
+- Standard `100vh` on mobile browsers includes the dynamic address bar, causing layout jumping when scrolling begins.
+- Use `100dvh` (dynamic viewport height) or `100svh` (small viewport height) for full-screen application shells:
+  ```css
+  .app-shell {
+    height: 100dvh;
+    min-height: 100dvh;
+  }
+  ```
+- Viewport meta tag configuration:
+  ```html
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  ```
+
+### B. Safe Area Insets (The Notch & Home Indicator)
+Ensure fixed navigation bars, headers, and floating action buttons respect device safe zones:
+```css
+.header {
+  padding-top: max(16px, env(safe-area-inset-top));
+}
+.bottom-bar {
+  padding-bottom: max(16px, env(safe-area-inset-bottom));
+}
+```
+
+### C. Eliminating the Gray Tap Highlight
+Mobile Safari and Android Chrome flash an ugly gray rectangular highlight on tapped elements by default:
+```css
+* {
+  -webkit-tap-highlight-color: transparent;
+}
+```
+
+### D. Eliminating 300ms Tap Delay & Unwanted Pinch Zoom
+Add `touch-action: manipulation` to interactive controls. This signals to the browser that double-tap-to-zoom is not needed, removing the 300ms gesture disambiguation delay:
+```css
+button, a, input, [role="button"] {
+  touch-action: manipulation;
+}
+```
+
+### E. Preventing iOS Auto-Zoom on Input Focus
+iOS Safari automatically zooms the page when an `<input>`, `<select>`, or `<textarea>` has a font-size below 16px.
+- Always set mobile input font size to at least `16px`:
+  ```css
+  input, select, textarea {
+    font-size: 16px; /* Prevents viewport zoom */
+  }
+  ```
+
+### F. Confining Overscroll on Sheets & Modals
+Prevent pull-to-refresh or background body rubber-banding when scrolling a modal sheet:
+```css
+.sheet-scroll-container {
+  overflow-y: auto;
+  overscroll-behavior-y: contain;
+  -webkit-overflow-scrolling: touch;
+}
+```
+
+### G. Preventing Accidental Text Selection on Rapid Taps
+Users double-tapping buttons or stepper controls should not trigger the blue native selection bubble:
+```css
+button, .clickable-badge, .nav-item {
+  user-select: none;
+  -webkit-user-select: none;
+}
+```
+
+---
+
+## 2. React Native & Expo Motion (Reanimated 3 & Gesture Handler)
+
+When building for React Native and Expo, all fluid interaction logic runs on the UI thread via Reanimated worklets.
+
+### A. The Core Rules of Reanimated
+1. **Never drive animations on the JS thread.** Use `useSharedValue` and `useAnimatedStyle`.
+2. **Worklets only**: Any function passed to gesture callbacks or `useAnimatedReaction` must run on the UI thread with the `'worklet';` directive.
+3. **Springs with physical damping**: Avoid duration-based bezier timing for touch gestures.
+
+### B. Pan Gesture with Velocity Handoff (Bottom Sheet Recipe)
+
+```tsx
+import { Gesture, GestureDetector } from 'react-native-gesture-handler';
+import Animated, {
+  useSharedValue,
+  useAnimatedStyle,
+  withSpring,
+  runOnJS,
+} from 'react-native-reanimated';
+
+export function BottomSheet({ onClose }: { onClose: () => void }) {
+  const translateY = useSharedValue(0);
+
+  const gesture = Gesture.Pan()
+    .onChange((event) => {
+      // 1:1 direct tracking downwards; damp upwards dragging
+      if (event.translationY > 0) {
+        translateY.value = event.translationY;
+      } else {
+        translateY.value = event.translationY * 0.2; // Rubber-band resistance
+      }
+    })
+    .onEnd((event) => {
+      // Velocity projection: if flicked down fast or dragged past 150px
+      const shouldClose = event.translationY > 150 || event.velocityY > 600;
+
+      if (shouldClose) {
+        translateY.value = withSpring(
+          600,
+          { velocity: event.velocityY, damping: 25, stiffness: 250 },
+          (finished) => {
+            if (finished) runOnJS(onClose)();
+          }
+        );
+      } else {
+        // Snap back to open position
+        translateY.value = withSpring(0, {
+          velocity: event.velocityY,
+          damping: 28,
+          stiffness: 300,
+        });
+      }
+    });
+
+  const animatedStyle = useAnimatedStyle(() => ({
+    transform: [{ translateY: translateY.value }],
+  }));
+
+  return (
+    <GestureDetector gesture={gesture}>
+      <Animated.View style={[styles.sheet, animatedStyle]}>
+        {/* Sheet content */}
+      </Animated.View>
+    </GestureDetector>
+  );
+}
+```
+
+### C. Layout Animations for Lists
+Use built-in layout transitions to smoothly animate item entry, deletion, and reordering without manual state coordination:
+
+```tsx
+import Animated, { FadeIn, FadeOut, LinearTransition } from 'react-native-reanimated';
+
+<Animated.View
+  entering={FadeIn.duration(200)}
+  exiting={FadeOut.duration(160)}
+  layout={LinearTransition.springify().damping(24).stiffness(280)}
+>
+  <ItemCard data={item} />
+</Animated.View>
+```
+
+### D. Haptics Integration
+Pair physical motion with tactile feedback (Expo Haptics / iOS Taptic Engine):
+- **Light Selection**: On picker wheel turn or tab bar change (`Haptics.selectionAsync()`).
+- **Impact Light**: On button release or toggle switch (`Haptics.impactAsync(Haptics.ImpactFeedbackStyle.Light)`).
+- **Notification Success**: On payment/task completion (`Haptics.notificationAsync(Haptics.NotificationFeedbackType.Success)`).
+- **Never trigger heavy haptics on high-frequency typing or scroll events.**
diff --git a/skills/impeccable/SKILL.md b/skills/impeccable/SKILL.md
index af5b37a..72cfb06 100644
--- a/skills/impeccable/SKILL.md
+++ b/skills/impeccable/SKILL.md
@@ -77,6 +77,7 @@ Routing:
 
 - **No argument:** read [routing.md](reference/routing.md) and present its context-aware menu; never auto-run a command.
 - **Explicit or clearly implied command:** load its reference (native variant on native platforms) and follow it. Ask once if two commands fit.
+- **Email design / HTML email:** (newsletters, campaigns, transactional receipts, digests, marketing broadcasts) load [reference/email.md](reference/email.md). Modern web CSS, Tailwind, div-based layouts, and web components break email clients. Strict email-safe tables (or React Email/MJML components if using an email framework), inline CSS, 6-digit hex, and bulletproof CTA rules apply.
 - **Otherwise:** treat the request as general design work. Missing PRODUCT.md routes a new surface or replacement world through init, then new-work; a narrow refinement of existing code proceeds on the incumbent implementation as context.mjs directs, offering init afterward rather than blocking on it.
 - `teach` aliases `init`. `craft` is a deprecated alias for ordinary new-work and adds nothing. `shape` owns task discovery, then enters new-work only for visual-world and surface-concept decisions.
 
diff --git a/skills/impeccable/reference/craft-floor.md b/skills/impeccable/reference/craft-floor.md
index 9653b98..ef84aab 100644
--- a/skills/impeccable/reference/craft-floor.md
+++ b/skills/impeccable/reference/craft-floor.md
@@ -40,5 +40,10 @@ Surface habits:
 - Unicode glyphs or emoji standing in for an icon system. Icons are drawn, from a real library or authored SVG, in one consistent stroke and weight.
 - Geometric masks standing in for organic contours. A circle, polygon, or radial-gradient cutout approximating a photographic subject's edge is the cheap version of the effect and reads worse than omitting it. Derive an alpha matte from the actual image, or produce a cut-out asset.
 - Light or dark picked by category. Pick it from the use scene: who, where, under what ambient light.
+- Tracking stops at -0.04em. -0.02 to -0.03em usually reads better.
+- Declare elevation once, border or shadow. A 1px border under a wide soft shadow is the ghost card. Card radii stay at 12–16px; pills are for small controls.
+- Real illustration or none. Sketch-style SVG scenes, `loose-sketch` / `doodle` class names, and `feTurbulence` grain read as amateur. This bans SVG imitating pictures, never SVG doing geometry: crisp vector shapes, diagrams, animated linework, and shader-driven effects remain first-class media. A shaded, perspectived, or figure-bearing illustration is a picture even in line-art style; geometry means shapes a session can specify exactly.
+- Backgrounds are surfaces, textured only from the subject's world. `repeating-linear-gradient` stripes and two-axis grid overlays need an actual canvas, map, blueprint, or measuring tool under them.
+- Claims and configuration come from supplied truth; label illustrative values honestly. Naming a concept and then ironizing it is not a claim.
 
 The floor holds the mechanics; it never picks the direction. With every check green, spend the page on the committed world, and when torn between refined and committed, commit.
diff --git a/skills/impeccable/reference/email.md b/skills/impeccable/reference/email.md
new file mode 100644
index 0000000..a6ca6a3
--- /dev/null
+++ b/skills/impeccable/reference/email.md
@@ -0,0 +1,182 @@
+# Email design and HTML email implementation
+
+Load this reference when the user wants to draft, compose, design, redesign, critique, or build an email: newsletters, promotional campaigns, welcome sequences, transactional receipts, password resets, onboarding digests, milestone celebrations, or win-back emails.
+
+Modern web CSS, Tailwind, div-based layouts, CSS Grid, Flexbox, and React/shadcn web components **actively break email clients**. Email clients render with outdated engines (Outlook on Windows still uses Microsoft Word's HTML/Word rendering engine; Gmail strips head styles in certain web views; iOS Mail and Outlook web rewrite color schemes).
+
+This guide unifies anti-slop visual design principles with bulletproof email client rendering.
+
+---
+
+## 1. Anti-slop email principles
+
+AI-generated email defaults to generic slop: wide empty white gaps, generic blue CTAs, interchangeable stock layouts, and lifeless footers. Replace those defaults with committed choices:
+
+1. **Own a color.** Pick one primary signature color for buttons, key borders, and accents that connects to brand identity. Never default to generic SaaS purple or blue unless that is the verified brand color.
+2. **Restrained palette.** Limit the email to 4 colors:
+   - 1 dominant brand accent (CTA, key emphasis)
+   - 1 neutral dark for body text (`#111827`, `#1e293b`; never harsh `#000000`)
+   - 1 neutral muted for labels/footer (`#64748b`, `#6b7280`)
+   - 1 canvas neutral (`#f8fafc`, `#ffffff`, `#f9fafb`)
+3. **Intentional imagery.** Sourced or clearly prompted image slots with defined aspect ratios and styled fallback text. Never place decorative AI stock graphics without purpose.
+4. **No orphan whitespace.** Avoid random 80px gaps between two-line sentences. Spacing must be rhythmic and structured (typically 16px, 24px, or 32px between sections).
+5. **Distinctive voice.** Tailor the rhythm of copy and visual layout to match the chosen archetype.
+
+---
+
+## 2. The Six Email Archetypes
+
+Commit to an archetype before drafting markup. Do not blend them into a mushy hybrid.
+
+| Archetype | Best for | Hallmarks | Typography | Key styling |
+| --- | --- | --- | --- | --- |
+| **Editorial** | Newsletters, essays, brand stories, long-form digests | Single column, generous leading, drop caps, bylines, reading rhythm | Serif headline (Georgia, Times New Roman), clean sans body | Warm paper canvas, subtle dividing rules, high copy density |
+| **Bold-mono** | Releases, tech announcements, changelogs, developer updates | High data density, structured key-value grids, commit logs, sharp borders | Monospace headers (Courier New, Consolas, Monaco), sans body | High contrast, 1px solid borders, pill badges, terminal aesthetic |
+| **Minimal-lux** | Luxury retail, architecture, portfolio, private invitations | Single photo focus, whisper borders, generous margins, restrained copy | Elegant serif or tracked geometric sans | Monochromatic base, muted brass or slate accent, quiet CTA |
+| **Founder letter** | Welcome, milestones, churn win-back, CEO updates | Plain-text feel, first-person narrative, short paragraphs (1-3 sentences) | Clean native sans (`system-ui`, Arial) | Zero template chrome, no hero image, simple hyperlinked text or quiet button |
+| **Punk / Character** | Drops, creator economy, music, streetwear, youth brands | High contrast, bold borders, asymmetrical card accents, irreverent copy | Heavy bold display sans, tight tracking | High saturation accents, thick borders (2px solid black), energetic tags |
+| **Lookbook** | Visual commerce, fashion, food, visual product releases | 80% photography, 20% copy, visual gallery grid, hero banner | Minimal discreet sans | Full-bleed hero image, 2-column image grid (stacks on mobile), minimal text overlays |
+
+---
+
+## 3. Strict Email Client Rules (Non-Negotiable)
+
+When generating email markup, web development instincts must be set aside:
+
+### A. Layout: Presentation Tables Only
+- **Zero `<div>` grid/column layouts, zero CSS Grid, zero Flexbox, zero `float`.**
+- For raw HTML emails, every layout container must be a `<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%">`.
+- `<div>` elements are strictly forbidden for layout columns, grids, or visual containers. However, `<div>` tags are explicitly permitted for hidden preheader text wrappers (`mso-hide:all; display:none;`) and progressive enhancement client hacks.
+- **Email framework exemption:** If the project uses modern email component frameworks such as **React Email** (`@react-email/components`), **JSX Email**, or **MJML**, write idiomatic framework components (`<Html>`, `<Head>`, `<Preview>`, `<Body>`, `<Container>`, `<Section>`, `<Column>`, `<Row>`, `<Text>`, `<Button>`, `<Img>`, `<Hr>`) instead of hand-crafting raw nested HTML tables. The framework compiler handles generating client-safe nested tables automatically. All visual principles (archetypes, color restraint, typography, spacing, 100 KB budget) remain mandatory.
+- Standard container width is **600px max**, centered:
+  ```html
+  <table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" bgcolor="#f8fafc" style="background-color: #f8fafc;">
+    <tr>
+      <td align="center" style="padding: 24px 16px;">
+        <!--[if mso]>
+        <table role="presentation" cellpadding="0" cellspacing="0" border="0" width="600" align="center">
+        <tr><td>
+        <![endif]-->
+        <table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="max-width: 600px; background-color: #ffffff; border-radius: 8px;" bgcolor="#ffffff">
+          <!-- Content rows -->
+        </table>
+        <!--[if mso]>
+        </td></tr>
+        </table>
+        <![endif]-->
+      </td>
+    </tr>
+  </table>
+  ```
+
+### B. Styling: Inline CSS
+- Apply inline `style="..."` attributes to every `<table>`, `<td>`, `<p>`, `<a>`, and `<span>`.
+- Embedded `<style>` blocks in `<head>` are allowed **only** for progressive enhancement:
+  - Media queries (`@media only screen and (max-width: 600px)`)
+  - Dark mode overrides (`@media (prefers-color-scheme: dark)`)
+  - Hover states for clients that support them
+
+### C. Color: Six-Digit Hex Only
+- Always write `#111827`, `#ffffff`, `#2563eb`.
+- **Forbidden:** 3-digit hex (`#fff`), `rgb()`, `rgba()`, `hsl()`, CSS custom properties (`var(--primary)`). Outlook and older Android clients completely drop properties with modern color notation.
+
+### D. Spacing: Cell Padding Only
+- Margin on `<p>`, `<div>`, and `<table>` is stripped or broken by Outlook.
+- Set all vertical and horizontal spacing via `padding` on `<td>` elements.
+- For vertical gaps between content blocks, use dedicated spacer rows:
+  ```html
+  <tr style="line-height:0;font-size:0;">
+    <td height="24" style="height:24px;line-height:24px;font-size:0;">&nbsp;</td>
+  </tr>
+  ```
+
+### E. Images: Explicit Dimensions and Styled Alt Text
+- Always declare `display: block; border: 0; outline: none; text-decoration: none;`.
+- Set explicit HTML attributes `width="..."` and `height="..."`, plus CSS `style="width: 100%; max-width: 560px; height: auto; display: block;"`.
+- Because Outlook and corporate webmail block images by default, provide styled alt text so the email remains legible:
+  ```html
+  <img src="https://example.com/hero.jpg" width="560" height="280" alt="New release overview" style="display:block; width:100%; max-width:560px; height:auto; border:0; outline:none; font-family:Arial, sans-serif; font-size:14px; color:#475569; background-color:#f1f5f9;">
+  ```
+
+### F. Bulletproof Button (CTA)
+Anchors (`<a>`) with padding fail in Outlook on Windows because Word engine strips vertical padding on inline elements. Use a padded table-cell button with Outlook VML fallback or spacer padding:
+
+```html
+<table role="presentation" cellpadding="0" cellspacing="0" border="0" align="center" style="margin: 0 auto;">
+  <tr>
+    <td align="center" bgcolor="#2563eb" style="border-radius: 6px; background-color: #2563eb;">
+      <a href="https://example.com/action" target="_blank" style="display: inline-block; padding: 14px 28px; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif; font-size: 15px; font-weight: 600; color: #ffffff; text-decoration: none; border-radius: 6px; mso-padding-alt: 0;">
+        <!--[if mso]>
+        <i style="letter-spacing: 28px; mso-font-width: -100%; mso-text-raise: 20pt;">&nbsp;</i>
+        <![endif]-->
+        <span style="mso-text-raise: 10pt;">Get Started Today &rarr;</span>
+        <!--[if mso]>
+        <i style="letter-spacing: 28px; mso-font-width: -100%;">&nbsp;</i>
+        <![endif]-->
+      </a>
+    </td>
+  </tr>
+</table>
+```
+
+### G. Preheader Text with Anti-Spill Padding
+Always place an invisible preheader right after `<body>`. Add zero-width non-joiners (`&#847;&zwnj;&nbsp;`) so that subsequent body copy or header navigation is not pulled into the client's inbox preview snippet:
+
+```html
+<div style="display:none;font-size:1px;color:#ffffff;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;mso-hide:all;">
+  Concise preheader snippet summarizing the email value proposition (80-100 chars).
+  &#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;&#847;&zwnj;&nbsp;
+</div>
+```
+
+### H. Dark Mode Support
+Support dark mode without breaking light mode:
+1. In `<head>`:
+   ```html
+   <meta name="color-scheme" content="light dark">
+   <meta name="supported-color-schemes" content="light dark">
+   <style>
+     :root { color-scheme: light dark; supported-color-schemes: light dark; }
+     @media (prefers-color-scheme: dark) {
+       .dark-bg { background-color: #0f172a !important; }
+       .dark-card { background-color: #1e293b !important; }
+       .dark-text { color: #f8fafc !important; }
+       .dark-muted { color: #94a3b8 !important; }
+       .dark-border { border-color: #334155 !important; }
+     }
+     [data-ogsc] .dark-bg { background-color: #0f172a !important; }
+     [data-ogsc] .dark-card { background-color: #1e293b !important; }
+     [data-ogsc] .dark-text { color: #f8fafc !important; }
+     [data-ogsc] .dark-muted { color: #94a3b8 !important; }
+   </style>
+   ```
+2. Transparent logos must have a subtle outer glow/stroke or live in a defined background box so they do not become invisible on inverted dark backgrounds.
+
+### I. Size Limit and Deliverability
+- **Keep total HTML file size under 100 KB.** Gmail clips emails at 102 KB, hiding content behind a `[Message clipped] View entire message` link and breaking unsubscribe tracking.
+- Every marketing/newsletter email **must** include a compliant footer:
+  - Organization legal name
+  - Valid physical postal address
+  - Clear, functional Unsubscribe link (`<a href="{{unsubscribe_url}}">Unsubscribe</a>`)
+  - Optional: Preferences link (`<a href="{{manage_preferences_url}}">Manage Preferences</a>`)
+
+### J. Plain-Text Twin
+Always accompany an HTML email with a clean, formatted plain-text alternative (`.txt`):
+- Maintain clean vertical spacing with blank lines.
+- Format links directly below CTA text or inline in brackets.
+- Retain the legal footer and unsubscribe link.
+
+---
+
+## 4. Verification Checklist Before Delivery
+
+Before delivering any email markup, verify every item:
+- [ ] Tested width: Max 600px, centers cleanly on desktop and scales to 100% on mobile.
+- [ ] No `div` containers for column layout (all table-cell based in raw HTML; React Email / MJML components if using an email framework).
+- [ ] All colors are 6-digit hex codes (`#xxxxxx`).
+- [ ] All spacing is on `<td>` padding or dedicated spacer rows (no `margin`).
+- [ ] CTA button uses table cell padding with Outlook VML/padding fix.
+- [ ] Preheader included with ZWNJ anti-spill characters.
+- [ ] All images have `display:block`, explicit width/height, and styled `alt` text.
+- [ ] Total HTML payload is strictly under 100 KB (no bloated inline base64 images).
+- [ ] Paired plain-text version provided.
diff --git a/skills/impeccable/reference/routing.md b/skills/impeccable/reference/routing.md
index 470a8bd..e0b9ae4 100644
--- a/skills/impeccable/reference/routing.md
+++ b/skills/impeccable/reference/routing.md
@@ -1,4 +1,18 @@
-# No-argument routing: the context-aware menu
+# Command guidance
+
+## Workflow questions
+
+Give advice without executing commands; the menu below is only for bare invocations. Consult relevant command references as needed for prerequisites and scope. If the user asks general design workflow or staging questions, answer directly; if the user also requests execution, follow that request.
+
+## Email and newsletter routing
+
+When the user asks to design, draft, code, critique, or polish an email, newsletter, transactional receipt, or broadcast:
+- Direct immediately to [email.md](email.md).
+- Do not attempt web UI components, flexbox, CSS Grid, or shadcn components.
+- Do not generate Tailwind or external CSS stylesheets.
+- Enforce the 6 email archetypes and strict client-safe table markup (or React Email/MJML framework components if configured).
+
+## No-argument routing: the context-aware menu
 
 Read this when the user invokes `/impeccable` with no argument. They are asking "what should I do?" Make the menu context-aware instead of static.
 
diff --git a/skills/impeccable/reference/ui-hub.md b/skills/impeccable/reference/ui-hub.md
index 98812d4..23b2187 100644
--- a/skills/impeccable/reference/ui-hub.md
+++ b/skills/impeccable/reference/ui-hub.md
@@ -6,6 +6,7 @@ Load this after the visual world is settled and before installing a catalog comp
 
 - `components.json` in cwd: search the hub.
 - React + Tailwind, no `components.json`: offer `npx shadcn@<pinned> init`. Do not run it silently.
+- HTML email templates, newsletters, or email marketing: do not call the hub; route to [email.md](email.md). Email clients do not support shadcn/web UI component libraries.
 - GrokBestFriend itself, backend, Python, or a non-UI tree: do not init and do not call the hub.
 - Context7 is documentation. Web search is not an installer.
 
diff --git a/tests/fixtures/codebase-memory-mcp b/tests/fixtures/codebase-memory-mcp
index cff381d..9ab0d09 100755
--- a/tests/fixtures/codebase-memory-mcp
+++ b/tests/fixtures/codebase-memory-mcp
@@ -1,2 +1,2 @@
 #!/bin/sh
-echo "codebase-memory-mcp 0.9.0"
+echo "codebase-memory-mcp 0.11.0"
diff --git a/tests/test_doctor.py b/tests/test_doctor.py
index f46e713..be3b199 100644
--- a/tests/test_doctor.py
+++ b/tests/test_doctor.py
@@ -57,13 +57,18 @@ def test_path_line_does_not_downgrade_connected(self):
 ●  ✓ context7 connected
 │      https://mcp.context7.com/mcp
 ●  ✓ shadcn connected
-│      npx -y shadcn@4.18.0 mcp
+│      npx -y shadcn@4.21.0 mcp
 """
         out = parse_mcp_list(text)
         self.assertEqual(out["codebase-memory-mcp"], "CONNECTED")
         self.assertEqual(out["context7"], "CONNECTED")
         self.assertEqual(out["shadcn"], "CONNECTED")
 
+    def test_shadcn_mcp_subcommand_probe(self):
+        text = "●  ✓ shadcn connected\n│      npx -y shadcn@4.21.0 mcp\n"
+        out = parse_mcp_list(text)
+        self.assertEqual(out["shadcn"], "CONNECTED")
+
 
 class AgentsBlockTests(unittest.TestCase):
     def test_owned_block_ignores_foreign_text(self):
diff --git a/tests/test_install.py b/tests/test_install.py
index b0ab44b..68bf55c 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -29,6 +29,7 @@
     cmd_ui_skills_disable,
     cmd_ui_skills_enable,
     cmd_uninstall,
+    download_codebase_memory,
 )
 from lib.doctor import cmd_doctor, cmd_skills_verify, isolation_check  # noqa: E402
 from lib.design_v2.bootstrap import BootstrapError  # noqa: E402
@@ -618,6 +619,46 @@ def test_install_quarantines_legacy_v1_plugin(self):
         self.assertTrue(qfile.is_file())
         self.assertTrue(user_plugin.is_file())
 
+    def test_cbm_pins_and_checksum_verification(self):
+        sources = jsonc.load_path(ROOT / "vendor" / "sources.json")["sources"]["codebase-memory"]
+        self.assertEqual(sources["version"], "0.11.0")
+        self.assertEqual(sources["artifactSha256"], "1f9e8293eb2bc5c05cfa27a7e8fc033da6d729ffad525ccfcdaa3fd606306683")
+        self.assertEqual(sources["innerBinarySha256"], "ce11c141431aeadd788506c3a7e6942db8fd438dec369d0707a39ec9fd8c6510")
+
+        with patch.dict(os.environ, {"OPENCODE_HE_TEST_CBM": ""}, clear=False):
+            os.environ.pop("OPENCODE_HE_TEST_CBM", None)
+            with patch("lib.install.urllib.request.urlretrieve"), \
+                 patch("lib.install.sha256_file", return_value="mismatched_archive_sha"), \
+                 self.assertRaises(SystemExit) as ctx:
+                download_codebase_memory()
+            self.assertEqual(ctx.exception.code, 1)
+
+    def test_cbm_inner_binary_checksum_verification(self):
+        with patch.dict(os.environ, {"OPENCODE_HE_TEST_CBM": ""}, clear=False):
+            os.environ.pop("OPENCODE_HE_TEST_CBM", None)
+            sources = jsonc.load_path(ROOT / "vendor" / "sources.json")["sources"]["codebase-memory"]
+            expected_archive_sha = sources["artifactSha256"]
+
+            import io
+            import tarfile
+
+            def fake_fetch(url, archive_path):
+                Path(archive_path).parent.mkdir(parents=True, exist_ok=True)
+                with tarfile.open(archive_path, "w:gz") as tf:
+                    content = b"fake-cbm-binary"
+                    ti = tarfile.TarInfo(name="codebase-memory-mcp")
+                    ti.size = len(content)
+                    ti.mode = 0o755
+                    tf.addfile(ti, io.BytesIO(content))
+
+            with patch("lib.install.urllib.request.urlretrieve", side_effect=fake_fetch), \
+                 patch("lib.install.sha256_file") as mock_sha, \
+                 self.assertRaises(SystemExit) as ctx:
+                mock_sha.side_effect = [expected_archive_sha, "mismatched_binary_sha"]
+                download_codebase_memory()
+            self.assertEqual(ctx.exception.code, 1)
+
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_license_audit.py b/tests/test_license_audit.py
index d574a38..114a158 100644
--- a/tests/test_license_audit.py
+++ b/tests/test_license_audit.py
@@ -38,6 +38,25 @@ def test_every_skill_is_audited(self):
         self.assertTrue(grok.is_file())
         self.assertIn("GrokBestFriend contributors", grok.read_text(encoding="utf-8"))
 
+    def test_sources_license_files_exist(self):
+        sources = json.loads((ROOT / "vendor" / "sources.json").read_text(encoding="utf-8"))["sources"]
+        pinned = []
+        for name, spec in sources.items():
+            rel = spec.get("licenseFile")
+            if not rel:
+                continue
+            path = ROOT / rel
+            self.assertTrue(path.is_file(), f"{name} licenseFile missing: {rel}")
+            text = path.read_text(encoding="utf-8")
+            self.assertGreater(len(text.strip()), 40, rel)
+            pinned.append(rel)
+        self.assertIn("vendor/licenses/IMPECCABLE-APACHE2.txt", pinned)
+        self.assertIn("vendor/licenses/EMILKOWALSKI-MIT.txt", pinned)
+        apache = (ROOT / "vendor/licenses/IMPECCABLE-APACHE2.txt").read_text(encoding="utf-8")
+        mit = (ROOT / "vendor/licenses/EMILKOWALSKI-MIT.txt").read_text(encoding="utf-8")
+        self.assertIn("Copyright 2025 Paul Bakaus", apache)
+        self.assertIn("Copyright (c) 2026 Emil Kowalski", mit)
+
     def test_provenance_version_matches_product(self):
         prov = json.loads((ROOT / "vendor" / "provenance.json").read_text(encoding="utf-8"))
         self.assertEqual(prov["productVersion"], product_version())
diff --git a/tests/test_v2_schema.py b/tests/test_v2_schema.py
index b243fa3..81130a1 100644
--- a/tests/test_v2_schema.py
+++ b/tests/test_v2_schema.py
@@ -23,6 +23,19 @@ def test_owned_mcp_is_v2(self):
             self.assertIn("disabled", entry)
             self.assertNotIn("enabled", entry)
 
+    def test_shadcn_mcp_invocation_and_pin(self):
+        spec = owned_mcp_spec(Path("/tmp/codebase-memory-mcp"))
+        self.assertIn("shadcn", spec)
+        shadcn = spec["shadcn"]
+        self.assertEqual(shadcn["type"], "local")
+        self.assertEqual(shadcn["command"], ["npx", "-y", "shadcn@4.21.0", "mcp"])
+        self.assertIn("mcp", shadcn["command"])
+        self.assertFalse(shadcn["disabled"])
+
+        sources = jsonc.load_path(ROOT / "vendor" / "sources.json")["sources"]["shadcn"]
+        self.assertEqual(sources["version"], "4.21.0")
+        self.assertEqual(sources["via"], "npx")
+
     def test_installer_rejects_opencode_1(self):
         prev = os.environ.get("OPENCODE_HE_MOCK_OPENCODE")
         with tempfile.TemporaryDirectory() as td:
diff --git a/vendor/licenses/EMILKOWALSKI-MIT.txt b/vendor/licenses/EMILKOWALSKI-MIT.txt
new file mode 100644
index 0000000..57b46f1
--- /dev/null
+++ b/vendor/licenses/EMILKOWALSKI-MIT.txt
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Emil Kowalski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/licenses/IMPECCABLE-APACHE2.txt b/vendor/licenses/IMPECCABLE-APACHE2.txt
new file mode 100644
index 0000000..bb3f6d2
--- /dev/null
+++ b/vendor/licenses/IMPECCABLE-APACHE2.txt
@@ -0,0 +1,191 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on
+      behalf of the copyright owner. For the purposes of this definition,
+      "submitted" means any form of electronic, verbal, or written
+      communication sent to the Licensor or its representatives, including
+      but not limited to communication on electronic mailing lists, source
+      code control systems, and issue tracking systems that are managed by,
+      or on behalf of, the Licensor for the purpose of discussing and
+      improving the Work, but excluding communication that is conspicuously
+      marked or otherwise designated in writing by the copyright owner as
+      "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2025 Paul Bakaus
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/mcp-policy.json b/vendor/mcp-policy.json
index f3598ea..18f4193 100644
--- a/vendor/mcp-policy.json
+++ b/vendor/mcp-policy.json
@@ -15,7 +15,7 @@
       "enabled": true,
       "transport": "stdio",
       "command": "npx",
-      "args": ["-y", "shadcn@4.18.0", "mcp"]
+      "args": ["-y", "shadcn@4.21.0", "mcp"]
     },
     "exa": {
       "enabled": false,
diff --git a/vendor/mcp-wanted.json b/vendor/mcp-wanted.json
index 4b19bbd..e245084 100644
--- a/vendor/mcp-wanted.json
+++ b/vendor/mcp-wanted.json
@@ -22,7 +22,7 @@
       "scope": "user",
       "transport": "stdio",
       "command": "npx",
-      "args": ["-y", "shadcn@4.18.0", "mcp"]
+      "args": ["-y", "shadcn@4.21.0", "mcp"]
     },
     "exa": {
       "wanted": false,
diff --git a/vendor/sources.json b/vendor/sources.json
index 2f1f5ab..cf51055 100644
--- a/vendor/sources.json
+++ b/vendor/sources.json
@@ -12,15 +12,16 @@
   "sources": {
     "codebase-memory": {
       "repository": "https://github.com/DeusData/codebase-memory-mcp",
-      "version": "0.9.0",
+      "version": "0.11.0",
       "platform": "linux-x86_64",
-      "artifactUrl": "https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.9.0/codebase-memory-mcp-linux-amd64-portable.tar.gz",
-      "artifactSha256": "8459d5c9d1457f2c82de3de307ffc7641ecbba2dde893427be1e62eca8ef9b25"
+      "artifactUrl": "https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.11.0/codebase-memory-mcp-linux-amd64-portable.tar.gz",
+      "artifactSha256": "1f9e8293eb2bc5c05cfa27a7e8fc033da6d729ffad525ccfcdaa3fd606306683",
+      "innerBinarySha256": "ce11c141431aeadd788506c3a7e6942db8fd438dec369d0707a39ec9fd8c6510"
     },
     "shadcn": {
       "repository": "https://github.com/shadcn-ui/ui",
       "package": "shadcn",
-      "version": "4.18.0",
+      "version": "4.21.0",
       "via": "npx",
       "engines": {
         "node": ">=20.18.1"
@@ -42,7 +43,7 @@
     },
     "serena": {
       "repository": "https://github.com/oraios/serena",
-      "version": "1.6.1",
+      "version": "1.7.0",
       "package": "serena-agent",
       "status": "optional-on-demand"
     },
@@ -54,6 +55,7 @@
     },
     "reticle": {
       "package": "@reticlehq/server",
+      "version": "3.1.0",
       "transport": "stdio",
       "via": "npx",
       "license": "FSL-1.1-ALv2",
@@ -68,8 +70,8 @@
     },
     "markitdown": {
       "repository": "https://github.com/microsoft/markitdown",
-      "version": "0.1.7",
-      "commit": "945314a45ddbe02935f2fd287b797dc0ba4a01e4",
+      "version": "0.1.8",
+      "commit": "b8f79c57ebc0044be41323d89b2a45d3fda8460e",
       "license": "MIT",
       "package": "markitdown-mcp",
       "via": "uvx",
@@ -79,13 +81,15 @@
     },
     "browser-act": {
       "repository": "https://github.com/browser-act/skills",
+      "commit": "11c057b03f92101642cadc9f840564574120d184",
       "version": "1.3.0",
       "package": "browser-act-cli",
-      "status": "optional-host"
+      "status": "optional-host",
+      "note": "Three supported execution modes (chrome, stealth-fresh, stealth-fixed). Never chrome-direct. Host CLI pinned 1.3.0."
     },
     "semgrep": {
       "package": "semgrep",
-      "version": "1.171.0",
+      "version": "1.177.0",
       "status": "optional-host"
     },
     "gitleaks": {
@@ -95,9 +99,59 @@
     },
     "osv-scanner": {
       "repository": "https://github.com/google/osv-scanner",
-      "version": "2.4.0",
+      "version": "2.6.0",
       "status": "optional-host"
     },
+    "impeccable": {
+      "repository": "https://github.com/pbakaus/impeccable",
+      "tag": "skill-v4.3.1",
+      "commit": "cd12f8660e2d",
+      "verifiedMainCommit": "e0881d2de397d5e9761d7b35ff5017d8f5ebf69b",
+      "license": "Apache-2.0",
+      "copyright": "Copyright 2025 Paul Bakaus",
+      "licenseFile": "vendor/licenses/IMPECCABLE-APACHE2.txt",
+      "note": "Adapted reference set with strict overlay gates (Design V2 atom shortlisting, taste-guard 4-tier, found-this-design world pin, BANK_MISS != generate, email design merge). No runtime plugin download."
+    },
+    "emil-design-eng": {
+      "repository": "https://github.com/emilkowalski/skills",
+      "commit": "85e8e2363b71",
+      "license": "MIT",
+      "copyright": "Copyright (c) 2026 Emil Kowalski",
+      "licenseFile": "vendor/licenses/EMILKOWALSKI-MIT.txt",
+      "note": "Emil Kowalski design engineering principles and motion doctrines merged into single specialist without catalog bloat (motion, apple-principles, native-motion, interface-feel)."
+    },
+    "email-design-sources": {
+      "sources": [
+        "https://github.com/CosmoBlk/email-design (commit c56bfe0, MIT)",
+        "https://github.com/jayesh-bansal/email-pro-max (commit 6a28b31, MIT)",
+        "https://github.com/chunkydotdev/email-skills (commit dca18fc, MIT)",
+        "https://github.com/Olshansk/agent-skills (commit d43745c, MIT)"
+      ],
+      "note": "Merged into skills/impeccable/reference/email.md; zero new allowlist names."
+    },
+    "axi": {
+      "repository": "https://github.com/kunchenguid/axi",
+      "commit": "85a8723276ca",
+      "license": "MIT",
+      "note": "Surfaces for gh-axi and chrome-devtools-axi under 4-door browser hierarchy."
+    },
+    "hyperframes": {
+      "repository": "https://github.com/heygen-com/hyperframes",
+      "commit": "ed75203cb6aa",
+      "version": "0.8.64",
+      "license": "Apache-2.0"
+    },
+    "diagram-design": {
+      "repository": "https://github.com/cathrynlavery/diagram-design",
+      "commit": "dc1ace47b99a",
+      "version": "2.6.33",
+      "license": "MIT"
+    },
+    "humanizer": {
+      "repository": "https://github.com/blader/humanizer",
+      "version": "3.0.0",
+      "license": "MIT"
+    },
     "matt-pocock-skills": {
       "repository": "https://github.com/mattpocock/skills",
       "commit": "9c9f36ccd3995266cd675468af71639c8dde1ec5",