Update to Stripo

SKILL.md text changes

− removed · + added

--- before
+++ after
@@ -1,40 +1,49 @@
 ---
 name: email-model-editor
-description: "Edit an existing Stripo email or template through its native JSON model. Use for document title and preheader, copy, link, image-source, AI image generation/editing, theme, style, and block additions, removals, or duplication when the email or template has an editor document state. Uses Stripo MCP image tools for requested visuals and a generated SDK mutation module, validated file-based execution, and durable read-back for model changes. Use email-from-reference for a new email or full rebuild. Do not use for raw-HTML editing, sending, scheduling, changes to name/project/folder, or content without a native model."
+description: "Edit an existing Stripo email/template through its native JSON model: document title and preheader, copy, links, images, AI image generation/editing, theme/style, and block additions, removals, or duplication. Uses validated SDK mutations, base/target merging and durable readback. Use email-from-reference for new emails/full rebuilds. Not for raw HTML, translation, sending/scheduling, external metadata (subject, sender, name, project or folder), or content without a native model."
 ---
 
 # Email Model Editor
 
-Host paths: in Claude Code `<skill-dir>` is `${CLAUDE_SKILL_DIR}` and `<bundle-root>` is
-`${CLAUDE_PLUGIN_ROOT}`. In Codex `<skill-dir>` is the directory of this `SKILL.md`. In both
-hosts `<bundle-root>` is two levels above `<skill-dir>`. Read `HOST.md` beside this file for
-the working directory and file-transfer commands before the first MCP call.
-
-Edit an existing Stripo email or template through its JSON model without flattening it to HTML.
-`PROVIDER.md` beside this file defines the Stripo MCP contract: reference and target resolution,
-model acquisition, image jobs, persistence, and verification. Follow it for every MCP
-step below; `<bundle-root>/mcp-tools.json` lists the tool names. The bundle contains no MCP
-endpoint or credential; use the Stripo MCP server and authorized file-transfer mechanism
-configured by the consuming agent.
-If the host installs `HOST.md` beside this file, read it for concrete file-transfer commands.
-The image workflow is supplied by `PROVIDER.md` and does not require a host image adapter.
-
-For an attached or Ctrl+V-pasted replacement image, follow [Upload supplied images](reference/image-upload.md)
-before editing the model. The host must supply the original bytes as a local file. Host that
-file with `prepare_image_upload`, the authorized HTTP transfer, and `upload_image`; use only
-the verified final `data.url`. Reacquire the target and check its current image source before
-replacement. Keep the original asset if hosting fails; do not regenerate a supplied image.
-
-When repairing a draft created from a reference, retain its chosen Exact, Tailored, or Creative
-regime and original PNG baseline. For Exact, preserve source choices, reuse existing assets or
-crops before considering AI generation, and compare the repaired PNGs with the original source.
-Do not reset the regime or adapt the branding during the repair.
-
-Validation runs the editor's own Document State rules bundled into the SDK. No schema download
-or initialization is required. `bundle.json.editorValidator` records the editor revision.
-`finish()` validates edits against the acquired input; create mode validates a new document.
-The service also validates its deployed revision and applies the write to its live state;
-local success does not establish persistence.
+Edit content, styles, and structure of an existing email without flattening the native model to
+HTML. Use `email-from-reference` for a new email or full rebuild.
+
+Reuse instructions already present, including a complete injected `SKILL.md` and shared topics
+across both email skills in the same provider/bundle. Reread missing, truncated or changed
+documents and reload on provider/version changes. All checks and remote-state freshness apply.
+
+Read [PROVIDER.md](PROVIDER.md) once before tool discovery for target resolution, metadata,
+transfers, images, persistence and verification. If installed, read `HOST.md` for bundle paths,
+transfer/attachment bindings, image viewing, permissions and delegated image operations.
+`mcp-tools.json` maps operation roles to advertised names; discover the selected server's actual
+schemas, not those logical keys. The bundle contains no endpoint or credentials.
+
+Use one agent by default and batch independent tool calls. For a newly acquired edit task, read
+the acquisition, mutation, persistence and [parallel work](reference/parallel-work.md) guides plus
+the provider's acquisition and persistence topics not already loaded, each in its own tool call.
+The parallel guide limits delegation to large independent subtasks or separate reviews. For a
+repair continuing creation, use the continuation below. Load conditional topics on demand,
+never the full tool/resource catalog.
+
+| Stage | Common guides read together; conditional topics when needed |
+| --- | --- |
+| Acquire | [Download and inspect the target](reference/acquire-and-inspect.md) before editing. |
+| Mutate | [SDK module, run, validation, completeness](reference/mutate-and-validate.md) before constructing the change. |
+| Conditional mutation | [Metadata, social, insertion, global block settings, theme resets and fonts](reference/mutation-options.md) when the request includes these operations. |
+| Text or colors | [Color consistency](reference/color-consistency.md) before changing text markup, colors, backgrounds, or inserting text. |
+| Editor limits | [Editor limitations](reference/editor-limitations.md) before changing text color, line height, or layout. |
+| Persist | [File upload, recovery, durable and visual checks, final presentation](reference/persist-and-verify.md) before writing. |
+| Attached or Ctrl+V image | [Upload supplied images](reference/image-upload.md) before hosting original bytes. |
+
+For an attached or Ctrl+V-pasted replacement image, the host must supply the original bytes as
+a local file. Host it before editing the model and use only the verified final `data.url`. Reacquire the
+target and check its current image source before replacement. Keep
+the original asset if hosting fails; do not regenerate a supplied image.
+
+## Continue after creation
+
+For a repair of the same saved draft, use [the continuation](reference/mutate-and-validate.md#continue-after-creation).
+Carry forward the latest readback and loaded contracts; keep all edit invariants and verification below.
 
 `<skill-dir>` is this installed skill directory. `<bundle-root>` is the directory containing the
 installed `skills/` and `packages/` directories.
@@ -45,365 +54,31 @@
   argument.
 - The candidate and base are complete models. Persistence applies the differences from the base
   to the candidate on top of the live state. Omitting an acquired optional key requests deletion,
-  not "unchanged" (see Model completeness). Never strip keys or upload a partial document; the runner
-  rejects a candidate that lost a key the acquired model had, except for supported explicit clears.
+  not "unchanged" (see [Model completeness](reference/mutate-and-validate.md#model-completeness)).
+  Never strip keys or upload a partial document; the runner rejects a candidate that lost a key
+  the acquired model had, except for supported explicit clears.
 - Express each request as a small JavaScript module that mutates the supplied `email` SDK handle.
-  Return nothing; the runner finishes its tracked session and rejects returned replacement documents.
-  Do not edit the raw JSON object or regenerate the full model.
+  Return nothing; the runner finishes its tracked session and rejects returned replacement
+  documents. Do not edit the raw JSON object or regenerate the full model.
 - Run the module with `run-sdk.mjs --input <model> --script <module> --output <candidate>`.
   Every edit receives the full SDK handle for content, style, insertion, removal, and duplication.
   The runner rejects scripts with no SDK mutations, selector misses, and schema-invalid output.
   A model without blocks permits metadata edits only; other edits must leave at least one block.
-- Keep the acquired model untouched as the baseline for the before/after comparison and as the
-  base file the write uploads next to the candidate.
+- Keep the acquired model byte-exact as the persistence base and retain its manifest and
+  concurrency token when supplied.
 - A successful local mutation is not completion. Verify the saved model and inspect fresh
-  desktop and mobile PNG previews of the persisted email.
-
-## 1. Acquire and inspect
-
-Resolve the target `(id, type)` as described in `PROVIDER.md` and call:
-
-```text
-get_document_state(id=<id>, type=<EMAIL|TEMPLATE>)
-```
-
-Require `status=OK` and download its temporary `downloadUrl` to a local JSON file through the
-host's authorized transfer path; that file, unmodified, is the base of the write.
-
-Inspect the model:
-
-```bash
-node <skill-dir>/scripts/inspect-editor-json.mjs \
-  --input <downloaded-model.json> \
-  --output <inspection.json>
-```
-
-If inspection reports no stripes or zero blocks, acquire and download again a bounded handful of
-times. Never upload a blockless model or fall back to editing compiled HTML. If no populated model
-becomes available, report a read failure and write nothing.
-
-Use the inspection report to identify node ids, message areas, block types, visible text, links,
-image sources, effective visibility, duplicate ids, and the before-edit census. Inspect relevant
-source nodes directly when exact content matters. IDs belong to this acquisition only.
-
-`moduleId` identifies a saved library module; it is different from a structural node `id`.
-The pinned editor contract makes `moduleId` read-only. Preserve it during ordinary content
-edits. Prefer a unique node id to address an edit; a `moduleId` selector also matches descendants,
-so constrain its node kind and check cardinality before changing content.
-
-## 2. Write the change module
-
-Create one task-local file such as `<workspace>/email-<id>.changes.mjs`. Export a function and
-mutate only the supplied `email` handle:
-
-```js
-export default ({ email }) => {
-  const logos = email.select({
-    nodeKind: "block",
-    type: "image",
-    inMessageArea: "header",
-  });
-  if (logos.length !== 1) {
-    throw new Error(`Expected one header logo, found ${logos.length}.`);
-  }
-  logos[0]
-    .setSrc("https://cdn.acme.example/logo.png")
-    .setAlt("Acme")
-    .setHref("https://acme.example/");
-};
-```
-
-For document title or preheader requests, use `email.setMetadata(patch)`:
-
-```js
-export default ({ email }) => {
-  email.setMetadata({
-    title: "Spring collection",
-    preheader: {text: "Discover what's new this season", fillSpace: true},
-  });
-};
-```
-
-Read current values from the inspection's `summary.metadata`. Include only the requested fields.
-When changing only the preheader text, carry over its current `fillSpace`; use `false` if no
-preheader exists. Both preheader fields must be supplied. `PROVIDER.md` defines the limits and
-clearing semantics. This method also works when the native model has no blocks. Return nothing
-from the module, including after a chained SDK call.
-
-Use `email.one(selector)` when exactly one match is required, or `email.block(id, type)` for
-a type-checked block. `within` restricts a selector to a subtree. Use `patchSettings(patch)`
-for supported settings; unknown keys, arbitrary collection arrays and `undefined` are errors.
-Use collection methods for social/menu items, `setSpacerMode` for spacer variants, and
-`resetSettings(paths)` for confirmed resets. A line spacer's `settings.mobileBorder` overrides
-its mobile line; `null` inherits `border`. `node.describe()` exposes the pinned contract.
-Each method is atomic. The synchronous module may also receive `transaction` and group
-related changes with `transaction(email => { ... })`; failure restores the whole group.
-All ten native block types are represented. Timer reads and unrelated supported edits are
-allowed, but preview-dependent changes and unsupported structural actions fail explicitly.
-
-Rules for the module:
-
-- Use the full `EmailDocument` API declared in
-  `<bundle-root>/packages/convo-email-agent/sdk/types.d.ts`: `email.byId`, `email.select`,
-  `email.first`, `email.theme`, node mutation methods, `remove()`, `repeat(totalCount)`, and
-  `insert(componentName, {after: handle})`. `repeat` takes the final total count including the
-  original. Use the handles returned by `repeat` for subsequent edits; the original IDs are
-  replaced. Insertion also accepts `{before: handle}`.
-- Check expected selector cardinality. When a request intentionally targets every match, require at
-  least one match before iterating.
-- Encode requested strings as JavaScript string literals; never evaluate customer text as code.
-- Do not import filesystem, process, network, or shell facilities. The edit function receives only
-  `{ email }`; the module's only job is to call SDK mutation methods.
-- Preserve unrelated content, links, merge tags, visibility, and compliance content unless they
-  are explicit targets. Make structural changes as needed to fulfill the user's request.
-- Prefer a theme edit for a broad change and a node edit for an exception. Render precedence is
-  inline HTML, block, container, structure, stripe, area theme, then general theme.
-- For a text block, responsive `textAlign` accepts `left`, `center`, `right`, or `justify`; font size
-  remains part of the semantic HTML passed to `node.setContent`.
-- For a social block, edit networks through `setSocialNetwork(typeOrIndex, {url, title, alt, icon})`,
-  `addSocialNetwork({type, url, title}, {after | before})`, `removeSocialNetwork(typeOrIndex)`, and
-  `setSocialShared({style, iconSize, spaceBetweenIcons, textCustomization})`; `setLink({url, network})`
-  changes one link. The editor's rules apply: known networks never carry `icon` (only `type: "custom"`
-  does), `alt` exists only while `textCustomization` is on (enable it with `setSocialShared` first;
-  turning it off removes every alt). Links support `http(s)://`, `#`, `mailto:`, `tel:`,
-  `ftp(s)://`, `sms:`, `tg://`, and `viber:`; a different non-empty, trimmed href uses the
-  editor's `other` type. A network `type` has to be one the editor ships an icon for, `title` is at
-  most 100 UTF-16 code units and `alt` at most 500 (`String.length`, so `😀` counts as two),
-  `iconSize` is an integer 16..64 and `spaceBetweenIcons`
-  an integer 0..40 per breakpoint. Social insertion, duplication and deletion are supported;
-  `moveSocialNetwork` reorders a network through the collection API.
-- Image sources must be email-safe hosted URLs already supplied or authorized by the user or
-  reused from the reference, or a completed hosted Stripo image-job result. For a requested
-  AI change, follow `PROVIDER.md` before writing the mutation module: `edit_image` changes the
-  current asset, while `generate_image` creates a new composition. Use the current target's
-  `(id, type)`; do not create another email. Inspect the completed image, then reacquire the
-  target model before constructing the SDK mutation. For a replacement, verify that the intended
-  image still exists with the expected source. Report a concurrent deletion or source change
-  instead of overwriting it. Use `setSrc()` and `setAlt()` as needed against that fresh model.
-  For an insertion, verify the intended container/anchor still exists and insert a native image
-  block with the completed URL through the component workflow below. Retain the fresh model
-  unmodified as the persistence base. Preserve unrelated links, layout, and settings.
-  A pending or failed image job is not a replacement; keep the original asset until ready.
-  Use the returned URL directly without reuploading or recompressing it, including during
-  document-write recovery. Image tool calls happen outside the SDK module.
-  Local attachments and crops use [Upload supplied images](reference/image-upload.md).
-  WebP inputs are supported by its image tools,
-  whose completed output is PNG; WebP, AVIF, and extensionless or otherwise unknown URLs are
-  not confirmed email-safe for direct insertion. Obtain a hosted PNG/JPG/JPEG/GIF before
-  applying an image change with an unsupported source; generation is not a lossless conversion.
-
-For insertion, define and export `components` in this same change module. Each named entry is
-`{node, slots, level?}` containing a complete native reference subtree; `level` is `L1` (stripe),
-`L2` (structure), or `atoms` (block). Give slots JSON pointers relative to that subtree and use
-`inserted.slot(role)` to address a block within an inserted section. Use `slots: []` when targeting
-the inserted block directly. The SDK assigns fresh IDs. Removal and duplication need no component
-definitions. For a block type absent from the reference, construct a schema-valid native component
-in the module using the reference styles.
-
-Block `settings` accept only the keys the editor schema lists for that block type. The model's
-top-level `settings` (`general`, `stripes`, `headings`, `buttons`) holds the defaults for every
-element of a type, and some of those keys have no block-level counterpart. Check the block
-definition before setting a key on a block. When the key is absent there, change the global
-setting instead and expect the change to apply to every element of that type in the email. A key
-the block schema does not list fails validation as `unsupported property`. For example, button
-`letterSpacing` and `textTransform` exist only in `settings.buttons`; the hover effect is the boolean
-`settings.buttons.hoverButtonStyles`, with its colors in `settings.buttons.lightTheme.hoverButtonStyles`.
-
-For example, a module can define and insert a text block:
-
-```js
-const zeroPadding = {top: 0, right: 0, bottom: 0, left: 0};
-export const components = {
-  "offer-text": {
-    node: {
-      id: "offer-text-source",
-      type: "text",
-      content: "<p>Offer details.</p>",
-      settings: {
-        backgroundColor: "transparent",
-        hideElement: "no",
-        includeInOutput: "both",
-        padding: {desktop: zeroPadding, mobile: zeroPadding},
-        rightToLeftTextDirection: false,
-      },
-    },
-    slots: [],
-  },
-};
-
-export default ({email}) => {
-  email.insert("offer-text", {after: email.byId("<anchor-block-id>")});
-};
-```
-
-## 3. Run the edit
-
-```bash
-node <skill-dir>/scripts/run-sdk.mjs \
-  --input <downloaded-model.json> \
-  --script <workspace>/email-<id>.changes.mjs \
-  --output <updated-model.json> \
-  --diagnostics <diagnostics.json>
-```
-
-Require exit code 0 and confirm:
-
-- `validation.valid` is true;
-- `sdkDiagnostics.mutationCount` is positive;
-- `sdkDiagnostics.selectorMisses` is empty;
-- `inputSummary` and `outputSummary` show the intended content, block types, and counts,
-  including any additions, removals, or duplication needed for the request.
-
-If the requested result already exists, call the supplied `skip(reason)` and return. The runner
-reports `skipped` and produces no uploadable output. A setter that silently changes nothing is an
-error. Keep the acquired model, inspection, module, candidate and diagnostics as task artifacts.
-On any preparation failure, the runner removes stale output. Diagnostics distinguish JSON,
-schema, capability, loss and optional runtime stages; inspect `diagnostics.error.issues`.
-Local contract validation is against the pinned revision. `--runtime-snapshot <file>` plus
-`STRIPO_RUNTIME_PATH` explicitly requests model preflight and fails if context is missing.
-Only a successful server set followed by get confirms persistence.
-
-Repair schema errors without removing intended content. Use `diagnostics.error.errors` and
-the untouched acquired model to repair the failing fields. Do not delete a logo or another
-intended block just to obtain a valid model; report an unresolved defect if repair cannot complete.
-
-## Model completeness
-
-`set_document_state` takes the whole document; with the acquired model uploaded as the base
-the editor applies the difference between it and the candidate to the live state.
-The editor diffs the uploaded JSON against the full acquired state. Settings are canonical and complete:
-every key of `general`, `stripes`, `headings`, and `buttons`, including their `lightTheme` and
-`darkTheme` branches, is required, so a missing settings key fails validation before upload. A
-stripe's `messageArea`, `includeInOutput`, `padding`, `stripeBackgroundColor`, and
-`contentBackgroundColor`, and a column's `settings.width`, must also stay present.
-
-An omitted `stripes`, `structures`, `columns`, or `blocks` array deletes every element it held.
-Timer blocks from the acquired model cannot be deleted, including through a parent
-`remove()` or `repeat()`. Social deletion is supported in the pinned merge-service profile.
-Therefore persist the complete candidate produced from the freshly acquired model. Clear ordinary
-values by setting their cleared value. The SDK can remove an image or social link with
-`setLink({url: ""})`, or discard `link.salesforce` when `setLink` changes a button's link from
-`salesforce_mc` to another type.
-Social `networks` is replaced as a complete list: replacing or reordering networks is supported,
-including multiple custom networks. Every resulting network still has to pass schema validation
-and the editor's icon, alt, and link rules.
-
-Colors live in the theme branches. Change a light color at its `lightTheme` path, for example
-`email.setTheme("settings.stripes.lightTheme.content.linkColor", "#2457d6")`, and set a dark-mode
-override at the matching `darkTheme` path, where `null` means no override. Switch the button hover
-effect with the boolean `settings.buttons.hoverButtonStyles`.
-
-For an intentional reset, write `undefined` or `null` to a nullable setting below. For example,
-`email.setTheme("settings.general.backgroundImage", undefined)` clears the email's background image,
-and `email.resetSettings(["general.customListStyles"])` disables custom list formatting.
-
-| Path | Settings that accept a reset (`null`) |
-| --- | --- |
-| `settings.general` | `backgroundImage`, `customListStyles` |
-| `settings.stripes.<area>` (`header`, `content`, `footer`, `infoArea`) | `paragraphBottomSpace` |
-| `settings.stripes.<area>` (`header`, `footer`) | `backgroundImage` |
-| `settings.headings.h1` through `settings.headings.h6` | `fontWeight`, `paragraphBottomSpace`, `fontSize.desktop`, `fontSize.mobile`, `lineHeight.desktop`, `lineHeight.mobile`, `textAlign.mobile` |
-| `settings.<section>.darkTheme` | every color |
-
-A nested patch works the same way: `email.setTheme("settings.general", {backgroundImage: undefined})`.
-Every other setting, including light-theme colors, global `fontFamily`, `general.hideImageDownloadIcons`, and
-whole groups such as `settings.stripes.content`, has no reset; set a new value instead. Do not strip
-fields from JSON manually. The runner still reports unintended loss for accidentally absent fields,
-unknown settings, and unsupported resets.
-
-## 4. Persist by file reference
-
-Preserve native font settings and resources; there is no font normalization step. Follow the
-prepare-upload/write flow in `PROVIDER.md`:
-
-```text
-prepare_document_state_upload(id=<id>, type=<type>)   # ticket for <updated-model.json>
-prepare_document_state_upload(id=<id>, type=<type>)   # ticket for <downloaded-model.json>
-set_document_state(id=<id>, type=<type>, uploadId=<first ticket>, baseUploadId=<second ticket>)
-```
-
-Between the calls, upload `<updated-model.json>` to the first `uploadUrl` and the untouched
-`<downloaded-model.json>` to the second, both through the consuming agent's authorized transfer
-mechanism. Never pass a model inline and never swap the two ids. With the base the editor writes
-only this edit on top of the live state and concurrent edits by others survive. Tickets are
-single-use and there is no hash or idempotency argument: keep the read-to-write gap short, and
-after an uncertain write read the state before retrying with fresh tickets. Follow the `status`
-contract in `PROVIDER.md`: a `MERGE_BROKEN` answer names the rejected fields in
-`details.errors[].path` (a dot path into `<updated-model.json>`); fix them in the change module,
-rerun the runner, and persist with two fresh tickets. `UPLOAD_NOT_FOUND` names the empty ticket in
-`missingUploadId`: a missing base has spent nothing, finish that upload and call again; a missing
-candidate has spent the base, so upload both files to fresh tickets. `REVISION_CONFLICT` or a
-`VALIDATION_ERROR` whose message says the delta is incompatible with the current document mean
-the letter moved, not that the edit is wrong: for `REVISION_CONFLICT` repeat the same write with
-fresh tickets; otherwise acquire again, rerun the same change module on the fresh model, and
-persist with the fresh model as the base. A deleted target can instead return `WRITE_UNCONFIRMED`:
-the result is unknown, so read back first. If the changes are already present, do not write again;
-if the intended node is missing, report the conflict without recreating it or retargeting the edit.
-Otherwise rerun the change module on the fresh model and use it as the base with fresh tickets.
-If readback fails, stop and report the failure. Use this same read-first procedure after a
-protocol or transport error. Use two fresh tickets for repairs after `INVALID_STATE`, `PARSE_ERROR`
-and `SIDE_EFFECT_UNAVAILABLE` as well. Never drop `baseUploadId` to force a write. Allow at
-most one repair retry before reporting the failure with the returned `code`, paths, and messages.
-
-## 5. Verify durable state
-
-Read both surfaces after persistence:
-
-```text
-get_document_state(id=<id>, type=<type>)
-get_screenshot(id=<id>, type=<type>, mode="BOTH")
-```
-
-Download the fresh model and both PNG artifacts through the authorized transfer path. Inspect
-the model for the exact requested values, link destinations, image URLs, alt text, merge tags, and
-preserved content. Compare its depth-agnostic per-type block census with the acquisition census.
-Structural node IDs may change between reads, so compare counts and types rather than those ids.
-Saved-library `moduleId` values are persistent identities and must still match. For an explicit
-module request, verify the requested ID and content on the final saved target; translated text,
-a matching module count, or a successful write receipt alone cannot establish replacement.
-After a structural edit, compare the census with the intended additions, removals, or duplication.
-The merged result may also contain concurrent edits. Whole-target equality or an unchanged
-block count is not required: verify the requested changes and investigate unexplained loss,
-while preserving unrelated live additions and edits.
-After a metadata edit, compare the fresh model's `metadata.title`, `metadata.preheader.text`, and
-`metadata.preheader.fillSpace` with the requested values and the preserved fields. Hidden metadata
-is verified from JSON; an unchanged screenshot is expected for a metadata-only edit.
-Because the write was applied as a delta, the fresh model may also carry edits other people made
-since the acquisition; those are not defects. Report a difference outside the requested change as
-a loss only when the acquisition had it, the current state lacks it, and nothing else explains it.
-
-Open and visually inspect both PNG files with the host's image-viewing tool. Check the requested
-visible changes, text readability, image loading, spacing, alignment, clipping, and responsive
-layout. A successful preview call or download alone is not visual verification. Screenshots do
-not prove link destinations, asset URLs, or hidden values; use the saved model for those checks.
-Compare against the untouched baseline and requested changes, not only the latest candidate.
-Check that branding remains, text and buttons retain effective side spacing, and heading scale
-works on mobile. Treat unrequested losses as defects, not as successful simplification.
-
-If either preview shows a defect, write a targeted repair for the same draft, persist it, then
-obtain and inspect fresh previews of both sizes again. Do not replay a successful structural edit
-as a verification step. Stop when the requested result passes review or a concrete limitation
-prevents repair. Report "saved, visual defects unresolved" with the defect if repair cannot
-complete; do not describe that email as ready to launch.
-Screenshots show the current coediting state with export settings, including unsaved changes; the
-fresh model read is the durable check. `PARTIAL` or unavailable previews mean "saved, visual
-verification incomplete" when the model checks pass.
-
-Do not rerun the change module for verification. Report full success only when persistence, model
-checks, and the required visual checks pass. If PNG generation, download, or inspection is unavailable or
-fails after a bounded retry, report "saved, visual verification incomplete" when persistence and
-model checks passed. Keep the same id for a later preview retry. Do not substitute an HTML
-export, inspect HTML as the visual check, or repeat a successful write to obtain a preview.
+  desktop and mobile PNG previews, except when `PROVIDER.md` defines preheader-only checks.
+  Then run the provider's final presentation step, when `PROVIDER.md` defines one.
 
 ## Boundaries
 
 - Do not create, clone, translate, send, schedule, activate, or delete an email.
-- Do not change name, project, or folder metadata; the Stripo MCP has no metadata write tool.
-  Report a requested change to those external fields as unsupported. Native document title and
-  preheader are supported through `email.setMetadata()` and `set_document_state`.
+- Change only requested native metadata. Preserve external sending and organization metadata;
+  `PROVIDER.md` defines supported fields and any separate route for explicitly requested changes.
+  Preheaders use `metadata.preheader`. A requested change is complete only when its saved value
+  is verified, including a fresh read confirming an already-correct value.
 - Do not use compiled HTML as the editable source of truth.
 - Do not mutate a message that has no native editor model.
-- Generate and edit requested visuals through the Stripo image workflow in `PROVIDER.md`.
-  Inspection-only requests must not start image jobs. Keep image-provider calls outside the SDK.
+- Use the image operations in `PROVIDER.md`; keep them outside the SDK module.
 - Do not infer MCP endpoints, credentials, or authentication.
 - Use `email-from-reference` for a new persisted email.