Pup - the AI's own browser

@@ -12,6 +12,30 @@ The canonical source of truth for the pup bridge is **this wiki repo** on 2026-06-29 to be cloud-owned like the kicad/fusion bridges. Read `CLAUDE.md` (ownership boundary) and `PUBLISHING.md` (step-by-step recipe) in this repo alongside this skill. +## ⚖ OWN YOUR DOMAIN — the capability-vs-policy test (John's rule, and he should never have had to say it)++Before filing ANYTHING against adom-desktop, apply this test:++- **CAPABILITY** = a generic OS/native mechanism pup cannot perform itself (z-order set-to-back,+  window identity stamping with process-lifetime HICONs, taskbar overlay/flash, monitor+  enumeration). These belong in AD — generic, bridge-agnostic, useful to the next bridge too.+  Correct asks that followed this test: `state:'bottom'` + `force:true`, `desktop_flash_window`+  routing, `desktop_set_window_identity` / `desktop_register_app_identity`.+- **POLICY** = any DECISION about pup's own domain: which browser pup drives, when/whether to+  provision it, what its windows look like, when they show, what its hints say. These are NEVER+  AD's business — pup decides, pup implements, pup ships. AD's job ends at "the bridge is+  installed and its verbs are routed."++**The failure this section exists to prevent (2026-07-18):** pup asked AD to change its prewarm+DEFAULT (#204) — outsourcing the "when does pup's browser get provisioned" decision to AD policy —+when the skip-CfT logic was sitting in pup's OWN `warmup()` the whole time. One-line fix in pup,+zero AD involvement, issue withdrawn. The tell was needing AD to change a *default* rather than+add a *mechanism*. If your ask to AD contains the words "policy", "default", "prefer", or "decide",+STOP: that decision is pup's, and the code that should change is in this repo.++(The same test, run in reverse, is CLAUDE.md's existing rule: don't re-absorb AD capabilities into+pup. The two directions together: mechanisms live in AD, decisions live here.)+ ## The THREE artifacts — know which is which (this is the #1 confusion)  A user installs TWO different things from this one page. They are not the same: