docs(skills): follow the package-root and subpath icon rule

Ordinary plugins now show exported icons, and subpath plugins use
<subpath>/icon instead of a package.json. Update the display checklist
and nested-package gate cases to match.

packages/preset/agent-preset/skills/cordis-plugin-development/SKILL.md

@@ -21,9 +21,9 @@ A shipped bundle can resolve a plugin row and leave it `disabled`. The row id an
 
 1. Resolve the requested result and destination. An unspecified visual destination is the current Harness Web UI; a standalone image or HTML file does not complete such a request. Choose reasonable visual details and implement a small first version; install it before visual refinement.
 2. Discover only the APIs needed for that version: `cordis_inspect_list`, then targeted `cordis_inspect_query` calls. For UI, query Client `Slots.listSubTree` and the selected slot's registration options and props. For anything beyond a static decoration, such as tool policy, agent context, session-derived state, or Chat rows, read `references/practices.md` before choosing the extension point; for a user action in plugin UI, also read `references/user-actions.md`. Once the chosen slot and registration API are known, write the plugin.
-3. Read and copy the matching template files into one workspace directory, or author the package, patch, and required Host/Client files there. Before installing, complete the display checklist in `references/host-plugin.md`: meaningful localized titles/descriptions, an original or licensed bundle icon, and exported resources with distribution checks where applicable. This applies to Host-only and configuration-only bundles too; adapt template text and artwork to the request. Check JavaScript syntax and the manifest, then install. Use the installed plugin as the first preview; do not create preview HTML, mock shells, design variants, screenshot scripts, or rasterizer tooling first.
+3. Read and copy the matching template files into one workspace directory, or author the package, patch, and required Host/Client files there. Before installing, complete the display checklist in `references/host-plugin.md`: meaningful localized titles/descriptions, an original or licensed icon, and exported resources with distribution checks where applicable. This applies to Host-only and configuration-only bundles too; adapt template text and artwork to the request. Check JavaScript syntax and the manifest, then install. Use the installed plugin as the first preview; do not create preview HTML, mock shells, design variants, screenshot scripts, or rasterizer tooling first.
 4. Read the installation result: `application` and `warnings` decide whether the change is live, not logs, process lists, or the page's boot payload. Confirm new rows with approval-free `cordis_inspect_query`, not `list_plugins`. After `application: applied`, exercise the capability or inspect the live Client registration. Verify installed display metadata and the icon using `references/host-plugin.md`. Use the connected page when available; follow `references/verification.md` for page/panel design checks and unavailable browser control, and `references/user-actions.md` for user actions. Restore user state changed during testing. Report verification limits; installation and slot registration alone do not establish what the user sees.
-5. Fix observed defects in the same plugin. When the requested result works, finish with its location, verification status, and the reason for any display-resource exception; never silently accept default bundle artwork. Do not continue speculative variants, optional features, or mock previews. Close any task list.
+5. Fix observed defects in the same plugin. When the requested result works, finish with its location, verification status, and the reason for any display-resource exception; never silently accept default artwork. Do not continue speculative variants, optional features, or mock previews. Close any task list.
 
 ## Knowledge sources, in order
 
@@ -39,7 +39,7 @@ The files below live in this skill's base directory, which the `skill` tool repo
 
 | Task | File |
 |---|---|
-| Bundle manifest, locale resources, bundle icons, installation, Host exports and Config | `references/host-plugin.md` |
+| Bundle manifest, locale resources, icons, installation, Host exports and Config | `references/host-plugin.md` |
 | Web UI: Client manifest, module loader, slot registration | `references/ui-plugin.md` |
 | Connecting an MCP server through a configuration-only bundle | `references/mcp-bundle.md` |
 | Page/panel design checks and verification without browser control | `references/verification.md` |

packages/preset/agent-preset/skills/cordis-plugin-development/references/host-plugin.md

@@ -50,7 +50,7 @@ For example, the locale file contains:
 
 A package-root plugin may instead declare a top-level `icon` in `package.json`; it takes priority over `./icon` and is a path relative to the manifest directory. A subpath plugin such as `my-plugins/search` is not a package and never reads a `package.json`; it exports `./search/locale/*.json` and `./search/icon` instead. Icons may be SVG, PNG, JPEG, or WebP up to 256 KiB and must stay inside the package; absolute paths, URLs, and symlinks leaving it are rejected. Missing fields of a package-root plugin fall back to `package.json` `name` and `description`, and missing images use the panel's default artwork; malformed metadata produces a diagnostic and keeps the valid text.
 
-After installation, verify the intended title and description in bundle details and plugin rows, plus the bundle's rendered icon, in English and the user's locale where supplied. Check for metadata diagnostics and unintended fallbacks, and that each plugin row shows its own exported icon or, when it has none, the generic artwork. Without browser control, inspect the installed resources and report that rendered display remains unverified; do not claim visual success from installation alone.
+After installation, verify the intended title and description in bundle details and plugin rows, plus the rendered icons, in English and the user's locale where supplied. Check for metadata diagnostics and unintended fallbacks, and that each plugin row shows its own exported icon or, when it has none, the generic artwork. Without browser control, inspect the installed resources and report that rendered display remains unverified; do not claim visual success from installation alone.
 
 An existing plugin's metadata may remain unchanged when it still describes the requested result. A disposable test fixture or an explicitly requested metadata-free package may omit resources, but explain each omission in the delivery report. A Host-only or configuration-only bundle still has a visible inventory entry; neither is an exception by itself.
 

scripts/verify-package-meta.spec.ts

@@ -146,17 +146,17 @@ it('excludes tests, installed dependencies, and build output from metadata disco
 it.each([
   ['valid bundle', {}, 'Nested', undefined],
   ['manifest icon takes precedence', {
-    icon: './icon.svg', exports: { './package.json': './package.json', './locale/*.json': './locale/*.json', './icon': './missing.svg' },
+    icon: './icon.svg', exports: { './package.json': './package.json', './locale/*.json': './locale/*.json', './icon': './fallback.svg' },
   }, 'Nested', undefined],
   ['unpublished manifest icon', {
-    icon: './icon.svg', exports: { './package.json': './package.json', './locale/*.json': './locale/*.json', './icon': './missing.svg' }, files: ['locale'],
+    icon: './icon.svg', exports: { './package.json': './package.json', './locale/*.json': './locale/*.json', './icon': './fallback.svg' }, files: ['locale'],
   }, 'Nested', 'files must include icon.svg'],
   ['missing locale export', { exports: { './icon': './icon.svg' } }, 'Nested', 'exports must expose locale/en.json'],
   ['unpublished locale', { files: ['icon.svg'] }, 'Nested', 'files must include locale/en.json'],
   ['unpublished icon', { files: ['locale'] }, 'Nested', 'files must include icon.svg'],
-  ['missing icon target', { exports: { './locale/*.json': './locale/*.json', './icon': './missing.svg' } }, 'Nested', 'missing.svg'],
+  ['missing icon target', { exports: { './locale/*.json': './locale/*.json', './icon': './missing.svg' } }, 'Nested', 'exports["./icon"] must resolve to a file'],
   ['invalid display text', {}, false, 'meta.title must be a non-empty string'],
-  ['ordinary locale-only metadata', { dsh: undefined, exports: { './locale/*.json': './locale/*.json', './icon': './missing.svg' } }, 'Nested', undefined],
+  ['ordinary plugin with an exported icon', { dsh: undefined }, 'Nested', undefined],
 ] as const)('validates a named nested package independently: %s', (_label, fields, title, expected) => {
   manifest({ exports: { '.': './entry.js' }, files: ['examples'] })
   json('examples/nested/package.json', {
@@ -166,6 +166,7 @@ it.each([
   })
   json('examples/nested/locale/en.json', { meta: { title } })
   file('examples/nested/icon.svg', '<svg/>')
+  file('examples/nested/fallback.svg', '<svg/>')
   const problems = packageMetaProblems(root)
   if (expected === undefined) expect(problems).toEqual([])
   else expect(problems.join('\n')).toContain(expected)