Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/CREATING_SKINS.md`:
- Around line 37-55: Make the skin.json manifest example valid JSON by removing
all inline // comments from the fenced json block. Keep the manifest fields and
values unchanged so the example can be copied and parsed directly.
- Around line 78-81: Update the logo-loading guidance around ctx.load_logo and
render_live so render hooks never trigger network I/O or blocking downloads.
Require logos to be preloaded before rendering, or provide and document a
strictly cache-only helper for render-time use; remove the “auto-downloaded”
recommendation and preserve the existing cache_key guidance.

In `@docs/SKIN_SYSTEM.md`:
- Around line 24-31: Add the text language identifier to the fenced architecture
diagram in docs/SKIN_SYSTEM.md lines 24-31, the package-layout fence in
docs/SKIN_SYSTEM.md lines 100-107, and the directory-layout fence in
skins/README.md lines 6-11. Do not alter the contents of these diagrams.

In `@scripts/validate_skin.py`:
- Around line 97-102: Update parse_size to reject zero or negative width and
height, raising a clear argparse.ArgumentTypeError before the skin is loaded. In
the --options parsing/validation flow near build_context, require the decoded
JSON value to be an object/dictionary and return a clear argparse error for
arrays, strings, or other non-object values before dict(...) is called.
- Around line 191-195: Update the output reporting in the render flow around
ctx.canvas.save and the corresponding Vegas-render reporting at lines 204-206 so
paths outside PROJECT_ROOT are supported. Replace unconditional
Path.relative_to(PROJECT_ROOT) usage with a fallback that prints the original
output path when it is not repository-relative, while preserving
repository-relative formatting for paths inside PROJECT_ROOT and ensuring valid
renders are not reported as failures.

In `@skins/example-classic-baseball/skin.py`:
- Around line 21-27: Validate the accent_color option during ClassicBaseballSkin
instantiation rather than in _accent, requiring a three-channel RGB sequence
with valid channel values and rejecting malformed strings or lengths. On invalid
input, log a clear error and fall back to the default (255, 200, 0), while
preserving _accent’s use of the validated option at render time.

In `@src/base_classes/sports.py`:
- Around line 302-304: Update the card-render exception handler in the relevant
render method to increment the skin’s _skin_failures count before returning
None. Reuse the existing three-strike disablement logic and ensure these
exceptions follow the same session-level skin disabling behavior as other skin
failures.

In `@src/plugin_system/schema_manager.py`:
- Around line 389-406: Update the skin schema construction in the surrounding
schema-enhancement method to detect object-valued current_value and preserve
per-mode configurations via a oneOf schema. Support both the existing global
string selector and an object containing live, recent, and upcoming selectors,
while retaining the current global enum/default behavior for non-object values.

In `@src/plugin_system/store_manager.py`:
- Around line 2279-2284: Centralize safe skin-ID validation and path-containment
checks in the skin install/uninstall flow. In src/plugin_system/store_manager.py
lines 2279-2284, validate the registry ID before constructing the target and
require its resolved parent to equal the resolved skins directory; in lines
2346-2353, validate the manifest ID and reject registry/manifest mismatches; in
lines 2364-2369, apply the same validation before uninstalling. Fail fast on
invalid IDs or containment violations.
- Around line 2282-2285: Update the skin installation flow around target and
_safe_remove_directory to stage the replacement in a temporary sibling directory
before touching the existing installation. Perform download, manifest JSON
parsing, and API compatibility validation against the staged directory, then
atomically swap it into target only after validation succeeds. Preserve the
current installation on any failure and roll back the swap if replacement fails,
allowing non-critical installation errors to degrade gracefully.

In `@src/skin_system/fixtures/football_upcoming.json`:
- Around line 7-9: Update the upcoming fixture score data to use pregame values.
In src/skin_system/fixtures/football_upcoming.json at lines 7-9, retain the
upcoming state and reset both scores at lines 14-20 to "0"; make the same score
reset in src/skin_system/fixtures/hockey_upcoming.json at lines 14-20 while
retaining its upcoming state at lines 7-9.

In `@src/skin_system/skin_runtime.py`:
- Around line 94-117: Update the discovery cache logic in the skin discovery
function to include each existing skin.json manifest’s modification time in the
cache fingerprint, not only the skins directory mtime. Recompute and compare
this fingerprint before returning _discovery_cache entries so in-place manifest
updates trigger rediscovery while preserving cached results when neither
directories nor manifests changed.
- Around line 174-220: Update the sibling-loading flow around the alias check
and entry-point execution so cached namespaced modules are always rebound to
their sibling bare names before importing the entry point; do not skip alias
creation merely because _skin_<skin_id>_<sibling> already exists. Track each
bare-name binding that was replaced or added, then restore the original
sys.modules entries in the cleanup after entry import, while preserving cached
module reuse and existing failure cleanup.

---

Nitpick comments:
In `@scripts/validate_skin.py`:
- Around line 40-84: Add type annotations to FixtureHost.__init__, _load_fonts,
_load_and_resize_logo, and _draw_text_with_outline, covering every parameter and
return value. Use types consistent with the host interface consumed by
build_context(), including appropriate image, font, mapping, optional, and
drawing-context types.

In `@test/test_skin_system.py`:
- Around line 326-337: Replace the source-text inspection in
test_extractor_produces_guaranteed_keys with direct calls to representative
concrete sport extractor implementations, then assert every GUARANTEED_KEYS
entry exists in each returned mapping. Keep the test focused on the extractor
contract and validate each concrete component’s output independently rather than
inspecting SportsCore._extract_game_details_common source.

In `@web_interface/blueprints/api_v3.py`:
- Around line 5314-5318: Update the unfiltered branch in the endpoint around
plugin_id to call skin_runtime.discover_skins() without force_refresh=True,
preserving the existing skin_runtime.skins_for_plugin(plugin_id) behavior for
filtered requests.