- discover <source>: open homepage → find login entry by visible text
  (fallback to common login paths) → click/open → detect main-frame vs
  iframe form (captcha/challenge iframes excluded) → enumerate fields →
  generate recipe (single-page / two-step / password-only) with
  remember-me checkbox ticking → write logins/<source>.json → optional
  live login verification (--no-login to skip)
- loggedOutText: login-state check by visible button/link text
  (regex), for sites whose login control has no stable class
- honest boundaries: CAPTCHA/OTP/perimeter protection exits with a
  clear human-required message and writes nothing (validated against
  wsj's DataDome layer); validated green path against nikkei Piano ID

- engine: step.frame executes fill/submit in the matching iframe's
  execution context (cross-origin auth widgets, e.g. Piano ID)
- engine: step.click {text} clicks a main-frame button by visible text
  (opens login modals); loggedOutSelector = logged-in when absent
- logins/nikkei-world.json: Piano two-step form (email -> password in
  auth.asia.nikkei.com iframe), validated with a real login

The only checkbox on join.asp is SaveID (remember email); extend the
tick pattern with save|. Session TTL on this site is short and there is
no keep-me-signed-in option, so preflight-before-harvest is the primary
mechanism; form login frequency stays at most once per harvest.

- submit button now resolved within the filled field's form first
  (document-wide query hit the header search form's identical
  button[type=submit] — clicked Search instead of Next)
- fill/checks/submit merged into one page-side step; checkbox ticking
  with label/name/id pattern filter (keep|remember|signed|记住)
- tab tracking by target id (open→use→close), immune to stale/concurrent
  same-site tabs; verification opens its own tab and closes it
- digitimes recipe: explicit Next button selector + keep-me-signed-in
  checkbox for long-lived session cookie

- check <source>: open checkUrl, assert loggedInSelector (exit 3 when
  logged out); login <source>: recipe-driven multi-step form flow with
  $USER/$PASS substitution from NH_LOGIN_* env, tab-relocation hardening
  against concurrent harvests, post-login verification
- recipes live in logins/<source>.json; ships digitimes-feed.json
- honors CDP_PORT_OVERRIDE / CDP_PROFILE_OVERRIDE (per-source instances)

Pair with CDP_PORT_OVERRIDE so parallel harvests can each drive a
dedicated Chromium instance (own port + own user-data-dir).

- pack.js: --pattern (articleUrlPattern) for direct sources; recipe no
  longer required (and forbidden) for --method direct, since a recipe
  forces the browser path at harvest time
- source-manage.js install: carry bundle articleUrlPattern into config
- fetcher-direct.js: decode HTML entities in title/img alt
- new wccftech-news direct bundle (server-rendered WordPress, no login,
  no Chromium); verified end-to-end via harvest --preview
- docs: SKILL.md, recipe-guide.md, source-management.md updated