diff --git a/.claude/skills/recipe-report/SKILL.md b/.claude/skills/recipe-report/SKILL.md
index 281af0b..73ba575 100644
--- a/.claude/skills/recipe-report/SKILL.md
+++ b/.claude/skills/recipe-report/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: recipe-report
-description: Generate the weekly public "Recipe Report" after the cc-ci /upgrade-all run. Reviews how the upgrade went and the state of every recipe + open PR, and publishes a self-contained HTML page to report.ci.commoninternet.net (one page per week + a home index). Page order: short lead → the full wire table (priority-sorted, CVE-count column, CVE recipes first) → Addendum of special issues → Security Bulletin → per-recipe "what changed". Read-only — reports, never merges or edits PRs. Runs as its own agent (model configured separately from the upgrader; default opus). Invoke as /recipe-report [YYYY-MM-DD].
+description: Generate the weekly public "Recipe Report" after the cc-ci /upgrade-all run. Reviews how the upgrade went and the state of every recipe + open PR, and publishes a self-contained HTML page to report.ci.commoninternet.net (one page per week + a home index). Page order: short lead → the full wire table (priority-sorted, CVE-count column, CVE recipes first) → Addendum of special issues → Security Bulletin → per-recipe "what changed". Read-only — reports, never merges or edits PRs. Runs as its own agent (model separately overridable via REPORT_BACKEND/REPORT_MODEL; defaults to the upgrader's backend+model, opencode-go/glm-5.2). Invoke as /recipe-report [YYYY-MM-DD].
 ---
 
 # recipe-report
@@ -14,6 +14,14 @@ tokens, internal IPs, or raw logs.
 
 Helper: `python3 /srv/cc-ci/cc-ci-plan/recipe-report.py {survey|render|publish}` (see its header).
 
+**Deterministic formatting — spec in, page out (NON-NEGOTIABLE).** ALL layout, CSS, and HTML is owned by
+`recipe-report.py`'s `render()`. Your ONLY output artifact is the **spec JSON** (data + editorial text).
+You **never** write, edit, post-process, or templatize HTML yourself; you never put markup/inline styles
+in spec text fields (they are HTML-escaped on purpose); the page is produced **solely** by
+`render <spec> <out>`. Same spec shape every week → a structurally identical page. If the layout itself
+must change, edit `recipe-report.py` (and `example-spec.json`) — never the generated page. This is what
+keeps every weekly edition looking the same regardless of which model writes the spec.
+
 ## Procedure
 
 1. **Pick the date.** `DATE` = the argument, else today (UTC). The `/upgrade-all` summary for that run is
@@ -69,10 +77,12 @@ Helper: `python3 /srv/cc-ci/cc-ci-plan/recipe-report.py {survey|render|publish}`
    example (operator-approved style/format/voice). **Match its editorial voice, field shapes, and level
    of specificity**, following the section order above. Read it before writing your spec.
 
-5. **Render & publish.**
+5. **Render & publish — via the script only; never hand-edit the HTML.**
    `python3 .../recipe-report.py render /tmp/report-spec.json /tmp/week-<DATE>.html`
    `python3 .../recipe-report.py publish /tmp/week-<DATE>.html <DATE>`
    (publish copies the page to `cc-ci:/var/lib/cc-ci-reports/` and regenerates the index.)
+   If `render` errors, **fix the spec JSON** (a malformed field) and re-run render — do NOT work around
+   it by writing HTML by hand. The rendered file is an artifact of the spec, never edited directly.
 
 6. **Verify & stop.** `curl -fsS https://report.ci.commoninternet.net/week-<DATE>.html` renders and the
    index lists it. Print the report URL and `RECIPE REPORT COMPLETE`, then go idle (one-shot — do not loop).
diff --git a/.claude/skills/upgrade-all/SKILL.md b/.claude/skills/upgrade-all/SKILL.md
index df56750..4016321 100644
--- a/.claude/skills/upgrade-all/SKILL.md
+++ b/.claude/skills/upgrade-all/SKILL.md
@@ -227,8 +227,8 @@ PR list** (the actionable output):
 End with the report path and a reminder that **nothing was merged**.
 
 ## 6. Launch the public Recipe Report
-Once the summary is written, kick off the weekly public report (its own agent, separate model — default
-opus): **`python3 /srv/cc-ci/cc-ci-plan/launch-report.py fresh`** (use `fresh`, not `start` — the report
+Once the summary is written, kick off the weekly public report (its own agent; model overridable via
+REPORT_BACKEND/REPORT_MODEL, defaults to opencode-go/glm-5.2): **`python3 /srv/cc-ci/cc-ci-plan/launch-report.py fresh`** (use `fresh`, not `start` — the report
 is a one-shot and must always run a NEW session for THIS week, even if a previous report session is
 still around). It runs `/recipe-report`, reviews this run + the live recipe/PR state, and publishes to
 https://report.ci.commoninternet.net. Fire-and-forget — it runs independently; you can then go idle.