Conciseness

The routing sections are dense and earn their tokens, but the appended 'Netlify house rules' section (~60 lines) restates the body nearly verbatim — the three-layer disambiguation, double-login footgun, no-API rule, internal-app single sign-in, Reviewer path, and who-can-change roles all appear twice. This fits the 3 anchor ('mostly efficient but includes some unnecessary explanation or could be tightened'); it doesn't reach 4 because the duplication is a whole padded section rather than minor instances.

Actionability

Fully executable guidance throughout: exact dashboard URLs with anchors ('https://app.netlify.com/projects/{site_name}/configuration/general/#project-visibility'), click-level menu sequences (Project configuration > General > Visitor access), a copy-paste-ready JS snippet that reads 'Netlify-Site-Protection-Expires-In' and reloads before expiry, plan-gated decision rules, and the Legacy → Credit-based mapping. Nothing is left as pseudocode or abstract direction.

Workflow Clarity

As a routing skill its single action is unambiguous and explicitly sequenced: 'First: disambiguate "auth"' with the checkpoint 'Identify which one is meant before recommending anything', then the decision guide mapping each request to a layer, then 'UI paths (the only path — no API)' with a failure protocol ('On failure, report what you tried and stop'). The simple-skill exception applies and no destructive/batch operations are involved, so no validation cap applies.

Progressive Disclosure

Structure is good: well-sectioned body, deep material (the combined Password-Protection + Identity pattern) correctly split into the one-level-deep, clearly signaled 'references/two-layer-pattern.md' (verified to exist), plus docs URLs for out-of-scope detail. It falls short of 5 because the inlined 'house rules' system section duplicates rather than delegates content — a minor organization gap rather than the cleanly split ideal.

Specificity

Multiple concrete actions are named — 'Picks the right Netlify site-protection layer', 'disambiguates the three unrelated "auth" concepts' with each layer identified (Netlify Identity, Password Protection / project visibility, dashboard SAML SSO) — plus explicit negative scope ('Not for wiring auth code — route app-login setup to netlify-identity'). Coverage is comprehensive with no vague filler, matching the 5 anchor and exceeding the 4 anchor's 'minor gaps'.

Completeness

What and when are both explicit: the what is 'Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts', followed by a concrete 'Use it when' list of setup triggers, symptom triggers, and an explicit exclusion ('Not for wiring auth code'). This matches the 5 anchor exactly and exceeds 4's 'when could be more explicit'.

Trigger Term Quality

Natural user phrasings are covered exhaustively: 'password-protect a site or Deploy Preview', 'make a project private/public', 'restrict a site to your team', 'invite users to a private project', and symptom language ('logged out mid-session', '401s after about an hour', 'token expiry/refresh'). The 4 anchor ('a few natural terms missing') doesn't apply — even symptom phrasing users actually report is included.

Distinctiveness Conflict Risk

Clear Netlify-specific niche with distinct triggers; the only sibling-skill overlap (netlify-identity, for app-user login) is explicitly fenced off with 'Not for wiring auth code — route app-login setup to netlify-identity'. The 4 anchor ('minor overlap risk') doesn't apply since the one real conflict is resolved by an explicit routing boundary.