@cueplusplus/ui 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,1088 @@
 # @cueplusplus/ui
 
+## 0.17.0
+
+### Minor Changes
+
+- a6afdd2: Graphite's round of the looks-fidelity work (spec §10.4, lane L5): ten more optional style names, and `band-y`'s rule admits a rem-plus-vw ramp.
+
+  **Ten optional names** join the style contract — `style-control-case` (a control's text-transform: `uppercase`, `none` or `capitalize`), `style-lede-ink` (a lede's ink apart from the prose ink), `style-band-title-size`, `-weight` and `-leading` (a band heading's own voice apart from the docs heading rung; the size scales with `--cue-font-scale` like every reading size), `style-subheading-leading`, `style-appbar-inset` (a proportion of `space-7`), `style-nav-active-ground` (the sidebar's active item, apart from a table's selected row), and `band-y-top` / `band-y-bottom` (the band rhythm's two halves, each falling back to `band-y` at its reader). Each is `initial` on the shared `[data-style]` reset, which grows from 99 lines to 109, and every set block is byte-identical apart from those ten lines. `console` declines all ten.
+
+  **`band-y`'s rule, widened once for it and both halves:** a `clamp()`'s middle term may now be a rem plus a vw expression (`3.8286rem + 6.8571vw`), the form a rung proportion already admits, as well as a bare vw term. The bounds are still `space-7` or a multiple of it, never `--cue-density`.
+
+  **The `graphite` style set, re-measured against agent-native.com** (spec §10.3–§10.4). Its reading measure is 53ch (the source's 633px lede column), its seam a 54% share of `--cue-border` in `srgb`, the share whose painted pixel lands inside ΔE00 3 of the source's subtle line in Chromium and WebKit (60% in `oklch` painted the light seam pink, and 55% painted #e0dedc in Chromium, 3.86), and its input face sans (the one field a visitor types into is sans). It now declares the round's type and control voice at the source's own pixels: a 46px/500/1.05 band title and display weight, a 32px/600 page title and 24px/600 heading at −0.02em, 18px (16px on a phone) card titles at 1.15, ledes at 16–18px in `fg-muted` with body prose in `fg`, 12px mono captions at 600 and 0.02em, 12px help, uppercase 600-weight buttons at 0.02em, a 2px focus offset, a `fg-subtle` outline edge, sans 15px/500 nav links that hover to `fg`, a transparent sidebar active ground at weight 500, dialogs on the page ground at a 12px corner, a 64px header with 40px (24px on a phone) of inline padding, and bands 160px above and 80px below (88/32 on a phone) through `band-y-top`/`band-y-bottom`. `band-y` itself is unchanged, so a `Footer` stays symmetric.
+
+  **The `bevel` paint pack draws one flat ink per surface kind** (F-19): recessed controls and cards are edged in `border-overlay` at both ends of the stroke, overlays in `border`, where it used to spend a 140° gradient on every surface. Its glass is `bg` at 90% in `srgb` (exactly the page colour), and its overlay shadow is the chassis stop at twice its geometry with a −12px spread, cast in 25% of the theme's `shade` role (F-24) — black under `theme-graphite`, which authors `shade: #000000`; under a theme that authors no `shade`, 25% of `fg`, where it used to be black at 40%. A consumer choosing `bevel` for its gradient now gets a flat edge.
+
+  These names are read by the `@cueplusplus/ui` components of the same release: `Button` takes its case from `style-control-case`, `PageShell`'s subtitle its ink from `style-lede-ink`, `AppBar` its inline padding from `style-appbar-inset` (40px, 24px on a phone, under `graphite`; `space-5` under every other set), the `Sidebar`'s active item its ground from `style-nav-active-ground` (transparent under `graphite`, so the item shows by its ink and weight alone; the selected ground under every other set), and `Band` its top and bottom padding from `band-y-top` and `band-y-bottom` (`Footer` keeps `band-y`); the band title and subheading leading are read by the docs site's own headings. Paired with an older `@cueplusplus/ui`, the graphite set's values for them are declared and inert. `@cueplusplus/ui`'s component manifest (`manifest/tokens.json`) lists the ten names beside the rest of the style vocabulary.
+
+- d205951: The looks-fidelity round's four contract PRs (P0.4–P0.7): a theme may now author four derived colour roles, the style axis gains 95 optional names, the paint axis gains a scrim filter and three more inks, and a theme's density override is gated for monotonicity.
+
+  **Four derived colour roles a theme may author per mode (spec §3.9).** `accent-fill`, `accent-fill-fg` and `accent-fill-hover` let a theme give its primary button a fill distinct from `accent` itself (unauthored, each still resolves to its `accent`/`accent-fg`/`accent-hover` anchor); `shade` gives a theme a shadow ink independent of `fg`. `Button`'s primary tone now reads `bg-accent-fill text-accent-fill-fg hover:bg-accent-fill-hover` — a no-op everywhere, since none of the fifteen shipped presets authors the trio. `accent-fill-fg/accent-fill` is a new required contrast pair (4.5:1); `accent-fill/bg` is advisory (3:1). Four presets — `theme-hivehub`, `theme-luma`, `theme-signal`, `theme-venu` — already waive `accent-fg/accent` and now waive the identical, unauthored `accent-fill-fg/accent-fill` failure beside it, at the same ratio.
+
+  **The style axis's contract, round 2 (spec §3.0–§3.11): 95 more optional names**, covering display/title/heading voice, body/prose/label/eyebrow/chip/kbd voice, control/focus/link voice, navigation/selection/tab/menu voice, and surface proportions. Every one is optional and every one is declined by all eight shipped style sets today — no rendered change. The shared `[data-style]` reset now emits `initial` for all 99 optional names once, ahead of every specific `[data-style="x"]` block, replacing the per-block restatement each set used to carry; a set's own block now declares only what it authors.
+
+  **The paint axis, round 2 (spec §3.10): five more names on every pack.** `paint-scrim-filter` (a modal scrim's own backdrop-filter, distinct from `paint-glass-filter`), `paint-rest-shade` (a resting-surface shadow fragment, `system/_paint-rest-shade.ts`), `paint-stroke-overlay-from`/`-to` (an overlay's own stroke ink, read by `_paint-stroke-surface-2.ts` in place of the shared `paint-stroke-from`/`-to`), and `paint-danger-glow-ink` (the danger button's own glow, `GLOW_DANGER_CLASSES`). All ten packs declare all five; nine of them restate their own existing stroke pair for the new overlay ink (no rendered change). **`none` is the one deliberate change (F-10):** its overlay stroke pair is now `var(--cue-border-overlay)`, closing a gap where an overlay's edge under `none` differed from what a page with no pack at all draws — on the docs site, a Classic overlay's edge now reads `border-overlay` instead of `border`. The overlay's fill layer also gains `style-overlay-ground` as a reader (spec §3.11), falling back to the existing `--cue-surface-2`. **`paint-scrim-filter` lives on a `::before` pseudo-element of the scrim, never on the scrim's own `backdrop-filter`:** every overlay's `backdropClassName` prop feeds a consumer's own backdrop utility onto that same element, and a raw `backdrop-filter` declaration there made a consumer's `backdropClassName="backdrop-blur-sm"` compute `none` instead of a blur — a regression this release did not ship with, caught before publish.
+
+  **Density override gates (spec §4.2, F-7, F-8).** A theme's `densities.overrides` may now retune only `control-sm`/`-md`/`-lg`, `text-ui`, `text-body` and `radius-control`/`-surface`/`-overlay` — never `chrome-toolbar`, `text-label` or `space-*` — and must cover all five rungs, monotonically (strictly increasing, a constant `0` radius excepted) at both 390px and 1440px, with `control-sm <= control-md <= control-lg` holding within each rung. This is stricter than before: a single-rung override, or one of a token outside that list, built without complaint and now refuses at `buildTheme`. `@cueplusplus/theme-tools` exports `deriveRungs(normal, token)`, which derives the other four rungs' values from a theme's own `normal` value and the base ladder's own ratios, and a theme that overrides `control-sm`/`-md`/`-lg` at `ultra-compact` now gets its own coarse-pointer re-raise (`max(<the base compact floor>, <the theme's own value>)`) instead of falling back to the base ladder's. The re-raise is written under the same selectors as the theme's own `ultra-compact` rule, including the ones that reach an island still carrying `data-cue-follows` before it mounts, so under a coarse pointer such an island is held to the same floor as the settled one.
+
+  **`@cueplusplus/theme-base`'s `validateManifest` gained a real shape check on every geometry value (spec §4.2, F-8), where it previously accepted any non-empty string.** A value now has to be a unitless number, a `rem`/`px` length, the font-scale `calc()` a text rung carries, or a `clamp()`/`min()`/`max()` of `rem`/`px`/`vw` terms (plain, or wrapped in that same `calc()` for a `text-ui`/`text-body` override, per spec §4.3) — this is what makes the Zine and Porcelain Looks' clamp-shaped text rungs admissible at all. It also means a hand-written or foreign manifest (one built by something other than `@cueplusplus/theme-tools`) carrying a geometry value outside this shape — `0.625em`, `calc(1rem + 2px)` — now fails `validateManifest`, and `ThemeProvider` throws on it in development where it previously did not. No first- or third-party manifest this repository builds authors such a value.
+
+  None of the fifteen shipped theme packages (`cue`, `dusk`, `graphite`, `hivehub`, `kiln`, `luma`, `porcelain`, `quotamate`, `requestport`, `signal`, `snuffle`, `tender`, `terminal`, `venu`, `zine`) authors any of the new derived roles, style names or paint names, or overrides a density, so every one is unchanged but for the four derived-colour lines every `theme.css` block now carries.
+
+  **`@cueplusplus/studio-mcp`: a studio document may set the four derived colour roles.** The catalogue a document is validated against is the published `/r/tokens.json`, whose colour list is 48 names now (44 before `accent-fill`, `accent-fill-fg`, `accent-fill-hover` and `shade`).
+
+- 7884cb4: The type voice reads the style set: a page title, a card, panel, bento or overlay title, body
+  copy, figures and field help text can each be restyled by a Look without a class at the call
+  site.
+
+  Every one of these sites now reads an optional `--cue-style-*` name through a `var()` whose
+  fallback is exactly what it rendered before. No shipped set (`console`, `editorial`,
+  `marketing`, `graphite`, `tender`, `zine`, `kiln`, `porcelain`) declares any of these 21 names
+  yet, and a set that does not declare one leaves its readers on their fallbacks, so the new names
+  change nothing under no style set or under any shipped set.
+
+  One change is visible under three shipped sets, and it is intended: **`FieldDescription` and
+  `FieldError` now take their label's face.** They read `--cue-style-label-face` like
+  `FieldLabel` above them, and that is a name every set declares. Under `tender`, `kiln` and
+  `porcelain` it is `var(--cue-font-sans)`, so a field's help text and its error move from mono to
+  the Look's sans, matching the label. Under no set and under `console`, `editorial`, `marketing`,
+  `graphite` and `zine` they stay mono.
+
+  - **`PageShell`'s title** reads `--cue-style-page-title-face`, `-size`, `-weight`, `-tracking`
+    and `-leading` (mono, `--cue-text-title`, 500, `normal`, inherited), plus
+    `--cue-style-display-variation` (`normal`) and `--cue-style-heading-ink` (`fg`).
+  - **`CardTitle`, `PanelHeader`'s title and `Bento.Tile`'s title** read the title voice:
+    `--cue-style-title-face`, `-size`, `-weight`, `-tracking` and `-leading` (mono,
+    `--cue-text-emphasis`, 500, `normal`, inherited), the variation and the heading ink.
+  - **`overlayTitleClasses`** (Dialog, AlertDialog, Drawer, Sheet and Popover titles) reads the
+    title face, weight, variation and heading ink at its own `--cue-style-overlay-title-size`
+    (`--cue-text-emphasis`).
+  - **`CardDescription`, `overlayTextClasses`, `overlayDescriptionClasses` and `PageShell`'s
+    subtitle** read `--cue-style-body-face` (mono) and `--cue-style-body-weight` (inherited). The
+    subtitle is a lede: it also reads `--cue-style-lede-size` (`--cue-text-ui`) and its ink as
+    `var(--cue-style-lede-ink, var(--cue-style-prose-ink, var(--cue-fg-muted)))`.
+  - **`Stat`'s value and detail, `Table`, `Row` (`rowVariants`), `Bento.Tile`'s eyebrow and
+    `SectionHeader`'s count** read `--cue-style-data-face` (mono). `tabular-nums` stays.
+  - **`FieldDescription` and `FieldError`** wear the label face (`--cue-style-label-face`: mono by
+    default, the sans under `tender`, `kiln` and `porcelain`, as above) and read
+    `--cue-style-help-size` (`--cue-text-micro`); the description's ink reads
+    `--cue-style-help-ink` (`fg-subtle`), and the error keeps `danger`.
+  - **The recessed control chassis** (`controlSurface`, `bareControlClasses`) reads
+    `--cue-style-body-weight` (inherited).
+
+  The public class constants `overlayTitleClasses`, `overlayTextClasses`,
+  `overlayDescriptionClasses`, `controlSurface`, `bareControlClasses` and `rowVariants` change
+  their strings accordingly. `className` still overrides as before: the weight readers are written
+  `font-[number:…]`, so a caller's `font-bold` or `font-semibold` replaces them through `cn()` as it
+  replaced `font-medium`.
+
+- 5d75ae7: Captions, the eyebrow, chips and key caps read the style set's round-2 names (spec
+  2026-09-26-looks-fidelity §3.6, lane R2) — fifteen optional names, each falling back to exactly
+  what its reader rendered before. No shipped set declares any of the fifteen, so they move nothing
+  yet. What does move under shipped sets is a handful of readers that now read a face, case or
+  tracking name those sets already declare:
+
+  - **Under `tender`, `kiln` and `porcelain`** (a sans label face, no label case, `normal` label
+    tracking): a chip's face and case (sans, sentence case — F-15 below); the face of `StatusBar`,
+    its interactive items included, of `Table.Caption` and of the `Progress` header (sans); and the
+    `Progress` label's case (sentence case) and, under `tender` and `kiln`, its tracking (`normal`
+    in place of their caps rung; `porcelain`'s caps rung is already `normal`).
+  - **Under `tender`, `kiln`, `porcelain` and `zine`** (a sans control face): `Kbd`'s face (F-16
+    below).
+
+  Under no set, `console`, `graphite`, `editorial` and `marketing`, nothing renders differently —
+  except a `Table.GroupRow` given a weight in its `className`, whose name now takes it (below).
+
+  - **Label size, ink and weight.** `FieldLabel`, a `SectionHeader` label, a table head and group
+    row, a `Sidebar.Section` label, a `Stat` label and a menu group label read
+    `--cue-style-label-size`, `-ink` and `-weight`; the `Checkbox` and `Switch` labels read the ink
+    and the weight. Each keeps its own fallback: the label rung (the micro rung for `Stat`),
+    `fg-muted` or `fg-subtle`, and the inherited weight (`400` on a table head, whose `<th>` is bold
+    in the user-agent sheet). A caller's `className="font-medium"` still wins, as it did over
+    `font-normal`. A `Table.GroupRow`'s name now inherits its cell's weight instead of pinning
+    `font-normal`, so a set's label weight moves the whole row, and a weight in the row's
+    `className` (which lands on the cell) now reaches the name as well as the count.
+  - **The eyebrow** reads `--cue-style-eyebrow-face`, `-size`, `-ink` and `-weight`, falling back
+    through the label names to mono, the label rung, the accent and the inherited weight; and
+    `--cue-style-eyebrow-glyph: none` drops the `//` slashes (`inline` by default).
+    `slashes={false}` still removes them from the markup under any set.
+  - **Chips read the label face** (`--cue-style-label-face`) and **their case through
+    `--cue-style-chip-case`**, which falls back to the label case. This reverses the earlier "a
+    tag's text is the value being shown" ruling (F-15): under a sans, sentence-case Look a chip is
+    now sans and sentence case like the captions around it. Under no set and under `console`,
+    `editorial`, `marketing`, `graphite` and `zine` it is still mono and uppercase; pass
+    `className="font-mono uppercase"` to keep a chip mono under every set. Its tracking, size and
+    radius read `--cue-style-chip-tracking`, `-size` and `-radius`, and each tone's fill and rim are
+    a share a set can move: `color-mix(in oklab, var(--cue-<tone>) var(--cue-style-chip-fill, 10%),
+transparent)` and the same at `--cue-style-chip-edge, 35%` — exactly `bg-<tone>/10` and
+    `border-<tone>/35` by default. `neutral` keeps its own inks.
+  - **`Kbd` wears the control face** (`--cue-style-control-face`, mono by default) rather than a
+    fixed mono (F-16) — so it is sans wherever controls are: under `tender`, `kiln`, `porcelain` and
+    `zine` — and reads `--cue-style-kbd-edge` for its rim, the chip's
+    `--cue-style-chip-size` and `--cue-style-label-weight`.
+  - **`StatusBar`, `Table.Caption` and the `Progress` header** read the label face, and the
+    `Progress` label the label case and tracking, instead of a fixed `font-mono`, `uppercase` and
+    caps tracking. An interactive `StatusBar.Item`, a `<button>` that restates the bar's face
+    because form controls inherit no type, restates the label face too, so one bar never mixes two
+    faces.
+
+  The shadcn registry's `@cue/eyebrow` ships the new label and eyebrow modules and `@cue/chip`
+  ships `_style-chip.ts`; `@cue/chip` now depends on `@cue/eyebrow`, which owns the label modules
+  it imports.
+
+- 5d75ae7: Navigation, selection, segments, tabs, menus and section rules take their voice from the style
+  set, so a Look can restyle a header, a sidebar, a tab strip or a menu without a class at every
+  call site. Every reader falls back to exactly the class it replaced, and no shipped style set
+  declares any of the new names yet, so nothing renders differently under no style set, and under
+  the shipped sets one thing does: **`Footer`'s fine print** (`meta`) is now set in the label face
+  rather than always in mono, so under `tender`, `kiln` and `porcelain`, whose label face is sans,
+  it is sans; under every other set it is mono as before.
+
+  - **`AppBar`.** The bar reads `--cue-style-appbar-height`, `--cue-style-chrome-rule` (its bottom
+    rule's ink) and `--cue-style-appbar-inset` (its inline padding). `AppBar.Link` reads the
+    navigation voice — `--cue-style-nav-face`, `-case`, `-tracking`, `-size` and `-weight`, falling
+    back to mono at the UI size — plus `--cue-style-nav-pad`, `--cue-style-nav-hover-ground`,
+    `--cue-style-hover-ink`, and `--cue-style-quiet-ink` for the `muted` register.
+  - **`Footer`** sets its column in the same navigation voice, reads `--cue-style-footer-rule` for
+    its top rule's width and `--cue-style-section-rule` for the rule over its fine print, which is
+    set in the label face. **`SectionHeader`**'s hairline reads `--cue-style-section-rule`.
+  - **`Sidebar.Item`** reads `--cue-style-nav-ink` at rest; the current page reads
+    `--cue-style-nav-active-ground`, then `--cue-style-selected-ground`, for its ground, and
+    `--cue-style-selected-ink` and `--cue-style-selected-weight`. A selected **`Table.Row`** reads
+    `--cue-style-selected-ground` and `--cue-style-selected-ink`, so a Look that inverts a
+    selection inverts its ink with it.
+  - **`SegmentedControl`** and **`Tabs`** share the segment names: `--cue-style-segment-track` and
+    `--cue-style-segment-inset` on the track — `SegmentedControl`'s rounded frame, whose own
+    `surface-1` ground and `space-1` padding are the fallbacks, and the `Tabs` list, which has
+    neither — `--cue-style-segment-idle-ink` on an unpicked choice,
+    and `--cue-style-segment-ground`, `-ink`, `-edge` and `-weight` on the pressed segment and the
+    active tab, which also carry the paint axis's resting shade (`--cue-paint-rest-shade`). A
+    segment's corners nest inside the track's inset. `Tabs` reads `--cue-style-tab-rule` and
+    `--cue-style-tab-underline` for its rule and the active underline.
+  - **Menu rows** (`DropdownMenu`'s items, and anything built on the exported `menuItemClasses`)
+    read `--cue-style-quiet-ink` at rest and `--cue-style-menu-highlight` when highlighted. The
+    exported `menuItemClasses` string no longer contains `text-fg-muted` or
+    `data-[highlighted]:bg-accent-soft`: code that edits it with `.replace()` on either finds
+    nothing to replace. Override those through `className` (or append a class) instead.
+  - **A `className` still wins over each of them**, as it won over the class each replaced: a
+    caller's `font-medium` on an `AppBar.Link` or `Footer`'s `columnClassName`, and a caller's
+    weight, ground, shadow or ink on a `Sidebar.Item`, a `SegmentedControl` item, a `Tabs.Tab` or
+    a `Table.Row`, applies to the current, pressed, active or selected one too. The readers of
+    what those states never set before — their weight, the active tab's ground, the pressed
+    segment's and active tab's shadow, the selected row's ink and a link's hover ground — sit at
+    zero specificity (`:where()`), so any class beats them.
+
+  `--cue-style-appbar-inset` and `--cue-style-nav-active-ground` are read now and join the style
+  contract in a later release; until then no set declares them.
+
+- 7884cb4: Surfaces and proportions read the style set (looks-fidelity round, lane R5). Every reader falls back to what the site drew before, so nothing changes under no style set or any shipped set until a Look declares a value.
+
+  - **`Card`**: every side of `Card.Header`, `Card.Content` and `Card.Footer` pads `--cue-space-5` times `--cue-style-card-pad` (1 by default), seamed or not.
+  - **`Dialog`**: the popup's corner reads `--cue-style-dialog-radius` over the overlay rung, times `--cue-radius-scale`. Every other overlay keeps `rounded-overlay`.
+  - **`Band`**: a `width="broad"` column reads `--cue-style-band-width` over `--cue-measure-broad`, and `Band` spends the rhythm's two halves, `--cue-band-y-top` and `--cue-band-y-bottom`, each falling back to `--cue-band-y`. `Footer` is unchanged and stays symmetric, `Container` keeps its broad rung, and a `className="py-0"` still zeroes a band.
+  - **`Preview`**: a frame's four registration marks read `--cue-style-stage-marks`, so a set that says `none` takes them away.
+  - **`Card` and `Panel`**: the paint axis's resting shade, `--cue-paint-rest-shade`, is now the second layer of their shadow, transparent under every shipped pack.
+
+  Rendered no-ops, measured: computed styles match the pre-change snapshot in both engines, and Card and Panel are pixel-identical under all ten paint packs. The one visible difference is in the markup. The longer class strings add about 2% to the HTML of pages that render many of these components.
+
+- e56ebf3: Round 2 of the Looks fidelity work added the readers its five Looks' fix lanes asked for. Every new reader falls back to the class it replaced. No shipped style set declares any of the new names yet, so no set renders differently through a new name. A shipped set does render differently at the sites below, where an existing name is now read. Each change follows the set's own voice.
+
+  - **Label voice at four more captions.** These are `CodeBlock`'s label, `TerminalFrame`'s title, `Footer`'s meta row and a `Frames.Item` caption. They read `--cue-style-label-size` and `--cue-style-label-ink`. A frame's caption also reads the label face and tracking, and a new optional `--cue-style-caption-case`. Under `tender`, `zine`, `kiln`, `porcelain` and `graphite` they take each set's label size, and each set's label ink where it has one.
+  - **Body weight.** `--cue-style-body-weight` now also reaches `FieldDescription`, `FieldError`, an unselected `Select` or combobox row, and the label beside a `Switch`, a `Checkbox` or a `Radio`. The control label falls back to `--cue-style-label-weight`. Under `tender` these are 300.
+  - **`Radio`'s label** reads the label ink and weight as `Checkbox`'s does.
+  - **The disclosure trigger.** `Accordion`, `Collapsible` and `Disclosure` read the control face, the quiet ink and the label weight.
+  - **`Select` and the filterable lists.** Their rows read `--cue-style-menu-highlight` (kiln's is `transparent`). The select's popup now uses the overlay recipe that every other popup uses, `STROKE_SURFACE_2`, so it reads `--cue-style-overlay-ground` and the pack's overlay stroke. Under no pack this draws the same pixels as before.
+  - **Help ink and size.** `Table.Caption` and the breadcrumb separator read `--cue-style-help-ink`. `Tooltip` reads `--cue-style-help-size`.
+  - **Other existing names at new sites.**
+    - The `PageShell` subtitle reads `--cue-style-prose-tracking`, which `kiln` and `zine` declare.
+    - The underline's hover colour reads `--cue-style-hover-ink`.
+    - Idle tabs read `--cue-style-segment-weight`, which `porcelain` sets to 500.
+
+  New optional names, each read at the sites named and falling back to what the site drew:
+
+  - **Type**
+    - `--cue-style-body-size` and `--cue-style-body-leading`: descriptions, tables, the breadcrumb, field help and the tooltip.
+    - `--cue-style-description-leading` and `-tracking`: `Card.Description`.
+    - `--cue-style-lede-leading`: the `PageShell` subtitle.
+    - `--cue-style-overlay-title-leading`, `--cue-style-label-leading` and `--cue-style-input-leading`.
+    - `--cue-style-code-weight`: `CodeBlock`.
+    - `--cue-style-title-variation`: the card, panel and bento titles, ahead of the display variation.
+    - `--cue-style-control-step-size`: the `sm` and `lg` fields and the `lg` button.
+  - **Inks**
+    - `--cue-style-option-ink` and `-option-selected-ink`: select and list rows.
+    - `--cue-style-secondary-hover-ink` and `-hover-edge`: the secondary tone under the pointer.
+    - `--cue-style-segment-rim`: `SegmentedControl`'s frame.
+  - **Geometry**
+    - `--cue-style-field-focus-offset`: the field ring.
+    - `--cue-style-gutter`: a padded `Container`.
+    - `--cue-style-chip-height` and `-chip-pad`.
+    - `--cue-style-kbd-size`, `-kbd-height`, `-kbd-pad` and `-kbd-radius`.
+    - `--cue-style-check-radius` and `-check-size`.
+    - `--cue-style-menu-item-radius`: menu, select and list rows.
+    - `--cue-style-tab-radius`: pill tabs on a rounded track.
+    - `--cue-style-tooltip-pad`, `--cue-style-row-pad`, `--cue-style-collapse-height`, `--cue-style-popover-pad` and `--cue-style-textarea-pad`.
+  - **`Card`'s stroke** reads the new `--cue-paint-stroke-raised-from` and `-to` ahead of the shared pair.
+
+  Three changes have no new name:
+
+  - `PageShell`'s title wraps a word too long for its column (`overflow-wrap: anywhere`).
+  - A `Panel` header's title clips only on the inline axis, so a tight title leading no longer cuts its descenders.
+  - A ground `Band` masks its grain with its own ground, so a transparent ground no longer lays a second grain over the page's.
+
+- f2c514d: The first frame of a page is the visitor's theme, mode, density and type size everywhere on it —
+  nested theme islands, `Preview` stages and density islands included — not the app's defaults.
+
+  Under a root `ThemeProvider` that persists (the default), `prepaintScript()` puts the visitor's
+  stored preferences on `<html>` before the page paints, and the root restates nothing of its own
+  until it has restored them. Three things still painted the app's defaults until they hydrated —
+  on a streamed page, for as long as their part of the page took to arrive:
+
+  - **A nested provider or stage that names one of theme and mode and not the other.** A theme's
+    light palette is keyed on `data-theme` and `data-mode` together, so such an island stamps the
+    other beside it, and in the server's HTML the only value it had was the root's prop. A visitor
+    who chose dark in an app whose default is light saw every `<ThemeProvider theme="…">` island and
+    every `<Preview theme="…">` stage light, at the default density; one whose stored theme was not
+    the default saw every `<ThemeProvider mode="…">` island in the default theme.
+  - **A density island's theme stamp.** A nested provider that names only a density, a `<Density>`
+    island and a `<Preview density="…">` stage stamp the theme around them as `data-cue-theme`, which
+    a theme's own density retunes are addressed through; the stamp was the root's default theme.
+  - **The type scale.** `fontScale` is published on the root's own element, but until the root has
+    restored, the text-size tokens the page reads are declared on `<html>`, which carried no scale:
+    every word set by a text token was drawn at 1× on the first frame and at the root's scale after.
+
+  What changes:
+
+  - **`@cueplusplus/ui`:** until it has mounted, an island leaves out any theme, mode or density it
+    would have copied from a persisting root (and the inline `color-scheme` that goes with them), and
+    carries `data-cue-follows` naming what it left out (`"mode density"`, `"theme"`, …). Its own
+    layout effect then stamps exactly the attributes it stamped before, ahead of the first paint once
+    it runs, and the marker goes. Anything the server does know is stamped from the first render as
+    before: an axis the island names itself, one named by a provider, `<Density>` island or stage
+    between it and the root, and everything under a root with `persistPreferences={false}`. If you
+    read these attributes off a nested provider's element before it hydrates, read `<html>`'s instead;
+    if you have written CSS of your own keyed on them, it will not reach such an island until it has
+    mounted (see **Migrating**). `overrides.colors` follows too: while the mode is `<html>`'s — a
+    persisting root before its restore, an island before its mount — the colour edit is a `<style>`
+    beside the element keyed on `<html>`'s mode (carrying `nonce`), not the inline block for the
+    root's default mode, so the first frame never pairs one mode's palette with the other mode's edit;
+    after the restore or the mount it is inline, as before. A nested provider with `asChild` over a
+    component, rather than a host element, follows nothing and stamps the root's values as before: the
+    re-render at its mount would render the component again, and a `<Suspense>` boundary it creates
+    would lose its streamed HTML.
+  - **`prepaintScript({ fontScale })`, new:** pass the same number as `<ThemeProvider fontScale>`, and
+    the script writes it on `<html>` as `--cue-font-scale`, where the first frame's text tokens are
+    declared; the root keeps it there after hydration, and takes it off when it unmounts. Omitted or
+    `1`, the script is exactly what it was. An app with a root `fontScale` other than `1` has to pass
+    it to get a first frame at that scale.
+  - **`createTheme()`, the `ThemeConfigurator`'s override stylesheet and `overrides.densities`** gain
+    the same selectors as a packaged theme (below), so a generated theme, a configured one and a
+    density override reach such an island too.
+  - **`themeSelector(name, { follows: true })`, new:** the same selectors for a theme assembled by
+    hand with `serializeThemeCss()`/`serializeThemeBlock()` — pass it for every block, or such an
+    island paints that theme's dark block for a light visitor until it mounts. `createTheme()` writes
+    exactly this. `mode` now also takes `"system"`, for the block inside each
+    `prefers-color-scheme` query; `follows` with both a light or system `mode` and a `density` throws.
+  - **`@cueplusplus/theme-tools`, and every theme package regenerated with it:** each `theme.css`
+    gains one selector line in front of each colour block — two in front of its light and system
+    blocks — and, for a theme that retunes or adds a density, in front of each density rule, that
+    matches such an island by `<html>`'s theme, mode or density and the island's marker, e.g.
+    `:where(:root[data-mode="light"]) [data-theme="x"][data-cue-follows~="mode"]`. No colour or
+    value moves, and each block keeps its specificity. A `data-theme` you stamp by hand, with no
+    mode beside it, is untouched: only the library's islands carry the marker. A theme with no light
+    palette (`supportsLight: false`, from theme-tools or `createTheme()`) now declares
+    `color-scheme: dark` in its two system blocks rather than `light dark`, as the pre-paint script
+    and the provider already said for it.
+  - **`@cueplusplus/tokens`:** each density rule in `axes.css`, and the coarse-pointer floor, gains the
+    same kind of line, so an island that is following the root's density declares that density
+    itself — its text tokens at its own `fontScale`, not the page's. The shadcn registry's
+    `registry/token-layer.json` keys its density rules the same way (the selector list `axes.css`
+    writes, `", "`-joined), so a registry install reaches such an island too.
+  - **`@cueplusplus/theme-base`:** `base.css`'s light and system blocks gain the line too, for the
+    tokens a `delta` theme's light palette leaves to the base.
+
+  ## Migrating
+
+  The new runtime and the new stylesheets ship as one change, and nothing but you ties their versions
+  together: the theme packages version on their own and peer only on `@cueplusplus/theme-base`, so
+  `pnpm up @cueplusplus/ui` alone leaves every `theme.css` you have where it was. With an older
+  stylesheet, an island that follows `<html>`'s mode matches no light block until it mounts, and
+  paints its theme's dark block for every visitor whose mode is light — on a streamed page, for as
+  long as its part of the page takes to arrive. Before, it painted the app's default mode, which was
+  right for exactly those visitors. So, in the same change as this upgrade:
+
+  - **Upgrade every `@cueplusplus/theme-*` package you register, and `@cueplusplus/theme-base`,** to
+    the releases that ship with this one: `pnpm up "@cueplusplus/theme-*"`.
+  - **A theme package you built with `@cueplusplus/theme-tools`:** upgrade `theme-tools`, run the
+    package's `generate` again, and ship the `theme.css` it writes.
+  - **CSS you emitted from `createTheme()`, `serializeThemeCss()`/`serializeThemeBlock()` or the
+    `ThemeConfigurator`'s CSS export and committed:** emit it again with this release.
+    `createTheme()` and the configurator write the new selectors themselves; a block you assemble
+    with `themeSelector()` gets them from `follows: true`.
+  - **Overrides of your own keyed on `[data-theme]`, `[data-mode]` or `[data-density]`:** put the twin
+    line in front of each compound (`docs/CONSUMING.md` §4 has the three forms), or they reach such an
+    island only once it has mounted.
+  - **Snapshots of server-rendered markup:** a nested provider, a stage or a `<Density>` island under
+    a persisting root no longer carries the `data-mode`, `data-theme`, `data-density` or
+    `data-cue-theme` it follows until it mounts, and carries `data-cue-follows` instead; a provider
+    with `overrides.colors` there carries `data-cue-colors`, with a `<style data-cue-colors-for>`
+    beside it. The DOM after hydration is what it was. Re-record them, and read the document's axes
+    off `<html>` before hydration.
+  - **A root `fontScale` other than `1`:** pass the same number to `prepaintScript({ fontScale })`.
+
+- 0d26a0c: Radii resolve at the element that draws them, a `Preview` stage that names a theme restates the
+  rung in force around it, and every focus ring library-wide reads the theme's contrast-gated
+  `focus` role instead of `accent`.
+
+  - **`rounded-(--radius-control|surface|overlay)` is gone; the library reads the compiled
+    `rounded-control` / `rounded-surface` / `rounded-overlay` utilities instead** (spec
+    2026-09-26-looks-fidelity §4.1.1, F-11). The old form named a Tailwind theme variable that
+    resolves once, at `:root`/`:host` — so a theme override or a `<Density>` island never reached a
+    radius, however deep inside it a card or a dialog sat. Measured: a `large` island computed
+    `--cue-radius-control: 5px` and still rendered a 4px radius. The new utilities inline the same
+    `calc(var(--cue-radius-*) * var(--cue-radius-scale))` at the element that draws it, so an
+    override or an island now reaches every radius in its subtree. No visual change under any
+    shipped preset today; this is what makes a theme's own radius override (a later release) work at
+    all. `cn()` is taught the three rungs (`extendTailwindMerge`), so a caller's own `rounded-*`
+    still overrides a component's default the way `className` always has — unextended,
+    `tailwind-merge` cannot see that `rounded-surface` and `rounded-full` are the same property, and
+    keeps both instead of the caller's winning. `Message`'s user and agent bubbles were the one
+    remaining `var(--radius-*)` reader (a four-value shorthand no plain utility could express, or so
+    it seemed); they now compose two ordinary bridge utilities instead — an all-corner rung and one
+    corner overridden — so no reader of the old, unreachable form is left in this package.
+  - **A `Preview` stage that names a theme (or a mode) now also carries `data-density` and
+    `data-cue-theme`, even when it names no density of its own.** A theme's rung retunes key on the
+    theme and the rung on one element, and `/looks` opens a stage with a theme and nothing else — so
+    before this, such a stage inherited the rung already resolved against the page's theme, and its
+    own theme's retune of that rung never applied. The stage now restates the rung in force around it
+    beside the theme it is naming, exactly as a nested `ThemeProvider` that names a theme already
+    does; outside every provider there is no rung in force, and nothing is restated. A stage that
+    names its own `density` is unaffected; a stage that names neither a theme nor a mode still stamps
+    nothing. Under a root that persists preferences, where that rung is the root's, the stage holds it
+    back until it mounts and names `density` in `data-cue-follows` instead — the same follower the
+    island first-frame fix introduced — so its first frame is the visitor's stored rung, and its own
+    theme's retune of it, rather than the app's default corrected a frame later.
+  - **Every `focus-visible` (and, for the one attribute-driven exception, `data-[focus-visible]`)
+    ring in this library now draws in the theme's `focus` role, never `accent`.** `forms/_chassis.ts`
+    was the only site that already made this distinction (its own comment has the long argument:
+    `focus` is contrast-gated at 3:1 against five grounds and `accent` is not); the other 81 sites —
+    every button, chip, tab, link, row, control and the colour picker's own draggable thumb — pointed
+    at the un-gated brand colour instead. A new shared module, `system/_focus-ring.ts`, draws the ring
+    everywhere now, and its width is a style-set knob (`--cue-style-focus-width`, falling back to the
+    existing 2px) that a Look may widen without a second module.
+
+    **This is a deliberate colour change, not a no-op.** The ring's colour moves wherever a theme's
+    `focus` differs from its `accent` — ten of the thirty shipped theme blocks:
+
+    - `graphite` light and dark
+    - `kiln` light and dark
+    - `porcelain` light and dark
+    - `tender` dark
+    - `hivehub` light
+    - `luma` light
+    - `venu` light
+
+    The other twenty blocks ship `focus` and `accent` at the same value, so nothing moves on screen
+    there. No component's public API changed.
+
+    `system/_focus-ring.ts`'s seven exports are each a complete literal string, not built from a
+    shared modifier-and-offset helper: Tailwind's compiler discovers a utility by scanning source
+    text for a whole candidate, never by evaluating the template literal that would assemble one
+    from parts, so a helper-built class rendered correctly everywhere and painted an `outline-offset`
+    of `0px` on every site in a real browser. `pnpm test:browser` (260/260) is green with the literal
+    form; nothing outside this one module needed a change.
+
+    `<AgentSurface skin="aui">`'s island re-points `--cue-focus` to its own ink alongside `--cue-accent`,
+    so an element inside it keeps drawing its ring in the island's palette rather than the outer
+    console theme's — the same ink it always drew, before this shared module gave the property a
+    name to read.
+
+- 5d75ae7: `Button`, `IconButton`, the checkbox and `Link` take their voice, tones and ink from the style
+  set, and the outline button, every recessed input and the checkbox take the paint axis's resting
+  shade (spec 2026-09-26-looks-fidelity §3.7, §3.10 and §10.4, plan R3).
+
+  - **`Button` and `IconButton`.** The chassis reads `--cue-style-control-weight` (falling back to
+    500, `font-medium`'s weight), `--cue-style-control-tracking` (`normal`),
+    `--cue-style-control-trim` (a `text-box` of `normal`) and `--cue-style-control-case` (`none`).
+    Each size's inline padding is its old rung times `--cue-style-control-pad` (1). The secondary
+    tone reads `--cue-style-secondary-ink`, `-ground` and `-edge`; the ghost and outline tones read
+    `--cue-style-quiet-ink` over their own inks (`fg-muted` and `fg`), and the outline reads
+    `--cue-style-outline-edge`. Hover states keep their classes.
+  - **The checkbox's** resting edge reads `--cue-style-check-edge` (`border`).
+  - **`Link`** reads `--cue-style-link-ink` (`fg`), and its `underline` variant
+    `--cue-style-inline-link-ink`, which falls back through the link ink; the underline's colour and
+    offset read `--cue-style-link-rule` (`border`) and `--cue-style-link-offset` (4px), its weight
+    `--cue-style-link-weight` (its parent's), and its hover ink `--cue-style-hover-ink` (`accent`).
+    Each variant now carries its own ink and the base none, so `linkVariants()` spread without
+    `cn()` never carries two.
+  - **The resting shade.** The outline tone, the recessed control chassis (`Input`, `Textarea`,
+    `Select`'s trigger, `NumberField` and every other control on it) and the checkbox add
+    `REST_SHADE`, a one-stop shadow whose ink is `--cue-paint-rest-shade`.
+  - **A `className` still overrides each of them** the way it overrode the class it replaced: a
+    caller's `font-*` weight, `tracking-*`, `px-*`, text, background and border colour, or
+    `shadow-*` passed to `Button`, `IconButton`, `Checkbox`, `Link` or an input replaces the reader
+    through the component's own `tailwind-merge`, and a `shadow-<colour>` tints the resting shade.
+    A caller's `uppercase`, `normal-case` and the rest still win over the case reader, which
+    Tailwind emits before them.
+  - **Concatenated onto `buttonVariants()` or `linkVariants()` without a merge, a class no longer
+    always wins.** Both return their recipe unmerged, so a class appended by a template string, `clsx`
+    or their own `className` option competes with the recipe's by Tailwind's emission order. The
+    button's padding readers (`px-[calc(…)]`) are emitted after every numeric `px-*`, where the
+    `px-(--cue-space-*)` rungs they replace were emitted before them, so `` `${buttonVariants()} px-2` ``
+    now keeps the recipe's padding; the link's offset reader is likewise emitted after every numeric
+    `underline-offset-*`. Pass `className` to the component, or merge with `tailwind-merge`.
+
+  Every fallback is what the site drew before, and no shipped style set or paint pack declares any
+  of these names with another value yet, so nothing renders differently under any shipped Look: the
+  style names are declared only as the shared `[data-style]` reset's `initial`, and every pack's
+  rest shade is `transparent`. One inheritance edge moves: a button used to inherit a letter-spacing
+  or a case from an ancestor that set one, and now draws `normal` and `none` unless the style set
+  names others. Measured over seven of the documentation site's pages, the kitchen sink among
+  them, no button sits under such an ancestor.
+  `--cue-style-control-case` is not yet part of the style contract; a later release adds it.
+
+- 3d481fc: `AppBar`'s bottom rule can be dashed. The style contract gains one optional name, `--cue-style-chrome-rule-style`, for the rule's line style, beside the `--cue-style-chrome-rule` that already sets its ink (looks-fidelity round 5, plan V.2: Z17). Its value rule is `solid` or `dashed`, the two that a measured row needs.
+
+  - **`AppBar.Root` reads it** through the slot its own `border-b` already reads, Tailwind's `--tw-border-style`, rather than through a second `border-bottom-style` declaration. A caller's own style class, such as `className="border-dotted"`, therefore still wins as it did: it writes `border-style` itself, and Tailwind emits it after `border-b`. A raw declaration would have been emitted after it and beaten it.
+  - **The fallback is `solid`.** That is the slot's own initial value, and the solid rule every bar drew before. The name is `initial` on the shared `[data-style]` reset and `console` declines it, so under no set, and under every set that does not name it, the bar draws exactly what it did.
+
+- 3d481fc: `Footer`'s two rules can be dashed. The style contract gains one optional name, `--cue-style-footer-rule-style`, for the line style of both of the footer's rules: the one across its top and the one over its fine print (looks-fidelity round 5, plan V.2: T120, T121). Its value rule is `solid` or `dashed`, as for `--cue-style-chrome-rule-style`, the app bar's.
+
+  - **`Footer` reads it on both rules** through the slot their own `border-t` utilities already read, Tailwind's `--tw-border-style`, rather than through a second `border-top-style` declaration. The slot does not inherit, so the landmark and the fine-print row each fill it. A caller's own style class, such as `className="border-dotted"`, therefore still wins on the landmark as it did: it writes `border-style` itself, and Tailwind emits it after the width utilities. A raw declaration would have been emitted after it and beaten it.
+  - **The fallback is `solid`.** That is the slot's own initial value, and the solid rules every footer drew before. The name is `initial` on the shared `[data-style]` reset and `console` declines it, so under no set, and under every set that does not name it, the footer draws exactly what it did.
+  - **A name of its own, not the app bar's.** A source can style the two ends of a page apart: stripe.com draws the rule under its header solid and both of its footer's rules dashed. `Band`'s rule does not read it either.
+
+- 88c6245: The package manifest names four more presets: `kiln`, `porcelain`, `tender` and `zine`.
+
+  `@cueplusplus/ui/manifest/manifest.json`'s `themes` now lists all four in their alphabetical slots — `kiln` between `hivehub` and `luma`, `porcelain` between `luma` and `quotamate`, `tender` between `snuffle` and `terminal`, `zine` after `venu` — and `manifest/tokens.json` carries each entry: the four `@cueplusplus/theme-*` packages, both modes, the five base density rungs. That list is what a tool or an agent reads to learn which palettes exist before it suggests one, so anything that reads it now offers all four too.
+
+  Nothing in the library changed to make room: a theme is still an application's choice, so to use one install its package beside `@cueplusplus/theme-base`, import its `theme.css` after `@cueplusplus/ui/styles.css`, and hand its manifest to `<ThemeProvider themes>`.
+
+- 25945dd: The package manifest names an eleventh preset, `graphite`.
+
+  `@cueplusplus/ui/manifest/manifest.json`'s `themes` now lists `graphite` between `dusk` and `hivehub`, and `manifest/tokens.json` carries its entry — `@cueplusplus/theme-graphite`, both modes, the five base density rungs. That list is what a tool or an agent reads to learn which palettes exist before it suggests one, so anything that reads it now offers `graphite` too.
+
+  Nothing in the library changed to make room: a theme is still an application's choice, so to use it install `@cueplusplus/theme-graphite` beside `@cueplusplus/theme-base`, import its `theme.css` after `@cueplusplus/ui/styles.css`, and hand its manifest to `<ThemeProvider themes>`.
+
+### Patch Changes
+
+- a6afdd2: **`Band`'s `separation` table names every shipped style set** (`@cueplusplus/ui`, documentation only). Under `kiln`, `separation="ground"` paints the recessed `--cue-sunken` ground and `separation="rule"` draws nothing, because the set's `--cue-band-rule` is now `0px`; `Footer` keeps its own rule there through `--cue-style-footer-rule`. `tender`, `zine` and `porcelain` draw the 1px rule and paint no ground, as `console` does. No class changes: the table is what the token layer already emits, and `band.test.tsx` now holds all nine rows (`:root` and the eight sets) to it.
+- 8970b22: A returning visitor's stored theme paints the first frame, nested providers follow the page's theme,
+  rung and mode live, and a `Preview` stage's font pairing reaches its overlays.
+
+  - **The root provider no longer restates its props on its own element before it has restored the
+    visitor's preferences.** `prepaintScript()` stamps the stored theme, rung, mode, style set and
+    pack on `<html>` before first paint, but the root `ThemeProvider` rendered its element — which
+    wraps every node of content — with `data-theme`, `data-density` and `data-mode` (and `data-style`
+    / `data-paint` when named) taken from its props, plus the props' `color-scheme`. That shadowed the
+    pre-paint stamp for the whole page until hydration caught up, so everyone whose stored theme was
+    not the default saw one frame of the default. It was invisible while the default theme looked
+    like bare `:root`, and a full-page flash under any other. A root that persists (the default) now
+    renders `data-cue-root` and no axis attribute in its server markup and first client render, and
+    stamps what it restored — the same values as `<html>` — once the restore lands, before the first
+    paint. If you read `data-theme` off the provider's element before hydration, read it off `<html>`
+    instead. A root with `persistPreferences={false}` stamps its props from the first render, as
+    before.
+  - **A `Preview` stage's font pairing reaches what opens on it.** `<Preview font="plex">` stamped
+    `data-font` on its stage and told nothing else, so a select, menu or popover opened on the stage
+    came up in the page's pairing, and `useTheme().font` read on the stage reported the page's. The
+    stage now republishes its pairing the way it already republished its theme, mode, density, style
+    set and pack. A stage that names a pairing also takes `font-sans`, so its text with no font class
+    of its own follows the stage's pairing instead of keeping the family it inherited. A stage that
+    names no pairing renders exactly as before.
+  - **A nested `ThemeProvider` that names no theme, density or mode now follows the page's live.** It
+    used to copy the ambient theme once when it mounted, open on its theme's preferred density rather
+    than the page's, and open `dark` whatever the page was — and stamp all three on its own element
+    for good. So a theme, density or mode the root restored from storage after the page loaded, or a
+    picker changed later, stopped at every nested provider. Now such a provider stamps none of the
+    three: its region inherits the page's, and `useTheme()` inside it and the overlays it opens report
+    the page's, as they change. A nested provider that names a theme or a mode keeps it and stamps it
+    together with the density and mode (or theme) it follows, since a theme's light palette and its
+    density rules need them on one element; one that names only a density stamps it the way a
+    `<Density>` island does. If you relied on a nested provider with no `density` opening on its
+    theme's preferred rung, or with no `mode` opening `dark`, pass the prop.
+
+- 69b6cbb: Three font pairings, four style sets and three new paint packs — the tokens for the four
+  remaining Looks (spec 2026-09-26 §8) — plus `grain` retuned to its own measurement.
+
+  Font pairings (`FONTS` now names twelve):
+
+  - `inter-source` — Inter over Source Code Pro, stripe.com's own recommendation once Söhne
+    is refused (Klim Type Foundry, licensee-only). Both faces are already delivered by every
+    app that ships `inter` or `source`.
+  - `dm` — DM Sans over Space Mono, with Anybody as the display face. The first pairing whose
+    `font-display` does not restate `font-sans`: reachable only because a style set can now
+    route `--cue-style-display-face` to `var(--cue-font-display)` (R-13).
+  - `calsans` — Cal Sans over Paper Mono, both self-hosted through `next/font/local` rather
+    than `next/font/google` (R-15), since Google Fonts serves neither in the cut this pairing
+    needs.
+
+  Style sets (`STYLE_SETS` now names eight): `tender` (stripe.com), `zine` (greptile.com),
+  `kiln` (replit.com) and `porcelain` (coss.com/ui). Each declares the full twelve-name
+  contract, including the three names every set has carried since `graphite` —
+  `style-control-face`, `style-display-face`, `style-seam-color`.
+
+  Paint packs (`PAINTS` now names ten): `plume` (stripe.com, a soft low-alpha bloom), `matte`
+  (replit.com, a flat shadow off the theme's own data-ground with the glass blur turned off)
+  and `glaze` (coss.com/ui, a light shadow ladder with a soft accent glow). Each declares all
+  thirty-one names. `grain` is retuned to its own measurement against greptile.com: its texture
+  now carries `stitchTiles='stitch'` (without it the tile seams every 200px, which the live
+  site never does), its screen moves from a 14px soft dot to the site's own 24px hard dot at
+  fg 15%, and its glass turns opaque to match the site's flat, unblurred header.
+
+  `@cueplusplus/theme-base`'s manifest schema recognises all three new pairings as base
+  pairings a theme package can override, the same as every pairing before them.
+
+  `@cueplusplus/ui`: the built-in paint devices now also cover a console shell's page ground,
+  not only `<Band separation="ground">` — `AppShell.Root` carries the same texture overlay
+  `Band` does (R-14), so a pack with a texture (today, only `grain`) reaches the whole page.
+  Every pack whose texture is `none` renders this as a no-op. The package manifest also picks
+  up the new pairings, sets and packs in its generated type unions and docs; nothing else in
+  the library's runtime code changes.
+
+  `@cueplusplus/studio-mcp` carries a comment fix only: `@repo/studio-core`'s catalogue
+  docblock named "nine fonts" among the closed lists it republishes, and that count is now
+  twelve. Nothing about the catalogue's shape or values moves.
+
+- 2d8eff5: A ninth font pairing, `geist-mono`, and `bevel` now matches the site it is measured from.
+
+  `geist-mono` pairs Geist with Geist Mono — the first pairing here that holds its sans and its
+  mono to one type family. Every pairing before it reaches for a different family on its
+  monospace half, `geist` itself included (Geist over JetBrains Mono); this is the pairing that
+  matches agent-native.com, whose buttons, labels and kbd are set entirely in Geist Mono.
+  `data-font="geist-mono"` resolves to nothing until your app delivers `--cue-face-geist-mono`,
+  the same way it delivers any other webfont pairing's faces — see
+  `FONT_PAIRINGS["geist-mono"].faces`.
+
+  `bevel`'s stroke and glass are retuned against a proper measurement of the site, in both
+  modes, rather than the dark-mode-only pass they shipped with:
+
+  - `stroke-angle` is `140deg`, not `180`.
+  - `stroke-from` is `var(--cue-border-strong)` — an exact share of the theme's own
+    border-strong in both modes, where the fg-tint it replaces missed light mode by a wide
+    margin.
+  - `stroke-to` is `color-mix(in oklch, var(--cue-fg-subtle) 19%, transparent)`, closer to the
+    measured endpoint than the formula it replaces in both modes at once.
+  - `glass-ink` is the page background at 90% under `blur(12px)`, not a raised surface at 88%
+    under `blur(10px)` — the site's own header sits over the page, not over a card.
+
+  Nothing else about the pack moves. It still declares all thirty-one paint names, and
+  `packages/tokens/test/paint.test.mjs` still holds it to that contract.
+
+  `@cueplusplus/theme-base`'s manifest schema now recognises `geist-mono` as a base pairing
+  too, so a theme package can write `fontPairings.overrides["geist-mono"]` the way it already
+  can for every other base pairing; `adds` refuses the name, the same as it refuses `geist`.
+
+  `@cueplusplus/ui`'s manifest picks up the new pairing's type union and the retuned pack's
+  values in its generated docs; nothing in the library's own runtime code changes.
+
+  `@cueplusplus/studio-mcp` carries a comment fix only: `@repo/studio-core`'s catalogue
+  docblock named "eight fonts" among the closed lists it republishes, and that count is now
+  nine too. Nothing about the catalogue's shape or values moves.
+
+- 8e23076: A theme island under a style set or a paint pack now paints its own borders, inks and band ground,
+  not the page's.
+
+  A pack's and a set's values read other axes — `bevel`'s stroke is the theme's border, every pack's
+  shade and rim inks are mixes of the theme's foreground, `marketing`'s band rule and ground are the
+  theme's border and surface — and CSS resolves a custom property where it is declared. With the set
+  or pack stamped only on the page, a region below it in another theme inherited values already
+  resolved against the page's theme: a `dusk` region inside a `cue` page under `bevel` drew `cue`'s
+  borders, and a light region inside a dark page kept the dark ones.
+
+  - **A nested `ThemeProvider` that names a `theme` or a `mode` now restates the style set and pack in
+    force** as `data-style` and `data-paint` on its own element, so they re-resolve against its theme.
+    It is still the page's set and pack, followed live: a picker that changes the page's pack moves
+    the region's with it, and `useTheme()`, storage and `<html>` are untouched. A nested provider that
+    names its own `styleSet` or `paint` keeps it, as before; one that names nothing, or only a
+    `density`, still stamps nothing.
+  - **A `Preview` stage with a `theme`, a `mode` or a `font` restates them the same way**, so a
+    specimen on a `dusk` stage draws `dusk`'s strokes under a `bevel` page. A stage that names only a
+    `density`, or nothing, is unchanged, and so is one that names its own `styleSet` or `paint`.
+  - Overlays were never affected: a portal already stamps every axis on its own container.
+
+  Under a root that persists, these islands restate nothing in their server markup or on their first
+  client render, so they inherit the visitor's stored set and pack from `<html>` rather than repeating
+  the app's defaults over them; each restates once it has mounted, before the first paint. The root's
+  restore itself changes nothing an island reads, so a streamed Suspense boundary full of stages
+  still hydrates in place instead of being rendered again on the client.
+
+  If you stamp `data-theme` on an element by hand inside a styled or painted page, restate
+  `data-style` and `data-paint` beside it yourself, or use a nested `ThemeProvider`, which does it for
+  you. `<Density>` still restates a set only when you pass `styleSet`: a rung changes no ink.
+  `@cueplusplus/tokens` emits the same stylesheet as before; the note in its build that described this
+  trade as yours to carry now says the library carries it for its own islands.
+
+- 9275ffc: `FieldLabel`, `Eyebrow`, a table head, `Stat` labels, group and section headings and a dozen
+  more chassis captions take their face, case and tracking from the style set; the shared
+  recessed control chassis — every text field, textarea, number field, combobox and the rest of
+  what a person types into — takes its face from it too.
+
+  Twenty-five sites read the new `--cue-style-label-face` and `--cue-style-label-case`, falling
+  back to `font-mono` and `uppercase` — what they have always worn — so nothing changes under no
+  style set or under `console`, `editorial`, `marketing`, `graphite` or `zine`. Under `tender`,
+  `kiln` or `porcelain` they read sans and sentence case instead, matching the sites those Looks
+  are measured from. `--cue-style-label-tracking` follows the same rule but is optional: `FieldLabel`
+  falls back to its own tighter tracking, `Eyebrow` to its own wider one, and the rest to the plain
+  rung — each exactly what it rendered before — and only the three sans sets declare one shared
+  value, converging every label onto it. `forms/_chassis.ts`'s shared input chassis reads
+  `--cue-style-input-face`, falling back to `font-mono`, so the same set of Looks reads sans for
+  typed text too.
+
+  Two calls that already forced their own face are unchanged on purpose: `color-picker.tsx`'s hex
+  field keeps `font-mono` regardless of the set (a hex code is content, not voice), and
+  `primitives/avatar.tsx`, `primitives/chip.tsx` and `chat/agent-pile.tsx`'s avatar initials keep
+  `font-mono uppercase` too — a rendered initial or a tag's text is the value being shown, not a
+  chassis caption.
+
+  Inside a stamped style set, the four are resolved where the set is stamped, exactly as
+  `--cue-style-control-face` already is — an island in another theme, pairing or font has to
+  restate the set to get its own, and the library's islands do that for you.
+
+  **The rest of the chrome now reads `--cue-style-control-face` too**, the existing name #205
+  gave `Button`, `IconButton` and the `Tabs` trigger: a menu row, a select/combobox/autocomplete
+  option, a tooltip's popup, a checkbox/switch/radio's option text, a segmented control and toggle
+  item, the command palette's input and its rows, a breadcrumb link, `Link` and a nav-menu trigger
+  and link all fall back to `font-mono` — again, what every one of them has always worn — so under
+  no style set or under a mono-voiced one they are unchanged, and under `tender`, `kiln` or
+  `porcelain` they read sans like the buttons beside them. No new contract name: none of these
+  sites was uppercase-tracked, so none needed the label axis. Left mono on purpose: a value chip's
+  user-typed content (`forms/_listbox.ts`'s `valueChipClasses`) and the general-purpose `Item`
+  media-object row — both hold arbitrary caller content, the same category as a table cell.
+
+  `Preview`, `Density` and `ThemeProvider` already accept `styleSet="tender" | "kiln" | "porcelain"`.
+
+- 07d8524: `PageShell`'s title no longer collapses to one word per line beside a wide `actions` slot.
+
+  The header row laid the title block (`min-w-0`) and the actions slot (`shrink-0`) out with
+  `flex` and no wrap, so an actions slot wider than the remaining row — the docs site's component
+  pages pass a peer-dependency chip row plus the markdown twin, copy button and two agent
+  hand-off buttons, together nearly 940px — squeezed the title down to whatever width was left,
+  sometimes under 30px, wrapping every word onto its own line. The header now wraps
+  (`flex-wrap`), the title block keeps a floor of `min-w-[min(100%,20rem)]` so it is never
+  squeezed below a readable width (or below its container's full width, on a narrower page), and
+  the actions slot trades its fixed `shrink-0` for `min-w-0` so it can shrink and wrap its own
+  children instead of forcing the title to give way. On a row with room for both, nothing
+  changes; when there is not enough room, the actions slot now drops to its own line under the
+  title and wraps there.
+
+- 36dfdd0: A paint pack is called a paint pack now, not a "look pack".
+
+  A **Look** is now a named bundle — one theme, font pairing, style set and paint pack chosen
+  together — so the finish axis's values stopped borrowing the word. The prose moved and nothing
+  else did:
+
+  - **`@cueplusplus/tokens`:** every pack's `$description`, and the docblocks the build writes over
+    `PAINTS` and `PAINT_CONTRACT` in `tokens.js` and `tokens.d.ts`.
+  - **`@cueplusplus/ui`:** the JSDoc on the `paint` props of `ThemeProvider`, `Density` and `Preview`,
+    on `useTheme().paint` and `setPaint`, on `prepaintScript()`'s paint options and on `isPaint`, and
+    the component manifest generated from it.
+
+  `halo`'s and `hatch`'s descriptions stop counting the presets they read under: both packs'
+  inks are shares of the theme's own colours, so they read under every preset, not "all ten".
+
+  No identifier changes: `PAINTS`, `DEFAULT_PAINT`, `PAINT_CONTRACT`, the `Paint` type, the
+  `data-paint` attribute and every file name are exactly as they were.
+
+- 080462c: A pack named on `ThemeProvider` now reaches the overlays it opens, and `setPaint` repaints the whole page.
+
+  Two things were wrong with the paint axis as 0.16.0 shipped it, and both showed in the surfaces a
+  pack moves most:
+
+  - **Overlays opened under a provider's pack carried none.** `<ThemeProvider paint="halo">` stamped
+    its own element and `<html>`, but a popover, menu, dialog or tooltip opened inside it got no
+    `data-paint` on its portal container. At the root nobody noticed, because an overlay mounted on
+    `<body>` inherits `<html data-paint>`. Under a nested provider — `<ThemeProvider paint="lift">`
+    around one region of a page — nothing covered for it, and that region's overlays opened in the
+    page's finish rather than the region's. A nested provider that names no pack also reported none
+    from `useTheme().paint` under a painted one; it now reports the pack in force, as `styleSet`
+    always has.
+  - **A nested provider that names no pack or style set now follows the outer one live.** It used to
+    copy the outer value once, when it mounted, and stamp that copy on its own element — so a pack or
+    set restored from storage after the page loaded, or changed later at the root, stopped at every
+    nested provider, which kept whatever the root held on its first render. The style set has had this
+    since it shipped. Now it stamps neither, and its region, `useTheme()` inside it and its overlays
+    all follow the outer value; a nested provider that names a pack or set keeps it, as before.
+  - **`setPaint` on its own left `<html>` behind.** It moved the provider's element and not the
+    document's, so the page ground and every overlay — a paint picker's own dropdown included — kept
+    the previous pack until some other setting changed. The whole page repaints at once now.
+
+  **`PAINTS`, `DEFAULT_PAINT` and the `Paint` type are exported from `@cueplusplus/ui/system`** and
+  the package root, beside `STYLE_SETS`. Five public signatures already named `Paint`, but the type
+  lived only in `@cueplusplus/tokens`, which pnpm does not let an app import unless the app installed
+  it too. You can now type a pack, and list the packs to build a picker, with no second dependency.
+
+  Nothing changes for an app that never names a pack: no `data-paint` is stamped anywhere, and the
+  stored preference is the same object it always was.
+
+- 36dfdd0: Documentation that counted the presets stopped counting what no longer holds.
+
+  - **Every theme package's README** counted the presets beside it when it pointed at the theming
+    guide — "the other nine presets", "the other ten", or in `theme-base` and `theme-tools` "the ten
+    shipped presets" — and `theme-tools` opened by saying "the ten presets in this repository are
+    built by it too". Fifteen ship now, and the next one would make any count wrong again, so each
+    line reads "the other presets" (or "the shipped presets", or "the presets") — the wording the
+    newest presets already use.
+  - **`CueMark`, and its `BrandTone`,** said a single element "is correct in all ten presets"; it is
+    correct in every preset, and the docs and the component manifest now say so.
+
+  - **`theme-tools`' CSS emitter** said "all ten presets are `complete`" in the docblock on its
+    light-block rule; every preset here is `complete`, and it now says so without a count.
+
+  Nothing else changed: no token, no value, no export.
+
+- 002f95a: Restoring a visitor's stored theme, pairing, style set or pack no longer throws away streamed
+  content that is still hydrating.
+
+  A `ThemeProvider` that persists renders its props on the server, then restores the visitor's stored
+  choice in its first commit. On a streamed page some Suspense boundaries are still server HTML at that
+  moment — waiting on a lazily loaded module, still streaming, or streamed and queued for React's
+  batched reveal — and React treats a boundary under a changed context as changed, whatever it reads.
+  One it cannot hydrate right then it renders again on the client, fallback first, and discards the
+  server HTML that arrives for it later; for a boundary still streaming or queued it does this on every
+  lane, so making the restore a transition does not help. Whenever the stored choice differed from the
+  page's default, that was a blank-and-redraw on every load.
+
+  The restore now moves no context value. Each provider still hands its values down through context,
+  and a setter or a changed prop moves them exactly as before — readers re-render in the same commit,
+  and a change made in a transition stays one. What the restore corrects is posted beside the context
+  instead: every reader inside the library picks it up by itself, hydrating first against what the
+  server rendered, and no boundary is told that anything changed. The same holds for the colour scheme
+  `mode="system"` reads from the OS.
+
+  `useTheme().font` now hydrates against the pairing the server rendered and catches up with the
+  restore, like every other axis: a component that rendered it into markup used to hydrate against HTML
+  naming the default, and React regenerated its whole boundary for the mismatch. Portal containers and
+  `<html>` still carry the stored pairing from the first commit, so no overlay makes the browser fetch
+  the default's webfont. A boundary that hydrates after a setter has run hydrates against what the
+  server rendered too, not against the setter's value.
+
+  A context now moves only when its own value does. A setter handed the value already in force does
+  nothing — no re-render and no write to storage — so an effect that re-asserts a preference on every
+  render stays one render. `setPaint` no longer re-renders a component that only lists the rungs on
+  offer. And a `themes` array built inline, equal to the last one, is treated as the same registry: a
+  parent re-rendering the provider while the page hydrates moves nothing. `useThemes()`,
+  `useDensities()` and `useFonts()` sit out a restore unless their own list changed.
+
+- a6afdd2: A modal's scrim no longer fades by its own `opacity`. An element under opacity 1 is a backdrop root, so while the scrim faded in, the paint pack's `--cue-paint-scrim-filter` on its `::before` had nothing to blur: under `glaze` (`blur(8px)`) the page stayed sharp for the whole 150ms fade, snapped to the blur when it ended, and lost it on the first frame of the exit. `scrimClasses` — behind `Dialog`, `AlertDialog`, `Sheet`, `Drawer` and `CommandPalette` — now keeps the scrim at opacity 1 and fades its parts over the same 150ms: its background from `transparent`, the `::before` by its own opacity, and its own `backdrop-filter` from `none` on the entering and leaving frames, so a `backdropClassName="backdrop-blur-*"` still fades in rather than snapping. Under every other pack, and with no pack, the scrim renders as it did.
+- c1f6b7c: `Button`, `IconButton` and the `Tabs` trigger take their face from the style set, and seam
+  grids take their hairline colour from it.
+
+  The three controls read `--cue-style-control-face`, falling back to `--cue-font-mono` — the
+  face they have always worn — so nothing changes under no style set or under any set that
+  ships today. `SeamGrid`, `SeamList` and `<Card seam>` read `--cue-style-seam-color` for the
+  gaps between their cells, and for their rim when they draw one, falling back to
+  `--cue-border`; under the new `graphite` set the seams draw lighter than the rules between
+  bands. A bordered seam container now clips its background to the padding box, which paints
+  nothing different under an opaque ink and keeps a translucent one from doubling under the
+  rim.
+
+  Inside a stamped style set, the face and the seam ink are resolved where the set is stamped,
+  so an island in another theme or pairing has to restate the set to get its own. The library's
+  islands do that for you: a nested `ThemeProvider` that names a `theme` or `mode`, and a
+  `Preview` stage that names a `theme`, `mode` or `font`, restate the set in force beside it, so a
+  `dusk` region under a `graphite` page draws `dusk`'s seams and a `plex` stage's buttons wear
+  Plex Mono. Only an element you stamp `data-theme` or `data-font` on by hand has to restate
+  `data-style` itself.
+
+  `Preview`, `Density` and `ThemeProvider` accept `styleSet="graphite"`.
+
+- Updated dependencies [a6afdd2]
+- Updated dependencies [a6afdd2]
+- Updated dependencies [a6afdd2]
+- Updated dependencies [a6afdd2]
+- Updated dependencies [a6afdd2]
+- Updated dependencies [a6afdd2]
+- Updated dependencies [d205951]
+- Updated dependencies [68e485b]
+- Updated dependencies [af8b102]
+- Updated dependencies [68e485b]
+- Updated dependencies [e56ebf3]
+- Updated dependencies [e56ebf3]
+- Updated dependencies [e56ebf3]
+- Updated dependencies [e56ebf3]
+- Updated dependencies [e56ebf3]
+- Updated dependencies [68e485b]
+- Updated dependencies [68e485b]
+- Updated dependencies [69b6cbb]
+- Updated dependencies [2d8eff5]
+- Updated dependencies [c1f6b7c]
+- Updated dependencies [f2c514d]
+- Updated dependencies [8e23076]
+- Updated dependencies [9275ffc]
+- Updated dependencies [36dfdd0]
+- Updated dependencies [36dfdd0]
+- Updated dependencies [e56ebf3]
+- Updated dependencies [68e485b]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+- Updated dependencies [3d481fc]
+  - @cueplusplus/tokens@0.17.0
+  - @cueplusplus/theme-base@1.1.0
+
+## 0.16.0
+
+### Minor Changes
+
+- 42021e4: Every overlay draws its shadow from a composite a look pack can move.
+
+  Dialogs, menus, popovers, tooltips, toasts, drawers, sheets, the command palette, the
+  select and combobox popups and the log viewer's jump button all drew
+  `shadow-[0_8px_24px_rgba(0,0,0,0.4)]` — the same literal in four places. They now share
+  one four-layer recipe: a hairline, a contact shadow, a bloom and an inset top light.
+
+  **Nothing looks different.** At the defaults three of the four layers are transparent and
+  the bloom is that exact literal. Measured rather than asserted: in Chromium the recipe and
+  the literal render byte for byte; in WebKit 42 channels of roughly 264,000 differ by 1/255,
+  which is compositing rounding and below what a display can show.
+
+  What it buys is that `--cue-paint-shadow-scale` moves the whole ladder at once and any
+  layer switches off by letting its ink resolve to `transparent` — so a pack can give every
+  floating surface a deeper shadow, a tighter one, or a lit top edge, without touching a
+  component.
+
+  Overlays also adopt the gradient stroke deferred from the previous release, and keep their
+  own rim colour while doing it: the recipe's stops fall back to `--cue-border-overlay`, not
+  `--cue-border`, because some themes match that token to the surface on purpose so the rim
+  vanishes.
+
+  `AppWindowFrame` keeps its literal shadow. Its bloom is twice as dark as every other
+  surface's, and giving it the shared recipe would have lightened it.
+
+- 6e2fd3b: Every edge fade in the library follows one token.
+
+  `Tabs`, `Toolbar`, `SegmentedControl`, `ScrollableTabsList` and `AppBar` soften their
+  overflowing edges with a mask that reached in a fixed 24px. That distance is
+  `--cue-paint-fade-length` now, so a `[data-paint]` pack can make every one of them
+  shorter or longer at once.
+
+  **Nothing looks different.** The token's default is the same 24px, measured pixel for
+  pixel in Chromium and WebKit — with a 64px override in the same test, so the comparison
+  is one that could have failed.
+
+  `edgeFadeMask(edges, fadePx)` is unchanged when you pass a reach of your own: an explicit
+  number still wins, because a caller that has measured its own fade is not asking for the
+  axis's.
+
+- 40c9de0: `AppBar`'s frosted glass is a look pack's to change, and a consumer's backdrop utilities still work.
+
+  The bar drew `bg-surface-1/95 backdrop-blur`. It now spends `--cue-paint-glass-filter` and
+  `--cue-paint-glass-ink`, so a `[data-paint]` pack can make the chrome heavier, clearer, or
+  tinted — or turn the blur off entirely — without touching the component.
+
+  **Nothing looks different**, measured pixel for pixel against what the bar drew before, in
+  Chromium and WebKit, over a hard-edged background so the blur has something to smear.
+
+  **And `className` still composes.** This is the part worth knowing if you style `AppBar`
+  from outside: passing `backdrop-brightness-50` or `backdrop-saturate-150` through
+  `className` adds to the bar's blur rather than replacing it. The obvious implementation —
+  a plain `backdrop-filter` declaration — would have silently deleted the blur the moment you
+  passed any backdrop utility of your own. That case is now a test.
+
+  The opaque fallback behind `@supports not (backdrop-filter: …)` is unchanged: a browser
+  without backdrop filters still gets a solid bar rather than a translucent one over the page.
+
+- e53619a: The first look pack: `halo`, and the glow it paints.
+
+  `<ThemeProvider paint="halo">` — or `data-paint="halo"` on any element — gives primary
+  buttons a soft two-stop glow in the theme's own accent, doubling on hover. It is the first
+  value the paint axis has other than `none`, so it is also the first time the axis changes
+  what a page looks like rather than only standing ready to.
+
+  **Nothing changes unless you ask.** Unstamped, both stops have zero blur and a transparent
+  ink, so the button renders exactly as it did — measured pixel for pixel in Chromium and
+  WebKit, alongside the other half of the same test: that stamping `halo` does change it.
+
+  A pack names no colour of its own. `halo`'s two inks are a share of `--cue-accent`, so it
+  reads correctly under all ten shipped themes rather than carrying one palette's blue into
+  the others.
+
+  Two fixes ride along. `--cue-paint-glow-blur` and `-blur-far` were validated against the
+  rim's 0–4px rule, so no usable halo radius was accepted — the first pack to set one was
+  refused at 12px. They take 0–64px now. And `Button`'s `primary` tone is the only component
+  that spends the glow; every other tone is untouched.
+
+- 3d0c3fd: A seventh look pack: `grain`, a fine fractal noise over every surface.
+
+  `<ThemeProvider paint="grain">`, or `<Density paint="grain">` over a subtree, lays a
+  200×200 fractal-noise tile across the surfaces that carry the texture recipe. It is the
+  quietest pack in the catalogue by design — 12% opacity, no blend mode — and it is the
+  only one that spends `--cue-paint-texture`, a name the library has carried since the
+  texture slice with nothing able to use it.
+
+  Measured from greptile.com, whose ground is an `feTurbulence fractalNoise` data URI at
+  0.85 baseFrequency over five octaves, composited at roughly 12% effective opacity across
+  every pixel of the site. The tile here is that filter at those parameters, generated
+  rather than copied: it is 331 bytes of SVG inline in the pack, so nothing is fetched and
+  no asset ships.
+
+  **It is deliberately below the bar.** Every other pack clears the threshold this system
+  sets for shipping one; `grain` reaches about 62% of its site and ships anyway, as the
+  proof that a pack is worth having for what it refuses as much as for what it paints. Its
+  `refuses` note names the four of six screens it cannot claim, the twelve divider forms
+  and the band-frame furniture that belong to components rather than to a finish, the
+  hexagon control silhouette, and the handwriting type stack.
+
+  Nothing changes for a page that does not ask for it: `grain` is opt-in like every pack,
+  and the provider still stamps no `data-paint` at all.
+
+- 4d851a0: `Panel` and `Card` can take an inset ring, and a `Band`'s ground can take a repeating pattern.
+
+  Two more devices reach the paint axis, which means every one of its thirty-one names is now
+  spent by something: `--cue-paint-rim-width` and `-rim-ink` draw a hairline ring inside a
+  panel's or a card's radius, and `--cue-paint-ground-pattern` with `-size` lays a repeating
+  geometry under a band's content.
+
+  **Nothing changes unless you ask.** The ring's width is `0px` and its ink is transparent;
+  the pattern is `none`. Measured pixel for pixel in Chromium and WebKit, with both devices
+  switched on in the same tests so the comparisons are ones that could have failed.
+
+  The ring is a `box-shadow`, so a `Band` or a `Card` that already draws one cannot take it —
+  and **form controls deliberately do not**. `forced-colors: active` discards shadows
+  entirely, and a control's ring is a focus indicator: it stays a real outline, which is what
+  a forced-colors user actually sees.
+
+  A pattern and a texture are different layers and compose: a pattern is the host's own
+  background image, a texture is noise on a pseudo-element above it.
+
+- 5fcc6b4: Form controls and cards draw their border as a gradient stroke, so a look pack can tint it.
+
+  `Input`, `Textarea`, `Select`, `Combobox`, `Autocomplete`, `SearchInput`, `OTPField`,
+  `InputGroup`, the date and colour fields, `MusicalTimeInput` and the rest of the recessed
+  control family — and `Card` — now paint their line from two background layers with a
+  transparent border between them, rather than from `border border-border`.
+
+  **Nothing looks different.** At the defaults both gradient stops are `--cue-border` and a
+  one-colour gradient paints a flat field, so the line is the same one device-pixel of the
+  same colour over the same fill. That is measured rather than asserted: the straight edges
+  and the interior are pixel-identical in Chromium and WebKit, and with square corners the
+  two are identical everywhere. On a rounded corner they differ by sub-pixel antialiasing —
+  invisible at 1×, and bounded by the test rather than claimed away.
+
+  What it buys is that `--cue-paint-stroke-from`, `-to`, `-angle` and `-width` now reach
+  every one of those surfaces, so a `[data-paint]` pack can give the whole family a gradient
+  edge, a thicker rule or a different angle without touching a component.
+
+  A seamed `Card` keeps its old border: its fill is `--cue-border` — the gaps between its
+  rows _are_ the line — and the recipe is keyed by fill.
+
+  `Toggle` and `ToggleGroup` also lose ten custom properties from their published manifests.
+  They never painted them: the entries came from a type-only import of the control chassis,
+  and the manifest lists what a component spends. `--cue-sunken`, `--cue-focus` and
+  `--cue-border` were among them, so this was wrong before the gradient stroke existed.
+
+- bcd0738: A `Band`'s ground can carry a grain or pattern overlay.
+
+  `<Band separation="ground">` now spends `--cue-paint-texture`, `-texture-size`,
+  `-texture-opacity` and `-texture-blend`, so a `[data-paint]` pack can lay a noise tile or
+  a repeating pattern over the band's ground without touching the component.
+
+  **Nothing changes unless you ask.** At the defaults `texture` is `none` and the overlay
+  paints nothing — measured against the same band with _no_ overlay element at all, which is
+  the comparison that matters, since the change adds a `::before` where there was none.
+
+  The overlay is `pointer-events-none` and covers its host exactly, so it never intercepts a
+  click or disturbs the band's own background.
+
+  `--cue-paint-texture` takes a `data:` URI or an absolute `https://` URL and nothing else —
+  the token layer ships no binary, and the build says so by name if you try something else.
+
+### Patch Changes
+
+- ac712b3: `ThemeProvider`'s `nonce` now documents what it does not reach, which matters more than what it does.
+
+  Nothing about the prop's behaviour changes. What changes is that its documentation — the prop's
+  own docblock, and so the manifest an agent reads — stops promising coverage it never had. If you
+  serve a nonce-based Content-Security-Policy, five things are worth checking:
+
+  - **Your pre-paint `<script>` needs the nonce by hand.** `prepaintScript()` returns the script's
+    text; the element is yours, and Next.js never nonces a plain `<script>`.
+  - **The density layer reads the nonce from this prop only.** Not from an outer `CSPProvider`, and
+    not from an outer `ThemeProvider` — a nested provider that sets its own `overrides.densities`
+    needs its own `nonce`. If you render your own `CSPProvider` and leave this prop unset, Base UI's
+    pre-hydration `<script>` takes its nonce in server-rendered HTML and its scrollbar rule takes it
+    wherever React creates that rule in the browser; the density layer, if you set
+    `overrides.densities`, is not covered.
+  - **A server-rendered ScrollArea's Base UI style ships without a nonce under Next.js 16**, whatever
+    this prop or your own `CSPProvider` says: React's server renderer (19.2, and the canary Next.js 16
+    bundles) writes that element's nonce only from a style-specific render option that Next does not
+    pass. Allow it by hash —
+    `'sha256-kLmvWqfziFavKtqHqRsb90f006UAK2Dmd0It5Iz2KFA='` for Base UI 1.7.0 — or switch Base UI's
+    element off and ship its two rules yourself.
+  - **Re-rendering your own `CSPProvider` inside needs the nonce on it.** If you turn on Base UI's
+    `disableStyleElements`, render `<CSPProvider nonce={nonce} disableStyleElements>` inside
+    `ThemeProvider`'s children — with the nonce, or Base UI's pre-hydration `<script>` below it loses
+    it.
+  - **A policy whose `style-src` (or, without one, `default-src`) carries a nonce or a hash, or lacks
+    `'unsafe-inline'`, needs an explicit `style-src-attr 'unsafe-inline'`.** A nonce cannot cover a
+    style attribute, the provider root and many components carry one, and a nonce or hash in the
+    governing list makes the browser ignore `'unsafe-inline'`.
+
+  This also corrects three earlier notes. 0.14.1 said Base UI's element appears wherever a Select, a
+  Popover or a ScrollArea does: a Popover never renders it, and a Select renders it only once its popup
+  mounts in the browser. 0.14.0 said nothing else in this library emits a `<style>` element:
+  `ThemeConfigurator` does, with no nonce. And 0.14.0 said `style-src-attr` is `'unsafe-inline'` or
+  `'none'` and that only `'none'` drops the root's declarations: a nonce in `style-src` drops them too
+  when no `style-src-attr` is set, and `'unsafe-hashes'` with a hash of each value is a third form. `docs/CONSUMING.md` §4.5 has the whole of it, including
+  `paint="grain"` needing `img-src data:`, statically rendered pages, and rolling out under
+  `Content-Security-Policy-Report-Only` first.
+
+- 3fc83a6: Four more look packs: `hatch`, `lift`, `frost` and `bevel`.
+
+  `<ThemeProvider paint="frost">` — or `data-paint` on any element — now picks from six
+  finishes rather than two:
+
+  - **`hatch`** lays a faint diagonal weave under a band's ground and puts a hairline ring on
+    the panels and cards above it.
+  - **`lift`** deepens the shadow ladder and adds a lit top edge, so overlays read as sitting
+    above the page rather than in it.
+  - **`frost`** is heavy glass on the chrome, a long edge fade, and a shadow that reads as
+    distance.
+  - **`bevel`** gives surfaces a gradient edge that catches light at the top and loses it at
+    the bottom, with a lighter glass over the chrome.
+
+  **No pack names a colour of its own.** Every ink is a share of the theme's own palette, so
+  each of the six reads correctly under all ten shipped themes rather than carrying one
+  site's blue into the others — and the build refuses a literal hue by name if one is ever
+  written.
+
+  Each pack is a complete statement of a finish rather than a diff against whatever is above
+  it, so switching between them — or nesting one inside another — changes only what the pack
+  is for. `paint="none"` inside a packed subtree really does reset it, and still renders
+  identically to no pack at all.
+
+  `@cueplusplus/ui`'s manifest records the four new pack values against the three components that stamp the axis, which is how the studio and the docs playground know to offer them.
+
+- f12d280: The READMEs now describe the package you install, not the one from three releases ago.
+
+  `@cueplusplus/tokens`'s README opened by calling itself "two of the system's three DOM axes" and
+  called `axes.css` "the two axes". It is four of five — density, font, style set and paint live
+  here, and the fifth, `[data-theme]`, is the theme packages' — so its axis table gains `[data-style]`
+  (page composition, 13 names) and `[data-paint]` (the finish, 18 names and 13 inks, off until a page
+  stamps it), its export table names `STYLE_SETS`, `PAINTS`, the style and paint contracts and the
+  paint inks beside the rest, and its quick start says the rule that applies to `DENSITIES` applies
+  to all four: build a picker from the exported list, never a hand-written one.
+
+  `@cueplusplus/ui`'s quick start now says what the provider's four axes each change, that `paint` is
+  off until you pass a pack, and where the seven packs and a nonce-based Content-Security-Policy are
+  written up — including that `paint="grain"` needs `img-src data:`. It also says which axes a
+  subtree can change: `<Density>` re-scopes `density`, `styleSet` and `paint`, and the font pairing is
+  the root's alone, because it lives on `<html>`.
+
+- Updated dependencies [e53619a]
+- Updated dependencies [840aa92]
+- Updated dependencies [4eb3b42]
+- Updated dependencies [3fc83a6]
+- Updated dependencies [3d0c3fd]
+- Updated dependencies [0371094]
+- Updated dependencies [f12d280]
+  - @cueplusplus/tokens@0.16.0
+
 ## 0.15.0
 
 ### Minor Changes