@floless/app 0.31.3 → 0.32.0

package/dist/floless-server.cjs

@@ -52835,7 +52835,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.31.3" : void 0,
+    define: true ? "0.32.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52845,7 +52845,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.31.3" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.32.0" : void 0 });
 }
 
 // oauth-presets.ts
@@ -53698,6 +53698,24 @@ function writeContract(appId, doc2) {
   (0, import_node_fs16.writeFileSync)(p, JSON.stringify(doc2));
 }
 
+// contract-resolve.ts
+function readContractForApp(appId, readAppFn = readApp) {
+  const draft = readContract(appId);
+  if (draft != null) return draft;
+  let app;
+  try {
+    app = readAppFn(appId);
+  } catch {
+    return null;
+  }
+  const node = app.nodes.find((n) => n.config["contract"] === "steel.takeoff/v1");
+  const t = node?.config["takeoff"];
+  if (t == null || typeof t !== "object" || Array.isArray(t) || Object.keys(t).length === 0) {
+    return null;
+  }
+  return t;
+}
+
 // contract-bake.ts
 var import_node_fs17 = require("node:fs");
 var import_yaml4 = __toESM(require_dist6(), 1);
@@ -55854,6 +55872,8 @@ var PRODUCT_SKILLS = [
   //      author event-driven ("on trigger") routines
   "floless-app-steel-from-drawings",
   // read a steel drawing into an interactive 3D model (bake the viewer-3d scene)
+  "floless-app-steel-takeoff",
+  // read a steel drawing into an editable steel.takeoff/v1 contract (the Steel Takeoff reader)
   "floless-app-tweak-contract",
   // handle a tweak-contract request from the steel-takeoff contract editor (Slice 2 AI round-trip)
   "floless-app-ui",
@@ -58147,7 +58167,7 @@ async function startServer() {
     return { ok: true, app: readApp(req.params.id) };
   });
   app.get("/api/contract/:appId", async (req, reply) => {
-    const doc2 = readContract(req.params.appId);
+    const doc2 = readContractForApp(req.params.appId);
     if (doc2 == null) return reply.status(404).send({ ok: false, error: "no contract for this app yet" });
     return doc2;
   });
@@ -58732,6 +58752,7 @@ async function startServer() {
     { bodyLimit: 25 * 1024 * 1024 },
     async (req, reply) => {
       const { appId, inputName, instruction, snapshots } = req.body ?? {};
+      const sourceName = typeof req.body?.sourceName === "string" ? req.body.sourceName : void 0;
       if (!appId) return reply.status(400).send({ ok: false, error: "appId required" });
       let decoded;
       try {
@@ -58740,7 +58761,7 @@ async function startServer() {
         return reply.status(400).send({ ok: false, error: e instanceof Error ? e.message : "bad snapshot" });
       }
       const request = addRequest(
-        { type: "rebake", appId, ...inputName ? { inputName } : {}, instruction: instruction || REBAKE_INSTRUCTION },
+        { type: "rebake", appId, ...inputName ? { inputName } : {}, ...sourceName ? { sourceName } : {}, instruction: instruction || REBAKE_INSTRUCTION },
         decoded
       );
       broadcast({ type: "request-added", request });

package/dist/schemas/steel.takeoff.v1.schema.json

@@ -23,6 +23,18 @@
       },
       "description": "sheet -> { detail number -> normalized [fx,fy] bubble anchor }."
     },
+    "source": {
+      "type": "object",
+      "description": "Provenance: where this takeoff was read from.",
+      "properties": {
+        "name":    { "type": "string" },
+        "path":    { "type": "string" },
+        "sheet":   { "type": "string" },
+        "sha256":  { "type": "string" },
+        "read_at": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
     "plans": { "type": "array", "items": { "$ref": "#/$defs/plan" } }
   },
   "$defs": {

package/dist/skills/floless-app-steel-takeoff/SKILL.md

@@ -0,0 +1,266 @@
+---
+name: floless-app-steel-takeoff
+description: Read a structural steel drawing into an editable steel.takeoff/v1 contract in floless.app — the "Steel Takeoff" reader. Triggers on a pending floless `rebake` request for the `steel-takeoff` app (queued from its "Re-read & re-bake ▸" button), or asks like "read this framing plan into a takeoff", "turn this structural drawing into a takeoff", "bake my drawing into steel-takeoff", "extract members from this PDF". Teaches the host AI to READ a steel drawing (PDF/image) with its own vision at COMPOSE time, build a steel.takeoff/v1 contract (members + profiles + elevations + weights from AISC lookup), write it to the contract store, and hand control to the editor — no model in the run path, no API key.
+metadata:
+  version: 0.1.0
+---
+
+# Steel Takeoff — read a drawing into a steel.takeoff/v1 contract
+
+## What this is
+
+`steel-takeoff` is a FloLess app that turns a structural steel drawing into an editable
+**takeoff contract** — members, profiles, AISC weights, T.O. elevations, connection detail refs
+— rendered in the overlay editor, then baked at Approve into the app's `read` node.
+
+The drawing is read **at compose time** with your own vision. There is **no model in the run
+path and no API key** — the brain is you, in the terminal (the FloLess thin-UI contract). The
+deterministic run only renders the approved result.
+
+**Downstream outputs** (on the same canvas, triggered separately) are a 3D stick model
+(`viewer-3d`, from the Approve bake), an IFC file, a Tekla bake, and a formatted BOM — but
+this skill's job ends at producing and handing off the takeoff contract. Mention those as "next"
+but do not attempt them here.
+
+> **Pasted a request?** If the user pastes a message beginning with a `[floless-request
+> type=rebake id=…]` marker, that's a request copied from the FloLess Dashboard — resolve it
+> via `GET /api/requests` (match the id), don't run the pasted line verbatim, and `DELETE` it
+> when done.
+
+---
+
+## The loop
+
+### 1. Find the drawing
+
+From a `rebake` request: `GET http://localhost:<port>/api/requests` → the entry with
+`type:"rebake"` and `appId:"steel-takeoff"` carries `snapshots: ["<abs path>"]` (the drawing
+file) and optionally `sourceName` (the original filename — use it for the `source.name`
+provenance field). If the user just attaches or points at a drawing in prose, skip the lookup
+and proceed from that path.
+
+### 2. Read it with your own vision — the heavy pipeline
+
+Follow the methodology condensed here (full detail + every gotcha in
+`docs/superpowers/specs/2026-06-17-steel-takeoff-agent-guidance.md`):
+
+1. **Sheet index.** If it's a multi-sheet PDF, read the index sheet (e.g. `S-100`) once with
+   vision to build a `sheet → page` map. Focus the takeoff on one or a few framing plan sheets
+   (Foundation, Floor, Roof); say which.
+2. **Tile the framing area** in display space (e.g. 4×3 grid, render scale ~2.0). Record each
+   tile's display origin and extent.
+3. **Geometry (exact).** `page.get_drawings()` → keep member-scale line segments (~8–45 ft) in
+   display coords, tagged H/V/D. These are the candidate members and the snap targets.
+4. **Labels (vision — parallel subagents).** Read section labels per tile; each subagent returns
+   **normalized fractions [0..1]** (not pixel coordinates — pixels from a subagent are
+   scale-ambiguous) plus orientation (`H`/`V`/`D`). Convert to display, dedup.
+   - **Skew bays get their OWN dedicated pass — they are the most-skipped members.** A skewed/angled
+     framing bay read together with the orthogonal grid loses its diagonal members (the orthogonal
+     pass "swallows" them, and free-hand label positions don't bind to the diagonal lines).
+   - **Reliable skew method = bind to the EXACT diagonal geometry, don't free-place.** This is the
+     technique that works (proven on S-202):
+     1. From step 3, take the `D` member-scale segments (the exact diagonal geometry) and their
+        bounding box — that's the skew bay.
+     2. Render that bbox at high DPI and **draw the `D` segments over it, each NUMBERED** at its
+        midpoint (red line + index 0..N).
+     3. One vision pass over that numbered image maps **each segment index → its label** (chords are
+        typically the short collinear sub-segments = `W16X26`; the long perpendicular rungs =
+        `W21X62`/`W12X19`; `MF` where it's a moment mark). Give the reader the per-segment length to
+        disambiguate chord-vs-rung.
+     4. Build one member per `D` segment using the segment's OWN endpoints as the work-points (so the
+        member lands exactly on the drawn line), profile from the map, AISC weight via lookup.
+     5. Replace any earlier free-placed diagonal members in the bay (members whose *real* orientation
+        is diagonal) with these exact ones. Cross-check: `D`-segment count ≈ diagonal members — a
+        pile of unbound `D` segments means skew is still missed.
+5. **Bind** each label to the nearest matching segment (within tolerance, orientation penalty on
+   mismatch). **Bind `D` labels to `D` segments** (don't let a diagonal label grab a nearby
+   orthogonal grid line). Segments that remain unbound are the coverage queue (the human's markup
+   worklist) — a pile of unbound `D` segments means skew was missed; go back to step 4.
+6. **Work-point extend.** Extend each bound segment's drawn-short ends to the centerline
+   intersection of connecting members (line–line intersection, capped reach). This closes joints
+   and is skew-proof.
+7. **AISC lookup for weights.** Call the `steel-detailer-us` AWARE agent's `lookup` verb for
+   each distinct profile designation → `plf` (pounds per linear foot). Build `weights: {
+   profile → plf }`. Unresolved → `rfi: true`, weight omitted. Verify the lookup is live with a
+   known section (e.g. W16X26 → 26 lb/ft) before trusting a full run — `~/.aware` rules can
+   vanish on agent re-update (see gotcha §6 of the guidance spec).
+8. **Dedupe coincident members.** Two labels binding the same segment (a W-size + its `MF` mark,
+   or overlapping tile reads) emit coincident members that double-count the BOM. Collapse members
+   with identical work-points (order-independent, ~3px tol), keeping the most-resolved one. (The
+   editor ALSO auto-dedupes coincident members on load as a safety net — but produce a clean
+   contract here; don't lean on it.)
+9. **Cross-sheet sources.** Frame Elevation sheets → moment-frame schedule (resolve `MF` marks),
+   level datums (Ground / Second Floor / Roof elevations). Roof framing → per-zone T.O. STEEL
+   callouts. See guidance spec §5 for what each sheet gives you.
+
+**Hard-won gotchas (from the guidance spec § 6 — do not skip these):**
+- **Text is outlined, not real text.** `get_text()` returns almost nothing. Everything textual
+  needs vision.
+- **Pages may be rotated (e.g. 270°).** Work entirely in display space via
+  `page.rotation_matrix`. Never mix native/display coords — this is the single biggest source of
+  misplaced members.
+- **Subagent reads must return normalized fractions, one pass, no sub-cropping.** Pixel coords
+  from a subagent collapse after downscaling.
+- **`MF` / `BF` are marks, not profiles.** No AISC section until resolved from Frame Elevations
+  by grid + level. Leave as `rfi` and `mf: true` until auto-resolved or the user picks.
+- **AISC rules can vanish.** Verify `steel-detailer-us` with a known section before a full run
+  (`W16X26 → 26 lb/ft`); if every member comes back weightless, restore `rules/aisc-shapes-v15.json`
+  into the installed agent dir from the aware-aeco repo. Seen cause: the agent was renamed
+  `steel-detailer-aisc → steel-detailer-us`, so an old lookup binary points at a dir that no longer
+  exists — make sure you're calling the current `steel-detailer-us` and its rules dir is populated.
+- **Half-grids have no plan coordinate.** Auto-resolve only confident cases; surface the rest in
+  the `rfi` panel.
+- **Detail callout detection misreads numbers/sheets.** Verify at high zoom before trusting
+  (both the number and the sheet can be wrong).
+- **`(N)` = new, `(E)` = existing (often out of scope).** Read the full set for context before
+  deciding.
+
+### 3. Honor `target_confidence`
+
+Read the app's `target_confidence` input (default 70). The confidence score is a **deterministic
+function of observable evidence** — not model self-report. Full method in
+`docs/superpowers/specs/2026-06-20-steel-takeoff-confidence-report.md`; the short summary:
+
+- **Verified (100%)** — human-confirmed.
+- **High (≥80%)** — fully resolved from drawing evidence, no contradiction.
+- **Medium (50–79%)** — one indirection (mark→schedule) or assumed elevation.
+- **Low (<50%)** — duplicate group, weak bind, half-grid, conflicting sources.
+- **RFI (0%)** — no AISC size resolved.
+
+Aggregate confidence = average of per-element scores over the detected set (members with
+resolved profiles + elevations; RFI members drag it down). **Loop**: re-read low-confidence
+regions (re-tile at higher zoom, re-run AISC lookup) until aggregate ≥ `target_confidence` OR
+the returns are clearly diminishing. Be honest if you stop below target — it's a triage guide,
+not a hard gate. The user decides whether to Approve.
+
+### 4. Assemble the `steel.takeoff/v1` contract
+
+Emit a JSON object matching the schema in `schemas/steel.takeoff.v1.schema.json`. Top-level
+required fields: `type: "steel.takeoff/v1"` (discriminator), `plans` (array of plan objects).
+Important optional fields:
+
+```jsonc
+{
+  "type": "steel.takeoff/v1",
+  "source": {
+    "name": "<sourceName or basename of the drawing path>",
+    "path": "<absolute path you read>",
+    "sheet": "<e.g. S-202>",
+    "sha256": "<sha256 of the file if available>",
+    "read_at": "<ISO 8601 timestamp>"
+  },
+  "weights": { "W16X26": 26, "HSS6X6X3/8": 27.48 },   // profile → plf; null for unresolved
+  "moment_frames": [ … ],                               // from Frame Elevation sheets
+  "detail_bubbles": { "S-504": { "5": [0.32, 0.71] } }, // sheet → { number → [fx,fy] }
+  "plans": [
+    {
+      "sheet": "S-202",
+      "title": "Second Floor Framing Plan",
+      "clip": [x0, y0, x1, y1],          // display-space crop of framing area
+      "pt_per_ft": 12.3,
+      "default_tos": 198,                 // decimal inches (16'-6" = 198)
+      "raster_b64": "…",                 // CONFIDENTIAL — machine-local, never committed
+      "segments": [ { "id": "seg-1", "a": [x,y], "b": [x,y], "o": "H" } ],
+      "labels":   [ { "text": "W16X26", "disp": [x,y] } ],
+      "details":  [ { "text": "5-S504",  "disp": [x,y] } ],
+      "tos_callouts": [ { "elev_in": 198, "type": "TOS", "disp": [x,y] } ],
+      "members": [
+        {
+          "id": "m1",
+          "profile": "W16X26",
+          "wp": [[x0,y0],[x1,y1]],
+          "angle": "H",
+          "role": "beam",
+          "rfi": false,
+          "mf": false,
+          "ends": [
+            { "tos": 198, "note": "moment", "tosDef": false, "detail": "5-S504" },
+            { "tos": 198, "note": "shear",  "tosDef": true,  "detail": "" }
+          ]
+        },
+        {
+          "id": "c1",
+          "profile": "HSS6X6X3/8",
+          "wp": [[x,y0],[x,y1]],
+          "angle": "V",
+          "role": "column",
+          "rfi": false,
+          "col": { "bos": 0, "tos": 198, "note": "", "detail": "" }
+        }
+      ]
+    }
+  ]
+}
+```
+
+Key field rules:
+- All `wp` / `disp` / `a` / `b` coordinates are **display space** (not native PDF coords, not
+  millimetres).
+- Elevations are **decimal inches** (canonical); the editor accepts/displays ft-in strings.
+  `tosDef: false` means the value came from a drawing callout; `true` means it follows the plan
+  default.
+- `rfi: true` means no AISC size resolved — excluded from the BOM. `mf: true` marks a
+  moment-frame member (persistent; survives AISC resolution).
+- `raster_b64` is a base64 JPEG of the framing area (title block excluded). It is
+  **machine-local** and **never committed**.
+
+### 5. Write to the contract store
+
+```
+PUT http://localhost:<port>/api/contract/steel-takeoff
+Content-Type: application/json
+
+<contract JSON body>
+```
+
+The server schema-validates the body. If it responds with `400`, read the error, fix the
+offending fields, and re-PUT. You can read back the current contract with
+`GET /api/contract/steel-takeoff`.
+
+### 6. Hand off to the user
+
+Tell the user:
+- What you read (e.g. "read 14 beams and 6 columns on sheets S-201/S-202; 3 MF members await
+  Frame-Elevation resolution; aggregate confidence 78% — above your 70% target").
+- **Open the editor**: double-click the `read` node (or the takeoff node) in the FloLess
+  canvas. The editor renders the overlay, the member list, the RFI panel, and the confidence
+  report so they can verify and correct.
+- **Approve & bake lock**: when satisfied, click Approve in the editor. Approve bakes the
+  contract into the `read` node's `config.takeoff` and recompiles; the Run gate disarms until
+  approved. After approval, the 3D view and BOM nodes render from the baked contract.
+- **Freeze** the `read` node (right-click → Freeze, or `aware app freeze`) once it's approved
+  so a future re-read won't overwrite it until they explicitly unfreeze.
+- What's next: the 3D view (`view` node), IFC export, Tekla bake, and formatted BOM are on the
+  same canvas and follow from Approve.
+
+### 7. Clear the request
+
+If the trigger came from a `rebake` request:
+
+```
+DELETE http://localhost:<port>/api/requests/<id>
+```
+
+### 8. Confidentiality
+
+Never write client, firm, or project identifiers into files, commits, or responses. The
+contract carries the source path in `source.path` and an embedded raster in `raster_b64` — both
+are machine-local (stored under `~/.floless/contracts/steel-takeoff.json` by the server and
+never committed). Clip title blocks from any embedded preview.
+
+---
+
+## Guardrails
+
+- **Compose-time only.** The drawing is read HERE, by you, then PUT to the store. Never add a
+  runtime node that reads the drawing — `aware app validate` rejects it, and it breaks
+  determinism.
+- **Contract, not scene.** This skill produces a `steel.takeoff/v1` contract. The 3D scene
+  derives from it at Approve (`contract-to-scene`); do not manually assemble the 3D scene here.
+- **Thin-UI contract.** The browser recorded intent and the drawing path; the brain is you, in
+  the terminal. The UI never reads the drawing and never writes the contract directly.
+- **Honest about gaps.** Unbound segments are the human's worklist, not an error. State
+  assumptions (plan-default elevations, assumed heights, unresolved MF marks). Never fabricate
+  sizes or grid positions the drawing does not show.
+- **Resolve the port** from the running floless.app the same way other floless-app skills do
+  (check `~/.floless/port` or the active server port).

package/dist/skills/floless-app-workflows/SKILL.md

@@ -166,6 +166,31 @@ Two rules that bite immediately:
   whatever the node returns.
 - **No `System.Net`** (so no `WebUtility.HtmlEncode`) — escape with a manual lambda.
 
+## Every node's Description must be plain English (HARD guardrail)
+
+The Inspect → **Description** tab is written **for non-coders**: it must always say, in plain
+English, *what the node does* — never raw code, markup, or jargon (CLAUDE.md standing rule).
+When authoring a `.flo`, that is **your** job, node by node:
+
+- **Each `exec` node's Description IS its leading `//` comment.** `web/aware.js` `leadingComment()`
+  derives both the Description paragraph and the card blurb from the comment block at the top of
+  `config.code`. So **start every exec `code:` with a 1–2 sentence plain-English comment** that
+  explains what the node does for someone who can't read C# — e.g.
+  `// Reads the chosen phase and builds the bill of materials as an HTML table.` A node with no
+  leading comment falls back to a generic "read-mode exec node" line — that's the rubbish this
+  rule forbids. (You may *mention* a `{{ upstream.result.x }}` knob in the prose, but never let a
+  description be *only* a bare `{{ … }}` ref — and remember braces inside `code` are a run-time
+  footgun, see the templating note above.)
+- **The workflow itself needs a plain-English top-level `description:`** (a paragraph saying what
+  the app is for) — it's required, not decorative.
+- **Don't rely on the display layer to save you.** The Inspect tab summarizes oversized/baked blob
+  *inputs* (e.g. a baked `args.html` → `baked HTML · 223 KB`) so they never dump raw markup — but
+  that's a safety net for input *values*, not a license to skip the node's own plain-English
+  description.
+- **Enforced in CI:** `npm run verify:flo` (`server/build/verify-flo-descriptions.mjs`) fails the
+  build if any committed `demos/*/*.flo` ships a node with no plain-English Description. Run it
+  before you call a `.flo` done.
+
 ## The build loop (install → validate → compile → run)
 
 Resolve the `aware` CLI the same way the adapter does: prefer the npm global
@@ -377,6 +402,9 @@ past a few hard facts, split it into a `references/` file and link it.
 
 ## Guardrails (do not drift)
 
+- **Every node's Description is plain English** — each exec node opens with a 1–2 sentence
+  plain-English `//` comment (its Description), and the app has a plain-English `description:`.
+  Enforced by `npm run verify:flo` in CI. See "Every node's Description must be plain English".
 - Determinism is AWARE's: `<app>.lock` is the approved artifact; Run is gated on a fresh
   source-hash. Never let the UI run on drift.
 - Any change under `web/` requires a Playwright pass (visual + interaction), not just a check of

package/dist/web/aware.js

@@ -1073,12 +1073,13 @@
     });
     if (!res) return;
     const dataUrl = res[name];
+    const sourceName = res[name + '__filename'] || undefined;
     if (typeof dataUrl !== 'string' || !dataUrl.startsWith('data:')) { showToast('attach a drawing to re-bake', 'warn'); return; }
     try {
       const r = await fetch('/api/rebake', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ appId: app.id, inputName: name, snapshots: [{ dataUrl }] }),
+        body: JSON.stringify({ appId: app.id, inputName: name, ...(sourceName ? { sourceName } : {}), snapshots: [{ dataUrl }] }),
       });
       const out = await r.json().catch(() => ({ ok: false, error: `re-bake failed (${r.status})` }));
       if (!out || !out.ok) { showToast((out && out.error) || 'could not queue re-bake', 'err'); return; }
@@ -1417,6 +1418,9 @@
       Object.assign(document.createElement('span'), { textContent: appId, style: 'color:var(--text);font-weight:600' }),
       Object.assign(document.createElement('span'), { textContent: ' · ' + type, style: 'color:var(--text-muted)' }),
     );
+    // Focus the iframe once it loads so its keyboard shortcuts (Ctrl+D, etc.) work without
+    // the user first having to click inside it.
+    $contractEditorFrame.onload = () => { try { $contractEditorFrame.contentWindow.focus(); } catch (_) {} };
     $contractEditorFrame.src = r.editorUrl(appId);
     $contractEditor.hidden = false;
     return true;
@@ -1956,7 +1960,11 @@
         const out = {};
         $body.querySelectorAll('[data-fm]').forEach((el) => { out[el.dataset.fm] = el.value; });
         imageStates.forEach((entry, name) => { out[name] = entry.state; });
-        fileStates.forEach((entry, name) => { out[name] = entry.st.mode === 'empty' ? '' : entry.st.value; });
+        fileStates.forEach((entry, name) => {
+          out[name] = entry.st.mode === 'empty' ? '' : entry.st.value;
+          // expose filename alongside so callers can capture provenance (e.g. rebake → sourceName)
+          out[name + '__filename'] = entry.st.name || '';
+        });
         return out;
       };
       const done = (result) => {

package/dist/web/steel-editor.html

@@ -2,6 +2,13 @@
 <title>Steel takeoff — editor</title>
 <style>
  :root{--bg:#0f172a;--panel:#1e293b;--line:#334155;--text:#e2e8f0;--mut:#94a3b8;--brand:#3b82f6}
+ /* Theme EVERY scrollbar — no native white default may leak (applies to the canvas, panels, and every modal list). */
+ *{scrollbar-width:thin;scrollbar-color:#475569 transparent}
+ *::-webkit-scrollbar{width:10px;height:10px}
+ *::-webkit-scrollbar-track{background:transparent}
+ *::-webkit-scrollbar-thumb{background:#475569;border-radius:6px;border:2px solid transparent;background-clip:content-box}
+ *::-webkit-scrollbar-thumb:hover{background:#5b6b85;background-clip:content-box}
+ *::-webkit-scrollbar-corner{background:transparent}
  *{box-sizing:border-box} body{margin:0;background:var(--bg);color:var(--text);font:13px system-ui;height:100vh;display:flex;flex-direction:column}
  header{display:flex;align-items:center;gap:14px;padding:8px 14px;background:var(--panel);border-bottom:1px solid var(--line)}
  header b{font-size:14px} .stat{color:var(--mut)} .stat b{color:var(--text)}
@@ -134,7 +141,8 @@
  <span class=stat id=rfiStat title="Click to list unresolved members (RFI)">RFI <b id=rc>0</b></span>
  <span class=stat id=dupStat title="Overlapping/duplicate members (same geometry)">Dup <b id=dpc>0</b></span>
  <span class=stat id=confStat title="Confidence report — score each AI-read element by evidence" style="display:none">Confidence <b id=confPct>—</b></span>
- <span class=stat id=saveStat title="Edits auto-save in this browser (localStorage)">Saved</span><span style="flex:1"></span>
+ <span class=stat id=saveStat title="Edits auto-save in this browser (localStorage)">Saved</span>
+ <span class=stat id=srcStat style="display:none"></span><span style="flex:1"></span>
  <button id=undoB title="Undo (Ctrl+Z)">↶</button>
  <button id=redoB title="Redo (Ctrl+Y / Ctrl+Shift+Z)">↷</button>
  <button id=dupB title="Select duplicate (overlapping) members — review then Delete to dedupe">Duplicates</button>
@@ -207,6 +215,9 @@
 <script>
 const APP_ID = new URLSearchParams(location.search).get('app') || '';
 let C, PAL, WT;
+// Fallback palette (colorFor indexes this array by profile order) when a contract ships no `palette`
+// — e.g. a contract shared/committed with raster_b64 + palette stripped for confidentiality.
+const DEFAULT_PAL=['#60a5fa','#94a3b8','#f59e0b','#34d399','#f472b6','#a78bfa','#fb7185','#22d3ee','#facc15','#4ade80'];
 let lastLocalPut = 0; // timestamp of our own PUT — used to suppress the SSE echo
 function showEmpty(icon, headline, bodyText, appIdText) {
   const wrap = document.createElement('div');
@@ -231,7 +242,7 @@ async function boot() {
     return;
   }
   C = await res.json();
-  PAL = C.palette; WT = C.weights;
+  PAL = (Array.isArray(C.palette) && C.palette.length) ? C.palette : DEFAULT_PAL; WT = C.weights || {};
   C.custom_details = C.custom_details || {};
   C.profile_colors = C.profile_colors || {};
   main();
@@ -421,6 +432,12 @@ function toSvg(e){const p=svg.createSVGPoint();p.x=e.clientX;p.y=e.clientY;retur
 // --- zoom + pan ---
 const ZMIN=0.1, ZMAX=4;
 let zoom=1; const stage=document.getElementById('stage');
+// The editor runs in an iframe; keyboard shortcuts (Ctrl+D etc.) only reach our handler when the
+// iframe has focus. The SVG canvas isn't focusable, so clicking it wouldn't grab focus and a real
+// Ctrl+D would hit the browser (bookmark) instead. Make the canvas focusable + grab focus on any
+// pointerdown so shortcuts work after the user clicks into the drawing.
+stage.tabIndex=-1; stage.style.outline='none';
+stage.addEventListener('pointerdown',()=>{try{stage.focus({preventScroll:true});}catch(_){}}, true);
 function applyZoom(z,ax,ay){z=Math.max(ZMIN,Math.min(ZMAX,z));
  const pt=(ax!=null)?toSvg({clientX:ax,clientY:ay}):null;
  zoom=z;svg.setAttribute('width',EXTX*zoom);svg.setAttribute('height',EXTY*zoom);
@@ -437,7 +454,7 @@ function doDup(){const arr=selArr();if(!arr.length)return;const o=12,pv=snapshot
 function esc(s){return String(s).replace(/[<>&"]/g,c=>({'<':'&lt;','>':'&gt;','&':'&amp;','"':'&quot;'}[c]));}
 function render(){
  if(geoMode&&selIds.size!==1){geoMode=null;document.body.classList.remove('geo');}   // geo edit needs exactly one member
- let s=`<image href="data:image/jpeg;base64,${RB64}" x="${X0}" y="${Y0}" width="${X1-X0}" height="${Y1-Y0}"/>`;
+ let s=RB64?`<image href="data:image/jpeg;base64,${RB64}" x="${X0}" y="${Y0}" width="${X1-X0}" height="${Y1-Y0}"/>`:'';
  for(const sg of P.segments) s+=`<line class=seg data-seg="${sg.id}" x1="${sg.a[0]}" y1="${sg.a[1]}" x2="${sg.b[0]}" y2="${sg.b[1]}"/>`;
  for(const m of P.members){const c=colorFor(m.profile);const on=selIds.has(m.id);const g=on?` style="filter:drop-shadow(0 0 3px ${c}) drop-shadow(0 0 8px ${c})"`:'';
    s+=`<line class="member${m.rfi?' rfi':''}${on?' sel':''}" data-id="${m.id}" x1="${m.wp[0][0]}" y1="${m.wp[0][1]}" x2="${m.wp[1][0]}" y2="${m.wp[1][1]}" stroke="${c}"${g}/>`;}
@@ -574,17 +591,28 @@ function rectHit(p0,p1,r){
  for(let i=0;i<4;i++) if(segSeg(p0,p1,c[i],c[(i+1)%4])) return true;
  return false;}
 // --- snap to existing member/segment endpoints (members lie on grids → snaps to grid intersections); Alt = off ---
-const SNAP_PX=9; let snapPts=[];
+const SNAP_PX=9; let snapPts=[], snapSegs=[];
 function buildSnap(except){const ex=except instanceof Set?except:(except!=null?new Set([except]):new Set());   // id or Set of ids to skip
- snapPts=[];for(const m of P.members){if(ex.has(m.id))continue;snapPts.push(m.wp[0],m.wp[1]);}for(const s of P.segments){snapPts.push(s.a,s.b);}}
+ snapPts=[];snapSegs=[];
+ for(const m of P.members){if(ex.has(m.id))continue;snapPts.push(m.wp[0],m.wp[1]);snapSegs.push([m.wp[0],m.wp[1]]);}
+ for(const s of P.segments){snapPts.push(s.a,s.b);snapSegs.push([s.a,s.b]);}}
+// nearest point lying ON another member/segment LINE (perpendicular foot, clamped to the segment) within tol
+function nearestOnLine(x,y,tol){let bp=null,bd=tol;
+ for(const sg of snapSegs){const pr=projPt([x,y],sg[0],sg[1]);const d=Math.hypot(pr.pt[0]-x,pr.pt[1]-y);if(d<bd){bd=d;bp=pr.pt;}}
+ return bp?{x:bp[0],y:bp[1],d:bd}:null;}
 function snap(x,y){const tol=SNAP_PX/zoom;let bp=null,bd=tol;
  for(const q of snapPts){const d=Math.hypot(q[0]-x,q[1]-y);if(d<bd){bd=d;bp=q;}}
- if(bp)return {x:bp[0],y:bp[1],hit:true};
- let sx=x,sy=y,bx=tol,by=tol;
+ if(bp)return {x:bp[0],y:bp[1],hit:true};                                  // 1) snap to an endpoint/grid intersection
+ const ln=nearestOnLine(x,y,tol);if(ln)return {x:ln.x,y:ln.y,hit:true};    // 2) else snap ONTO a line (not only its endpoints)
+ let sx=x,sy=y,bx=tol,by=tol;                                              // 3) else axis-align to a nearby point
  for(const q of snapPts){const dx=Math.abs(q[0]-x);if(dx<bx){bx=dx;sx=q[0];}const dy=Math.abs(q[1]-y);if(dy<by){by=dy;sy=q[1];}}
  return {x:sx,y:sy,hit:false};}
 function snapMark(x,y){let c=document.getElementById('snapMark');if(!c){c=document.createElementNS('http://www.w3.org/2000/svg','circle');c.id='snapMark';c.setAttribute('class','snapmk');svg.appendChild(c);}c.setAttribute('cx',x);c.setAttribute('cy',y);c.setAttribute('r',6/zoom);}
 function snapClear(){const c=document.getElementById('snapMark');if(c)c.remove();}
+// themed transient toast (baseline tokens — never a native alert)
+function toast(msg){let t=document.getElementById('toast');
+ if(!t){t=document.createElement('div');t.id='toast';t.style.cssText='position:fixed;left:50%;bottom:18px;transform:translateX(-50%);background:var(--panel);color:var(--text);border:1px solid var(--line);border-radius:8px;padding:8px 14px;box-shadow:0 6px 20px rgba(0,0,0,.5);z-index:60;font:13px system-ui;opacity:0;transition:opacity .2s;pointer-events:none';document.body.appendChild(t);}
+ t.textContent=msg;t.style.opacity='1';clearTimeout(t._h);t._h=setTimeout(()=>{t.style.opacity='0';},2600);}
 // --- pointer: select(+ctrl toggle / box) + group-move + endpoint (Shift = ortho) ---
 svg.addEventListener('pointerdown',e=>{if(e.button!==0)return;const t=e.target;
  if(geoMode&&selIds.size===1){const id=[...selIds][0],m=byId(id);
@@ -631,9 +659,10 @@ svg.addEventListener('pointermove',e=>{
    drag.rect.setAttribute('x',x);drag.rect.setAttribute('y',y);drag.rect.setAttribute('width',w);drag.rect.setAttribute('height',h);drag.cur=[x,y,x+w,y+h];return;}
  if(drag.type==='move'){let dx=p.x-drag.start[0],dy=p.y-drag.start[1];
    if(e.shiftKey){if(Math.abs(dx)>=Math.abs(dy))dy=0;else dx=0;snapClear();}
-   else if(!e.altKey){let best=null,bd=SNAP_PX/zoom;                  // shift the group so its nearest endpoint lands on a snap target
+   else if(!e.altKey){let best=null,bd=SNAP_PX/zoom;                  // shift the group so a moving endpoint lands on a snap target (endpoint OR line)
      for(const it of drag.items)for(const o of [it.o0,it.o1]){const nx=o[0]+dx,ny=o[1]+dy;
-       for(const q of snapPts){const d=Math.hypot(q[0]-nx,q[1]-ny);if(d<bd){bd=d;best={q,cx:q[0]-nx,cy:q[1]-ny};}}}
+       for(const q of snapPts){const d=Math.hypot(q[0]-nx,q[1]-ny);if(d<bd){bd=d;best={q,cx:q[0]-nx,cy:q[1]-ny};}}
+       const ln=nearestOnLine(nx,ny,bd);if(ln){bd=ln.d;best={q:[ln.x,ln.y],cx:ln.x-nx,cy:ln.y-ny};}}  // also snap onto other lines
      if(best){dx+=best.cx;dy+=best.cy;snapMark(best.q[0],best.q[1]);}else snapClear();}
    else snapClear();
    for(const it of drag.items){const m=byId(it.id);if(!m)continue;
@@ -956,9 +985,27 @@ document.addEventListener('keydown',e=>{if(!comboInput||comboPop.style.display==
  e.preventDefault();e.stopPropagation();opts.forEach((o,i)=>o.classList.toggle('active',i===comboIdx));if(comboIdx>=0)opts[comboIdx].scrollIntoView({block:'nearest'});},true);
 // --- multi-plan: switch between all steel plan views ---
 function setPlan(i){C.active=i;P=C.plans[i];
- X0=P.clip[0];Y0=P.clip[1];X1=P.clip[2];Y1=P.clip[3];FT=P.pt_per_ft;RB64=P.raster_b64;EXTX=X1-X0;EXTY=Y1-Y0;
+ if(!Array.isArray(P.members))P.members=[];
+ if(!Array.isArray(P.segments))P.segments=[];
+ // clip = the drawing's display-space crop. A contract may ship WITHOUT a raster/clip (a shared or
+ // committed contract strips raster_b64 for confidentiality), so fall back to the members' bounding
+ // box (padded) → the editor renders members on a blank canvas instead of crashing on P.clip[0].
+ let clip=P.clip;
+ if(!Array.isArray(clip)||clip.length<4){
+  const xs=[],ys=[];for(const m of P.members)for(const pt of (m.wp||[])){xs.push(pt[0]);ys.push(pt[1]);}
+  if(xs.length){const pad=Math.max(200,(Math.max(...xs)-Math.min(...xs))*0.1);
+    clip=[Math.min(...xs)-pad,Math.min(...ys)-pad,Math.max(...xs)+pad,Math.max(...ys)+pad];}
+  else clip=[0,0,1000,1000];}
+ X0=clip[0];Y0=clip[1];X1=clip[2];Y1=clip[3];FT=P.pt_per_ft||12;RB64=P.raster_b64||'';EXTX=X1-X0;EXTY=Y1-Y0;
  svg.setAttribute('viewBox',`${X0} ${Y0} ${X1-X0} ${Y1-Y0}`);
  P.members.forEach(ensureMeta);
+ // Auto-dedupe coincident members on first load of each plan — the read can bind one segment to
+ // two labels (a W-size + its MF mark) or overlap tile reads, producing stacked duplicates that
+ // double-count the BOM. Collapse them automatically (keep the most-resolved copy), undoable, once
+ // per plan. The "Duplicates" button stays for any made while editing.
+ if(!P.deduped){P.deduped=true;const red=new Set(redundantDups());
+   if(red.size){(P.undo=P.undo||[]).push(JSON.stringify(P.members));P.members=P.members.filter(m=>!red.has(m.id));
+     scheduleSave();setTimeout(()=>toast('Auto-removed '+red.size+' duplicate member'+(red.size>1?'s':'')),60);}}
  profs=[...new Set([...P.members.map(m=>m.profile), ...Object.keys(WT)])].sort();
  undo=P.undo||(P.undo=[]);redo=P.redo||(P.redo=[]);
  selIds=new Set();picking=false;pickKind='profile';pickEnd=null;mode='sel';geoMode=null;
@@ -974,6 +1021,18 @@ document.getElementById('revertB').onclick=()=>{if(confirm('Discard ALL saved ed
 const _restored=restoreSaved();                         // bring back this browser's saved edits before first paint
 setPlan(C.active==null?0:C.active);
 setSaved(_restored?'ok':'idle', _restored?'Restored ✓':'Auto-save on');
+try{stage.focus({preventScroll:true});}catch(_){}   // grab keyboard focus on open so shortcuts work before the first click
+// --- provenance caption: show contract.source when present (read from <name> · <sheet> · <read_at>) ---
+(function(){
+  const src=C.source;if(!src||typeof src!=='object')return;
+  const parts=[];
+  if(src.name)parts.push('read from '+src.name);
+  if(src.sheet)parts.push(src.sheet);
+  if(src.read_at){try{const d=new Date(src.read_at);if(!isNaN(d.getTime()))parts.push(d.toLocaleDateString());}catch{/* skip unparseable date */}}
+  if(!parts.length)return;
+  const el=document.getElementById('srcStat');if(!el)return;
+  el.textContent=parts.join(' · ');el.style.display='';
+})();
 // --- Ask AI: send instruction + optional screenshots → POST /api/contract-request ---
 // The server records a tweak-contract request; the terminal AI picks it up async and PUTs
 // back a revised contract. This is NOT a chat — the status message says so honestly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.31.3",
+  "version": "0.32.0",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {
@@ -24,6 +24,7 @@
     "build": "node build/bundle.mjs",
     "build:exe": "node build/bundle.mjs && node build/make-sea.mjs",
     "verify:skills": "node build/verify-shipped-skills.mjs",
+    "verify:flo": "node build/verify-flo-descriptions.mjs",
     "typecheck": "tsc --noEmit",
     "prepack": "npm run build"
   },