@nurix/etna 0.19.2 → 0.19.4

package/data/harnesses/code/skills/design/data/operator-pack/surface-catalog.md

@@ -22,7 +22,7 @@ This is the default archetype for the operator's primary entity — the queue sh
 
 **Density modifier.** At tier — the reference archetype. The global tier is calibrated on the operator's primary table, so list-detail runs at it unmodified.
 
-**Composition.** Toolbar (search, filters, bulk actions, column/view picker) + a virtualized table + a side-panel detail. Detail opens **beside** the table, never in a modal (floor P3). Bounded visible columns (rest behind the picker), right-aligned numerics in tabular figures (floor P4), sticky header, bounded pagination ("1–25 of 150") over infinite scroll, virtualization at ≥50 rows. Keyboard-first (floor P6): roving tabindex, arrow/j-k row travel, Enter opens the panel, shortcuts for the frequent verbs. Lifecycle states that matter most: **empty** (first-run vs filtered-to-nothing kept distinct), **loading** (skeleton rows mirroring the table, not a centered spinner), **partial/degraded** (stale rows marked honestly), and the per-row action's post-action state with optimistic-update-then-rollback.
+**Composition.** Toolbar (search, filters, bulk actions, column/view picker) + a virtualized table + a side-panel detail. Detail opens **beside** the table, never in a modal (floor f03). Bounded visible columns (rest behind the picker), right-aligned numerics in tabular figures (floor f04), sticky header, bounded pagination ("1–25 of 150") over infinite scroll, virtualization at ≥50 rows. Keyboard-first (floor f06): roving tabindex, arrow/j-k row travel, Enter opens the panel, shortcuts for the frequent verbs. Lifecycle states that matter most: **empty** (first-run vs filtered-to-nothing kept distinct), **loading** (skeleton rows mirroring the table, not a centered spinner), **partial/degraded** (stale rows marked honestly), and the per-row action's post-action state with optimistic-update-then-rollback.
 
 **Navigation.** A top-level nav item per primary entity collection — the queues and tables the operator lives in; the default landing for that entity. Detail is not a nav item; it is a panel state on the list route.
 
@@ -42,7 +42,7 @@ Selects on an overview / home / summary brief. Distinguish from command-center:
 
 **Density modifier.** One step looser — a dashboard is a glanceable aggregate; KPI cards and charts need whitespace to separate and read at a glance, not row-scan density.
 
-**Composition.** A KPI / StatCard row at the top (≤4 primary metrics visible without scrolling — answer a few questions well, not many badly) + a small number of self-contained chart/panel tiles below, each a single question with a drill link. Hierarchy from spacing, not borders. Tabular figures on every KPI number (floor P4); charts read `--chart-1..5`; color is never the only signal. Lifecycle states that matter most: **loading** (per-card skeletons, never one page spinner), **partial/degraded** (a downed source names *which* panel is stale — "can't get data" is distinct from "no data"), **empty** (new-tenant zero-state that teaches the surface's value).
+**Composition.** A KPI / StatCard row at the top (≤4 primary metrics visible without scrolling — answer a few questions well, not many badly) + a small number of self-contained chart/panel tiles below, each a single question with a drill link. Hierarchy from spacing, not borders. Tabular figures on every KPI number (floor f04); charts read `--chart-1..5`; color is never the only signal. Lifecycle states that matter most: **loading** (per-card skeletons, never one page spinner), **partial/degraded** (a downed source names *which* panel is stale — "can't get data" is distinct from "no data"), **empty** (new-tenant zero-state that teaches the surface's value).
 
 **Navigation.** The home/overview landing — typically the app root or the first nav item. It is a hub that links out; never a leaf. Its panels' drill targets are the list-detail and entity-detail routes.
 
@@ -62,7 +62,7 @@ Distinguish from list-detail: list-detail's detail is a lightweight row projecti
 
 **Density modifier.** At tier — it mixes dense read views (related lists, activity) with edit forms, so it sits at the global tier: neither a scan surface nor a pure form.
 
-**Composition.** Header (entity identity, status, primary actions) + a tab bar (overview / related collections / activity-history) + tabbed content. Related lists render as compact list-details inline; editing happens in place or opens the create-edit stepper beside the work (floor P3). Lifecycle states that matter most: **loading** (skeleton mirroring the header + tab shell), **error** (entity-not-found / load-failure with a recovery path, never a dead end), the edit **save states** (saving / saved / conflict — the concurrent-edit path from the temporal probe), and per-tab **empty** states.
+**Composition.** Header (entity identity, status, primary actions) + a tab bar (overview / related collections / activity-history) + tabbed content. Related lists render as compact list-details inline; editing happens in place or opens the create-edit stepper beside the work (floor f03). Lifecycle states that matter most: **loading** (skeleton mirroring the header + tab shell), **error** (entity-not-found / load-failure with a recovery path, never a dead end), the edit **save states** (saving / saved / conflict — the concurrent-edit path from the temporal probe), and per-tab **empty** states.
 
 **Navigation.** Not a top-level nav item — reached by drilling from its list-detail (row → entity route), a dashboard, or a command-center link. Route nests under the entity's collection (`/entities/:id`); its tabs are in-surface sub-nav, never top-level entries.
 
@@ -81,7 +81,7 @@ Create mirrors edit — the same field set and order; templates prefill. Disting
 
 **Density modifier.** One step looser — forms need field breathing room and comfortable target sizes; loosening cuts entry error on a surface where mistakes are costly.
 
-**Composition.** A side-stepper opened **beside** the originating surface (floor P3), or a full form route for long creates. Labels above inputs; errors inline below the field, validated on blur; never placeholder-as-label. Logical field order preserved; one primary CTA bottom-right; primary targets ≥44px. Preview-then-commit for irreversible creates. Lifecycle states that matter most: **validation** (inline, on blur — diagnose → explain → recover), **submitting** (button loading, double-submit disabled), **server-error** (non-dead-end, entered values preserved), **success** (confirmation plus the next step).
+**Composition.** A side-stepper opened **beside** the originating surface (floor f03), or a full form route for long creates. Labels above inputs; errors inline below the field, validated on blur; never placeholder-as-label. Logical field order preserved; one primary CTA bottom-right; primary targets ≥44px. Preview-then-commit for irreversible creates. Lifecycle states that matter most: **validation** (inline, on blur — diagnose → explain → recover), **submitting** (button loading, double-submit disabled), **server-error** (non-dead-end, entered values preserved), **success** (confirmation plus the next step).
 
 **Navigation.** Never a top-level nav item — invoked from a list-detail toolbar ("New") or an entity-detail action, and it returns to that surface on complete. A create route may exist (`/entities/new`) but is entered from the collection, not from the nav.
 
@@ -100,7 +100,7 @@ Selects on a log / event / audit / activity-feed entity — high volume, time-ke
 
 **Density modifier.** One step denser — the value of the surface is lines-on-screen; tighten to maximize visible history under one glance.
 
-**Composition.** Filter/search bar + a follow/tail toggle (live vs paused) + a virtualized monospace line list, with inline expansion of a selected line (expand in place, not a modal). Tabular timestamps and IDs (floor P4), level-coded severity via status tokens with a second non-color cue, hairline dividers, minimal chrome. Lifecycle states that matter most: **streaming/live** (new lines announced via `aria-live` without stealing focus), **empty** (no events yet vs filtered-to-nothing, kept distinct), **error** (stream disconnected shows reconnecting, never a dead spinner), **partial/degraded** (dropped or truncated buffer marked honestly).
+**Composition.** Filter/search bar + a follow/tail toggle (live vs paused) + a virtualized monospace line list, with inline expansion of a selected line (expand in place, not a modal). Tabular timestamps and IDs (floor f04), level-coded severity via status tokens with a second non-color cue, hairline dividers, minimal chrome. Lifecycle states that matter most: **streaming/live** (new lines announced via `aria-live` without stealing focus), **empty** (no events yet vs filtered-to-nothing, kept distinct), **error** (stream disconnected shows reconnecting, never a dead spinner), **partial/degraded** (dropped or truncated buffer marked honestly).
 
 **Navigation.** A top-level nav item when logs/audit/activity is a primary operator surface; otherwise a tab inside the owning entity-detail (that entity's activity/history). Time-keyed, so deep-links carry a timestamp or anchor.
 

package/data/harnesses/code/skills/design/references/create.md

@@ -16,27 +16,58 @@ The gate closing each phase runs the D21 rule classes decidable at that boundary
 
 ## intake
 
-**Purpose.** Recognize the brief, decide pack coverage, extract intent, resolve the look.
-**In → out.** the brief · the design.md library · `data/combinations/product-router.csv` (+ `typography.csv` · `palettes.csv` · `styles.csv` when the look is authored fresh) → a confirmed intent digest · a design-tokens artifact at project root (`design.tokens.json` + `design.resolver.json` — the look + lever manifest).
-**Work.** Front gate: a project-declared identity (product-type traits) wins; otherwise the signal checklist (audience is employees / agents / analysts; the metric is task throughput, not conversion; the surfaces are queues / tables / forms / monitors), with `data/combinations/product-router.csv` — loaded at every intake — as the recognition assist and the digest's density/archetype priors. Build a structured intent digest — entity list, archetype guesses, density tier, substrate — every inference marked as inferred, present it once for confirmation, and ask only strategic unknowns whose answers change the design. Resolve the look project-first: the project's own artifact wins; a library entry serves on propose-confirm (proposed from resemblance, never applied silently); zero input wears the Nurix default. When the look resolves to authoring a fresh artifact — not a library copy, not the default — load `typography.csv`, `palettes.csv`, and `styles.csv` (pairings, palettes, movement vocabulary) before composing it; the consumption contract is [combinations/Readme.md](../data/combinations/Readme.md). Materialize the resolved artifact at project root against [SCHEMA.md](../data/design-tokens/SCHEMA.md).
-**Gate — `phase-gate.mjs intake`.** The digest is confirmed and a schema-valid token artifact exists at project root. A brief no pack covers is refused here — cleanly, with a redirect — never derived.
+**Purpose.** Recognize the brief, decide pack coverage, extract intent, resolve the look — its direction, its source, and its delight ceiling.
+**In → out.** the brief · the design.md library · `data/combinations/product-router.csv` (+ `typography.csv` · `palettes.csv` · `styles.csv` when the look is authored fresh) · `docs/design/taste.yml` → a confirmed intent digest carrying the look block · a design-tokens artifact at project root (`design.tokens.json` + `design.resolver.json` — the look + lever manifest).
+**Work.** Front gate: a project-declared identity (product-type traits) wins; otherwise the signal checklist (audience is employees / agents / analysts; the metric is task throughput, not conversion; the surfaces are queues / tables / forms / monitors), with `data/combinations/product-router.csv` — loaded at every intake — as the recognition assist and the digest's density/archetype priors. Build a structured intent digest — entity list, archetype guesses, density tier, substrate, **and the mandatory look block** (below) — every inference marked as inferred, present it once for confirmation, and ask only strategic unknowns whose answers change the design. Fold look-relevant brief language into the taste profile (below) as you read it. Resolve the look through the precedence spine — **project > library (on match) > seed composition > default**, never applied unrecorded (Resolution, below): the project's own artifact wins; a library entry or a fresh seed composition is proposed-and-confirmed (interactive) or resolved-and-recorded (autonomous); `default` — the Nurix look — resolves only when the brief explicitly asks for it. When the look resolves to authoring a fresh artifact — not a library copy, not the default — load `typography.csv`, `palettes.csv`, and `styles.csv` before composing it; the consumption contract is [combinations/Readme.md](../data/combinations/Readme.md). Materialize the resolved artifact at project root against [SCHEMA.md](../data/design-tokens/SCHEMA.md) — the look block in its payload, and for a recorded resolution the resolution record in the artifact root `$description`.
+**Gate — `phase-gate.mjs intake`.** The digest is confirmed and a schema-valid token artifact exists at project root, carrying a well-formed **look block** — presence, the theme / delight / resolution-mode enums, 2–3 named anchors, the resolution shape, and (for a recorded resolution) the resolution record in the artifact root `$description`. A brief no pack covers is refused here — cleanly, with a redirect — never derived.
 **Avoid.**
 - Deriving on silently inferred facts instead of presenting the digest for one confirmation.
 - Blanket-interviewing when the brief already declares its identity — ask only strategic unknowns.
 - Attempting a marketing / storefront / mobile-native brief instead of refusing on pack coverage.
 - Authoring a fresh look without `typography.csv` / `palettes.csv` / `styles.csv` in context — a gate violation.
+- Filling `anchors` with adjectives instead of 2–3 named products — the gate rejects it; convert them first.
+- Applying a resolution unrecorded — an autonomous pick writes its record into the artifact root `$description`, or the gate fails.
+
+### The look block
+
+The intent digest carries a mandatory **look block**, filled at intake beside the entity / archetype / density fields:
+
+```yaml
+look:
+  theme: light | dark | both          # binding when the brief states it; default light
+  anchors: ["Linear", "Stripe Dashboard"]   # 2–3 NAMED real products; adjectives are not anchors
+  delight: baseline | expressive      # the global delight ceiling; per-surface budgets refine it
+  resolution: project | library:<slug> | seed:<style-row>+<palette-row> | default
+  resolution-mode: confirmed | recorded    # how the resolution was authorized (below)
+```
+
+- **`theme` is binding.** A brief-stated theme writes the payload's `theme-default`, the resolver's default context, and scaffold's `<html data-theme>`; `both` ships light-boot with a working toggle, `dark` ships dark-boot. Default light when the brief is silent.
+- **`anchors` are named products, required.** Two or three real products pin the gestalt at the direction moment — unnamed ambition drifts to beige, and ~10 tokens of product names carry what a thousand adjective-words cannot. Adjectives are not anchors: convert an adjective to its nearest named products by **asking** (interactive) or **inferring-and-recording** (autonomous) through the [design.md library](../data/design-md/library/)'s resemblance lookup, then record the named products. Anchors land in the payload so improve and `judge` critique against the same targets the run aimed at.
+- **Anchors work twice.** At resolution they drive the resemblance lookup; at the surfaces phase the anchor products' design.md entries JIT-load so composition leans toward the anchor's gestalt — composition is anchor-*steered*, not exemplar-cloned.
+
+### Resolution — propose-and-record
+
+The precedence spine serves both session modes and is **never applied unrecorded**.
+
+- **Interactive** (a confirmer is present): propose-confirm — the resolved source is proposed from resemblance and applied only on confirmation, never silently.
+- **Autonomous** (the digest's one confirmation round goes unanswered, or the brief forbids questions): resolve the best match, set `resolution-mode: recorded`, and write the **resolution record** into the artifact root `$description` — the winner, the runner-up, and the deciding evidence. For example: `resolution: library:stripe (recorded; runner-up palettes.csv#3; brief phrase "Stripe-dashboard territory" matched product + fintech traits)`. The record is auditable and reversible — an improve run can be pointed at the runner-up by consent. Nothing is silent; nothing dead-ends.
+
+**Selection is brief-keyed, never mood-keyed.** Route before judging: extract the brief's traits (domain, product type, tone words) → filter `product-router.csv` by product type and theme → a 2–3-row shortlist enters context with its `mood` prose → pick, the record naming the runner-up. Same brief → same shortlist; different domains → different pools — divergence by construction, not by model mood. `default` resolves only when the brief explicitly asks for the Nurix look; a look-less brief always composes from seeds through this routing. The taste profile biases the pick once it has content.
+
+**Seed composition partitions, never contests.** A fresh artifact composes from the routed rows by domain: the **palette** row contributes color, the **typography** row type, the **style** row treatment (`css-recipe` + `tokens-hint` + the non-token `voice`). Out-of-domain content in a row — a style row's color suggestion — is advisory prose for the composer, never a value source, so no two seeds can contest the same value. The composer closes with a deliberate **best-fit harmony pass**: do the palette, type, and treatment read as one hand, for *this* user — the taste profile is in context? Harmony is judged, not mechanical; no link exists between the dimension tables.
 
 ## structure
 
 **Purpose.** Derive the app's structure from its domain objects — never guess it.
 **In → out.** the confirmed intent digest → `docs/design/structure.md` with its fenced `yaml structure` block.
-**Work.** The object pass: entities, attributes, relationships, cardinalities, lifecycle states; the operator's unit of work and core loop. The **temporal probe runs inside the pass** — intermediate states, read-model lag, deletion semantics, history, failure paths — because they are model facts, not later polish. Then assign each surface an archetype from the closed six-catalog (`list-detail`, `dashboard`, `entity-detail`, `create-edit`, `log-stream`, `command-center`) with its density modifier — see [surface-catalog.md](../data/operator-pack/surface-catalog.md). Navigation derives from the object model; it is never decorated onto it. The OOUX failure vocabulary (Shapeshifter / Masked / Broken / Isolated) is the judged diagnostic — see [structure.md](./structure.md).
+**Work.** The object pass: entities, attributes, relationships, cardinalities, lifecycle states; the operator's unit of work and core loop. The **temporal probe runs inside the pass** — intermediate states, read-model lag, deletion semantics, history, failure paths — because they are model facts, not later polish. Then assign each surface an archetype from the closed six-catalog (`list-detail`, `dashboard`, `entity-detail`, `create-edit`, `log-stream`, `command-center`) with its density modifier — see [surface-catalog.md](../data/operator-pack/surface-catalog.md). The pass also classifies **every surface with a mandatory delight `budget`** (`baseline` / `brand-forward`) — permission is structural, decided here; defaults by archetype, overridable against a recorded reason — see [structure.md](./structure.md) (the delight budget). `scaffold.mjs` stamps the budget into each route file and `phase-gate.mjs surfaces` reads it back. Navigation derives from the object model; it is never decorated onto it. The OOUX failure vocabulary (Shapeshifter / Masked / Broken / Isolated) is the judged diagnostic — see [structure.md](./structure.md).
 **Gate — `phase-gate.mjs structure`.** The map parses; every surface carries an archetype from the catalog; the `temporal` block is present. `scaffold.mjs` consumes this block, so its shape is validated here.
 **Avoid.**
 - Skipping the object pass on a small brief — a small brief earns a proportionally small pass, never a skipped one; the skip is the characteristic failure.
 - Decorating navigation onto the UI instead of deriving it from the object model.
 - Omitting the temporal probe — intermediate states and failure paths are model facts, not afterthoughts.
 - Inventing an archetype outside the closed six.
+- Leaving a surface's delight budget to chance — classify every surface, and record the reason whenever a stamp overrides its archetype's default (caught at the surfaces gate).
 
 ## scaffold
 
@@ -53,7 +84,7 @@ The gate closing each phase runs the D21 rule classes decidable at that boundary
 
 **Purpose.** Emit the complete token surface from the resolved artifact.
 **In → out.** the design-tokens artifact → `src/styles/personality.css` + `src/styles/globals.css`.
-**Work.** Derivation is hybrid: deterministic where the artifact states a value, judgment-with-recorded-rationale for gaps (a resolved hint records its rationale in the token's `$description`). Before any typography hint is resolved, `data/combinations/typography.csv` is in context; before any color hint, `palettes.csv` — the table is the floor for the resolution, and an off-table pairing or palette is allowed only with its stated reason recorded in the token's `$description`. The **coverage gate** `derive-personality.mjs <project-dir> --check` fails — exit non-zero, naming the missing paths — if any of the 26 visual primitives, the 2 behavioral dials, or the emission tokens is unassigned and un-hinted. Only once it is green does `derive-personality.mjs <project-dir> --emit <project-dir>` write both files (into `<project-dir>/src/styles/`), defining the full surface — 26 primitives, 17 semantic tokens, and the 17 substrate tokens no consumable value is left to fall back to gray on — and hardening both cascade contracts (selector specificity, import order) with explanatory comments. See [personality.md](./personality.md).
+**Work.** Derivation is hybrid: deterministic where the artifact states a value, judgment-with-recorded-rationale for gaps (a resolved hint records its rationale in the token's `$description`). Before any typography hint is resolved, `data/combinations/typography.csv` is in context; before any color hint, `palettes.csv` **and `accent-presets.md`** — the routed-consult contract. The look's theme filters the consult: a `dark` look narrows the palette pool to dark-capable rows (`theme` column `dark` / `both`), and composing a dark look from a light-only row is off-table and needs a recorded reason. The taste profile sits in context beside the rows, biasing the pick. The table is the floor for the resolution, and an off-table pairing or palette is allowed only with its stated reason recorded in the token's `$description`. The **coverage gate** `derive-personality.mjs <project-dir> --check` fails — exit non-zero, naming the missing paths — if any of the 26 visual primitives, the 2 behavioral dials, or the emission tokens is unassigned and un-hinted. Only once it is green does `derive-personality.mjs <project-dir> --emit <project-dir>` write both files (into `<project-dir>/src/styles/`), defining the full surface — 27 primitives, 17 semantic tokens, and the 17 substrate tokens no consumable value is left to fall back to gray on — and hardening both cascade contracts (selector specificity, import order) with explanatory comments. See [personality.md](./personality.md).
 **Gate — `phase-gate.mjs tokens`.** The coverage gate passed and both files carry the full token surface with the cascade-contract comments intact.
 **Avoid.**
 - Emitting before the coverage gate passes.
@@ -82,6 +113,8 @@ The gate closing each phase runs the D21 rule classes decidable at that boundary
 **In → out.** the state-shells · the fixtures · the emitted tokens · the archetype exemplar → composed `src/routes/<surface>/` surfaces, every state present.
 **Work.** For each surface, compose in the `@nurix/components` idiom (imported by subpath) against the resolved tokens — the look comes entirely from the cascade, never from literals. Fill every lifecycle state into its pre-created shell; states are composed with the surface, not bolted on after. AI-bearing surfaces clear the [trust rubric](../data/operator-pack/trust-rubric.md); microcopy follows the error and empty-state formulas in [lifecycle.md](./lifecycle.md); keyboard and focus discipline follow [interaction.md](./interaction.md).
 
+> **The budget is a grant, not only a ban.** Read each surface's stamped delight budget ([structure.md](./structure.md), the delight budget) as permission, not just a ceiling: a brand-forward dashboard *uses* the display step on its focal metric, an elevation lift on its hero card, an arrival stagger on its rows — a page of uniform 14px text ignores its budget. A baseline surface withholds ornament, never signal. The budget grants which vocabulary a surface may consume; the floor holds identically at every budget.
+
 > **Just-in-time exemplar.** Each archetype's token-pure exemplar ([exemplars/](../data/operator-pack/exemplars/)) loads just-in-time at that archetype's emission gate — never at boot — because imitation proximity is highest when the exemplar sits in context at the moment of composition. Composing a surface of archetype X without exemplar X in context is a **gate violation**. Imitate the composition; the look comes from the project's personality.
 
 > **Just-in-time combination tables.** `data/combinations/charts.csv` loads at the emission gate of any surface that composes a chart; `icons.csv` loads once, at the first surface-composition gate — icon picks happen throughout. Each table is the floor for its picks: an off-table chart type or icon is allowed only with its stated reason in a code comment adjacent to the deviating pick. An unrecorded off-table pick is a **gate violation**. Contract: [combinations/Readme.md](../data/combinations/Readme.md).
@@ -92,7 +125,7 @@ The gate closing each phase runs the D21 rule classes decidable at that boundary
 - Composing a chart or picking an icon without its combination table in context — a gate violation.
 - Writing states as an afterthought instead of into the pre-created shells.
 - Emitting a look disjoint from the resolved personality — literals or off-scale values instead of the cascade.
-- Modals where side panels belong; a workflow a pointer alone can complete (floor P3 / P6).
+- Modals where side panels belong; a workflow a pointer alone can complete (floor f03 / f06).
 
 ## verification
 
@@ -102,6 +135,15 @@ The gate closing each phase runs the D21 rule classes decidable at that boundary
 
 ---
 
+## The taste profile — the standing input
+
+A **project taste profile** rides with the consumer project at `docs/design/taste.yml` (beside the judge reports) — per-dimension summaries of the user's expressed taste (`overall`, `typography`, `color`, `density`, `motion`, `dark`), each a short `feel` line plus an `avoid` line. It is **intent, never values**: the token artifact stays the only value transport; the profile biases picks, it never sets them. It is YAML because the file is human-facing intent — prose summaries plus an explanatory header comment.
+
+- **Captured** at intake (look-relevant brief language folds in) and whenever the user reacts to shipped output — an accepted or rejected finding, an improve consent round, a "too showy". The relevant item updates or a new one lands; provenance folds into the prose ("asked twice for tighter headings"), never into machine fields.
+- **Consumed** at resolution (it biases the shortlist pick; the resolution record cites the taste items that drove it) and at the color / type moment (in context beside the seed rows). `judge` critiques against it as a fixed referent.
+- **Reset** serves a deliberate style switch: an explicit flow re-asks the taste questions dimension by dimension and rewrites the items in place. The file is never deleted — switching styles is a re-interview, never a silent fall back to no-profile behavior.
+- **Fail-open.** A missing or malformed `taste.yml` degrades to no-profile behavior with a one-line notice — never a crash, never a block. The profile is a bias; a bias that cannot be read cleanly is simply not applied.
+
 ## The preservation contract
 
 Two disciplines protect what must never silently change.

package/data/harnesses/code/skills/design/references/diagnosis.md

@@ -26,7 +26,7 @@ Eight fields, fixed. Every finding carries all eight, machine or judged.
 
 - **dimension** — which of the sixteen. Names *what* is wrong.
 - **cause layer** — Structure, Behavior, or Perception. Names *where the fix lives* — the meta-layer of the root, which often differs from the dimension's own layer (a felt Perception problem rooted in a Structure fact).
-- **evidence** — the anchor in the code: `file:line`, a token name, or a measured value. Never a vibe.
+- **evidence** — the anchor in the code: `file:line`, a token name, or a measured value; for a rendered-evidence finding (a `judge` run — [improve.md](improve.md)), a screenshot path + the region within it (`shots/1440.png · header row, right cluster`). Never a vibe.
 - **before → after** — the current state → the corrected state. Numeric where machine-backed (a value → its threshold); a concrete, measurable state change where judged. Never "make it cleaner."
 - **consequence** — what it costs the operator: lost throughput, eroded trust, an unreadable figure, an irreversible mistake.
 - **tier** — `within-levers` (fixable inside the current lever manifest) or `lever-change` (needs a manifest change). The [improve.md](improve.md) jail reads this.
@@ -77,7 +77,7 @@ The render rung computes deterministic numbers (`inst-*`) over the rendered surf
 
 The load-bearing caution: **dense operator surfaces are dense on purpose.** "Lower visual complexity ⇒ better" was refuted 0–3 in adversarial verification; on an information-dense surface the sign of "good" can invert. A high instrument number is a prompt to *look*, never proof of a problem, and a threshold is never derived from an exemplar (circular). Start with edge density — cheapest, best-documented — and treat every reading as a signal.
 
-**KLM operator-cost** (`inst-11`): a comparative throughput diagnosis, not ground truth. Sum the typed operators over a fixed core-loop path with the published constants — **P (point) 1.10s · H (home hand between keyboard and mouse) 0.40s · M (mental prep) 1.35s · K (keystroke) 0.20–0.28s** — counting clicks, keystrokes, tab-stops, and hand-homings. It compares two paths (before a redesign vs after, path A vs path B), pairing with the entity/surface map's core loop ([structure.md](structure.md)) and floor P1's throughput-first metric. It is a cost *model*: path selection is judgment, so the number is evidence for a judged B1/B4 finding, never a verdict.
+**KLM operator-cost** (`inst-11`): a comparative throughput diagnosis, not ground truth. Sum the typed operators over a fixed core-loop path with the published constants — **P (point) 1.10s · H (home hand between keyboard and mouse) 0.40s · M (mental prep) 1.35s · K (keystroke) 0.20–0.28s** — counting clicks, keystrokes, tab-stops, and hand-homings. It compares two paths (before a redesign vs after, path A vs path B), pairing with the entity/surface map's core loop ([structure.md](structure.md)) and floor f01's throughput-first metric. It is a cost *model*: path selection is judgment, so the number is evidence for a judged B1/B4 finding, never a verdict.
 
 ## The AI-surface trust rubric
 
@@ -91,7 +91,7 @@ Quality is the skill's burden, never the user's — so decay is *observed*, not
 2. **Judged findings recurring across runs** — the same judged finding reappears on a later run, evidence the guidance is not being absorbed.
 3. **Guidance fought or produced wrong output** — the agent resisted a rule, or following the guidance yielded a worse result or collided with the user's workload.
 
-The ledger is **maintainer-facing telemetry, not runtime state** — the emitted UI stays the only design record (floor P8). The skill never reads it back and **never self-modifies**. The maintainer reads it, diagnoses whether the failure is the skill's design or the project's circumstances, and closes it by hand — updating the skill, or going back to the user.
+The ledger is **maintainer-facing telemetry, not runtime state** — the emitted UI stays the only design record (floor f08). The skill never reads it back and **never self-modifies**. The maintainer reads it, diagnoses whether the failure is the skill's design or the project's circumstances, and closes it by hand — updating the skill, or going back to the user.
 
 Entries are **dated, factual, and human-closed** — append-only, oldest at bottom:
 

package/data/harnesses/code/skills/design/references/hard-rules.md

@@ -4,16 +4,33 @@ The hard-prose channel: every machine ban, deterministic threshold, and mandator
 
 The backticked anchor id is the shared key: the same id names the `rules.csv` row, the check-engine rule key, the fixture pair, and a finding's provenance. Machine rules are absolute — a violation is fixed now, or classified as inapplicable in `docs/memory/design-decay.md`; never ignored silently. No waivers, no inline suppressions. Lines tagged `· render` are decided on the rendered surface at the render rung (pixels or DOM), not from source at edit time. Judged dimensions are diagnosed, not gated — the index at the foot points at where their judgment lives.
 
+## Doctrine floor
+
+The twelve fixed principles the rule families below serve — the canonical in-skill enumeration. Nothing overrides them: expressiveness is granted by the per-surface delight budget *inside* the floor, never as an exception to it. Cite a principle by its id.
+
+- Throughput vs delight is weighed per surface (`f01`).
+- Empty states are text-first (`f02`).
+- Side panels over modals (`f03`).
+- Numbers are tabular (`f04`).
+- One accent is the default (`f05`).
+- Keyboard-first (`f06`).
+- Semantic token classes only (`f07`).
+- State persists in emitted code (`f08`).
+- Wrong-fit briefs are refused cleanly (`f09`).
+- The substrate is Tailwind + shadcn-flavor only (`f10`).
+- A modular SKILL.md router with lazy references (`f11`).
+- Vocabulary is a business call (`f12`).
+
 ## Typography
 
 - `typ-01` Body text contrast ≥ 4.5:1; large text ≥ 3:1. · render
 - `typ-02` Body ≥ 14px on operator surfaces; never below 11px anywhere.
 - `typ-03` Form inputs ≥ 16px on touch/mobile surfaces; desktop operator inputs exempt.
 - `typ-05` Prose measure 45–75ch; tables exempt.
-- `typ-06` ≤ 2 font families per app; type scale holds ~6 distinct sizes.
+- `typ-06` ≤ 3 font families per app, each with a distinct job (display / body / numeric-mono); a fourth family is banned. Type scale holds the declared ramp's steps (≤ 7).
 - `typ-07` Tabular lining numerals (`font-variant-numeric`) on every numeric column, KPI, timer, ID.
 - `typ-08` All-caps micro-labels: letter-spacing ≥ 0.02em (caps band 0.05–0.12em); tracking never below −0.04em.
-- `typ-09` Font sizes from a fixed rem scale (step ratio 1.125–1.2); ban `vw`/`vh`/`clamp` on font-size; operator surfaces.
+- `typ-09` Font sizes from a fixed rem scale (step ratio 1.125–1.2) — the fixed scale is the declared ramp's emitted utilities (`text-h1` … `text-display`), not merely *a* scale; ban `vw`/`vh`/`clamp` on font-size; operator surfaces.
 - `typ-10` Adjacent type-scale steps ≥ 25% apart.
 - `typ-11` No UI font weight below 400.
 - `typ-12` Never size type in `em`; px or rem only.
@@ -22,6 +39,7 @@ The backticked anchor id is the shared key: the same id names the `rules.csv` ro
 - `typ-16` Ban serif faces in dashboards and software UIs.
 - `typ-18` Uppercase-tracking (eyebrow/micro-label) instances ≤ ceil(sectionCount/3).
 - `typ-19` Code/mono type fixed at 16px; long lines scroll horizontally, never wrap.
+- `typ-20` The `display` ramp step appears only on surfaces stamped `brand-forward`; ≤ 1 display-step element per surface.
 
 ## Color
 
@@ -37,6 +55,7 @@ The backticked anchor id is the shared key: the same id names the `rules.csv` ro
 - `col-10` Modal scrim 40–60% black.
 - `col-13` Semantic price/status colors are text-only, never fills; never repurposed for generic success or error.
 - `col-14` Data-viz: lines/bars ≥ 3:1 vs background; data labels ≥ 4.5:1. · render
+- `col-16` A wash token (`--wash-*`) is consumed only on `brand-forward`-stamped surfaces; wash stops obey the slop ban (`col-12` vocabulary).
 
 ## Spatial
 
@@ -50,6 +69,7 @@ The backticked anchor id is the shared key: the same id names the `rules.csv` ro
 - `spc-09` Ban calc-percentage layout arithmetic (`calc(33% - 1rem)`); CSS Grid instead.
 - `spc-10` No horizontal scroll at any viewport (375/768/1024/1440); any overflow means broken. · render
 - `spc-15` Grid/bento integrity: N items fill exactly N cells; no orphan corners; spans interlock. · render
+- `spc-16` In fixed-width table/grid cells, rendered text fits the cell — no overlap or clip without a `truncate`/scroll affordance. · render
 
 ## Depth & hierarchy
 
@@ -80,6 +100,7 @@ The backticked anchor id is the shared key: the same id names the `rules.csv` ro
 - `mot-05` Animate only `transform` and `opacity`; never top, left, width, height, or margin.
 - `mot-06` `will-change` only on an in-progress `transform`/`opacity` animation; never blanket, never left dangling.
 - `mot-07` Loading indicators skeleton the content shape; delay 150–300ms; nothing < 500ms, spinner/skeleton 500ms–2s, progress bar > 2s.
+- `mot-08` Stagger rides the `stagger-unit` token: 0–60ms per item, ≤ 8 children, total sequence < 1s (child count and total confirmed on the DOM at the render rung). Baseline-stamped surfaces skip arrival cascades; brand-forward surfaces may run `motion-stagger`.
 - `mot-09` Ban scroll-event listeners for animation (`window.addEventListener('scroll')`); observers or scrubbing only.
 - `mot-10` Ban `useState` for continuous scroll/pointer values; motion values instead. React-scoped.
 
@@ -103,6 +124,8 @@ The backticked anchor id is the shared key: the same id names the `rules.csv` ro
 - `cod-09` Component line ceilings: < 120 ln table, < 80 ln section; never modify files outside scope.
 - `cod-11` Every emitted component exports a typed Props interface; no HTML tags in React Native output.
 - `cod-12` Runtime budgets: LCP < 2.5s, INP < 200ms, CLS < 0.1, 16ms frame. · render
+- `cod-15` Per-theme rendered token drift: under each theme context the resolver declares, rendered `--background`/`--foreground`/`--primary` equal that context's authored values. · render
+- `cod-16` Every family name in an emitted font stack binds to an installed package's registered family or a system generic (fail-closed at `--emit`).
 
 ## Mandatory procedures (never skip)
 
@@ -144,7 +167,6 @@ Not gated — diagnosed. Each names what the judgment covers; the mechanics live
 - `int-15` Virtualize lists ≥ 50 items; bounded/paginated lists exempt.
 - `int-16` Tactile press feedback (−1px translateY / scale 0.98, < 100–150ms); suppressed under reduced-motion.
 - `mot-02` Per-interaction reference durations (button 100 / hover 150 / tooltip 200 / tab 250 / modal 300 / page 400ms) — reference, not a ban.
-- `mot-08` Stagger 30–50ms/item, cap ~8 children, total < 1s; operator surfaces skip orchestration.
 - `mot-11` Exit 60–70% of enter; press scale 0.95–1.05; ≤ 1–2 animated elements per view.
 - `sta-04` Errors render inline near the field, not banner-only; system-wide failures may banner.
 - `sta-06` Empty-state taxonomy: first-time / user-cleared / no-results / no-access / error, distinct copy each.

package/data/harnesses/code/skills/design/references/improve.md

@@ -2,7 +2,7 @@
 
 > Loaded when the front gate routes to improve. Pairs with [diagnosis.md](diagnosis.md) (the finding source and format) and closes at the same machine-check wall create's gates enforce. Improve is every change to a UI that **already exists**; [create.md](create.md) owns the case where nothing does.
 
-Improve is one engine, not a set of commands. Every improvement — a review, a polish, a full redesign, a typography-only pass — is the same engine run at a different point on three axes. The familiar verbs are parameter bindings, not sibling workflows: there is no `review.md`, no `redesign.md`.
+Improve is one engine, not a set of commands. Every improvement — a review, a polish, a full redesign, a typography-only pass, a rendered judgment — is the same engine run at a different point on three axes. The familiar verbs are parameter bindings, not sibling workflows: there is no `review.md`, no `redesign.md`, no `judge.md`.
 
 ## The three axes
 
@@ -22,14 +22,15 @@ Bindings over the engine, in one table. Never restated as separate files.
 | `polish` | whole app | apply | jailed | Fix everything reachable inside the current levers. |
 | `redesign` | whole app | apply | lever-consent | Apply the consented lever changes, then polish within the new manifest. |
 | `typeset` | `P1 Typography` | apply | jailed | Apply, scoped to the Typography dimension only. |
+| `judge` | whole app (narrowable to a surface) | diagnose-only | jailed | Rank findings from **rendered evidence** — screenshots captured, read back, critiqued (the protocol below); change nothing. |
 
-A narrower or wider pass — one surface, one other dimension — is the same table with the scope cell moved. Bind the parameters; do not author a verb.
+A narrower or wider pass — one surface, one other dimension — is the same table with the scope cell moved. Bind the parameters; do not author a verb. `judge --fix` is sugar, not a fifth row: a `judge` run followed by an apply-depth run over its findings — still jailed to the lever manifest, closing at the same verify sweep as any apply run.
 
 ## The golden rule: jailed to the lever manifest
 
 A design skill improves a UI **using the levers already in it**. Emitting design disjoint from the surrounding UI is a failure, not a style choice.
 
-The project's design-tokens artifact carries the **lever manifest** — the `lever-manifest` in its `$extensions["com.nurix.design"]` payload (spacing scale, radius scale, shadow levels, motion durations/easings, icon family, accent count) plus the token-carried allowlists (the 34 color roles, the font stacks). Read it **first**, before any diagnosis or edit.
+The project's design-tokens artifact carries the **lever manifest** — the `lever-manifest` in its `$extensions["com.nurix.design"]` payload (spacing scale, radius scale, shadow levels, motion durations/easings, icon family, accent count) plus the token-carried allowlists (the 36 color roles, the font stacks). Read it **first**, before any diagnosis or edit.
 
 ### When the UI wasn't built by this skill: extract first
 
@@ -85,3 +86,31 @@ The universal preservation list holds regardless of scope or depth — never sil
 3. **Diagnose-only** → deliver the ranked findings and stop.
 4. **Apply** → edit only the files the findings name, then close at the verify sweep over the touched files, jailed to the manifest.
 5. **Escalate** → report the tier-two findings and offer the consented lever-authority follow-up.
+
+## `judge` — the rendered-evidence preset
+
+The invocable eye. `judge` is the preset row above run over **rendered pixels**: same engine, same jail, same finding format — plus screenshots captured, read back, and critiqued. It ships behind an explicit verb, never as a mandatory create phase; create's pipeline keeps zero model-judged rungs.
+
+The protocol, five steps, in order:
+
+1. **Render.** Reuse the render rung's browser plumbing: `render-rung.mjs --screenshot <outdir>` captures the app's key surfaces at **375 / 768 / 1440** (the rung's sweep also lands 1024 — a captured screenshot is read like any other) — the boot theme, *and* the second theme when the resolver declares a dark context (flip `data-theme`, as the rung's per-theme drift check does). Deterministic waits are the rung's existing settle logic; the PNGs land in a run-scoped temp dir.
+2. **Read back.** Read every captured image into context. **A screenshot you didn't read doesn't count** — describe each surface before critiquing it.
+3. **Critique against the four fixed referents** — never free-floating taste:
+   - **the brief** — does the rendered app serve the stated intent;
+   - **the artifact's `anchors`** — does the gestalt read in the named products' class: would this screenshot sit plausibly in Linear's or Stripe's product family;
+   - **the resolved style row's `checklist`** ([`styles.csv`](../data/combinations/styles.csv)) — the did-the-look-land walk, item by item, always including the standing harmony item: palette, type, and treatment read as one hand;
+   - **the project taste profile** (`docs/design/taste.yml`) — does the rendered app respect the recorded taste items; missing or malformed degrades to no-profile behavior with a one-line notice, as at intake.
+
+   Plus the standing judged dimensions — [diagnosis.md](diagnosis.md)'s taxonomy pass, Perception especially — with the screenshots as the evidence.
+4. **Findings** in the canonical format, verbatim — dimension · cause layer · evidence (now admitting screenshot path + region) · before→after · consequence · tier · severity · provenance — severity-ranked, unscored; fix-or-classify applies. Structure findings still precede Perception: causes-first holds even when the evidence is a pixel.
+5. **File the report.** A judge run always writes a dated findings report — `docs/design/judge-YYYY-MM-DD.md` in the consumer project — so the eye leaves a record even when nothing is applied.
+
+### Boundaries — what judge is not
+
+- **Not a rung.** The verification ladder is unchanged; no machine verdict rests on the model's read of a screenshot; a create run completes without judge ever running. Pixel instruments stay evidence-inside-findings — judge is a *workflow*, subject to the same rule.
+- **Not autonomous escalation.** judge recommends; the user triggers any follow-up — `judge --fix`, a lever-consent run. No regenerate-until-passing.
+- **Not a score.** No numeric grades in findings, ever — run-time scores are false precision; severity ranks plus the mandatory measurable before→after per finding give comparability without pretending decimals. Scores exist only outside the skill: the eval harness computes them from its own panel; the skill never self-scores.
+- **Instruments are evidence, never verdicts — on recorded empirical grounds.** "Lower visual complexity ⇒ higher quality" is refuted for this domain: surfaces that are dense on purpose invert the sign of "good". Computational clutter/aesthetics metrics validate correlationally and modestly — ≤ 49% of human ratings on webpages, ≤ 32% on apps, zero validation on dashboards and CRMs — and a subset are pretrained neural nets, excluded outright as model judgment. So a pixel instrument may be *cited inside* a judged finding and is structurally barred from gating. The two vetted instruments a judge finding reaches for first: **Edge Density** (`inst-01` — Canny edge pixels ÷ total pixels; r≈0.83 with visual-search times, the cheapest proxy for how fast an operator finds a target) and the **Keystroke-Level Model** (`inst-11` — P 1.10s · H 0.40s · M 1.35s · K 0.20–0.28s, summed over the core loop; countable operator-cost evidence for the throughput-vs-delight floor principle, `f01`). The interaction *path* is judgment, so KLM is evidence too, never ground truth.
+- **Degradation.** No headless browser → judge **refuses**, printing the rung's install command (`npm install -D playwright && npx playwright install chromium`) — an eye that cannot see does not judge from memory. It never falls back to source-only critique; source-only is `review`.
+
+Prior art for a future live-variant mode (consent-gated, human present — never a rung): impeccable's identity lock — extract the surface's existing identity into one non-aspirational sentence, then a mandatory squint test that every variant reads as the same brand — with 0–4 tunable `--p-*` parameter knobs per variant; the corpus's only closed taste loop with real eyes on it.

package/data/harnesses/code/skills/design/references/interaction.md

@@ -28,12 +28,12 @@ The **error** state surfaces on blur, never per keystroke (`int-*`), and renders
 - **Visible focus, always.** Every focusable element carries a `:focus-visible` ring driven by the `--ring` token so it follows the look. `outline: none` without a replacement is banned (`int-*`). The ring meets the catalog's contrast and width floor — do not restate it, satisfy it.
 - **Focus order follows task order.** Tab order is the sequence the operator works, not a DOM accident. Composite widgets — tables, listboxes, menus, toolbars — use roving tabindex: the widget is one tab-stop, arrow keys traverse inside it.
 - **Focus is returned on overlay close.** Opening an overlay moves focus into it; closing returns focus to the element that opened it. Focus never drops to the top of the document.
-- **Keyboard path parity.** Every pointer affordance has a keyboard equivalent — nothing is reachable by hover or click alone (floor P6). Hover-revealed row actions carry a focus path (`int-*`). `cursor: pointer` marks every clickable element on the web (`int-*`).
+- **Keyboard path parity.** Every pointer affordance has a keyboard equivalent — nothing is reachable by hover or click alone (floor f06). Hover-revealed row actions carry a focus path (`int-*`). `cursor: pointer` marks every clickable element on the web (`int-*`).
 - **Skip links** jump to the primary work region on any surface with substantial navigation.
 
 ## Overlay policy
 
-Escalate only as far as the interaction demands, cheapest rung first (floor P3):
+Escalate only as far as the interaction demands, cheapest rung first (floor f03):
 
 1. **Inline expansion** — reveal detail in place; no overlay at all.
 2. **Side panel** — detail and edit open *beside* the work, not on top of it (`--side-panel-width` / `--side-panel-width-rich`). This is the default for viewing and editing an entity.
@@ -57,7 +57,7 @@ Match the affordance to the action's reversibility:
 - **Command palette** (`cmdk`) is the power-user's front door — global verbs, entity jump, reachable by a single chord. Expected on any multi-surface operator tool.
 - **Row-level keyboard actions in queues.** A queue row is focusable; the frequent verbs (open, assign, resolve, advance) bind to keys; the kebab overflow is keyboard-reachable, not pointer-only. Roving tabindex moves between rows, and the row's keyboard action set mirrors its pointer menu exactly — no verb is pointer-only.
 - **Tab-stop economics on the core loop.** The operator's core loop ([structure.md](structure.md)) must complete in few keystrokes and homings. Every tab-stop on the hot path is a cost paid per item, per shift — prune stops that do not earn their place, and keep the primary verb one key away.
-- **KLM is the diagnosis lens, not a gate.** Counting the keystrokes, pointer homings, and mental operators of a fixed core-loop path (the Keystroke-Level Model) turns "this feels slow" into a number. It rides [diagnosis.md](diagnosis.md) as a judged instrument against floor P1's throughput metric — evidence inside a finding, never a machine verdict.
+- **KLM is the diagnosis lens, not a gate.** Counting the keystrokes, pointer homings, and mental operators of a fixed core-loop path (the Keystroke-Level Model) turns "this feels slow" into a number. It rides [diagnosis.md](diagnosis.md) as a judged instrument against floor f01's throughput metric — evidence inside a finding, never a machine verdict.
 
 ## Assistive floors beyond keyboard
 

package/data/harnesses/code/skills/design/references/introspect.md

@@ -58,7 +58,7 @@ Every run files a dated report — introspection doubles as documentation, so a
 docs/design/findings/YYYY-MM-DD-<slug>.md
 ```
 
-`<slug>` names the target (the surface, or the app). The report carries the canonical findings so a consented improve run consumes it directly, topped with a two-line executive summary in the chosen register. It is a deliverable, not runtime state — never read back as design state (code is the cache, floor P8).
+`<slug>` names the target (the surface, or the app). The report carries the canonical findings so a consented improve run consumes it directly, topped with a two-line executive summary in the chosen register. It is a deliverable, not runtime state — never read back as design state (code is the cache, floor f08).
 
 ### Template
 

package/data/harnesses/code/skills/design/references/lifecycle.md

@@ -6,7 +6,7 @@ The states a surface actually lives in, and the microcopy mechanisms that fill t
 
 ## The seam: mechanisms, not words
 
-Everything here is a **mechanism** — a formula, a required shape, a consistency discipline. The actual words are the business's call (floor P12). The skill enforces that an error names what happened / why / how to fix; it never writes the error text. It enforces one term per concept; it never picks the term. Emit shells and shapes; leave the vocabulary to the domain.
+Everything here is a **mechanism** — a formula, a required shape, a consistency discipline. The actual words are the business's call (floor f12). The skill enforces that an error names what happened / why / how to fix; it never writes the error text. It enforces one term per concept; it never picks the term. Emit shells and shapes; leave the vocabulary to the domain.
 
 ## Required states per surface
 
@@ -33,7 +33,7 @@ An empty state is not one state. Five are distinct, and each earns distinct copy
 | no-access | forbidden, not empty | that it exists but is gated, who to ask |
 | error | the fetch failed | routes to the error formula below, never to "empty" |
 
-**The empty formula: acknowledge → state the value → at most one action.** Text-first (floor P2) — copy plus at most one action, never an illustration showcase. *At most* one, not exactly one: a read-only surface (an audit log) legitimately offers zero. Never a dead-end on an actionable surface. Copy runs one to two sentences.
+**The empty formula: acknowledge → state the value → at most one action.** Text-first (floor f02) — copy plus at most one action, never an illustration showcase. *At most* one, not exactly one: a read-only surface (an audit log) legitimately offers zero. Never a dead-end on an actionable surface. Copy runs one to two sentences.
 
 ## Errors